100 files changed, 4662 insertions, 1397 deletions
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index 284cf3433720..5760c1a4b3f6 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -304,9 +304,6 @@ config MTD_OOPS
          buffer in a flash partition where it can be read back at some
          later point.
-          To use, add console=ttyMTDx to the kernel command line,
-          where x is the MTD device number to use.
 config MTD_SWAP
        tristate "Swap on MTD device support"
        depends on MTD && SWAP
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 9bcd1f415f43..dbbd2edfb812 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -87,7 +87,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **
 static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
                     size_t *retlen, void **virt, resource_size_t *phys);
-static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
+static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
@@ -262,9 +262,9 @@ static void fixup_st_m28w320cb(struct mtd_info *mtd)
 static void fixup_use_point(struct mtd_info *mtd)
 {
        struct map_info *map = mtd->priv;
-        if (!mtd->point && map_is_linear(map)) {
+        if (!mtd->_point && map_is_linear(map)) {
-                mtd->point   = cfi_intelext_point;
+                mtd->_point   = cfi_intelext_point;
-                mtd->unpoint = cfi_intelext_unpoint;
+                mtd->_unpoint = cfi_intelext_unpoint;
        }
 }
@@ -274,8 +274,8 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
        struct cfi_private *cfi = map->fldrv_priv;
        if (cfi->cfiq->BufWriteTimeoutTyp) {
                printk(KERN_INFO "Using buffer write method\n" );
-                mtd->write = cfi_intelext_write_buffers;
+                mtd->_write = cfi_intelext_write_buffers;
-                mtd->writev = cfi_intelext_writev;
+                mtd->_writev = cfi_intelext_writev;
        }
 }
@@ -443,15 +443,15 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
        mtd->type = MTD_NORFLASH;
        /* Fill in the default mtd operations */
-        mtd->erase   = cfi_intelext_erase_varsize;
+        mtd->_erase   = cfi_intelext_erase_varsize;
-        mtd->read    = cfi_intelext_read;
+        mtd->_read    = cfi_intelext_read;
-        mtd->write   = cfi_intelext_write_words;
+        mtd->_write   = cfi_intelext_write_words;
-        mtd->sync    = cfi_intelext_sync;
+        mtd->_sync    = cfi_intelext_sync;
-        mtd->lock    = cfi_intelext_lock;
+        mtd->_lock    = cfi_intelext_lock;
-        mtd->unlock  = cfi_intelext_unlock;
+        mtd->_unlock  = cfi_intelext_unlock;
-        mtd->is_locked = cfi_intelext_is_locked;
+        mtd->_is_locked = cfi_intelext_is_locked;
-        mtd->suspend = cfi_intelext_suspend;
+        mtd->_suspend = cfi_intelext_suspend;
-        mtd->resume  = cfi_intelext_resume;
+        mtd->_resume  = cfi_intelext_resume;
        mtd->flags   = MTD_CAP_NORFLASH;
        mtd->name    = map->name;
        mtd->writesize = 1;
@@ -600,12 +600,12 @@ static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
        }
 #ifdef CONFIG_MTD_OTP
-        mtd->read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
+        mtd->_read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
-        mtd->read_user_prot_reg = cfi_intelext_read_user_prot_reg;
+        mtd->_read_user_prot_reg = cfi_intelext_read_user_prot_reg;
-        mtd->write_user_prot_reg = cfi_intelext_write_user_prot_reg;
+        mtd->_write_user_prot_reg = cfi_intelext_write_user_prot_reg;
-        mtd->lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
+        mtd->_lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
-        mtd->get_fact_prot_info = cfi_intelext_get_fact_prot_info;
+        mtd->_get_fact_prot_info = cfi_intelext_get_fact_prot_info;
-        mtd->get_user_prot_info = cfi_intelext_get_user_prot_info;
+        mtd->_get_user_prot_info = cfi_intelext_get_user_prot_info;
 #endif
        /* This function has the potential to distort the reality
@@ -1017,8 +1017,6 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
        case FL_READY:
        case FL_STATUS:
        case FL_JEDEC_QUERY:
-                /* We should really make set_vpp() count, rather than doing this */
-                DISABLE_VPP(map);
                break;
        default:
                printk(KERN_ERR "%s: put_chip() called with oldstate %d!!\n", map->name, chip->oldstate);
@@ -1324,7 +1322,7 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
        int chipnum;
        int ret = 0;
-        if (!map->virt || (from + len > mtd->size))
+        if (!map->virt)
                return -EINVAL;
        /* Now lock the chip(s) to POINT state */
@@ -1334,7 +1332,6 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
        ofs = from - (chipnum << cfi->chipshift);
        *virt = map->virt + cfi->chips[chipnum].start + ofs;
-        *retlen = 0;
        if (phys)
                *phys = map->phys + cfi->chips[chipnum].start + ofs;
@@ -1369,12 +1366,12 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
        return 0;
 }
-static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
        struct map_info *map = mtd->priv;
        struct cfi_private *cfi = map->fldrv_priv;
        unsigned long ofs;
-        int chipnum;
+        int chipnum, err = 0;
        /* Now unlock the chip(s) POINT state */
@@ -1382,7 +1379,7 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
        chipnum = (from >> cfi->chipshift);
        ofs = from - (chipnum <<  cfi->chipshift);
-        while (len) {
+        while (len && !err) {
                unsigned long thislen;
                struct flchip *chip;
@@ -1400,8 +1397,10 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                        chip->ref_point_counter--;
                        if(chip->ref_point_counter == 0)
                                chip->state = FL_READY;
-                } else
+                } else {
-                        printk(KERN_ERR "%s: Warning: unpoint called on non pointed region\n", map->name); /* Should this give an error? */
+                        printk(KERN_ERR "%s: Error: unpoint called on non pointed region\n", map->name);
+                        err = -EINVAL;
+                }
                put_chip(map, chip, chip->start);
                mutex_unlock(&chip->mutex);
@@ -1410,6 +1409,8 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                ofs = 0;
                chipnum++;
        }
+        return err;
 }
 static inline int do_read_onechip(struct map_info *map, struct flchip *chip, loff_t adr, size_t len, u_char *buf)
@@ -1456,8 +1457,6 @@ static int cfi_intelext_read (struct mtd_info *mtd, loff_t from, size_t len, siz
        chipnum = (from >> cfi->chipshift);
        ofs = from - (chipnum <<  cfi->chipshift);
-        *retlen = 0;
        while (len) {
                unsigned long thislen;
@@ -1551,7 +1550,8 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
        }
        xip_enable(map, chip, adr);
- out:   put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
        return ret;
 }
@@ -1565,10 +1565,6 @@ static int cfi_intelext_write_words (struct mtd_info *mtd, loff_t to , size_t le
        int chipnum;
        unsigned long ofs;
-        *retlen = 0;
-        if (!len)
-                return 0;
        chipnum = to >> cfi->chipshift;
        ofs = to  - (chipnum << cfi->chipshift);
@@ -1794,7 +1790,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        }
        xip_enable(map, chip, cmd_adr);
- out:   put_chip(map, chip, cmd_adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, cmd_adr);
        mutex_unlock(&chip->mutex);
        return ret;
 }
@@ -1813,7 +1810,6 @@ static int cfi_intelext_writev (struct mtd_info *mtd, const struct kvec *vecs,
        for (i = 0; i < count; i++)
                len += vecs[i].iov_len;
-        *retlen = 0;
        if (!len)
                return 0;
@@ -1932,6 +1928,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
                        ret = -EIO;
                } else if (chipstatus & 0x20 && retries--) {
                        printk(KERN_DEBUG "block erase failed at 0x%08lx: status 0x%lx. Retrying...\n", adr, chipstatus);
+                        DISABLE_VPP(map);
                        put_chip(map, chip, adr);
                        mutex_unlock(&chip->mutex);
                        goto retry;
@@ -1944,7 +1941,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        }
        xip_enable(map, chip, adr);
- out:   put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
        return ret;
 }
@@ -2086,7 +2084,8 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
        }
        xip_enable(map, chip, adr);
-out:    put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
        return ret;
 }
@@ -2483,7 +2482,7 @@ static int cfi_intelext_suspend(struct mtd_info *mtd)
                           allowed to. Or should we return -EAGAIN, because the upper layers
                           ought to have already shut down anything which was using the device
                           anyway? The latter for now. */
-                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->oldstate);
+                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->state);
                        ret = -EAGAIN;
                case FL_PM_SUSPENDED:
                        break;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 8d70895a58d6..d02592e6a0f0 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -59,6 +59,9 @@ static void cfi_amdstd_resume (struct mtd_info *);
 static int cfi_amdstd_reboot(struct notifier_block *, unsigned long, void *);
 static int cfi_amdstd_secsi_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
+static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
+                                  size_t *retlen, const u_char *buf);
 static void cfi_amdstd_destroy(struct mtd_info *);
 struct mtd_info *cfi_cmdset_0002(struct map_info *, int);
@@ -189,7 +192,7 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
        struct cfi_private *cfi = map->fldrv_priv;
        if (cfi->cfiq->BufWriteTimeoutTyp) {
                pr_debug("Using buffer write method\n" );
-                mtd->write = cfi_amdstd_write_buffers;
+                mtd->_write = cfi_amdstd_write_buffers;
        }
 }
@@ -228,8 +231,8 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd)
 static void fixup_use_secsi(struct mtd_info *mtd)
 {
        /* Setup for chips with a secsi area */
-        mtd->read_user_prot_reg = cfi_amdstd_secsi_read;
+        mtd->_read_user_prot_reg = cfi_amdstd_secsi_read;
-        mtd->read_fact_prot_reg = cfi_amdstd_secsi_read;
+        mtd->_read_fact_prot_reg = cfi_amdstd_secsi_read;
 }
 static void fixup_use_erase_chip(struct mtd_info *mtd)
@@ -238,7 +241,7 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
        struct cfi_private *cfi = map->fldrv_priv;
        if ((cfi->cfiq->NumEraseRegions == 1) &&
                ((cfi->cfiq->EraseRegionInfo[0] & 0xffff) == 0)) {
-                mtd->erase = cfi_amdstd_erase_chip;
+                mtd->_erase = cfi_amdstd_erase_chip;
        }
 }
@@ -249,8 +252,8 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
 */
 static void fixup_use_atmel_lock(struct mtd_info *mtd)
 {
-        mtd->lock = cfi_atmel_lock;
+        mtd->_lock = cfi_atmel_lock;
-        mtd->unlock = cfi_atmel_unlock;
+        mtd->_unlock = cfi_atmel_unlock;
        mtd->flags |= MTD_POWERUP_LOCK;
 }
@@ -429,12 +432,12 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
        mtd->type = MTD_NORFLASH;
        /* Fill in the default mtd operations */
-        mtd->erase   = cfi_amdstd_erase_varsize;
+        mtd->_erase   = cfi_amdstd_erase_varsize;
-        mtd->write   = cfi_amdstd_write_words;
+        mtd->_write   = cfi_amdstd_write_words;
-        mtd->read    = cfi_amdstd_read;
+        mtd->_read    = cfi_amdstd_read;
-        mtd->sync    = cfi_amdstd_sync;
+        mtd->_sync    = cfi_amdstd_sync;
-        mtd->suspend = cfi_amdstd_suspend;
+        mtd->_suspend = cfi_amdstd_suspend;
-        mtd->resume  = cfi_amdstd_resume;
+        mtd->_resume  = cfi_amdstd_resume;
        mtd->flags   = MTD_CAP_NORFLASH;
        mtd->name    = map->name;
        mtd->writesize = 1;
@@ -443,6 +446,7 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
        pr_debug("MTD %s(): write buffer size %d\n", __func__,
                        mtd->writebufsize);
+        mtd->_panic_write = cfi_amdstd_panic_write;
        mtd->reboot_notifier.notifier_call = cfi_amdstd_reboot;
        if (cfi->cfi_mode==CFI_MODE_CFI){
@@ -770,8 +774,6 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
        case FL_READY:
        case FL_STATUS:
-                /* We should really make set_vpp() count, rather than doing this */
-                DISABLE_VPP(map);
                break;
        default:
                printk(KERN_ERR "MTD: put_chip() called with oldstate %d!!\n", chip->oldstate);
@@ -1013,13 +1015,9 @@ static int cfi_amdstd_read (struct mtd_info *mtd, loff_t from, size_t len, size_
        int ret = 0;
        /* ofs: offset within the first chip that the first read should start */
        chipnum = (from >> cfi->chipshift);
        ofs = from - (chipnum <<  cfi->chipshift);
-        *retlen = 0;
        while (len) {
                unsigned long thislen;
@@ -1097,16 +1095,11 @@ static int cfi_amdstd_secsi_read (struct mtd_info *mtd, loff_t from, size_t len,
        int chipnum;
        int ret = 0;
        /* ofs: offset within the first chip that the first read should start */
        /* 8 secsi bytes per chip */
        chipnum=from>>3;
        ofs=from & 7;
-        *retlen = 0;
        while (len) {
                unsigned long thislen;
@@ -1234,6 +1227,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
        xip_enable(map, chip, adr);
 op_done:
        chip->state = FL_READY;
+        DISABLE_VPP(map);
        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
@@ -1251,10 +1245,6 @@ static int cfi_amdstd_write_words(struct mtd_info *mtd, loff_t to, size_t len,
        unsigned long ofs, chipstart;
        DECLARE_WAITQUEUE(wait, current);
-        *retlen = 0;
-        if (!len)
-                return 0;
        chipnum = to >> cfi->chipshift;
        ofs = to  - (chipnum << cfi->chipshift);
        chipstart = cfi->chips[chipnum].start;
@@ -1476,6 +1466,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        ret = -EIO;
 op_done:
        chip->state = FL_READY;
+        DISABLE_VPP(map);
        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
@@ -1493,10 +1484,6 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
        int chipnum;
        unsigned long ofs;
-        *retlen = 0;
-        if (!len)
-                return 0;
        chipnum = to >> cfi->chipshift;
        ofs = to  - (chipnum << cfi->chipshift);
@@ -1562,6 +1549,238 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
        return 0;
 }
+/*
+ * Wait for the flash chip to become ready to write data
+ *
+ * This is only called during the panic_write() path. When panic_write()
+ * is called, the kernel is in the process of a panic, and will soon be
+ * dead. Therefore we don't take any locks, and attempt to get access
+ * to the chip as soon as possible.
+ */
+static int cfi_amdstd_panic_wait(struct map_info *map, struct flchip *chip,
+                                 unsigned long adr)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int retries = 10;
+        int i;
+        /*
+         * If the driver thinks the chip is idle, and no toggle bits
+         * are changing, then the chip is actually idle for sure.
+         */
+        if (chip->state == FL_READY && chip_ready(map, adr))
+                return 0;
+        /*
+         * Try several times to reset the chip and then wait for it
+         * to become idle. The upper limit of a few milliseconds of
+         * delay isn't a big problem: the kernel is dying anyway. It
+         * is more important to save the messages.
+         */
+        while (retries > 0) {
+                const unsigned long timeo = (HZ / 1000) + 1;
+                /* send the reset command */
+                map_write(map, CMD(0xF0), chip->start);
+                /* wait for the chip to become ready */
+                for (i = 0; i < jiffies_to_usecs(timeo); i++) {
+                        if (chip_ready(map, adr))
+                                return 0;
+                        udelay(1);
+                }
+        }
+        /* the chip never became ready */
+        return -EBUSY;
+}
+/*
+ * Write out one word of data to a single flash chip during a kernel panic
+ *
+ * This is only called during the panic_write() path. When panic_write()
+ * is called, the kernel is in the process of a panic, and will soon be
+ * dead. Therefore we don't take any locks, and attempt to get access
+ * to the chip as soon as possible.
+ *
+ * The implementation of this routine is intentionally similar to
+ * do_write_oneword(), in order to ease code maintenance.
+ */
+static int do_panic_write_oneword(struct map_info *map, struct flchip *chip,
+                                  unsigned long adr, map_word datum)
+{
+        const unsigned long uWriteTimeout = (HZ / 1000) + 1;
+        struct cfi_private *cfi = map->fldrv_priv;
+        int retry_cnt = 0;
+        map_word oldd;
+        int ret = 0;
+        int i;
+        adr += chip->start;
+        ret = cfi_amdstd_panic_wait(map, chip, adr);
+        if (ret)
+                return ret;
+        pr_debug("MTD %s(): PANIC WRITE 0x%.8lx(0x%.8lx)\n",
+                        __func__, adr, datum.x[0]);
+        /*
+         * Check for a NOP for the case when the datum to write is already
+         * present - it saves time and works around buggy chips that corrupt
+         * data at other locations when 0xff is written to a location that
+         * already contains 0xff.
+         */
+        oldd = map_read(map, adr);
+        if (map_word_equal(map, oldd, datum)) {
+                pr_debug("MTD %s(): NOP\n", __func__);
+                goto op_done;
+        }
+        ENABLE_VPP(map);
+retry:
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xA0, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
+        map_write(map, datum, adr);
+        for (i = 0; i < jiffies_to_usecs(uWriteTimeout); i++) {
+                if (chip_ready(map, adr))
+                        break;
+                udelay(1);
+        }
+        if (!chip_good(map, adr, datum)) {
+                /* reset on all failures. */
+                map_write(map, CMD(0xF0), chip->start);
+                /* FIXME - should have reset delay before continuing */
+                if (++retry_cnt <= MAX_WORD_RETRIES)
+                        goto retry;
+                ret = -EIO;
+        }
+op_done:
+        DISABLE_VPP(map);
+        return ret;
+}
+/*
+ * Write out some data during a kernel panic
+ *
+ * This is used by the mtdoops driver to save the dying messages from a
+ * kernel which has panic'd.
+ *
+ * This routine ignores all of the locking used throughout the rest of the
+ * driver, in order to ensure that the data gets written out no matter what
+ * state this driver (and the flash chip itself) was in when the kernel crashed.
+ *
+ * The implementation of this routine is intentionally similar to
+ * cfi_amdstd_write_words(), in order to ease code maintenance.
+ */
+static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
+                                  size_t *retlen, const u_char *buf)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        unsigned long ofs, chipstart;
+        int ret = 0;
+        int chipnum;
+        chipnum = to >> cfi->chipshift;
+        ofs = to - (chipnum << cfi->chipshift);
+        chipstart = cfi->chips[chipnum].start;
+        /* If it's not bus aligned, do the first byte write */
+        if (ofs & (map_bankwidth(map) - 1)) {
+                unsigned long bus_ofs = ofs & ~(map_bankwidth(map) - 1);
+                int i = ofs - bus_ofs;
+                int n = 0;
+                map_word tmp_buf;
+                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], bus_ofs);
+                if (ret)
+                        return ret;
+                /* Load 'tmp_buf' with old contents of flash */
+                tmp_buf = map_read(map, bus_ofs + chipstart);
+                /* Number of bytes to copy from buffer */
+                n = min_t(int, len, map_bankwidth(map) - i);
+                tmp_buf = map_word_load_partial(map, tmp_buf, buf, i, n);
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             bus_ofs, tmp_buf);
+                if (ret)
+                        return ret;
+                ofs += n;
+                buf += n;
+                (*retlen) += n;
+                len -= n;
+                if (ofs >> cfi->chipshift) {
+                        chipnum++;
+                        ofs = 0;
+                        if (chipnum == cfi->numchips)
+                                return 0;
+                }
+        }
+        /* We are now aligned, write as much as possible */
+        while (len >= map_bankwidth(map)) {
+                map_word datum;
+                datum = map_word_load(map, buf);
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             ofs, datum);
+                if (ret)
+                        return ret;
+                ofs += map_bankwidth(map);
+                buf += map_bankwidth(map);
+                (*retlen) += map_bankwidth(map);
+                len -= map_bankwidth(map);
+                if (ofs >> cfi->chipshift) {
+                        chipnum++;
+                        ofs = 0;
+                        if (chipnum == cfi->numchips)
+                                return 0;
+                        chipstart = cfi->chips[chipnum].start;
+                }
+        }
+        /* Write the trailing bytes if any */
+        if (len & (map_bankwidth(map) - 1)) {
+                map_word tmp_buf;
+                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], ofs);
+                if (ret)
+                        return ret;
+                tmp_buf = map_read(map, ofs + chipstart);
+                tmp_buf = map_word_load_partial(map, tmp_buf, buf, 0, len);
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             ofs, tmp_buf);
+                if (ret)
+                        return ret;
+                (*retlen) += len;
+        }
+        return 0;
+}
 /*
 * Handle devices with one erase region, that only implement
@@ -1649,6 +1868,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
        chip->state = FL_READY;
        xip_enable(map, chip, adr);
+        DISABLE_VPP(map);
        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
@@ -1739,6 +1959,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        }
        chip->state = FL_READY;
+        DISABLE_VPP(map);
        put_chip(map, chip, adr);
        mutex_unlock(&chip->mutex);
        return ret;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 85e80180b65b..096993f9711e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -228,15 +228,15 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
                }
        /* Also select the correct geometry setup too */
-        mtd->erase = cfi_staa_erase_varsize;
+        mtd->_erase = cfi_staa_erase_varsize;
-        mtd->read = cfi_staa_read;
+        mtd->_read = cfi_staa_read;
-        mtd->write = cfi_staa_write_buffers;
+        mtd->_write = cfi_staa_write_buffers;
-        mtd->writev = cfi_staa_writev;
+        mtd->_writev = cfi_staa_writev;
-        mtd->sync = cfi_staa_sync;
+        mtd->_sync = cfi_staa_sync;
-        mtd->lock = cfi_staa_lock;
+        mtd->_lock = cfi_staa_lock;
-        mtd->unlock = cfi_staa_unlock;
+        mtd->_unlock = cfi_staa_unlock;
-        mtd->suspend = cfi_staa_suspend;
+        mtd->_suspend = cfi_staa_suspend;
-        mtd->resume = cfi_staa_resume;
+        mtd->_resume = cfi_staa_resume;
        mtd->flags = MTD_CAP_NORFLASH & ~MTD_BIT_WRITEABLE;
        mtd->writesize = 8; /* FIXME: Should be 0 for STMicro flashes w/out ECC */
        mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
@@ -394,8 +394,6 @@ static int cfi_staa_read (struct mtd_info *mtd, loff_t from, size_t len, size_t
        chipnum = (from >> cfi->chipshift);
        ofs = from - (chipnum <<  cfi->chipshift);
-        *retlen = 0;
        while (len) {
                unsigned long thislen;
@@ -617,10 +615,6 @@ static int cfi_staa_write_buffers (struct mtd_info *mtd, loff_t to,
        int chipnum;
        unsigned long ofs;
-        *retlen = 0;
-        if (!len)
-                return 0;
        chipnum = to >> cfi->chipshift;
        ofs = to  - (chipnum << cfi->chipshift);
@@ -904,12 +898,6 @@ static int cfi_staa_erase_varsize(struct mtd_info *mtd,
        int i, first;
        struct mtd_erase_region_info *regions = mtd->eraseregions;
-        if (instr->addr > mtd->size)
-                return -EINVAL;
-        if ((instr->len + instr->addr) > mtd->size)
-                return -EINVAL;
        /* Check that both start and end of the requested erase are
         * aligned with the erasesize at the appropriate addresses.
         */
@@ -1155,9 +1143,6 @@ static int cfi_staa_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
        if (len & (mtd->erasesize -1))
                return -EINVAL;
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
        chipnum = ofs >> cfi->chipshift;
        adr = ofs - (chipnum << cfi->chipshift);
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index 8e464054a631..f992418f40a8 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -173,12 +173,6 @@ int cfi_varsize_frob(struct mtd_info *mtd, varsize_frob_t frob,
        int i, first;
        struct mtd_erase_region_info *regions = mtd->eraseregions;
-        if (ofs > mtd->size)
-                return -EINVAL;
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
        /* Check that both start and end of the requested erase are
         * aligned with the erasesize at the appropriate addresses.
         */
diff --git a/drivers/mtd/chips/fwh_lock.h b/drivers/mtd/chips/fwh_lock.h
index 89c6595454a5..800b0e853e86 100644
--- a/drivers/mtd/chips/fwh_lock.h
+++ b/drivers/mtd/chips/fwh_lock.h
@@ -101,7 +101,7 @@ static void fixup_use_fwh_lock(struct mtd_info *mtd)
 {
        printk(KERN_NOTICE "using fwh lock/unlock method\n");
        /* Setup for the chips with the fwh lock method */
-        mtd->lock   = fwh_lock_varsize;
+        mtd->_lock   = fwh_lock_varsize;
-        mtd->unlock = fwh_unlock_varsize;
+        mtd->_unlock = fwh_unlock_varsize;
 }
 #endif /* FWH_LOCK_H */
diff --git a/drivers/mtd/chips/map_absent.c b/drivers/mtd/chips/map_absent.c
index f2b872946871..f7a5bca92aef 100644
--- a/drivers/mtd/chips/map_absent.c
+++ b/drivers/mtd/chips/map_absent.c
@@ -55,10 +55,10 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
        mtd->name       = map->name;
        mtd->type       = MTD_ABSENT;
        mtd->size       = map->size;
-        mtd->erase      = map_absent_erase;
+        mtd->_erase     = map_absent_erase;
-        mtd->read       = map_absent_read;
+        mtd->_read      = map_absent_read;
-        mtd->write      = map_absent_write;
+        mtd->_write     = map_absent_write;
-        mtd->sync       = map_absent_sync;
+        mtd->_sync      = map_absent_sync;
        mtd->flags      = 0;
        mtd->erasesize  = PAGE_SIZE;
        mtd->writesize  = 1;
@@ -70,13 +70,11 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
 static int map_absent_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf)
 {
-        *retlen = 0;
        return -ENODEV;
 }
 static int map_absent_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
-        *retlen = 0;
        return -ENODEV;
 }
diff --git a/drivers/mtd/chips/map_ram.c b/drivers/mtd/chips/map_ram.c
index 67640ccb2d41..991c2a1c05d3 100644
--- a/drivers/mtd/chips/map_ram.c
+++ b/drivers/mtd/chips/map_ram.c
@@ -64,11 +64,11 @@ static struct mtd_info *map_ram_probe(struct map_info *map)
        mtd->name = map->name;
        mtd->type = MTD_RAM;
        mtd->size = map->size;
-        mtd->erase = mapram_erase;
+        mtd->_erase = mapram_erase;
-        mtd->get_unmapped_area = mapram_unmapped_area;
+        mtd->_get_unmapped_area = mapram_unmapped_area;
-        mtd->read = mapram_read;
+        mtd->_read = mapram_read;
-        mtd->write = mapram_write;
+        mtd->_write = mapram_write;
-        mtd->sync = mapram_nop;
+        mtd->_sync = mapram_nop;
        mtd->flags = MTD_CAP_RAM;
        mtd->writesize = 1;
@@ -122,14 +122,10 @@ static int mapram_erase (struct mtd_info *mtd, struct erase_info *instr)
        unsigned long i;
        allff = map_word_ff(map);
        for (i=0; i<instr->len; i += map_bankwidth(map))
                map_write(map, allff, instr->addr + i);
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);
        return 0;
 }
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 593f73d480d2..47a43cf7e5c6 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -41,11 +41,11 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
        mtd->name = map->name;
        mtd->type = MTD_ROM;
        mtd->size = map->size;
-        mtd->get_unmapped_area = maprom_unmapped_area;
+        mtd->_get_unmapped_area = maprom_unmapped_area;
-        mtd->read = maprom_read;
+        mtd->_read = maprom_read;
-        mtd->write = maprom_write;
+        mtd->_write = maprom_write;
-        mtd->sync = maprom_nop;
+        mtd->_sync = maprom_nop;
-        mtd->erase = maprom_erase;
+        mtd->_erase = maprom_erase;
        mtd->flags = MTD_CAP_ROM;
        mtd->erasesize = map->size;
        mtd->writesize = 1;
@@ -85,8 +85,7 @@ static void maprom_nop(struct mtd_info *mtd)
 static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
-        printk(KERN_NOTICE "maprom_write called\n");
+        return -EROFS;
-        return -EIO;
 }
 static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 8d3dac40d7e6..4cdb2af7bf44 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -103,6 +103,13 @@ config M25PXX_USE_FAST_READ
        help
          This option enables FAST_READ access supported by ST M25Pxx.
+config MTD_SPEAR_SMI
+        tristate "SPEAR MTD NOR Support through SMI controller"
+        depends on PLAT_SPEAR
+        default y
+        help
+          This enable SNOR support on SPEAR platforms using SMI controller
 config MTD_SST25L
        tristate "Support SST25L (non JEDEC) SPI Flash chips"
        depends on SPI_MASTER
diff --git a/drivers/mtd/devices/Makefile b/drivers/mtd/devices/Makefile
index 56c7cd462f11..a4dd1d822b6c 100644
--- a/drivers/mtd/devices/Makefile
+++ b/drivers/mtd/devices/Makefile
@@ -17,6 +17,7 @@ obj-$(CONFIG_MTD_LART)		+= lart.o
 obj-$(CONFIG_MTD_BLOCK2MTD)     += block2mtd.o
 obj-$(CONFIG_MTD_DATAFLASH)     += mtd_dataflash.o
 obj-$(CONFIG_MTD_M25P80)        += m25p80.o
+obj-$(CONFIG_MTD_SPEAR_SMI)     += spear_smi.o
 obj-$(CONFIG_MTD_SST25L)        += sst25l.o
 CFLAGS_docg3.o                  += -I$(src)
 \ No newline at end of file
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index e7e46d1e7463..a4a80b742e65 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -104,14 +104,6 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len,
        int offset = from & (PAGE_SIZE-1);
        int cpylen;
-        if (from > mtd->size)
-                return -EINVAL;
-        if (from + len > mtd->size)
-                len = mtd->size - from;
-        if (retlen)
-                *retlen = 0;
        while (len) {
                if ((offset + len) > PAGE_SIZE)
                        cpylen = PAGE_SIZE - offset;    // multiple pages
@@ -148,8 +140,6 @@ static int _block2mtd_write(struct block2mtd_dev *dev, const u_char *buf,
        int offset = to & ~PAGE_MASK;   // page offset
        int cpylen;
-        if (retlen)
-                *retlen = 0;
        while (len) {
                if ((offset+len) > PAGE_SIZE)
                        cpylen = PAGE_SIZE - offset;    // multiple pages
@@ -188,13 +178,6 @@ static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
        struct block2mtd_dev *dev = mtd->priv;
        int err;
-        if (!len)
-                return 0;
-        if (to >= mtd->size)
-                return -ENOSPC;
-        if (to + len > mtd->size)
-                len = mtd->size - to;
        mutex_lock(&dev->write_mutex);
        err = _block2mtd_write(dev, buf, to, len, retlen);
        mutex_unlock(&dev->write_mutex);
@@ -283,13 +266,14 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size)
        dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK;
        dev->mtd.erasesize = erase_size;
        dev->mtd.writesize = 1;
+        dev->mtd.writebufsize = PAGE_SIZE;
        dev->mtd.type = MTD_RAM;
        dev->mtd.flags = MTD_CAP_RAM;
-        dev->mtd.erase = block2mtd_erase;
+        dev->mtd._erase = block2mtd_erase;
-        dev->mtd.write = block2mtd_write;
+        dev->mtd._write = block2mtd_write;
-        dev->mtd.writev = mtd_writev;
+        dev->mtd._writev = mtd_writev;
-        dev->mtd.sync = block2mtd_sync;
+        dev->mtd._sync = block2mtd_sync;
-        dev->mtd.read = block2mtd_read;
+        dev->mtd._read = block2mtd_read;
        dev->mtd.priv = dev;
        dev->mtd.owner = THIS_MODULE;
diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
index b1cdf6479019..a4eb8b5b85ec 100644
--- a/drivers/mtd/devices/doc2000.c
+++ b/drivers/mtd/devices/doc2000.c
@@ -562,14 +562,15 @@ void DoC2k_init(struct mtd_info *mtd)
        mtd->type = MTD_NANDFLASH;
        mtd->flags = MTD_CAP_NANDFLASH;
-        mtd->writesize = 512;
+        mtd->writebufsize = mtd->writesize = 512;
        mtd->oobsize = 16;
+        mtd->ecc_strength = 2;
        mtd->owner = THIS_MODULE;
-        mtd->erase = doc_erase;
+        mtd->_erase = doc_erase;
-        mtd->read = doc_read;
+        mtd->_read = doc_read;
-        mtd->write = doc_write;
+        mtd->_write = doc_write;
-        mtd->read_oob = doc_read_oob;
+        mtd->_read_oob = doc_read_oob;
-        mtd->write_oob = doc_write_oob;
+        mtd->_write_oob = doc_write_oob;
        this->curfloor = -1;
        this->curchip = -1;
        mutex_init(&this->lock);
@@ -602,13 +603,7 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
        int i, len256 = 0, ret=0;
        size_t left = len;
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
        mutex_lock(&this->lock);
-        *retlen = 0;
        while (left) {
                len = left;
@@ -748,13 +743,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
        size_t left = len;
        int status;
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
        mutex_lock(&this->lock);
-        *retlen = 0;
        while (left) {
                len = left;
diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
index 7543b98f46c4..f6927955dab0 100644
--- a/drivers/mtd/devices/doc2001.c
+++ b/drivers/mtd/devices/doc2001.c
@@ -346,14 +346,15 @@ void DoCMil_init(struct mtd_info *mtd)
        /* FIXME: erase size is not always 8KiB */
        mtd->erasesize = 0x2000;
-        mtd->writesize = 512;
+        mtd->writebufsize = mtd->writesize = 512;
        mtd->oobsize = 16;
+        mtd->ecc_strength = 2;
        mtd->owner = THIS_MODULE;
-        mtd->erase = doc_erase;
+        mtd->_erase = doc_erase;
-        mtd->read = doc_read;
+        mtd->_read = doc_read;
-        mtd->write = doc_write;
+        mtd->_write = doc_write;
-        mtd->read_oob = doc_read_oob;
+        mtd->_read_oob = doc_read_oob;
-        mtd->write_oob = doc_write_oob;
+        mtd->_write_oob = doc_write_oob;
        this->curfloor = -1;
        this->curchip = -1;
@@ -383,10 +384,6 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
        void __iomem *docptr = this->virtadr;
        struct Nand *mychip = &this->chips[from >> (this->chipshift)];
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
        /* Don't allow a single read to cross a 512-byte block boundary */
        if (from + len > ((from | 0x1ff) + 1))
                len = ((from | 0x1ff) + 1) - from;
@@ -494,10 +491,6 @@ static int doc_write (struct mtd_info *mtd, loff_t to, size_t len,
        void __iomem *docptr = this->virtadr;
        struct Nand *mychip = &this->chips[to >> (this->chipshift)];
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
 #if 0
        /* Don't allow a single write to cross a 512-byte block boundary */
        if (to + len > ( (to | 0x1ff) + 1))
@@ -599,7 +592,6 @@ static int doc_write (struct mtd_info *mtd, loff_t to, size_t len,
                printk("Error programming flash\n");
                /* Error in programming
                   FIXME: implement Bad Block Replacement (in nftl.c ??) */
-                *retlen = 0;
                ret = -EIO;
        }
        dummy = ReadDOC(docptr, LastDataRead);
diff --git a/drivers/mtd/devices/doc2001plus.c b/drivers/mtd/devices/doc2001plus.c
index 177510d0e7ee..04eb2e4aa50f 100644
--- a/drivers/mtd/devices/doc2001plus.c
+++ b/drivers/mtd/devices/doc2001plus.c
@@ -467,14 +467,15 @@ void DoCMilPlus_init(struct mtd_info *mtd)
        mtd->type = MTD_NANDFLASH;
        mtd->flags = MTD_CAP_NANDFLASH;
-        mtd->writesize = 512;
+        mtd->writebufsize = mtd->writesize = 512;
        mtd->oobsize = 16;
+        mtd->ecc_strength = 2;
        mtd->owner = THIS_MODULE;
-        mtd->erase = doc_erase;
+        mtd->_erase = doc_erase;
-        mtd->read = doc_read;
+        mtd->_read = doc_read;
-        mtd->write = doc_write;
+        mtd->_write = doc_write;
-        mtd->read_oob = doc_read_oob;
+        mtd->_read_oob = doc_read_oob;
-        mtd->write_oob = doc_write_oob;
+        mtd->_write_oob = doc_write_oob;
        this->curfloor = -1;
        this->curchip = -1;
@@ -581,10 +582,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
        void __iomem * docptr = this->virtadr;
        struct Nand *mychip = &this->chips[from >> (this->chipshift)];
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
        /* Don't allow a single read to cross a 512-byte block boundary */
        if (from + len > ((from | 0x1ff) + 1))
                len = ((from | 0x1ff) + 1) - from;
@@ -700,10 +697,6 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
        void __iomem * docptr = this->virtadr;
        struct Nand *mychip = &this->chips[to >> (this->chipshift)];
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
        /* Don't allow writes which aren't exactly one block (512 bytes) */
        if ((to & 0x1ff) || (len != 0x200))
                return -EINVAL;
@@ -800,7 +793,6 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
                printk("MTD: Error 0x%x programming at 0x%x\n", dummy, (int)to);
                /* Error in programming
                   FIXME: implement Bad Block Replacement (in nftl.c ??) */
-                *retlen = 0;
                ret = -EIO;
        }
        dummy = ReadDOC(docptr, Mplus_LastDataRead);
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index ad11ef0a81f4..8272c02668d6 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -80,14 +80,9 @@ static struct nand_ecclayout docg3_oobinfo = {
        .oobavail = 8,
 };
-/**
- * struct docg3_bch - BCH engine
- */
-static struct bch_control *docg3_bch;
 static inline u8 doc_readb(struct docg3 *docg3, u16 reg)
 {
-        u8 val = readb(docg3->base + reg);
+        u8 val = readb(docg3->cascade->base + reg);
        trace_docg3_io(0, 8, reg, (int)val);
        return val;
@@ -95,7 +90,7 @@ static inline u8 doc_readb(struct docg3 *docg3, u16 reg)
 static inline u16 doc_readw(struct docg3 *docg3, u16 reg)
 {
-        u16 val = readw(docg3->base + reg);
+        u16 val = readw(docg3->cascade->base + reg);
        trace_docg3_io(0, 16, reg, (int)val);
        return val;
@@ -103,13 +98,13 @@ static inline u16 doc_readw(struct docg3 *docg3, u16 reg)
 static inline void doc_writeb(struct docg3 *docg3, u8 val, u16 reg)
 {
-        writeb(val, docg3->base + reg);
+        writeb(val, docg3->cascade->base + reg);
        trace_docg3_io(1, 8, reg, val);
 }
 static inline void doc_writew(struct docg3 *docg3, u16 val, u16 reg)
 {
-        writew(val, docg3->base + reg);
+        writew(val, docg3->cascade->base + reg);
        trace_docg3_io(1, 16, reg, val);
 }
@@ -643,7 +638,8 @@ static int doc_ecc_bch_fix_data(struct docg3 *docg3, void *buf, u8 *hwecc)
        for (i = 0; i < DOC_ECC_BCH_SIZE; i++)
                ecc[i] = bitrev8(hwecc[i]);
-        numerrs = decode_bch(docg3_bch, NULL, DOC_ECC_BCH_COVERED_BYTES,
+        numerrs = decode_bch(docg3->cascade->bch, NULL,
+                             DOC_ECC_BCH_COVERED_BYTES,
                             NULL, ecc, NULL, errorpos);
        BUG_ON(numerrs == -EINVAL);
        if (numerrs < 0)
@@ -734,7 +730,7 @@ err:
 * doc_read_page_getbytes - Reads bytes from a prepared page
 * @docg3: the device
 * @len: the number of bytes to be read (must be a multiple of 4)
- * @buf: the buffer to be filled in
+ * @buf: the buffer to be filled in (or NULL is forget bytes)
 * @first: 1 if first time read, DOC_READADDRESS should be set
 *
 */
@@ -849,7 +845,7 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from,
                        struct mtd_oob_ops *ops)
 {
        struct docg3 *docg3 = mtd->priv;
-        int block0, block1, page, ret, ofs = 0;
+        int block0, block1, page, ret, skip, ofs = 0;
        u8 *oobbuf = ops->oobbuf;
        u8 *buf = ops->datbuf;
        size_t len, ooblen, nbdata, nboob;
@@ -869,34 +865,36 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from,
        doc_dbg("doc_read_oob(from=%lld, mode=%d, data=(%p:%zu), oob=(%p:%zu))\n",
                from, ops->mode, buf, len, oobbuf, ooblen);
-        if ((len % DOC_LAYOUT_PAGE_SIZE) || (ooblen % DOC_LAYOUT_OOB_SIZE) ||
+        if (ooblen % DOC_LAYOUT_OOB_SIZE)
-            (from % DOC_LAYOUT_PAGE_SIZE))
                return -EINVAL;
-        ret = -EINVAL;
+        if (from + len > mtd->size)
-        calc_block_sector(from + len, &block0, &block1, &page, &ofs,
+                return -EINVAL;
-                          docg3->reliable);
-        if (block1 > docg3->max_block)
-                goto err;
        ops->oobretlen = 0;
        ops->retlen = 0;
        ret = 0;
+        skip = from % DOC_LAYOUT_PAGE_SIZE;
+        mutex_lock(&docg3->cascade->lock);
        while (!ret && (len > 0 || ooblen > 0)) {
-                calc_block_sector(from, &block0, &block1, &page, &ofs,
+                calc_block_sector(from - skip, &block0, &block1, &page, &ofs,
                        docg3->reliable);
-                nbdata = min_t(size_t, len, (size_t)DOC_LAYOUT_PAGE_SIZE);
+                nbdata = min_t(size_t, len, DOC_LAYOUT_PAGE_SIZE - skip);
                nboob = min_t(size_t, ooblen, (size_t)DOC_LAYOUT_OOB_SIZE);
                ret = doc_read_page_prepare(docg3, block0, block1, page, ofs);
                if (ret < 0)
-                        goto err;
+                        goto out;
                ret = doc_read_page_ecc_init(docg3, DOC_ECC_BCH_TOTAL_BYTES);
                if (ret < 0)
                        goto err_in_read;
-                ret = doc_read_page_getbytes(docg3, nbdata, buf, 1);
+                ret = doc_read_page_getbytes(docg3, skip, NULL, 1);
+                if (ret < skip)
+                        goto err_in_read;
+                ret = doc_read_page_getbytes(docg3, nbdata, buf, 0);
                if (ret < nbdata)
                        goto err_in_read;
-                doc_read_page_getbytes(docg3, DOC_LAYOUT_PAGE_SIZE - nbdata,
+                doc_read_page_getbytes(docg3,
+                                       DOC_LAYOUT_PAGE_SIZE - nbdata - skip,
                                       NULL, 0);
                ret = doc_read_page_getbytes(docg3, nboob, oobbuf, 0);
                if (ret < nboob)
@@ -950,13 +948,15 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from,
                len -= nbdata;
                ooblen -= nboob;
                from += DOC_LAYOUT_PAGE_SIZE;
+                skip = 0;
        }
+out:
+        mutex_unlock(&docg3->cascade->lock);
        return ret;
 err_in_read:
        doc_read_page_finish(docg3);
-err:
+        goto out;
-        return ret;
 }
 /**
@@ -1114,10 +1114,10 @@ static int doc_get_op_status(struct docg3 *docg3)
 */
 static int doc_write_erase_wait_status(struct docg3 *docg3)
 {
-        int status, ret = 0;
+        int i, status, ret = 0;
-        if (!doc_is_ready(docg3))
+        for (i = 0; !doc_is_ready(docg3) && i < 5; i++)
-                usleep_range(3000, 3000);
+                msleep(20);
        if (!doc_is_ready(docg3)) {
                doc_dbg("Timeout reached and the chip is still not ready\n");
                ret = -EAGAIN;
@@ -1196,18 +1196,19 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *info)
        int block0, block1, page, ret, ofs = 0;
        doc_dbg("doc_erase(from=%lld, len=%lld\n", info->addr, info->len);
-        doc_set_device_id(docg3, docg3->device_id);
        info->state = MTD_ERASE_PENDING;
        calc_block_sector(info->addr + info->len, &block0, &block1, &page,
                          &ofs, docg3->reliable);
        ret = -EINVAL;
-        if (block1 > docg3->max_block || page || ofs)
+        if (info->addr + info->len > mtd->size || page || ofs)
                goto reset_err;
        ret = 0;
        calc_block_sector(info->addr, &block0, &block1, &page, &ofs,
                          docg3->reliable);
+        mutex_lock(&docg3->cascade->lock);
+        doc_set_device_id(docg3, docg3->device_id);
        doc_set_reliable_mode(docg3);
        for (len = info->len; !ret && len > 0; len -= mtd->erasesize) {
                info->state = MTD_ERASING;
@@ -1215,6 +1216,7 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *info)
                block0 += 2;
                block1 += 2;
        }
+        mutex_unlock(&docg3->cascade->lock);
        if (ret)
                goto reset_err;
@@ -1401,7 +1403,7 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
                         struct mtd_oob_ops *ops)
 {
        struct docg3 *docg3 = mtd->priv;
-        int block0, block1, page, ret, pofs = 0, autoecc, oobdelta;
+        int ret, autoecc, oobdelta;
        u8 *oobbuf = ops->oobbuf;
        u8 *buf = ops->datbuf;
        size_t len, ooblen;
@@ -1438,12 +1440,8 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
        if (len && ooblen &&
            (len / DOC_LAYOUT_PAGE_SIZE) != (ooblen / oobdelta))
                return -EINVAL;
+        if (ofs + len > mtd->size)
-        ret = -EINVAL;
+                return -EINVAL;
-        calc_block_sector(ofs + len, &block0, &block1, &page, &pofs,
-                          docg3->reliable);
-        if (block1 > docg3->max_block)
-                goto err;
        ops->oobretlen = 0;
        ops->retlen = 0;
@@ -1457,6 +1455,7 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
        if (autoecc < 0)
                return autoecc;
+        mutex_lock(&docg3->cascade->lock);
        while (!ret && len > 0) {
                memset(oob, 0, sizeof(oob));
                if (ofs == docg3->oob_write_ofs)
@@ -1477,8 +1476,9 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
                }
                ops->retlen += DOC_LAYOUT_PAGE_SIZE;
        }
-err:
        doc_set_device_id(docg3, 0);
+        mutex_unlock(&docg3->cascade->lock);
        return ret;
 }
@@ -1535,9 +1535,11 @@ static ssize_t dps0_is_key_locked(struct device *dev,
        struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
        int dps0;
+        mutex_lock(&docg3->cascade->lock);
        doc_set_device_id(docg3, docg3->device_id);
        dps0 = doc_register_readb(docg3, DOC_DPS0_STATUS);
        doc_set_device_id(docg3, 0);
+        mutex_unlock(&docg3->cascade->lock);
        return sprintf(buf, "%d\n", !(dps0 & DOC_DPS_KEY_OK));
 }
@@ -1548,9 +1550,11 @@ static ssize_t dps1_is_key_locked(struct device *dev,
        struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
        int dps1;
+        mutex_lock(&docg3->cascade->lock);
        doc_set_device_id(docg3, docg3->device_id);
        dps1 = doc_register_readb(docg3, DOC_DPS1_STATUS);
        doc_set_device_id(docg3, 0);
+        mutex_unlock(&docg3->cascade->lock);
        return sprintf(buf, "%d\n", !(dps1 & DOC_DPS_KEY_OK));
 }
@@ -1565,10 +1569,12 @@ static ssize_t dps0_insert_key(struct device *dev,
        if (count != DOC_LAYOUT_DPS_KEY_LENGTH)
                return -EINVAL;
+        mutex_lock(&docg3->cascade->lock);
        doc_set_device_id(docg3, docg3->device_id);
        for (i = 0; i < DOC_LAYOUT_DPS_KEY_LENGTH; i++)
                doc_writeb(docg3, buf[i], DOC_DPS0_KEY);
        doc_set_device_id(docg3, 0);
+        mutex_unlock(&docg3->cascade->lock);
        return count;
 }
@@ -1582,10 +1588,12 @@ static ssize_t dps1_insert_key(struct device *dev,
        if (count != DOC_LAYOUT_DPS_KEY_LENGTH)
                return -EINVAL;
+        mutex_lock(&docg3->cascade->lock);
        doc_set_device_id(docg3, docg3->device_id);
        for (i = 0; i < DOC_LAYOUT_DPS_KEY_LENGTH; i++)
                doc_writeb(docg3, buf[i], DOC_DPS1_KEY);
        doc_set_device_id(docg3, 0);
+        mutex_unlock(&docg3->cascade->lock);
        return count;
 }
@@ -1601,13 +1609,13 @@ static struct device_attribute doc_sys_attrs[DOC_MAX_NBFLOORS][4] = {
 };
 static int doc_register_sysfs(struct platform_device *pdev,
-                              struct mtd_info **floors)
+                              struct docg3_cascade *cascade)
 {
        int ret = 0, floor, i = 0;
        struct device *dev = &pdev->dev;
-        for (floor = 0; !ret && floor < DOC_MAX_NBFLOORS && floors[floor];
+        for (floor = 0; !ret && floor < DOC_MAX_NBFLOORS &&
-             floor++)
+                     cascade->floors[floor]; floor++)
                for (i = 0; !ret && i < 4; i++)
                        ret = device_create_file(dev, &doc_sys_attrs[floor][i]);
        if (!ret)
@@ -1621,12 +1629,12 @@ static int doc_register_sysfs(struct platform_device *pdev,
 }
 static void doc_unregister_sysfs(struct platform_device *pdev,
-                                 struct mtd_info **floors)
+                                 struct docg3_cascade *cascade)
 {
        struct device *dev = &pdev->dev;
        int floor, i;
-        for (floor = 0; floor < DOC_MAX_NBFLOORS && floors[floor];
+        for (floor = 0; floor < DOC_MAX_NBFLOORS && cascade->floors[floor];
             floor++)
                for (i = 0; i < 4; i++)
                        device_remove_file(dev, &doc_sys_attrs[floor][i]);
@@ -1640,7 +1648,11 @@ static int dbg_flashctrl_show(struct seq_file *s, void *p)
        struct docg3 *docg3 = (struct docg3 *)s->private;
        int pos = 0;
-        u8 fctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
+        u8 fctrl;
+        mutex_lock(&docg3->cascade->lock);
+        fctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
+        mutex_unlock(&docg3->cascade->lock);
        pos += seq_printf(s,
                 "FlashControl : 0x%02x (%s,CE# %s,%s,%s,flash %s)\n",
@@ -1658,9 +1670,12 @@ static int dbg_asicmode_show(struct seq_file *s, void *p)
 {
        struct docg3 *docg3 = (struct docg3 *)s->private;
-        int pos = 0;
+        int pos = 0, pctrl, mode;
-        int pctrl = doc_register_readb(docg3, DOC_ASICMODE);
-        int mode = pctrl & 0x03;
+        mutex_lock(&docg3->cascade->lock);
+        pctrl = doc_register_readb(docg3, DOC_ASICMODE);
+        mode = pctrl & 0x03;
+        mutex_unlock(&docg3->cascade->lock);
        pos += seq_printf(s,
                         "%04x : RAM_WE=%d,RSTIN_RESET=%d,BDETCT_RESET=%d,WRITE_ENABLE=%d,POWERDOWN=%d,MODE=%d%d (",
@@ -1692,7 +1707,11 @@ static int dbg_device_id_show(struct seq_file *s, void *p)
 {
        struct docg3 *docg3 = (struct docg3 *)s->private;
        int pos = 0;
-        int id = doc_register_readb(docg3, DOC_DEVICESELECT);
+        int id;
+        mutex_lock(&docg3->cascade->lock);
+        id = doc_register_readb(docg3, DOC_DEVICESELECT);
+        mutex_unlock(&docg3->cascade->lock);
        pos += seq_printf(s, "DeviceId = %d\n", id);
        return pos;
@@ -1705,6 +1724,7 @@ static int dbg_protection_show(struct seq_file *s, void *p)
        int pos = 0;
        int protect, dps0, dps0_low, dps0_high, dps1, dps1_low, dps1_high;
+        mutex_lock(&docg3->cascade->lock);
        protect = doc_register_readb(docg3, DOC_PROTECTION);
        dps0 = doc_register_readb(docg3, DOC_DPS0_STATUS);
        dps0_low = doc_register_readw(docg3, DOC_DPS0_ADDRLOW);
@@ -1712,6 +1732,7 @@ static int dbg_protection_show(struct seq_file *s, void *p)
        dps1 = doc_register_readb(docg3, DOC_DPS1_STATUS);
        dps1_low = doc_register_readw(docg3, DOC_DPS1_ADDRLOW);
        dps1_high = doc_register_readw(docg3, DOC_DPS1_ADDRHIGH);
+        mutex_unlock(&docg3->cascade->lock);
        pos += seq_printf(s, "Protection = 0x%02x (",
                         protect);
@@ -1804,7 +1825,7 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
        switch (chip_id) {
        case DOC_CHIPID_G3:
-                mtd->name = kasprintf(GFP_KERNEL, "DiskOnChip G3 floor %d",
+                mtd->name = kasprintf(GFP_KERNEL, "docg3.%d",
                                      docg3->device_id);
                docg3->max_block = 2047;
                break;
@@ -1817,16 +1838,17 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
        mtd->erasesize = DOC_LAYOUT_BLOCK_SIZE * DOC_LAYOUT_NBPLANES;
        if (docg3->reliable == 2)
                mtd->erasesize /= 2;
-        mtd->writesize = DOC_LAYOUT_PAGE_SIZE;
+        mtd->writebufsize = mtd->writesize = DOC_LAYOUT_PAGE_SIZE;
        mtd->oobsize = DOC_LAYOUT_OOB_SIZE;
        mtd->owner = THIS_MODULE;
-        mtd->erase = doc_erase;
+        mtd->_erase = doc_erase;
-        mtd->read = doc_read;
+        mtd->_read = doc_read;
-        mtd->write = doc_write;
+        mtd->_write = doc_write;
-        mtd->read_oob = doc_read_oob;
+        mtd->_read_oob = doc_read_oob;
-        mtd->write_oob = doc_write_oob;
+        mtd->_write_oob = doc_write_oob;
-        mtd->block_isbad = doc_block_isbad;
+        mtd->_block_isbad = doc_block_isbad;
        mtd->ecclayout = &docg3_oobinfo;
+        mtd->ecc_strength = DOC_ECC_BCH_T;
 }
 /**
@@ -1834,6 +1856,7 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
 * @base: the io space where the device is probed
 * @floor: the floor of the probed device
 * @dev: the device
+ * @cascade: the cascade of chips this devices will belong to
 *
 * Checks whether a device at the specified IO range, and floor is available.
 *
@@ -1841,8 +1864,8 @@ static void __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
 * if a memory allocation failed. If floor 0 is checked, a reset of the ASIC is
 * launched.
 */
-static struct mtd_info *doc_probe_device(void __iomem *base, int floor,
+static struct mtd_info * __init
-                                         struct device *dev)
+doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
 {
        int ret, bbt_nbpages;
        u16 chip_id, chip_id_inv;
@@ -1865,7 +1888,7 @@ static struct mtd_info *doc_probe_device(void __iomem *base, int floor,
        docg3->dev = dev;
        docg3->device_id = floor;
-        docg3->base = base;
+        docg3->cascade = cascade;
        doc_set_device_id(docg3, docg3->device_id);
        if (!floor)
                doc_set_asic_mode(docg3, DOC_ASICMODE_RESET);
@@ -1882,7 +1905,7 @@ static struct mtd_info *doc_probe_device(void __iomem *base, int floor,
        switch (chip_id) {
        case DOC_CHIPID_G3:
                doc_info("Found a G3 DiskOnChip at addr %p, floor %d\n",
-                         base, floor);
+                         docg3->cascade->base, floor);
                break;
        default:
                doc_err("Chip id %04x is not a DiskOnChip G3 chip\n", chip_id);
@@ -1927,10 +1950,12 @@ static void doc_release_device(struct mtd_info *mtd)
 static int docg3_resume(struct platform_device *pdev)
 {
        int i;
+        struct docg3_cascade *cascade;
        struct mtd_info **docg3_floors, *mtd;
        struct docg3 *docg3;
-        docg3_floors = platform_get_drvdata(pdev);
+        cascade = platform_get_drvdata(pdev);
+        docg3_floors = cascade->floors;
        mtd = docg3_floors[0];
        docg3 = mtd->priv;
@@ -1952,11 +1977,13 @@ static int docg3_resume(struct platform_device *pdev)
 static int docg3_suspend(struct platform_device *pdev, pm_message_t state)
 {
        int floor, i;
+        struct docg3_cascade *cascade;
        struct mtd_info **docg3_floors, *mtd;
        struct docg3 *docg3;
        u8 ctrl, pwr_down;
-        docg3_floors = platform_get_drvdata(pdev);
+        cascade = platform_get_drvdata(pdev);
+        docg3_floors = cascade->floors;
        for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
                mtd = docg3_floors[floor];
                if (!mtd)
@@ -2006,7 +2033,7 @@ static int __init docg3_probe(struct platform_device *pdev)
        struct resource *ress;
        void __iomem *base;
        int ret, floor, found = 0;
-        struct mtd_info **docg3_floors;
+        struct docg3_cascade *cascade;
        ret = -ENXIO;
        ress = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -2017,17 +2044,19 @@ static int __init docg3_probe(struct platform_device *pdev)
        base = ioremap(ress->start, DOC_IOSPACE_SIZE);
        ret = -ENOMEM;
-        docg3_floors = kzalloc(sizeof(*docg3_floors) * DOC_MAX_NBFLOORS,
+        cascade = kzalloc(sizeof(*cascade) * DOC_MAX_NBFLOORS,
-                               GFP_KERNEL);
+                          GFP_KERNEL);
-        if (!docg3_floors)
+        if (!cascade)
                goto nomem1;
-        docg3_bch = init_bch(DOC_ECC_BCH_M, DOC_ECC_BCH_T,
+        cascade->base = base;
+        mutex_init(&cascade->lock);
+        cascade->bch = init_bch(DOC_ECC_BCH_M, DOC_ECC_BCH_T,
                             DOC_ECC_BCH_PRIMPOLY);
-        if (!docg3_bch)
+        if (!cascade->bch)
                goto nomem2;
        for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
-                mtd = doc_probe_device(base, floor, dev);
+                mtd = doc_probe_device(cascade, floor, dev);
                if (IS_ERR(mtd)) {
                        ret = PTR_ERR(mtd);
                        goto err_probe;
@@ -2038,7 +2067,7 @@ static int __init docg3_probe(struct platform_device *pdev)
                        else
                                continue;
                }
-                docg3_floors[floor] = mtd;
+                cascade->floors[floor] = mtd;
                ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
                                                0);
                if (ret)
@@ -2046,26 +2075,26 @@ static int __init docg3_probe(struct platform_device *pdev)
                found++;
        }
-        ret = doc_register_sysfs(pdev, docg3_floors);
+        ret = doc_register_sysfs(pdev, cascade);
        if (ret)
                goto err_probe;
        if (!found)
                goto notfound;
-        platform_set_drvdata(pdev, docg3_floors);
+        platform_set_drvdata(pdev, cascade);
-        doc_dbg_register(docg3_floors[0]->priv);
+        doc_dbg_register(cascade->floors[0]->priv);
        return 0;
 notfound:
        ret = -ENODEV;
        dev_info(dev, "No supported DiskOnChip found\n");
 err_probe:
-        free_bch(docg3_bch);
+        kfree(cascade->bch);
        for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++)
-                if (docg3_floors[floor])
+                if (cascade->floors[floor])
-                        doc_release_device(docg3_floors[floor]);
+                        doc_release_device(cascade->floors[floor]);
 nomem2:
-        kfree(docg3_floors);
+        kfree(cascade);
 nomem1:
        iounmap(base);
 noress:
@@ -2080,19 +2109,19 @@ noress:
 */
 static int __exit docg3_release(struct platform_device *pdev)
 {
-        struct mtd_info **docg3_floors = platform_get_drvdata(pdev);
+        struct docg3_cascade *cascade = platform_get_drvdata(pdev);
-        struct docg3 *docg3 = docg3_floors[0]->priv;
+        struct docg3 *docg3 = cascade->floors[0]->priv;
-        void __iomem *base = docg3->base;
+        void __iomem *base = cascade->base;
        int floor;
-        doc_unregister_sysfs(pdev, docg3_floors);
+        doc_unregister_sysfs(pdev, cascade);
        doc_dbg_unregister(docg3);
        for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++)
-                if (docg3_floors[floor])
+                if (cascade->floors[floor])
-                        doc_release_device(docg3_floors[floor]);
+                        doc_release_device(cascade->floors[floor]);
-        kfree(docg3_floors);
+        free_bch(docg3->cascade->bch);
-        free_bch(docg3_bch);
+        kfree(cascade);
        iounmap(base);
        return 0;
 }
diff --git a/drivers/mtd/devices/docg3.h b/drivers/mtd/devices/docg3.h
index db0da436b493..19fb93f96a3a 100644
--- a/drivers/mtd/devices/docg3.h
+++ b/drivers/mtd/devices/docg3.h
@@ -22,6 +22,8 @@
 #ifndef _MTD_DOCG3_H
 #define _MTD_DOCG3_H
+#include <linux/mtd/mtd.h>
 /*
 * Flash memory areas :
 *   - 0x0000 .. 0x07ff : IPL
@@ -267,9 +269,23 @@
 #define DOC_LAYOUT_DPS_KEY_LENGTH       8
 /**
+ * struct docg3_cascade - Cascade of 1 to 4 docg3 chips
+ * @floors: floors (ie. one physical docg3 chip is one floor)
+ * @base: IO space to access all chips in the cascade
+ * @bch: the BCH correcting control structure
+ * @lock: lock to protect docg3 IO space from concurrent accesses
+ */
+struct docg3_cascade {
+        struct mtd_info *floors[DOC_MAX_NBFLOORS];
+        void __iomem *base;
+        struct bch_control *bch;
+        struct mutex lock;
+};
+/**
 * struct docg3 - DiskOnChip driver private data
 * @dev: the device currently under control
- * @base: mapped IO space
+ * @cascade: the cascade this device belongs to
 * @device_id: number of the cascaded DoCG3 device (0, 1, 2 or 3)
 * @if_cfg: if true, reads are on 16bits, else reads are on 8bits
@@ -287,7 +303,7 @@
 */
 struct docg3 {
        struct device *dev;
-        void __iomem *base;
+        struct docg3_cascade *cascade;
        unsigned int device_id:4;
        unsigned int if_cfg:1;
        unsigned int reliable:2;
diff --git a/drivers/mtd/devices/lart.c b/drivers/mtd/devices/lart.c
index 3a11ea628e58..82bd00af5cc3 100644
--- a/drivers/mtd/devices/lart.c
+++ b/drivers/mtd/devices/lart.c
@@ -367,9 +367,6 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr)
   printk (KERN_DEBUG "%s(addr = 0x%.8x, len = %d)\n", __func__, instr->addr, instr->len);
 #endif
-   /* sanity checks */
-   if (instr->addr + instr->len > mtd->size) return (-EINVAL);
   /*
        * check that both start and end of the requested erase are
        * aligned with the erasesize at the appropriate addresses.
@@ -440,10 +437,6 @@ static int flash_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retle
   printk (KERN_DEBUG "%s(from = 0x%.8x, len = %d)\n", __func__, (__u32)from, len);
 #endif
-   /* sanity checks */
-   if (!len) return (0);
-   if (from + len > mtd->size) return (-EINVAL);
   /* we always read len bytes */
   *retlen = len;
@@ -522,11 +515,8 @@ static int flash_write (struct mtd_info *mtd,loff_t to,size_t len,size_t *retlen
   printk (KERN_DEBUG "%s(to = 0x%.8x, len = %d)\n", __func__, (__u32)to, len);
 #endif
-   *retlen = 0;
   /* sanity checks */
   if (!len) return (0);
-   if (to + len > mtd->size) return (-EINVAL);
   /* first, we write a 0xFF.... padded byte until we reach a dword boundary */
   if (to & (BUSWIDTH - 1))
@@ -630,14 +620,15 @@ static int __init lart_flash_init (void)
   mtd.name = module_name;
   mtd.type = MTD_NORFLASH;
   mtd.writesize = 1;
+   mtd.writebufsize = 4;
   mtd.flags = MTD_CAP_NORFLASH;
   mtd.size = FLASH_BLOCKSIZE_PARAM * FLASH_NUMBLOCKS_16m_PARAM + FLASH_BLOCKSIZE_MAIN * FLASH_NUMBLOCKS_16m_MAIN;
   mtd.erasesize = FLASH_BLOCKSIZE_MAIN;
   mtd.numeraseregions = ARRAY_SIZE(erase_regions);
   mtd.eraseregions = erase_regions;
-   mtd.erase = flash_erase;
+   mtd._erase = flash_erase;
-   mtd.read = flash_read;
+   mtd._read = flash_read;
-   mtd.write = flash_write;
+   mtd._write = flash_write;
   mtd.owner = THIS_MODULE;
 #ifdef LART_DEBUG
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 7c60dddbefc0..1924d247c1cb 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -288,9 +288,6 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
                        __func__, (long long)instr->addr,
                        (long long)instr->len);
-        /* sanity checks */
-        if (instr->addr + instr->len > flash->mtd.size)
-                return -EINVAL;
        div_u64_rem(instr->len, mtd->erasesize, &rem);
        if (rem)
                return -EINVAL;
@@ -349,13 +346,6 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
        pr_debug("%s: %s from 0x%08x, len %zd\n", dev_name(&flash->spi->dev),
                        __func__, (u32)from, len);
-        /* sanity checks */
-        if (!len)
-                return 0;
-        if (from + len > flash->mtd.size)
-                return -EINVAL;
        spi_message_init(&m);
        memset(t, 0, (sizeof t));
@@ -371,9 +361,6 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
        t[1].len = len;
        spi_message_add_tail(&t[1], &m);
-        /* Byte count starts at zero. */
-        *retlen = 0;
        mutex_lock(&flash->lock);
        /* Wait till previous write/erase is done. */
@@ -417,15 +404,6 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
        pr_debug("%s: %s to 0x%08x, len %zd\n", dev_name(&flash->spi->dev),
                        __func__, (u32)to, len);
-        *retlen = 0;
-        /* sanity checks */
-        if (!len)
-                return(0);
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
        spi_message_init(&m);
        memset(t, 0, (sizeof t));
@@ -509,15 +487,6 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
        pr_debug("%s: %s to 0x%08x, len %zd\n", dev_name(&flash->spi->dev),
                        __func__, (u32)to, len);
-        *retlen = 0;
-        /* sanity checks */
-        if (!len)
-                return 0;
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
        spi_message_init(&m);
        memset(t, 0, (sizeof t));
@@ -908,14 +877,14 @@ static int __devinit m25p_probe(struct spi_device *spi)
        flash->mtd.writesize = 1;
        flash->mtd.flags = MTD_CAP_NORFLASH;
        flash->mtd.size = info->sector_size * info->n_sectors;
-        flash->mtd.erase = m25p80_erase;
+        flash->mtd._erase = m25p80_erase;
-        flash->mtd.read = m25p80_read;
+        flash->mtd._read = m25p80_read;
        /* sst flash chips use AAI word program */
        if (JEDEC_MFR(info->jedec_id) == CFI_MFR_SST)
-                flash->mtd.write = sst_write;
+                flash->mtd._write = sst_write;
        else
-                flash->mtd.write = m25p80_write;
+                flash->mtd._write = m25p80_write;
        /* prefer "small sector" erase if possible */
        if (info->flags & SECT_4K) {
@@ -932,6 +901,7 @@ static int __devinit m25p_probe(struct spi_device *spi)
        ppdata.of_node = spi->dev.of_node;
        flash->mtd.dev.parent = &spi->dev;
        flash->page_size = info->page_size;
+        flash->mtd.writebufsize = flash->page_size;
        if (info->addr_width)
                flash->addr_width = info->addr_width;
@@ -1004,21 +974,7 @@ static struct spi_driver m25p80_driver = {
         */
 };
+module_spi_driver(m25p80_driver);
-static int __init m25p80_init(void)
-{
-        return spi_register_driver(&m25p80_driver);
-}
-static void __exit m25p80_exit(void)
-{
-        spi_unregister_driver(&m25p80_driver);
-}
-module_init(m25p80_init);
-module_exit(m25p80_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Mike Lavender");
diff --git a/drivers/mtd/devices/ms02-nv.c b/drivers/mtd/devices/ms02-nv.c
index 8423fb6d4f26..182849d39c61 100644
--- a/drivers/mtd/devices/ms02-nv.c
+++ b/drivers/mtd/devices/ms02-nv.c
@@ -59,12 +59,8 @@ static int ms02nv_read(struct mtd_info *mtd, loff_t from,
 {
        struct ms02nv_private *mp = mtd->priv;
-        if (from + len > mtd->size)
-                return -EINVAL;
        memcpy(buf, mp->uaddr + from, len);
        *retlen = len;
        return 0;
 }
@@ -73,12 +69,8 @@ static int ms02nv_write(struct mtd_info *mtd, loff_t to,
 {
        struct ms02nv_private *mp = mtd->priv;
-        if (to + len > mtd->size)
-                return -EINVAL;
        memcpy(mp->uaddr + to, buf, len);
        *retlen = len;
        return 0;
 }
@@ -215,8 +207,8 @@ static int __init ms02nv_init_one(ulong addr)
        mtd->size = fixsize;
        mtd->name = (char *)ms02nv_name;
        mtd->owner = THIS_MODULE;
-        mtd->read = ms02nv_read;
+        mtd->_read = ms02nv_read;
-        mtd->write = ms02nv_write;
+        mtd->_write = ms02nv_write;
        mtd->writesize = 1;
        ret = -EIO;
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 236057ead0d2..928fb0e6d73a 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -164,9 +164,6 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
              dev_name(&spi->dev), (long long)instr->addr,
              (long long)instr->len);
-        /* Sanity checks */
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
        div_u64_rem(instr->len, priv->page_size, &rem);
        if (rem)
                return -EINVAL;
@@ -252,14 +249,6 @@ static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
        pr_debug("%s: read 0x%x..0x%x\n", dev_name(&priv->spi->dev),
                        (unsigned)from, (unsigned)(from + len));
-        *retlen = 0;
-        /* Sanity checks */
-        if (!len)
-                return 0;
-        if (from + len > mtd->size)
-                return -EINVAL;
        /* Calculate flash page/byte address */
        addr = (((unsigned)from / priv->page_size) << priv->page_offset)
                + ((unsigned)from % priv->page_size);
@@ -328,14 +317,6 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
        pr_debug("%s: write 0x%x..0x%x\n",
                dev_name(&spi->dev), (unsigned)to, (unsigned)(to + len));
-        *retlen = 0;
-        /* Sanity checks */
-        if (!len)
-                return 0;
-        if ((to + len) > mtd->size)
-                return -EINVAL;
        spi_message_init(&msg);
        x[0].tx_buf = command = priv->command;
@@ -490,8 +471,6 @@ static ssize_t otp_read(struct spi_device *spi, unsigned base,
        if ((off + len) > 64)
                len = 64 - off;
-        if (len == 0)
-                return len;
        spi_message_init(&m);
@@ -611,16 +590,16 @@ static int dataflash_write_user_otp(struct mtd_info *mtd,
 static char *otp_setup(struct mtd_info *device, char revision)
 {
-        device->get_fact_prot_info = dataflash_get_otp_info;
+        device->_get_fact_prot_info = dataflash_get_otp_info;
-        device->read_fact_prot_reg = dataflash_read_fact_otp;
+        device->_read_fact_prot_reg = dataflash_read_fact_otp;
-        device->get_user_prot_info = dataflash_get_otp_info;
+        device->_get_user_prot_info = dataflash_get_otp_info;
-        device->read_user_prot_reg = dataflash_read_user_otp;
+        device->_read_user_prot_reg = dataflash_read_user_otp;
        /* rev c parts (at45db321c and at45db1281 only!) use a
         * different write procedure; not (yet?) implemented.
         */
        if (revision > 'c')
-                device->write_user_prot_reg = dataflash_write_user_otp;
+                device->_write_user_prot_reg = dataflash_write_user_otp;
        return ", OTP";
 }
@@ -672,9 +651,9 @@ add_dataflash_otp(struct spi_device *spi, char *name,
        device->owner = THIS_MODULE;
        device->type = MTD_DATAFLASH;
        device->flags = MTD_WRITEABLE;
-        device->erase = dataflash_erase;
+        device->_erase = dataflash_erase;
-        device->read = dataflash_read;
+        device->_read = dataflash_read;
-        device->write = dataflash_write;
+        device->_write = dataflash_write;
        device->priv = priv;
        device->dev.parent = &spi->dev;
@@ -946,18 +925,7 @@ static struct spi_driver dataflash_driver = {
        /* FIXME:  investigate suspend and resume... */
 };
-static int __init dataflash_init(void)
+module_spi_driver(dataflash_driver);
-{
-        return spi_register_driver(&dataflash_driver);
-}
-module_init(dataflash_init);
-static void __exit dataflash_exit(void)
-{
-        spi_unregister_driver(&dataflash_driver);
-}
-module_exit(dataflash_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Andrew Victor, David Brownell");
diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index 2562689ba6b4..ec59d65897fb 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -34,34 +34,23 @@ static struct mtd_info *mtd_info;
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
        memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);
        return 0;
 }
 static int ram_point(struct mtd_info *mtd, loff_t from, size_t len,
                size_t *retlen, void **virt, resource_size_t *phys)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
-        /* can we return a physical address with this driver? */
-        if (phys)
-                return -EINVAL;
        *virt = mtd->priv + from;
        *retlen = len;
        return 0;
 }
-static void ram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int ram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
+        return 0;
 }
 /*
@@ -80,11 +69,7 @@ static unsigned long ram_get_unmapped_area(struct mtd_info *mtd,
 static int ram_read(struct mtd_info *mtd, loff_t from, size_t len,
                size_t *retlen, u_char *buf)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
        memcpy(buf, mtd->priv + from, len);
        *retlen = len;
        return 0;
 }
@@ -92,11 +77,7 @@ static int ram_read(struct mtd_info *mtd, loff_t from, size_t len,
 static int ram_write(struct mtd_info *mtd, loff_t to, size_t len,
                size_t *retlen, const u_char *buf)
 {
-        if (to + len > mtd->size)
-                return -EINVAL;
        memcpy((char *)mtd->priv + to, buf, len);
        *retlen = len;
        return 0;
 }
@@ -126,12 +107,12 @@ int mtdram_init_device(struct mtd_info *mtd, void *mapped_address,
        mtd->priv = mapped_address;
        mtd->owner = THIS_MODULE;
-        mtd->erase = ram_erase;
+        mtd->_erase = ram_erase;
-        mtd->point = ram_point;
+        mtd->_point = ram_point;
-        mtd->unpoint = ram_unpoint;
+        mtd->_unpoint = ram_unpoint;
-        mtd->get_unmapped_area = ram_get_unmapped_area;
+        mtd->_get_unmapped_area = ram_get_unmapped_area;
-        mtd->read = ram_read;
+        mtd->_read = ram_read;
-        mtd->write = ram_write;
+        mtd->_write = ram_write;
        if (mtd_device_register(mtd, NULL, 0))
                return -EIO;
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 23423bd00b06..67823de68db6 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -33,45 +33,33 @@ struct phram_mtd_list {
 static LIST_HEAD(phram_list);
 static int phram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
        u_char *start = mtd->priv;
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
        memset(start + instr->addr, 0xff, instr->len);
-        /* This'll catch a few races. Free the thing before returning :)
+        /*
+         * This'll catch a few races. Free the thing before returning :)
         * I don't feel at all ashamed. This kind of thing is possible anyway
         * with flash, but unlikely.
         */
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);
        return 0;
 }
 static int phram_point(struct mtd_info *mtd, loff_t from, size_t len,
                size_t *retlen, void **virt, resource_size_t *phys)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
-        /* can we return a physical address with this driver? */
-        if (phys)
-                return -EINVAL;
        *virt = mtd->priv + from;
        *retlen = len;
        return 0;
 }
-static void phram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int phram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
+        return 0;
 }
 static int phram_read(struct mtd_info *mtd, loff_t from, size_t len,
@@ -79,14 +67,7 @@ static int phram_read(struct mtd_info *mtd, loff_t from, size_t len,
 {
        u_char *start = mtd->priv;
-        if (from >= mtd->size)
-                return -EINVAL;
-        if (len > mtd->size - from)
-                len = mtd->size - from;
        memcpy(buf, start + from, len);
        *retlen = len;
        return 0;
 }
@@ -96,20 +77,11 @@ static int phram_write(struct mtd_info *mtd, loff_t to, size_t len,
 {
        u_char *start = mtd->priv;
-        if (to >= mtd->size)
-                return -EINVAL;
-        if (len > mtd->size - to)
-                len = mtd->size - to;
        memcpy(start + to, buf, len);
        *retlen = len;
        return 0;
 }
 static void unregister_devices(void)
 {
        struct phram_mtd_list *this, *safe;
@@ -142,11 +114,11 @@ static int register_device(char *name, unsigned long start, unsigned long len)
        new->mtd.name = name;
        new->mtd.size = len;
        new->mtd.flags = MTD_CAP_RAM;
-        new->mtd.erase = phram_erase;
+        new->mtd._erase = phram_erase;
-        new->mtd.point = phram_point;
+        new->mtd._point = phram_point;
-        new->mtd.unpoint = phram_unpoint;
+        new->mtd._unpoint = phram_unpoint;
-        new->mtd.read = phram_read;
+        new->mtd._read = phram_read;
-        new->mtd.write = phram_write;
+        new->mtd._write = phram_write;
        new->mtd.owner = THIS_MODULE;
        new->mtd.type = MTD_RAM;
        new->mtd.erasesize = PAGE_SIZE;
@@ -233,7 +205,17 @@ static inline void kill_final_newline(char *str)
        return 1;               \
 } while (0)
-static int phram_setup(const char *val, struct kernel_param *kp)
+/*
+ * This shall contain the module parameter if any. It is of the form:
+ * - phram=<device>,<address>,<size> for module case
+ * - phram.phram=<device>,<address>,<size> for built-in case
+ * We leave 64 bytes for the device name, 12 for the address and 12 for the
+ * size.
+ * Example: phram.phram=rootfs,0xa0000000,512Mi
+ */
+static __initdata char phram_paramline[64+12+12];
+static int __init phram_setup(const char *val)
 {
        char buf[64+12+12], *str = buf;
        char *token[3];
@@ -282,12 +264,28 @@ static int phram_setup(const char *val, struct kernel_param *kp)
        return ret;
 }
-module_param_call(phram, phram_setup, NULL, NULL, 000);
+static int __init phram_param_call(const char *val, struct kernel_param *kp)
+{
+        /*
+         * This function is always called before 'init_phram()', whether
+         * built-in or module.
+         */
+        if (strlen(val) >= sizeof(phram_paramline))
+                return -ENOSPC;
+        strcpy(phram_paramline, val);
+        return 0;
+}
+module_param_call(phram, phram_param_call, NULL, NULL, 000);
 MODULE_PARM_DESC(phram, "Memory region to map. \"phram=<name>,<start>,<length>\"");
 static int __init init_phram(void)
 {
+        if (phram_paramline[0])
+                return phram_setup(phram_paramline);
        return 0;
 }
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 5d53c5760a6c..0c51b988e1f8 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -94,12 +94,48 @@
 #include <linux/ioctl.h>
 #include <asm/io.h>
 #include <linux/pci.h>
 #include <linux/mtd/mtd.h>
-#include <linux/mtd/pmc551.h>
+#define PMC551_VERSION \
+        "Ramix PMC551 PCI Mezzanine Ram Driver. (C) 1999,2000 Nortel Networks.\n"
+#define PCI_VENDOR_ID_V3_SEMI 0x11b0
+#define PCI_DEVICE_ID_V3_SEMI_V370PDC 0x0200
+#define PMC551_PCI_MEM_MAP0 0x50
+#define PMC551_PCI_MEM_MAP1 0x54
+#define PMC551_PCI_MEM_MAP_MAP_ADDR_MASK 0x3ff00000
+#define PMC551_PCI_MEM_MAP_APERTURE_MASK 0x000000f0
+#define PMC551_PCI_MEM_MAP_REG_EN 0x00000002
+#define PMC551_PCI_MEM_MAP_ENABLE 0x00000001
+#define PMC551_SDRAM_MA  0x60
+#define PMC551_SDRAM_CMD 0x62
+#define PMC551_DRAM_CFG  0x64
+#define PMC551_SYS_CTRL_REG 0x78
+#define PMC551_DRAM_BLK0 0x68
+#define PMC551_DRAM_BLK1 0x6c
+#define PMC551_DRAM_BLK2 0x70
+#define PMC551_DRAM_BLK3 0x74
+#define PMC551_DRAM_BLK_GET_SIZE(x) (524288 << ((x >> 4) & 0x0f))
+#define PMC551_DRAM_BLK_SET_COL_MUX(x, v) (((x) & ~0x00007000) | (((v) & 0x7) << 12))
+#define PMC551_DRAM_BLK_SET_ROW_MUX(x, v) (((x) & ~0x00000f00) | (((v) & 0xf) << 8))
+struct mypriv {
+        struct pci_dev *dev;
+        u_char *start;
+        u32 base_map0;
+        u32 curr_map0;
+        u32 asize;
+        struct mtd_info *nextpmc551;
+};
 static struct mtd_info *pmc551list;
+static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
+                        size_t *retlen, void **virt, resource_size_t *phys);
 static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
        struct mypriv *priv = mtd->priv;
@@ -115,16 +151,6 @@ static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
 #endif
        end = instr->addr + instr->len - 1;
-        /* Is it past the end? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_erase() out of bounds (%ld > %ld)\n",
-                        (long)end, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
        eoff_hi = end & ~(priv->asize - 1);
        soff_hi = instr->addr & ~(priv->asize - 1);
        eoff_lo = end & (priv->asize - 1);
@@ -178,18 +204,6 @@ static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
        printk(KERN_DEBUG "pmc551_point(%ld, %ld)\n", (long)from, (long)len);
 #endif
-        if (from + len > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_point() out of bounds (%ld > %ld)\n",
-                        (long)from + len, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
-        /* can we return a physical address with this driver? */
-        if (phys)
-                return -EINVAL;
        soff_hi = from & ~(priv->asize - 1);
        soff_lo = from & (priv->asize - 1);
@@ -205,11 +219,12 @@ static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
        return 0;
 }
-static void pmc551_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int pmc551_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
 #ifdef CONFIG_MTD_PMC551_DEBUG
        printk(KERN_DEBUG "pmc551_unpoint()\n");
 #endif
+        return 0;
 }
 static int pmc551_read(struct mtd_info *mtd, loff_t from, size_t len,
@@ -228,16 +243,6 @@ static int pmc551_read(struct mtd_info *mtd, loff_t from, size_t len,
 #endif
        end = from + len - 1;
-        /* Is it past the end? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_read() out of bounds (%ld > %ld)\n",
-                        (long)end, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
        soff_hi = from & ~(priv->asize - 1);
        eoff_hi = end & ~(priv->asize - 1);
        soff_lo = from & (priv->asize - 1);
@@ -295,16 +300,6 @@ static int pmc551_write(struct mtd_info *mtd, loff_t to, size_t len,
 #endif
        end = to + len - 1;
-        /* Is it past the end?  or did the u32 wrap? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_write() out of bounds (end: %ld, "
-                        "size: %ld, to: %ld)\n", (long)end, (long)mtd->size,
-                        (long)to);
-#endif
-                return -EINVAL;
-        }
        soff_hi = to & ~(priv->asize - 1);
        eoff_hi = end & ~(priv->asize - 1);
        soff_lo = to & (priv->asize - 1);
@@ -358,7 +353,7 @@ static int pmc551_write(struct mtd_info *mtd, loff_t to, size_t len,
 * mechanism
 * returns the size of the memory region found.
 */
-static u32 fixup_pmc551(struct pci_dev *dev)
+static int fixup_pmc551(struct pci_dev *dev)
 {
 #ifdef CONFIG_MTD_PMC551_BUGFIX
        u32 dram_data;
@@ -668,7 +663,7 @@ static int __init init_pmc551(void)
        struct mypriv *priv;
        int found = 0;
        struct mtd_info *mtd;
-        u32 length = 0;
+        int length = 0;
        if (msize) {
                msize = (1 << (ffs(msize) - 1)) << 20;
@@ -786,11 +781,11 @@ static int __init init_pmc551(void)
                mtd->size = msize;
                mtd->flags = MTD_CAP_RAM;
-                mtd->erase = pmc551_erase;
+                mtd->_erase = pmc551_erase;
-                mtd->read = pmc551_read;
+                mtd->_read = pmc551_read;
-                mtd->write = pmc551_write;
+                mtd->_write = pmc551_write;
-                mtd->point = pmc551_point;
+                mtd->_point = pmc551_point;
-                mtd->unpoint = pmc551_unpoint;
+                mtd->_unpoint = pmc551_unpoint;
                mtd->type = MTD_RAM;
                mtd->name = "PMC551 RAM board";
                mtd->erasesize = 0x10000;
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 288594163c22..8f52fc858e48 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -75,7 +75,7 @@ static slram_mtd_list_t *slram_mtdlist = NULL;
 static int slram_erase(struct mtd_info *, struct erase_info *);
 static int slram_point(struct mtd_info *, loff_t, size_t, size_t *, void **,
                resource_size_t *);
-static void slram_unpoint(struct mtd_info *, loff_t, size_t);
+static int slram_unpoint(struct mtd_info *, loff_t, size_t);
 static int slram_read(struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int slram_write(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -83,21 +83,13 @@ static int slram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
        slram_priv_t *priv = mtd->priv;
-        if (instr->addr + instr->len > mtd->size) {
-                return(-EINVAL);
-        }
        memset(priv->start + instr->addr, 0xff, instr->len);
        /* This'll catch a few races. Free the thing before returning :)
         * I don't feel at all ashamed. This kind of thing is possible anyway
         * with flash, but unlikely.
         */
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);
        return(0);
 }
@@ -106,20 +98,14 @@ static int slram_point(struct mtd_info *mtd, loff_t from, size_t len,
 {
        slram_priv_t *priv = mtd->priv;
-        /* can we return a physical address with this driver? */
-        if (phys)
-                return -EINVAL;
-        if (from + len > mtd->size)
-                return -EINVAL;
        *virt = priv->start + from;
        *retlen = len;
        return(0);
 }
-static void slram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int slram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
+        return 0;
 }
 static int slram_read(struct mtd_info *mtd, loff_t from, size_t len,
@@ -127,14 +113,7 @@ static int slram_read(struct mtd_info *mtd, loff_t from, size_t len,
 {
        slram_priv_t *priv = mtd->priv;
-        if (from > mtd->size)
-                return -EINVAL;
-        if (from + len > mtd->size)
-                len = mtd->size - from;
        memcpy(buf, priv->start + from, len);
        *retlen = len;
        return(0);
 }
@@ -144,11 +123,7 @@ static int slram_write(struct mtd_info *mtd, loff_t to, size_t len,
 {
        slram_priv_t *priv = mtd->priv;
-        if (to + len > mtd->size)
-                return -EINVAL;
        memcpy(priv->start + to, buf, len);
        *retlen = len;
        return(0);
 }
@@ -199,11 +174,11 @@ static int register_device(char *name, unsigned long start, unsigned long length
        (*curmtd)->mtdinfo->name = name;
        (*curmtd)->mtdinfo->size = length;
        (*curmtd)->mtdinfo->flags = MTD_CAP_RAM;
-        (*curmtd)->mtdinfo->erase = slram_erase;
+        (*curmtd)->mtdinfo->_erase = slram_erase;
-        (*curmtd)->mtdinfo->point = slram_point;
+        (*curmtd)->mtdinfo->_point = slram_point;
-        (*curmtd)->mtdinfo->unpoint = slram_unpoint;
+        (*curmtd)->mtdinfo->_unpoint = slram_unpoint;
-        (*curmtd)->mtdinfo->read = slram_read;
+        (*curmtd)->mtdinfo->_read = slram_read;
-        (*curmtd)->mtdinfo->write = slram_write;
+        (*curmtd)->mtdinfo->_write = slram_write;
        (*curmtd)->mtdinfo->owner = THIS_MODULE;
        (*curmtd)->mtdinfo->type = MTD_RAM;
        (*curmtd)->mtdinfo->erasesize = SLRAM_BLK_SZ;
diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c
new file mode 100644
index 000000000000..797d43cd3550
--- /dev/null
+++ b/drivers/mtd/devices/spear_smi.c
@@ -0,0 +1,1147 @@
+/*
+ * SMI (Serial Memory Controller) device driver for Serial NOR Flash on
+ * SPEAr platform
+ * The serial nor interface is largely based on drivers/mtd/m25p80.c,
+ * however the SPI interface has been replaced by SMI.
+ *
+ * Copyright © 2010 STMicroelectronics.
+ * Ashish Priyadarshi
+ * Shiraz Hashim <shiraz.hashim@st.com>
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/param.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/spear_smi.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+/* SMI clock rate */
+#define SMI_MAX_CLOCK_FREQ      50000000 /* 50 MHz */
+/* MAX time out to safely come out of a erase or write busy conditions */
+#define SMI_PROBE_TIMEOUT       (HZ / 10)
+#define SMI_MAX_TIME_OUT        (3 * HZ)
+/* timeout for command completion */
+#define SMI_CMD_TIMEOUT         (HZ / 10)
+/* registers of smi */
+#define SMI_CR1         0x0     /* SMI control register 1 */
+#define SMI_CR2         0x4     /* SMI control register 2 */
+#define SMI_SR          0x8     /* SMI status register */
+#define SMI_TR          0xC     /* SMI transmit register */
+#define SMI_RR          0x10    /* SMI receive register */
+/* defines for control_reg 1 */
+#define BANK_EN         (0xF << 0)      /* enables all banks */
+#define DSEL_TIME       (0x6 << 4)      /* Deselect time 6 + 1 SMI_CK periods */
+#define SW_MODE         (0x1 << 28)     /* enables SW Mode */
+#define WB_MODE         (0x1 << 29)     /* Write Burst Mode */
+#define FAST_MODE       (0x1 << 15)     /* Fast Mode */
+#define HOLD1           (0x1 << 16)     /* Clock Hold period selection */
+/* defines for control_reg 2 */
+#define SEND            (0x1 << 7)      /* Send data */
+#define TFIE            (0x1 << 8)      /* Transmission Flag Interrupt Enable */
+#define WCIE            (0x1 << 9)      /* Write Complete Interrupt Enable */
+#define RD_STATUS_REG   (0x1 << 10)     /* reads status reg */
+#define WE              (0x1 << 11)     /* Write Enable */
+#define TX_LEN_SHIFT    0
+#define RX_LEN_SHIFT    4
+#define BANK_SHIFT      12
+/* defines for status register */
+#define SR_WIP          0x1     /* Write in progress */
+#define SR_WEL          0x2     /* Write enable latch */
+#define SR_BP0          0x4     /* Block protect 0 */
+#define SR_BP1          0x8     /* Block protect 1 */
+#define SR_BP2          0x10    /* Block protect 2 */
+#define SR_SRWD         0x80    /* SR write protect */
+#define TFF             0x100   /* Transfer Finished Flag */
+#define WCF             0x200   /* Transfer Finished Flag */
+#define ERF1            0x400   /* Forbidden Write Request */
+#define ERF2            0x800   /* Forbidden Access */
+#define WM_SHIFT        12
+/* flash opcodes */
+#define OPCODE_RDID     0x9f    /* Read JEDEC ID */
+/* Flash Device Ids maintenance section */
+/* data structure to maintain flash ids from different vendors */
+struct flash_device {
+        char *name;
+        u8 erase_cmd;
+        u32 device_id;
+        u32 pagesize;
+        unsigned long sectorsize;
+        unsigned long size_in_bytes;
+};
+#define FLASH_ID(n, es, id, psize, ssize, size) \
+{                               \
+        .name = n,              \
+        .erase_cmd = es,        \
+        .device_id = id,        \
+        .pagesize = psize,      \
+        .sectorsize = ssize,    \
+        .size_in_bytes = size   \
+}
+static struct flash_device flash_devices[] = {
+        FLASH_ID("st m25p16"     , 0xd8, 0x00152020, 0x100, 0x10000, 0x200000),
+        FLASH_ID("st m25p32"     , 0xd8, 0x00162020, 0x100, 0x10000, 0x400000),
+        FLASH_ID("st m25p64"     , 0xd8, 0x00172020, 0x100, 0x10000, 0x800000),
+        FLASH_ID("st m25p128"    , 0xd8, 0x00182020, 0x100, 0x40000, 0x1000000),
+        FLASH_ID("st m25p05"     , 0xd8, 0x00102020, 0x80 , 0x8000 , 0x10000),
+        FLASH_ID("st m25p10"     , 0xd8, 0x00112020, 0x80 , 0x8000 , 0x20000),
+        FLASH_ID("st m25p20"     , 0xd8, 0x00122020, 0x100, 0x10000, 0x40000),
+        FLASH_ID("st m25p40"     , 0xd8, 0x00132020, 0x100, 0x10000, 0x80000),
+        FLASH_ID("st m25p80"     , 0xd8, 0x00142020, 0x100, 0x10000, 0x100000),
+        FLASH_ID("st m45pe10"    , 0xd8, 0x00114020, 0x100, 0x10000, 0x20000),
+        FLASH_ID("st m45pe20"    , 0xd8, 0x00124020, 0x100, 0x10000, 0x40000),
+        FLASH_ID("st m45pe40"    , 0xd8, 0x00134020, 0x100, 0x10000, 0x80000),
+        FLASH_ID("st m45pe80"    , 0xd8, 0x00144020, 0x100, 0x10000, 0x100000),
+        FLASH_ID("sp s25fl004"   , 0xd8, 0x00120201, 0x100, 0x10000, 0x80000),
+        FLASH_ID("sp s25fl008"   , 0xd8, 0x00130201, 0x100, 0x10000, 0x100000),
+        FLASH_ID("sp s25fl016"   , 0xd8, 0x00140201, 0x100, 0x10000, 0x200000),
+        FLASH_ID("sp s25fl032"   , 0xd8, 0x00150201, 0x100, 0x10000, 0x400000),
+        FLASH_ID("sp s25fl064"   , 0xd8, 0x00160201, 0x100, 0x10000, 0x800000),
+        FLASH_ID("atmel 25f512"  , 0x52, 0x0065001F, 0x80 , 0x8000 , 0x10000),
+        FLASH_ID("atmel 25f1024" , 0x52, 0x0060001F, 0x100, 0x8000 , 0x20000),
+        FLASH_ID("atmel 25f2048" , 0x52, 0x0063001F, 0x100, 0x10000, 0x40000),
+        FLASH_ID("atmel 25f4096" , 0x52, 0x0064001F, 0x100, 0x10000, 0x80000),
+        FLASH_ID("atmel 25fs040" , 0xd7, 0x0004661F, 0x100, 0x10000, 0x80000),
+        FLASH_ID("mac 25l512"    , 0xd8, 0x001020C2, 0x010, 0x10000, 0x10000),
+        FLASH_ID("mac 25l1005"   , 0xd8, 0x001120C2, 0x010, 0x10000, 0x20000),
+        FLASH_ID("mac 25l2005"   , 0xd8, 0x001220C2, 0x010, 0x10000, 0x40000),
+        FLASH_ID("mac 25l4005"   , 0xd8, 0x001320C2, 0x010, 0x10000, 0x80000),
+        FLASH_ID("mac 25l4005a"  , 0xd8, 0x001320C2, 0x010, 0x10000, 0x80000),
+        FLASH_ID("mac 25l8005"   , 0xd8, 0x001420C2, 0x010, 0x10000, 0x100000),
+        FLASH_ID("mac 25l1605"   , 0xd8, 0x001520C2, 0x100, 0x10000, 0x200000),
+        FLASH_ID("mac 25l1605a"  , 0xd8, 0x001520C2, 0x010, 0x10000, 0x200000),
+        FLASH_ID("mac 25l3205"   , 0xd8, 0x001620C2, 0x100, 0x10000, 0x400000),
+        FLASH_ID("mac 25l3205a"  , 0xd8, 0x001620C2, 0x100, 0x10000, 0x400000),
+        FLASH_ID("mac 25l6405"   , 0xd8, 0x001720C2, 0x100, 0x10000, 0x800000),
+};
+/* Define spear specific structures */
+struct spear_snor_flash;
+/**
+ * struct spear_smi - Structure for SMI Device
+ *
+ * @clk: functional clock
+ * @status: current status register of SMI.
+ * @clk_rate: functional clock rate of SMI (default: SMI_MAX_CLOCK_FREQ)
+ * @lock: lock to prevent parallel access of SMI.
+ * @io_base: base address for registers of SMI.
+ * @pdev: platform device
+ * @cmd_complete: queue to wait for command completion of NOR-flash.
+ * @num_flashes: number of flashes actually present on board.
+ * @flash: separate structure for each Serial NOR-flash attached to SMI.
+ */
+struct spear_smi {
+        struct clk *clk;
+        u32 status;
+        unsigned long clk_rate;
+        struct mutex lock;
+        void __iomem *io_base;
+        struct platform_device *pdev;
+        wait_queue_head_t cmd_complete;
+        u32 num_flashes;
+        struct spear_snor_flash *flash[MAX_NUM_FLASH_CHIP];
+};
+/**
+ * struct spear_snor_flash - Structure for Serial NOR Flash
+ *
+ * @bank: Bank number(0, 1, 2, 3) for each NOR-flash.
+ * @dev_id: Device ID of NOR-flash.
+ * @lock: lock to manage flash read, write and erase operations
+ * @mtd: MTD info for each NOR-flash.
+ * @num_parts: Total number of partition in each bank of NOR-flash.
+ * @parts: Partition info for each bank of NOR-flash.
+ * @page_size: Page size of NOR-flash.
+ * @base_addr: Base address of NOR-flash.
+ * @erase_cmd: erase command may vary on different flash types
+ * @fast_mode: flash supports read in fast mode
+ */
+struct spear_snor_flash {
+        u32 bank;
+        u32 dev_id;
+        struct mutex lock;
+        struct mtd_info mtd;
+        u32 num_parts;
+        struct mtd_partition *parts;
+        u32 page_size;
+        void __iomem *base_addr;
+        u8 erase_cmd;
+        u8 fast_mode;
+};
+static inline struct spear_snor_flash *get_flash_data(struct mtd_info *mtd)
+{
+        return container_of(mtd, struct spear_snor_flash, mtd);
+}
+/**
+ * spear_smi_read_sr - Read status register of flash through SMI
+ * @dev: structure of SMI information.
+ * @bank: bank to which flash is connected
+ *
+ * This routine will return the status register of the flash chip present at the
+ * given bank.
+ */
+static int spear_smi_read_sr(struct spear_smi *dev, u32 bank)
+{
+        int ret;
+        u32 ctrlreg1;
+        mutex_lock(&dev->lock);
+        dev->status = 0; /* Will be set in interrupt handler */
+        ctrlreg1 = readl(dev->io_base + SMI_CR1);
+        /* program smi in hw mode */
+        writel(ctrlreg1 & ~(SW_MODE | WB_MODE), dev->io_base + SMI_CR1);
+        /* performing a rsr instruction in hw mode */
+        writel((bank << BANK_SHIFT) | RD_STATUS_REG | TFIE,
+                        dev->io_base + SMI_CR2);
+        /* wait for tff */
+        ret = wait_event_interruptible_timeout(dev->cmd_complete,
+                        dev->status & TFF, SMI_CMD_TIMEOUT);
+        /* copy dev->status (lower 16 bits) in order to release lock */
+        if (ret > 0)
+                ret = dev->status & 0xffff;
+        else
+                ret = -EIO;
+        /* restore the ctrl regs state */
+        writel(ctrlreg1, dev->io_base + SMI_CR1);
+        writel(0, dev->io_base + SMI_CR2);
+        mutex_unlock(&dev->lock);
+        return ret;
+}
+/**
+ * spear_smi_wait_till_ready - wait till flash is ready
+ * @dev: structure of SMI information.
+ * @bank: flash corresponding to this bank
+ * @timeout: timeout for busy wait condition
+ *
+ * This routine checks for WIP (write in progress) bit in Status register
+ * If successful the routine returns 0 else -EBUSY
+ */
+static int spear_smi_wait_till_ready(struct spear_smi *dev, u32 bank,
+                unsigned long timeout)
+{
+        unsigned long finish;
+        int status;
+        finish = jiffies + timeout;
+        do {
+                status = spear_smi_read_sr(dev, bank);
+                if (status < 0)
+                        continue; /* try till timeout */
+                else if (!(status & SR_WIP))
+                        return 0;
+                cond_resched();
+        } while (!time_after_eq(jiffies, finish));
+        dev_err(&dev->pdev->dev, "smi controller is busy, timeout\n");
+        return status;
+}
+/**
+ * spear_smi_int_handler - SMI Interrupt Handler.
+ * @irq: irq number
+ * @dev_id: structure of SMI device, embedded in dev_id.
+ *
+ * The handler clears all interrupt conditions and records the status in
+ * dev->status which is used by the driver later.
+ */
+static irqreturn_t spear_smi_int_handler(int irq, void *dev_id)
+{
+        u32 status = 0;
+        struct spear_smi *dev = dev_id;
+        status = readl(dev->io_base + SMI_SR);
+        if (unlikely(!status))
+                return IRQ_NONE;
+        /* clear all interrupt conditions */
+        writel(0, dev->io_base + SMI_SR);
+        /* copy the status register in dev->status */
+        dev->status |= status;
+        /* send the completion */
+        wake_up_interruptible(&dev->cmd_complete);
+        return IRQ_HANDLED;
+}
+/**
+ * spear_smi_hw_init - initializes the smi controller.
+ * @dev: structure of smi device
+ *
+ * this routine initializes the smi controller wit the default values
+ */
+static void spear_smi_hw_init(struct spear_smi *dev)
+{
+        unsigned long rate = 0;
+        u32 prescale = 0;
+        u32 val;
+        rate = clk_get_rate(dev->clk);
+        /* functional clock of smi */
+        prescale = DIV_ROUND_UP(rate, dev->clk_rate);
+        /*
+         * setting the standard values, fast mode, prescaler for
+         * SMI_MAX_CLOCK_FREQ (50MHz) operation and bank enable
+         */
+        val = HOLD1 | BANK_EN | DSEL_TIME | (prescale << 8);
+        mutex_lock(&dev->lock);
+        writel(val, dev->io_base + SMI_CR1);
+        mutex_unlock(&dev->lock);
+}
+/**
+ * get_flash_index - match chip id from a flash list.
+ * @flash_id: a valid nor flash chip id obtained from board.
+ *
+ * try to validate the chip id by matching from a list, if not found then simply
+ * returns negative. In case of success returns index in to the flash devices
+ * array.
+ */
+static int get_flash_index(u32 flash_id)
+{
+        int index;
+        /* Matches chip-id to entire list of 'serial-nor flash' ids */
+        for (index = 0; index < ARRAY_SIZE(flash_devices); index++) {
+                if (flash_devices[index].device_id == flash_id)
+                        return index;
+        }
+        /* Memory chip is not listed and not supported */
+        return -ENODEV;
+}
+/**
+ * spear_smi_write_enable - Enable the flash to do write operation
+ * @dev: structure of SMI device
+ * @bank: enable write for flash connected to this bank
+ *
+ * Set write enable latch with Write Enable command.
+ * Returns 0 on success.
+ */
+static int spear_smi_write_enable(struct spear_smi *dev, u32 bank)
+{
+        int ret;
+        u32 ctrlreg1;
+        mutex_lock(&dev->lock);
+        dev->status = 0; /* Will be set in interrupt handler */
+        ctrlreg1 = readl(dev->io_base + SMI_CR1);
+        /* program smi in h/w mode */
+        writel(ctrlreg1 & ~SW_MODE, dev->io_base + SMI_CR1);
+        /* give the flash, write enable command */
+        writel((bank << BANK_SHIFT) | WE | TFIE, dev->io_base + SMI_CR2);
+        ret = wait_event_interruptible_timeout(dev->cmd_complete,
+                        dev->status & TFF, SMI_CMD_TIMEOUT);
+        /* restore the ctrl regs state */
+        writel(ctrlreg1, dev->io_base + SMI_CR1);
+        writel(0, dev->io_base + SMI_CR2);
+        if (ret <= 0) {
+                ret = -EIO;
+                dev_err(&dev->pdev->dev,
+                        "smi controller failed on write enable\n");
+        } else {
+                /* check whether write mode status is set for required bank */
+                if (dev->status & (1 << (bank + WM_SHIFT)))
+                        ret = 0;
+                else {
+                        dev_err(&dev->pdev->dev, "couldn't enable write\n");
+                        ret = -EIO;
+                }
+        }
+        mutex_unlock(&dev->lock);
+        return ret;
+}
+static inline u32
+get_sector_erase_cmd(struct spear_snor_flash *flash, u32 offset)
+{
+        u32 cmd;
+        u8 *x = (u8 *)&cmd;
+        x[0] = flash->erase_cmd;
+        x[1] = offset >> 16;
+        x[2] = offset >> 8;
+        x[3] = offset;
+        return cmd;
+}
+/**
+ * spear_smi_erase_sector - erase one sector of flash
+ * @dev: structure of SMI information
+ * @command: erase command to be send
+ * @bank: bank to which this command needs to be send
+ * @bytes: size of command
+ *
+ * Erase one sector of flash memory at offset ``offset'' which is any
+ * address within the sector which should be erased.
+ * Returns 0 if successful, non-zero otherwise.
+ */
+static int spear_smi_erase_sector(struct spear_smi *dev,
+                u32 bank, u32 command, u32 bytes)
+{
+        u32 ctrlreg1 = 0;
+        int ret;
+        ret = spear_smi_wait_till_ready(dev, bank, SMI_MAX_TIME_OUT);
+        if (ret)
+                return ret;
+        ret = spear_smi_write_enable(dev, bank);
+        if (ret)
+                return ret;
+        mutex_lock(&dev->lock);
+        ctrlreg1 = readl(dev->io_base + SMI_CR1);
+        writel((ctrlreg1 | SW_MODE) & ~WB_MODE, dev->io_base + SMI_CR1);
+        /* send command in sw mode */
+        writel(command, dev->io_base + SMI_TR);
+        writel((bank << BANK_SHIFT) | SEND | TFIE | (bytes << TX_LEN_SHIFT),
+                        dev->io_base + SMI_CR2);
+        ret = wait_event_interruptible_timeout(dev->cmd_complete,
+                        dev->status & TFF, SMI_CMD_TIMEOUT);
+        if (ret <= 0) {
+                ret = -EIO;
+                dev_err(&dev->pdev->dev, "sector erase failed\n");
+        } else
+                ret = 0; /* success */
+        /* restore ctrl regs */
+        writel(ctrlreg1, dev->io_base + SMI_CR1);
+        writel(0, dev->io_base + SMI_CR2);
+        mutex_unlock(&dev->lock);
+        return ret;
+}
+/**
+ * spear_mtd_erase - perform flash erase operation as requested by user
+ * @mtd: Provides the memory characteristics
+ * @e_info: Provides the erase information
+ *
+ * Erase an address range on the flash chip. The address range may extend
+ * one or more erase sectors. Return an error is there is a problem erasing.
+ */
+static int spear_mtd_erase(struct mtd_info *mtd, struct erase_info *e_info)
+{
+        struct spear_snor_flash *flash = get_flash_data(mtd);
+        struct spear_smi *dev = mtd->priv;
+        u32 addr, command, bank;
+        int len, ret;
+        if (!flash || !dev)
+                return -ENODEV;
+        bank = flash->bank;
+        if (bank > dev->num_flashes - 1) {
+                dev_err(&dev->pdev->dev, "Invalid Bank Num");
+                return -EINVAL;
+        }
+        addr = e_info->addr;
+        len = e_info->len;
+        mutex_lock(&flash->lock);
+        /* now erase sectors in loop */
+        while (len) {
+                command = get_sector_erase_cmd(flash, addr);
+                /* preparing the command for flash */
+                ret = spear_smi_erase_sector(dev, bank, command, 4);
+                if (ret) {
+                        e_info->state = MTD_ERASE_FAILED;
+                        mutex_unlock(&flash->lock);
+                        return ret;
+                }
+                addr += mtd->erasesize;
+                len -= mtd->erasesize;
+        }
+        mutex_unlock(&flash->lock);
+        e_info->state = MTD_ERASE_DONE;
+        mtd_erase_callback(e_info);
+        return 0;
+}
+/**
+ * spear_mtd_read - performs flash read operation as requested by the user
+ * @mtd: MTD information of the memory bank
+ * @from: Address from which to start read
+ * @len: Number of bytes to be read
+ * @retlen: Fills the Number of bytes actually read
+ * @buf: Fills this after reading
+ *
+ * Read an address range from the flash chip. The address range
+ * may be any size provided it is within the physical boundaries.
+ * Returns 0 on success, non zero otherwise
+ */
+static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len,
+                size_t *retlen, u8 *buf)
+{
+        struct spear_snor_flash *flash = get_flash_data(mtd);
+        struct spear_smi *dev = mtd->priv;
+        void *src;
+        u32 ctrlreg1, val;
+        int ret;
+        if (!flash || !dev)
+                return -ENODEV;
+        if (flash->bank > dev->num_flashes - 1) {
+                dev_err(&dev->pdev->dev, "Invalid Bank Num");
+                return -EINVAL;
+        }
+        /* select address as per bank number */
+        src = flash->base_addr + from;
+        mutex_lock(&flash->lock);
+        /* wait till previous write/erase is done. */
+        ret = spear_smi_wait_till_ready(dev, flash->bank, SMI_MAX_TIME_OUT);
+        if (ret) {
+                mutex_unlock(&flash->lock);
+                return ret;
+        }
+        mutex_lock(&dev->lock);
+        /* put smi in hw mode not wbt mode */
+        ctrlreg1 = val = readl(dev->io_base + SMI_CR1);
+        val &= ~(SW_MODE | WB_MODE);
+        if (flash->fast_mode)
+                val |= FAST_MODE;
+        writel(val, dev->io_base + SMI_CR1);
+        memcpy_fromio(buf, (u8 *)src, len);
+        /* restore ctrl reg1 */
+        writel(ctrlreg1, dev->io_base + SMI_CR1);
+        mutex_unlock(&dev->lock);
+        *retlen = len;
+        mutex_unlock(&flash->lock);
+        return 0;
+}
+static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank,
+                void *dest, const void *src, size_t len)
+{
+        int ret;
+        u32 ctrlreg1;
+        /* wait until finished previous write command. */
+        ret = spear_smi_wait_till_ready(dev, bank, SMI_MAX_TIME_OUT);
+        if (ret)
+                return ret;
+        /* put smi in write enable */
+        ret = spear_smi_write_enable(dev, bank);
+        if (ret)
+                return ret;
+        /* put smi in hw, write burst mode */
+        mutex_lock(&dev->lock);
+        ctrlreg1 = readl(dev->io_base + SMI_CR1);
+        writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1);
+        memcpy_toio(dest, src, len);
+        writel(ctrlreg1, dev->io_base + SMI_CR1);
+        mutex_unlock(&dev->lock);
+        return 0;
+}
+/**
+ * spear_mtd_write - performs write operation as requested by the user.
+ * @mtd: MTD information of the memory bank.
+ * @to: Address to write.
+ * @len: Number of bytes to be written.
+ * @retlen: Number of bytes actually wrote.
+ * @buf: Buffer from which the data to be taken.
+ *
+ * Write an address range to the flash chip. Data must be written in
+ * flash_page_size chunks. The address range may be any size provided
+ * it is within the physical boundaries.
+ * Returns 0 on success, non zero otherwise
+ */
+static int spear_mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
+                size_t *retlen, const u8 *buf)
+{
+        struct spear_snor_flash *flash = get_flash_data(mtd);
+        struct spear_smi *dev = mtd->priv;
+        void *dest;
+        u32 page_offset, page_size;
+        int ret;
+        if (!flash || !dev)
+                return -ENODEV;
+        if (flash->bank > dev->num_flashes - 1) {
+                dev_err(&dev->pdev->dev, "Invalid Bank Num");
+                return -EINVAL;
+        }
+        /* select address as per bank number */
+        dest = flash->base_addr + to;
+        mutex_lock(&flash->lock);
+        page_offset = (u32)to % flash->page_size;
+        /* do if all the bytes fit onto one page */
+        if (page_offset + len <= flash->page_size) {
+                ret = spear_smi_cpy_toio(dev, flash->bank, dest, buf, len);
+                if (!ret)
+                        *retlen += len;
+        } else {
+                u32 i;
+                /* the size of data remaining on the first page */
+                page_size = flash->page_size - page_offset;
+                ret = spear_smi_cpy_toio(dev, flash->bank, dest, buf,
+                                page_size);
+                if (ret)
+                        goto err_write;
+                else
+                        *retlen += page_size;
+                /* write everything in pagesize chunks */
+                for (i = page_size; i < len; i += page_size) {
+                        page_size = len - i;
+                        if (page_size > flash->page_size)
+                                page_size = flash->page_size;
+                        ret = spear_smi_cpy_toio(dev, flash->bank, dest + i,
+                                        buf + i, page_size);
+                        if (ret)
+                                break;
+                        else
+                                *retlen += page_size;
+                }
+        }
+err_write:
+        mutex_unlock(&flash->lock);
+        return ret;
+}
+/**
+ * spear_smi_probe_flash - Detects the NOR Flash chip.
+ * @dev: structure of SMI information.
+ * @bank: bank on which flash must be probed
+ *
+ * This routine will check whether there exists a flash chip on a given memory
+ * bank ID.
+ * Return index of the probed flash in flash devices structure
+ */
+static int spear_smi_probe_flash(struct spear_smi *dev, u32 bank)
+{
+        int ret;
+        u32 val = 0;
+        ret = spear_smi_wait_till_ready(dev, bank, SMI_PROBE_TIMEOUT);
+        if (ret)
+                return ret;
+        mutex_lock(&dev->lock);
+        dev->status = 0; /* Will be set in interrupt handler */
+        /* put smi in sw mode */
+        val = readl(dev->io_base + SMI_CR1);
+        writel(val | SW_MODE, dev->io_base + SMI_CR1);
+        /* send readid command in sw mode */
+        writel(OPCODE_RDID, dev->io_base + SMI_TR);
+        val = (bank << BANK_SHIFT) | SEND | (1 << TX_LEN_SHIFT) |
+                (3 << RX_LEN_SHIFT) | TFIE;
+        writel(val, dev->io_base + SMI_CR2);
+        /* wait for TFF */
+        ret = wait_event_interruptible_timeout(dev->cmd_complete,
+                        dev->status & TFF, SMI_CMD_TIMEOUT);
+        if (ret <= 0) {
+                ret = -ENODEV;
+                goto err_probe;
+        }
+        /* get memory chip id */
+        val = readl(dev->io_base + SMI_RR);
+        val &= 0x00ffffff;
+        ret = get_flash_index(val);
+err_probe:
+        /* clear sw mode */
+        val = readl(dev->io_base + SMI_CR1);
+        writel(val & ~SW_MODE, dev->io_base + SMI_CR1);
+        mutex_unlock(&dev->lock);
+        return ret;
+}
+#ifdef CONFIG_OF
+static int __devinit spear_smi_probe_config_dt(struct platform_device *pdev,
+                                               struct device_node *np)
+{
+        struct spear_smi_plat_data *pdata = dev_get_platdata(&pdev->dev);
+        struct device_node *pp = NULL;
+        const __be32 *addr;
+        u32 val;
+        int len;
+        int i = 0;
+        if (!np)
+                return -ENODEV;
+        of_property_read_u32(np, "clock-rate", &val);
+        pdata->clk_rate = val;
+        pdata->board_flash_info = devm_kzalloc(&pdev->dev,
+                                               sizeof(*pdata->board_flash_info),
+                                               GFP_KERNEL);
+        /* Fill structs for each subnode (flash device) */
+        while ((pp = of_get_next_child(np, pp))) {
+                struct spear_smi_flash_info *flash_info;
+                flash_info = &pdata->board_flash_info[i];
+                pdata->np[i] = pp;
+                /* Read base-addr and size from DT */
+                addr = of_get_property(pp, "reg", &len);
+                pdata->board_flash_info->mem_base = be32_to_cpup(&addr[0]);
+                pdata->board_flash_info->size = be32_to_cpup(&addr[1]);
+                if (of_get_property(pp, "st,smi-fast-mode", NULL))
+                        pdata->board_flash_info->fast_mode = 1;
+                i++;
+        }
+        pdata->num_flashes = i;
+        return 0;
+}
+#else
+static int __devinit spear_smi_probe_config_dt(struct platform_device *pdev,
+                                               struct device_node *np)
+{
+        return -ENOSYS;
+}
+#endif
+static int spear_smi_setup_banks(struct platform_device *pdev,
+                                 u32 bank, struct device_node *np)
+{
+        struct spear_smi *dev = platform_get_drvdata(pdev);
+        struct mtd_part_parser_data ppdata = {};
+        struct spear_smi_flash_info *flash_info;
+        struct spear_smi_plat_data *pdata;
+        struct spear_snor_flash *flash;
+        struct mtd_partition *parts = NULL;
+        int count = 0;
+        int flash_index;
+        int ret = 0;
+        pdata = dev_get_platdata(&pdev->dev);
+        if (bank > pdata->num_flashes - 1)
+                return -EINVAL;
+        flash_info = &pdata->board_flash_info[bank];
+        if (!flash_info)
+                return -ENODEV;
+        flash = kzalloc(sizeof(*flash), GFP_ATOMIC);
+        if (!flash)
+                return -ENOMEM;
+        flash->bank = bank;
+        flash->fast_mode = flash_info->fast_mode ? 1 : 0;
+        mutex_init(&flash->lock);
+        /* verify whether nor flash is really present on board */
+        flash_index = spear_smi_probe_flash(dev, bank);
+        if (flash_index < 0) {
+                dev_info(&dev->pdev->dev, "smi-nor%d not found\n", bank);
+                ret = flash_index;
+                goto err_probe;
+        }
+        /* map the memory for nor flash chip */
+        flash->base_addr = ioremap(flash_info->mem_base, flash_info->size);
+        if (!flash->base_addr) {
+                ret = -EIO;
+                goto err_probe;
+        }
+        dev->flash[bank] = flash;
+        flash->mtd.priv = dev;
+        if (flash_info->name)
+                flash->mtd.name = flash_info->name;
+        else
+                flash->mtd.name = flash_devices[flash_index].name;
+        flash->mtd.type = MTD_NORFLASH;
+        flash->mtd.writesize = 1;
+        flash->mtd.flags = MTD_CAP_NORFLASH;
+        flash->mtd.size = flash_info->size;
+        flash->mtd.erasesize = flash_devices[flash_index].sectorsize;
+        flash->page_size = flash_devices[flash_index].pagesize;
+        flash->mtd.writebufsize = flash->page_size;
+        flash->erase_cmd = flash_devices[flash_index].erase_cmd;
+        flash->mtd._erase = spear_mtd_erase;
+        flash->mtd._read = spear_mtd_read;
+        flash->mtd._write = spear_mtd_write;
+        flash->dev_id = flash_devices[flash_index].device_id;
+        dev_info(&dev->pdev->dev, "mtd .name=%s .size=%llx(%lluM)\n",
+                        flash->mtd.name, flash->mtd.size,
+                        flash->mtd.size / (1024 * 1024));
+        dev_info(&dev->pdev->dev, ".erasesize = 0x%x(%uK)\n",
+                        flash->mtd.erasesize, flash->mtd.erasesize / 1024);
+#ifndef CONFIG_OF
+        if (flash_info->partitions) {
+                parts = flash_info->partitions;
+                count = flash_info->nr_partitions;
+        }
+#endif
+        ppdata.of_node = np;
+        ret = mtd_device_parse_register(&flash->mtd, NULL, &ppdata, parts,
+                                        count);
+        if (ret) {
+                dev_err(&dev->pdev->dev, "Err MTD partition=%d\n", ret);
+                goto err_map;
+        }
+        return 0;
+err_map:
+        iounmap(flash->base_addr);
+err_probe:
+        kfree(flash);
+        return ret;
+}
+/**
+ * spear_smi_probe - Entry routine
+ * @pdev: platform device structure
+ *
+ * This is the first routine which gets invoked during booting and does all
+ * initialization/allocation work. The routine looks for available memory banks,
+ * and do proper init for any found one.
+ * Returns 0 on success, non zero otherwise
+ */
+static int __devinit spear_smi_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct spear_smi_plat_data *pdata = NULL;
+        struct spear_smi *dev;
+        struct resource *smi_base;
+        int irq, ret = 0;
+        int i;
+        if (np) {
+                pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+                if (!pdata) {
+                        pr_err("%s: ERROR: no memory", __func__);
+                        ret = -ENOMEM;
+                        goto err;
+                }
+                pdev->dev.platform_data = pdata;
+                ret = spear_smi_probe_config_dt(pdev, np);
+                if (ret) {
+                        ret = -ENODEV;
+                        dev_err(&pdev->dev, "no platform data\n");
+                        goto err;
+                }
+        } else {
+                pdata = dev_get_platdata(&pdev->dev);
+                if (pdata < 0) {
+                        ret = -ENODEV;
+                        dev_err(&pdev->dev, "no platform data\n");
+                        goto err;
+                }
+        }
+        smi_base = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!smi_base) {
+                ret = -ENODEV;
+                dev_err(&pdev->dev, "invalid smi base address\n");
+                goto err;
+        }
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                ret = -ENODEV;
+                dev_err(&pdev->dev, "invalid smi irq\n");
+                goto err;
+        }
+        dev = kzalloc(sizeof(*dev), GFP_ATOMIC);
+        if (!dev) {
+                ret = -ENOMEM;
+                dev_err(&pdev->dev, "mem alloc fail\n");
+                goto err;
+        }
+        smi_base = request_mem_region(smi_base->start, resource_size(smi_base),
+                        pdev->name);
+        if (!smi_base) {
+                ret = -EBUSY;
+                dev_err(&pdev->dev, "request mem region fail\n");
+                goto err_mem;
+        }
+        dev->io_base = ioremap(smi_base->start, resource_size(smi_base));
+        if (!dev->io_base) {
+                ret = -EIO;
+                dev_err(&pdev->dev, "ioremap fail\n");
+                goto err_ioremap;
+        }
+        dev->pdev = pdev;
+        dev->clk_rate = pdata->clk_rate;
+        if (dev->clk_rate < 0 || dev->clk_rate > SMI_MAX_CLOCK_FREQ)
+                dev->clk_rate = SMI_MAX_CLOCK_FREQ;
+        dev->num_flashes = pdata->num_flashes;
+        if (dev->num_flashes > MAX_NUM_FLASH_CHIP) {
+                dev_err(&pdev->dev, "exceeding max number of flashes\n");
+                dev->num_flashes = MAX_NUM_FLASH_CHIP;
+        }
+        dev->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(dev->clk)) {
+                ret = PTR_ERR(dev->clk);
+                goto err_clk;
+        }
+        ret = clk_enable(dev->clk);
+        if (ret)
+                goto err_clk_enable;
+        ret = request_irq(irq, spear_smi_int_handler, 0, pdev->name, dev);
+        if (ret) {
+                dev_err(&dev->pdev->dev, "SMI IRQ allocation failed\n");
+                goto err_irq;
+        }
+        mutex_init(&dev->lock);
+        init_waitqueue_head(&dev->cmd_complete);
+        spear_smi_hw_init(dev);
+        platform_set_drvdata(pdev, dev);
+        /* loop for each serial nor-flash which is connected to smi */
+        for (i = 0; i < dev->num_flashes; i++) {
+                ret = spear_smi_setup_banks(pdev, i, pdata->np[i]);
+                if (ret) {
+                        dev_err(&dev->pdev->dev, "bank setup failed\n");
+                        goto err_bank_setup;
+                }
+        }
+        return 0;
+err_bank_setup:
+        free_irq(irq, dev);
+        platform_set_drvdata(pdev, NULL);
+err_irq:
+        clk_disable(dev->clk);
+err_clk_enable:
+        clk_put(dev->clk);
+err_clk:
+        iounmap(dev->io_base);
+err_ioremap:
+        release_mem_region(smi_base->start, resource_size(smi_base));
+err_mem:
+        kfree(dev);
+err:
+        return ret;
+}
+/**
+ * spear_smi_remove - Exit routine
+ * @pdev: platform device structure
+ *
+ * free all allocations and delete the partitions.
+ */
+static int __devexit spear_smi_remove(struct platform_device *pdev)
+{
+        struct spear_smi *dev;
+        struct spear_smi_plat_data *pdata;
+        struct spear_snor_flash *flash;
+        struct resource *smi_base;
+        int ret;
+        int i, irq;
+        dev = platform_get_drvdata(pdev);
+        if (!dev) {
+                dev_err(&pdev->dev, "dev is null\n");
+                return -ENODEV;
+        }
+        pdata = dev_get_platdata(&pdev->dev);
+        /* clean up for all nor flash */
+        for (i = 0; i < dev->num_flashes; i++) {
+                flash = dev->flash[i];
+                if (!flash)
+                        continue;
+                /* clean up mtd stuff */
+                ret = mtd_device_unregister(&flash->mtd);
+                if (ret)
+                        dev_err(&pdev->dev, "error removing mtd\n");
+                iounmap(flash->base_addr);
+                kfree(flash);
+        }
+        irq = platform_get_irq(pdev, 0);
+        free_irq(irq, dev);
+        clk_disable(dev->clk);
+        clk_put(dev->clk);
+        iounmap(dev->io_base);
+        kfree(dev);
+        smi_base = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        release_mem_region(smi_base->start, resource_size(smi_base));
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+int spear_smi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct spear_smi *dev = platform_get_drvdata(pdev);
+        if (dev && dev->clk)
+                clk_disable(dev->clk);
+        return 0;
+}
+int spear_smi_resume(struct platform_device *pdev)
+{
+        struct spear_smi *dev = platform_get_drvdata(pdev);
+        int ret = -EPERM;
+        if (dev && dev->clk)
+                ret = clk_enable(dev->clk);
+        if (!ret)
+                spear_smi_hw_init(dev);
+        return ret;
+}
+#ifdef CONFIG_OF
+static const struct of_device_id spear_smi_id_table[] = {
+        { .compatible = "st,spear600-smi" },
+        {}
+};
+MODULE_DEVICE_TABLE(of, spear_smi_id_table);
+#endif
+static struct platform_driver spear_smi_driver = {
+        .driver = {
+                .name = "smi",
+                .bus = &platform_bus_type,
+                .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(spear_smi_id_table),
+        },
+        .probe = spear_smi_probe,
+        .remove = __devexit_p(spear_smi_remove),
+        .suspend = spear_smi_suspend,
+        .resume = spear_smi_resume,
+};
+static int spear_smi_init(void)
+{
+        return platform_driver_register(&spear_smi_driver);
+}
+module_init(spear_smi_init);
+static void spear_smi_exit(void)
+{
+        platform_driver_unregister(&spear_smi_driver);
+}
+module_exit(spear_smi_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Ashish Priyadarshi, Shiraz Hashim <shiraz.hashim@st.com>");
+MODULE_DESCRIPTION("MTD SMI driver for serial nor flash chips");
diff --git a/drivers/mtd/devices/sst25l.c b/drivers/mtd/devices/sst25l.c
index 5fc198350b94..ab8a2f4c8d60 100644
--- a/drivers/mtd/devices/sst25l.c
+++ b/drivers/mtd/devices/sst25l.c
@@ -175,9 +175,6 @@ static int sst25l_erase(struct mtd_info *mtd, struct erase_info *instr)
        int err;
        /* Sanity checks */
-        if (instr->addr + instr->len > flash->mtd.size)
-                return -EINVAL;
        if ((uint32_t)instr->len % mtd->erasesize)
                return -EINVAL;
@@ -223,16 +220,6 @@ static int sst25l_read(struct mtd_info *mtd, loff_t from, size_t len,
        unsigned char command[4];
        int ret;
-        /* Sanity checking */
-        if (len == 0)
-                return 0;
-        if (from + len > flash->mtd.size)
-                return -EINVAL;
-        if (retlen)
-                *retlen = 0;
        spi_message_init(&message);
        memset(&transfer, 0, sizeof(transfer));
@@ -274,13 +261,6 @@ static int sst25l_write(struct mtd_info *mtd, loff_t to, size_t len,
        int i, j, ret, bytes, copied = 0;
        unsigned char command[5];
-        /* Sanity checks */
-        if (!len)
-                return 0;
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
        if ((uint32_t)to % mtd->writesize)
                return -EINVAL;
@@ -402,10 +382,11 @@ static int __devinit sst25l_probe(struct spi_device *spi)
        flash->mtd.flags        = MTD_CAP_NORFLASH;
        flash->mtd.erasesize    = flash_info->erase_size;
        flash->mtd.writesize    = flash_info->page_size;
+        flash->mtd.writebufsize = flash_info->page_size;
        flash->mtd.size         = flash_info->page_size * flash_info->nr_pages;
-        flash->mtd.erase        = sst25l_erase;
+        flash->mtd._erase       = sst25l_erase;
-        flash->mtd.read         = sst25l_read;
+        flash->mtd._read                = sst25l_read;
-        flash->mtd.write        = sst25l_write;
+        flash->mtd._write       = sst25l_write;
        dev_info(&spi->dev, "%s (%lld KiB)\n", flash_info->name,
                 (long long)flash->mtd.size >> 10);
@@ -418,9 +399,9 @@ static int __devinit sst25l_probe(struct spi_device *spi)
              flash->mtd.numeraseregions);
-        ret = mtd_device_parse_register(&flash->mtd, NULL, 0,
+        ret = mtd_device_parse_register(&flash->mtd, NULL, NULL,
-                        data ? data->parts : NULL,
+                                        data ? data->parts : NULL,
-                        data ? data->nr_parts : 0);
+                                        data ? data->nr_parts : 0);
        if (ret) {
                kfree(flash);
                dev_set_drvdata(&spi->dev, NULL);
@@ -450,18 +431,7 @@ static struct spi_driver sst25l_driver = {
        .remove         = __devexit_p(sst25l_remove),
 };
-static int __init sst25l_init(void)
+module_spi_driver(sst25l_driver);
-{
-        return spi_register_driver(&sst25l_driver);
-}
-static void __exit sst25l_exit(void)
-{
-        spi_unregister_driver(&sst25l_driver);
-}
-module_init(sst25l_init);
-module_exit(sst25l_exit);
 MODULE_DESCRIPTION("MTD SPI driver for SST25L Flash chips");
 MODULE_AUTHOR("Andre Renaud <andre@bluewatersys.com>, "
diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 28646c95cfb8..3af351484098 100644
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
@@ -56,7 +56,7 @@ static void inftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
        if (memcmp(mtd->name, "DiskOnChip", 10))
                return;
-        if (!mtd->block_isbad) {
+        if (!mtd->_block_isbad) {
                printk(KERN_ERR
 "INFTL no longer supports the old DiskOnChip drivers loaded via docprobe.\n"
 "Please use the new diskonchip driver under the NAND subsystem.\n");
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index 536bbceaeaad..d3cfe26beeaa 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -40,7 +40,7 @@ static int lpddr_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
 static int lpddr_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
 static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,
                        size_t *retlen, void **mtdbuf, resource_size_t *phys);
-static void lpddr_unpoint(struct mtd_info *mtd, loff_t adr, size_t len);
+static int lpddr_unpoint(struct mtd_info *mtd, loff_t adr, size_t len);
 static int get_chip(struct map_info *map, struct flchip *chip, int mode);
 static int chip_ready(struct map_info *map, struct flchip *chip, int mode);
 static void put_chip(struct map_info *map, struct flchip *chip);
@@ -63,18 +63,18 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
        mtd->type = MTD_NORFLASH;
        /* Fill in the default mtd operations */
-        mtd->read = lpddr_read;
+        mtd->_read = lpddr_read;
        mtd->type = MTD_NORFLASH;
        mtd->flags = MTD_CAP_NORFLASH;
        mtd->flags &= ~MTD_BIT_WRITEABLE;
-        mtd->erase = lpddr_erase;
+        mtd->_erase = lpddr_erase;
-        mtd->write = lpddr_write_buffers;
+        mtd->_write = lpddr_write_buffers;
-        mtd->writev = lpddr_writev;
+        mtd->_writev = lpddr_writev;
-        mtd->lock = lpddr_lock;
+        mtd->_lock = lpddr_lock;
-        mtd->unlock = lpddr_unlock;
+        mtd->_unlock = lpddr_unlock;
        if (map_is_linear(map)) {
-                mtd->point = lpddr_point;
+                mtd->_point = lpddr_point;
-                mtd->unpoint = lpddr_unpoint;
+                mtd->_unpoint = lpddr_unpoint;
        }
        mtd->size = 1 << lpddr->qinfo->DevSizeShift;
        mtd->erasesize = 1 << lpddr->qinfo->UniformBlockSizeShift;
@@ -530,14 +530,12 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,
        struct flchip *chip = &lpddr->chips[chipnum];
        int ret = 0;
-        if (!map->virt || (adr + len > mtd->size))
+        if (!map->virt)
                return -EINVAL;
        /* ofs: offset within the first chip that the first read should start */
        ofs = adr - (chipnum << lpddr->chipshift);
        *mtdbuf = (void *)map->virt + chip->start + ofs;
-        *retlen = 0;
        while (len) {
                unsigned long thislen;
@@ -575,11 +573,11 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,
        return 0;
 }
-static void lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)
+static int lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)
 {
        struct map_info *map = mtd->priv;
        struct lpddr_private *lpddr = map->fldrv_priv;
-        int chipnum = adr >> lpddr->chipshift;
+        int chipnum = adr >> lpddr->chipshift, err = 0;
        unsigned long ofs;
        /* ofs: offset within the first chip that the first read should start */
@@ -603,9 +601,11 @@ static void lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)
                        chip->ref_point_counter--;
                        if (chip->ref_point_counter == 0)
                                chip->state = FL_READY;
-                } else
+                } else {
                        printk(KERN_WARNING "%s: Warning: unpoint called on non"
                                        "pointed region\n", map->name);
+                        err = -EINVAL;
+                }
                put_chip(map, chip);
                mutex_unlock(&chip->mutex);
@@ -614,6 +614,8 @@ static void lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)
                ofs = 0;
                chipnum++;
        }
+        return err;
 }
 static int lpddr_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
@@ -637,13 +639,11 @@ static int lpddr_writev(struct mtd_info *mtd, const struct kvec *vecs,
        int chipnum;
        unsigned long ofs, vec_seek, i;
        int wbufsize = 1 << lpddr->qinfo->BufSizeShift;
        size_t len = 0;
        for (i = 0; i < count; i++)
                len += vecs[i].iov_len;
-        *retlen = 0;
        if (!len)
                return 0;
@@ -688,9 +688,6 @@ static int lpddr_erase(struct mtd_info *mtd, struct erase_info *instr)
        ofs = instr->addr;
        len = instr->len;
-        if (ofs > mtd->size || (len + ofs) > mtd->size)
-                return -EINVAL;
        while (len > 0) {
                ret = do_erase_oneblock(mtd, ofs);
                if (ret)
diff --git a/drivers/mtd/maps/bfin-async-flash.c b/drivers/mtd/maps/bfin-async-flash.c
index 650126c361f1..ef5cde84a8b3 100644
--- a/drivers/mtd/maps/bfin-async-flash.c
+++ b/drivers/mtd/maps/bfin-async-flash.c
@@ -164,8 +164,8 @@ static int __devinit bfin_flash_probe(struct platform_device *pdev)
                return -ENXIO;
        }
-        mtd_device_parse_register(state->mtd, part_probe_types, 0,
+        mtd_device_parse_register(state->mtd, part_probe_types, NULL,
-                        pdata->parts, pdata->nr_parts);
+                                  pdata->parts, pdata->nr_parts);
        platform_set_drvdata(pdev, state);
diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
index f43b365b848c..080f06053bd4 100644
--- a/drivers/mtd/maps/dc21285.c
+++ b/drivers/mtd/maps/dc21285.c
@@ -196,7 +196,7 @@ static int __init init_dc21285(void)
        dc21285_mtd->owner = THIS_MODULE;
-        mtd_device_parse_register(dc21285_mtd, probes, 0, NULL, 0);
+        mtd_device_parse_register(dc21285_mtd, probes, NULL, NULL, 0);
        if(machine_is_ebsa285()) {
                /*
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 33cce895859f..e4de96ba52b3 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -252,8 +252,8 @@ static int __devinit gpio_flash_probe(struct platform_device *pdev)
        }
-        mtd_device_parse_register(state->mtd, part_probe_types, 0,
+        mtd_device_parse_register(state->mtd, part_probe_types, NULL,
-                        pdata->parts, pdata->nr_parts);
+                                  pdata->parts, pdata->nr_parts);
        return 0;
 }
diff --git a/drivers/mtd/maps/h720x-flash.c b/drivers/mtd/maps/h720x-flash.c
index 49c14187fc66..8ed6cb4529d8 100644
--- a/drivers/mtd/maps/h720x-flash.c
+++ b/drivers/mtd/maps/h720x-flash.c
@@ -85,8 +85,8 @@ static int __init h720x_mtd_init(void)
        if (mymtd) {
                mymtd->owner = THIS_MODULE;
-                mtd_device_parse_register(mymtd, NULL, 0,
+                mtd_device_parse_register(mymtd, NULL, NULL,
-                                h720x_partitions, NUM_PARTITIONS);
+                                          h720x_partitions, NUM_PARTITIONS);
                return 0;
        }
diff --git a/drivers/mtd/maps/impa7.c b/drivers/mtd/maps/impa7.c
index f47aedb24366..834a06c56f56 100644
--- a/drivers/mtd/maps/impa7.c
+++ b/drivers/mtd/maps/impa7.c
@@ -91,7 +91,7 @@ static int __init init_impa7(void)
                if (impa7_mtd[i]) {
                        impa7_mtd[i]->owner = THIS_MODULE;
                        devicesfound++;
-                        mtd_device_parse_register(impa7_mtd[i], NULL, 0,
+                        mtd_device_parse_register(impa7_mtd[i], NULL, NULL,
                                                  partitions,
                                                  ARRAY_SIZE(partitions));
                }
diff --git a/drivers/mtd/maps/intel_vr_nor.c b/drivers/mtd/maps/intel_vr_nor.c
index 08c239604ee4..92e1f41634c7 100644
--- a/drivers/mtd/maps/intel_vr_nor.c
+++ b/drivers/mtd/maps/intel_vr_nor.c
@@ -72,7 +72,7 @@ static int __devinit vr_nor_init_partitions(struct vr_nor_mtd *p)
 {
        /* register the flash bank */
        /* partition the flash bank */
-        return mtd_device_parse_register(p->info, NULL, 0, NULL, 0);
+        return mtd_device_parse_register(p->info, NULL, NULL, NULL, 0);
 }
 static void __devexit vr_nor_destroy_mtd_setup(struct vr_nor_mtd *p)
diff --git a/drivers/mtd/maps/ixp2000.c b/drivers/mtd/maps/ixp2000.c
index fc7d4d0d9a4e..4a41ced0f710 100644
--- a/drivers/mtd/maps/ixp2000.c
+++ b/drivers/mtd/maps/ixp2000.c
@@ -226,7 +226,7 @@ static int ixp2000_flash_probe(struct platform_device *dev)
        }
        info->mtd->owner = THIS_MODULE;
-        err = mtd_device_parse_register(info->mtd, probes, 0, NULL, 0);
+        err = mtd_device_parse_register(info->mtd, probes, NULL, NULL, 0);
        if (err)
                goto Error;
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index 8b5410162d70..e864fc6c58f9 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -182,6 +182,9 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
 {
        struct flash_platform_data *plat = dev->dev.platform_data;
        struct ixp4xx_flash_info *info;
+        struct mtd_part_parser_data ppdata = {
+                .origin = dev->resource->start,
+        };
        int err = -1;
        if (!plat)
@@ -247,7 +250,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
        /* Use the fast version */
        info->map.write = ixp4xx_write16;
-        err = mtd_device_parse_register(info->mtd, probes, dev->resource->start,
+        err = mtd_device_parse_register(info->mtd, probes, &ppdata,
                        plat->parts, plat->nr_parts);
        if (err) {
                printk(KERN_ERR "Could not parse partitions\n");
diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index dd0360ba2412..74bd98ee635f 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -27,17 +27,21 @@ static struct mtd_info *mymtd;
 /* Is this really the vpp port? */
+static DEFINE_SPINLOCK(l440gx_vpp_lock);
+static int l440gx_vpp_refcnt;
 static void l440gx_set_vpp(struct map_info *map, int vpp)
 {
-        unsigned long l;
+        unsigned long flags;
-        l = inl(VPP_PORT);
+        spin_lock_irqsave(&l440gx_vpp_lock, flags);
        if (vpp) {
-                l |= 1;
+                if (++l440gx_vpp_refcnt == 1)   /* first nested 'on' */
+                        outl(inl(VPP_PORT) | 1, VPP_PORT);
        } else {
-                l &= ~1;
+                if (--l440gx_vpp_refcnt == 0)   /* last nested 'off' */
+                        outl(inl(VPP_PORT) & ~1, VPP_PORT);
        }
-        outl(l, VPP_PORT);
+        spin_unlock_irqrestore(&l440gx_vpp_lock, flags);
 }
 static struct map_info l440gx_map = {
diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c
index 7b889de9477b..b5401e355745 100644
--- a/drivers/mtd/maps/lantiq-flash.c
+++ b/drivers/mtd/maps/lantiq-flash.c
@@ -45,6 +45,7 @@ struct ltq_mtd {
 };
 static char ltq_map_name[] = "ltq_nor";
+static const char *ltq_probe_types[] __devinitconst = { "cmdlinepart", NULL };
 static map_word
 ltq_read16(struct map_info *map, unsigned long adr)
@@ -168,8 +169,9 @@ ltq_mtd_probe(struct platform_device *pdev)
        cfi->addr_unlock1 ^= 1;
        cfi->addr_unlock2 ^= 1;
-        err = mtd_device_parse_register(ltq_mtd->mtd, NULL, 0,
+        err = mtd_device_parse_register(ltq_mtd->mtd, ltq_probe_types, NULL,
-                        ltq_mtd_data->parts, ltq_mtd_data->nr_parts);
+                                        ltq_mtd_data->parts,
+                                        ltq_mtd_data->nr_parts);
        if (err) {
                dev_err(&pdev->dev, "failed to add partitions\n");
                goto err_destroy;
diff --git a/drivers/mtd/maps/latch-addr-flash.c b/drivers/mtd/maps/latch-addr-flash.c
index 8fed58e3a4a8..3c7ad17fca78 100644
--- a/drivers/mtd/maps/latch-addr-flash.c
+++ b/drivers/mtd/maps/latch-addr-flash.c
@@ -199,8 +199,9 @@ static int __devinit latch_addr_flash_probe(struct platform_device *dev)
        }
        info->mtd->owner = THIS_MODULE;
-        mtd_device_parse_register(info->mtd, NULL, 0,
+        mtd_device_parse_register(info->mtd, NULL, NULL,
-                        latch_addr_data->parts, latch_addr_data->nr_parts);
+                                  latch_addr_data->parts,
+                                  latch_addr_data->nr_parts);
        return 0;
 iounmap:
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index 0259cf583022..a3cfad392ed6 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -294,13 +294,24 @@ static void pcmcia_copy_to(struct map_info *map, unsigned long to, const void *f
 }
+static DEFINE_SPINLOCK(pcmcia_vpp_lock);
+static int pcmcia_vpp_refcnt;
 static void pcmciamtd_set_vpp(struct map_info *map, int on)
 {
        struct pcmciamtd_dev *dev = (struct pcmciamtd_dev *)map->map_priv_1;
        struct pcmcia_device *link = dev->p_dev;
+        unsigned long flags;
        pr_debug("dev = %p on = %d vpp = %d\n\n", dev, on, dev->vpp);
-        pcmcia_fixup_vpp(link, on ? dev->vpp : 0);
+        spin_lock_irqsave(&pcmcia_vpp_lock, flags);
+        if (on) {
+                if (++pcmcia_vpp_refcnt == 1)   /* first nested 'on' */
+                        pcmcia_fixup_vpp(link, dev->vpp);
+        } else {
+                if (--pcmcia_vpp_refcnt == 0)   /* last nested 'off' */
+                        pcmcia_fixup_vpp(link, 0);
+        }
+        spin_unlock_irqrestore(&pcmcia_vpp_lock, flags);
 }
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index abc562653b31..21b0b713cacb 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -27,6 +27,8 @@ struct physmap_flash_info {
        struct mtd_info         *mtd[MAX_RESOURCES];
        struct mtd_info         *cmtd;
        struct map_info         map[MAX_RESOURCES];
+        spinlock_t              vpp_lock;
+        int                     vpp_refcnt;
 };
 static int physmap_flash_remove(struct platform_device *dev)
@@ -63,12 +65,26 @@ static void physmap_set_vpp(struct map_info *map, int state)
 {
        struct platform_device *pdev;
        struct physmap_flash_data *physmap_data;
+        struct physmap_flash_info *info;
+        unsigned long flags;
        pdev = (struct platform_device *)map->map_priv_1;
        physmap_data = pdev->dev.platform_data;
-        if (physmap_data->set_vpp)
+        if (!physmap_data->set_vpp)
-                physmap_data->set_vpp(pdev, state);
+                return;
+        info = platform_get_drvdata(pdev);
+        spin_lock_irqsave(&info->vpp_lock, flags);
+        if (state) {
+                if (++info->vpp_refcnt == 1)    /* first nested 'on' */
+                        physmap_data->set_vpp(pdev, 1);
+        } else {
+                if (--info->vpp_refcnt == 0)    /* last nested 'off' */
+                        physmap_data->set_vpp(pdev, 0);
+        }
+        spin_unlock_irqrestore(&info->vpp_lock, flags);
 }
 static const char *rom_probe_types[] = {
@@ -172,9 +188,11 @@ static int physmap_flash_probe(struct platform_device *dev)
        if (err)
                goto err_out;
+        spin_lock_init(&info->vpp_lock);
        part_types = physmap_data->part_probe_types ? : part_probe_types;
-        mtd_device_parse_register(info->cmtd, part_types, 0,
+        mtd_device_parse_register(info->cmtd, part_types, NULL,
                                  physmap_data->parts, physmap_data->nr_parts);
        return 0;
diff --git a/drivers/mtd/maps/plat-ram.c b/drivers/mtd/maps/plat-ram.c
index 45876d0e5b8e..891558de3ec1 100644
--- a/drivers/mtd/maps/plat-ram.c
+++ b/drivers/mtd/maps/plat-ram.c
@@ -222,8 +222,9 @@ static int platram_probe(struct platform_device *pdev)
        /* check to see if there are any available partitions, or wether
         * to add this device whole */
-        err = mtd_device_parse_register(info->mtd, pdata->probes, 0,
+        err = mtd_device_parse_register(info->mtd, pdata->probes, NULL,
-                        pdata->partitions, pdata->nr_partitions);
+                                        pdata->partitions,
+                                        pdata->nr_partitions);
        if (!err)
                dev_info(&pdev->dev, "registered mtd device\n");
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index 436d121185b1..81884c277405 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -98,7 +98,8 @@ static int __devinit pxa2xx_flash_probe(struct platform_device *pdev)
        }
        info->mtd->owner = THIS_MODULE;
-        mtd_device_parse_register(info->mtd, probes, 0, flash->parts, flash->nr_parts);
+        mtd_device_parse_register(info->mtd, probes, NULL, flash->parts,
+                                  flash->nr_parts);
        platform_set_drvdata(pdev, info);
        return 0;
diff --git a/drivers/mtd/maps/rbtx4939-flash.c b/drivers/mtd/maps/rbtx4939-flash.c
index 3da63fc6f16e..6f52e1f288b6 100644
--- a/drivers/mtd/maps/rbtx4939-flash.c
+++ b/drivers/mtd/maps/rbtx4939-flash.c
@@ -102,8 +102,8 @@ static int rbtx4939_flash_probe(struct platform_device *dev)
        info->mtd->owner = THIS_MODULE;
        if (err)
                goto err_out;
-        err = mtd_device_parse_register(info->mtd, NULL, 0,
+        err = mtd_device_parse_register(info->mtd, NULL, NULL, pdata->parts,
-                        pdata->parts, pdata->nr_parts);
+                                        pdata->nr_parts);
        if (err)
                goto err_out;
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index cbc3b7867910..a675bdbcb0fe 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -36,10 +36,22 @@ struct sa_info {
        struct sa_subdev_info   subdev[0];
 };
+static DEFINE_SPINLOCK(sa1100_vpp_lock);
+static int sa1100_vpp_refcnt;
 static void sa1100_set_vpp(struct map_info *map, int on)
 {
        struct sa_subdev_info *subdev = container_of(map, struct sa_subdev_info, map);
-        subdev->plat->set_vpp(on);
+        unsigned long flags;
+        spin_lock_irqsave(&sa1100_vpp_lock, flags);
+        if (on) {
+                if (++sa1100_vpp_refcnt == 1)   /* first nested 'on' */
+                        subdev->plat->set_vpp(1);
+        } else {
+                if (--sa1100_vpp_refcnt == 0)   /* last nested 'off' */
+                        subdev->plat->set_vpp(0);
+        }
+        spin_unlock_irqrestore(&sa1100_vpp_lock, flags);
 }
 static void sa1100_destroy_subdev(struct sa_subdev_info *subdev)
@@ -252,8 +264,8 @@ static int __devinit sa1100_mtd_probe(struct platform_device *pdev)
        /*
         * Partition selection stuff.
         */
-        mtd_device_parse_register(info->mtd, part_probes, 0,
+        mtd_device_parse_register(info->mtd, part_probes, NULL, plat->parts,
-                        plat->parts, plat->nr_parts);
+                                  plat->nr_parts);
        platform_set_drvdata(pdev, info);
        err = 0;
diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c
index 496c40704aff..9d900ada6708 100644
--- a/drivers/mtd/maps/solutionengine.c
+++ b/drivers/mtd/maps/solutionengine.c
@@ -92,8 +92,8 @@ static int __init init_soleng_maps(void)
                mtd_device_register(eprom_mtd, NULL, 0);
        }
-        mtd_device_parse_register(flash_mtd, probes, 0,
+        mtd_device_parse_register(flash_mtd, probes, NULL,
-                        superh_se_partitions, NUM_PARTITIONS);
+                                  superh_se_partitions, NUM_PARTITIONS);
        return 0;
 }
diff --git a/drivers/mtd/maps/uclinux.c b/drivers/mtd/maps/uclinux.c
index 6793074f3f40..cfff454f628b 100644
--- a/drivers/mtd/maps/uclinux.c
+++ b/drivers/mtd/maps/uclinux.c
@@ -85,7 +85,7 @@ static int __init uclinux_mtd_init(void)
        }
        mtd->owner = THIS_MODULE;
-        mtd->point = uclinux_point;
+        mtd->_point = uclinux_point;
        mtd->priv = mapp;
        uclinux_ram_mtdinfo = mtd;
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 3a04b078576a..2e2b0945edc7 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -360,9 +360,6 @@ static int vmu_flash_read(struct mtd_info *mtd, loff_t from, size_t len,
        int index = 0, retval, partition, leftover, numblocks;
        unsigned char cx;
-        if (len < 1)
-                return -EIO;
        mpart = mtd->priv;
        mdev = mpart->mdev;
        partition = mpart->partition;
@@ -434,11 +431,6 @@ static int vmu_flash_write(struct mtd_info *mtd, loff_t to, size_t len,
        partition = mpart->partition;
        card = maple_get_drvdata(mdev);
-        /* simple sanity checks */
-        if (len < 1) {
-                error = -EIO;
-                goto failed;
-        }
        numblocks = card->parts[partition].numblocks;
        if (to + len > numblocks * card->blocklen)
                len = numblocks * card->blocklen - to;
@@ -544,9 +536,9 @@ static void vmu_queryblocks(struct mapleq *mq)
        mtd_cur->flags = MTD_WRITEABLE|MTD_NO_ERASE;
        mtd_cur->size = part_cur->numblocks * card->blocklen;
        mtd_cur->erasesize = card->blocklen;
-        mtd_cur->write = vmu_flash_write;
+        mtd_cur->_write = vmu_flash_write;
-        mtd_cur->read = vmu_flash_read;
+        mtd_cur->_read = vmu_flash_read;
-        mtd_cur->sync = vmu_flash_sync;
+        mtd_cur->_sync = vmu_flash_sync;
        mtd_cur->writesize = card->blocklen;
        mpart = kmalloc(sizeof(struct mdev_part), GFP_KERNEL);
diff --git a/drivers/mtd/maps/wr_sbc82xx_flash.c b/drivers/mtd/maps/wr_sbc82xx_flash.c
index aa7e0cb2893c..71b0ba797912 100644
--- a/drivers/mtd/maps/wr_sbc82xx_flash.c
+++ b/drivers/mtd/maps/wr_sbc82xx_flash.c
@@ -142,7 +142,7 @@ static int __init init_sbc82xx_flash(void)
                        nr_parts = ARRAY_SIZE(smallflash_parts);
                }
-                mtd_device_parse_register(sbcmtd[i], part_probes, 0,
+                mtd_device_parse_register(sbcmtd[i], part_probes, NULL,
                                          defparts, nr_parts);
        }
        return 0;
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 424ca5f93c6c..f1f06715d4e0 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -233,6 +233,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
        ret = __get_mtd_device(dev->mtd);
        if (ret)
                goto error_release;
+        dev->file_mode = mode;
 unlock:
        dev->open++;
diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c
index af6591237b9b..6c6d80736fad 100644
--- a/drivers/mtd/mtdblock.c
+++ b/drivers/mtd/mtdblock.c
@@ -321,8 +321,12 @@ static int mtdblock_release(struct mtd_blktrans_dev *mbd)
        mutex_unlock(&mtdblk->cache_mutex);
        if (!--mtdblk->count) {
-                /* It was the last usage. Free the cache */
+                /*
-                mtd_sync(mbd->mtd);
+                 * It was the last usage. Free the cache, but only sync if
+                 * opened for writing.
+                 */
+                if (mbd->file_mode & FMODE_WRITE)
+                        mtd_sync(mbd->mtd);
                vfree(mtdblk->cache_data);
        }
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index c57ae92ebda4..55d82321d307 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -405,7 +405,7 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
        if (length > 4096)
                return -EINVAL;
-        if (!mtd->write_oob)
+        if (!mtd->_write_oob)
                ret = -EOPNOTSUPP;
        else
                ret = access_ok(VERIFY_READ, ptr, length) ? 0 : -EFAULT;
@@ -576,7 +576,7 @@ static int mtdchar_write_ioctl(struct mtd_info *mtd,
                        !access_ok(VERIFY_READ, req.usr_data, req.len) ||
                        !access_ok(VERIFY_READ, req.usr_oob, req.ooblen))
                return -EFAULT;
-        if (!mtd->write_oob)
+        if (!mtd->_write_oob)
                return -EOPNOTSUPP;
        ops.mode = req.mode;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 1ed5103b219b..b9000563b9f4 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -72,8 +72,6 @@ concat_read(struct mtd_info *mtd, loff_t from, size_t len,
        int ret = 0, err;
        int i;
-        *retlen = 0;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
                size_t size, retsize;
@@ -126,11 +124,6 @@ concat_write(struct mtd_info *mtd, loff_t to, size_t len,
        int err = -EINVAL;
        int i;
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
-        *retlen = 0;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
                size_t size, retsize;
@@ -145,11 +138,7 @@ concat_write(struct mtd_info *mtd, loff_t to, size_t len,
                else
                        size = len;
-                if (!(subdev->flags & MTD_WRITEABLE))
+                err = mtd_write(subdev, to, size, &retsize, buf);
-                        err = -EROFS;
-                else
-                        err = mtd_write(subdev, to, size, &retsize, buf);
                if (err)
                        break;
@@ -176,19 +165,10 @@ concat_writev(struct mtd_info *mtd, const struct kvec *vecs,
        int i;
        int err = -EINVAL;
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
-        *retlen = 0;
        /* Calculate total length of data */
        for (i = 0; i < count; i++)
                total_len += vecs[i].iov_len;
-        /* Do not allow write past end of device */
-        if ((to + total_len) > mtd->size)
-                return -EINVAL;
        /* Check alignment */
        if (mtd->writesize > 1) {
                uint64_t __to = to;
@@ -224,12 +204,8 @@ concat_writev(struct mtd_info *mtd, const struct kvec *vecs,
                old_iov_len = vecs_copy[entry_high].iov_len;
                vecs_copy[entry_high].iov_len = size;
-                if (!(subdev->flags & MTD_WRITEABLE))
+                err = mtd_writev(subdev, &vecs_copy[entry_low],
-                        err = -EROFS;
+                                 entry_high - entry_low + 1, to, &retsize);
-                else
-                        err = mtd_writev(subdev, &vecs_copy[entry_low],
-                                         entry_high - entry_low + 1, to,
-                                         &retsize);
                vecs_copy[entry_high].iov_len = old_iov_len - size;
                vecs_copy[entry_high].iov_base += size;
@@ -403,15 +379,6 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
        uint64_t length, offset = 0;
        struct erase_info *erase;
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
-        if (instr->addr > concat->mtd.size)
-                return -EINVAL;
-        if (instr->len + instr->addr > concat->mtd.size)
-                return -EINVAL;
        /*
         * Check for proper erase block alignment of the to-be-erased area.
         * It is easier to do this based on the super device's erase
@@ -459,8 +426,6 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
                        return -EINVAL;
        }
-        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* make a local copy of instr to avoid modifying the caller's struct */
        erase = kmalloc(sizeof (struct erase_info), GFP_KERNEL);
@@ -499,10 +464,6 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
                else
                        erase->len = length;
-                if (!(subdev->flags & MTD_WRITEABLE)) {
-                        err = -EROFS;
-                        break;
-                }
                length -= erase->len;
                if ((err = concat_dev_erase(subdev, erase))) {
                        /* sanity check: should never happen since
@@ -538,9 +499,6 @@ static int concat_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
        struct mtd_concat *concat = CONCAT(mtd);
        int i, err = -EINVAL;
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
                uint64_t size;
@@ -575,9 +533,6 @@ static int concat_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
        struct mtd_concat *concat = CONCAT(mtd);
        int i, err = 0;
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
                uint64_t size;
@@ -650,9 +605,6 @@ static int concat_block_isbad(struct mtd_info *mtd, loff_t ofs)
        if (!mtd_can_have_bb(concat->subdev[0]))
                return res;
-        if (ofs > mtd->size)
-                return -EINVAL;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
@@ -673,12 +625,6 @@ static int concat_block_markbad(struct mtd_info *mtd, loff_t ofs)
        struct mtd_concat *concat = CONCAT(mtd);
        int i, err = -EINVAL;
-        if (!mtd_can_have_bb(concat->subdev[0]))
-                return 0;
-        if (ofs > mtd->size)
-                return -EINVAL;
        for (i = 0; i < concat->num_subdev; i++) {
                struct mtd_info *subdev = concat->subdev[i];
@@ -716,10 +662,6 @@ static unsigned long concat_get_unmapped_area(struct mtd_info *mtd,
                        continue;
                }
-                /* we've found the subdev over which the mapping will reside */
-                if (offset + len > subdev->size)
-                        return (unsigned long) -EINVAL;
                return mtd_get_unmapped_area(subdev, len, offset, flags);
        }
@@ -777,16 +719,16 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
        concat->mtd.subpage_sft = subdev[0]->subpage_sft;
        concat->mtd.oobsize = subdev[0]->oobsize;
        concat->mtd.oobavail = subdev[0]->oobavail;
-        if (subdev[0]->writev)
+        if (subdev[0]->_writev)
-                concat->mtd.writev = concat_writev;
+                concat->mtd._writev = concat_writev;
-        if (subdev[0]->read_oob)
+        if (subdev[0]->_read_oob)
-                concat->mtd.read_oob = concat_read_oob;
+                concat->mtd._read_oob = concat_read_oob;
-        if (subdev[0]->write_oob)
+        if (subdev[0]->_write_oob)
-                concat->mtd.write_oob = concat_write_oob;
+                concat->mtd._write_oob = concat_write_oob;
-        if (subdev[0]->block_isbad)
+        if (subdev[0]->_block_isbad)
-                concat->mtd.block_isbad = concat_block_isbad;
+                concat->mtd._block_isbad = concat_block_isbad;
-        if (subdev[0]->block_markbad)
+        if (subdev[0]->_block_markbad)
-                concat->mtd.block_markbad = concat_block_markbad;
+                concat->mtd._block_markbad = concat_block_markbad;
        concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks;
@@ -833,8 +775,8 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
                if (concat->mtd.writesize   !=  subdev[i]->writesize ||
                    concat->mtd.subpage_sft != subdev[i]->subpage_sft ||
                    concat->mtd.oobsize    !=  subdev[i]->oobsize ||
-                    !concat->mtd.read_oob  != !subdev[i]->read_oob ||
+                    !concat->mtd._read_oob  != !subdev[i]->_read_oob ||
-                    !concat->mtd.write_oob != !subdev[i]->write_oob) {
+                    !concat->mtd._write_oob != !subdev[i]->_write_oob) {
                        kfree(concat);
                        printk("Incompatible OOB or ECC data on \"%s\"\n",
                               subdev[i]->name);
@@ -849,15 +791,15 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
        concat->num_subdev = num_devs;
        concat->mtd.name = name;
-        concat->mtd.erase = concat_erase;
+        concat->mtd._erase = concat_erase;
-        concat->mtd.read = concat_read;
+        concat->mtd._read = concat_read;
-        concat->mtd.write = concat_write;
+        concat->mtd._write = concat_write;
-        concat->mtd.sync = concat_sync;
+        concat->mtd._sync = concat_sync;
-        concat->mtd.lock = concat_lock;
+        concat->mtd._lock = concat_lock;
-        concat->mtd.unlock = concat_unlock;
+        concat->mtd._unlock = concat_unlock;
-        concat->mtd.suspend = concat_suspend;
+        concat->mtd._suspend = concat_suspend;
-        concat->mtd.resume = concat_resume;
+        concat->mtd._resume = concat_resume;
-        concat->mtd.get_unmapped_area = concat_get_unmapped_area;
+        concat->mtd._get_unmapped_area = concat_get_unmapped_area;
        /*
         * Combine the erase block size info of the subdevices:
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 9a9ce71a71fc..c837507dfb1c 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -107,7 +107,7 @@ static LIST_HEAD(mtd_notifiers);
 */
 static void mtd_release(struct device *dev)
 {
-        struct mtd_info *mtd = dev_get_drvdata(dev);
+        struct mtd_info __maybe_unused *mtd = dev_get_drvdata(dev);
        dev_t index = MTD_DEVT(mtd->index);
        /* remove /dev/mtdXro node if needed */
@@ -126,7 +126,7 @@ static int mtd_cls_resume(struct device *dev)
 {
        struct mtd_info *mtd = dev_get_drvdata(dev);
-        if (mtd && mtd->resume)
+        if (mtd)
                mtd_resume(mtd);
        return 0;
 }
@@ -610,8 +610,8 @@ int __get_mtd_device(struct mtd_info *mtd)
        if (!try_module_get(mtd->owner))
                return -ENODEV;
-        if (mtd->get_device) {
+        if (mtd->_get_device) {
-                err = mtd->get_device(mtd);
+                err = mtd->_get_device(mtd);
                if (err) {
                        module_put(mtd->owner);
@@ -675,14 +675,267 @@ void __put_mtd_device(struct mtd_info *mtd)
        --mtd->usecount;
        BUG_ON(mtd->usecount < 0);
-        if (mtd->put_device)
+        if (mtd->_put_device)
-                mtd->put_device(mtd);
+                mtd->_put_device(mtd);
        module_put(mtd->owner);
 }
 EXPORT_SYMBOL_GPL(__put_mtd_device);
 /*
+ * Erase is an asynchronous operation.  Device drivers are supposed
+ * to call instr->callback() whenever the operation completes, even
+ * if it completes with a failure.
+ * Callers are supposed to pass a callback function and wait for it
+ * to be called before writing to the block.
+ */
+int mtd_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        if (instr->addr > mtd->size || instr->len > mtd->size - instr->addr)
+                return -EINVAL;
+        if (!(mtd->flags & MTD_WRITEABLE))
+                return -EROFS;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
+        if (!instr->len) {
+                instr->state = MTD_ERASE_DONE;
+                mtd_erase_callback(instr);
+                return 0;
+        }
+        return mtd->_erase(mtd, instr);
+}
+EXPORT_SYMBOL_GPL(mtd_erase);
+/*
+ * This stuff for eXecute-In-Place. phys is optional and may be set to NULL.
+ */
+int mtd_point(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
+              void **virt, resource_size_t *phys)
+{
+        *retlen = 0;
+        *virt = NULL;
+        if (phys)
+                *phys = 0;
+        if (!mtd->_point)
+                return -EOPNOTSUPP;
+        if (from < 0 || from > mtd->size || len > mtd->size - from)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_point(mtd, from, len, retlen, virt, phys);
+}
+EXPORT_SYMBOL_GPL(mtd_point);
+/* We probably shouldn't allow XIP if the unpoint isn't a NULL */
+int mtd_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+{
+        if (!mtd->_point)
+                return -EOPNOTSUPP;
+        if (from < 0 || from > mtd->size || len > mtd->size - from)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_unpoint(mtd, from, len);
+}
+EXPORT_SYMBOL_GPL(mtd_unpoint);
+/*
+ * Allow NOMMU mmap() to directly map the device (if not NULL)
+ * - return the address to which the offset maps
+ * - return -ENOSYS to indicate refusal to do the mapping
+ */
+unsigned long mtd_get_unmapped_area(struct mtd_info *mtd, unsigned long len,
+                                    unsigned long offset, unsigned long flags)
+{
+        if (!mtd->_get_unmapped_area)
+                return -EOPNOTSUPP;
+        if (offset > mtd->size || len > mtd->size - offset)
+                return -EINVAL;
+        return mtd->_get_unmapped_area(mtd, len, offset, flags);
+}
+EXPORT_SYMBOL_GPL(mtd_get_unmapped_area);
+int mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
+             u_char *buf)
+{
+        *retlen = 0;
+        if (from < 0 || from > mtd->size || len > mtd->size - from)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_read(mtd, from, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_read);
+int mtd_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen,
+              const u_char *buf)
+{
+        *retlen = 0;
+        if (to < 0 || to > mtd->size || len > mtd->size - to)
+                return -EINVAL;
+        if (!mtd->_write || !(mtd->flags & MTD_WRITEABLE))
+                return -EROFS;
+        if (!len)
+                return 0;
+        return mtd->_write(mtd, to, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_write);
+/*
+ * In blackbox flight recorder like scenarios we want to make successful writes
+ * in interrupt context. panic_write() is only intended to be called when its
+ * known the kernel is about to panic and we need the write to succeed. Since
+ * the kernel is not going to be running for much longer, this function can
+ * break locks and delay to ensure the write succeeds (but not sleep).
+ */
+int mtd_panic_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen,
+                    const u_char *buf)
+{
+        *retlen = 0;
+        if (!mtd->_panic_write)
+                return -EOPNOTSUPP;
+        if (to < 0 || to > mtd->size || len > mtd->size - to)
+                return -EINVAL;
+        if (!(mtd->flags & MTD_WRITEABLE))
+                return -EROFS;
+        if (!len)
+                return 0;
+        return mtd->_panic_write(mtd, to, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_panic_write);
+/*
+ * Method to access the protection register area, present in some flash
+ * devices. The user data is one time programmable but the factory data is read
+ * only.
+ */
+int mtd_get_fact_prot_info(struct mtd_info *mtd, struct otp_info *buf,
+                           size_t len)
+{
+        if (!mtd->_get_fact_prot_info)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_get_fact_prot_info(mtd, buf, len);
+}
+EXPORT_SYMBOL_GPL(mtd_get_fact_prot_info);
+int mtd_read_fact_prot_reg(struct mtd_info *mtd, loff_t from, size_t len,
+                           size_t *retlen, u_char *buf)
+{
+        *retlen = 0;
+        if (!mtd->_read_fact_prot_reg)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_read_fact_prot_reg(mtd, from, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_read_fact_prot_reg);
+int mtd_get_user_prot_info(struct mtd_info *mtd, struct otp_info *buf,
+                           size_t len)
+{
+        if (!mtd->_get_user_prot_info)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_get_user_prot_info(mtd, buf, len);
+}
+EXPORT_SYMBOL_GPL(mtd_get_user_prot_info);
+int mtd_read_user_prot_reg(struct mtd_info *mtd, loff_t from, size_t len,
+                           size_t *retlen, u_char *buf)
+{
+        *retlen = 0;
+        if (!mtd->_read_user_prot_reg)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_read_user_prot_reg(mtd, from, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_read_user_prot_reg);
+int mtd_write_user_prot_reg(struct mtd_info *mtd, loff_t to, size_t len,
+                            size_t *retlen, u_char *buf)
+{
+        *retlen = 0;
+        if (!mtd->_write_user_prot_reg)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_write_user_prot_reg(mtd, to, len, retlen, buf);
+}
+EXPORT_SYMBOL_GPL(mtd_write_user_prot_reg);
+int mtd_lock_user_prot_reg(struct mtd_info *mtd, loff_t from, size_t len)
+{
+        if (!mtd->_lock_user_prot_reg)
+                return -EOPNOTSUPP;
+        if (!len)
+                return 0;
+        return mtd->_lock_user_prot_reg(mtd, from, len);
+}
+EXPORT_SYMBOL_GPL(mtd_lock_user_prot_reg);
+/* Chip-supported device locking */
+int mtd_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+        if (!mtd->_lock)
+                return -EOPNOTSUPP;
+        if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_lock(mtd, ofs, len);
+}
+EXPORT_SYMBOL_GPL(mtd_lock);
+int mtd_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+        if (!mtd->_unlock)
+                return -EOPNOTSUPP;
+        if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_unlock(mtd, ofs, len);
+}
+EXPORT_SYMBOL_GPL(mtd_unlock);
+int mtd_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+        if (!mtd->_is_locked)
+                return -EOPNOTSUPP;
+        if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        return mtd->_is_locked(mtd, ofs, len);
+}
+EXPORT_SYMBOL_GPL(mtd_is_locked);
+int mtd_block_isbad(struct mtd_info *mtd, loff_t ofs)
+{
+        if (!mtd->_block_isbad)
+                return 0;
+        if (ofs < 0 || ofs > mtd->size)
+                return -EINVAL;
+        return mtd->_block_isbad(mtd, ofs);
+}
+EXPORT_SYMBOL_GPL(mtd_block_isbad);
+int mtd_block_markbad(struct mtd_info *mtd, loff_t ofs)
+{
+        if (!mtd->_block_markbad)
+                return -EOPNOTSUPP;
+        if (ofs < 0 || ofs > mtd->size)
+                return -EINVAL;
+        if (!(mtd->flags & MTD_WRITEABLE))
+                return -EROFS;
+        return mtd->_block_markbad(mtd, ofs);
+}
+EXPORT_SYMBOL_GPL(mtd_block_markbad);
+/*
 * default_mtd_writev - the default writev method
 * @mtd: mtd device description object pointer
 * @vecs: the vectors to write
@@ -729,9 +982,11 @@ int mtd_writev(struct mtd_info *mtd, const struct kvec *vecs,
               unsigned long count, loff_t to, size_t *retlen)
 {
        *retlen = 0;
-        if (!mtd->writev)
+        if (!(mtd->flags & MTD_WRITEABLE))
+                return -EROFS;
+        if (!mtd->_writev)
                return default_mtd_writev(mtd, vecs, count, to, retlen);
-        return mtd->writev(mtd, vecs, count, to, retlen);
+        return mtd->_writev(mtd, vecs, count, to, retlen);
 }
 EXPORT_SYMBOL_GPL(mtd_writev);
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 3ce99e00a49e..ae36d7e1e913 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -169,7 +169,7 @@ static void mtdoops_workfunc_erase(struct work_struct *work)
                        cxt->nextpage = 0;
        }
-        while (mtd_can_have_bb(mtd)) {
+        while (1) {
                ret = mtd_block_isbad(mtd, cxt->nextpage * record_size);
                if (!ret)
                        break;
@@ -199,9 +199,9 @@ badblock:
                return;
        }
-        if (mtd_can_have_bb(mtd) && ret == -EIO) {
+        if (ret == -EIO) {
                ret = mtd_block_markbad(mtd, cxt->nextpage * record_size);
-                if (ret < 0) {
+                if (ret < 0 && ret != -EOPNOTSUPP) {
                        printk(KERN_ERR "mtdoops: block_markbad failed, aborting\n");
                        return;
                }
@@ -257,8 +257,7 @@ static void find_next_position(struct mtdoops_context *cxt)
        size_t retlen;
        for (page = 0; page < cxt->oops_pages; page++) {
-                if (mtd_can_have_bb(mtd) &&
+                if (mtd_block_isbad(mtd, page * record_size))
-                    mtd_block_isbad(mtd, page * record_size))
                        continue;
                /* Assume the page is used */
                mark_page_used(cxt, page);
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index a3d44c3416b4..9651c06de0a9 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -65,12 +65,8 @@ static int part_read(struct mtd_info *mtd, loff_t from, size_t len,
        int res;
        stats = part->master->ecc_stats;
+        res = part->master->_read(part->master, from + part->offset, len,
-        if (from >= mtd->size)
+                                  retlen, buf);
-                len = 0;
-        else if (from + len > mtd->size)
-                len = mtd->size - from;
-        res = mtd_read(part->master, from + part->offset, len, retlen, buf);
        if (unlikely(res)) {
                if (mtd_is_bitflip(res))
                        mtd->ecc_stats.corrected += part->master->ecc_stats.corrected - stats.corrected;
@@ -84,19 +80,16 @@ static int part_point(struct mtd_info *mtd, loff_t from, size_t len,
                size_t *retlen, void **virt, resource_size_t *phys)
 {
        struct mtd_part *part = PART(mtd);
-        if (from >= mtd->size)
-                len = 0;
+        return part->master->_point(part->master, from + part->offset, len,
-        else if (from + len > mtd->size)
+                                    retlen, virt, phys);
-                len = mtd->size - from;
-        return mtd_point(part->master, from + part->offset, len, retlen,
-                         virt, phys);
 }
-static void part_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int part_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
        struct mtd_part *part = PART(mtd);
-        mtd_unpoint(part->master, from + part->offset, len);
+        return part->master->_unpoint(part->master, from + part->offset, len);
 }
 static unsigned long part_get_unmapped_area(struct mtd_info *mtd,
@@ -107,7 +100,8 @@ static unsigned long part_get_unmapped_area(struct mtd_info *mtd,
        struct mtd_part *part = PART(mtd);
        offset += part->offset;
-        return mtd_get_unmapped_area(part->master, len, offset, flags);
+        return part->master->_get_unmapped_area(part->master, len, offset,
+                                                flags);
 }
 static int part_read_oob(struct mtd_info *mtd, loff_t from,
@@ -138,7 +132,7 @@ static int part_read_oob(struct mtd_info *mtd, loff_t from,
                        return -EINVAL;
        }
-        res = mtd_read_oob(part->master, from + part->offset, ops);
+        res = part->master->_read_oob(part->master, from + part->offset, ops);
        if (unlikely(res)) {
                if (mtd_is_bitflip(res))
                        mtd->ecc_stats.corrected++;
@@ -152,55 +146,46 @@ static int part_read_user_prot_reg(struct mtd_info *mtd, loff_t from,
                size_t len, size_t *retlen, u_char *buf)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_read_user_prot_reg(part->master, from, len, retlen, buf);
+        return part->master->_read_user_prot_reg(part->master, from, len,
+                                                 retlen, buf);
 }
 static int part_get_user_prot_info(struct mtd_info *mtd,
                struct otp_info *buf, size_t len)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_get_user_prot_info(part->master, buf, len);
+        return part->master->_get_user_prot_info(part->master, buf, len);
 }
 static int part_read_fact_prot_reg(struct mtd_info *mtd, loff_t from,
                size_t len, size_t *retlen, u_char *buf)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_read_fact_prot_reg(part->master, from, len, retlen, buf);
+        return part->master->_read_fact_prot_reg(part->master, from, len,
+                                                 retlen, buf);
 }
 static int part_get_fact_prot_info(struct mtd_info *mtd, struct otp_info *buf,
                size_t len)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_get_fact_prot_info(part->master, buf, len);
+        return part->master->_get_fact_prot_info(part->master, buf, len);
 }
 static int part_write(struct mtd_info *mtd, loff_t to, size_t len,
                size_t *retlen, const u_char *buf)
 {
        struct mtd_part *part = PART(mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
+        return part->master->_write(part->master, to + part->offset, len,
-                return -EROFS;
+                                    retlen, buf);
-        if (to >= mtd->size)
-                len = 0;
-        else if (to + len > mtd->size)
-                len = mtd->size - to;
-        return mtd_write(part->master, to + part->offset, len, retlen, buf);
 }
 static int part_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
                size_t *retlen, const u_char *buf)
 {
        struct mtd_part *part = PART(mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
+        return part->master->_panic_write(part->master, to + part->offset, len,
-                return -EROFS;
+                                          retlen, buf);
-        if (to >= mtd->size)
-                len = 0;
-        else if (to + len > mtd->size)
-                len = mtd->size - to;
-        return mtd_panic_write(part->master, to + part->offset, len, retlen,
-                               buf);
 }
 static int part_write_oob(struct mtd_info *mtd, loff_t to,
@@ -208,50 +193,43 @@ static int part_write_oob(struct mtd_info *mtd, loff_t to,
 {
        struct mtd_part *part = PART(mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
        if (to >= mtd->size)
                return -EINVAL;
        if (ops->datbuf && to + ops->len > mtd->size)
                return -EINVAL;
-        return mtd_write_oob(part->master, to + part->offset, ops);
+        return part->master->_write_oob(part->master, to + part->offset, ops);
 }
 static int part_write_user_prot_reg(struct mtd_info *mtd, loff_t from,
                size_t len, size_t *retlen, u_char *buf)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_write_user_prot_reg(part->master, from, len, retlen, buf);
+        return part->master->_write_user_prot_reg(part->master, from, len,
+                                                  retlen, buf);
 }
 static int part_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
                size_t len)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_lock_user_prot_reg(part->master, from, len);
+        return part->master->_lock_user_prot_reg(part->master, from, len);
 }
 static int part_writev(struct mtd_info *mtd, const struct kvec *vecs,
                unsigned long count, loff_t to, size_t *retlen)
 {
        struct mtd_part *part = PART(mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
+        return part->master->_writev(part->master, vecs, count,
-                return -EROFS;
+                                     to + part->offset, retlen);
-        return mtd_writev(part->master, vecs, count, to + part->offset,
-                          retlen);
 }
 static int part_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
        struct mtd_part *part = PART(mtd);
        int ret;
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
-        if (instr->addr >= mtd->size)
-                return -EINVAL;
        instr->addr += part->offset;
-        ret = mtd_erase(part->master, instr);
+        ret = part->master->_erase(part->master, instr);
        if (ret) {
                if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
                        instr->fail_addr -= part->offset;
@@ -262,7 +240,7 @@ static int part_erase(struct mtd_info *mtd, struct erase_info *instr)
 void mtd_erase_callback(struct erase_info *instr)
 {
-        if (instr->mtd->erase == part_erase) {
+        if (instr->mtd->_erase == part_erase) {
                struct mtd_part *part = PART(instr->mtd);
                if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
@@ -277,52 +255,44 @@ EXPORT_SYMBOL_GPL(mtd_erase_callback);
 static int part_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
        struct mtd_part *part = PART(mtd);
-        if ((len + ofs) > mtd->size)
+        return part->master->_lock(part->master, ofs + part->offset, len);
-                return -EINVAL;
-        return mtd_lock(part->master, ofs + part->offset, len);
 }
 static int part_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
        struct mtd_part *part = PART(mtd);
-        if ((len + ofs) > mtd->size)
+        return part->master->_unlock(part->master, ofs + part->offset, len);
-                return -EINVAL;
-        return mtd_unlock(part->master, ofs + part->offset, len);
 }
 static int part_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
        struct mtd_part *part = PART(mtd);
-        if ((len + ofs) > mtd->size)
+        return part->master->_is_locked(part->master, ofs + part->offset, len);
-                return -EINVAL;
-        return mtd_is_locked(part->master, ofs + part->offset, len);
 }
 static void part_sync(struct mtd_info *mtd)
 {
        struct mtd_part *part = PART(mtd);
-        mtd_sync(part->master);
+        part->master->_sync(part->master);
 }
 static int part_suspend(struct mtd_info *mtd)
 {
        struct mtd_part *part = PART(mtd);
-        return mtd_suspend(part->master);
+        return part->master->_suspend(part->master);
 }
 static void part_resume(struct mtd_info *mtd)
 {
        struct mtd_part *part = PART(mtd);
-        mtd_resume(part->master);
+        part->master->_resume(part->master);
 }
 static int part_block_isbad(struct mtd_info *mtd, loff_t ofs)
 {
        struct mtd_part *part = PART(mtd);
-        if (ofs >= mtd->size)
-                return -EINVAL;
        ofs += part->offset;
-        return mtd_block_isbad(part->master, ofs);
+        return part->master->_block_isbad(part->master, ofs);
 }
 static int part_block_markbad(struct mtd_info *mtd, loff_t ofs)
@@ -330,12 +300,8 @@ static int part_block_markbad(struct mtd_info *mtd, loff_t ofs)
        struct mtd_part *part = PART(mtd);
        int res;
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
-        if (ofs >= mtd->size)
-                return -EINVAL;
        ofs += part->offset;
-        res = mtd_block_markbad(part->master, ofs);
+        res = part->master->_block_markbad(part->master, ofs);
        if (!res)
                mtd->ecc_stats.badblocks++;
        return res;
@@ -410,54 +376,55 @@ static struct mtd_part *allocate_partition(struct mtd_info *master,
         */
        slave->mtd.dev.parent = master->dev.parent;
-        slave->mtd.read = part_read;
+        slave->mtd._read = part_read;
-        slave->mtd.write = part_write;
+        slave->mtd._write = part_write;
-        if (master->panic_write)
+        if (master->_panic_write)
-                slave->mtd.panic_write = part_panic_write;
+                slave->mtd._panic_write = part_panic_write;
-        if (master->point && master->unpoint) {
+        if (master->_point && master->_unpoint) {
-                slave->mtd.point = part_point;
+                slave->mtd._point = part_point;
-                slave->mtd.unpoint = part_unpoint;
+                slave->mtd._unpoint = part_unpoint;
        }
-        if (master->get_unmapped_area)
+        if (master->_get_unmapped_area)
-                slave->mtd.get_unmapped_area = part_get_unmapped_area;
+                slave->mtd._get_unmapped_area = part_get_unmapped_area;
-        if (master->read_oob)
+        if (master->_read_oob)
-                slave->mtd.read_oob = part_read_oob;
+                slave->mtd._read_oob = part_read_oob;
-        if (master->write_oob)
+        if (master->_write_oob)
-                slave->mtd.write_oob = part_write_oob;
+                slave->mtd._write_oob = part_write_oob;
-        if (master->read_user_prot_reg)
+        if (master->_read_user_prot_reg)
-                slave->mtd.read_user_prot_reg = part_read_user_prot_reg;
+                slave->mtd._read_user_prot_reg = part_read_user_prot_reg;
-        if (master->read_fact_prot_reg)
+        if (master->_read_fact_prot_reg)
-                slave->mtd.read_fact_prot_reg = part_read_fact_prot_reg;
+                slave->mtd._read_fact_prot_reg = part_read_fact_prot_reg;
-        if (master->write_user_prot_reg)
+        if (master->_write_user_prot_reg)
-                slave->mtd.write_user_prot_reg = part_write_user_prot_reg;
+                slave->mtd._write_user_prot_reg = part_write_user_prot_reg;
-        if (master->lock_user_prot_reg)
+        if (master->_lock_user_prot_reg)
-                slave->mtd.lock_user_prot_reg = part_lock_user_prot_reg;
+                slave->mtd._lock_user_prot_reg = part_lock_user_prot_reg;
-        if (master->get_user_prot_info)
+        if (master->_get_user_prot_info)
-                slave->mtd.get_user_prot_info = part_get_user_prot_info;
+                slave->mtd._get_user_prot_info = part_get_user_prot_info;
-        if (master->get_fact_prot_info)
+        if (master->_get_fact_prot_info)
-                slave->mtd.get_fact_prot_info = part_get_fact_prot_info;
+                slave->mtd._get_fact_prot_info = part_get_fact_prot_info;
-        if (master->sync)
+        if (master->_sync)
-                slave->mtd.sync = part_sync;
+                slave->mtd._sync = part_sync;
-        if (!partno && !master->dev.class && master->suspend && master->resume) {
+        if (!partno && !master->dev.class && master->_suspend &&
-                        slave->mtd.suspend = part_suspend;
+            master->_resume) {
-                        slave->mtd.resume = part_resume;
+                        slave->mtd._suspend = part_suspend;
+                        slave->mtd._resume = part_resume;
        }
-        if (master->writev)
+        if (master->_writev)
-                slave->mtd.writev = part_writev;
+                slave->mtd._writev = part_writev;
-        if (master->lock)
+        if (master->_lock)
-                slave->mtd.lock = part_lock;
+                slave->mtd._lock = part_lock;
-        if (master->unlock)
+        if (master->_unlock)
-                slave->mtd.unlock = part_unlock;
+                slave->mtd._unlock = part_unlock;
-        if (master->is_locked)
+        if (master->_is_locked)
-                slave->mtd.is_locked = part_is_locked;
+                slave->mtd._is_locked = part_is_locked;
-        if (master->block_isbad)
+        if (master->_block_isbad)
-                slave->mtd.block_isbad = part_block_isbad;
+                slave->mtd._block_isbad = part_block_isbad;
-        if (master->block_markbad)
+        if (master->_block_markbad)
-                slave->mtd.block_markbad = part_block_markbad;
+                slave->mtd._block_markbad = part_block_markbad;
-        slave->mtd.erase = part_erase;
+        slave->mtd._erase = part_erase;
        slave->master = master;
        slave->offset = part->offset;
@@ -549,7 +516,8 @@ static struct mtd_part *allocate_partition(struct mtd_info *master,
        }
        slave->mtd.ecclayout = master->ecclayout;
-        if (master->block_isbad) {
+        slave->mtd.ecc_strength = master->ecc_strength;
+        if (master->_block_isbad) {
                uint64_t offs = 0;
                while (offs < slave->mtd.size) {
@@ -761,7 +729,7 @@ int parse_mtd_partitions(struct mtd_info *master, const char **types,
        for ( ; ret <= 0 && *types; types++) {
                parser = get_partition_parser(*types);
                if (!parser && !request_module("%s", *types))
-                                parser = get_partition_parser(*types);
+                        parser = get_partition_parser(*types);
                if (!parser)
                        continue;
                ret = (*parser->parse_fn)(master, pparts, data);
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index a3c4de551ebe..7d17cecad69d 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -314,6 +314,26 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
          load time (assuming you build diskonchip as a module) with the module
          parameter "inftl_bbt_write=1".
+config MTD_NAND_DOCG4
+        tristate "Support for DiskOnChip G4 (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        select BCH
+        select BITREVERSE
+        help
+          Support for diskonchip G4 nand flash, found in various smartphones and
+          PDAs, among them the Palm Treo680, HTC Prophet and Wizard, Toshiba
+          Portege G900, Asus P526, and O2 XDA Zinc.
+          With this driver you will be able to use UBI and create a ubifs on the
+          device, so you may wish to consider enabling UBI and UBIFS as well.
+          These devices ship with the Mys/Sandisk SAFTL formatting, for which
+          there is currently no mtd parser, so you may want to use command line
+          partitioning to segregate write-protected blocks. On the Treo680, the
+          first five erase blocks (256KiB each) are write-protected, followed
+          by the block containing the saftl partition table.  This is probably
+          typical.
 config MTD_NAND_SHARPSL
        tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
        depends on ARCH_PXA
@@ -421,7 +441,6 @@ config MTD_NAND_NANDSIM
 config MTD_NAND_GPMI_NAND
        bool "GPMI NAND Flash Controller driver"
        depends on MTD_NAND && (SOC_IMX23 || SOC_IMX28)
-        select MTD_CMDLINE_PARTS
        help
         Enables NAND Flash support for IMX23 or IMX28.
         The GPMI controller is very powerful, with the help of BCH
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 19bc8cb1d187..d4b4d8739bd8 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_MTD_NAND_PPCHAMELEONEVB)	+= ppchameleonevb.o
 obj-$(CONFIG_MTD_NAND_S3C2410)          += s3c2410.o
 obj-$(CONFIG_MTD_NAND_DAVINCI)          += davinci_nand.o
 obj-$(CONFIG_MTD_NAND_DISKONCHIP)       += diskonchip.o
+obj-$(CONFIG_MTD_NAND_DOCG4)            += docg4.o
 obj-$(CONFIG_MTD_NAND_FSMC)             += fsmc_nand.o
 obj-$(CONFIG_MTD_NAND_H1900)            += h1910.o
 obj-$(CONFIG_MTD_NAND_RTC_FROM4)        += rtc_from4.o
diff --git a/drivers/mtd/nand/alauda.c b/drivers/mtd/nand/alauda.c
index 6a5ff64a139e..4f20e1d8bef1 100644
--- a/drivers/mtd/nand/alauda.c
+++ b/drivers/mtd/nand/alauda.c
@@ -585,12 +585,13 @@ static int alauda_init_media(struct alauda *al)
        mtd->writesize = 1<<card->pageshift;
        mtd->type = MTD_NANDFLASH;
        mtd->flags = MTD_CAP_NANDFLASH;
-        mtd->read = alauda_read;
+        mtd->_read = alauda_read;
-        mtd->write = alauda_write;
+        mtd->_write = alauda_write;
-        mtd->erase = alauda_erase;
+        mtd->_erase = alauda_erase;
-        mtd->block_isbad = alauda_isbad;
+        mtd->_block_isbad = alauda_isbad;
        mtd->priv = al;
        mtd->owner = THIS_MODULE;
+        mtd->ecc_strength = 1;
        err = mtd_device_register(mtd, NULL, 0);
        if (err) {
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index ae7e37d9ac17..2165576a1c67 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -603,6 +603,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
                nand_chip->ecc.hwctl = atmel_nand_hwctl;
                nand_chip->ecc.read_page = atmel_nand_read_page;
                nand_chip->ecc.bytes = 4;
+                nand_chip->ecc.strength = 1;
        }
        nand_chip->chip_delay = 20;             /* 20us command delay time */
diff --git a/drivers/mtd/nand/bcm_umi_nand.c b/drivers/mtd/nand/bcm_umi_nand.c
index 64c9cbaf86a1..6908cdde3065 100644
--- a/drivers/mtd/nand/bcm_umi_nand.c
+++ b/drivers/mtd/nand/bcm_umi_nand.c
@@ -475,6 +475,14 @@ static int __devinit bcm_umi_nand_probe(struct platform_device *pdev)
                        largepage_bbt.options = NAND_BBT_SCAN2NDPAGE;
                this->badblock_pattern = &largepage_bbt;
        }
+        /*
+         * FIXME: ecc strength value of 6 bits per 512 bytes of data is a
+         * conservative guess, given 13 ecc bytes and using bch alg.
+         * (Assume Galois field order m=15 to allow a margin of error.)
+         */
+        this->ecc.strength = 6;
 #endif
        /* Now finish off the scan, now that ecc.layout has been initialized. */
@@ -487,7 +495,7 @@ static int __devinit bcm_umi_nand_probe(struct platform_device *pdev)
        /* Register the partitions */
        board_mtd->name = "bcm_umi-nand";
-        mtd_device_parse_register(board_mtd, NULL, 0, NULL, 0);
+        mtd_device_parse_register(board_mtd, NULL, NULL, NULL, 0);
        /* Return happy */
        return 0;
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
index dd899cb5d366..d7b86b925de5 100644
--- a/drivers/mtd/nand/bf5xx_nand.c
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -702,9 +702,11 @@ static int bf5xx_nand_scan(struct mtd_info *mtd)
                if (likely(mtd->writesize >= 512)) {
                        chip->ecc.size = 512;
                        chip->ecc.bytes = 6;
+                        chip->ecc.strength = 2;
                } else {
                        chip->ecc.size = 256;
                        chip->ecc.bytes = 3;
+                        chip->ecc.strength = 1;
                        bfin_write_NFC_CTL(bfin_read_NFC_CTL() & ~(1 << NFC_PG_SIZE_OFFSET));
                        SSYNC();
                }
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index 72d3f23490c5..2a96e1a12062 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -783,6 +783,7 @@ static int __devinit cafe_nand_probe(struct pci_dev *pdev,
        cafe->nand.ecc.mode = NAND_ECC_HW_SYNDROME;
        cafe->nand.ecc.size = mtd->writesize;
        cafe->nand.ecc.bytes = 14;
+        cafe->nand.ecc.strength = 4;
        cafe->nand.ecc.hwctl  = (void *)cafe_nand_bug;
        cafe->nand.ecc.calculate = (void *)cafe_nand_bug;
        cafe->nand.ecc.correct  = (void *)cafe_nand_bug;
@@ -799,7 +800,7 @@ static int __devinit cafe_nand_probe(struct pci_dev *pdev,
        pci_set_drvdata(pdev, mtd);
        mtd->name = "cafe_nand";
-        mtd_device_parse_register(mtd, part_probes, 0, NULL, 0);
+        mtd_device_parse_register(mtd, part_probes, NULL, NULL, 0);
        goto out;
diff --git a/drivers/mtd/nand/cmx270_nand.c b/drivers/mtd/nand/cmx270_nand.c
index 737ef9a04fdb..1024bfc05c86 100644
--- a/drivers/mtd/nand/cmx270_nand.c
+++ b/drivers/mtd/nand/cmx270_nand.c
@@ -219,7 +219,7 @@ static int __init cmx270_init(void)
        }
        /* Register the partitions */
-        ret = mtd_device_parse_register(cmx270_nand_mtd, NULL, 0,
+        ret = mtd_device_parse_register(cmx270_nand_mtd, NULL, NULL,
                                        partition_info, NUM_PARTITIONS);
        if (ret)
                goto err_scan;
diff --git a/drivers/mtd/nand/cs553x_nand.c b/drivers/mtd/nand/cs553x_nand.c
index 414afa793563..821c34c62500 100644
--- a/drivers/mtd/nand/cs553x_nand.c
+++ b/drivers/mtd/nand/cs553x_nand.c
@@ -248,6 +248,8 @@ static int __init cs553x_init_one(int cs, int mmio, unsigned long adr)
                goto out_ior;
        }
+        this->ecc.strength = 1;
        new_mtd->name = kasprintf(GFP_KERNEL, "cs553x_nand_cs%d", cs);
        cs553x_mtd[cs] = new_mtd;
@@ -313,7 +315,7 @@ static int __init cs553x_init(void)
        for (i = 0; i < NR_CS553X_CONTROLLERS; i++) {
                if (cs553x_mtd[i]) {
                        /* If any devices registered, return success. Else the last error. */
-                        mtd_device_parse_register(cs553x_mtd[i], NULL, 0,
+                        mtd_device_parse_register(cs553x_mtd[i], NULL, NULL,
                                                  NULL, 0);
                        err = 0;
                }
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 6e566156956f..d94b03c207af 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -641,6 +641,7 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
                        info->chip.ecc.bytes = 3;
                }
                info->chip.ecc.size = 512;
+                info->chip.ecc.strength = pdata->ecc_bits;
                break;
        default:
                ret = -EINVAL;
@@ -752,8 +753,8 @@ syndrome_done:
        if (ret < 0)
                goto err_scan;
-        ret = mtd_device_parse_register(&info->mtd, NULL, 0,
+        ret = mtd_device_parse_register(&info->mtd, NULL, NULL, pdata->parts,
-                        pdata->parts, pdata->nr_parts);
+                                        pdata->nr_parts);
        if (ret < 0)
                goto err_scan;
diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
index 3984d488f9ab..a9e57d686297 100644
--- a/drivers/mtd/nand/denali.c
+++ b/drivers/mtd/nand/denali.c
@@ -1590,6 +1590,7 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                        ECC_15BITS * (denali->mtd.writesize /
                        ECC_SECTOR_SIZE)))) {
                /* if MLC OOB size is large enough, use 15bit ECC*/
+                denali->nand.ecc.strength = 15;
                denali->nand.ecc.layout = &nand_15bit_oob;
                denali->nand.ecc.bytes = ECC_15BITS;
                iowrite32(15, denali->flash_reg + ECC_CORRECTION);
@@ -1600,12 +1601,14 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                                " contain 8bit ECC correction codes");
                goto failed_req_irq;
        } else {
+                denali->nand.ecc.strength = 8;
                denali->nand.ecc.layout = &nand_8bit_oob;
                denali->nand.ecc.bytes = ECC_8BITS;
                iowrite32(8, denali->flash_reg + ECC_CORRECTION);
        }
        denali->nand.ecc.bytes *= denali->devnum;
+        denali->nand.ecc.strength *= denali->devnum;
        denali->nand.ecc.layout->eccbytes *=
                denali->mtd.writesize / ECC_SECTOR_SIZE;
        denali->nand.ecc.layout->oobfree[0].offset =
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index df921e7a496c..e2ca067631cf 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -1653,6 +1653,7 @@ static int __init doc_probe(unsigned long physadr)
        nand->ecc.mode          = NAND_ECC_HW_SYNDROME;
        nand->ecc.size          = 512;
        nand->ecc.bytes         = 6;
+        nand->ecc.strength      = 2;
        nand->bbt_options       = NAND_BBT_USE_FLASH;
        doc->physadr            = physadr;
diff --git a/drivers/mtd/nand/docg4.c b/drivers/mtd/nand/docg4.c
new file mode 100644
index 000000000000..b08202664543
--- /dev/null
+++ b/drivers/mtd/nand/docg4.c
@@ -0,0 +1,1377 @@
+/*
+ *  Copyright © 2012 Mike Dunn <mikedunn@newsguy.com>
+ *
+ * mtd nand driver for M-Systems DiskOnChip G4
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Tested on the Palm Treo 680.  The G4 is also present on Toshiba Portege, Asus
+ * P526, some HTC smartphones (Wizard, Prophet, ...), O2 XDA Zinc, maybe others.
+ * Should work on these as well.  Let me know!
+ *
+ * TODO:
+ *
+ *  Mechanism for management of password-protected areas
+ *
+ *  Hamming ecc when reading oob only
+ *
+ *  According to the M-Sys documentation, this device is also available in a
+ *  "dual-die" configuration having a 256MB capacity, but no mechanism for
+ *  detecting this variant is documented.  Currently this driver assumes 128MB
+ *  capacity.
+ *
+ *  Support for multiple cascaded devices ("floors").  Not sure which gadgets
+ *  contain multiple G4s in a cascaded configuration, if any.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/string.h>
+#include <linux/sched.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/export.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/bitops.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/bch.h>
+#include <linux/bitrev.h>
+/*
+ * You'll want to ignore badblocks if you're reading a partition that contains
+ * data written by the TrueFFS library (i.e., by PalmOS, Windows, etc), since
+ * it does not use mtd nand's method for marking bad blocks (using oob area).
+ * This will also skip the check of the "page written" flag.
+ */
+static bool ignore_badblocks;
+module_param(ignore_badblocks, bool, 0);
+MODULE_PARM_DESC(ignore_badblocks, "no badblock checking performed");
+struct docg4_priv {
+        struct mtd_info *mtd;
+        struct device *dev;
+        void __iomem *virtadr;
+        int status;
+        struct {
+                unsigned int command;
+                int column;
+                int page;
+        } last_command;
+        uint8_t oob_buf[16];
+        uint8_t ecc_buf[7];
+        int oob_page;
+        struct bch_control *bch;
+};
+/*
+ * Defines prefixed with DOCG4 are unique to the diskonchip G4.  All others are
+ * shared with other diskonchip devices (P3, G3 at least).
+ *
+ * Functions with names prefixed with docg4_ are mtd / nand interface functions
+ * (though they may also be called internally).  All others are internal.
+ */
+#define DOC_IOSPACE_DATA                0x0800
+/* register offsets */
+#define DOC_CHIPID                      0x1000
+#define DOC_DEVICESELECT                0x100a
+#define DOC_ASICMODE                    0x100c
+#define DOC_DATAEND                     0x101e
+#define DOC_NOP                         0x103e
+#define DOC_FLASHSEQUENCE               0x1032
+#define DOC_FLASHCOMMAND                0x1034
+#define DOC_FLASHADDRESS                0x1036
+#define DOC_FLASHCONTROL                0x1038
+#define DOC_ECCCONF0                    0x1040
+#define DOC_ECCCONF1                    0x1042
+#define DOC_HAMMINGPARITY               0x1046
+#define DOC_BCH_SYNDROM(idx)            (0x1048 + idx)
+#define DOC_ASICMODECONFIRM             0x1072
+#define DOC_CHIPID_INV                  0x1074
+#define DOC_POWERMODE                   0x107c
+#define DOCG4_MYSTERY_REG               0x1050
+/* apparently used only to write oob bytes 6 and 7 */
+#define DOCG4_OOB_6_7                   0x1052
+/* DOC_FLASHSEQUENCE register commands */
+#define DOC_SEQ_RESET                   0x00
+#define DOCG4_SEQ_PAGE_READ             0x03
+#define DOCG4_SEQ_FLUSH                 0x29
+#define DOCG4_SEQ_PAGEWRITE             0x16
+#define DOCG4_SEQ_PAGEPROG              0x1e
+#define DOCG4_SEQ_BLOCKERASE            0x24
+/* DOC_FLASHCOMMAND register commands */
+#define DOCG4_CMD_PAGE_READ             0x00
+#define DOC_CMD_ERASECYCLE2             0xd0
+#define DOCG4_CMD_FLUSH                 0x70
+#define DOCG4_CMD_READ2                 0x30
+#define DOC_CMD_PROG_BLOCK_ADDR         0x60
+#define DOCG4_CMD_PAGEWRITE             0x80
+#define DOC_CMD_PROG_CYCLE2             0x10
+#define DOC_CMD_RESET                   0xff
+/* DOC_POWERMODE register bits */
+#define DOC_POWERDOWN_READY             0x80
+/* DOC_FLASHCONTROL register bits */
+#define DOC_CTRL_CE                     0x10
+#define DOC_CTRL_UNKNOWN                0x40
+#define DOC_CTRL_FLASHREADY             0x01
+/* DOC_ECCCONF0 register bits */
+#define DOC_ECCCONF0_READ_MODE          0x8000
+#define DOC_ECCCONF0_UNKNOWN            0x2000
+#define DOC_ECCCONF0_ECC_ENABLE         0x1000
+#define DOC_ECCCONF0_DATA_BYTES_MASK    0x07ff
+/* DOC_ECCCONF1 register bits */
+#define DOC_ECCCONF1_BCH_SYNDROM_ERR    0x80
+#define DOC_ECCCONF1_ECC_ENABLE         0x07
+#define DOC_ECCCONF1_PAGE_IS_WRITTEN    0x20
+/* DOC_ASICMODE register bits */
+#define DOC_ASICMODE_RESET              0x00
+#define DOC_ASICMODE_NORMAL             0x01
+#define DOC_ASICMODE_POWERDOWN          0x02
+#define DOC_ASICMODE_MDWREN             0x04
+#define DOC_ASICMODE_BDETCT_RESET       0x08
+#define DOC_ASICMODE_RSTIN_RESET        0x10
+#define DOC_ASICMODE_RAM_WE             0x20
+/* good status values read after read/write/erase operations */
+#define DOCG4_PROGSTATUS_GOOD          0x51
+#define DOCG4_PROGSTATUS_GOOD_2        0xe0
+/*
+ * On read operations (page and oob-only), the first byte read from I/O reg is a
+ * status.  On error, it reads 0x73; otherwise, it reads either 0x71 (first read
+ * after reset only) or 0x51, so bit 1 is presumed to be an error indicator.
+ */
+#define DOCG4_READ_ERROR           0x02 /* bit 1 indicates read error */
+/* anatomy of the device */
+#define DOCG4_CHIP_SIZE        0x8000000
+#define DOCG4_PAGE_SIZE        0x200
+#define DOCG4_PAGES_PER_BLOCK  0x200
+#define DOCG4_BLOCK_SIZE       (DOCG4_PAGES_PER_BLOCK * DOCG4_PAGE_SIZE)
+#define DOCG4_NUMBLOCKS        (DOCG4_CHIP_SIZE / DOCG4_BLOCK_SIZE)
+#define DOCG4_OOB_SIZE         0x10
+#define DOCG4_CHIP_SHIFT       27    /* log_2(DOCG4_CHIP_SIZE) */
+#define DOCG4_PAGE_SHIFT       9     /* log_2(DOCG4_PAGE_SIZE) */
+#define DOCG4_ERASE_SHIFT      18    /* log_2(DOCG4_BLOCK_SIZE) */
+/* all but the last byte is included in ecc calculation */
+#define DOCG4_BCH_SIZE         (DOCG4_PAGE_SIZE + DOCG4_OOB_SIZE - 1)
+#define DOCG4_USERDATA_LEN     520 /* 512 byte page plus 8 oob avail to user */
+/* expected values from the ID registers */
+#define DOCG4_IDREG1_VALUE     0x0400
+#define DOCG4_IDREG2_VALUE     0xfbff
+/* primitive polynomial used to build the Galois field used by hw ecc gen */
+#define DOCG4_PRIMITIVE_POLY   0x4443
+#define DOCG4_M                14  /* Galois field is of order 2^14 */
+#define DOCG4_T                4   /* BCH alg corrects up to 4 bit errors */
+#define DOCG4_FACTORY_BBT_PAGE 16 /* page where read-only factory bbt lives */
+/*
+ * Oob bytes 0 - 6 are available to the user.
+ * Byte 7 is hamming ecc for first 7 bytes.  Bytes 8 - 14 are hw-generated ecc.
+ * Byte 15 (the last) is used by the driver as a "page written" flag.
+ */
+static struct nand_ecclayout docg4_oobinfo = {
+        .eccbytes = 9,
+        .eccpos = {7, 8, 9, 10, 11, 12, 13, 14, 15},
+        .oobavail = 7,
+        .oobfree = { {0, 7} }
+};
+/*
+ * The device has a nop register which M-Sys claims is for the purpose of
+ * inserting precise delays.  But beware; at least some operations fail if the
+ * nop writes are replaced with a generic delay!
+ */
+static inline void write_nop(void __iomem *docptr)
+{
+        writew(0, docptr + DOC_NOP);
+}
+static void docg4_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        int i;
+        struct nand_chip *nand = mtd->priv;
+        uint16_t *p = (uint16_t *) buf;
+        len >>= 1;
+        for (i = 0; i < len; i++)
+                p[i] = readw(nand->IO_ADDR_R);
+}
+static void docg4_write_buf16(struct mtd_info *mtd, const uint8_t *buf, int len)
+{
+        int i;
+        struct nand_chip *nand = mtd->priv;
+        uint16_t *p = (uint16_t *) buf;
+        len >>= 1;
+        for (i = 0; i < len; i++)
+                writew(p[i], nand->IO_ADDR_W);
+}
+static int poll_status(struct docg4_priv *doc)
+{
+        /*
+         * Busy-wait for the FLASHREADY bit to be set in the FLASHCONTROL
+         * register.  Operations known to take a long time (e.g., block erase)
+         * should sleep for a while before calling this.
+         */
+        uint16_t flash_status;
+        unsigned int timeo;
+        void __iomem *docptr = doc->virtadr;
+        dev_dbg(doc->dev, "%s...\n", __func__);
+        /* hardware quirk requires reading twice initially */
+        flash_status = readw(docptr + DOC_FLASHCONTROL);
+        timeo = 1000;
+        do {
+                cpu_relax();
+                flash_status = readb(docptr + DOC_FLASHCONTROL);
+        } while (!(flash_status & DOC_CTRL_FLASHREADY) && --timeo);
+        if (!timeo) {
+                dev_err(doc->dev, "%s: timed out!\n", __func__);
+                return NAND_STATUS_FAIL;
+        }
+        if (unlikely(timeo < 50))
+                dev_warn(doc->dev, "%s: nearly timed out; %d remaining\n",
+                         __func__, timeo);
+        return 0;
+}
+static int docg4_wait(struct mtd_info *mtd, struct nand_chip *nand)
+{
+        struct docg4_priv *doc = nand->priv;
+        int status = NAND_STATUS_WP;       /* inverse logic?? */
+        dev_dbg(doc->dev, "%s...\n", __func__);
+        /* report any previously unreported error */
+        if (doc->status) {
+                status |= doc->status;
+                doc->status = 0;
+                return status;
+        }
+        status |= poll_status(doc);
+        return status;
+}
+static void docg4_select_chip(struct mtd_info *mtd, int chip)
+{
+        /*
+         * Select among multiple cascaded chips ("floors").  Multiple floors are
+         * not yet supported, so the only valid non-negative value is 0.
+         */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        dev_dbg(doc->dev, "%s: chip %d\n", __func__, chip);
+        if (chip < 0)
+                return;         /* deselected */
+        if (chip > 0)
+                dev_warn(doc->dev, "multiple floors currently unsupported\n");
+        writew(0, docptr + DOC_DEVICESELECT);
+}
+static void reset(struct mtd_info *mtd)
+{
+        /* full device reset */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        writew(DOC_ASICMODE_RESET | DOC_ASICMODE_MDWREN,
+               docptr + DOC_ASICMODE);
+        writew(~(DOC_ASICMODE_RESET | DOC_ASICMODE_MDWREN),
+               docptr + DOC_ASICMODECONFIRM);
+        write_nop(docptr);
+        writew(DOC_ASICMODE_NORMAL | DOC_ASICMODE_MDWREN,
+               docptr + DOC_ASICMODE);
+        writew(~(DOC_ASICMODE_NORMAL | DOC_ASICMODE_MDWREN),
+               docptr + DOC_ASICMODECONFIRM);
+        writew(DOC_ECCCONF1_ECC_ENABLE, docptr + DOC_ECCCONF1);
+        poll_status(doc);
+}
+static void read_hw_ecc(void __iomem *docptr, uint8_t *ecc_buf)
+{
+        /* read the 7 hw-generated ecc bytes */
+        int i;
+        for (i = 0; i < 7; i++) { /* hw quirk; read twice */
+                ecc_buf[i] = readb(docptr + DOC_BCH_SYNDROM(i));
+                ecc_buf[i] = readb(docptr + DOC_BCH_SYNDROM(i));
+        }
+}
+static int correct_data(struct mtd_info *mtd, uint8_t *buf, int page)
+{
+        /*
+         * Called after a page read when hardware reports bitflips.
+         * Up to four bitflips can be corrected.
+         */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        int i, numerrs, errpos[4];
+        const uint8_t blank_read_hwecc[8] = {
+                0xcf, 0x72, 0xfc, 0x1b, 0xa9, 0xc7, 0xb9, 0 };
+        read_hw_ecc(docptr, doc->ecc_buf); /* read 7 hw-generated ecc bytes */
+        /* check if read error is due to a blank page */
+        if (!memcmp(doc->ecc_buf, blank_read_hwecc, 7))
+                return 0;       /* yes */
+        /* skip additional check of "written flag" if ignore_badblocks */
+        if (ignore_badblocks == false) {
+                /*
+                 * If the hw ecc bytes are not those of a blank page, there's
+                 * still a chance that the page is blank, but was read with
+                 * errors.  Check the "written flag" in last oob byte, which
+                 * is set to zero when a page is written.  If more than half
+                 * the bits are set, assume a blank page.  Unfortunately, the
+                 * bit flips(s) are not reported in stats.
+                 */
+                if (doc->oob_buf[15]) {
+                        int bit, numsetbits = 0;
+                        unsigned long written_flag = doc->oob_buf[15];
+                        for_each_set_bit(bit, &written_flag, 8)
+                                numsetbits++;
+                        if (numsetbits > 4) { /* assume blank */
+                                dev_warn(doc->dev,
+                                         "error(s) in blank page "
+                                         "at offset %08x\n",
+                                         page * DOCG4_PAGE_SIZE);
+                                return 0;
+                        }
+                }
+        }
+        /*
+         * The hardware ecc unit produces oob_ecc ^ calc_ecc.  The kernel's bch
+         * algorithm is used to decode this.  However the hw operates on page
+         * data in a bit order that is the reverse of that of the bch alg,
+         * requiring that the bits be reversed on the result.  Thanks to Ivan
+         * Djelic for his analysis!
+         */
+        for (i = 0; i < 7; i++)
+                doc->ecc_buf[i] = bitrev8(doc->ecc_buf[i]);
+        numerrs = decode_bch(doc->bch, NULL, DOCG4_USERDATA_LEN, NULL,
+                             doc->ecc_buf, NULL, errpos);
+        if (numerrs == -EBADMSG) {
+                dev_warn(doc->dev, "uncorrectable errors at offset %08x\n",
+                         page * DOCG4_PAGE_SIZE);
+                return -EBADMSG;
+        }
+        BUG_ON(numerrs < 0);    /* -EINVAL, or anything other than -EBADMSG */
+        /* undo last step in BCH alg (modulo mirroring not needed) */
+        for (i = 0; i < numerrs; i++)
+                errpos[i] = (errpos[i] & ~7)|(7-(errpos[i] & 7));
+        /* fix the errors */
+        for (i = 0; i < numerrs; i++) {
+                /* ignore if error within oob ecc bytes */
+                if (errpos[i] > DOCG4_USERDATA_LEN * 8)
+                        continue;
+                /* if error within oob area preceeding ecc bytes... */
+                if (errpos[i] > DOCG4_PAGE_SIZE * 8)
+                        change_bit(errpos[i] - DOCG4_PAGE_SIZE * 8,
+                                   (unsigned long *)doc->oob_buf);
+                else    /* error in page data */
+                        change_bit(errpos[i], (unsigned long *)buf);
+        }
+        dev_notice(doc->dev, "%d error(s) corrected at offset %08x\n",
+                   numerrs, page * DOCG4_PAGE_SIZE);
+        return numerrs;
+}
+static uint8_t docg4_read_byte(struct mtd_info *mtd)
+{
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        dev_dbg(doc->dev, "%s\n", __func__);
+        if (doc->last_command.command == NAND_CMD_STATUS) {
+                int status;
+                /*
+                 * Previous nand command was status request, so nand
+                 * infrastructure code expects to read the status here.  If an
+                 * error occurred in a previous operation, report it.
+                 */
+                doc->last_command.command = 0;
+                if (doc->status) {
+                        status = doc->status;
+                        doc->status = 0;
+                }
+                /* why is NAND_STATUS_WP inverse logic?? */
+                else
+                        status = NAND_STATUS_WP | NAND_STATUS_READY;
+                return status;
+        }
+        dev_warn(doc->dev, "unexpectd call to read_byte()\n");
+        return 0;
+}
+static void write_addr(struct docg4_priv *doc, uint32_t docg4_addr)
+{
+        /* write the four address bytes packed in docg4_addr to the device */
+        void __iomem *docptr = doc->virtadr;
+        writeb(docg4_addr & 0xff, docptr + DOC_FLASHADDRESS);
+        docg4_addr >>= 8;
+        writeb(docg4_addr & 0xff, docptr + DOC_FLASHADDRESS);
+        docg4_addr >>= 8;
+        writeb(docg4_addr & 0xff, docptr + DOC_FLASHADDRESS);
+        docg4_addr >>= 8;
+        writeb(docg4_addr & 0xff, docptr + DOC_FLASHADDRESS);
+}
+static int read_progstatus(struct docg4_priv *doc)
+{
+        /*
+         * This apparently checks the status of programming.  Done after an
+         * erasure, and after page data is written.  On error, the status is
+         * saved, to be later retrieved by the nand infrastructure code.
+         */
+        void __iomem *docptr = doc->virtadr;
+        /* status is read from the I/O reg */
+        uint16_t status1 = readw(docptr + DOC_IOSPACE_DATA);
+        uint16_t status2 = readw(docptr + DOC_IOSPACE_DATA);
+        uint16_t status3 = readw(docptr + DOCG4_MYSTERY_REG);
+        dev_dbg(doc->dev, "docg4: %s: %02x %02x %02x\n",
+              __func__, status1, status2, status3);
+        if (status1 != DOCG4_PROGSTATUS_GOOD
+            || status2 != DOCG4_PROGSTATUS_GOOD_2
+            || status3 != DOCG4_PROGSTATUS_GOOD_2) {
+                doc->status = NAND_STATUS_FAIL;
+                dev_warn(doc->dev, "read_progstatus failed: "
+                         "%02x, %02x, %02x\n", status1, status2, status3);
+                return -EIO;
+        }
+        return 0;
+}
+static int pageprog(struct mtd_info *mtd)
+{
+        /*
+         * Final step in writing a page.  Writes the contents of its
+         * internal buffer out to the flash array, or some such.
+         */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        int retval = 0;
+        dev_dbg(doc->dev, "docg4: %s\n", __func__);
+        writew(DOCG4_SEQ_PAGEPROG, docptr + DOC_FLASHSEQUENCE);
+        writew(DOC_CMD_PROG_CYCLE2, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_nop(docptr);
+        /* Just busy-wait; usleep_range() slows things down noticeably. */
+        poll_status(doc);
+        writew(DOCG4_SEQ_FLUSH, docptr + DOC_FLASHSEQUENCE);
+        writew(DOCG4_CMD_FLUSH, docptr + DOC_FLASHCOMMAND);
+        writew(DOC_ECCCONF0_READ_MODE | 4, docptr + DOC_ECCCONF0);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        retval = read_progstatus(doc);
+        writew(0, docptr + DOC_DATAEND);
+        write_nop(docptr);
+        poll_status(doc);
+        write_nop(docptr);
+        return retval;
+}
+static void sequence_reset(struct mtd_info *mtd)
+{
+        /* common starting sequence for all operations */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        writew(DOC_CTRL_UNKNOWN | DOC_CTRL_CE, docptr + DOC_FLASHCONTROL);
+        writew(DOC_SEQ_RESET, docptr + DOC_FLASHSEQUENCE);
+        writew(DOC_CMD_RESET, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_nop(docptr);
+        poll_status(doc);
+        write_nop(docptr);
+}
+static void read_page_prologue(struct mtd_info *mtd, uint32_t docg4_addr)
+{
+        /* first step in reading a page */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        dev_dbg(doc->dev,
+              "docg4: %s: g4 page %08x\n", __func__, docg4_addr);
+        sequence_reset(mtd);
+        writew(DOCG4_SEQ_PAGE_READ, docptr + DOC_FLASHSEQUENCE);
+        writew(DOCG4_CMD_PAGE_READ, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_addr(doc, docg4_addr);
+        write_nop(docptr);
+        writew(DOCG4_CMD_READ2, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_nop(docptr);
+        poll_status(doc);
+}
+static void write_page_prologue(struct mtd_info *mtd, uint32_t docg4_addr)
+{
+        /* first step in writing a page */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        dev_dbg(doc->dev,
+              "docg4: %s: g4 addr: %x\n", __func__, docg4_addr);
+        sequence_reset(mtd);
+        writew(DOCG4_SEQ_PAGEWRITE, docptr + DOC_FLASHSEQUENCE);
+        writew(DOCG4_CMD_PAGEWRITE, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_addr(doc, docg4_addr);
+        write_nop(docptr);
+        write_nop(docptr);
+        poll_status(doc);
+}
+static uint32_t mtd_to_docg4_address(int page, int column)
+{
+        /*
+         * Convert mtd address to format used by the device, 32 bit packed.
+         *
+         * Some notes on G4 addressing... The M-Sys documentation on this device
+         * claims that pages are 2K in length, and indeed, the format of the
+         * address used by the device reflects that.  But within each page are
+         * four 512 byte "sub-pages", each with its own oob data that is
+         * read/written immediately after the 512 bytes of page data.  This oob
+         * data contains the ecc bytes for the preceeding 512 bytes.
+         *
+         * Rather than tell the mtd nand infrastructure that page size is 2k,
+         * with four sub-pages each, we engage in a little subterfuge and tell
+         * the infrastructure code that pages are 512 bytes in size.  This is
+         * done because during the course of reverse-engineering the device, I
+         * never observed an instance where an entire 2K "page" was read or
+         * written as a unit.  Each "sub-page" is always addressed individually,
+         * its data read/written, and ecc handled before the next "sub-page" is
+         * addressed.
+         *
+         * This requires us to convert addresses passed by the mtd nand
+         * infrastructure code to those used by the device.
+         *
+         * The address that is written to the device consists of four bytes: the
+         * first two are the 2k page number, and the second is the index into
+         * the page.  The index is in terms of 16-bit half-words and includes
+         * the preceeding oob data, so e.g., the index into the second
+         * "sub-page" is 0x108, and the full device address of the start of mtd
+         * page 0x201 is 0x00800108.
+         */
+        int g4_page = page / 4;                       /* device's 2K page */
+        int g4_index = (page % 4) * 0x108 + column/2; /* offset into page */
+        return (g4_page << 16) | g4_index;            /* pack */
+}
+static void docg4_command(struct mtd_info *mtd, unsigned command, int column,
+                          int page_addr)
+{
+        /* handle standard nand commands */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        uint32_t g4_addr = mtd_to_docg4_address(page_addr, column);
+        dev_dbg(doc->dev, "%s %x, page_addr=%x, column=%x\n",
+              __func__, command, page_addr, column);
+        /*
+         * Save the command and its arguments.  This enables emulation of
+         * standard flash devices, and also some optimizations.
+         */
+        doc->last_command.command = command;
+        doc->last_command.column = column;
+        doc->last_command.page = page_addr;
+        switch (command) {
+        case NAND_CMD_RESET:
+                reset(mtd);
+                break;
+        case NAND_CMD_READ0:
+                read_page_prologue(mtd, g4_addr);
+                break;
+        case NAND_CMD_STATUS:
+                /* next call to read_byte() will expect a status */
+                break;
+        case NAND_CMD_SEQIN:
+                write_page_prologue(mtd, g4_addr);
+                /* hack for deferred write of oob bytes */
+                if (doc->oob_page == page_addr)
+                        memcpy(nand->oob_poi, doc->oob_buf, 16);
+                break;
+        case NAND_CMD_PAGEPROG:
+                pageprog(mtd);
+                break;
+        /* we don't expect these, based on review of nand_base.c */
+        case NAND_CMD_READOOB:
+        case NAND_CMD_READID:
+        case NAND_CMD_ERASE1:
+        case NAND_CMD_ERASE2:
+                dev_warn(doc->dev, "docg4_command: "
+                         "unexpected nand command 0x%x\n", command);
+                break;
+        }
+}
+static int read_page(struct mtd_info *mtd, struct nand_chip *nand,
+                     uint8_t *buf, int page, bool use_ecc)
+{
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        uint16_t status, edc_err, *buf16;
+        dev_dbg(doc->dev, "%s: page %08x\n", __func__, page);
+        writew(DOC_ECCCONF0_READ_MODE |
+               DOC_ECCCONF0_ECC_ENABLE |
+               DOC_ECCCONF0_UNKNOWN |
+               DOCG4_BCH_SIZE,
+               docptr + DOC_ECCCONF0);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        /* the 1st byte from the I/O reg is a status; the rest is page data */
+        status = readw(docptr + DOC_IOSPACE_DATA);
+        if (status & DOCG4_READ_ERROR) {
+                dev_err(doc->dev,
+                        "docg4_read_page: bad status: 0x%02x\n", status);
+                writew(0, docptr + DOC_DATAEND);
+                return -EIO;
+        }
+        dev_dbg(doc->dev, "%s: status = 0x%x\n", __func__, status);
+        docg4_read_buf(mtd, buf, DOCG4_PAGE_SIZE); /* read the page data */
+        /*
+         * Diskonchips read oob immediately after a page read.  Mtd
+         * infrastructure issues a separate command for reading oob after the
+         * page is read.  So we save the oob bytes in a local buffer and just
+         * copy it if the next command reads oob from the same page.
+         */
+        /* first 14 oob bytes read from I/O reg */
+        docg4_read_buf(mtd, doc->oob_buf, 14);
+        /* last 2 read from another reg */
+        buf16 = (uint16_t *)(doc->oob_buf + 14);
+        *buf16 = readw(docptr + DOCG4_MYSTERY_REG);
+        write_nop(docptr);
+        if (likely(use_ecc == true)) {
+                /* read the register that tells us if bitflip(s) detected  */
+                edc_err = readw(docptr + DOC_ECCCONF1);
+                edc_err = readw(docptr + DOC_ECCCONF1);
+                dev_dbg(doc->dev, "%s: edc_err = 0x%02x\n", __func__, edc_err);
+                /* If bitflips are reported, attempt to correct with ecc */
+                if (edc_err & DOC_ECCCONF1_BCH_SYNDROM_ERR) {
+                        int bits_corrected = correct_data(mtd, buf, page);
+                        if (bits_corrected == -EBADMSG)
+                                mtd->ecc_stats.failed++;
+                        else
+                                mtd->ecc_stats.corrected += bits_corrected;
+                }
+        }
+        writew(0, docptr + DOC_DATAEND);
+        return 0;
+}
+static int docg4_read_page_raw(struct mtd_info *mtd, struct nand_chip *nand,
+                               uint8_t *buf, int page)
+{
+        return read_page(mtd, nand, buf, page, false);
+}
+static int docg4_read_page(struct mtd_info *mtd, struct nand_chip *nand,
+                           uint8_t *buf, int page)
+{
+        return read_page(mtd, nand, buf, page, true);
+}
+static int docg4_read_oob(struct mtd_info *mtd, struct nand_chip *nand,
+                          int page, int sndcmd)
+{
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        uint16_t status;
+        dev_dbg(doc->dev, "%s: page %x\n", __func__, page);
+        /*
+         * Oob bytes are read as part of a normal page read.  If the previous
+         * nand command was a read of the page whose oob is now being read, just
+         * copy the oob bytes that we saved in a local buffer and avoid a
+         * separate oob read.
+         */
+        if (doc->last_command.command == NAND_CMD_READ0 &&
+            doc->last_command.page == page) {
+                memcpy(nand->oob_poi, doc->oob_buf, 16);
+                return 0;
+        }
+        /*
+         * Separate read of oob data only.
+         */
+        docg4_command(mtd, NAND_CMD_READ0, nand->ecc.size, page);
+        writew(DOC_ECCCONF0_READ_MODE | DOCG4_OOB_SIZE, docptr + DOC_ECCCONF0);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        /* the 1st byte from the I/O reg is a status; the rest is oob data */
+        status = readw(docptr + DOC_IOSPACE_DATA);
+        if (status & DOCG4_READ_ERROR) {
+                dev_warn(doc->dev,
+                         "docg4_read_oob failed: status = 0x%02x\n", status);
+                return -EIO;
+        }
+        dev_dbg(doc->dev, "%s: status = 0x%x\n", __func__, status);
+        docg4_read_buf(mtd, nand->oob_poi, 16);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        writew(0, docptr + DOC_DATAEND);
+        write_nop(docptr);
+        return 0;
+}
+static void docg4_erase_block(struct mtd_info *mtd, int page)
+{
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        uint16_t g4_page;
+        dev_dbg(doc->dev, "%s: page %04x\n", __func__, page);
+        sequence_reset(mtd);
+        writew(DOCG4_SEQ_BLOCKERASE, docptr + DOC_FLASHSEQUENCE);
+        writew(DOC_CMD_PROG_BLOCK_ADDR, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        /* only 2 bytes of address are written to specify erase block */
+        g4_page = (uint16_t)(page / 4);  /* to g4's 2k page addressing */
+        writeb(g4_page & 0xff, docptr + DOC_FLASHADDRESS);
+        g4_page >>= 8;
+        writeb(g4_page & 0xff, docptr + DOC_FLASHADDRESS);
+        write_nop(docptr);
+        /* start the erasure */
+        writew(DOC_CMD_ERASECYCLE2, docptr + DOC_FLASHCOMMAND);
+        write_nop(docptr);
+        write_nop(docptr);
+        usleep_range(500, 1000); /* erasure is long; take a snooze */
+        poll_status(doc);
+        writew(DOCG4_SEQ_FLUSH, docptr + DOC_FLASHSEQUENCE);
+        writew(DOCG4_CMD_FLUSH, docptr + DOC_FLASHCOMMAND);
+        writew(DOC_ECCCONF0_READ_MODE | 4, docptr + DOC_ECCCONF0);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        write_nop(docptr);
+        read_progstatus(doc);
+        writew(0, docptr + DOC_DATAEND);
+        write_nop(docptr);
+        poll_status(doc);
+        write_nop(docptr);
+}
+static void write_page(struct mtd_info *mtd, struct nand_chip *nand,
+                       const uint8_t *buf, bool use_ecc)
+{
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        uint8_t ecc_buf[8];
+        dev_dbg(doc->dev, "%s...\n", __func__);
+        writew(DOC_ECCCONF0_ECC_ENABLE |
+               DOC_ECCCONF0_UNKNOWN |
+               DOCG4_BCH_SIZE,
+               docptr + DOC_ECCCONF0);
+        write_nop(docptr);
+        /* write the page data */
+        docg4_write_buf16(mtd, buf, DOCG4_PAGE_SIZE);
+        /* oob bytes 0 through 5 are written to I/O reg */
+        docg4_write_buf16(mtd, nand->oob_poi, 6);
+        /* oob byte 6 written to a separate reg */
+        writew(nand->oob_poi[6], docptr + DOCG4_OOB_6_7);
+        write_nop(docptr);
+        write_nop(docptr);
+        /* write hw-generated ecc bytes to oob */
+        if (likely(use_ecc == true)) {
+                /* oob byte 7 is hamming code */
+                uint8_t hamming = readb(docptr + DOC_HAMMINGPARITY);
+                hamming = readb(docptr + DOC_HAMMINGPARITY); /* 2nd read */
+                writew(hamming, docptr + DOCG4_OOB_6_7);
+                write_nop(docptr);
+                /* read the 7 bch bytes from ecc regs */
+                read_hw_ecc(docptr, ecc_buf);
+                ecc_buf[7] = 0;         /* clear the "page written" flag */
+        }
+        /* write user-supplied bytes to oob */
+        else {
+                writew(nand->oob_poi[7], docptr + DOCG4_OOB_6_7);
+                write_nop(docptr);
+                memcpy(ecc_buf, &nand->oob_poi[8], 8);
+        }
+        docg4_write_buf16(mtd, ecc_buf, 8);
+        write_nop(docptr);
+        write_nop(docptr);
+        writew(0, docptr + DOC_DATAEND);
+        write_nop(docptr);
+}
+static void docg4_write_page_raw(struct mtd_info *mtd, struct nand_chip *nand,
+                                 const uint8_t *buf)
+{
+        return write_page(mtd, nand, buf, false);
+}
+static void docg4_write_page(struct mtd_info *mtd, struct nand_chip *nand,
+                             const uint8_t *buf)
+{
+        return write_page(mtd, nand, buf, true);
+}
+static int docg4_write_oob(struct mtd_info *mtd, struct nand_chip *nand,
+                           int page)
+{
+        /*
+         * Writing oob-only is not really supported, because MLC nand must write
+         * oob bytes at the same time as page data.  Nonetheless, we save the
+         * oob buffer contents here, and then write it along with the page data
+         * if the same page is subsequently written.  This allows user space
+         * utilities that write the oob data prior to the page data to work
+         * (e.g., nandwrite).  The disdvantage is that, if the intention was to
+         * write oob only, the operation is quietly ignored.  Also, oob can get
+         * corrupted if two concurrent processes are running nandwrite.
+         */
+        /* note that bytes 7..14 are hw generated hamming/ecc and overwritten */
+        struct docg4_priv *doc = nand->priv;
+        doc->oob_page = page;
+        memcpy(doc->oob_buf, nand->oob_poi, 16);
+        return 0;
+}
+static int __init read_factory_bbt(struct mtd_info *mtd)
+{
+        /*
+         * The device contains a read-only factory bad block table.  Read it and
+         * update the memory-based bbt accordingly.
+         */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        uint32_t g4_addr = mtd_to_docg4_address(DOCG4_FACTORY_BBT_PAGE, 0);
+        uint8_t *buf;
+        int i, block, status;
+        buf = kzalloc(DOCG4_PAGE_SIZE, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+        read_page_prologue(mtd, g4_addr);
+        status = docg4_read_page(mtd, nand, buf, DOCG4_FACTORY_BBT_PAGE);
+        if (status)
+                goto exit;
+        /*
+         * If no memory-based bbt was created, exit.  This will happen if module
+         * parameter ignore_badblocks is set.  Then why even call this function?
+         * For an unknown reason, block erase always fails if it's the first
+         * operation after device power-up.  The above read ensures it never is.
+         * Ugly, I know.
+         */
+        if (nand->bbt == NULL)  /* no memory-based bbt */
+                goto exit;
+        /*
+         * Parse factory bbt and update memory-based bbt.  Factory bbt format is
+         * simple: one bit per block, block numbers increase left to right (msb
+         * to lsb).  Bit clear means bad block.
+         */
+        for (i = block = 0; block < DOCG4_NUMBLOCKS; block += 8, i++) {
+                int bitnum;
+                unsigned long bits = ~buf[i];
+                for_each_set_bit(bitnum, &bits, 8) {
+                        int badblock = block + 7 - bitnum;
+                        nand->bbt[badblock / 4] |=
+                                0x03 << ((badblock % 4) * 2);
+                        mtd->ecc_stats.badblocks++;
+                        dev_notice(doc->dev, "factory-marked bad block: %d\n",
+                                   badblock);
+                }
+        }
+ exit:
+        kfree(buf);
+        return status;
+}
+static int docg4_block_markbad(struct mtd_info *mtd, loff_t ofs)
+{
+        /*
+         * Mark a block as bad.  Bad blocks are marked in the oob area of the
+         * first page of the block.  The default scan_bbt() in the nand
+         * infrastructure code works fine for building the memory-based bbt
+         * during initialization, as does the nand infrastructure function that
+         * checks if a block is bad by reading the bbt.  This function replaces
+         * the nand default because writes to oob-only are not supported.
+         */
+        int ret, i;
+        uint8_t *buf;
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        struct nand_bbt_descr *bbtd = nand->badblock_pattern;
+        int block = (int)(ofs >> nand->bbt_erase_shift);
+        int page = (int)(ofs >> nand->page_shift);
+        uint32_t g4_addr = mtd_to_docg4_address(page, 0);
+        dev_dbg(doc->dev, "%s: %08llx\n", __func__, ofs);
+        if (unlikely(ofs & (DOCG4_BLOCK_SIZE - 1)))
+                dev_warn(doc->dev, "%s: ofs %llx not start of block!\n",
+                         __func__, ofs);
+        /* allocate blank buffer for page data */
+        buf = kzalloc(DOCG4_PAGE_SIZE, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+        /* update bbt in memory */
+        nand->bbt[block / 4] |= 0x01 << ((block & 0x03) * 2);
+        /* write bit-wise negation of pattern to oob buffer */
+        memset(nand->oob_poi, 0xff, mtd->oobsize);
+        for (i = 0; i < bbtd->len; i++)
+                nand->oob_poi[bbtd->offs + i] = ~bbtd->pattern[i];
+        /* write first page of block */
+        write_page_prologue(mtd, g4_addr);
+        docg4_write_page(mtd, nand, buf);
+        ret = pageprog(mtd);
+        if (!ret)
+                mtd->ecc_stats.badblocks++;
+        kfree(buf);
+        return ret;
+}
+static int docg4_block_neverbad(struct mtd_info *mtd, loff_t ofs, int getchip)
+{
+        /* only called when module_param ignore_badblocks is set */
+        return 0;
+}
+static int docg4_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        /*
+         * Put the device into "deep power-down" mode.  Note that CE# must be
+         * deasserted for this to take effect.  The xscale, e.g., can be
+         * configured to float this signal when the processor enters power-down,
+         * and a suitable pull-up ensures its deassertion.
+         */
+        int i;
+        uint8_t pwr_down;
+        struct docg4_priv *doc = platform_get_drvdata(pdev);
+        void __iomem *docptr = doc->virtadr;
+        dev_dbg(doc->dev, "%s...\n", __func__);
+        /* poll the register that tells us we're ready to go to sleep */
+        for (i = 0; i < 10; i++) {
+                pwr_down = readb(docptr + DOC_POWERMODE);
+                if (pwr_down & DOC_POWERDOWN_READY)
+                        break;
+                usleep_range(1000, 4000);
+        }
+        if (pwr_down & DOC_POWERDOWN_READY) {
+                dev_err(doc->dev, "suspend failed; "
+                        "timeout polling DOC_POWERDOWN_READY\n");
+                return -EIO;
+        }
+        writew(DOC_ASICMODE_POWERDOWN | DOC_ASICMODE_MDWREN,
+               docptr + DOC_ASICMODE);
+        writew(~(DOC_ASICMODE_POWERDOWN | DOC_ASICMODE_MDWREN),
+               docptr + DOC_ASICMODECONFIRM);
+        write_nop(docptr);
+        return 0;
+}
+static int docg4_resume(struct platform_device *pdev)
+{
+        /*
+         * Exit power-down.  Twelve consecutive reads of the address below
+         * accomplishes this, assuming CE# has been asserted.
+         */
+        struct docg4_priv *doc = platform_get_drvdata(pdev);
+        void __iomem *docptr = doc->virtadr;
+        int i;
+        dev_dbg(doc->dev, "%s...\n", __func__);
+        for (i = 0; i < 12; i++)
+                readb(docptr + 0x1fff);
+        return 0;
+}
+static void __init init_mtd_structs(struct mtd_info *mtd)
+{
+        /* initialize mtd and nand data structures */
+        /*
+         * Note that some of the following initializations are not usually
+         * required within a nand driver because they are performed by the nand
+         * infrastructure code as part of nand_scan().  In this case they need
+         * to be initialized here because we skip call to nand_scan_ident() (the
+         * first half of nand_scan()).  The call to nand_scan_ident() is skipped
+         * because for this device the chip id is not read in the manner of a
+         * standard nand device.  Unfortunately, nand_scan_ident() does other
+         * things as well, such as call nand_set_defaults().
+         */
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        mtd->size = DOCG4_CHIP_SIZE;
+        mtd->name = "Msys_Diskonchip_G4";
+        mtd->writesize = DOCG4_PAGE_SIZE;
+        mtd->erasesize = DOCG4_BLOCK_SIZE;
+        mtd->oobsize = DOCG4_OOB_SIZE;
+        nand->chipsize = DOCG4_CHIP_SIZE;
+        nand->chip_shift = DOCG4_CHIP_SHIFT;
+        nand->bbt_erase_shift = nand->phys_erase_shift = DOCG4_ERASE_SHIFT;
+        nand->chip_delay = 20;
+        nand->page_shift = DOCG4_PAGE_SHIFT;
+        nand->pagemask = 0x3ffff;
+        nand->badblockpos = NAND_LARGE_BADBLOCK_POS;
+        nand->badblockbits = 8;
+        nand->ecc.layout = &docg4_oobinfo;
+        nand->ecc.mode = NAND_ECC_HW_SYNDROME;
+        nand->ecc.size = DOCG4_PAGE_SIZE;
+        nand->ecc.prepad = 8;
+        nand->ecc.bytes = 8;
+        nand->ecc.strength = DOCG4_T;
+        nand->options =
+                NAND_BUSWIDTH_16 | NAND_NO_SUBPAGE_WRITE | NAND_NO_AUTOINCR;
+        nand->IO_ADDR_R = nand->IO_ADDR_W = doc->virtadr + DOC_IOSPACE_DATA;
+        nand->controller = &nand->hwcontrol;
+        spin_lock_init(&nand->controller->lock);
+        init_waitqueue_head(&nand->controller->wq);
+        /* methods */
+        nand->cmdfunc = docg4_command;
+        nand->waitfunc = docg4_wait;
+        nand->select_chip = docg4_select_chip;
+        nand->read_byte = docg4_read_byte;
+        nand->block_markbad = docg4_block_markbad;
+        nand->read_buf = docg4_read_buf;
+        nand->write_buf = docg4_write_buf16;
+        nand->scan_bbt = nand_default_bbt;
+        nand->erase_cmd = docg4_erase_block;
+        nand->ecc.read_page = docg4_read_page;
+        nand->ecc.write_page = docg4_write_page;
+        nand->ecc.read_page_raw = docg4_read_page_raw;
+        nand->ecc.write_page_raw = docg4_write_page_raw;
+        nand->ecc.read_oob = docg4_read_oob;
+        nand->ecc.write_oob = docg4_write_oob;
+        /*
+         * The way the nand infrastructure code is written, a memory-based bbt
+         * is not created if NAND_SKIP_BBTSCAN is set.  With no memory bbt,
+         * nand->block_bad() is used.  So when ignoring bad blocks, we skip the
+         * scan and define a dummy block_bad() which always returns 0.
+         */
+        if (ignore_badblocks) {
+                nand->options |= NAND_SKIP_BBTSCAN;
+                nand->block_bad = docg4_block_neverbad;
+        }
+}
+static int __init read_id_reg(struct mtd_info *mtd)
+{
+        struct nand_chip *nand = mtd->priv;
+        struct docg4_priv *doc = nand->priv;
+        void __iomem *docptr = doc->virtadr;
+        uint16_t id1, id2;
+        /* check for presence of g4 chip by reading id registers */
+        id1 = readw(docptr + DOC_CHIPID);
+        id1 = readw(docptr + DOCG4_MYSTERY_REG);
+        id2 = readw(docptr + DOC_CHIPID_INV);
+        id2 = readw(docptr + DOCG4_MYSTERY_REG);
+        if (id1 == DOCG4_IDREG1_VALUE && id2 == DOCG4_IDREG2_VALUE) {
+                dev_info(doc->dev,
+                         "NAND device: 128MiB Diskonchip G4 detected\n");
+                return 0;
+        }
+        return -ENODEV;
+}
+static char const *part_probes[] = { "cmdlinepart", "saftlpart", NULL };
+static int __init probe_docg4(struct platform_device *pdev)
+{
+        struct mtd_info *mtd;
+        struct nand_chip *nand;
+        void __iomem *virtadr;
+        struct docg4_priv *doc;
+        int len, retval;
+        struct resource *r;
+        struct device *dev = &pdev->dev;
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (r == NULL) {
+                dev_err(dev, "no io memory resource defined!\n");
+                return -ENODEV;
+        }
+        virtadr = ioremap(r->start, resource_size(r));
+        if (!virtadr) {
+                dev_err(dev, "Diskonchip ioremap failed: %pR\n", r);
+                return -EIO;
+        }
+        len = sizeof(struct mtd_info) + sizeof(struct nand_chip) +
+                sizeof(struct docg4_priv);
+        mtd = kzalloc(len, GFP_KERNEL);
+        if (mtd == NULL) {
+                retval = -ENOMEM;
+                goto fail;
+        }
+        nand = (struct nand_chip *) (mtd + 1);
+        doc = (struct docg4_priv *) (nand + 1);
+        mtd->priv = nand;
+        nand->priv = doc;
+        mtd->owner = THIS_MODULE;
+        doc->virtadr = virtadr;
+        doc->dev = dev;
+        init_mtd_structs(mtd);
+        /* initialize kernel bch algorithm */
+        doc->bch = init_bch(DOCG4_M, DOCG4_T, DOCG4_PRIMITIVE_POLY);
+        if (doc->bch == NULL) {
+                retval = -EINVAL;
+                goto fail;
+        }
+        platform_set_drvdata(pdev, doc);
+        reset(mtd);
+        retval = read_id_reg(mtd);
+        if (retval == -ENODEV) {
+                dev_warn(dev, "No diskonchip G4 device found.\n");
+                goto fail;
+        }
+        retval = nand_scan_tail(mtd);
+        if (retval)
+                goto fail;
+        retval = read_factory_bbt(mtd);
+        if (retval)
+                goto fail;
+        retval = mtd_device_parse_register(mtd, part_probes, NULL, NULL, 0);
+        if (retval)
+                goto fail;
+        doc->mtd = mtd;
+        return 0;
+ fail:
+        iounmap(virtadr);
+        if (mtd) {
+                /* re-declarations avoid compiler warning */
+                struct nand_chip *nand = mtd->priv;
+                struct docg4_priv *doc = nand->priv;
+                nand_release(mtd); /* deletes partitions and mtd devices */
+                platform_set_drvdata(pdev, NULL);
+                free_bch(doc->bch);
+                kfree(mtd);
+        }
+        return retval;
+}
+static int __exit cleanup_docg4(struct platform_device *pdev)
+{
+        struct docg4_priv *doc = platform_get_drvdata(pdev);
+        nand_release(doc->mtd);
+        platform_set_drvdata(pdev, NULL);
+        free_bch(doc->bch);
+        kfree(doc->mtd);
+        iounmap(doc->virtadr);
+        return 0;
+}
+static struct platform_driver docg4_driver = {
+        .driver         = {
+                .name   = "docg4",
+                .owner  = THIS_MODULE,
+        },
+        .suspend        = docg4_suspend,
+        .resume         = docg4_resume,
+        .remove         = __exit_p(cleanup_docg4),
+};
+static int __init docg4_init(void)
+{
+        return platform_driver_probe(&docg4_driver, probe_docg4);
+}
+static void __exit docg4_exit(void)
+{
+        platform_driver_unregister(&docg4_driver);
+}
+module_init(docg4_init);
+module_exit(docg4_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Mike Dunn");
+MODULE_DESCRIPTION("M-Systems DiskOnChip G4 device driver");
diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
index 7195ee6efe12..80b5264f0a32 100644
--- a/drivers/mtd/nand/fsl_elbc_nand.c
+++ b/drivers/mtd/nand/fsl_elbc_nand.c
@@ -813,6 +813,12 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv)
                                &fsl_elbc_oob_sp_eccm1 : &fsl_elbc_oob_sp_eccm0;
                chip->ecc.size = 512;
                chip->ecc.bytes = 3;
+                chip->ecc.strength = 1;
+                /*
+                 * FIXME: can hardware ecc correct 4 bitflips if page size is
+                 * 2k?  Then does hardware report number of corrections for this
+                 * case?  If so, ecc_stats reporting needs to be fixed as well.
+                 */
        } else {
                /* otherwise fall back to default software ECC */
                chip->ecc.mode = NAND_ECC_SOFT;
diff --git a/drivers/mtd/nand/fsmc_nand.c b/drivers/mtd/nand/fsmc_nand.c
index e53b76064133..1b8330e1155a 100644
--- a/drivers/mtd/nand/fsmc_nand.c
+++ b/drivers/mtd/nand/fsmc_nand.c
@@ -17,6 +17,10 @@
 */
 #include <linux/clk.h>
+#include <linux/completion.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-direction.h>
+#include <linux/dma-mapping.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -27,6 +31,7 @@
 #include <linux/mtd/nand.h>
 #include <linux/mtd/nand_ecc.h>
 #include <linux/platform_device.h>
+#include <linux/of.h>
 #include <linux/mtd/partitions.h>
 #include <linux/io.h>
 #include <linux/slab.h>
@@ -34,7 +39,7 @@
 #include <linux/amba/bus.h>
 #include <mtd/mtd-abi.h>
-static struct nand_ecclayout fsmc_ecc1_layout = {
+static struct nand_ecclayout fsmc_ecc1_128_layout = {
        .eccbytes = 24,
        .eccpos = {2, 3, 4, 18, 19, 20, 34, 35, 36, 50, 51, 52,
                66, 67, 68, 82, 83, 84, 98, 99, 100, 114, 115, 116},
@@ -50,7 +55,127 @@ static struct nand_ecclayout fsmc_ecc1_layout = {
        }
 };
-static struct nand_ecclayout fsmc_ecc4_lp_layout = {
+static struct nand_ecclayout fsmc_ecc1_64_layout = {
+        .eccbytes = 12,
+        .eccpos = {2, 3, 4, 18, 19, 20, 34, 35, 36, 50, 51, 52},
+        .oobfree = {
+                {.offset = 8, .length = 8},
+                {.offset = 24, .length = 8},
+                {.offset = 40, .length = 8},
+                {.offset = 56, .length = 8},
+        }
+};
+static struct nand_ecclayout fsmc_ecc1_16_layout = {
+        .eccbytes = 3,
+        .eccpos = {2, 3, 4},
+        .oobfree = {
+                {.offset = 8, .length = 8},
+        }
+};
+/*
+ * ECC4 layout for NAND of pagesize 8192 bytes & OOBsize 256 bytes. 13*16 bytes
+ * of OB size is reserved for ECC, Byte no. 0 & 1 reserved for bad block and 46
+ * bytes are free for use.
+ */
+static struct nand_ecclayout fsmc_ecc4_256_layout = {
+        .eccbytes = 208,
+        .eccpos = {  2,   3,   4,   5,   6,   7,   8,
+                9,  10,  11,  12,  13,  14,
+                18,  19,  20,  21,  22,  23,  24,
+                25,  26,  27,  28,  29,  30,
+                34,  35,  36,  37,  38,  39,  40,
+                41,  42,  43,  44,  45,  46,
+                50,  51,  52,  53,  54,  55,  56,
+                57,  58,  59,  60,  61,  62,
+                66,  67,  68,  69,  70,  71,  72,
+                73,  74,  75,  76,  77,  78,
+                82,  83,  84,  85,  86,  87,  88,
+                89,  90,  91,  92,  93,  94,
+                98,  99, 100, 101, 102, 103, 104,
+                105, 106, 107, 108, 109, 110,
+                114, 115, 116, 117, 118, 119, 120,
+                121, 122, 123, 124, 125, 126,
+                130, 131, 132, 133, 134, 135, 136,
+                137, 138, 139, 140, 141, 142,
+                146, 147, 148, 149, 150, 151, 152,
+                153, 154, 155, 156, 157, 158,
+                162, 163, 164, 165, 166, 167, 168,
+                169, 170, 171, 172, 173, 174,
+                178, 179, 180, 181, 182, 183, 184,
+                185, 186, 187, 188, 189, 190,
+                194, 195, 196, 197, 198, 199, 200,
+                201, 202, 203, 204, 205, 206,
+                210, 211, 212, 213, 214, 215, 216,
+                217, 218, 219, 220, 221, 222,
+                226, 227, 228, 229, 230, 231, 232,
+                233, 234, 235, 236, 237, 238,
+                242, 243, 244, 245, 246, 247, 248,
+                249, 250, 251, 252, 253, 254
+        },
+        .oobfree = {
+                {.offset = 15, .length = 3},
+                {.offset = 31, .length = 3},
+                {.offset = 47, .length = 3},
+                {.offset = 63, .length = 3},
+                {.offset = 79, .length = 3},
+                {.offset = 95, .length = 3},
+                {.offset = 111, .length = 3},
+                {.offset = 127, .length = 3},
+                {.offset = 143, .length = 3},
+                {.offset = 159, .length = 3},
+                {.offset = 175, .length = 3},
+                {.offset = 191, .length = 3},
+                {.offset = 207, .length = 3},
+                {.offset = 223, .length = 3},
+                {.offset = 239, .length = 3},
+                {.offset = 255, .length = 1}
+        }
+};
+/*
+ * ECC4 layout for NAND of pagesize 4096 bytes & OOBsize 224 bytes. 13*8 bytes
+ * of OOB size is reserved for ECC, Byte no. 0 & 1 reserved for bad block & 118
+ * bytes are free for use.
+ */
+static struct nand_ecclayout fsmc_ecc4_224_layout = {
+        .eccbytes = 104,
+        .eccpos = {  2,   3,   4,   5,   6,   7,   8,
+                9,  10,  11,  12,  13,  14,
+                18,  19,  20,  21,  22,  23,  24,
+                25,  26,  27,  28,  29,  30,
+                34,  35,  36,  37,  38,  39,  40,
+                41,  42,  43,  44,  45,  46,
+                50,  51,  52,  53,  54,  55,  56,
+                57,  58,  59,  60,  61,  62,
+                66,  67,  68,  69,  70,  71,  72,
+                73,  74,  75,  76,  77,  78,
+                82,  83,  84,  85,  86,  87,  88,
+                89,  90,  91,  92,  93,  94,
+                98,  99, 100, 101, 102, 103, 104,
+                105, 106, 107, 108, 109, 110,
+                114, 115, 116, 117, 118, 119, 120,
+                121, 122, 123, 124, 125, 126
+        },
+        .oobfree = {
+                {.offset = 15, .length = 3},
+                {.offset = 31, .length = 3},
+                {.offset = 47, .length = 3},
+                {.offset = 63, .length = 3},
+                {.offset = 79, .length = 3},
+                {.offset = 95, .length = 3},
+                {.offset = 111, .length = 3},
+                {.offset = 127, .length = 97}
+        }
+};
+/*
+ * ECC4 layout for NAND of pagesize 4096 bytes & OOBsize 128 bytes. 13*8 bytes
+ * of OOB size is reserved for ECC, Byte no. 0 & 1 reserved for bad block & 22
+ * bytes are free for use.
+ */
+static struct nand_ecclayout fsmc_ecc4_128_layout = {
        .eccbytes = 104,
        .eccpos = {  2,   3,   4,   5,   6,   7,   8,
                9,  10,  11,  12,  13,  14,
@@ -82,6 +207,45 @@ static struct nand_ecclayout fsmc_ecc4_lp_layout = {
 };
 /*
+ * ECC4 layout for NAND of pagesize 2048 bytes & OOBsize 64 bytes. 13*4 bytes of
+ * OOB size is reserved for ECC, Byte no. 0 & 1 reserved for bad block and 10
+ * bytes are free for use.
+ */
+static struct nand_ecclayout fsmc_ecc4_64_layout = {
+        .eccbytes = 52,
+        .eccpos = {  2,   3,   4,   5,   6,   7,   8,
+                9,  10,  11,  12,  13,  14,
+                18,  19,  20,  21,  22,  23,  24,
+                25,  26,  27,  28,  29,  30,
+                34,  35,  36,  37,  38,  39,  40,
+                41,  42,  43,  44,  45,  46,
+                50,  51,  52,  53,  54,  55,  56,
+                57,  58,  59,  60,  61,  62,
+        },
+        .oobfree = {
+                {.offset = 15, .length = 3},
+                {.offset = 31, .length = 3},
+                {.offset = 47, .length = 3},
+                {.offset = 63, .length = 1},
+        }
+};
+/*
+ * ECC4 layout for NAND of pagesize 512 bytes & OOBsize 16 bytes. 13 bytes of
+ * OOB size is reserved for ECC, Byte no. 4 & 5 reserved for bad block and One
+ * byte is free for use.
+ */
+static struct nand_ecclayout fsmc_ecc4_16_layout = {
+        .eccbytes = 13,
+        .eccpos = { 0,  1,  2,  3,  6,  7, 8,
+                9, 10, 11, 12, 13, 14
+        },
+        .oobfree = {
+                {.offset = 15, .length = 1},
+        }
+};
+/*
 * ECC placement definitions in oobfree type format.
 * There are 13 bytes of ecc for every 512 byte block and it has to be read
 * consecutively and immediately after the 512 byte data block for hardware to
@@ -103,16 +267,6 @@ static struct fsmc_eccplace fsmc_ecc4_lp_place = {
        }
 };
-static struct nand_ecclayout fsmc_ecc4_sp_layout = {
-        .eccbytes = 13,
-        .eccpos = { 0,  1,  2,  3,  6,  7, 8,
-                9, 10, 11, 12, 13, 14
-        },
-        .oobfree = {
-                {.offset = 15, .length = 1},
-        }
-};
 static struct fsmc_eccplace fsmc_ecc4_sp_place = {
        .eccplace = {
                {.offset = 0, .length = 4},
@@ -120,75 +274,24 @@ static struct fsmc_eccplace fsmc_ecc4_sp_place = {
        }
 };
-/*
- * Default partition tables to be used if the partition information not
- * provided through platform data.
- *
- * Default partition layout for small page(= 512 bytes) devices
- * Size for "Root file system" is updated in driver based on actual device size
- */
-static struct mtd_partition partition_info_16KB_blk[] = {
-        {
-                .name = "X-loader",
-                .offset = 0,
-                .size = 4*0x4000,
-        },
-        {
-                .name = "U-Boot",
-                .offset = 0x10000,
-                .size = 20*0x4000,
-        },
-        {
-                .name = "Kernel",
-                .offset = 0x60000,
-                .size = 256*0x4000,
-        },
-        {
-                .name = "Root File System",
-                .offset = 0x460000,
-                .size = MTDPART_SIZ_FULL,
-        },
-};
-/*
- * Default partition layout for large page(> 512 bytes) devices
- * Size for "Root file system" is updated in driver based on actual device size
- */
-static struct mtd_partition partition_info_128KB_blk[] = {
-        {
-                .name = "X-loader",
-                .offset = 0,
-                .size = 4*0x20000,
-        },
-        {
-                .name = "U-Boot",
-                .offset = 0x80000,
-                .size = 12*0x20000,
-        },
-        {
-                .name = "Kernel",
-                .offset = 0x200000,
-                .size = 48*0x20000,
-        },
-        {
-                .name = "Root File System",
-                .offset = 0x800000,
-                .size = MTDPART_SIZ_FULL,
-        },
-};
 /**
 * struct fsmc_nand_data - structure for FSMC NAND device state
 *
 * @pid:                Part ID on the AMBA PrimeCell format
 * @mtd:                MTD info for a NAND flash.
 * @nand:               Chip related info for a NAND flash.
+ * @partitions:         Partition info for a NAND Flash.
+ * @nr_partitions:      Total number of partition of a NAND flash.
 *
 * @ecc_place:          ECC placing locations in oobfree type format.
 * @bank:               Bank number for probed device.
 * @clk:                Clock structure for FSMC.
 *
+ * @read_dma_chan:      DMA channel for read access
+ * @write_dma_chan:     DMA channel for write access to NAND
+ * @dma_access_complete: Completion structure
+ *
+ * @data_pa:            NAND Physical port for Data.
 * @data_va:            NAND port for Data.
 * @cmd_va:             NAND port for Command.
 * @addr_va:            NAND port for Address.
@@ -198,16 +301,23 @@ struct fsmc_nand_data {
        u32                     pid;
        struct mtd_info         mtd;
        struct nand_chip        nand;
+        struct mtd_partition    *partitions;
+        unsigned int            nr_partitions;
        struct fsmc_eccplace    *ecc_place;
        unsigned int            bank;
+        struct device           *dev;
+        enum access_mode        mode;
        struct clk              *clk;
-        struct resource         *resregs;
+        /* DMA related objects */
-        struct resource         *rescmd;
+        struct dma_chan         *read_dma_chan;
-        struct resource         *resaddr;
+        struct dma_chan         *write_dma_chan;
-        struct resource         *resdata;
+        struct completion       dma_access_complete;
+        struct fsmc_nand_timings *dev_timings;
+        dma_addr_t              data_pa;
        void __iomem            *data_va;
        void __iomem            *cmd_va;
        void __iomem            *addr_va;
@@ -251,28 +361,29 @@ static void fsmc_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
        struct nand_chip *this = mtd->priv;
        struct fsmc_nand_data *host = container_of(mtd,
                                        struct fsmc_nand_data, mtd);
-        struct fsmc_regs *regs = host->regs_va;
+        void *__iomem *regs = host->regs_va;
        unsigned int bank = host->bank;
        if (ctrl & NAND_CTRL_CHANGE) {
+                u32 pc;
                if (ctrl & NAND_CLE) {
-                        this->IO_ADDR_R = (void __iomem *)host->cmd_va;
+                        this->IO_ADDR_R = host->cmd_va;
-                        this->IO_ADDR_W = (void __iomem *)host->cmd_va;
+                        this->IO_ADDR_W = host->cmd_va;
                } else if (ctrl & NAND_ALE) {
-                        this->IO_ADDR_R = (void __iomem *)host->addr_va;
+                        this->IO_ADDR_R = host->addr_va;
-                        this->IO_ADDR_W = (void __iomem *)host->addr_va;
+                        this->IO_ADDR_W = host->addr_va;
                } else {
-                        this->IO_ADDR_R = (void __iomem *)host->data_va;
+                        this->IO_ADDR_R = host->data_va;
-                        this->IO_ADDR_W = (void __iomem *)host->data_va;
+                        this->IO_ADDR_W = host->data_va;
                }
-                if (ctrl & NAND_NCE) {
+                pc = readl(FSMC_NAND_REG(regs, bank, PC));
-                        writel(readl(&regs->bank_regs[bank].pc) | FSMC_ENABLE,
+                if (ctrl & NAND_NCE)
-                                        &regs->bank_regs[bank].pc);
+                        pc |= FSMC_ENABLE;
-                } else {
+                else
-                        writel(readl(&regs->bank_regs[bank].pc) & ~FSMC_ENABLE,
+                        pc &= ~FSMC_ENABLE;
-                                       &regs->bank_regs[bank].pc);
+                writel(pc, FSMC_NAND_REG(regs, bank, PC));
-                }
        }
        mb();
@@ -287,22 +398,42 @@ static void fsmc_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
 * This routine initializes timing parameters related to NAND memory access in
 * FSMC registers
 */
-static void __init fsmc_nand_setup(struct fsmc_regs *regs, uint32_t bank,
+static void fsmc_nand_setup(void __iomem *regs, uint32_t bank,
-                                   uint32_t busw)
+                           uint32_t busw, struct fsmc_nand_timings *timings)
 {
        uint32_t value = FSMC_DEVTYPE_NAND | FSMC_ENABLE | FSMC_WAITON;
+        uint32_t tclr, tar, thiz, thold, twait, tset;
+        struct fsmc_nand_timings *tims;
+        struct fsmc_nand_timings default_timings = {
+                .tclr   = FSMC_TCLR_1,
+                .tar    = FSMC_TAR_1,
+                .thiz   = FSMC_THIZ_1,
+                .thold  = FSMC_THOLD_4,
+                .twait  = FSMC_TWAIT_6,
+                .tset   = FSMC_TSET_0,
+        };
+        if (timings)
+                tims = timings;
+        else
+                tims = &default_timings;
+        tclr = (tims->tclr & FSMC_TCLR_MASK) << FSMC_TCLR_SHIFT;
+        tar = (tims->tar & FSMC_TAR_MASK) << FSMC_TAR_SHIFT;
+        thiz = (tims->thiz & FSMC_THIZ_MASK) << FSMC_THIZ_SHIFT;
+        thold = (tims->thold & FSMC_THOLD_MASK) << FSMC_THOLD_SHIFT;
+        twait = (tims->twait & FSMC_TWAIT_MASK) << FSMC_TWAIT_SHIFT;
+        tset = (tims->tset & FSMC_TSET_MASK) << FSMC_TSET_SHIFT;
        if (busw)
-                writel(value | FSMC_DEVWID_16, &regs->bank_regs[bank].pc);
+                writel(value | FSMC_DEVWID_16, FSMC_NAND_REG(regs, bank, PC));
        else
-                writel(value | FSMC_DEVWID_8, &regs->bank_regs[bank].pc);
+                writel(value | FSMC_DEVWID_8, FSMC_NAND_REG(regs, bank, PC));
-        writel(readl(&regs->bank_regs[bank].pc) | FSMC_TCLR_1 | FSMC_TAR_1,
+        writel(readl(FSMC_NAND_REG(regs, bank, PC)) | tclr | tar,
-               &regs->bank_regs[bank].pc);
+                        FSMC_NAND_REG(regs, bank, PC));
-        writel(FSMC_THIZ_1 | FSMC_THOLD_4 | FSMC_TWAIT_6 | FSMC_TSET_0,
+        writel(thiz | thold | twait | tset, FSMC_NAND_REG(regs, bank, COMM));
-               &regs->bank_regs[bank].comm);
+        writel(thiz | thold | twait | tset, FSMC_NAND_REG(regs, bank, ATTRIB));
-        writel(FSMC_THIZ_1 | FSMC_THOLD_4 | FSMC_TWAIT_6 | FSMC_TSET_0,
-               &regs->bank_regs[bank].attrib);
 }
 /*
@@ -312,15 +443,15 @@ static void fsmc_enable_hwecc(struct mtd_info *mtd, int mode)
 {
        struct fsmc_nand_data *host = container_of(mtd,
                                        struct fsmc_nand_data, mtd);
-        struct fsmc_regs *regs = host->regs_va;
+        void __iomem *regs = host->regs_va;
        uint32_t bank = host->bank;
-        writel(readl(&regs->bank_regs[bank].pc) & ~FSMC_ECCPLEN_256,
+        writel(readl(FSMC_NAND_REG(regs, bank, PC)) & ~FSMC_ECCPLEN_256,
-                       &regs->bank_regs[bank].pc);
+                        FSMC_NAND_REG(regs, bank, PC));
-        writel(readl(&regs->bank_regs[bank].pc) & ~FSMC_ECCEN,
+        writel(readl(FSMC_NAND_REG(regs, bank, PC)) & ~FSMC_ECCEN,
-                        &regs->bank_regs[bank].pc);
+                        FSMC_NAND_REG(regs, bank, PC));
-        writel(readl(&regs->bank_regs[bank].pc) | FSMC_ECCEN,
+        writel(readl(FSMC_NAND_REG(regs, bank, PC)) | FSMC_ECCEN,
-                        &regs->bank_regs[bank].pc);
+                        FSMC_NAND_REG(regs, bank, PC));
 }
 /*
@@ -333,37 +464,42 @@ static int fsmc_read_hwecc_ecc4(struct mtd_info *mtd, const uint8_t *data,
 {
        struct fsmc_nand_data *host = container_of(mtd,
                                        struct fsmc_nand_data, mtd);
-        struct fsmc_regs *regs = host->regs_va;
+        void __iomem *regs = host->regs_va;
        uint32_t bank = host->bank;
        uint32_t ecc_tmp;
        unsigned long deadline = jiffies + FSMC_BUSY_WAIT_TIMEOUT;
        do {
-                if (readl(&regs->bank_regs[bank].sts) & FSMC_CODE_RDY)
+                if (readl(FSMC_NAND_REG(regs, bank, STS)) & FSMC_CODE_RDY)
                        break;
                else
                        cond_resched();
        } while (!time_after_eq(jiffies, deadline));
-        ecc_tmp = readl(&regs->bank_regs[bank].ecc1);
+        if (time_after_eq(jiffies, deadline)) {
+                dev_err(host->dev, "calculate ecc timed out\n");
+                return -ETIMEDOUT;
+        }
+        ecc_tmp = readl(FSMC_NAND_REG(regs, bank, ECC1));
        ecc[0] = (uint8_t) (ecc_tmp >> 0);
        ecc[1] = (uint8_t) (ecc_tmp >> 8);
        ecc[2] = (uint8_t) (ecc_tmp >> 16);
        ecc[3] = (uint8_t) (ecc_tmp >> 24);
-        ecc_tmp = readl(&regs->bank_regs[bank].ecc2);
+        ecc_tmp = readl(FSMC_NAND_REG(regs, bank, ECC2));
        ecc[4] = (uint8_t) (ecc_tmp >> 0);
        ecc[5] = (uint8_t) (ecc_tmp >> 8);
        ecc[6] = (uint8_t) (ecc_tmp >> 16);
        ecc[7] = (uint8_t) (ecc_tmp >> 24);
-        ecc_tmp = readl(&regs->bank_regs[bank].ecc3);
+        ecc_tmp = readl(FSMC_NAND_REG(regs, bank, ECC3));
        ecc[8] = (uint8_t) (ecc_tmp >> 0);
        ecc[9] = (uint8_t) (ecc_tmp >> 8);
        ecc[10] = (uint8_t) (ecc_tmp >> 16);
        ecc[11] = (uint8_t) (ecc_tmp >> 24);
-        ecc_tmp = readl(&regs->bank_regs[bank].sts);
+        ecc_tmp = readl(FSMC_NAND_REG(regs, bank, STS));
        ecc[12] = (uint8_t) (ecc_tmp >> 16);
        return 0;
@@ -379,11 +515,11 @@ static int fsmc_read_hwecc_ecc1(struct mtd_info *mtd, const uint8_t *data,
 {
        struct fsmc_nand_data *host = container_of(mtd,
                                        struct fsmc_nand_data, mtd);
-        struct fsmc_regs *regs = host->regs_va;
+        void __iomem *regs = host->regs_va;
        uint32_t bank = host->bank;
        uint32_t ecc_tmp;
-        ecc_tmp = readl(&regs->bank_regs[bank].ecc1);
+        ecc_tmp = readl(FSMC_NAND_REG(regs, bank, ECC1));
        ecc[0] = (uint8_t) (ecc_tmp >> 0);
        ecc[1] = (uint8_t) (ecc_tmp >> 8);
        ecc[2] = (uint8_t) (ecc_tmp >> 16);
@@ -391,6 +527,166 @@ static int fsmc_read_hwecc_ecc1(struct mtd_info *mtd, const uint8_t *data,
        return 0;
 }
+/* Count the number of 0's in buff upto a max of max_bits */
+static int count_written_bits(uint8_t *buff, int size, int max_bits)
+{
+        int k, written_bits = 0;
+        for (k = 0; k < size; k++) {
+                written_bits += hweight8(~buff[k]);
+                if (written_bits > max_bits)
+                        break;
+        }
+        return written_bits;
+}
+static void dma_complete(void *param)
+{
+        struct fsmc_nand_data *host = param;
+        complete(&host->dma_access_complete);
+}
+static int dma_xfer(struct fsmc_nand_data *host, void *buffer, int len,
+                enum dma_data_direction direction)
+{
+        struct dma_chan *chan;
+        struct dma_device *dma_dev;
+        struct dma_async_tx_descriptor *tx;
+        dma_addr_t dma_dst, dma_src, dma_addr;
+        dma_cookie_t cookie;
+        unsigned long flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
+        int ret;
+        if (direction == DMA_TO_DEVICE)
+                chan = host->write_dma_chan;
+        else if (direction == DMA_FROM_DEVICE)
+                chan = host->read_dma_chan;
+        else
+                return -EINVAL;
+        dma_dev = chan->device;
+        dma_addr = dma_map_single(dma_dev->dev, buffer, len, direction);
+        if (direction == DMA_TO_DEVICE) {
+                dma_src = dma_addr;
+                dma_dst = host->data_pa;
+                flags |= DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_SKIP_DEST_UNMAP;
+        } else {
+                dma_src = host->data_pa;
+                dma_dst = dma_addr;
+                flags |= DMA_COMPL_DEST_UNMAP_SINGLE | DMA_COMPL_SKIP_SRC_UNMAP;
+        }
+        tx = dma_dev->device_prep_dma_memcpy(chan, dma_dst, dma_src,
+                        len, flags);
+        if (!tx) {
+                dev_err(host->dev, "device_prep_dma_memcpy error\n");
+                dma_unmap_single(dma_dev->dev, dma_addr, len, direction);
+                return -EIO;
+        }
+        tx->callback = dma_complete;
+        tx->callback_param = host;
+        cookie = tx->tx_submit(tx);
+        ret = dma_submit_error(cookie);
+        if (ret) {
+                dev_err(host->dev, "dma_submit_error %d\n", cookie);
+                return ret;
+        }
+        dma_async_issue_pending(chan);
+        ret =
+        wait_for_completion_interruptible_timeout(&host->dma_access_complete,
+                                msecs_to_jiffies(3000));
+        if (ret <= 0) {
+                chan->device->device_control(chan, DMA_TERMINATE_ALL, 0);
+                dev_err(host->dev, "wait_for_completion_timeout\n");
+                return ret ? ret : -ETIMEDOUT;
+        }
+        return 0;
+}
+/*
+ * fsmc_write_buf - write buffer to chip
+ * @mtd:        MTD device structure
+ * @buf:        data buffer
+ * @len:        number of bytes to write
+ */
+static void fsmc_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
+{
+        int i;
+        struct nand_chip *chip = mtd->priv;
+        if (IS_ALIGNED((uint32_t)buf, sizeof(uint32_t)) &&
+                        IS_ALIGNED(len, sizeof(uint32_t))) {
+                uint32_t *p = (uint32_t *)buf;
+                len = len >> 2;
+                for (i = 0; i < len; i++)
+                        writel(p[i], chip->IO_ADDR_W);
+        } else {
+                for (i = 0; i < len; i++)
+                        writeb(buf[i], chip->IO_ADDR_W);
+        }
+}
+/*
+ * fsmc_read_buf - read chip data into buffer
+ * @mtd:        MTD device structure
+ * @buf:        buffer to store date
+ * @len:        number of bytes to read
+ */
+static void fsmc_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        int i;
+        struct nand_chip *chip = mtd->priv;
+        if (IS_ALIGNED((uint32_t)buf, sizeof(uint32_t)) &&
+                        IS_ALIGNED(len, sizeof(uint32_t))) {
+                uint32_t *p = (uint32_t *)buf;
+                len = len >> 2;
+                for (i = 0; i < len; i++)
+                        p[i] = readl(chip->IO_ADDR_R);
+        } else {
+                for (i = 0; i < len; i++)
+                        buf[i] = readb(chip->IO_ADDR_R);
+        }
+}
+/*
+ * fsmc_read_buf_dma - read chip data into buffer
+ * @mtd:        MTD device structure
+ * @buf:        buffer to store date
+ * @len:        number of bytes to read
+ */
+static void fsmc_read_buf_dma(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        struct fsmc_nand_data *host;
+        host = container_of(mtd, struct fsmc_nand_data, mtd);
+        dma_xfer(host, buf, len, DMA_FROM_DEVICE);
+}
+/*
+ * fsmc_write_buf_dma - write buffer to chip
+ * @mtd:        MTD device structure
+ * @buf:        data buffer
+ * @len:        number of bytes to write
+ */
+static void fsmc_write_buf_dma(struct mtd_info *mtd, const uint8_t *buf,
+                int len)
+{
+        struct fsmc_nand_data *host;
+        host = container_of(mtd, struct fsmc_nand_data, mtd);
+        dma_xfer(host, (void *)buf, len, DMA_TO_DEVICE);
+}
 /*
 * fsmc_read_page_hwecc
 * @mtd:        mtd info structure
@@ -426,7 +722,6 @@ static int fsmc_read_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip,
        uint8_t *oob = (uint8_t *)&ecc_oob[0];
        for (i = 0, s = 0; s < eccsteps; s++, i += eccbytes, p += eccsize) {
                chip->cmdfunc(mtd, NAND_CMD_READ0, s * eccsize, page);
                chip->ecc.hwctl(mtd, NAND_ECC_READ);
                chip->read_buf(mtd, p, eccsize);
@@ -437,17 +732,19 @@ static int fsmc_read_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip,
                        group++;
                        /*
-                        * length is intentionally kept a higher multiple of 2
+                         * length is intentionally kept a higher multiple of 2
-                        * to read at least 13 bytes even in case of 16 bit NAND
+                         * to read at least 13 bytes even in case of 16 bit NAND
-                        * devices
+                         * devices
-                        */
+                         */
-                        len = roundup(len, 2);
+                        if (chip->options & NAND_BUSWIDTH_16)
+                                len = roundup(len, 2);
                        chip->cmdfunc(mtd, NAND_CMD_READOOB, off, page);
                        chip->read_buf(mtd, oob + j, len);
                        j += len;
                }
-                memcpy(&ecc_code[i], oob, 13);
+                memcpy(&ecc_code[i], oob, chip->ecc.bytes);
                chip->ecc.calculate(mtd, p, &ecc_calc[i]);
                stat = chip->ecc.correct(mtd, p, &ecc_code[i], &ecc_calc[i]);
@@ -461,7 +758,7 @@ static int fsmc_read_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip,
 }
 /*
- * fsmc_correct_data
+ * fsmc_bch8_correct_data
 * @mtd:        mtd info structure
 * @dat:        buffer of read data
 * @read_ecc:   ecc read from device spare area
@@ -470,19 +767,51 @@ static int fsmc_read_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip,
 * calc_ecc is a 104 bit information containing maximum of 8 error
 * offset informations of 13 bits each in 512 bytes of read data.
 */
-static int fsmc_correct_data(struct mtd_info *mtd, uint8_t *dat,
+static int fsmc_bch8_correct_data(struct mtd_info *mtd, uint8_t *dat,
                             uint8_t *read_ecc, uint8_t *calc_ecc)
 {
        struct fsmc_nand_data *host = container_of(mtd,
                                        struct fsmc_nand_data, mtd);
-        struct fsmc_regs *regs = host->regs_va;
+        struct nand_chip *chip = mtd->priv;
+        void __iomem *regs = host->regs_va;
        unsigned int bank = host->bank;
-        uint16_t err_idx[8];
+        uint32_t err_idx[8];
-        uint64_t ecc_data[2];
        uint32_t num_err, i;
+        uint32_t ecc1, ecc2, ecc3, ecc4;
+        num_err = (readl(FSMC_NAND_REG(regs, bank, STS)) >> 10) & 0xF;
+        /* no bit flipping */
+        if (likely(num_err == 0))
+                return 0;
+        /* too many errors */
+        if (unlikely(num_err > 8)) {
+                /*
+                 * This is a temporary erase check. A newly erased page read
+                 * would result in an ecc error because the oob data is also
+                 * erased to FF and the calculated ecc for an FF data is not
+                 * FF..FF.
+                 * This is a workaround to skip performing correction in case
+                 * data is FF..FF
+                 *
+                 * Logic:
+                 * For every page, each bit written as 0 is counted until these
+                 * number of bits are greater than 8 (the maximum correction
+                 * capability of FSMC for each 512 + 13 bytes)
+                 */
+                int bits_ecc = count_written_bits(read_ecc, chip->ecc.bytes, 8);
+                int bits_data = count_written_bits(dat, chip->ecc.size, 8);
+                if ((bits_ecc + bits_data) <= 8) {
+                        if (bits_data)
+                                memset(dat, 0xff, chip->ecc.size);
+                        return bits_data;
+                }
-        /* The calculated ecc is actually the correction index in data */
+                return -EBADMSG;
-        memcpy(ecc_data, calc_ecc, 13);
+        }
        /*
         * ------------------- calc_ecc[] bit wise -----------|--13 bits--|
@@ -493,27 +822,26 @@ static int fsmc_correct_data(struct mtd_info *mtd, uint8_t *dat,
         * uint64_t array and error offset indexes are populated in err_idx
         * array
         */
-        for (i = 0; i < 8; i++) {
+        ecc1 = readl(FSMC_NAND_REG(regs, bank, ECC1));
-                if (i == 4) {
+        ecc2 = readl(FSMC_NAND_REG(regs, bank, ECC2));
-                        err_idx[4] = ((ecc_data[1] & 0x1) << 12) | ecc_data[0];
+        ecc3 = readl(FSMC_NAND_REG(regs, bank, ECC3));
-                        ecc_data[1] >>= 1;
+        ecc4 = readl(FSMC_NAND_REG(regs, bank, STS));
-                        continue;
-                }
+        err_idx[0] = (ecc1 >> 0) & 0x1FFF;
-                err_idx[i] = (ecc_data[i/4] & 0x1FFF);
+        err_idx[1] = (ecc1 >> 13) & 0x1FFF;
-                ecc_data[i/4] >>= 13;
+        err_idx[2] = (((ecc2 >> 0) & 0x7F) << 6) | ((ecc1 >> 26) & 0x3F);
-        }
+        err_idx[3] = (ecc2 >> 7) & 0x1FFF;
+        err_idx[4] = (((ecc3 >> 0) & 0x1) << 12) | ((ecc2 >> 20) & 0xFFF);
-        num_err = (readl(&regs->bank_regs[bank].sts) >> 10) & 0xF;
+        err_idx[5] = (ecc3 >> 1) & 0x1FFF;
+        err_idx[6] = (ecc3 >> 14) & 0x1FFF;
-        if (num_err == 0xF)
+        err_idx[7] = (((ecc4 >> 16) & 0xFF) << 5) | ((ecc3 >> 27) & 0x1F);
-                return -EBADMSG;
        i = 0;
        while (num_err--) {
                change_bit(0, (unsigned long *)&err_idx[i]);
                change_bit(1, (unsigned long *)&err_idx[i]);
-                if (err_idx[i] <= 512 * 8) {
+                if (err_idx[i] < chip->ecc.size * 8) {
                        change_bit(err_idx[i], (unsigned long *)dat);
                        i++;
                }
@@ -521,6 +849,44 @@ static int fsmc_correct_data(struct mtd_info *mtd, uint8_t *dat,
        return i;
 }
+static bool filter(struct dma_chan *chan, void *slave)
+{
+        chan->private = slave;
+        return true;
+}
+#ifdef CONFIG_OF
+static int __devinit fsmc_nand_probe_config_dt(struct platform_device *pdev,
+                                               struct device_node *np)
+{
+        struct fsmc_nand_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        u32 val;
+        /* Set default NAND width to 8 bits */
+        pdata->width = 8;
+        if (!of_property_read_u32(np, "bank-width", &val)) {
+                if (val == 2) {
+                        pdata->width = 16;
+                } else if (val != 1) {
+                        dev_err(&pdev->dev, "invalid bank-width %u\n", val);
+                        return -EINVAL;
+                }
+        }
+        of_property_read_u32(np, "st,ale-off", &pdata->ale_off);
+        of_property_read_u32(np, "st,cle-off", &pdata->cle_off);
+        if (of_get_property(np, "nand-skip-bbtscan", NULL))
+                pdata->options = NAND_SKIP_BBTSCAN;
+        return 0;
+}
+#else
+static int __devinit fsmc_nand_probe_config_dt(struct platform_device *pdev,
+                                               struct device_node *np)
+{
+        return -ENOSYS;
+}
+#endif
 /*
 * fsmc_nand_probe - Probe function
 * @pdev:       platform device structure
@@ -528,102 +894,109 @@ static int fsmc_correct_data(struct mtd_info *mtd, uint8_t *dat,
 static int __init fsmc_nand_probe(struct platform_device *pdev)
 {
        struct fsmc_nand_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        struct device_node __maybe_unused *np = pdev->dev.of_node;
+        struct mtd_part_parser_data ppdata = {};
        struct fsmc_nand_data *host;
        struct mtd_info *mtd;
        struct nand_chip *nand;
-        struct fsmc_regs *regs;
        struct resource *res;
+        dma_cap_mask_t mask;
        int ret = 0;
        u32 pid;
        int i;
+        if (np) {
+                pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+                pdev->dev.platform_data = pdata;
+                ret = fsmc_nand_probe_config_dt(pdev, np);
+                if (ret) {
+                        dev_err(&pdev->dev, "no platform data\n");
+                        return -ENODEV;
+                }
+        }
        if (!pdata) {
                dev_err(&pdev->dev, "platform data is NULL\n");
                return -EINVAL;
        }
        /* Allocate memory for the device structure (and zero it) */
-        host = kzalloc(sizeof(*host), GFP_KERNEL);
+        host = devm_kzalloc(&pdev->dev, sizeof(*host), GFP_KERNEL);
        if (!host) {
                dev_err(&pdev->dev, "failed to allocate device structure\n");
                return -ENOMEM;
        }
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "nand_data");
-        if (!res) {
+        if (!res)
-                ret = -EIO;
+                return -EINVAL;
-                goto err_probe1;
-        }
-        host->resdata = request_mem_region(res->start, resource_size(res),
+        if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res),
-                        pdev->name);
+                                pdev->name)) {
-        if (!host->resdata) {
+                dev_err(&pdev->dev, "Failed to get memory data resourse\n");
-                ret = -EIO;
+                return -ENOENT;
-                goto err_probe1;
        }
-        host->data_va = ioremap(res->start, resource_size(res));
+        host->data_pa = (dma_addr_t)res->start;
+        host->data_va = devm_ioremap(&pdev->dev, res->start,
+                        resource_size(res));
        if (!host->data_va) {
-                ret = -EIO;
+                dev_err(&pdev->dev, "data ioremap failed\n");
-                goto err_probe1;
+                return -ENOMEM;
        }
-        host->resaddr = request_mem_region(res->start + PLAT_NAND_ALE,
+        if (!devm_request_mem_region(&pdev->dev, res->start + pdata->ale_off,
-                        resource_size(res), pdev->name);
+                        resource_size(res), pdev->name)) {
-        if (!host->resaddr) {
+                dev_err(&pdev->dev, "Failed to get memory ale resourse\n");
-                ret = -EIO;
+                return -ENOENT;
-                goto err_probe1;
        }
-        host->addr_va = ioremap(res->start + PLAT_NAND_ALE, resource_size(res));
+        host->addr_va = devm_ioremap(&pdev->dev, res->start + pdata->ale_off,
+                        resource_size(res));
        if (!host->addr_va) {
-                ret = -EIO;
+                dev_err(&pdev->dev, "ale ioremap failed\n");
-                goto err_probe1;
+                return -ENOMEM;
        }
-        host->rescmd = request_mem_region(res->start + PLAT_NAND_CLE,
+        if (!devm_request_mem_region(&pdev->dev, res->start + pdata->cle_off,
-                        resource_size(res), pdev->name);
+                        resource_size(res), pdev->name)) {
-        if (!host->rescmd) {
+                dev_err(&pdev->dev, "Failed to get memory cle resourse\n");
-                ret = -EIO;
+                return -ENOENT;
-                goto err_probe1;
        }
-        host->cmd_va = ioremap(res->start + PLAT_NAND_CLE, resource_size(res));
+        host->cmd_va = devm_ioremap(&pdev->dev, res->start + pdata->cle_off,
+                        resource_size(res));
        if (!host->cmd_va) {
-                ret = -EIO;
+                dev_err(&pdev->dev, "ale ioremap failed\n");
-                goto err_probe1;
+                return -ENOMEM;
        }
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fsmc_regs");
-        if (!res) {
+        if (!res)
-                ret = -EIO;
+                return -EINVAL;
-                goto err_probe1;
-        }
-        host->resregs = request_mem_region(res->start, resource_size(res),
+        if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res),
-                        pdev->name);
+                        pdev->name)) {
-        if (!host->resregs) {
+                dev_err(&pdev->dev, "Failed to get memory regs resourse\n");
-                ret = -EIO;
+                return -ENOENT;
-                goto err_probe1;
        }
-        host->regs_va = ioremap(res->start, resource_size(res));
+        host->regs_va = devm_ioremap(&pdev->dev, res->start,
+                        resource_size(res));
        if (!host->regs_va) {
-                ret = -EIO;
+                dev_err(&pdev->dev, "regs ioremap failed\n");
-                goto err_probe1;
+                return -ENOMEM;
        }
        host->clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(host->clk)) {
                dev_err(&pdev->dev, "failed to fetch block clock\n");
-                ret = PTR_ERR(host->clk);
+                return PTR_ERR(host->clk);
-                host->clk = NULL;
-                goto err_probe1;
        }
        ret = clk_enable(host->clk);
        if (ret)
-                goto err_probe1;
+                goto err_clk_enable;
        /*
         * This device ID is actually a common AMBA ID as used on the
@@ -639,7 +1012,14 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
        host->bank = pdata->bank;
        host->select_chip = pdata->select_bank;
-        regs = host->regs_va;
+        host->partitions = pdata->partitions;
+        host->nr_partitions = pdata->nr_partitions;
+        host->dev = &pdev->dev;
+        host->dev_timings = pdata->nand_timings;
+        host->mode = pdata->mode;
+        if (host->mode == USE_DMA_ACCESS)
+                init_completion(&host->dma_access_complete);
        /* Link all private pointers */
        mtd = &host->mtd;
@@ -658,21 +1038,53 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
        nand->ecc.size = 512;
        nand->options = pdata->options;
        nand->select_chip = fsmc_select_chip;
+        nand->badblockbits = 7;
        if (pdata->width == FSMC_NAND_BW16)
                nand->options |= NAND_BUSWIDTH_16;
-        fsmc_nand_setup(regs, host->bank, nand->options & NAND_BUSWIDTH_16);
+        switch (host->mode) {
+        case USE_DMA_ACCESS:
+                dma_cap_zero(mask);
+                dma_cap_set(DMA_MEMCPY, mask);
+                host->read_dma_chan = dma_request_channel(mask, filter,
+                                pdata->read_dma_priv);
+                if (!host->read_dma_chan) {
+                        dev_err(&pdev->dev, "Unable to get read dma channel\n");
+                        goto err_req_read_chnl;
+                }
+                host->write_dma_chan = dma_request_channel(mask, filter,
+                                pdata->write_dma_priv);
+                if (!host->write_dma_chan) {
+                        dev_err(&pdev->dev, "Unable to get write dma channel\n");
+                        goto err_req_write_chnl;
+                }
+                nand->read_buf = fsmc_read_buf_dma;
+                nand->write_buf = fsmc_write_buf_dma;
+                break;
+        default:
+        case USE_WORD_ACCESS:
+                nand->read_buf = fsmc_read_buf;
+                nand->write_buf = fsmc_write_buf;
+                break;
+        }
+        fsmc_nand_setup(host->regs_va, host->bank,
+                        nand->options & NAND_BUSWIDTH_16,
+                        host->dev_timings);
        if (AMBA_REV_BITS(host->pid) >= 8) {
                nand->ecc.read_page = fsmc_read_page_hwecc;
                nand->ecc.calculate = fsmc_read_hwecc_ecc4;
-                nand->ecc.correct = fsmc_correct_data;
+                nand->ecc.correct = fsmc_bch8_correct_data;
                nand->ecc.bytes = 13;
+                nand->ecc.strength = 8;
        } else {
                nand->ecc.calculate = fsmc_read_hwecc_ecc1;
                nand->ecc.correct = nand_correct_data;
                nand->ecc.bytes = 3;
+                nand->ecc.strength = 1;
        }
        /*
@@ -681,19 +1093,52 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
        if (nand_scan_ident(&host->mtd, 1, NULL)) {
                ret = -ENXIO;
                dev_err(&pdev->dev, "No NAND Device found!\n");
-                goto err_probe;
+                goto err_scan_ident;
        }
        if (AMBA_REV_BITS(host->pid) >= 8) {
-                if (host->mtd.writesize == 512) {
+                switch (host->mtd.oobsize) {
-                        nand->ecc.layout = &fsmc_ecc4_sp_layout;
+                case 16:
+                        nand->ecc.layout = &fsmc_ecc4_16_layout;
                        host->ecc_place = &fsmc_ecc4_sp_place;
-                } else {
+                        break;
-                        nand->ecc.layout = &fsmc_ecc4_lp_layout;
+                case 64:
+                        nand->ecc.layout = &fsmc_ecc4_64_layout;
+                        host->ecc_place = &fsmc_ecc4_lp_place;
+                        break;
+                case 128:
+                        nand->ecc.layout = &fsmc_ecc4_128_layout;
+                        host->ecc_place = &fsmc_ecc4_lp_place;
+                        break;
+                case 224:
+                        nand->ecc.layout = &fsmc_ecc4_224_layout;
                        host->ecc_place = &fsmc_ecc4_lp_place;
+                        break;
+                case 256:
+                        nand->ecc.layout = &fsmc_ecc4_256_layout;
+                        host->ecc_place = &fsmc_ecc4_lp_place;
+                        break;
+                default:
+                        printk(KERN_WARNING "No oob scheme defined for "
+                               "oobsize %d\n", mtd->oobsize);
+                        BUG();
                }
        } else {
-                nand->ecc.layout = &fsmc_ecc1_layout;
+                switch (host->mtd.oobsize) {
+                case 16:
+                        nand->ecc.layout = &fsmc_ecc1_16_layout;
+                        break;
+                case 64:
+                        nand->ecc.layout = &fsmc_ecc1_64_layout;
+                        break;
+                case 128:
+                        nand->ecc.layout = &fsmc_ecc1_128_layout;
+                        break;
+                default:
+                        printk(KERN_WARNING "No oob scheme defined for "
+                               "oobsize %d\n", mtd->oobsize);
+                        BUG();
+                }
        }
        /* Second stage of scan to fill MTD data-structures */
@@ -713,13 +1158,9 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
         * Check for partition info passed
         */
        host->mtd.name = "nand";
-        ret = mtd_device_parse_register(&host->mtd, NULL, 0,
+        ppdata.of_node = np;
-                        host->mtd.size <= 0x04000000 ?
+        ret = mtd_device_parse_register(&host->mtd, NULL, &ppdata,
-                                partition_info_16KB_blk :
+                                        host->partitions, host->nr_partitions);
-                                partition_info_128KB_blk,
-                        host->mtd.size <= 0x04000000 ?
-                                ARRAY_SIZE(partition_info_16KB_blk) :
-                                ARRAY_SIZE(partition_info_128KB_blk));
        if (ret)
                goto err_probe;
@@ -728,32 +1169,16 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
        return 0;
 err_probe:
+err_scan_ident:
+        if (host->mode == USE_DMA_ACCESS)
+                dma_release_channel(host->write_dma_chan);
+err_req_write_chnl:
+        if (host->mode == USE_DMA_ACCESS)
+                dma_release_channel(host->read_dma_chan);
+err_req_read_chnl:
        clk_disable(host->clk);
-err_probe1:
+err_clk_enable:
-        if (host->clk)
+        clk_put(host->clk);
-                clk_put(host->clk);
-        if (host->regs_va)
-                iounmap(host->regs_va);
-        if (host->resregs)
-                release_mem_region(host->resregs->start,
-                                resource_size(host->resregs));
-        if (host->cmd_va)
-                iounmap(host->cmd_va);
-        if (host->rescmd)
-                release_mem_region(host->rescmd->start,
-                                resource_size(host->rescmd));
-        if (host->addr_va)
-                iounmap(host->addr_va);
-        if (host->resaddr)
-                release_mem_region(host->resaddr->start,
-                                resource_size(host->resaddr));
-        if (host->data_va)
-                iounmap(host->data_va);
-        if (host->resdata)
-                release_mem_region(host->resdata->start,
-                                resource_size(host->resdata));
-        kfree(host);
        return ret;
 }
@@ -768,24 +1193,15 @@ static int fsmc_nand_remove(struct platform_device *pdev)
        if (host) {
                nand_release(&host->mtd);
+                if (host->mode == USE_DMA_ACCESS) {
+                        dma_release_channel(host->write_dma_chan);
+                        dma_release_channel(host->read_dma_chan);
+                }
                clk_disable(host->clk);
                clk_put(host->clk);
-                iounmap(host->regs_va);
-                release_mem_region(host->resregs->start,
-                                resource_size(host->resregs));
-                iounmap(host->cmd_va);
-                release_mem_region(host->rescmd->start,
-                                resource_size(host->rescmd));
-                iounmap(host->addr_va);
-                release_mem_region(host->resaddr->start,
-                                resource_size(host->resaddr));
-                iounmap(host->data_va);
-                release_mem_region(host->resdata->start,
-                                resource_size(host->resdata));
-                kfree(host);
        }
        return 0;
 }
@@ -801,15 +1217,24 @@ static int fsmc_nand_suspend(struct device *dev)
 static int fsmc_nand_resume(struct device *dev)
 {
        struct fsmc_nand_data *host = dev_get_drvdata(dev);
-        if (host)
+        if (host) {
                clk_enable(host->clk);
+                fsmc_nand_setup(host->regs_va, host->bank,
+                                host->nand.options & NAND_BUSWIDTH_16,
+                                host->dev_timings);
+        }
        return 0;
 }
-static const struct dev_pm_ops fsmc_nand_pm_ops = {
+static SIMPLE_DEV_PM_OPS(fsmc_nand_pm_ops, fsmc_nand_suspend, fsmc_nand_resume);
-        .suspend = fsmc_nand_suspend,
+#endif
-        .resume = fsmc_nand_resume,
+#ifdef CONFIG_OF
+static const struct of_device_id fsmc_nand_id_table[] = {
+        { .compatible = "st,spear600-fsmc-nand" },
+        {}
 };
+MODULE_DEVICE_TABLE(of, fsmc_nand_id_table);
 #endif
 static struct platform_driver fsmc_nand_driver = {
@@ -817,6 +1242,7 @@ static struct platform_driver fsmc_nand_driver = {
        .driver = {
                .owner = THIS_MODULE,
                .name = "fsmc-nand",
+                .of_match_table = of_match_ptr(fsmc_nand_id_table),
 #ifdef CONFIG_PM
                .pm = &fsmc_nand_pm_ops,
 #endif
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
index 590dd5cceed6..e8ea7107932e 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
@@ -848,7 +848,10 @@ int gpmi_send_command(struct gpmi_nand_data *this)
        sg_init_one(sgl, this->cmd_buffer, this->command_length);
        dma_map_sg(this->dev, sgl, 1, DMA_TO_DEVICE);
-        desc = dmaengine_prep_slave_sg(channel, sgl, 1, DMA_MEM_TO_DEV, 1);
+        desc = dmaengine_prep_slave_sg(channel,
+                                sgl, 1, DMA_MEM_TO_DEV,
+                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 2 error\n");
                return -1;
@@ -889,7 +892,8 @@ int gpmi_send_data(struct gpmi_nand_data *this)
        /* [2] send DMA request */
        prepare_data_dma(this, DMA_TO_DEVICE);
        desc = dmaengine_prep_slave_sg(channel, &this->data_sgl,
-                                                1, DMA_MEM_TO_DEV, 1);
+                                        1, DMA_MEM_TO_DEV,
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 2 error\n");
                return -1;
@@ -925,7 +929,8 @@ int gpmi_read_data(struct gpmi_nand_data *this)
        /* [2] : send DMA request */
        prepare_data_dma(this, DMA_FROM_DEVICE);
        desc = dmaengine_prep_slave_sg(channel, &this->data_sgl,
-                                        1, DMA_DEV_TO_MEM, 1);
+                                        1, DMA_DEV_TO_MEM,
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 2 error\n");
                return -1;
@@ -970,8 +975,10 @@ int gpmi_send_page(struct gpmi_nand_data *this,
        pio[4] = payload;
        pio[5] = auxiliary;
-        desc = dmaengine_prep_slave_sg(channel, (struct scatterlist *)pio,
+        desc = dmaengine_prep_slave_sg(channel,
-                                        ARRAY_SIZE(pio), DMA_TRANS_NONE, 0);
+                                        (struct scatterlist *)pio,
+                                        ARRAY_SIZE(pio), DMA_TRANS_NONE,
+                                        DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 2 error\n");
                return -1;
@@ -1035,7 +1042,8 @@ int gpmi_read_page(struct gpmi_nand_data *this,
        pio[5] = auxiliary;
        desc = dmaengine_prep_slave_sg(channel,
                                        (struct scatterlist *)pio,
-                                        ARRAY_SIZE(pio), DMA_TRANS_NONE, 1);
+                                        ARRAY_SIZE(pio), DMA_TRANS_NONE,
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 2 error\n");
                return -1;
@@ -1052,9 +1060,11 @@ int gpmi_read_page(struct gpmi_nand_data *this,
                | BF_GPMI_CTRL0_ADDRESS(address)
                | BF_GPMI_CTRL0_XFER_COUNT(geo->page_size);
        pio[1] = 0;
+        pio[2] = 0; /* clear GPMI_HW_GPMI_ECCCTRL, disable the BCH. */
        desc = dmaengine_prep_slave_sg(channel,
-                                (struct scatterlist *)pio, 2,
+                                (struct scatterlist *)pio, 3,
-                                DMA_TRANS_NONE, 1);
+                                DMA_TRANS_NONE,
+                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc) {
                pr_err("step 3 error\n");
                return -1;
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 493ec2fcf97f..75b1dde16358 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1124,7 +1124,7 @@ static int gpmi_block_markbad(struct mtd_info *mtd, loff_t ofs)
                chip->bbt[block >> 2] |= 0x01 << ((block & 0x03) << 1);
        /* Do we have a flash based bad block table ? */
-        if (chip->options & NAND_BBT_USE_FLASH)
+        if (chip->bbt_options & NAND_BBT_USE_FLASH)
                ret = nand_update_bbt(mtd, ofs);
        else {
                chipnr = (int)(ofs >> chip->chip_shift);
@@ -1155,7 +1155,7 @@ static int gpmi_block_markbad(struct mtd_info *mtd, loff_t ofs)
        return ret;
 }
-static int __devinit nand_boot_set_geometry(struct gpmi_nand_data *this)
+static int nand_boot_set_geometry(struct gpmi_nand_data *this)
 {
        struct boot_rom_geometry *geometry = &this->rom_geometry;
@@ -1182,7 +1182,7 @@ static int __devinit nand_boot_set_geometry(struct gpmi_nand_data *this)
 }
 static const char  *fingerprint = "STMP";
-static int __devinit mx23_check_transcription_stamp(struct gpmi_nand_data *this)
+static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
 {
        struct boot_rom_geometry *rom_geo = &this->rom_geometry;
        struct device *dev = this->dev;
@@ -1239,7 +1239,7 @@ static int __devinit mx23_check_transcription_stamp(struct gpmi_nand_data *this)
 }
 /* Writes a transcription stamp. */
-static int __devinit mx23_write_transcription_stamp(struct gpmi_nand_data *this)
+static int mx23_write_transcription_stamp(struct gpmi_nand_data *this)
 {
        struct device *dev = this->dev;
        struct boot_rom_geometry *rom_geo = &this->rom_geometry;
@@ -1322,7 +1322,7 @@ static int __devinit mx23_write_transcription_stamp(struct gpmi_nand_data *this)
        return 0;
 }
-static int __devinit mx23_boot_init(struct gpmi_nand_data  *this)
+static int mx23_boot_init(struct gpmi_nand_data  *this)
 {
        struct device *dev = this->dev;
        struct nand_chip *chip = &this->nand;
@@ -1391,7 +1391,7 @@ static int __devinit mx23_boot_init(struct gpmi_nand_data  *this)
        return 0;
 }
-static int __devinit nand_boot_init(struct gpmi_nand_data  *this)
+static int nand_boot_init(struct gpmi_nand_data  *this)
 {
        nand_boot_set_geometry(this);
@@ -1401,7 +1401,7 @@ static int __devinit nand_boot_init(struct gpmi_nand_data  *this)
        return 0;
 }
-static int __devinit gpmi_set_geometry(struct gpmi_nand_data *this)
+static int gpmi_set_geometry(struct gpmi_nand_data *this)
 {
        int ret;
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.h b/drivers/mtd/nand/gpmi-nand/gpmi-nand.h
index e023bccb7781..ec6180d4ff8f 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.h
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.h
@@ -20,7 +20,7 @@
 #include <linux/mtd/nand.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
-#include <mach/dma.h>
+#include <linux/fsl/mxs-dma.h>
 struct resources {
        void          *gpmi_regs;
diff --git a/drivers/mtd/nand/h1910.c b/drivers/mtd/nand/h1910.c
index 5dc6f0d92f1a..11e487813428 100644
--- a/drivers/mtd/nand/h1910.c
+++ b/drivers/mtd/nand/h1910.c
@@ -135,8 +135,8 @@ static int __init h1910_init(void)
        }
        /* Register the partitions */
-        mtd_device_parse_register(h1910_nand_mtd, NULL, 0,
+        mtd_device_parse_register(h1910_nand_mtd, NULL, NULL, partition_info,
-                        partition_info, NUM_PARTITIONS);
+                                  NUM_PARTITIONS);
        /* Return happy */
        return 0;
diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
index ac3b9f255e00..e4147e8acb7c 100644
--- a/drivers/mtd/nand/jz4740_nand.c
+++ b/drivers/mtd/nand/jz4740_nand.c
@@ -332,6 +332,11 @@ static int __devinit jz_nand_probe(struct platform_device *pdev)
        chip->ecc.mode          = NAND_ECC_HW_OOB_FIRST;
        chip->ecc.size          = 512;
        chip->ecc.bytes         = 9;
+        chip->ecc.strength      = 2;
+        /*
+         * FIXME: ecc_strength value of 2 bits per 512 bytes of data is a
+         * conservative guess, given 9 ecc bytes and reed-solomon alg.
+         */
        if (pdata)
                chip->ecc.layout = pdata->ecc_layout;
@@ -367,9 +372,9 @@ static int __devinit jz_nand_probe(struct platform_device *pdev)
                goto err_gpio_free;
        }
-        ret = mtd_device_parse_register(mtd, NULL, 0,
+        ret = mtd_device_parse_register(mtd, NULL, NULL,
-                        pdata ? pdata->partitions : NULL,
+                                        pdata ? pdata->partitions : NULL,
-                        pdata ? pdata->num_partitions : 0);
+                                        pdata ? pdata->num_partitions : 0);
        if (ret) {
                dev_err(&pdev->dev, "Failed to add mtd device\n");
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 74a43b818d0e..cc0678a967c1 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -1225,9 +1225,16 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                goto escan;
        }
+        if (this->ecc.mode == NAND_ECC_HW) {
+                if (nfc_is_v1())
+                        this->ecc.strength = 1;
+                else
+                        this->ecc.strength = (host->eccsize == 4) ? 4 : 8;
+        }
        /* Register the partitions */
-        mtd_device_parse_register(mtd, part_probes, 0,
+        mtd_device_parse_register(mtd, part_probes, NULL, pdata->parts,
-                        pdata->parts, pdata->nr_parts);
+                                  pdata->nr_parts);
        platform_set_drvdata(pdev, host);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 8a393f9e6027..47b19c0bb070 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -123,12 +123,6 @@ static int check_offs_len(struct mtd_info *mtd,
                ret = -EINVAL;
        }
-        /* Do not allow past end of device */
-        if (ofs + len > mtd->size) {
-                pr_debug("%s: past end of device\n", __func__);
-                ret = -EINVAL;
-        }
        return ret;
 }
@@ -338,7 +332,7 @@ static int nand_verify_buf16(struct mtd_info *mtd, const uint8_t *buf, int len)
 */
 static int nand_block_bad(struct mtd_info *mtd, loff_t ofs, int getchip)
 {
-        int page, chipnr, res = 0;
+        int page, chipnr, res = 0, i = 0;
        struct nand_chip *chip = mtd->priv;
        u16 bad;
@@ -356,23 +350,29 @@ static int nand_block_bad(struct mtd_info *mtd, loff_t ofs, int getchip)
                chip->select_chip(mtd, chipnr);
        }
-        if (chip->options & NAND_BUSWIDTH_16) {
+        do {
-                chip->cmdfunc(mtd, NAND_CMD_READOOB, chip->badblockpos & 0xFE,
+                if (chip->options & NAND_BUSWIDTH_16) {
-                              page);
+                        chip->cmdfunc(mtd, NAND_CMD_READOOB,
-                bad = cpu_to_le16(chip->read_word(mtd));
+                                        chip->badblockpos & 0xFE, page);
-                if (chip->badblockpos & 0x1)
+                        bad = cpu_to_le16(chip->read_word(mtd));
-                        bad >>= 8;
+                        if (chip->badblockpos & 0x1)
-                else
+                                bad >>= 8;
-                        bad &= 0xFF;
+                        else
-        } else {
+                                bad &= 0xFF;
-                chip->cmdfunc(mtd, NAND_CMD_READOOB, chip->badblockpos, page);
+                } else {
-                bad = chip->read_byte(mtd);
+                        chip->cmdfunc(mtd, NAND_CMD_READOOB, chip->badblockpos,
-        }
+                                        page);
+                        bad = chip->read_byte(mtd);
+                }
-        if (likely(chip->badblockbits == 8))
+                if (likely(chip->badblockbits == 8))
-                res = bad != 0xFF;
+                        res = bad != 0xFF;
-        else
+                else
-                res = hweight8(bad) < chip->badblockbits;
+                        res = hweight8(bad) < chip->badblockbits;
+                ofs += mtd->writesize;
+                page = (int)(ofs >> chip->page_shift) & chip->pagemask;
+                i++;
+        } while (!res && i < 2 && (chip->bbt_options & NAND_BBT_SCAN2NDPAGE));
        if (getchip)
                nand_release_device(mtd);
@@ -386,51 +386,79 @@ static int nand_block_bad(struct mtd_info *mtd, loff_t ofs, int getchip)
 * @ofs: offset from device start
 *
 * This is the default implementation, which can be overridden by a hardware
- * specific driver.
+ * specific driver. We try operations in the following order, according to our
+ * bbt_options (NAND_BBT_NO_OOB_BBM and NAND_BBT_USE_FLASH):
+ *  (1) erase the affected block, to allow OOB marker to be written cleanly
+ *  (2) update in-memory BBT
+ *  (3) write bad block marker to OOB area of affected block
+ *  (4) update flash-based BBT
+ * Note that we retain the first error encountered in (3) or (4), finish the
+ * procedures, and dump the error in the end.
 */
 static int nand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
 {
        struct nand_chip *chip = mtd->priv;
        uint8_t buf[2] = { 0, 0 };
-        int block, ret, i = 0;
+        int block, res, ret = 0, i = 0;
+        int write_oob = !(chip->bbt_options & NAND_BBT_NO_OOB_BBM);
-        if (chip->bbt_options & NAND_BBT_SCANLASTPAGE)
+        if (write_oob) {
-                ofs += mtd->erasesize - mtd->writesize;
+                struct erase_info einfo;
+                /* Attempt erase before marking OOB */
+                memset(&einfo, 0, sizeof(einfo));
+                einfo.mtd = mtd;
+                einfo.addr = ofs;
+                einfo.len = 1 << chip->phys_erase_shift;
+                nand_erase_nand(mtd, &einfo, 0);
+        }
        /* Get block number */
        block = (int)(ofs >> chip->bbt_erase_shift);
+        /* Mark block bad in memory-based BBT */
        if (chip->bbt)
                chip->bbt[block >> 2] |= 0x01 << ((block & 0x03) << 1);
-        /* Do we have a flash based bad block table? */
+        /* Write bad block marker to OOB */
-        if (chip->bbt_options & NAND_BBT_USE_FLASH)
+        if (write_oob) {
-                ret = nand_update_bbt(mtd, ofs);
-        else {
                struct mtd_oob_ops ops;
+                loff_t wr_ofs = ofs;
                nand_get_device(chip, mtd, FL_WRITING);
-                /*
-                 * Write to first two pages if necessary. If we write to more
-                 * than one location, the first error encountered quits the
-                 * procedure. We write two bytes per location, so we dont have
-                 * to mess with 16 bit access.
-                 */
-                ops.len = ops.ooblen = 2;
                ops.datbuf = NULL;
                ops.oobbuf = buf;
-                ops.ooboffs = chip->badblockpos & ~0x01;
+                ops.ooboffs = chip->badblockpos;
+                if (chip->options & NAND_BUSWIDTH_16) {
+                        ops.ooboffs &= ~0x01;
+                        ops.len = ops.ooblen = 2;
+                } else {
+                        ops.len = ops.ooblen = 1;
+                }
                ops.mode = MTD_OPS_PLACE_OOB;
+                /* Write to first/last page(s) if necessary */
+                if (chip->bbt_options & NAND_BBT_SCANLASTPAGE)
+                        wr_ofs += mtd->erasesize - mtd->writesize;
                do {
-                        ret = nand_do_write_oob(mtd, ofs, &ops);
+                        res = nand_do_write_oob(mtd, wr_ofs, &ops);
+                        if (!ret)
+                                ret = res;
                        i++;
-                        ofs += mtd->writesize;
+                        wr_ofs += mtd->writesize;
-                } while (!ret && (chip->bbt_options & NAND_BBT_SCAN2NDPAGE) &&
+                } while ((chip->bbt_options & NAND_BBT_SCAN2NDPAGE) && i < 2);
-                                i < 2);
                nand_release_device(mtd);
        }
+        /* Update flash-based bad block table */
+        if (chip->bbt_options & NAND_BBT_USE_FLASH) {
+                res = nand_update_bbt(mtd, ofs);
+                if (!ret)
+                        ret = res;
+        }
        if (!ret)
                mtd->ecc_stats.badblocks++;
@@ -1586,25 +1614,14 @@ static int nand_read(struct mtd_info *mtd, loff_t from, size_t len,
        struct mtd_oob_ops ops;
        int ret;
-        /* Do not allow reads past end of device */
-        if ((from + len) > mtd->size)
-                return -EINVAL;
-        if (!len)
-                return 0;
        nand_get_device(chip, mtd, FL_READING);
        ops.len = len;
        ops.datbuf = buf;
        ops.oobbuf = NULL;
        ops.mode = 0;
        ret = nand_do_read_ops(mtd, from, &ops);
        *retlen = ops.retlen;
        nand_release_device(mtd);
        return ret;
 }
@@ -2293,12 +2310,6 @@ static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
        struct mtd_oob_ops ops;
        int ret;
-        /* Do not allow reads past end of device */
-        if ((to + len) > mtd->size)
-                return -EINVAL;
-        if (!len)
-                return 0;
        /* Wait for the device to get ready */
        panic_nand_wait(mtd, chip, 400);
@@ -2333,25 +2344,14 @@ static int nand_write(struct mtd_info *mtd, loff_t to, size_t len,
        struct mtd_oob_ops ops;
        int ret;
-        /* Do not allow reads past end of device */
-        if ((to + len) > mtd->size)
-                return -EINVAL;
-        if (!len)
-                return 0;
        nand_get_device(chip, mtd, FL_WRITING);
        ops.len = len;
        ops.datbuf = (uint8_t *)buf;
        ops.oobbuf = NULL;
        ops.mode = 0;
        ret = nand_do_write_ops(mtd, to, &ops);
        *retlen = ops.retlen;
        nand_release_device(mtd);
        return ret;
 }
@@ -2550,8 +2550,6 @@ int nand_erase_nand(struct mtd_info *mtd, struct erase_info *instr,
        if (check_offs_len(mtd, instr->addr, instr->len))
                return -EINVAL;
-        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* Grab the lock and see if the device is available */
        nand_get_device(chip, mtd, FL_ERASING);
@@ -2715,10 +2713,6 @@ static void nand_sync(struct mtd_info *mtd)
 */
 static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
 {
-        /* Check for invalid offset */
-        if (offs > mtd->size)
-                return -EINVAL;
        return nand_block_checkbad(mtd, offs, 1, 0);
 }
@@ -2857,7 +2851,6 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
                chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
                return 0;
-        pr_info("ONFI flash detected\n");
        chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
        for (i = 0; i < 3; i++) {
                chip->read_buf(mtd, (uint8_t *)p, sizeof(*p));
@@ -2898,7 +2891,8 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
        mtd->writesize = le32_to_cpu(p->byte_per_page);
        mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize;
        mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page);
-        chip->chipsize = (uint64_t)le32_to_cpu(p->blocks_per_lun) * mtd->erasesize;
+        chip->chipsize = le32_to_cpu(p->blocks_per_lun);
+        chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count;
        *busw = 0;
        if (le16_to_cpu(p->features) & 1)
                *busw = NAND_BUSWIDTH_16;
@@ -2907,6 +2901,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
        chip->options |= (NAND_NO_READRDY |
                        NAND_NO_AUTOINCR) & NAND_CHIPOPTIONS_MSK;
+        pr_info("ONFI flash detected\n");
        return 1;
 }
@@ -3238,6 +3233,10 @@ int nand_scan_tail(struct mtd_info *mtd)
        int i;
        struct nand_chip *chip = mtd->priv;
+        /* New bad blocks should be marked in OOB, flash-based BBT, or both */
+        BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
+                        !(chip->bbt_options & NAND_BBT_USE_FLASH));
        if (!(chip->options & NAND_OWN_BUFFERS))
                chip->buffers = kmalloc(sizeof(*chip->buffers), GFP_KERNEL);
        if (!chip->buffers)
@@ -3350,6 +3349,7 @@ int nand_scan_tail(struct mtd_info *mtd)
                if (!chip->ecc.size)
                        chip->ecc.size = 256;
                chip->ecc.bytes = 3;
+                chip->ecc.strength = 1;
                break;
        case NAND_ECC_SOFT_BCH:
@@ -3384,6 +3384,8 @@ int nand_scan_tail(struct mtd_info *mtd)
                        pr_warn("BCH ECC initialization failed!\n");
                        BUG();
                }
+                chip->ecc.strength =
+                        chip->ecc.bytes*8 / fls(8*chip->ecc.size);
                break;
        case NAND_ECC_NONE:
@@ -3397,6 +3399,7 @@ int nand_scan_tail(struct mtd_info *mtd)
                chip->ecc.write_oob = nand_write_oob_std;
                chip->ecc.size = mtd->writesize;
                chip->ecc.bytes = 0;
+                chip->ecc.strength = 0;
                break;
        default:
@@ -3461,25 +3464,26 @@ int nand_scan_tail(struct mtd_info *mtd)
        mtd->type = MTD_NANDFLASH;
        mtd->flags = (chip->options & NAND_ROM) ? MTD_CAP_ROM :
                                                MTD_CAP_NANDFLASH;
-        mtd->erase = nand_erase;
+        mtd->_erase = nand_erase;
-        mtd->point = NULL;
+        mtd->_point = NULL;
-        mtd->unpoint = NULL;
+        mtd->_unpoint = NULL;
-        mtd->read = nand_read;
+        mtd->_read = nand_read;
-        mtd->write = nand_write;
+        mtd->_write = nand_write;
-        mtd->panic_write = panic_nand_write;
+        mtd->_panic_write = panic_nand_write;
-        mtd->read_oob = nand_read_oob;
+        mtd->_read_oob = nand_read_oob;
-        mtd->write_oob = nand_write_oob;
+        mtd->_write_oob = nand_write_oob;
-        mtd->sync = nand_sync;
+        mtd->_sync = nand_sync;
-        mtd->lock = NULL;
+        mtd->_lock = NULL;
-        mtd->unlock = NULL;
+        mtd->_unlock = NULL;
-        mtd->suspend = nand_suspend;
+        mtd->_suspend = nand_suspend;
-        mtd->resume = nand_resume;
+        mtd->_resume = nand_resume;
-        mtd->block_isbad = nand_block_isbad;
+        mtd->_block_isbad = nand_block_isbad;
-        mtd->block_markbad = nand_block_markbad;
+        mtd->_block_markbad = nand_block_markbad;
        mtd->writebufsize = mtd->writesize;
-        /* propagate ecc.layout to mtd_info */
+        /* propagate ecc info to mtd_info */
        mtd->ecclayout = chip->ecc.layout;
+        mtd->ecc_strength = chip->ecc.strength * chip->ecc.steps;
        /* Check, if we should skip the bad block table scan */
        if (chip->options & NAND_SKIP_BBTSCAN)
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index ec688548c880..2b6f632cf274 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -179,6 +179,7 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc,
        chip->ecc.mode = NAND_ECC_HW;
        chip->ecc.size = 256;
        chip->ecc.bytes = 3;
+        chip->ecc.strength = 1;
        chip->priv = ndfc;
        ndfc->mtd.priv = chip;
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index b3a883e2a22f..c2b0bba9d8b3 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1058,6 +1058,7 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
                (pdata->ecc_opt == OMAP_ECC_HAMMING_CODE_HW_ROMCODE)) {
                info->nand.ecc.bytes            = 3;
                info->nand.ecc.size             = 512;
+                info->nand.ecc.strength         = 1;
                info->nand.ecc.calculate        = omap_calculate_ecc;
                info->nand.ecc.hwctl            = omap_enable_hwecc;
                info->nand.ecc.correct          = omap_correct_data;
@@ -1101,8 +1102,8 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
                goto out_release_mem_region;
        }
-        mtd_device_parse_register(&info->mtd, NULL, 0,
+        mtd_device_parse_register(&info->mtd, NULL, NULL, pdata->parts,
-                        pdata->parts, pdata->nr_parts);
+                                  pdata->nr_parts);
        platform_set_drvdata(pdev, &info->mtd);
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 29f505adaf84..1d3bfb26080c 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -129,8 +129,8 @@ static int __init orion_nand_probe(struct platform_device *pdev)
        }
        mtd->name = "orion_nand";
-        ret = mtd_device_parse_register(mtd, NULL, 0,
+        ret = mtd_device_parse_register(mtd, NULL, NULL, board->parts,
-                        board->parts, board->nr_parts);
+                                        board->nr_parts);
        if (ret) {
                nand_release(mtd);
                goto no_dev;
diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index 7f2da6953357..6404e6e81b10 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -99,8 +99,9 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
        }
        err = mtd_device_parse_register(&data->mtd,
-                        pdata->chip.part_probe_types, 0,
+                                        pdata->chip.part_probe_types, NULL,
-                        pdata->chip.partitions, pdata->chip.nr_partitions);
+                                        pdata->chip.partitions,
+                                        pdata->chip.nr_partitions);
        if (!err)
                return err;
diff --git a/drivers/mtd/nand/ppchameleonevb.c b/drivers/mtd/nand/ppchameleonevb.c
index 7e52af51a198..0ddd90e5788f 100644
--- a/drivers/mtd/nand/ppchameleonevb.c
+++ b/drivers/mtd/nand/ppchameleonevb.c
@@ -275,11 +275,10 @@ static int __init ppchameleonevb_init(void)
        ppchameleon_mtd->name = "ppchameleon-nand";
        /* Register the partitions */
-        mtd_device_parse_register(ppchameleon_mtd, NULL, 0,
+        mtd_device_parse_register(ppchameleon_mtd, NULL, NULL,
-                        ppchameleon_mtd->size == NAND_SMALL_SIZE ?
+                                  ppchameleon_mtd->size == NAND_SMALL_SIZE ?
-                                partition_info_me :
+                                        partition_info_me : partition_info_hi,
-                                partition_info_hi,
+                                  NUM_PARTITIONS);
-                        NUM_PARTITIONS);
 nand_evb_init:
        /****************************
@@ -365,11 +364,10 @@ static int __init ppchameleonevb_init(void)
        ppchameleonevb_mtd->name = NAND_EVB_MTD_NAME;
        /* Register the partitions */
-        mtd_device_parse_register(ppchameleonevb_mtd, NULL, 0,
+        mtd_device_parse_register(ppchameleonevb_mtd, NULL, NULL,
-                        ppchameleon_mtd->size == NAND_SMALL_SIZE ?
+                                  ppchameleon_mtd->size == NAND_SMALL_SIZE ?
-                                partition_info_me :
+                                  partition_info_me : partition_info_hi,
-                                partition_info_hi,
+                                  NUM_PARTITIONS);
-                        NUM_PARTITIONS);
        /* Return happy */
        return 0;
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 5c3d719c37e6..def50caa6f84 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1002,6 +1002,7 @@ static int pxa3xx_nand_scan(struct mtd_info *mtd)
 KEEP_CONFIG:
        chip->ecc.mode = NAND_ECC_HW;
        chip->ecc.size = host->page_size;
+        chip->ecc.strength = 1;
        chip->options = NAND_NO_AUTOINCR;
        chip->options |= NAND_NO_READRDY;
@@ -1228,8 +1229,9 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
                        continue;
                }
-                ret = mtd_device_parse_register(info->host[cs]->mtd, NULL, 0,
+                ret = mtd_device_parse_register(info->host[cs]->mtd, NULL,
-                                pdata->parts[cs], pdata->nr_parts[cs]);
+                                                NULL, pdata->parts[cs],
+                                                pdata->nr_parts[cs]);
                if (!ret)
                        probe_success = 1;
        }
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 769a4e096b3c..c2040187c813 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -891,6 +891,7 @@ int  r852_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
        chip->ecc.mode = NAND_ECC_HW_SYNDROME;
        chip->ecc.size = R852_DMA_LEN;
        chip->ecc.bytes = SM_OOB_SIZE;
+        chip->ecc.strength = 2;
        chip->ecc.hwctl = r852_ecc_hwctl;
        chip->ecc.calculate = r852_ecc_calculate;
        chip->ecc.correct = r852_ecc_correct;
diff --git a/drivers/mtd/nand/rtc_from4.c b/drivers/mtd/nand/rtc_from4.c
index f309addc2fa0..e55b5cfbe145 100644
--- a/drivers/mtd/nand/rtc_from4.c
+++ b/drivers/mtd/nand/rtc_from4.c
@@ -527,6 +527,7 @@ static int __init rtc_from4_init(void)
        this->ecc.mode = NAND_ECC_HW_SYNDROME;
        this->ecc.size = 512;
        this->ecc.bytes = 8;
+        this->ecc.strength = 3;
        /* return the status of extra status and ECC checks */
        this->errstat = rtc_from4_errstat;
        /* set the nand_oobinfo to support FPGA H/W error detection */
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 868685db6712..91121f33f743 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -751,8 +751,8 @@ static int s3c2410_nand_add_partition(struct s3c2410_nand_info *info,
        if (set)
                mtd->mtd.name = set->name;
-        return mtd_device_parse_register(&mtd->mtd, NULL, 0,
+        return mtd_device_parse_register(&mtd->mtd, NULL, NULL,
-                        set->partitions, set->nr_partitions);
+                                         set->partitions, set->nr_partitions);
 }
 /**
@@ -823,6 +823,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
                chip->ecc.calculate = s3c2410_nand_calculate_ecc;
                chip->ecc.correct   = s3c2410_nand_correct_data;
                chip->ecc.mode      = NAND_ECC_HW;
+                chip->ecc.strength  = 1;
                switch (info->cpu_type) {
                case TYPE_S3C2410:
diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c
index 93b1f74321c2..e9b2b260de3a 100644
--- a/drivers/mtd/nand/sh_flctl.c
+++ b/drivers/mtd/nand/sh_flctl.c
@@ -26,6 +26,7 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/slab.h>
 #include <linux/mtd/mtd.h>
@@ -283,7 +284,7 @@ static void write_fiforeg(struct sh_flctl *flctl, int rlen, int offset)
 static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_val)
 {
        struct sh_flctl *flctl = mtd_to_flctl(mtd);
-        uint32_t flcmncr_val = readl(FLCMNCR(flctl)) & ~SEL_16BIT;
+        uint32_t flcmncr_val = flctl->flcmncr_base & ~SEL_16BIT;
        uint32_t flcmdcr_val, addr_len_bytes = 0;
        /* Set SNAND bit if page size is 2048byte */
@@ -303,6 +304,7 @@ static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_va
                break;
        case NAND_CMD_READ0:
        case NAND_CMD_READOOB:
+        case NAND_CMD_RNDOUT:
                addr_len_bytes = flctl->rw_ADRCNT;
                flcmdcr_val |= CDSRC_E;
                if (flctl->chip.options & NAND_BUSWIDTH_16)
@@ -320,6 +322,7 @@ static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_va
                break;
        case NAND_CMD_READID:
                flcmncr_val &= ~SNAND_E;
+                flcmdcr_val |= CDSRC_E;
                addr_len_bytes = ADRCNT_1;
                break;
        case NAND_CMD_STATUS:
@@ -513,6 +516,8 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
        struct sh_flctl *flctl = mtd_to_flctl(mtd);
        uint32_t read_cmd = 0;
+        pm_runtime_get_sync(&flctl->pdev->dev);
        flctl->read_bytes = 0;
        if (command != NAND_CMD_PAGEPROG)
                flctl->index = 0;
@@ -525,7 +530,6 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
                        execmd_read_page_sector(mtd, page_addr);
                        break;
                }
-                empty_fifo(flctl);
                if (flctl->page_size)
                        set_cmd_regs(mtd, command, (NAND_CMD_READSTART << 8)
                                | command);
@@ -547,7 +551,6 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
                        break;
                }
-                empty_fifo(flctl);
                if (flctl->page_size) {
                        set_cmd_regs(mtd, command, (NAND_CMD_READSTART << 8)
                                | NAND_CMD_READ0);
@@ -559,15 +562,35 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
                flctl->read_bytes = mtd->oobsize;
                goto read_normal_exit;
+        case NAND_CMD_RNDOUT:
+                if (flctl->hwecc)
+                        break;
+                if (flctl->page_size)
+                        set_cmd_regs(mtd, command, (NAND_CMD_RNDOUTSTART << 8)
+                                | command);
+                else
+                        set_cmd_regs(mtd, command, command);
+                set_addr(mtd, column, 0);
+                flctl->read_bytes = mtd->writesize + mtd->oobsize - column;
+                goto read_normal_exit;
        case NAND_CMD_READID:
-                empty_fifo(flctl);
                set_cmd_regs(mtd, command, command);
-                set_addr(mtd, 0, 0);
-                flctl->read_bytes = 4;
+                /* READID is always performed using an 8-bit bus */
+                if (flctl->chip.options & NAND_BUSWIDTH_16)
+                        column <<= 1;
+                set_addr(mtd, column, 0);
+                flctl->read_bytes = 8;
                writel(flctl->read_bytes, FLDTCNTR(flctl)); /* set read size */
+                empty_fifo(flctl);
                start_translation(flctl);
-                read_datareg(flctl, 0); /* read and end */
+                read_fiforeg(flctl, flctl->read_bytes, 0);
+                wait_completion(flctl);
                break;
        case NAND_CMD_ERASE1:
@@ -650,29 +673,55 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
        default:
                break;
        }
-        return;
+        goto runtime_exit;
 read_normal_exit:
        writel(flctl->read_bytes, FLDTCNTR(flctl));     /* set read size */
+        empty_fifo(flctl);
        start_translation(flctl);
        read_fiforeg(flctl, flctl->read_bytes, 0);
        wait_completion(flctl);
+runtime_exit:
+        pm_runtime_put_sync(&flctl->pdev->dev);
        return;
 }
 static void flctl_select_chip(struct mtd_info *mtd, int chipnr)
 {
        struct sh_flctl *flctl = mtd_to_flctl(mtd);
-        uint32_t flcmncr_val = readl(FLCMNCR(flctl));
+        int ret;
        switch (chipnr) {
        case -1:
-                flcmncr_val &= ~CE0_ENABLE;
+                flctl->flcmncr_base &= ~CE0_ENABLE;
-                writel(flcmncr_val, FLCMNCR(flctl));
+                pm_runtime_get_sync(&flctl->pdev->dev);
+                writel(flctl->flcmncr_base, FLCMNCR(flctl));
+                if (flctl->qos_request) {
+                        dev_pm_qos_remove_request(&flctl->pm_qos);
+                        flctl->qos_request = 0;
+                }
+                pm_runtime_put_sync(&flctl->pdev->dev);
                break;
        case 0:
-                flcmncr_val |= CE0_ENABLE;
+                flctl->flcmncr_base |= CE0_ENABLE;
-                writel(flcmncr_val, FLCMNCR(flctl));
+                if (!flctl->qos_request) {
+                        ret = dev_pm_qos_add_request(&flctl->pdev->dev,
+                                                        &flctl->pm_qos, 100);
+                        if (ret < 0)
+                                dev_err(&flctl->pdev->dev,
+                                        "PM QoS request failed: %d\n", ret);
+                        flctl->qos_request = 1;
+                }
+                if (flctl->holden) {
+                        pm_runtime_get_sync(&flctl->pdev->dev);
+                        writel(HOLDEN, FLHOLDCR(flctl));
+                        pm_runtime_put_sync(&flctl->pdev->dev);
+                }
                break;
        default:
                BUG();
@@ -730,11 +779,6 @@ static int flctl_verify_buf(struct mtd_info *mtd, const u_char *buf, int len)
        return 0;
 }
-static void flctl_register_init(struct sh_flctl *flctl, unsigned long val)
-{
-        writel(val, FLCMNCR(flctl));
-}
 static int flctl_chip_init_tail(struct mtd_info *mtd)
 {
        struct sh_flctl *flctl = mtd_to_flctl(mtd);
@@ -781,13 +825,13 @@ static int flctl_chip_init_tail(struct mtd_info *mtd)
                chip->ecc.size = 512;
                chip->ecc.bytes = 10;
+                chip->ecc.strength = 4;
                chip->ecc.read_page = flctl_read_page_hwecc;
                chip->ecc.write_page = flctl_write_page_hwecc;
                chip->ecc.mode = NAND_ECC_HW;
                /* 4 symbols ECC enabled */
-                writel(readl(FLCMNCR(flctl)) | _4ECCEN | ECCPOS2 | ECCPOS_02,
+                flctl->flcmncr_base |= _4ECCEN | ECCPOS2 | ECCPOS_02;
-                                FLCMNCR(flctl));
        } else {
                chip->ecc.mode = NAND_ECC_SOFT;
        }
@@ -819,13 +863,13 @@ static int __devinit flctl_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                dev_err(&pdev->dev, "failed to get I/O memory\n");
-                goto err;
+                goto err_iomap;
        }
        flctl->reg = ioremap(res->start, resource_size(res));
        if (flctl->reg == NULL) {
                dev_err(&pdev->dev, "failed to remap I/O memory\n");
-                goto err;
+                goto err_iomap;
        }
        platform_set_drvdata(pdev, flctl);
@@ -833,9 +877,9 @@ static int __devinit flctl_probe(struct platform_device *pdev)
        nand = &flctl->chip;
        flctl_mtd->priv = nand;
        flctl->pdev = pdev;
+        flctl->flcmncr_base = pdata->flcmncr_val;
        flctl->hwecc = pdata->has_hwecc;
+        flctl->holden = pdata->use_holden;
-        flctl_register_init(flctl, pdata->flcmncr_val);
        nand->options = NAND_NO_AUTOINCR;
@@ -855,23 +899,28 @@ static int __devinit flctl_probe(struct platform_device *pdev)
                nand->read_word = flctl_read_word;
        }
+        pm_runtime_enable(&pdev->dev);
+        pm_runtime_resume(&pdev->dev);
        ret = nand_scan_ident(flctl_mtd, 1, NULL);
        if (ret)
-                goto err;
+                goto err_chip;
        ret = flctl_chip_init_tail(flctl_mtd);
        if (ret)
-                goto err;
+                goto err_chip;
        ret = nand_scan_tail(flctl_mtd);
        if (ret)
-                goto err;
+                goto err_chip;
        mtd_device_register(flctl_mtd, pdata->parts, pdata->nr_parts);
        return 0;
-err:
+err_chip:
+        pm_runtime_disable(&pdev->dev);
+err_iomap:
        kfree(flctl);
        return ret;
 }
@@ -881,6 +930,7 @@ static int __devexit flctl_remove(struct platform_device *pdev)
        struct sh_flctl *flctl = platform_get_drvdata(pdev);
        nand_release(&flctl->mtd);
+        pm_runtime_disable(&pdev->dev);
        kfree(flctl);
        return 0;
diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index b175c0fd8b93..3421e3762a5a 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -167,6 +167,7 @@ static int __devinit sharpsl_nand_probe(struct platform_device *pdev)
        this->ecc.mode = NAND_ECC_HW;
        this->ecc.size = 256;
        this->ecc.bytes = 3;
+        this->ecc.strength = 1;
        this->badblock_pattern = data->badblock_pattern;
        this->ecc.layout = data->ecc_layout;
        this->ecc.hwctl = sharpsl_nand_enable_hwecc;
@@ -181,8 +182,8 @@ static int __devinit sharpsl_nand_probe(struct platform_device *pdev)
        /* Register the partitions */
        sharpsl->mtd.name = "sharpsl-nand";
-        err = mtd_device_parse_register(&sharpsl->mtd, NULL, 0,
+        err = mtd_device_parse_register(&sharpsl->mtd, NULL, NULL,
-                        data->partitions, data->nr_partitions);
+                                        data->partitions, data->nr_partitions);
        if (err)
                goto err_add;
diff --git a/drivers/mtd/nand/tmio_nand.c b/drivers/mtd/nand/tmio_nand.c
index 6caa0cd9d6a7..5aa518081c51 100644
--- a/drivers/mtd/nand/tmio_nand.c
+++ b/drivers/mtd/nand/tmio_nand.c
@@ -430,6 +430,7 @@ static int tmio_probe(struct platform_device *dev)
        nand_chip->ecc.mode = NAND_ECC_HW;
        nand_chip->ecc.size = 512;
        nand_chip->ecc.bytes = 6;
+        nand_chip->ecc.strength = 2;
        nand_chip->ecc.hwctl = tmio_nand_enable_hwecc;
        nand_chip->ecc.calculate = tmio_nand_calculate_ecc;
        nand_chip->ecc.correct = tmio_nand_correct_data;
@@ -456,9 +457,9 @@ static int tmio_probe(struct platform_device *dev)
                goto err_scan;
        }
        /* Register the partitions */
-        retval = mtd_device_parse_register(mtd, NULL, 0,
+        retval = mtd_device_parse_register(mtd, NULL, NULL,
-                        data ? data->partition : NULL,
+                                           data ? data->partition : NULL,
-                        data ? data->num_partitions : 0);
+                                           data ? data->num_partitions : 0);
        if (!retval)
                return retval;
diff --git a/drivers/mtd/nand/txx9ndfmc.c b/drivers/mtd/nand/txx9ndfmc.c
index c7c4f1d11c77..26398dcf21cf 100644
--- a/drivers/mtd/nand/txx9ndfmc.c
+++ b/drivers/mtd/nand/txx9ndfmc.c
@@ -356,6 +356,7 @@ static int __init txx9ndfmc_probe(struct platform_device *dev)
                /* txx9ndfmc_nand_scan will overwrite ecc.size and ecc.bytes */
                chip->ecc.size = 256;
                chip->ecc.bytes = 3;
+                chip->ecc.strength = 1;
                chip->chip_delay = 100;
                chip->controller = &drvdata->hw_control;
@@ -386,7 +387,7 @@ static int __init txx9ndfmc_probe(struct platform_device *dev)
                }
                mtd->name = txx9_priv->mtdname;
-                mtd_device_parse_register(mtd, NULL, 0, NULL, 0);
+                mtd_device_parse_register(mtd, NULL, NULL, NULL, 0);
                drvdata->mtds[i] = mtd;
        }
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index a75382aff5f6..c5f4ebf4b384 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -56,13 +56,6 @@ static void nftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
        if (memcmp(mtd->name, "DiskOnChip", 10))
                return;
-        if (!mtd_can_have_bb(mtd)) {
-                printk(KERN_ERR
-"NFTL no longer supports the old DiskOnChip drivers loaded via docprobe.\n"
-"Please use the new diskonchip driver under the NAND subsystem.\n");
-                return;
-        }
        pr_debug("NFTL: add_mtd for %s\n", mtd->name);
        nftl = kzalloc(sizeof(struct NFTLrecord), GFP_KERNEL);
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index 0ccd5bff2544..1c4f97c63e62 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -70,9 +70,9 @@ static int __devinit generic_onenand_probe(struct platform_device *pdev)
                goto out_iounmap;
        }
-        err = mtd_device_parse_register(&info->mtd, NULL, 0,
+        err = mtd_device_parse_register(&info->mtd, NULL, NULL,
-                        pdata ? pdata->parts : NULL,
+                                        pdata ? pdata->parts : NULL,
-                        pdata ? pdata->nr_parts : 0);
+                                        pdata ? pdata->nr_parts : 0);
        platform_set_drvdata(pdev, info);
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index 7e9ea6852b67..398a82783848 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -751,9 +751,9 @@ static int __devinit omap2_onenand_probe(struct platform_device *pdev)
        if ((r = onenand_scan(&c->mtd, 1)) < 0)
                goto err_release_regulator;
-        r = mtd_device_parse_register(&c->mtd, NULL, 0,
+        r = mtd_device_parse_register(&c->mtd, NULL, NULL,
-                        pdata ? pdata->parts : NULL,
+                                      pdata ? pdata->parts : NULL,
-                        pdata ? pdata->nr_parts : 0);
+                                      pdata ? pdata->nr_parts : 0);
        if (r)
                goto err_release_onenand;
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index a061bc163da2..b3ce12ef359e 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -1753,16 +1753,6 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
        pr_debug("%s: to = 0x%08x, len = %i\n", __func__, (unsigned int)to,
                        (int)len);
-        /* Initialize retlen, in case of early exit */
-        *retlen = 0;
-        /* Do not allow writes past end of device */
-        if (unlikely((to + len) > mtd->size)) {
-                printk(KERN_ERR "%s: Attempt write to past end of device\n",
-                        __func__);
-                return -EINVAL;
-        }
        /* Reject writes, which are not page aligned */
        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
                printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
@@ -1890,13 +1880,6 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
        ops->retlen = 0;
        ops->oobretlen = 0;
-        /* Do not allow writes past end of device */
-        if (unlikely((to + len) > mtd->size)) {
-                printk(KERN_ERR "%s: Attempt write to past end of device\n",
-                        __func__);
-                return -EINVAL;
-        }
        /* Reject writes, which are not page aligned */
        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
                printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
@@ -2493,12 +2476,6 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                        (unsigned long long)instr->addr,
                        (unsigned long long)instr->len);
-        /* Do not allow erase past end of device */
-        if (unlikely((len + addr) > mtd->size)) {
-                printk(KERN_ERR "%s: Erase past end of device\n", __func__);
-                return -EINVAL;
-        }
        if (FLEXONENAND(this)) {
                /* Find the eraseregion of this address */
                int i = flexonenand_region(mtd, addr);
@@ -2525,8 +2502,6 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                return -EINVAL;
        }
-        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* Grab the lock and see if the device is available */
        onenand_get_device(mtd, FL_ERASING);
@@ -4103,33 +4078,34 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        mtd->oobavail = this->ecclayout->oobavail;
        mtd->ecclayout = this->ecclayout;
+        mtd->ecc_strength = 1;
        /* Fill in remaining MTD driver data */
        mtd->type = ONENAND_IS_MLC(this) ? MTD_MLCNANDFLASH : MTD_NANDFLASH;
        mtd->flags = MTD_CAP_NANDFLASH;
-        mtd->erase = onenand_erase;
+        mtd->_erase = onenand_erase;
-        mtd->point = NULL;
+        mtd->_point = NULL;
-        mtd->unpoint = NULL;
+        mtd->_unpoint = NULL;
-        mtd->read = onenand_read;
+        mtd->_read = onenand_read;
-        mtd->write = onenand_write;
+        mtd->_write = onenand_write;
-        mtd->read_oob = onenand_read_oob;
+        mtd->_read_oob = onenand_read_oob;
-        mtd->write_oob = onenand_write_oob;
+        mtd->_write_oob = onenand_write_oob;
-        mtd->panic_write = onenand_panic_write;
+        mtd->_panic_write = onenand_panic_write;
 #ifdef CONFIG_MTD_ONENAND_OTP
-        mtd->get_fact_prot_info = onenand_get_fact_prot_info;
+        mtd->_get_fact_prot_info = onenand_get_fact_prot_info;
-        mtd->read_fact_prot_reg = onenand_read_fact_prot_reg;
+        mtd->_read_fact_prot_reg = onenand_read_fact_prot_reg;
-        mtd->get_user_prot_info = onenand_get_user_prot_info;
+        mtd->_get_user_prot_info = onenand_get_user_prot_info;
-        mtd->read_user_prot_reg = onenand_read_user_prot_reg;
+        mtd->_read_user_prot_reg = onenand_read_user_prot_reg;
-        mtd->write_user_prot_reg = onenand_write_user_prot_reg;
+        mtd->_write_user_prot_reg = onenand_write_user_prot_reg;
-        mtd->lock_user_prot_reg = onenand_lock_user_prot_reg;
+        mtd->_lock_user_prot_reg = onenand_lock_user_prot_reg;
 #endif
-        mtd->sync = onenand_sync;
+        mtd->_sync = onenand_sync;
-        mtd->lock = onenand_lock;
+        mtd->_lock = onenand_lock;
-        mtd->unlock = onenand_unlock;
+        mtd->_unlock = onenand_unlock;
-        mtd->suspend = onenand_suspend;
+        mtd->_suspend = onenand_suspend;
-        mtd->resume = onenand_resume;
+        mtd->_resume = onenand_resume;
-        mtd->block_isbad = onenand_block_isbad;
+        mtd->_block_isbad = onenand_block_isbad;
-        mtd->block_markbad = onenand_block_markbad;
+        mtd->_block_markbad = onenand_block_markbad;
        mtd->owner = THIS_MODULE;
        mtd->writebufsize = mtd->writesize;
diff --git a/drivers/mtd/onenand/samsung.c b/drivers/mtd/onenand/samsung.c
index fa1ee43f735b..8e4b3f2742ba 100644
--- a/drivers/mtd/onenand/samsung.c
+++ b/drivers/mtd/onenand/samsung.c
@@ -923,7 +923,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
                r = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                if (!r) {
                        dev_err(&pdev->dev, "no buffer memory resource defined\n");
-                        return -ENOENT;
+                        err = -ENOENT;
                        goto ahb_resource_failed;
                }
@@ -964,7 +964,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
                r = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                if (!r) {
                        dev_err(&pdev->dev, "no dma memory resource defined\n");
-                        return -ENOENT;
+                        err = -ENOENT;
                        goto dma_resource_failed;
                }
@@ -1014,7 +1014,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
        if (s3c_read_reg(MEM_CFG_OFFSET) & ONENAND_SYS_CFG1_SYNC_READ)
                dev_info(&onenand->pdev->dev, "OneNAND Sync. Burst Read enabled\n");
-        err = mtd_device_parse_register(mtd, NULL, 0,
+        err = mtd_device_parse_register(mtd, NULL, NULL,
                                        pdata ? pdata->parts : NULL,
                                        pdata ? pdata->nr_parts : 0);
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 48970c14beff..580035c803d6 100644
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -78,8 +78,7 @@ static int parse_redboot_partitions(struct mtd_info *master,
        if ( directory < 0 ) {
                offset = master->size + directory * master->erasesize;
-                while (mtd_can_have_bb(master) &&
+                while (mtd_block_isbad(master, offset)) {
-                       mtd_block_isbad(master, offset)) {
                        if (!offset) {
                        nogood:
                                printk(KERN_NOTICE "Failed to find a non-bad block to check for RedBoot partition table\n");
@@ -89,8 +88,7 @@ static int parse_redboot_partitions(struct mtd_info *master,
                }
        } else {
                offset = directory * master->erasesize;
-                while (mtd_can_have_bb(master) &&
+                while (mtd_block_isbad(master, offset)) {
-                       mtd_block_isbad(master, offset)) {
                        offset += master->erasesize;
                        if (offset == master->size)
                                goto nogood;
diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 072ed5970e2f..9e2dfd517aa5 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -1256,7 +1256,7 @@ static void sm_remove_dev(struct mtd_blktrans_dev *dev)
 static struct mtd_blktrans_ops sm_ftl_ops = {
        .name           = "smblk",
-        .major          = -1,
+        .major          = 0,
        .part_bits      = SM_FTL_PARTN_BITS,
        .blksize        = SM_SECTOR_SIZE,
        .getgeo         = sm_getgeo,
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 941bc3c05d6e..90b98822d9a4 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -174,11 +174,7 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
        int err = 0, lnum, offs, total_read;
        struct gluebi_device *gluebi;
-        if (len < 0 || from < 0 || from + len > mtd->size)
-                return -EINVAL;
        gluebi = container_of(mtd, struct gluebi_device, mtd);
        lnum = div_u64_rem(from, mtd->erasesize, &offs);
        total_read = len;
        while (total_read) {
@@ -218,14 +214,7 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
        int err = 0, lnum, offs, total_written;
        struct gluebi_device *gluebi;
-        if (len < 0 || to < 0 || len + to > mtd->size)
-                return -EINVAL;
        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
        lnum = div_u64_rem(to, mtd->erasesize, &offs);
        if (len % mtd->writesize || offs % mtd->writesize)
@@ -265,21 +254,13 @@ static int gluebi_erase(struct mtd_info *mtd, struct erase_info *instr)
        int err, i, lnum, count;
        struct gluebi_device *gluebi;
-        if (instr->addr < 0 || instr->addr > mtd->size - mtd->erasesize)
-                return -EINVAL;
-        if (instr->len < 0 || instr->addr + instr->len > mtd->size)
-                return -EINVAL;
        if (mtd_mod_by_ws(instr->addr, mtd) || mtd_mod_by_ws(instr->len, mtd))
                return -EINVAL;
        lnum = mtd_div_by_eb(instr->addr, mtd);
        count = mtd_div_by_eb(instr->len, mtd);
        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        if (!(mtd->flags & MTD_WRITEABLE))
-                return -EROFS;
        for (i = 0; i < count - 1; i++) {
                err = ubi_leb_unmap(gluebi->desc, lnum + i);
                if (err)
@@ -340,11 +321,11 @@ static int gluebi_create(struct ubi_device_info *di,
        mtd->owner      = THIS_MODULE;
        mtd->writesize  = di->min_io_size;
        mtd->erasesize  = vi->usable_leb_size;
-        mtd->read       = gluebi_read;
+        mtd->_read       = gluebi_read;
-        mtd->write      = gluebi_write;
+        mtd->_write      = gluebi_write;
-        mtd->erase      = gluebi_erase;
+        mtd->_erase      = gluebi_erase;
-        mtd->get_device = gluebi_get_device;
+        mtd->_get_device = gluebi_get_device;
-        mtd->put_device = gluebi_put_device;
+        mtd->_put_device = gluebi_put_device;
        /*
         * In case of dynamic a volume, MTD device size is just volume size. In