Merge git://git.infradead.org/mtd-2.6

* git://git.infradead.org/mtd-2.6:
  [JFFS2] print a message when marking bad block
  [JFFS2] Check for all-zero node headers
  [MTD] [OneNAND] Classify the page data and oob buffer
  [MTD] [OneNAND] Exit the loop when transferring/filling of the oob is finished
  [MTD] [OneNAND] add Nokia Copyright and a credit
  [MTD] [OneNAND] Fix typo & wrong comments
  [MTD] [OneNAND] Use oob buffer instead of main one in oob functions
  [MTD] Correct partition failed erase address
  [JFFS2] Use yield() between GC passes in background thread.
  [MTD] [NAND] Correct misspelled preprocessor variable.
  [MTD] [MAPS] dilnetpc: Fix printk warning
  [MTD] [NOR] Fix oops in cfi_amdstd_sync
  [MTD] ESB2 check for closed ROM window
  [JFFS2] Fix writebuffer recovery in the first page of a block
  [MTD] [NAND] make oobavail public

15 files changed, 115 insertions, 38 deletions

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index e3acd398fb..1f64458404 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -359,6 +359,8 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
                 cfi->chips[i].word_write_time = 1<<cfi->cfiq->WordWriteTimeoutTyp;
                 cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                 cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
         }
 
         map->fldrv = &cfi_amdstd_chipdrv;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 69d49e0250..b344ff858b 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -158,6 +158,8 @@ struct mtd_info *cfi_cmdset_0020(struct map_info *map, int primary)
                 cfi->chips[i].word_write_time = 128;
                 cfi->chips[i].buffer_write_time = 128;
                 cfi->chips[i].erase_time = 1024;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
         }
 
         return cfi_staa_setup(map);
diff --git a/drivers/mtd/maps/dilnetpc.c b/drivers/mtd/maps/dilnetpc.c
index b1104fe1f2..1c3b34ad73 100644
--- a/drivers/mtd/maps/dilnetpc.c
+++ b/drivers/mtd/maps/dilnetpc.c
@@ -402,8 +402,8 @@ static int __init init_dnpc(void)
                         ++higlvl_partition_info[i].name;
         }
 
-        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%lx\n",
-                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, dnpc_map.phys);
+        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%llx\n",
+                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, (unsigned long long)dnpc_map.phys);
 
         dnpc_map.virt = ioremap_nocache(dnpc_map.phys, dnpc_map.size);
 
diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c
index 0bc013fd66..aa64a47527 100644
--- a/drivers/mtd/maps/esb2rom.c
+++ b/drivers/mtd/maps/esb2rom.c
@@ -30,7 +30,7 @@
 
 #define ROM_PROBE_STEP_SIZE (64*1024) /* 64KiB */
 
-#define BIOS_CNTL       0xDC
+#define BIOS_CNTL               0xDC
 #define BIOS_LOCK_ENABLE        0x02
 #define BIOS_WRITE_ENABLE       0x01
 
@@ -145,7 +145,7 @@ static void esb2rom_cleanup(struct esb2rom_window *window)
 }
 
 static int __devinit esb2rom_init_one(struct pci_dev *pdev,
-                                const struct pci_device_id *ent)
+                                      const struct pci_device_id *ent)
 {
         static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL };
         struct esb2rom_window *window = &esb2rom_window;
@@ -185,7 +185,7 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
         /* Find a region continuous to the end of the ROM window  */
         window->phys = 0;
         pci_read_config_word(pdev, FWH_DEC_EN1, &word);
-        printk(KERN_DEBUG "pci_read_config_byte : %x\n", word);
+        printk(KERN_DEBUG "pci_read_config_word : %x\n", word);
 
         if ((word & FWH_8MiB) == FWH_8MiB)
                 window->phys = 0xff400000;
@@ -212,6 +212,11 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
         else if ((word & FWH_0_5MiB) == FWH_0_5MiB)
                 window->phys = 0xfff80000;
 
+        if (window->phys == 0) {
+                printk(KERN_ERR MOD_NAME ": Rom window is closed\n");
+                goto out;
+        }
+
         /* reserved  0x0020 and 0x0010 */
         window->phys -= 0x400000UL;
         window->size = (0xffffffffUL - window->phys) + 1UL;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 880580c44e..41844ea024 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -727,6 +727,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
         concat->mtd.erasesize = subdev[0]->erasesize;
         concat->mtd.writesize = subdev[0]->writesize;
         concat->mtd.oobsize = subdev[0]->oobsize;
+        concat->mtd.oobavail = subdev[0]->oobavail;
         if (subdev[0]->writev)
                 concat->mtd.writev = concat_writev;
         if (subdev[0]->read_oob)
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 633def3fb0..1af989023c 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -200,6 +200,11 @@ static int part_erase (struct mtd_info *mtd, struct erase_info *instr)
                 return -EINVAL;
         instr->addr += part->offset;
         ret = part->master->erase(part->master, instr);
+        if (ret) {
+                if (instr->fail_addr != 0xffffffff)
+                        instr->fail_addr -= part->offset;
+                instr->addr -= part->offset;
+        }
         return ret;
 }
 
@@ -338,6 +343,7 @@ int add_mtd_partitions(struct mtd_info *master,
                 slave->mtd.size = parts[i].size;
                 slave->mtd.writesize = master->writesize;
                 slave->mtd.oobsize = master->oobsize;
+                slave->mtd.oobavail = master->oobavail;
                 slave->mtd.subpage_sft = master->subpage_sft;
 
                 slave->mtd.name = parts[i].name;
@@ -559,4 +565,3 @@ EXPORT_SYMBOL_GPL(deregister_mtd_parser);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
 MODULE_DESCRIPTION("Generic support for partitioning of MTD devices");
-
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 12608c13cc..595208f965 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -114,7 +114,7 @@ module_param(no_autopart, int, 0);
 static int show_firmware_partition = 0;
 module_param(show_firmware_partition, int, 0);
 
-#ifdef MTD_NAND_DISKONCHIP_BBTWRITE
+#ifdef CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE
 static int inftl_bbt_write = 1;
 #else
 static int inftl_bbt_write = 0;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index acaf97bc80..6af37b8cff 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2524,6 +2524,7 @@ int nand_scan_tail(struct mtd_info *mtd)
         for (i = 0; chip->ecc.layout->oobfree[i].length; i++)
                 chip->ecc.layout->oobavail +=
                         chip->ecc.layout->oobfree[i].length;
+        mtd->oobavail = chip->ecc.layout->oobavail;
 
         /*
          * Set the number of read / write steps for one page depending on ECC
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 7f1cb6e5dc..9e14a26ca4 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -4,6 +4,11 @@
  *  Copyright (C) 2005-2007 Samsung Electronics
  *  Kyungmin Park <kyungmin.park@samsung.com>
  *
+ *  Credits:
+ *      Adrian Hunter <ext-adrian.hunter@nokia.com>:
+ *      auto-placement support, read-while load support, various fixes
+ *      Copyright (C) Nokia Corporation, 2007
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -831,7 +836,7 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
         int readcol = column;
         int readend = column + thislen;
         int lastgap = 0;
-        uint8_t *oob_buf = this->page_buf + mtd->writesize;
+        uint8_t *oob_buf = this->oob_buf;
 
         for (free = this->ecclayout->oobfree; free->length; ++free) {
                 if (readcol >= lastgap)
@@ -849,7 +854,8 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
                         int n = ed - st;
                         memcpy(buf, oob_buf + st, n);
                         buf += n;
-                }
+                } else
+                        break;
         }
         return 0;
 }
@@ -947,9 +953,9 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
 
 /**
  * onenand_read_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
- * @from:       offset to read from
- * @ops:        oob operation description structure
+ * @param mtd:          MTD device structure
+ * @param from:         offset to read from
+ * @param ops:          oob operation description structure
  */
 static int onenand_read_oob(struct mtd_info *mtd, loff_t from,
                             struct mtd_oob_ops *ops)
@@ -1017,7 +1023,7 @@ static int onenand_bbt_wait(struct mtd_info *mtd, int state)
  * onenand_bbt_read_oob - [MTD Interface] OneNAND read out-of-band for bbt scan
  * @param mtd           MTD device structure
  * @param from          offset to read from
- * @param @ops          oob operation description structure
+ * @param ops           oob operation description structure
  *
  * OneNAND read out-of-band data from the spare area for bbt scan
  */
@@ -1093,7 +1099,7 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
 static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to)
 {
         struct onenand_chip *this = mtd->priv;
-        char *readp = this->page_buf + mtd->writesize;
+        char oobbuf[64];
         int status, i;
 
         this->command(mtd, ONENAND_CMD_READOOB, to, mtd->oobsize);
@@ -1102,9 +1108,9 @@ static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to
         if (status)
                 return status;
 
-        this->read_bufferram(mtd, ONENAND_SPARERAM, readp, 0, mtd->oobsize);
-        for(i = 0; i < mtd->oobsize; i++)
-                if (buf[i] != 0xFF && buf[i] != readp[i])
+        this->read_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
+        for (i = 0; i < mtd->oobsize; i++)
+                if (buf[i] != 0xFF && buf[i] != oobbuf[i])
                         return -EBADMSG;
 
         return 0;
@@ -1290,7 +1296,8 @@ static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
                         int n = ed - st;
                         memcpy(oob_buf + st, buf, n);
                         buf += n;
-                }
+                } else
+                        break;
         }
         return 0;
 }
@@ -1312,6 +1319,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
         struct onenand_chip *this = mtd->priv;
         int column, ret = 0, oobsize;
         int written = 0;
+        u_char *oobbuf;
 
         DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
 
@@ -1331,7 +1339,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
         }
 
         /* For compatibility with NAND: Do not allow write past end of page */
-        if (column + len > oobsize) {
+        if (unlikely(column + len > oobsize)) {
                 printk(KERN_ERR "onenand_write_oob: "
                       "Attempt to write past end of page\n");
                 return -EINVAL;
@@ -1348,6 +1356,8 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
         /* Grab the lock and see if the device is available */
         onenand_get_device(mtd, FL_WRITING);
 
+        oobbuf = this->oob_buf;
+
         /* Loop until all data write */
         while (written < len) {
                 int thislen = min_t(int, oobsize, len - written);
@@ -1358,12 +1368,12 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
 
                 /* We send data to spare ram with oobsize
                  * to prevent byte access */
-                memset(this->page_buf, 0xff, mtd->oobsize);
+                memset(oobbuf, 0xff, mtd->oobsize);
                 if (mode == MTD_OOB_AUTO)
-                        onenand_fill_auto_oob(mtd, this->page_buf, buf, column, thislen);
+                        onenand_fill_auto_oob(mtd, oobbuf, buf, column, thislen);
                 else
-                        memcpy(this->page_buf + column, buf, thislen);
-                this->write_bufferram(mtd, ONENAND_SPARERAM, this->page_buf, 0, mtd->oobsize);
+                        memcpy(oobbuf + column, buf, thislen);
+                this->write_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
 
                 this->command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
 
@@ -1375,7 +1385,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                         break;
                 }
 
-                ret = onenand_verify_oob(mtd, this->page_buf, to);
+                ret = onenand_verify_oob(mtd, oobbuf, to);
                 if (ret) {
                         printk(KERN_ERR "onenand_write_oob: verify failed %d\n", ret);
                         break;
@@ -1400,9 +1410,9 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
 
 /**
  * onenand_write_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
- * @from:       offset to read from
- * @ops:        oob operation description structure
+ * @param mtd:          MTD device structure
+ * @param to:           offset to write
+ * @param ops:          oob operation description structure
  */
 static int onenand_write_oob(struct mtd_info *mtd, loff_t to,
                              struct mtd_oob_ops *ops)
@@ -1616,6 +1626,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
  * @param mtd           MTD device structure
  * @param ofs           offset relative to mtd start
  * @param len           number of bytes to lock or unlock
+ * @param cmd           lock or unlock command
  *
  * Lock or unlock one or more blocks
  */
@@ -2117,10 +2128,11 @@ static void onenand_check_features(struct mtd_info *mtd)
 }
 
 /**
- * onenand_print_device_info - Print device ID
+ * onenand_print_device_info - Print device & version ID
  * @param device        device ID
+ * @param version       version ID
  *
- * Print device ID
+ * Print device & version ID
  */
 static void onenand_print_device_info(int device, int version)
 {
@@ -2320,15 +2332,25 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
 
         /* Allocate buffers, if necessary */
         if (!this->page_buf) {
-                size_t len;
-                len = mtd->writesize + mtd->oobsize;
-                this->page_buf = kmalloc(len, GFP_KERNEL);
+                this->page_buf = kzalloc(mtd->writesize, GFP_KERNEL);
                 if (!this->page_buf) {
                         printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
                         return -ENOMEM;
                 }
                 this->options |= ONENAND_PAGEBUF_ALLOC;
         }
+        if (!this->oob_buf) {
+                this->oob_buf = kzalloc(mtd->oobsize, GFP_KERNEL);
+                if (!this->oob_buf) {
+                        printk(KERN_ERR "onenand_scan(): Can't allocate oob_buf\n");
+                        if (this->options & ONENAND_PAGEBUF_ALLOC) {
+                                this->options &= ~ONENAND_PAGEBUF_ALLOC;
+                                kfree(this->page_buf);
+                        }
+                        return -ENOMEM;
+                }
+                this->options |= ONENAND_OOBBUF_ALLOC;
+        }
 
         this->state = FL_READY;
         init_waitqueue_head(&this->wq);
@@ -2367,6 +2389,7 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
         for (i = 0; this->ecclayout->oobfree[i].length; i++)
                 this->ecclayout->oobavail +=
                         this->ecclayout->oobfree[i].length;
+        mtd->oobavail = this->ecclayout->oobavail;
 
         mtd->ecclayout = this->ecclayout;
 
@@ -2424,9 +2447,11 @@ void onenand_release(struct mtd_info *mtd)
                 kfree(bbm->bbt);
                 kfree(this->bbm);
         }
-        /* Buffer allocated by onenand_scan */
+        /* Buffers allocated by onenand_scan */
         if (this->options & ONENAND_PAGEBUF_ALLOC)
                 kfree(this->page_buf);
+        if (this->options & ONENAND_OOBBUF_ALLOC)
+                kfree(this->oob_buf);
 }
 
 EXPORT_SYMBOL_GPL(onenand_scan);
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 6eb3daebd5..888f236e54 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -99,7 +99,13 @@ static int jffs2_garbage_collect_thread(void *_c)
                 if (try_to_freeze())
                         continue;
 
-                cond_resched();
+                /* This thread is purely an optimisation. But if it runs when
+                   other things could be running, it actually makes things a
+                   lot worse. Use yield() and put it at the back of the runqueue
+                   every time. Especially during boot, pulling an inode in
+                   with read_inode() is much preferable to having the GC thread
+                   get there first. */
+                yield();
 
                 /* Put_super will send a SIGKILL and then wait on the sem.
                  */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 58a0b912e9..717a48cf7d 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -373,7 +373,14 @@ free_out:
 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 {
         /* We don't mark unknown nodes as REF_UNCHECKED */
-        BUG_ON(ref_flags(ref) == REF_UNCHECKED);
+        if (ref_flags(ref) == REF_UNCHECKED) {
+                JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
+                            ref_offset(ref));
+                JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
+                            je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
+                            je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
+                return 1;
+        }
 
         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 
@@ -576,6 +583,13 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                         jffs2_mark_node_obsolete(c, ref);
                         goto cont;
                 }
+                /* Due to poor choice of crc32 seed, an all-zero node will have a correct CRC */
+                if (!je32_to_cpu(node->u.hdr_crc) && !je16_to_cpu(node->u.nodetype) &&
+                    !je16_to_cpu(node->u.magic) && !je32_to_cpu(node->u.totlen)) {
+                        JFFS2_NOTICE("All zero node header at %#08x.\n", ref_offset(ref));
+                        jffs2_mark_node_obsolete(c, ref);
+                        goto cont;
+                }
 
                 switch (je16_to_cpu(node->u.nodetype)) {
 
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index 31c1475d92..7fb45bd491 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -734,6 +734,15 @@ scan_more:
                         ofs += 4;
                         continue;
                 }
+                /* Due to poor choice of crc32 seed, an all-zero node will have a correct CRC */
+                if (!je32_to_cpu(node->hdr_crc) && !je16_to_cpu(node->nodetype) &&
+                    !je16_to_cpu(node->magic) && !je32_to_cpu(node->totlen)) {
+                        noisy_printk(&noise, "jffs2_scan_eraseblock(): All zero node header at 0x%08x.\n", ofs);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
+                        ofs += 4;
+                        continue;
+                }
 
                 if (ofs + je32_to_cpu(node->totlen) >
                     jeb->offset + c->sector_size) {
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index de718e3a16..4fac6dd539 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -238,7 +238,10 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
         jeb = &c->blocks[c->wbuf_ofs / c->sector_size];
 
         spin_lock(&c->erase_completion_lock);
-        jffs2_block_refile(c, jeb, REFILE_NOTEMPTY);
+        if (c->wbuf_ofs % c->mtd->erasesize)
+                jffs2_block_refile(c, jeb, REFILE_NOTEMPTY);
+        else
+                jffs2_block_refile(c, jeb, REFILE_ANYWAY);
         spin_unlock(&c->erase_completion_lock);
 
         BUG_ON(!ref_obsolete(jeb->last_node));
@@ -1087,7 +1090,7 @@ int jffs2_write_nand_badblock(struct jffs2_sb_info *c, struct jffs2_eraseblock *
         if (!c->mtd->block_markbad)
                 return 1; // What else can we do?
 
-        D1(printk(KERN_WARNING "jffs2_write_nand_badblock(): Marking bad block at %08x\n", bad_offset));
+        printk(KERN_WARNING "JFFS2: marking eraseblock at %08x\n as bad", bad_offset);
         ret = c->mtd->block_markbad(c->mtd, bad_offset);
 
         if (ret) {
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 6a8570be33..3d956c3abb 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -121,6 +121,7 @@ struct mtd_info {
         u_int32_t writesize;
 
         u_int32_t oobsize;   // Amount of OOB data per block (e.g. 16)
+        u_int32_t oobavail;  // Available OOB bytes per block
 
         // Kernel-only stuff starts here.
         char *name;
diff --git a/include/linux/mtd/onenand.h b/include/linux/mtd/onenand.h
index d8af8a95e5..a56d24ada5 100644
--- a/include/linux/mtd/onenand.h
+++ b/include/linux/mtd/onenand.h
@@ -82,7 +82,8 @@ struct onenand_bufferram {
  * @wq:                 [INTERN] wait queue to sleep on if a OneNAND
  *                      operation is in progress
  * @state:              [INTERN] the current state of the OneNAND device
- * @page_buf:           data buffer
+ * @page_buf:           [INTERN] page main data buffer
+ * @oob_buf:            [INTERN] page oob data buffer
  * @subpagesize:        [INTERN] holds the subpagesize
  * @ecclayout:          [REPLACEABLE] the default ecc placement scheme
  * @bbm:                [REPLACEABLE] pointer to Bad Block Management
@@ -122,6 +123,7 @@ struct onenand_chip {
         wait_queue_head_t       wq;
         onenand_state_t         state;
         unsigned char           *page_buf;
+        unsigned char           *oob_buf;
 
         int                     subpagesize;
         struct nand_ecclayout   *ecclayout;
@@ -156,6 +158,7 @@ struct onenand_chip {
 #define ONENAND_HAS_CONT_LOCK           (0x0001)
 #define ONENAND_HAS_UNLOCK_ALL          (0x0002)
 #define ONENAND_PAGEBUF_ALLOC           (0x1000)
+#define ONENAND_OOBBUF_ALLOC            (0x2000)
 
 /*
  * OneNAND Flash Manufacturer ID Codes