1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright © 2010-2015 Broadcom Corporation
4  */
5 
6 #include <linux/clk.h>
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/delay.h>
10 #include <linux/device.h>
11 #include <linux/platform_device.h>
12 #include <linux/err.h>
13 #include <linux/completion.h>
14 #include <linux/interrupt.h>
15 #include <linux/spinlock.h>
16 #include <linux/dma-mapping.h>
17 #include <linux/ioport.h>
18 #include <linux/bug.h>
19 #include <linux/kernel.h>
20 #include <linux/bitops.h>
21 #include <linux/mm.h>
22 #include <linux/mtd/mtd.h>
23 #include <linux/mtd/rawnand.h>
24 #include <linux/mtd/partitions.h>
25 #include <linux/of.h>
26 #include <linux/of_platform.h>
27 #include <linux/slab.h>
28 #include <linux/list.h>
29 #include <linux/log2.h>
30 
31 #include "brcmnand.h"
32 
33 /*
34  * This flag controls if WP stays on between erase/write commands to mitigate
35  * flash corruption due to power glitches. Values:
36  * 0: NAND_WP is not used or not available
37  * 1: NAND_WP is set by default, cleared for erase/write operations
38  * 2: NAND_WP is always cleared
39  */
40 static int wp_on = 1;
41 module_param(wp_on, int, 0444);
42 
43 /***********************************************************************
44  * Definitions
45  ***********************************************************************/
46 
47 #define DRV_NAME			"brcmnand"
48 
49 #define CMD_NULL			0x00
50 #define CMD_PAGE_READ			0x01
51 #define CMD_SPARE_AREA_READ		0x02
52 #define CMD_STATUS_READ			0x03
53 #define CMD_PROGRAM_PAGE		0x04
54 #define CMD_PROGRAM_SPARE_AREA		0x05
55 #define CMD_COPY_BACK			0x06
56 #define CMD_DEVICE_ID_READ		0x07
57 #define CMD_BLOCK_ERASE			0x08
58 #define CMD_FLASH_RESET			0x09
59 #define CMD_BLOCKS_LOCK			0x0a
60 #define CMD_BLOCKS_LOCK_DOWN		0x0b
61 #define CMD_BLOCKS_UNLOCK		0x0c
62 #define CMD_READ_BLOCKS_LOCK_STATUS	0x0d
63 #define CMD_PARAMETER_READ		0x0e
64 #define CMD_PARAMETER_CHANGE_COL	0x0f
65 #define CMD_LOW_LEVEL_OP		0x10
66 
67 struct brcm_nand_dma_desc {
68 	u32 next_desc;
69 	u32 next_desc_ext;
70 	u32 cmd_irq;
71 	u32 dram_addr;
72 	u32 dram_addr_ext;
73 	u32 tfr_len;
74 	u32 total_len;
75 	u32 flash_addr;
76 	u32 flash_addr_ext;
77 	u32 cs;
78 	u32 pad2[5];
79 	u32 status_valid;
80 } __packed;
81 
82 /* Bitfields for brcm_nand_dma_desc::status_valid */
83 #define FLASH_DMA_ECC_ERROR	(1 << 8)
84 #define FLASH_DMA_CORR_ERROR	(1 << 9)
85 
86 /* Bitfields for DMA_MODE */
87 #define FLASH_DMA_MODE_STOP_ON_ERROR	BIT(1) /* stop in Uncorr ECC error */
88 #define FLASH_DMA_MODE_MODE		BIT(0) /* link list */
89 #define FLASH_DMA_MODE_MASK		(FLASH_DMA_MODE_STOP_ON_ERROR |	\
90 						FLASH_DMA_MODE_MODE)
91 
92 /* 512B flash cache in the NAND controller HW */
93 #define FC_SHIFT		9U
94 #define FC_BYTES		512U
95 #define FC_WORDS		(FC_BYTES >> 2)
96 
97 #define BRCMNAND_MIN_PAGESIZE	512
98 #define BRCMNAND_MIN_BLOCKSIZE	(8 * 1024)
99 #define BRCMNAND_MIN_DEVSIZE	(4ULL * 1024 * 1024)
100 
101 #define NAND_CTRL_RDY			(INTFC_CTLR_READY | INTFC_FLASH_READY)
102 #define NAND_POLL_STATUS_TIMEOUT_MS	100
103 
104 #define EDU_CMD_WRITE          0x00
105 #define EDU_CMD_READ           0x01
106 #define EDU_STATUS_ACTIVE      BIT(0)
107 #define EDU_ERR_STATUS_ERRACK  BIT(0)
108 #define EDU_DONE_MASK		GENMASK(1, 0)
109 
110 #define EDU_CONFIG_MODE_NAND   BIT(0)
111 #define EDU_CONFIG_SWAP_BYTE   BIT(1)
112 #ifdef CONFIG_CPU_BIG_ENDIAN
113 #define EDU_CONFIG_SWAP_CFG     EDU_CONFIG_SWAP_BYTE
114 #else
115 #define EDU_CONFIG_SWAP_CFG     0
116 #endif
117 
118 /* edu registers */
119 enum edu_reg {
120 	EDU_CONFIG = 0,
121 	EDU_DRAM_ADDR,
122 	EDU_EXT_ADDR,
123 	EDU_LENGTH,
124 	EDU_CMD,
125 	EDU_STOP,
126 	EDU_STATUS,
127 	EDU_DONE,
128 	EDU_ERR_STATUS,
129 };
130 
131 static const u16  edu_regs[] = {
132 	[EDU_CONFIG] = 0x00,
133 	[EDU_DRAM_ADDR] = 0x04,
134 	[EDU_EXT_ADDR] = 0x08,
135 	[EDU_LENGTH] = 0x0c,
136 	[EDU_CMD] = 0x10,
137 	[EDU_STOP] = 0x14,
138 	[EDU_STATUS] = 0x18,
139 	[EDU_DONE] = 0x1c,
140 	[EDU_ERR_STATUS] = 0x20,
141 };
142 
143 /* flash_dma registers */
144 enum flash_dma_reg {
145 	FLASH_DMA_REVISION = 0,
146 	FLASH_DMA_FIRST_DESC,
147 	FLASH_DMA_FIRST_DESC_EXT,
148 	FLASH_DMA_CTRL,
149 	FLASH_DMA_MODE,
150 	FLASH_DMA_STATUS,
151 	FLASH_DMA_INTERRUPT_DESC,
152 	FLASH_DMA_INTERRUPT_DESC_EXT,
153 	FLASH_DMA_ERROR_STATUS,
154 	FLASH_DMA_CURRENT_DESC,
155 	FLASH_DMA_CURRENT_DESC_EXT,
156 };
157 
158 /* flash_dma registers v0*/
159 static const u16 flash_dma_regs_v0[] = {
160 	[FLASH_DMA_REVISION]		= 0x00,
161 	[FLASH_DMA_FIRST_DESC]		= 0x04,
162 	[FLASH_DMA_CTRL]		= 0x08,
163 	[FLASH_DMA_MODE]		= 0x0c,
164 	[FLASH_DMA_STATUS]		= 0x10,
165 	[FLASH_DMA_INTERRUPT_DESC]	= 0x14,
166 	[FLASH_DMA_ERROR_STATUS]	= 0x18,
167 	[FLASH_DMA_CURRENT_DESC]	= 0x1c,
168 };
169 
170 /* flash_dma registers v1*/
171 static const u16 flash_dma_regs_v1[] = {
172 	[FLASH_DMA_REVISION]		= 0x00,
173 	[FLASH_DMA_FIRST_DESC]		= 0x04,
174 	[FLASH_DMA_FIRST_DESC_EXT]	= 0x08,
175 	[FLASH_DMA_CTRL]		= 0x0c,
176 	[FLASH_DMA_MODE]		= 0x10,
177 	[FLASH_DMA_STATUS]		= 0x14,
178 	[FLASH_DMA_INTERRUPT_DESC]	= 0x18,
179 	[FLASH_DMA_INTERRUPT_DESC_EXT]	= 0x1c,
180 	[FLASH_DMA_ERROR_STATUS]	= 0x20,
181 	[FLASH_DMA_CURRENT_DESC]	= 0x24,
182 	[FLASH_DMA_CURRENT_DESC_EXT]	= 0x28,
183 };
184 
185 /* flash_dma registers v4 */
186 static const u16 flash_dma_regs_v4[] = {
187 	[FLASH_DMA_REVISION]		= 0x00,
188 	[FLASH_DMA_FIRST_DESC]		= 0x08,
189 	[FLASH_DMA_FIRST_DESC_EXT]	= 0x0c,
190 	[FLASH_DMA_CTRL]		= 0x10,
191 	[FLASH_DMA_MODE]		= 0x14,
192 	[FLASH_DMA_STATUS]		= 0x18,
193 	[FLASH_DMA_INTERRUPT_DESC]	= 0x20,
194 	[FLASH_DMA_INTERRUPT_DESC_EXT]	= 0x24,
195 	[FLASH_DMA_ERROR_STATUS]	= 0x28,
196 	[FLASH_DMA_CURRENT_DESC]	= 0x30,
197 	[FLASH_DMA_CURRENT_DESC_EXT]	= 0x34,
198 };
199 
200 /* Controller feature flags */
201 enum {
202 	BRCMNAND_HAS_1K_SECTORS			= BIT(0),
203 	BRCMNAND_HAS_PREFETCH			= BIT(1),
204 	BRCMNAND_HAS_CACHE_MODE			= BIT(2),
205 	BRCMNAND_HAS_WP				= BIT(3),
206 };
207 
208 struct brcmnand_host;
209 
210 struct brcmnand_controller {
211 	struct device		*dev;
212 	struct nand_controller	controller;
213 	void __iomem		*nand_base;
214 	void __iomem		*nand_fc; /* flash cache */
215 	void __iomem		*flash_dma_base;
216 	unsigned int		irq;
217 	unsigned int		dma_irq;
218 	int			nand_version;
219 
220 	/* Some SoCs provide custom interrupt status register(s) */
221 	struct brcmnand_soc	*soc;
222 
223 	/* Some SoCs have a gateable clock for the controller */
224 	struct clk		*clk;
225 
226 	int			cmd_pending;
227 	bool			dma_pending;
228 	bool                    edu_pending;
229 	struct completion	done;
230 	struct completion	dma_done;
231 	struct completion       edu_done;
232 
233 	/* List of NAND hosts (one for each chip-select) */
234 	struct list_head host_list;
235 
236 	/* EDU info, per-transaction */
237 	const u16               *edu_offsets;
238 	void __iomem            *edu_base;
239 	int			edu_irq;
240 	int                     edu_count;
241 	u64                     edu_dram_addr;
242 	u32                     edu_ext_addr;
243 	u32                     edu_cmd;
244 	u32                     edu_config;
245 
246 	/* flash_dma reg */
247 	const u16		*flash_dma_offsets;
248 	struct brcm_nand_dma_desc *dma_desc;
249 	dma_addr_t		dma_pa;
250 
251 	int (*dma_trans)(struct brcmnand_host *host, u64 addr, u32 *buf,
252 			 u32 len, u8 dma_cmd);
253 
254 	/* in-memory cache of the FLASH_CACHE, used only for some commands */
255 	u8			flash_cache[FC_BYTES];
256 
257 	/* Controller revision details */
258 	const u16		*reg_offsets;
259 	unsigned int		reg_spacing; /* between CS1, CS2, ... regs */
260 	const u8		*cs_offsets; /* within each chip-select */
261 	const u8		*cs0_offsets; /* within CS0, if different */
262 	unsigned int		max_block_size;
263 	const unsigned int	*block_sizes;
264 	unsigned int		max_page_size;
265 	const unsigned int	*page_sizes;
266 	unsigned int		page_size_shift;
267 	unsigned int		max_oob;
268 	u32			features;
269 
270 	/* for low-power standby/resume only */
271 	u32			nand_cs_nand_select;
272 	u32			nand_cs_nand_xor;
273 	u32			corr_stat_threshold;
274 	u32			flash_dma_mode;
275 	u32                     flash_edu_mode;
276 	bool			pio_poll_mode;
277 };
278 
279 struct brcmnand_cfg {
280 	u64			device_size;
281 	unsigned int		block_size;
282 	unsigned int		page_size;
283 	unsigned int		spare_area_size;
284 	unsigned int		device_width;
285 	unsigned int		col_adr_bytes;
286 	unsigned int		blk_adr_bytes;
287 	unsigned int		ful_adr_bytes;
288 	unsigned int		sector_size_1k;
289 	unsigned int		ecc_level;
290 	/* use for low-power standby/resume only */
291 	u32			acc_control;
292 	u32			config;
293 	u32			config_ext;
294 	u32			timing_1;
295 	u32			timing_2;
296 };
297 
298 struct brcmnand_host {
299 	struct list_head	node;
300 
301 	struct nand_chip	chip;
302 	struct platform_device	*pdev;
303 	int			cs;
304 
305 	unsigned int		last_cmd;
306 	unsigned int		last_byte;
307 	u64			last_addr;
308 	struct brcmnand_cfg	hwcfg;
309 	struct brcmnand_controller *ctrl;
310 };
311 
312 enum brcmnand_reg {
313 	BRCMNAND_CMD_START = 0,
314 	BRCMNAND_CMD_EXT_ADDRESS,
315 	BRCMNAND_CMD_ADDRESS,
316 	BRCMNAND_INTFC_STATUS,
317 	BRCMNAND_CS_SELECT,
318 	BRCMNAND_CS_XOR,
319 	BRCMNAND_LL_OP,
320 	BRCMNAND_CS0_BASE,
321 	BRCMNAND_CS1_BASE,		/* CS1 regs, if non-contiguous */
322 	BRCMNAND_CORR_THRESHOLD,
323 	BRCMNAND_CORR_THRESHOLD_EXT,
324 	BRCMNAND_UNCORR_COUNT,
325 	BRCMNAND_CORR_COUNT,
326 	BRCMNAND_CORR_EXT_ADDR,
327 	BRCMNAND_CORR_ADDR,
328 	BRCMNAND_UNCORR_EXT_ADDR,
329 	BRCMNAND_UNCORR_ADDR,
330 	BRCMNAND_SEMAPHORE,
331 	BRCMNAND_ID,
332 	BRCMNAND_ID_EXT,
333 	BRCMNAND_LL_RDATA,
334 	BRCMNAND_OOB_READ_BASE,
335 	BRCMNAND_OOB_READ_10_BASE,	/* offset 0x10, if non-contiguous */
336 	BRCMNAND_OOB_WRITE_BASE,
337 	BRCMNAND_OOB_WRITE_10_BASE,	/* offset 0x10, if non-contiguous */
338 	BRCMNAND_FC_BASE,
339 };
340 
341 /* BRCMNAND v2.1-v2.2 */
342 static const u16 brcmnand_regs_v21[] = {
343 	[BRCMNAND_CMD_START]		=  0x04,
344 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
345 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
346 	[BRCMNAND_INTFC_STATUS]		=  0x5c,
347 	[BRCMNAND_CS_SELECT]		=  0x14,
348 	[BRCMNAND_CS_XOR]		=  0x18,
349 	[BRCMNAND_LL_OP]		=     0,
350 	[BRCMNAND_CS0_BASE]		=  0x40,
351 	[BRCMNAND_CS1_BASE]		=     0,
352 	[BRCMNAND_CORR_THRESHOLD]	=     0,
353 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
354 	[BRCMNAND_UNCORR_COUNT]		=     0,
355 	[BRCMNAND_CORR_COUNT]		=     0,
356 	[BRCMNAND_CORR_EXT_ADDR]	=  0x60,
357 	[BRCMNAND_CORR_ADDR]		=  0x64,
358 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x68,
359 	[BRCMNAND_UNCORR_ADDR]		=  0x6c,
360 	[BRCMNAND_SEMAPHORE]		=  0x50,
361 	[BRCMNAND_ID]			=  0x54,
362 	[BRCMNAND_ID_EXT]		=     0,
363 	[BRCMNAND_LL_RDATA]		=     0,
364 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
365 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
366 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
367 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
368 	[BRCMNAND_FC_BASE]		= 0x200,
369 };
370 
371 /* BRCMNAND v3.3-v4.0 */
372 static const u16 brcmnand_regs_v33[] = {
373 	[BRCMNAND_CMD_START]		=  0x04,
374 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
375 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
376 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
377 	[BRCMNAND_CS_SELECT]		=  0x14,
378 	[BRCMNAND_CS_XOR]		=  0x18,
379 	[BRCMNAND_LL_OP]		= 0x178,
380 	[BRCMNAND_CS0_BASE]		=  0x40,
381 	[BRCMNAND_CS1_BASE]		=  0xd0,
382 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
383 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
384 	[BRCMNAND_UNCORR_COUNT]		=     0,
385 	[BRCMNAND_CORR_COUNT]		=     0,
386 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
387 	[BRCMNAND_CORR_ADDR]		=  0x74,
388 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
389 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
390 	[BRCMNAND_SEMAPHORE]		=  0x58,
391 	[BRCMNAND_ID]			=  0x60,
392 	[BRCMNAND_ID_EXT]		=  0x64,
393 	[BRCMNAND_LL_RDATA]		= 0x17c,
394 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
395 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
396 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
397 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
398 	[BRCMNAND_FC_BASE]		= 0x200,
399 };
400 
401 /* BRCMNAND v5.0 */
402 static const u16 brcmnand_regs_v50[] = {
403 	[BRCMNAND_CMD_START]		=  0x04,
404 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
405 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
406 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
407 	[BRCMNAND_CS_SELECT]		=  0x14,
408 	[BRCMNAND_CS_XOR]		=  0x18,
409 	[BRCMNAND_LL_OP]		= 0x178,
410 	[BRCMNAND_CS0_BASE]		=  0x40,
411 	[BRCMNAND_CS1_BASE]		=  0xd0,
412 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
413 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
414 	[BRCMNAND_UNCORR_COUNT]		=     0,
415 	[BRCMNAND_CORR_COUNT]		=     0,
416 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
417 	[BRCMNAND_CORR_ADDR]		=  0x74,
418 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
419 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
420 	[BRCMNAND_SEMAPHORE]		=  0x58,
421 	[BRCMNAND_ID]			=  0x60,
422 	[BRCMNAND_ID_EXT]		=  0x64,
423 	[BRCMNAND_LL_RDATA]		= 0x17c,
424 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
425 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
426 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
427 	[BRCMNAND_OOB_WRITE_10_BASE]	= 0x140,
428 	[BRCMNAND_FC_BASE]		= 0x200,
429 };
430 
431 /* BRCMNAND v6.0 - v7.1 */
432 static const u16 brcmnand_regs_v60[] = {
433 	[BRCMNAND_CMD_START]		=  0x04,
434 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
435 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
436 	[BRCMNAND_INTFC_STATUS]		=  0x14,
437 	[BRCMNAND_CS_SELECT]		=  0x18,
438 	[BRCMNAND_CS_XOR]		=  0x1c,
439 	[BRCMNAND_LL_OP]		=  0x20,
440 	[BRCMNAND_CS0_BASE]		=  0x50,
441 	[BRCMNAND_CS1_BASE]		=     0,
442 	[BRCMNAND_CORR_THRESHOLD]	=  0xc0,
443 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xc4,
444 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
445 	[BRCMNAND_CORR_COUNT]		= 0x100,
446 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
447 	[BRCMNAND_CORR_ADDR]		= 0x110,
448 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
449 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
450 	[BRCMNAND_SEMAPHORE]		= 0x150,
451 	[BRCMNAND_ID]			= 0x194,
452 	[BRCMNAND_ID_EXT]		= 0x198,
453 	[BRCMNAND_LL_RDATA]		= 0x19c,
454 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
455 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
456 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
457 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
458 	[BRCMNAND_FC_BASE]		= 0x400,
459 };
460 
461 /* BRCMNAND v7.1 */
462 static const u16 brcmnand_regs_v71[] = {
463 	[BRCMNAND_CMD_START]		=  0x04,
464 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
465 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
466 	[BRCMNAND_INTFC_STATUS]		=  0x14,
467 	[BRCMNAND_CS_SELECT]		=  0x18,
468 	[BRCMNAND_CS_XOR]		=  0x1c,
469 	[BRCMNAND_LL_OP]		=  0x20,
470 	[BRCMNAND_CS0_BASE]		=  0x50,
471 	[BRCMNAND_CS1_BASE]		=     0,
472 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
473 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
474 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
475 	[BRCMNAND_CORR_COUNT]		= 0x100,
476 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
477 	[BRCMNAND_CORR_ADDR]		= 0x110,
478 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
479 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
480 	[BRCMNAND_SEMAPHORE]		= 0x150,
481 	[BRCMNAND_ID]			= 0x194,
482 	[BRCMNAND_ID_EXT]		= 0x198,
483 	[BRCMNAND_LL_RDATA]		= 0x19c,
484 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
485 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
486 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
487 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
488 	[BRCMNAND_FC_BASE]		= 0x400,
489 };
490 
491 /* BRCMNAND v7.2 */
492 static const u16 brcmnand_regs_v72[] = {
493 	[BRCMNAND_CMD_START]		=  0x04,
494 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
495 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
496 	[BRCMNAND_INTFC_STATUS]		=  0x14,
497 	[BRCMNAND_CS_SELECT]		=  0x18,
498 	[BRCMNAND_CS_XOR]		=  0x1c,
499 	[BRCMNAND_LL_OP]		=  0x20,
500 	[BRCMNAND_CS0_BASE]		=  0x50,
501 	[BRCMNAND_CS1_BASE]		=     0,
502 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
503 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
504 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
505 	[BRCMNAND_CORR_COUNT]		= 0x100,
506 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
507 	[BRCMNAND_CORR_ADDR]		= 0x110,
508 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
509 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
510 	[BRCMNAND_SEMAPHORE]		= 0x150,
511 	[BRCMNAND_ID]			= 0x194,
512 	[BRCMNAND_ID_EXT]		= 0x198,
513 	[BRCMNAND_LL_RDATA]		= 0x19c,
514 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
515 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
516 	[BRCMNAND_OOB_WRITE_BASE]	= 0x400,
517 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
518 	[BRCMNAND_FC_BASE]		= 0x600,
519 };
520 
521 enum brcmnand_cs_reg {
522 	BRCMNAND_CS_CFG_EXT = 0,
523 	BRCMNAND_CS_CFG,
524 	BRCMNAND_CS_ACC_CONTROL,
525 	BRCMNAND_CS_TIMING1,
526 	BRCMNAND_CS_TIMING2,
527 };
528 
529 /* Per chip-select offsets for v7.1 */
530 static const u8 brcmnand_cs_offsets_v71[] = {
531 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
532 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
533 	[BRCMNAND_CS_CFG]		= 0x08,
534 	[BRCMNAND_CS_TIMING1]		= 0x0c,
535 	[BRCMNAND_CS_TIMING2]		= 0x10,
536 };
537 
538 /* Per chip-select offsets for pre v7.1, except CS0 on <= v5.0 */
539 static const u8 brcmnand_cs_offsets[] = {
540 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
541 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
542 	[BRCMNAND_CS_CFG]		= 0x04,
543 	[BRCMNAND_CS_TIMING1]		= 0x08,
544 	[BRCMNAND_CS_TIMING2]		= 0x0c,
545 };
546 
547 /* Per chip-select offset for <= v5.0 on CS0 only */
548 static const u8 brcmnand_cs_offsets_cs0[] = {
549 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
550 	[BRCMNAND_CS_CFG_EXT]		= 0x08,
551 	[BRCMNAND_CS_CFG]		= 0x08,
552 	[BRCMNAND_CS_TIMING1]		= 0x10,
553 	[BRCMNAND_CS_TIMING2]		= 0x14,
554 };
555 
556 /*
557  * Bitfields for the CFG and CFG_EXT registers. Pre-v7.1 controllers only had
558  * one config register, but once the bitfields overflowed, newer controllers
559  * (v7.1 and newer) added a CFG_EXT register and shuffled a few fields around.
560  */
561 enum {
562 	CFG_BLK_ADR_BYTES_SHIFT		= 8,
563 	CFG_COL_ADR_BYTES_SHIFT		= 12,
564 	CFG_FUL_ADR_BYTES_SHIFT		= 16,
565 	CFG_BUS_WIDTH_SHIFT		= 23,
566 	CFG_BUS_WIDTH			= BIT(CFG_BUS_WIDTH_SHIFT),
567 	CFG_DEVICE_SIZE_SHIFT		= 24,
568 
569 	/* Only for v2.1 */
570 	CFG_PAGE_SIZE_SHIFT_v2_1	= 30,
571 
572 	/* Only for pre-v7.1 (with no CFG_EXT register) */
573 	CFG_PAGE_SIZE_SHIFT		= 20,
574 	CFG_BLK_SIZE_SHIFT		= 28,
575 
576 	/* Only for v7.1+ (with CFG_EXT register) */
577 	CFG_EXT_PAGE_SIZE_SHIFT		= 0,
578 	CFG_EXT_BLK_SIZE_SHIFT		= 4,
579 };
580 
581 /* BRCMNAND_INTFC_STATUS */
582 enum {
583 	INTFC_FLASH_STATUS		= GENMASK(7, 0),
584 
585 	INTFC_ERASED			= BIT(27),
586 	INTFC_OOB_VALID			= BIT(28),
587 	INTFC_CACHE_VALID		= BIT(29),
588 	INTFC_FLASH_READY		= BIT(30),
589 	INTFC_CTLR_READY		= BIT(31),
590 };
591 
592 static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
593 {
594 	return brcmnand_readl(ctrl->nand_base + offs);
595 }
596 
597 static inline void nand_writereg(struct brcmnand_controller *ctrl, u32 offs,
598 				 u32 val)
599 {
600 	brcmnand_writel(val, ctrl->nand_base + offs);
601 }
602 
603 static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
604 {
605 	static const unsigned int block_sizes_v6[] = { 8, 16, 128, 256, 512, 1024, 2048, 0 };
606 	static const unsigned int block_sizes_v4[] = { 16, 128, 8, 512, 256, 1024, 2048, 0 };
607 	static const unsigned int block_sizes_v2_2[] = { 16, 128, 8, 512, 256, 0 };
608 	static const unsigned int block_sizes_v2_1[] = { 16, 128, 8, 512, 0 };
609 	static const unsigned int page_sizes_v3_4[] = { 512, 2048, 4096, 8192, 0 };
610 	static const unsigned int page_sizes_v2_2[] = { 512, 2048, 4096, 0 };
611 	static const unsigned int page_sizes_v2_1[] = { 512, 2048, 0 };
612 
613 	ctrl->nand_version = nand_readreg(ctrl, 0) & 0xffff;
614 
615 	/* Only support v2.1+ */
616 	if (ctrl->nand_version < 0x0201) {
617 		dev_err(ctrl->dev, "version %#x not supported\n",
618 			ctrl->nand_version);
619 		return -ENODEV;
620 	}
621 
622 	/* Register offsets */
623 	if (ctrl->nand_version >= 0x0702)
624 		ctrl->reg_offsets = brcmnand_regs_v72;
625 	else if (ctrl->nand_version == 0x0701)
626 		ctrl->reg_offsets = brcmnand_regs_v71;
627 	else if (ctrl->nand_version >= 0x0600)
628 		ctrl->reg_offsets = brcmnand_regs_v60;
629 	else if (ctrl->nand_version >= 0x0500)
630 		ctrl->reg_offsets = brcmnand_regs_v50;
631 	else if (ctrl->nand_version >= 0x0303)
632 		ctrl->reg_offsets = brcmnand_regs_v33;
633 	else if (ctrl->nand_version >= 0x0201)
634 		ctrl->reg_offsets = brcmnand_regs_v21;
635 
636 	/* Chip-select stride */
637 	if (ctrl->nand_version >= 0x0701)
638 		ctrl->reg_spacing = 0x14;
639 	else
640 		ctrl->reg_spacing = 0x10;
641 
642 	/* Per chip-select registers */
643 	if (ctrl->nand_version >= 0x0701) {
644 		ctrl->cs_offsets = brcmnand_cs_offsets_v71;
645 	} else {
646 		ctrl->cs_offsets = brcmnand_cs_offsets;
647 
648 		/* v3.3-5.0 have a different CS0 offset layout */
649 		if (ctrl->nand_version >= 0x0303 &&
650 		    ctrl->nand_version <= 0x0500)
651 			ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
652 	}
653 
654 	/* Page / block sizes */
655 	if (ctrl->nand_version >= 0x0701) {
656 		/* >= v7.1 use nice power-of-2 values! */
657 		ctrl->max_page_size = 16 * 1024;
658 		ctrl->max_block_size = 2 * 1024 * 1024;
659 	} else {
660 		if (ctrl->nand_version >= 0x0304)
661 			ctrl->page_sizes = page_sizes_v3_4;
662 		else if (ctrl->nand_version >= 0x0202)
663 			ctrl->page_sizes = page_sizes_v2_2;
664 		else
665 			ctrl->page_sizes = page_sizes_v2_1;
666 
667 		if (ctrl->nand_version >= 0x0202)
668 			ctrl->page_size_shift = CFG_PAGE_SIZE_SHIFT;
669 		else
670 			ctrl->page_size_shift = CFG_PAGE_SIZE_SHIFT_v2_1;
671 
672 		if (ctrl->nand_version >= 0x0600)
673 			ctrl->block_sizes = block_sizes_v6;
674 		else if (ctrl->nand_version >= 0x0400)
675 			ctrl->block_sizes = block_sizes_v4;
676 		else if (ctrl->nand_version >= 0x0202)
677 			ctrl->block_sizes = block_sizes_v2_2;
678 		else
679 			ctrl->block_sizes = block_sizes_v2_1;
680 
681 		if (ctrl->nand_version < 0x0400) {
682 			if (ctrl->nand_version < 0x0202)
683 				ctrl->max_page_size = 2048;
684 			else
685 				ctrl->max_page_size = 4096;
686 			ctrl->max_block_size = 512 * 1024;
687 		}
688 	}
689 
690 	/* Maximum spare area sector size (per 512B) */
691 	if (ctrl->nand_version == 0x0702)
692 		ctrl->max_oob = 128;
693 	else if (ctrl->nand_version >= 0x0600)
694 		ctrl->max_oob = 64;
695 	else if (ctrl->nand_version >= 0x0500)
696 		ctrl->max_oob = 32;
697 	else
698 		ctrl->max_oob = 16;
699 
700 	/* v6.0 and newer (except v6.1) have prefetch support */
701 	if (ctrl->nand_version >= 0x0600 && ctrl->nand_version != 0x0601)
702 		ctrl->features |= BRCMNAND_HAS_PREFETCH;
703 
704 	/*
705 	 * v6.x has cache mode, but it's implemented differently. Ignore it for
706 	 * now.
707 	 */
708 	if (ctrl->nand_version >= 0x0700)
709 		ctrl->features |= BRCMNAND_HAS_CACHE_MODE;
710 
711 	if (ctrl->nand_version >= 0x0500)
712 		ctrl->features |= BRCMNAND_HAS_1K_SECTORS;
713 
714 	if (ctrl->nand_version >= 0x0700)
715 		ctrl->features |= BRCMNAND_HAS_WP;
716 	else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp"))
717 		ctrl->features |= BRCMNAND_HAS_WP;
718 
719 	return 0;
720 }
721 
722 static void brcmnand_flash_dma_revision_init(struct brcmnand_controller *ctrl)
723 {
724 	/* flash_dma register offsets */
725 	if (ctrl->nand_version >= 0x0703)
726 		ctrl->flash_dma_offsets = flash_dma_regs_v4;
727 	else if (ctrl->nand_version == 0x0602)
728 		ctrl->flash_dma_offsets = flash_dma_regs_v0;
729 	else
730 		ctrl->flash_dma_offsets = flash_dma_regs_v1;
731 }
732 
733 static inline u32 brcmnand_read_reg(struct brcmnand_controller *ctrl,
734 		enum brcmnand_reg reg)
735 {
736 	u16 offs = ctrl->reg_offsets[reg];
737 
738 	if (offs)
739 		return nand_readreg(ctrl, offs);
740 	else
741 		return 0;
742 }
743 
744 static inline void brcmnand_write_reg(struct brcmnand_controller *ctrl,
745 				      enum brcmnand_reg reg, u32 val)
746 {
747 	u16 offs = ctrl->reg_offsets[reg];
748 
749 	if (offs)
750 		nand_writereg(ctrl, offs, val);
751 }
752 
753 static inline void brcmnand_rmw_reg(struct brcmnand_controller *ctrl,
754 				    enum brcmnand_reg reg, u32 mask, unsigned
755 				    int shift, u32 val)
756 {
757 	u32 tmp = brcmnand_read_reg(ctrl, reg);
758 
759 	tmp &= ~mask;
760 	tmp |= val << shift;
761 	brcmnand_write_reg(ctrl, reg, tmp);
762 }
763 
764 static inline u32 brcmnand_read_fc(struct brcmnand_controller *ctrl, int word)
765 {
766 	return __raw_readl(ctrl->nand_fc + word * 4);
767 }
768 
769 static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
770 				     int word, u32 val)
771 {
772 	__raw_writel(val, ctrl->nand_fc + word * 4);
773 }
774 
775 static inline void edu_writel(struct brcmnand_controller *ctrl,
776 			      enum edu_reg reg, u32 val)
777 {
778 	u16 offs = ctrl->edu_offsets[reg];
779 
780 	brcmnand_writel(val, ctrl->edu_base + offs);
781 }
782 
783 static inline u32 edu_readl(struct brcmnand_controller *ctrl,
784 			    enum edu_reg reg)
785 {
786 	u16 offs = ctrl->edu_offsets[reg];
787 
788 	return brcmnand_readl(ctrl->edu_base + offs);
789 }
790 
791 static void brcmnand_clear_ecc_addr(struct brcmnand_controller *ctrl)
792 {
793 
794 	/* Clear error addresses */
795 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
796 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
797 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
798 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
799 }
800 
801 static u64 brcmnand_get_uncorrecc_addr(struct brcmnand_controller *ctrl)
802 {
803 	u64 err_addr;
804 
805 	err_addr = brcmnand_read_reg(ctrl, BRCMNAND_UNCORR_ADDR);
806 	err_addr |= ((u64)(brcmnand_read_reg(ctrl,
807 					     BRCMNAND_UNCORR_EXT_ADDR)
808 					     & 0xffff) << 32);
809 
810 	return err_addr;
811 }
812 
813 static u64 brcmnand_get_correcc_addr(struct brcmnand_controller *ctrl)
814 {
815 	u64 err_addr;
816 
817 	err_addr = brcmnand_read_reg(ctrl, BRCMNAND_CORR_ADDR);
818 	err_addr |= ((u64)(brcmnand_read_reg(ctrl,
819 					     BRCMNAND_CORR_EXT_ADDR)
820 					     & 0xffff) << 32);
821 
822 	return err_addr;
823 }
824 
825 static void brcmnand_set_cmd_addr(struct mtd_info *mtd, u64 addr)
826 {
827 	struct nand_chip *chip =  mtd_to_nand(mtd);
828 	struct brcmnand_host *host = nand_get_controller_data(chip);
829 	struct brcmnand_controller *ctrl = host->ctrl;
830 
831 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
832 			   (host->cs << 16) | ((addr >> 32) & 0xffff));
833 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
834 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
835 			   lower_32_bits(addr));
836 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
837 }
838 
839 static inline u16 brcmnand_cs_offset(struct brcmnand_controller *ctrl, int cs,
840 				     enum brcmnand_cs_reg reg)
841 {
842 	u16 offs_cs0 = ctrl->reg_offsets[BRCMNAND_CS0_BASE];
843 	u16 offs_cs1 = ctrl->reg_offsets[BRCMNAND_CS1_BASE];
844 	u8 cs_offs;
845 
846 	if (cs == 0 && ctrl->cs0_offsets)
847 		cs_offs = ctrl->cs0_offsets[reg];
848 	else
849 		cs_offs = ctrl->cs_offsets[reg];
850 
851 	if (cs && offs_cs1)
852 		return offs_cs1 + (cs - 1) * ctrl->reg_spacing + cs_offs;
853 
854 	return offs_cs0 + cs * ctrl->reg_spacing + cs_offs;
855 }
856 
857 static inline u32 brcmnand_count_corrected(struct brcmnand_controller *ctrl)
858 {
859 	if (ctrl->nand_version < 0x0600)
860 		return 1;
861 	return brcmnand_read_reg(ctrl, BRCMNAND_CORR_COUNT);
862 }
863 
864 static void brcmnand_wr_corr_thresh(struct brcmnand_host *host, u8 val)
865 {
866 	struct brcmnand_controller *ctrl = host->ctrl;
867 	unsigned int shift = 0, bits;
868 	enum brcmnand_reg reg = BRCMNAND_CORR_THRESHOLD;
869 	int cs = host->cs;
870 
871 	if (!ctrl->reg_offsets[reg])
872 		return;
873 
874 	if (ctrl->nand_version == 0x0702)
875 		bits = 7;
876 	else if (ctrl->nand_version >= 0x0600)
877 		bits = 6;
878 	else if (ctrl->nand_version >= 0x0500)
879 		bits = 5;
880 	else
881 		bits = 4;
882 
883 	if (ctrl->nand_version >= 0x0702) {
884 		if (cs >= 4)
885 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
886 		shift = (cs % 4) * bits;
887 	} else if (ctrl->nand_version >= 0x0600) {
888 		if (cs >= 5)
889 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
890 		shift = (cs % 5) * bits;
891 	}
892 	brcmnand_rmw_reg(ctrl, reg, (bits - 1) << shift, shift, val);
893 }
894 
895 static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
896 {
897 	if (ctrl->nand_version < 0x0602)
898 		return 24;
899 	return 0;
900 }
901 
902 /***********************************************************************
903  * NAND ACC CONTROL bitfield
904  *
905  * Some bits have remained constant throughout hardware revision, while
906  * others have shifted around.
907  ***********************************************************************/
908 
909 /* Constant for all versions (where supported) */
910 enum {
911 	/* See BRCMNAND_HAS_CACHE_MODE */
912 	ACC_CONTROL_CACHE_MODE				= BIT(22),
913 
914 	/* See BRCMNAND_HAS_PREFETCH */
915 	ACC_CONTROL_PREFETCH				= BIT(23),
916 
917 	ACC_CONTROL_PAGE_HIT				= BIT(24),
918 	ACC_CONTROL_WR_PREEMPT				= BIT(25),
919 	ACC_CONTROL_PARTIAL_PAGE			= BIT(26),
920 	ACC_CONTROL_RD_ERASED				= BIT(27),
921 	ACC_CONTROL_FAST_PGM_RDIN			= BIT(28),
922 	ACC_CONTROL_WR_ECC				= BIT(30),
923 	ACC_CONTROL_RD_ECC				= BIT(31),
924 };
925 
926 static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
927 {
928 	if (ctrl->nand_version == 0x0702)
929 		return GENMASK(7, 0);
930 	else if (ctrl->nand_version >= 0x0600)
931 		return GENMASK(6, 0);
932 	else if (ctrl->nand_version >= 0x0303)
933 		return GENMASK(5, 0);
934 	else
935 		return GENMASK(4, 0);
936 }
937 
938 #define NAND_ACC_CONTROL_ECC_SHIFT	16
939 #define NAND_ACC_CONTROL_ECC_EXT_SHIFT	13
940 
941 static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl)
942 {
943 	u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f;
944 
945 	mask <<= NAND_ACC_CONTROL_ECC_SHIFT;
946 
947 	/* v7.2 includes additional ECC levels */
948 	if (ctrl->nand_version >= 0x0702)
949 		mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT;
950 
951 	return mask;
952 }
953 
954 static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
955 {
956 	struct brcmnand_controller *ctrl = host->ctrl;
957 	u16 offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
958 	u32 acc_control = nand_readreg(ctrl, offs);
959 	u32 ecc_flags = ACC_CONTROL_WR_ECC | ACC_CONTROL_RD_ECC;
960 
961 	if (en) {
962 		acc_control |= ecc_flags; /* enable RD/WR ECC */
963 		acc_control |= host->hwcfg.ecc_level
964 			       << NAND_ACC_CONTROL_ECC_SHIFT;
965 	} else {
966 		acc_control &= ~ecc_flags; /* disable RD/WR ECC */
967 		acc_control &= ~brcmnand_ecc_level_mask(ctrl);
968 	}
969 
970 	nand_writereg(ctrl, offs, acc_control);
971 }
972 
973 static inline int brcmnand_sector_1k_shift(struct brcmnand_controller *ctrl)
974 {
975 	if (ctrl->nand_version >= 0x0702)
976 		return 9;
977 	else if (ctrl->nand_version >= 0x0600)
978 		return 7;
979 	else if (ctrl->nand_version >= 0x0500)
980 		return 6;
981 	else
982 		return -1;
983 }
984 
985 static int brcmnand_get_sector_size_1k(struct brcmnand_host *host)
986 {
987 	struct brcmnand_controller *ctrl = host->ctrl;
988 	int shift = brcmnand_sector_1k_shift(ctrl);
989 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
990 						  BRCMNAND_CS_ACC_CONTROL);
991 
992 	if (shift < 0)
993 		return 0;
994 
995 	return (nand_readreg(ctrl, acc_control_offs) >> shift) & 0x1;
996 }
997 
998 static void brcmnand_set_sector_size_1k(struct brcmnand_host *host, int val)
999 {
1000 	struct brcmnand_controller *ctrl = host->ctrl;
1001 	int shift = brcmnand_sector_1k_shift(ctrl);
1002 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
1003 						  BRCMNAND_CS_ACC_CONTROL);
1004 	u32 tmp;
1005 
1006 	if (shift < 0)
1007 		return;
1008 
1009 	tmp = nand_readreg(ctrl, acc_control_offs);
1010 	tmp &= ~(1 << shift);
1011 	tmp |= (!!val) << shift;
1012 	nand_writereg(ctrl, acc_control_offs, tmp);
1013 }
1014 
1015 /***********************************************************************
1016  * CS_NAND_SELECT
1017  ***********************************************************************/
1018 
1019 enum {
1020 	CS_SELECT_NAND_WP			= BIT(29),
1021 	CS_SELECT_AUTO_DEVICE_ID_CFG		= BIT(30),
1022 };
1023 
1024 static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,
1025 				    u32 mask, u32 expected_val,
1026 				    unsigned long timeout_ms)
1027 {
1028 	unsigned long limit;
1029 	u32 val;
1030 
1031 	if (!timeout_ms)
1032 		timeout_ms = NAND_POLL_STATUS_TIMEOUT_MS;
1033 
1034 	limit = jiffies + msecs_to_jiffies(timeout_ms);
1035 	do {
1036 		val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
1037 		if ((val & mask) == expected_val)
1038 			return 0;
1039 
1040 		cpu_relax();
1041 	} while (time_after(limit, jiffies));
1042 
1043 	dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
1044 		 expected_val, val & mask);
1045 
1046 	return -ETIMEDOUT;
1047 }
1048 
1049 static inline void brcmnand_set_wp(struct brcmnand_controller *ctrl, bool en)
1050 {
1051 	u32 val = en ? CS_SELECT_NAND_WP : 0;
1052 
1053 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT, CS_SELECT_NAND_WP, 0, val);
1054 }
1055 
1056 /***********************************************************************
1057  * Flash DMA
1058  ***********************************************************************/
1059 
1060 static inline bool has_flash_dma(struct brcmnand_controller *ctrl)
1061 {
1062 	return ctrl->flash_dma_base;
1063 }
1064 
1065 static inline bool has_edu(struct brcmnand_controller *ctrl)
1066 {
1067 	return ctrl->edu_base;
1068 }
1069 
1070 static inline bool use_dma(struct brcmnand_controller *ctrl)
1071 {
1072 	return has_flash_dma(ctrl) || has_edu(ctrl);
1073 }
1074 
1075 static inline void disable_ctrl_irqs(struct brcmnand_controller *ctrl)
1076 {
1077 	if (ctrl->pio_poll_mode)
1078 		return;
1079 
1080 	if (has_flash_dma(ctrl)) {
1081 		ctrl->flash_dma_base = NULL;
1082 		disable_irq(ctrl->dma_irq);
1083 	}
1084 
1085 	disable_irq(ctrl->irq);
1086 	ctrl->pio_poll_mode = true;
1087 }
1088 
1089 static inline bool flash_dma_buf_ok(const void *buf)
1090 {
1091 	return buf && !is_vmalloc_addr(buf) &&
1092 		likely(IS_ALIGNED((uintptr_t)buf, 4));
1093 }
1094 
1095 static inline void flash_dma_writel(struct brcmnand_controller *ctrl,
1096 				    enum flash_dma_reg dma_reg, u32 val)
1097 {
1098 	u16 offs = ctrl->flash_dma_offsets[dma_reg];
1099 
1100 	brcmnand_writel(val, ctrl->flash_dma_base + offs);
1101 }
1102 
1103 static inline u32 flash_dma_readl(struct brcmnand_controller *ctrl,
1104 				  enum flash_dma_reg dma_reg)
1105 {
1106 	u16 offs = ctrl->flash_dma_offsets[dma_reg];
1107 
1108 	return brcmnand_readl(ctrl->flash_dma_base + offs);
1109 }
1110 
1111 /* Low-level operation types: command, address, write, or read */
1112 enum brcmnand_llop_type {
1113 	LL_OP_CMD,
1114 	LL_OP_ADDR,
1115 	LL_OP_WR,
1116 	LL_OP_RD,
1117 };
1118 
1119 /***********************************************************************
1120  * Internal support functions
1121  ***********************************************************************/
1122 
1123 static inline bool is_hamming_ecc(struct brcmnand_controller *ctrl,
1124 				  struct brcmnand_cfg *cfg)
1125 {
1126 	if (ctrl->nand_version <= 0x0701)
1127 		return cfg->sector_size_1k == 0 && cfg->spare_area_size == 16 &&
1128 			cfg->ecc_level == 15;
1129 	else
1130 		return cfg->sector_size_1k == 0 && ((cfg->spare_area_size == 16 &&
1131 			cfg->ecc_level == 15) ||
1132 			(cfg->spare_area_size == 28 && cfg->ecc_level == 16));
1133 }
1134 
1135 /*
1136  * Set mtd->ooblayout to the appropriate mtd_ooblayout_ops given
1137  * the layout/configuration.
1138  * Returns -ERRCODE on failure.
1139  */
1140 static int brcmnand_hamming_ooblayout_ecc(struct mtd_info *mtd, int section,
1141 					  struct mtd_oob_region *oobregion)
1142 {
1143 	struct nand_chip *chip = mtd_to_nand(mtd);
1144 	struct brcmnand_host *host = nand_get_controller_data(chip);
1145 	struct brcmnand_cfg *cfg = &host->hwcfg;
1146 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1147 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1148 
1149 	if (section >= sectors)
1150 		return -ERANGE;
1151 
1152 	oobregion->offset = (section * sas) + 6;
1153 	oobregion->length = 3;
1154 
1155 	return 0;
1156 }
1157 
1158 static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section,
1159 					   struct mtd_oob_region *oobregion)
1160 {
1161 	struct nand_chip *chip = mtd_to_nand(mtd);
1162 	struct brcmnand_host *host = nand_get_controller_data(chip);
1163 	struct brcmnand_cfg *cfg = &host->hwcfg;
1164 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1165 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1166 	u32 next;
1167 
1168 	if (section > sectors)
1169 		return -ERANGE;
1170 
1171 	next = (section * sas);
1172 	if (section < sectors)
1173 		next += 6;
1174 
1175 	if (section) {
1176 		oobregion->offset = ((section - 1) * sas) + 9;
1177 	} else {
1178 		if (cfg->page_size > 512) {
1179 			/* Large page NAND uses first 2 bytes for BBI */
1180 			oobregion->offset = 2;
1181 		} else {
1182 			/* Small page NAND uses last byte before ECC for BBI */
1183 			oobregion->offset = 0;
1184 			next--;
1185 		}
1186 	}
1187 
1188 	oobregion->length = next - oobregion->offset;
1189 
1190 	return 0;
1191 }
1192 
1193 static const struct mtd_ooblayout_ops brcmnand_hamming_ooblayout_ops = {
1194 	.ecc = brcmnand_hamming_ooblayout_ecc,
1195 	.free = brcmnand_hamming_ooblayout_free,
1196 };
1197 
1198 static int brcmnand_bch_ooblayout_ecc(struct mtd_info *mtd, int section,
1199 				      struct mtd_oob_region *oobregion)
1200 {
1201 	struct nand_chip *chip = mtd_to_nand(mtd);
1202 	struct brcmnand_host *host = nand_get_controller_data(chip);
1203 	struct brcmnand_cfg *cfg = &host->hwcfg;
1204 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1205 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1206 
1207 	if (section >= sectors)
1208 		return -ERANGE;
1209 
1210 	oobregion->offset = ((section + 1) * sas) - chip->ecc.bytes;
1211 	oobregion->length = chip->ecc.bytes;
1212 
1213 	return 0;
1214 }
1215 
1216 static int brcmnand_bch_ooblayout_free_lp(struct mtd_info *mtd, int section,
1217 					  struct mtd_oob_region *oobregion)
1218 {
1219 	struct nand_chip *chip = mtd_to_nand(mtd);
1220 	struct brcmnand_host *host = nand_get_controller_data(chip);
1221 	struct brcmnand_cfg *cfg = &host->hwcfg;
1222 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1223 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1224 
1225 	if (section >= sectors)
1226 		return -ERANGE;
1227 
1228 	if (sas <= chip->ecc.bytes)
1229 		return 0;
1230 
1231 	oobregion->offset = section * sas;
1232 	oobregion->length = sas - chip->ecc.bytes;
1233 
1234 	if (!section) {
1235 		oobregion->offset++;
1236 		oobregion->length--;
1237 	}
1238 
1239 	return 0;
1240 }
1241 
1242 static int brcmnand_bch_ooblayout_free_sp(struct mtd_info *mtd, int section,
1243 					  struct mtd_oob_region *oobregion)
1244 {
1245 	struct nand_chip *chip = mtd_to_nand(mtd);
1246 	struct brcmnand_host *host = nand_get_controller_data(chip);
1247 	struct brcmnand_cfg *cfg = &host->hwcfg;
1248 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1249 
1250 	if (section > 1 || sas - chip->ecc.bytes < 6 ||
1251 	    (section && sas - chip->ecc.bytes == 6))
1252 		return -ERANGE;
1253 
1254 	if (!section) {
1255 		oobregion->offset = 0;
1256 		oobregion->length = 5;
1257 	} else {
1258 		oobregion->offset = 6;
1259 		oobregion->length = sas - chip->ecc.bytes - 6;
1260 	}
1261 
1262 	return 0;
1263 }
1264 
1265 static const struct mtd_ooblayout_ops brcmnand_bch_lp_ooblayout_ops = {
1266 	.ecc = brcmnand_bch_ooblayout_ecc,
1267 	.free = brcmnand_bch_ooblayout_free_lp,
1268 };
1269 
1270 static const struct mtd_ooblayout_ops brcmnand_bch_sp_ooblayout_ops = {
1271 	.ecc = brcmnand_bch_ooblayout_ecc,
1272 	.free = brcmnand_bch_ooblayout_free_sp,
1273 };
1274 
1275 static int brcmstb_choose_ecc_layout(struct brcmnand_host *host)
1276 {
1277 	struct brcmnand_cfg *p = &host->hwcfg;
1278 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
1279 	struct nand_ecc_ctrl *ecc = &host->chip.ecc;
1280 	unsigned int ecc_level = p->ecc_level;
1281 	int sas = p->spare_area_size << p->sector_size_1k;
1282 	int sectors = p->page_size / (512 << p->sector_size_1k);
1283 
1284 	if (p->sector_size_1k)
1285 		ecc_level <<= 1;
1286 
1287 	if (is_hamming_ecc(host->ctrl, p)) {
1288 		ecc->bytes = 3 * sectors;
1289 		mtd_set_ooblayout(mtd, &brcmnand_hamming_ooblayout_ops);
1290 		return 0;
1291 	}
1292 
1293 	/*
1294 	 * CONTROLLER_VERSION:
1295 	 *   < v5.0: ECC_REQ = ceil(BCH_T * 13/8)
1296 	 *  >= v5.0: ECC_REQ = ceil(BCH_T * 14/8)
1297 	 * But we will just be conservative.
1298 	 */
1299 	ecc->bytes = DIV_ROUND_UP(ecc_level * 14, 8);
1300 	if (p->page_size == 512)
1301 		mtd_set_ooblayout(mtd, &brcmnand_bch_sp_ooblayout_ops);
1302 	else
1303 		mtd_set_ooblayout(mtd, &brcmnand_bch_lp_ooblayout_ops);
1304 
1305 	if (ecc->bytes >= sas) {
1306 		dev_err(&host->pdev->dev,
1307 			"error: ECC too large for OOB (ECC bytes %d, spare sector %d)\n",
1308 			ecc->bytes, sas);
1309 		return -EINVAL;
1310 	}
1311 
1312 	return 0;
1313 }
1314 
1315 static void brcmnand_wp(struct mtd_info *mtd, int wp)
1316 {
1317 	struct nand_chip *chip = mtd_to_nand(mtd);
1318 	struct brcmnand_host *host = nand_get_controller_data(chip);
1319 	struct brcmnand_controller *ctrl = host->ctrl;
1320 
1321 	if ((ctrl->features & BRCMNAND_HAS_WP) && wp_on == 1) {
1322 		static int old_wp = -1;
1323 		int ret;
1324 
1325 		if (old_wp != wp) {
1326 			dev_dbg(ctrl->dev, "WP %s\n", wp ? "on" : "off");
1327 			old_wp = wp;
1328 		}
1329 
1330 		/*
1331 		 * make sure ctrl/flash ready before and after
1332 		 * changing state of #WP pin
1333 		 */
1334 		ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY |
1335 					       NAND_STATUS_READY,
1336 					       NAND_CTRL_RDY |
1337 					       NAND_STATUS_READY, 0);
1338 		if (ret)
1339 			return;
1340 
1341 		brcmnand_set_wp(ctrl, wp);
1342 		nand_status_op(chip, NULL);
1343 		/* NAND_STATUS_WP 0x00 = protected, 0x80 = not protected */
1344 		ret = bcmnand_ctrl_poll_status(ctrl,
1345 					       NAND_CTRL_RDY |
1346 					       NAND_STATUS_READY |
1347 					       NAND_STATUS_WP,
1348 					       NAND_CTRL_RDY |
1349 					       NAND_STATUS_READY |
1350 					       (wp ? 0 : NAND_STATUS_WP), 0);
1351 
1352 		if (ret)
1353 			dev_err_ratelimited(&host->pdev->dev,
1354 					    "nand #WP expected %s\n",
1355 					    wp ? "on" : "off");
1356 	}
1357 }
1358 
1359 /* Helper functions for reading and writing OOB registers */
1360 static inline u8 oob_reg_read(struct brcmnand_controller *ctrl, u32 offs)
1361 {
1362 	u16 offset0, offset10, reg_offs;
1363 
1364 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_READ_BASE];
1365 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_READ_10_BASE];
1366 
1367 	if (offs >= ctrl->max_oob)
1368 		return 0x77;
1369 
1370 	if (offs >= 16 && offset10)
1371 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1372 	else
1373 		reg_offs = offset0 + (offs & ~0x03);
1374 
1375 	return nand_readreg(ctrl, reg_offs) >> (24 - ((offs & 0x03) << 3));
1376 }
1377 
1378 static inline void oob_reg_write(struct brcmnand_controller *ctrl, u32 offs,
1379 				 u32 data)
1380 {
1381 	u16 offset0, offset10, reg_offs;
1382 
1383 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_BASE];
1384 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_10_BASE];
1385 
1386 	if (offs >= ctrl->max_oob)
1387 		return;
1388 
1389 	if (offs >= 16 && offset10)
1390 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1391 	else
1392 		reg_offs = offset0 + (offs & ~0x03);
1393 
1394 	nand_writereg(ctrl, reg_offs, data);
1395 }
1396 
1397 /*
1398  * read_oob_from_regs - read data from OOB registers
1399  * @ctrl: NAND controller
1400  * @i: sub-page sector index
1401  * @oob: buffer to read to
1402  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1403  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1404  */
1405 static int read_oob_from_regs(struct brcmnand_controller *ctrl, int i, u8 *oob,
1406 			      int sas, int sector_1k)
1407 {
1408 	int tbytes = sas << sector_1k;
1409 	int j;
1410 
1411 	/* Adjust OOB values for 1K sector size */
1412 	if (sector_1k && (i & 0x01))
1413 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1414 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1415 
1416 	for (j = 0; j < tbytes; j++)
1417 		oob[j] = oob_reg_read(ctrl, j);
1418 	return tbytes;
1419 }
1420 
1421 /*
1422  * write_oob_to_regs - write data to OOB registers
1423  * @i: sub-page sector index
1424  * @oob: buffer to write from
1425  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1426  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1427  */
1428 static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
1429 			     const u8 *oob, int sas, int sector_1k)
1430 {
1431 	int tbytes = sas << sector_1k;
1432 	int j;
1433 
1434 	/* Adjust OOB values for 1K sector size */
1435 	if (sector_1k && (i & 0x01))
1436 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1437 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1438 
1439 	for (j = 0; j < tbytes; j += 4)
1440 		oob_reg_write(ctrl, j,
1441 				(oob[j + 0] << 24) |
1442 				(oob[j + 1] << 16) |
1443 				(oob[j + 2] <<  8) |
1444 				(oob[j + 3] <<  0));
1445 	return tbytes;
1446 }
1447 
1448 static void brcmnand_edu_init(struct brcmnand_controller *ctrl)
1449 {
1450 	/* initialize edu */
1451 	edu_writel(ctrl, EDU_ERR_STATUS, 0);
1452 	edu_readl(ctrl, EDU_ERR_STATUS);
1453 	edu_writel(ctrl, EDU_DONE, 0);
1454 	edu_writel(ctrl, EDU_DONE, 0);
1455 	edu_writel(ctrl, EDU_DONE, 0);
1456 	edu_writel(ctrl, EDU_DONE, 0);
1457 	edu_readl(ctrl, EDU_DONE);
1458 }
1459 
1460 /* edu irq */
1461 static irqreturn_t brcmnand_edu_irq(int irq, void *data)
1462 {
1463 	struct brcmnand_controller *ctrl = data;
1464 
1465 	if (ctrl->edu_count) {
1466 		ctrl->edu_count--;
1467 		while (!(edu_readl(ctrl, EDU_DONE) & EDU_DONE_MASK))
1468 			udelay(1);
1469 		edu_writel(ctrl, EDU_DONE, 0);
1470 		edu_readl(ctrl, EDU_DONE);
1471 	}
1472 
1473 	if (ctrl->edu_count) {
1474 		ctrl->edu_dram_addr += FC_BYTES;
1475 		ctrl->edu_ext_addr += FC_BYTES;
1476 
1477 		edu_writel(ctrl, EDU_DRAM_ADDR, (u32)ctrl->edu_dram_addr);
1478 		edu_readl(ctrl, EDU_DRAM_ADDR);
1479 		edu_writel(ctrl, EDU_EXT_ADDR, ctrl->edu_ext_addr);
1480 		edu_readl(ctrl, EDU_EXT_ADDR);
1481 
1482 		mb(); /* flush previous writes */
1483 		edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
1484 		edu_readl(ctrl, EDU_CMD);
1485 
1486 		return IRQ_HANDLED;
1487 	}
1488 
1489 	complete(&ctrl->edu_done);
1490 
1491 	return IRQ_HANDLED;
1492 }
1493 
1494 static irqreturn_t brcmnand_ctlrdy_irq(int irq, void *data)
1495 {
1496 	struct brcmnand_controller *ctrl = data;
1497 
1498 	/* Discard all NAND_CTLRDY interrupts during DMA */
1499 	if (ctrl->dma_pending)
1500 		return IRQ_HANDLED;
1501 
1502 	/* check if you need to piggy back on the ctrlrdy irq */
1503 	if (ctrl->edu_pending) {
1504 		if (irq == ctrl->irq && ((int)ctrl->edu_irq >= 0))
1505 	/* Discard interrupts while using dedicated edu irq */
1506 			return IRQ_HANDLED;
1507 
1508 	/* no registered edu irq, call handler */
1509 		return brcmnand_edu_irq(irq, data);
1510 	}
1511 
1512 	complete(&ctrl->done);
1513 	return IRQ_HANDLED;
1514 }
1515 
1516 /* Handle SoC-specific interrupt hardware */
1517 static irqreturn_t brcmnand_irq(int irq, void *data)
1518 {
1519 	struct brcmnand_controller *ctrl = data;
1520 
1521 	if (ctrl->soc->ctlrdy_ack(ctrl->soc))
1522 		return brcmnand_ctlrdy_irq(irq, data);
1523 
1524 	return IRQ_NONE;
1525 }
1526 
1527 static irqreturn_t brcmnand_dma_irq(int irq, void *data)
1528 {
1529 	struct brcmnand_controller *ctrl = data;
1530 
1531 	complete(&ctrl->dma_done);
1532 
1533 	return IRQ_HANDLED;
1534 }
1535 
1536 static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
1537 {
1538 	struct brcmnand_controller *ctrl = host->ctrl;
1539 	int ret;
1540 	u64 cmd_addr;
1541 
1542 	cmd_addr = brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1543 
1544 	dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
1545 
1546 	BUG_ON(ctrl->cmd_pending != 0);
1547 	ctrl->cmd_pending = cmd;
1548 
1549 	ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
1550 	WARN_ON(ret);
1551 
1552 	mb(); /* flush previous writes */
1553 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_START,
1554 			   cmd << brcmnand_cmd_shift(ctrl));
1555 }
1556 
1557 /***********************************************************************
1558  * NAND MTD API: read/program/erase
1559  ***********************************************************************/
1560 
1561 static void brcmnand_cmd_ctrl(struct nand_chip *chip, int dat,
1562 			      unsigned int ctrl)
1563 {
1564 	/* intentionally left blank */
1565 }
1566 
1567 static bool brcmstb_nand_wait_for_completion(struct nand_chip *chip)
1568 {
1569 	struct brcmnand_host *host = nand_get_controller_data(chip);
1570 	struct brcmnand_controller *ctrl = host->ctrl;
1571 	struct mtd_info *mtd = nand_to_mtd(chip);
1572 	bool err = false;
1573 	int sts;
1574 
1575 	if (mtd->oops_panic_write) {
1576 		/* switch to interrupt polling and PIO mode */
1577 		disable_ctrl_irqs(ctrl);
1578 		sts = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY,
1579 					       NAND_CTRL_RDY, 0);
1580 		err = (sts < 0) ? true : false;
1581 	} else {
1582 		unsigned long timeo = msecs_to_jiffies(
1583 						NAND_POLL_STATUS_TIMEOUT_MS);
1584 		/* wait for completion interrupt */
1585 		sts = wait_for_completion_timeout(&ctrl->done, timeo);
1586 		err = (sts <= 0) ? true : false;
1587 	}
1588 
1589 	return err;
1590 }
1591 
1592 static int brcmnand_waitfunc(struct nand_chip *chip)
1593 {
1594 	struct brcmnand_host *host = nand_get_controller_data(chip);
1595 	struct brcmnand_controller *ctrl = host->ctrl;
1596 	bool err = false;
1597 
1598 	dev_dbg(ctrl->dev, "wait on native cmd %d\n", ctrl->cmd_pending);
1599 	if (ctrl->cmd_pending)
1600 		err = brcmstb_nand_wait_for_completion(chip);
1601 
1602 	if (err) {
1603 		u32 cmd = brcmnand_read_reg(ctrl, BRCMNAND_CMD_START)
1604 					>> brcmnand_cmd_shift(ctrl);
1605 
1606 		dev_err_ratelimited(ctrl->dev,
1607 			"timeout waiting for command %#02x\n", cmd);
1608 		dev_err_ratelimited(ctrl->dev, "intfc status %08x\n",
1609 			brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS));
1610 	}
1611 	ctrl->cmd_pending = 0;
1612 	return brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1613 				 INTFC_FLASH_STATUS;
1614 }
1615 
1616 enum {
1617 	LLOP_RE				= BIT(16),
1618 	LLOP_WE				= BIT(17),
1619 	LLOP_ALE			= BIT(18),
1620 	LLOP_CLE			= BIT(19),
1621 	LLOP_RETURN_IDLE		= BIT(31),
1622 
1623 	LLOP_DATA_MASK			= GENMASK(15, 0),
1624 };
1625 
1626 static int brcmnand_low_level_op(struct brcmnand_host *host,
1627 				 enum brcmnand_llop_type type, u32 data,
1628 				 bool last_op)
1629 {
1630 	struct nand_chip *chip = &host->chip;
1631 	struct brcmnand_controller *ctrl = host->ctrl;
1632 	u32 tmp;
1633 
1634 	tmp = data & LLOP_DATA_MASK;
1635 	switch (type) {
1636 	case LL_OP_CMD:
1637 		tmp |= LLOP_WE | LLOP_CLE;
1638 		break;
1639 	case LL_OP_ADDR:
1640 		/* WE | ALE */
1641 		tmp |= LLOP_WE | LLOP_ALE;
1642 		break;
1643 	case LL_OP_WR:
1644 		/* WE */
1645 		tmp |= LLOP_WE;
1646 		break;
1647 	case LL_OP_RD:
1648 		/* RE */
1649 		tmp |= LLOP_RE;
1650 		break;
1651 	}
1652 	if (last_op)
1653 		/* RETURN_IDLE */
1654 		tmp |= LLOP_RETURN_IDLE;
1655 
1656 	dev_dbg(ctrl->dev, "ll_op cmd %#x\n", tmp);
1657 
1658 	brcmnand_write_reg(ctrl, BRCMNAND_LL_OP, tmp);
1659 	(void)brcmnand_read_reg(ctrl, BRCMNAND_LL_OP);
1660 
1661 	brcmnand_send_cmd(host, CMD_LOW_LEVEL_OP);
1662 	return brcmnand_waitfunc(chip);
1663 }
1664 
1665 static void brcmnand_cmdfunc(struct nand_chip *chip, unsigned command,
1666 			     int column, int page_addr)
1667 {
1668 	struct mtd_info *mtd = nand_to_mtd(chip);
1669 	struct brcmnand_host *host = nand_get_controller_data(chip);
1670 	struct brcmnand_controller *ctrl = host->ctrl;
1671 	u64 addr = (u64)page_addr << chip->page_shift;
1672 	int native_cmd = 0;
1673 
1674 	if (command == NAND_CMD_READID || command == NAND_CMD_PARAM ||
1675 			command == NAND_CMD_RNDOUT)
1676 		addr = (u64)column;
1677 	/* Avoid propagating a negative, don't-care address */
1678 	else if (page_addr < 0)
1679 		addr = 0;
1680 
1681 	dev_dbg(ctrl->dev, "cmd 0x%x addr 0x%llx\n", command,
1682 		(unsigned long long)addr);
1683 
1684 	host->last_cmd = command;
1685 	host->last_byte = 0;
1686 	host->last_addr = addr;
1687 
1688 	switch (command) {
1689 	case NAND_CMD_RESET:
1690 		native_cmd = CMD_FLASH_RESET;
1691 		break;
1692 	case NAND_CMD_STATUS:
1693 		native_cmd = CMD_STATUS_READ;
1694 		break;
1695 	case NAND_CMD_READID:
1696 		native_cmd = CMD_DEVICE_ID_READ;
1697 		break;
1698 	case NAND_CMD_READOOB:
1699 		native_cmd = CMD_SPARE_AREA_READ;
1700 		break;
1701 	case NAND_CMD_ERASE1:
1702 		native_cmd = CMD_BLOCK_ERASE;
1703 		brcmnand_wp(mtd, 0);
1704 		break;
1705 	case NAND_CMD_PARAM:
1706 		native_cmd = CMD_PARAMETER_READ;
1707 		break;
1708 	case NAND_CMD_SET_FEATURES:
1709 	case NAND_CMD_GET_FEATURES:
1710 		brcmnand_low_level_op(host, LL_OP_CMD, command, false);
1711 		brcmnand_low_level_op(host, LL_OP_ADDR, column, false);
1712 		break;
1713 	case NAND_CMD_RNDOUT:
1714 		native_cmd = CMD_PARAMETER_CHANGE_COL;
1715 		addr &= ~((u64)(FC_BYTES - 1));
1716 		/*
1717 		 * HW quirk: PARAMETER_CHANGE_COL requires SECTOR_SIZE_1K=0
1718 		 * NB: hwcfg.sector_size_1k may not be initialized yet
1719 		 */
1720 		if (brcmnand_get_sector_size_1k(host)) {
1721 			host->hwcfg.sector_size_1k =
1722 				brcmnand_get_sector_size_1k(host);
1723 			brcmnand_set_sector_size_1k(host, 0);
1724 		}
1725 		break;
1726 	}
1727 
1728 	if (!native_cmd)
1729 		return;
1730 
1731 	brcmnand_set_cmd_addr(mtd, addr);
1732 	brcmnand_send_cmd(host, native_cmd);
1733 	brcmnand_waitfunc(chip);
1734 
1735 	if (native_cmd == CMD_PARAMETER_READ ||
1736 			native_cmd == CMD_PARAMETER_CHANGE_COL) {
1737 		/* Copy flash cache word-wise */
1738 		u32 *flash_cache = (u32 *)ctrl->flash_cache;
1739 		int i;
1740 
1741 		brcmnand_soc_data_bus_prepare(ctrl->soc, true);
1742 
1743 		/*
1744 		 * Must cache the FLASH_CACHE now, since changes in
1745 		 * SECTOR_SIZE_1K may invalidate it
1746 		 */
1747 		for (i = 0; i < FC_WORDS; i++)
1748 			/*
1749 			 * Flash cache is big endian for parameter pages, at
1750 			 * least on STB SoCs
1751 			 */
1752 			flash_cache[i] = be32_to_cpu(brcmnand_read_fc(ctrl, i));
1753 
1754 		brcmnand_soc_data_bus_unprepare(ctrl->soc, true);
1755 
1756 		/* Cleanup from HW quirk: restore SECTOR_SIZE_1K */
1757 		if (host->hwcfg.sector_size_1k)
1758 			brcmnand_set_sector_size_1k(host,
1759 						    host->hwcfg.sector_size_1k);
1760 	}
1761 
1762 	/* Re-enable protection is necessary only after erase */
1763 	if (command == NAND_CMD_ERASE1)
1764 		brcmnand_wp(mtd, 1);
1765 }
1766 
1767 static uint8_t brcmnand_read_byte(struct nand_chip *chip)
1768 {
1769 	struct brcmnand_host *host = nand_get_controller_data(chip);
1770 	struct brcmnand_controller *ctrl = host->ctrl;
1771 	uint8_t ret = 0;
1772 	int addr, offs;
1773 
1774 	switch (host->last_cmd) {
1775 	case NAND_CMD_READID:
1776 		if (host->last_byte < 4)
1777 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID) >>
1778 				(24 - (host->last_byte << 3));
1779 		else if (host->last_byte < 8)
1780 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID_EXT) >>
1781 				(56 - (host->last_byte << 3));
1782 		break;
1783 
1784 	case NAND_CMD_READOOB:
1785 		ret = oob_reg_read(ctrl, host->last_byte);
1786 		break;
1787 
1788 	case NAND_CMD_STATUS:
1789 		ret = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1790 					INTFC_FLASH_STATUS;
1791 		if (wp_on) /* hide WP status */
1792 			ret |= NAND_STATUS_WP;
1793 		break;
1794 
1795 	case NAND_CMD_PARAM:
1796 	case NAND_CMD_RNDOUT:
1797 		addr = host->last_addr + host->last_byte;
1798 		offs = addr & (FC_BYTES - 1);
1799 
1800 		/* At FC_BYTES boundary, switch to next column */
1801 		if (host->last_byte > 0 && offs == 0)
1802 			nand_change_read_column_op(chip, addr, NULL, 0, false);
1803 
1804 		ret = ctrl->flash_cache[offs];
1805 		break;
1806 	case NAND_CMD_GET_FEATURES:
1807 		if (host->last_byte >= ONFI_SUBFEATURE_PARAM_LEN) {
1808 			ret = 0;
1809 		} else {
1810 			bool last = host->last_byte ==
1811 				ONFI_SUBFEATURE_PARAM_LEN - 1;
1812 			brcmnand_low_level_op(host, LL_OP_RD, 0, last);
1813 			ret = brcmnand_read_reg(ctrl, BRCMNAND_LL_RDATA) & 0xff;
1814 		}
1815 	}
1816 
1817 	dev_dbg(ctrl->dev, "read byte = 0x%02x\n", ret);
1818 	host->last_byte++;
1819 
1820 	return ret;
1821 }
1822 
1823 static void brcmnand_read_buf(struct nand_chip *chip, uint8_t *buf, int len)
1824 {
1825 	int i;
1826 
1827 	for (i = 0; i < len; i++, buf++)
1828 		*buf = brcmnand_read_byte(chip);
1829 }
1830 
1831 static void brcmnand_write_buf(struct nand_chip *chip, const uint8_t *buf,
1832 			       int len)
1833 {
1834 	int i;
1835 	struct brcmnand_host *host = nand_get_controller_data(chip);
1836 
1837 	switch (host->last_cmd) {
1838 	case NAND_CMD_SET_FEATURES:
1839 		for (i = 0; i < len; i++)
1840 			brcmnand_low_level_op(host, LL_OP_WR, buf[i],
1841 						  (i + 1) == len);
1842 		break;
1843 	default:
1844 		BUG();
1845 		break;
1846 	}
1847 }
1848 
1849 /**
1850  *  Kick EDU engine
1851  */
1852 static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
1853 			      u32 len, u8 cmd)
1854 {
1855 	struct brcmnand_controller *ctrl = host->ctrl;
1856 	unsigned long timeo = msecs_to_jiffies(200);
1857 	int ret = 0;
1858 	int dir = (cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE);
1859 	u8 edu_cmd = (cmd == CMD_PAGE_READ ? EDU_CMD_READ : EDU_CMD_WRITE);
1860 	unsigned int trans = len >> FC_SHIFT;
1861 	dma_addr_t pa;
1862 
1863 	pa = dma_map_single(ctrl->dev, buf, len, dir);
1864 	if (dma_mapping_error(ctrl->dev, pa)) {
1865 		dev_err(ctrl->dev, "unable to map buffer for EDU DMA\n");
1866 		return -ENOMEM;
1867 	}
1868 
1869 	ctrl->edu_pending = true;
1870 	ctrl->edu_dram_addr = pa;
1871 	ctrl->edu_ext_addr = addr;
1872 	ctrl->edu_cmd = edu_cmd;
1873 	ctrl->edu_count = trans;
1874 
1875 	edu_writel(ctrl, EDU_DRAM_ADDR, (u32)ctrl->edu_dram_addr);
1876 	edu_readl(ctrl,  EDU_DRAM_ADDR);
1877 	edu_writel(ctrl, EDU_EXT_ADDR, ctrl->edu_ext_addr);
1878 	edu_readl(ctrl, EDU_EXT_ADDR);
1879 	edu_writel(ctrl, EDU_LENGTH, FC_BYTES);
1880 	edu_readl(ctrl, EDU_LENGTH);
1881 
1882 	/* Start edu engine */
1883 	mb(); /* flush previous writes */
1884 	edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
1885 	edu_readl(ctrl, EDU_CMD);
1886 
1887 	if (wait_for_completion_timeout(&ctrl->edu_done, timeo) <= 0) {
1888 		dev_err(ctrl->dev,
1889 			"timeout waiting for EDU; status %#x, error status %#x\n",
1890 			edu_readl(ctrl, EDU_STATUS),
1891 			edu_readl(ctrl, EDU_ERR_STATUS));
1892 	}
1893 
1894 	dma_unmap_single(ctrl->dev, pa, len, dir);
1895 
1896 	/* for program page check NAND status */
1897 	if (((brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1898 	      INTFC_FLASH_STATUS) & NAND_STATUS_FAIL) &&
1899 	    edu_cmd == EDU_CMD_WRITE) {
1900 		dev_info(ctrl->dev, "program failed at %llx\n",
1901 			 (unsigned long long)addr);
1902 		ret = -EIO;
1903 	}
1904 
1905 	/* Make sure the EDU status is clean */
1906 	if (edu_readl(ctrl, EDU_STATUS) & EDU_STATUS_ACTIVE)
1907 		dev_warn(ctrl->dev, "EDU still active: %#x\n",
1908 			 edu_readl(ctrl, EDU_STATUS));
1909 
1910 	if (unlikely(edu_readl(ctrl, EDU_ERR_STATUS) & EDU_ERR_STATUS_ERRACK)) {
1911 		dev_warn(ctrl->dev, "EDU RBUS error at addr %llx\n",
1912 			 (unsigned long long)addr);
1913 		ret = -EIO;
1914 	}
1915 
1916 	ctrl->edu_pending = false;
1917 	brcmnand_edu_init(ctrl);
1918 	edu_writel(ctrl, EDU_STOP, 0); /* force stop */
1919 	edu_readl(ctrl, EDU_STOP);
1920 
1921 	if (!ret && edu_cmd == EDU_CMD_READ) {
1922 		u64 err_addr = 0;
1923 
1924 		/*
1925 		 * check for ECC errors here, subpage ECC errors are
1926 		 * retained in ECC error address register
1927 		 */
1928 		err_addr = brcmnand_get_uncorrecc_addr(ctrl);
1929 		if (!err_addr) {
1930 			err_addr = brcmnand_get_correcc_addr(ctrl);
1931 			if (err_addr)
1932 				ret = -EUCLEAN;
1933 		} else
1934 			ret = -EBADMSG;
1935 	}
1936 
1937 	return ret;
1938 }
1939 
1940 /**
1941  * Construct a FLASH_DMA descriptor as part of a linked list. You must know the
1942  * following ahead of time:
1943  *  - Is this descriptor the beginning or end of a linked list?
1944  *  - What is the (DMA) address of the next descriptor in the linked list?
1945  */
1946 static int brcmnand_fill_dma_desc(struct brcmnand_host *host,
1947 				  struct brcm_nand_dma_desc *desc, u64 addr,
1948 				  dma_addr_t buf, u32 len, u8 dma_cmd,
1949 				  bool begin, bool end,
1950 				  dma_addr_t next_desc)
1951 {
1952 	memset(desc, 0, sizeof(*desc));
1953 	/* Descriptors are written in native byte order (wordwise) */
1954 	desc->next_desc = lower_32_bits(next_desc);
1955 	desc->next_desc_ext = upper_32_bits(next_desc);
1956 	desc->cmd_irq = (dma_cmd << 24) |
1957 		(end ? (0x03 << 8) : 0) | /* IRQ | STOP */
1958 		(!!begin) | ((!!end) << 1); /* head, tail */
1959 #ifdef CONFIG_CPU_BIG_ENDIAN
1960 	desc->cmd_irq |= 0x01 << 12;
1961 #endif
1962 	desc->dram_addr = lower_32_bits(buf);
1963 	desc->dram_addr_ext = upper_32_bits(buf);
1964 	desc->tfr_len = len;
1965 	desc->total_len = len;
1966 	desc->flash_addr = lower_32_bits(addr);
1967 	desc->flash_addr_ext = upper_32_bits(addr);
1968 	desc->cs = host->cs;
1969 	desc->status_valid = 0x01;
1970 	return 0;
1971 }
1972 
1973 /**
1974  * Kick the FLASH_DMA engine, with a given DMA descriptor
1975  */
1976 static void brcmnand_dma_run(struct brcmnand_host *host, dma_addr_t desc)
1977 {
1978 	struct brcmnand_controller *ctrl = host->ctrl;
1979 	unsigned long timeo = msecs_to_jiffies(100);
1980 
1981 	flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC, lower_32_bits(desc));
1982 	(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC);
1983 	if (ctrl->nand_version > 0x0602) {
1984 		flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC_EXT,
1985 				 upper_32_bits(desc));
1986 		(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC_EXT);
1987 	}
1988 
1989 	/* Start FLASH_DMA engine */
1990 	ctrl->dma_pending = true;
1991 	mb(); /* flush previous writes */
1992 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0x03); /* wake | run */
1993 
1994 	if (wait_for_completion_timeout(&ctrl->dma_done, timeo) <= 0) {
1995 		dev_err(ctrl->dev,
1996 				"timeout waiting for DMA; status %#x, error status %#x\n",
1997 				flash_dma_readl(ctrl, FLASH_DMA_STATUS),
1998 				flash_dma_readl(ctrl, FLASH_DMA_ERROR_STATUS));
1999 	}
2000 	ctrl->dma_pending = false;
2001 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0); /* force stop */
2002 }
2003 
2004 static int brcmnand_dma_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
2005 			      u32 len, u8 dma_cmd)
2006 {
2007 	struct brcmnand_controller *ctrl = host->ctrl;
2008 	dma_addr_t buf_pa;
2009 	int dir = dma_cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
2010 
2011 	buf_pa = dma_map_single(ctrl->dev, buf, len, dir);
2012 	if (dma_mapping_error(ctrl->dev, buf_pa)) {
2013 		dev_err(ctrl->dev, "unable to map buffer for DMA\n");
2014 		return -ENOMEM;
2015 	}
2016 
2017 	brcmnand_fill_dma_desc(host, ctrl->dma_desc, addr, buf_pa, len,
2018 				   dma_cmd, true, true, 0);
2019 
2020 	brcmnand_dma_run(host, ctrl->dma_pa);
2021 
2022 	dma_unmap_single(ctrl->dev, buf_pa, len, dir);
2023 
2024 	if (ctrl->dma_desc->status_valid & FLASH_DMA_ECC_ERROR)
2025 		return -EBADMSG;
2026 	else if (ctrl->dma_desc->status_valid & FLASH_DMA_CORR_ERROR)
2027 		return -EUCLEAN;
2028 
2029 	return 0;
2030 }
2031 
2032 /*
2033  * Assumes proper CS is already set
2034  */
2035 static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
2036 				u64 addr, unsigned int trans, u32 *buf,
2037 				u8 *oob, u64 *err_addr)
2038 {
2039 	struct brcmnand_host *host = nand_get_controller_data(chip);
2040 	struct brcmnand_controller *ctrl = host->ctrl;
2041 	int i, j, ret = 0;
2042 
2043 	brcmnand_clear_ecc_addr(ctrl);
2044 
2045 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
2046 		brcmnand_set_cmd_addr(mtd, addr);
2047 		/* SPARE_AREA_READ does not use ECC, so just use PAGE_READ */
2048 		brcmnand_send_cmd(host, CMD_PAGE_READ);
2049 		brcmnand_waitfunc(chip);
2050 
2051 		if (likely(buf)) {
2052 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
2053 
2054 			for (j = 0; j < FC_WORDS; j++, buf++)
2055 				*buf = brcmnand_read_fc(ctrl, j);
2056 
2057 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
2058 		}
2059 
2060 		if (oob)
2061 			oob += read_oob_from_regs(ctrl, i, oob,
2062 					mtd->oobsize / trans,
2063 					host->hwcfg.sector_size_1k);
2064 
2065 		if (!ret) {
2066 			*err_addr = brcmnand_get_uncorrecc_addr(ctrl);
2067 
2068 			if (*err_addr)
2069 				ret = -EBADMSG;
2070 		}
2071 
2072 		if (!ret) {
2073 			*err_addr = brcmnand_get_correcc_addr(ctrl);
2074 
2075 			if (*err_addr)
2076 				ret = -EUCLEAN;
2077 		}
2078 	}
2079 
2080 	return ret;
2081 }
2082 
2083 /*
2084  * Check a page to see if it is erased (w/ bitflips) after an uncorrectable ECC
2085  * error
2086  *
2087  * Because the HW ECC signals an ECC error if an erase paged has even a single
2088  * bitflip, we must check each ECC error to see if it is actually an erased
2089  * page with bitflips, not a truly corrupted page.
2090  *
2091  * On a real error, return a negative error code (-EBADMSG for ECC error), and
2092  * buf will contain raw data.
2093  * Otherwise, buf gets filled with 0xffs and return the maximum number of
2094  * bitflips-per-ECC-sector to the caller.
2095  *
2096  */
2097 static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
2098 		  struct nand_chip *chip, void *buf, u64 addr)
2099 {
2100 	struct mtd_oob_region ecc;
2101 	int i;
2102 	int bitflips = 0;
2103 	int page = addr >> chip->page_shift;
2104 	int ret;
2105 	void *ecc_bytes;
2106 	void *ecc_chunk;
2107 
2108 	if (!buf)
2109 		buf = nand_get_data_buf(chip);
2110 
2111 	/* read without ecc for verification */
2112 	ret = chip->ecc.read_page_raw(chip, buf, true, page);
2113 	if (ret)
2114 		return ret;
2115 
2116 	for (i = 0; i < chip->ecc.steps; i++) {
2117 		ecc_chunk = buf + chip->ecc.size * i;
2118 
2119 		mtd_ooblayout_ecc(mtd, i, &ecc);
2120 		ecc_bytes = chip->oob_poi + ecc.offset;
2121 
2122 		ret = nand_check_erased_ecc_chunk(ecc_chunk, chip->ecc.size,
2123 						  ecc_bytes, ecc.length,
2124 						  NULL, 0,
2125 						  chip->ecc.strength);
2126 		if (ret < 0)
2127 			return ret;
2128 
2129 		bitflips = max(bitflips, ret);
2130 	}
2131 
2132 	return bitflips;
2133 }
2134 
2135 static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
2136 			 u64 addr, unsigned int trans, u32 *buf, u8 *oob)
2137 {
2138 	struct brcmnand_host *host = nand_get_controller_data(chip);
2139 	struct brcmnand_controller *ctrl = host->ctrl;
2140 	u64 err_addr = 0;
2141 	int err;
2142 	bool retry = true;
2143 	bool edu_err = false;
2144 
2145 	dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
2146 
2147 try_dmaread:
2148 	brcmnand_clear_ecc_addr(ctrl);
2149 
2150 	if (ctrl->dma_trans && !oob && flash_dma_buf_ok(buf)) {
2151 		err = ctrl->dma_trans(host, addr, buf,
2152 				      trans * FC_BYTES,
2153 				      CMD_PAGE_READ);
2154 
2155 		if (err) {
2156 			if (mtd_is_bitflip_or_eccerr(err))
2157 				err_addr = addr;
2158 			else
2159 				return -EIO;
2160 		}
2161 
2162 		if (has_edu(ctrl) && err_addr)
2163 			edu_err = true;
2164 
2165 	} else {
2166 		if (oob)
2167 			memset(oob, 0x99, mtd->oobsize);
2168 
2169 		err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
2170 					       oob, &err_addr);
2171 	}
2172 
2173 	if (mtd_is_eccerr(err)) {
2174 		/*
2175 		 * On controller version and 7.0, 7.1 , DMA read after a
2176 		 * prior PIO read that reported uncorrectable error,
2177 		 * the DMA engine captures this error following DMA read
2178 		 * cleared only on subsequent DMA read, so just retry once
2179 		 * to clear a possible false error reported for current DMA
2180 		 * read
2181 		 */
2182 		if ((ctrl->nand_version == 0x0700) ||
2183 		    (ctrl->nand_version == 0x0701)) {
2184 			if (retry) {
2185 				retry = false;
2186 				goto try_dmaread;
2187 			}
2188 		}
2189 
2190 		/*
2191 		 * Controller version 7.2 has hw encoder to detect erased page
2192 		 * bitflips, apply sw verification for older controllers only
2193 		 */
2194 		if (ctrl->nand_version < 0x0702) {
2195 			err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
2196 							      addr);
2197 			/* erased page bitflips corrected */
2198 			if (err >= 0)
2199 				return err;
2200 		}
2201 
2202 		dev_dbg(ctrl->dev, "uncorrectable error at 0x%llx\n",
2203 			(unsigned long long)err_addr);
2204 		mtd->ecc_stats.failed++;
2205 		/* NAND layer expects zero on ECC errors */
2206 		return 0;
2207 	}
2208 
2209 	if (mtd_is_bitflip(err)) {
2210 		unsigned int corrected = brcmnand_count_corrected(ctrl);
2211 
2212 		/* in case of EDU correctable error we read again using PIO */
2213 		if (edu_err)
2214 			err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
2215 						   oob, &err_addr);
2216 
2217 		dev_dbg(ctrl->dev, "corrected error at 0x%llx\n",
2218 			(unsigned long long)err_addr);
2219 		mtd->ecc_stats.corrected += corrected;
2220 		/* Always exceed the software-imposed threshold */
2221 		return max(mtd->bitflip_threshold, corrected);
2222 	}
2223 
2224 	return 0;
2225 }
2226 
2227 static int brcmnand_read_page(struct nand_chip *chip, uint8_t *buf,
2228 			      int oob_required, int page)
2229 {
2230 	struct mtd_info *mtd = nand_to_mtd(chip);
2231 	struct brcmnand_host *host = nand_get_controller_data(chip);
2232 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
2233 
2234 	nand_read_page_op(chip, page, 0, NULL, 0);
2235 
2236 	return brcmnand_read(mtd, chip, host->last_addr,
2237 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
2238 }
2239 
2240 static int brcmnand_read_page_raw(struct nand_chip *chip, uint8_t *buf,
2241 				  int oob_required, int page)
2242 {
2243 	struct brcmnand_host *host = nand_get_controller_data(chip);
2244 	struct mtd_info *mtd = nand_to_mtd(chip);
2245 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
2246 	int ret;
2247 
2248 	nand_read_page_op(chip, page, 0, NULL, 0);
2249 
2250 	brcmnand_set_ecc_enabled(host, 0);
2251 	ret = brcmnand_read(mtd, chip, host->last_addr,
2252 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
2253 	brcmnand_set_ecc_enabled(host, 1);
2254 	return ret;
2255 }
2256 
2257 static int brcmnand_read_oob(struct nand_chip *chip, int page)
2258 {
2259 	struct mtd_info *mtd = nand_to_mtd(chip);
2260 
2261 	return brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
2262 			mtd->writesize >> FC_SHIFT,
2263 			NULL, (u8 *)chip->oob_poi);
2264 }
2265 
2266 static int brcmnand_read_oob_raw(struct nand_chip *chip, int page)
2267 {
2268 	struct mtd_info *mtd = nand_to_mtd(chip);
2269 	struct brcmnand_host *host = nand_get_controller_data(chip);
2270 
2271 	brcmnand_set_ecc_enabled(host, 0);
2272 	brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
2273 		mtd->writesize >> FC_SHIFT,
2274 		NULL, (u8 *)chip->oob_poi);
2275 	brcmnand_set_ecc_enabled(host, 1);
2276 	return 0;
2277 }
2278 
2279 static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
2280 			  u64 addr, const u32 *buf, u8 *oob)
2281 {
2282 	struct brcmnand_host *host = nand_get_controller_data(chip);
2283 	struct brcmnand_controller *ctrl = host->ctrl;
2284 	unsigned int i, j, trans = mtd->writesize >> FC_SHIFT;
2285 	int status, ret = 0;
2286 
2287 	dev_dbg(ctrl->dev, "write %llx <- %p\n", (unsigned long long)addr, buf);
2288 
2289 	if (unlikely((unsigned long)buf & 0x03)) {
2290 		dev_warn(ctrl->dev, "unaligned buffer: %p\n", buf);
2291 		buf = (u32 *)((unsigned long)buf & ~0x03);
2292 	}
2293 
2294 	brcmnand_wp(mtd, 0);
2295 
2296 	for (i = 0; i < ctrl->max_oob; i += 4)
2297 		oob_reg_write(ctrl, i, 0xffffffff);
2298 
2299 	if (use_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
2300 		if (ctrl->dma_trans(host, addr, (u32 *)buf, mtd->writesize,
2301 				    CMD_PROGRAM_PAGE))
2302 
2303 			ret = -EIO;
2304 
2305 		goto out;
2306 	}
2307 
2308 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
2309 		/* full address MUST be set before populating FC */
2310 		brcmnand_set_cmd_addr(mtd, addr);
2311 
2312 		if (buf) {
2313 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
2314 
2315 			for (j = 0; j < FC_WORDS; j++, buf++)
2316 				brcmnand_write_fc(ctrl, j, *buf);
2317 
2318 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
2319 		} else if (oob) {
2320 			for (j = 0; j < FC_WORDS; j++)
2321 				brcmnand_write_fc(ctrl, j, 0xffffffff);
2322 		}
2323 
2324 		if (oob) {
2325 			oob += write_oob_to_regs(ctrl, i, oob,
2326 					mtd->oobsize / trans,
2327 					host->hwcfg.sector_size_1k);
2328 		}
2329 
2330 		/* we cannot use SPARE_AREA_PROGRAM when PARTIAL_PAGE_EN=0 */
2331 		brcmnand_send_cmd(host, CMD_PROGRAM_PAGE);
2332 		status = brcmnand_waitfunc(chip);
2333 
2334 		if (status & NAND_STATUS_FAIL) {
2335 			dev_info(ctrl->dev, "program failed at %llx\n",
2336 				(unsigned long long)addr);
2337 			ret = -EIO;
2338 			goto out;
2339 		}
2340 	}
2341 out:
2342 	brcmnand_wp(mtd, 1);
2343 	return ret;
2344 }
2345 
2346 static int brcmnand_write_page(struct nand_chip *chip, const uint8_t *buf,
2347 			       int oob_required, int page)
2348 {
2349 	struct mtd_info *mtd = nand_to_mtd(chip);
2350 	struct brcmnand_host *host = nand_get_controller_data(chip);
2351 	void *oob = oob_required ? chip->oob_poi : NULL;
2352 
2353 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
2354 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
2355 
2356 	return nand_prog_page_end_op(chip);
2357 }
2358 
2359 static int brcmnand_write_page_raw(struct nand_chip *chip, const uint8_t *buf,
2360 				   int oob_required, int page)
2361 {
2362 	struct mtd_info *mtd = nand_to_mtd(chip);
2363 	struct brcmnand_host *host = nand_get_controller_data(chip);
2364 	void *oob = oob_required ? chip->oob_poi : NULL;
2365 
2366 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
2367 	brcmnand_set_ecc_enabled(host, 0);
2368 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
2369 	brcmnand_set_ecc_enabled(host, 1);
2370 
2371 	return nand_prog_page_end_op(chip);
2372 }
2373 
2374 static int brcmnand_write_oob(struct nand_chip *chip, int page)
2375 {
2376 	return brcmnand_write(nand_to_mtd(chip), chip,
2377 			      (u64)page << chip->page_shift, NULL,
2378 			      chip->oob_poi);
2379 }
2380 
2381 static int brcmnand_write_oob_raw(struct nand_chip *chip, int page)
2382 {
2383 	struct mtd_info *mtd = nand_to_mtd(chip);
2384 	struct brcmnand_host *host = nand_get_controller_data(chip);
2385 	int ret;
2386 
2387 	brcmnand_set_ecc_enabled(host, 0);
2388 	ret = brcmnand_write(mtd, chip, (u64)page << chip->page_shift, NULL,
2389 				 (u8 *)chip->oob_poi);
2390 	brcmnand_set_ecc_enabled(host, 1);
2391 
2392 	return ret;
2393 }
2394 
2395 /***********************************************************************
2396  * Per-CS setup (1 NAND device)
2397  ***********************************************************************/
2398 
2399 static int brcmnand_set_cfg(struct brcmnand_host *host,
2400 			    struct brcmnand_cfg *cfg)
2401 {
2402 	struct brcmnand_controller *ctrl = host->ctrl;
2403 	struct nand_chip *chip = &host->chip;
2404 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2405 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
2406 			BRCMNAND_CS_CFG_EXT);
2407 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
2408 			BRCMNAND_CS_ACC_CONTROL);
2409 	u8 block_size = 0, page_size = 0, device_size = 0;
2410 	u32 tmp;
2411 
2412 	if (ctrl->block_sizes) {
2413 		int i, found;
2414 
2415 		for (i = 0, found = 0; ctrl->block_sizes[i]; i++)
2416 			if (ctrl->block_sizes[i] * 1024 == cfg->block_size) {
2417 				block_size = i;
2418 				found = 1;
2419 			}
2420 		if (!found) {
2421 			dev_warn(ctrl->dev, "invalid block size %u\n",
2422 					cfg->block_size);
2423 			return -EINVAL;
2424 		}
2425 	} else {
2426 		block_size = ffs(cfg->block_size) - ffs(BRCMNAND_MIN_BLOCKSIZE);
2427 	}
2428 
2429 	if (cfg->block_size < BRCMNAND_MIN_BLOCKSIZE || (ctrl->max_block_size &&
2430 				cfg->block_size > ctrl->max_block_size)) {
2431 		dev_warn(ctrl->dev, "invalid block size %u\n",
2432 				cfg->block_size);
2433 		block_size = 0;
2434 	}
2435 
2436 	if (ctrl->page_sizes) {
2437 		int i, found;
2438 
2439 		for (i = 0, found = 0; ctrl->page_sizes[i]; i++)
2440 			if (ctrl->page_sizes[i] == cfg->page_size) {
2441 				page_size = i;
2442 				found = 1;
2443 			}
2444 		if (!found) {
2445 			dev_warn(ctrl->dev, "invalid page size %u\n",
2446 					cfg->page_size);
2447 			return -EINVAL;
2448 		}
2449 	} else {
2450 		page_size = ffs(cfg->page_size) - ffs(BRCMNAND_MIN_PAGESIZE);
2451 	}
2452 
2453 	if (cfg->page_size < BRCMNAND_MIN_PAGESIZE || (ctrl->max_page_size &&
2454 				cfg->page_size > ctrl->max_page_size)) {
2455 		dev_warn(ctrl->dev, "invalid page size %u\n", cfg->page_size);
2456 		return -EINVAL;
2457 	}
2458 
2459 	if (fls64(cfg->device_size) < fls64(BRCMNAND_MIN_DEVSIZE)) {
2460 		dev_warn(ctrl->dev, "invalid device size 0x%llx\n",
2461 			(unsigned long long)cfg->device_size);
2462 		return -EINVAL;
2463 	}
2464 	device_size = fls64(cfg->device_size) - fls64(BRCMNAND_MIN_DEVSIZE);
2465 
2466 	tmp = (cfg->blk_adr_bytes << CFG_BLK_ADR_BYTES_SHIFT) |
2467 		(cfg->col_adr_bytes << CFG_COL_ADR_BYTES_SHIFT) |
2468 		(cfg->ful_adr_bytes << CFG_FUL_ADR_BYTES_SHIFT) |
2469 		(!!(cfg->device_width == 16) << CFG_BUS_WIDTH_SHIFT) |
2470 		(device_size << CFG_DEVICE_SIZE_SHIFT);
2471 	if (cfg_offs == cfg_ext_offs) {
2472 		tmp |= (page_size << ctrl->page_size_shift) |
2473 		       (block_size << CFG_BLK_SIZE_SHIFT);
2474 		nand_writereg(ctrl, cfg_offs, tmp);
2475 	} else {
2476 		nand_writereg(ctrl, cfg_offs, tmp);
2477 		tmp = (page_size << CFG_EXT_PAGE_SIZE_SHIFT) |
2478 		      (block_size << CFG_EXT_BLK_SIZE_SHIFT);
2479 		nand_writereg(ctrl, cfg_ext_offs, tmp);
2480 	}
2481 
2482 	tmp = nand_readreg(ctrl, acc_control_offs);
2483 	tmp &= ~brcmnand_ecc_level_mask(ctrl);
2484 	tmp &= ~brcmnand_spare_area_mask(ctrl);
2485 	if (ctrl->nand_version >= 0x0302) {
2486 		tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT;
2487 		tmp |= cfg->spare_area_size;
2488 	}
2489 	nand_writereg(ctrl, acc_control_offs, tmp);
2490 
2491 	brcmnand_set_sector_size_1k(host, cfg->sector_size_1k);
2492 
2493 	/* threshold = ceil(BCH-level * 0.75) */
2494 	brcmnand_wr_corr_thresh(host, DIV_ROUND_UP(chip->ecc.strength * 3, 4));
2495 
2496 	return 0;
2497 }
2498 
2499 static void brcmnand_print_cfg(struct brcmnand_host *host,
2500 			       char *buf, struct brcmnand_cfg *cfg)
2501 {
2502 	buf += sprintf(buf,
2503 		"%lluMiB total, %uKiB blocks, %u%s pages, %uB OOB, %u-bit",
2504 		(unsigned long long)cfg->device_size >> 20,
2505 		cfg->block_size >> 10,
2506 		cfg->page_size >= 1024 ? cfg->page_size >> 10 : cfg->page_size,
2507 		cfg->page_size >= 1024 ? "KiB" : "B",
2508 		cfg->spare_area_size, cfg->device_width);
2509 
2510 	/* Account for Hamming ECC and for BCH 512B vs 1KiB sectors */
2511 	if (is_hamming_ecc(host->ctrl, cfg))
2512 		sprintf(buf, ", Hamming ECC");
2513 	else if (cfg->sector_size_1k)
2514 		sprintf(buf, ", BCH-%u (1KiB sector)", cfg->ecc_level << 1);
2515 	else
2516 		sprintf(buf, ", BCH-%u", cfg->ecc_level);
2517 }
2518 
2519 /*
2520  * Minimum number of bytes to address a page. Calculated as:
2521  *     roundup(log2(size / page-size) / 8)
2522  *
2523  * NB: the following does not "round up" for non-power-of-2 'size'; but this is
2524  *     OK because many other things will break if 'size' is irregular...
2525  */
2526 static inline int get_blk_adr_bytes(u64 size, u32 writesize)
2527 {
2528 	return ALIGN(ilog2(size) - ilog2(writesize), 8) >> 3;
2529 }
2530 
2531 static int brcmnand_setup_dev(struct brcmnand_host *host)
2532 {
2533 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
2534 	struct nand_chip *chip = &host->chip;
2535 	struct brcmnand_controller *ctrl = host->ctrl;
2536 	struct brcmnand_cfg *cfg = &host->hwcfg;
2537 	char msg[128];
2538 	u32 offs, tmp, oob_sector;
2539 	int ret;
2540 
2541 	memset(cfg, 0, sizeof(*cfg));
2542 
2543 	ret = of_property_read_u32(nand_get_flash_node(chip),
2544 				   "brcm,nand-oob-sector-size",
2545 				   &oob_sector);
2546 	if (ret) {
2547 		/* Use detected size */
2548 		cfg->spare_area_size = mtd->oobsize /
2549 					(mtd->writesize >> FC_SHIFT);
2550 	} else {
2551 		cfg->spare_area_size = oob_sector;
2552 	}
2553 	if (cfg->spare_area_size > ctrl->max_oob)
2554 		cfg->spare_area_size = ctrl->max_oob;
2555 	/*
2556 	 * Set oobsize to be consistent with controller's spare_area_size, as
2557 	 * the rest is inaccessible.
2558 	 */
2559 	mtd->oobsize = cfg->spare_area_size * (mtd->writesize >> FC_SHIFT);
2560 
2561 	cfg->device_size = mtd->size;
2562 	cfg->block_size = mtd->erasesize;
2563 	cfg->page_size = mtd->writesize;
2564 	cfg->device_width = (chip->options & NAND_BUSWIDTH_16) ? 16 : 8;
2565 	cfg->col_adr_bytes = 2;
2566 	cfg->blk_adr_bytes = get_blk_adr_bytes(mtd->size, mtd->writesize);
2567 
2568 	if (chip->ecc.mode != NAND_ECC_HW) {
2569 		dev_err(ctrl->dev, "only HW ECC supported; selected: %d\n",
2570 			chip->ecc.mode);
2571 		return -EINVAL;
2572 	}
2573 
2574 	if (chip->ecc.algo == NAND_ECC_UNKNOWN) {
2575 		if (chip->ecc.strength == 1 && chip->ecc.size == 512)
2576 			/* Default to Hamming for 1-bit ECC, if unspecified */
2577 			chip->ecc.algo = NAND_ECC_HAMMING;
2578 		else
2579 			/* Otherwise, BCH */
2580 			chip->ecc.algo = NAND_ECC_BCH;
2581 	}
2582 
2583 	if (chip->ecc.algo == NAND_ECC_HAMMING && (chip->ecc.strength != 1 ||
2584 						   chip->ecc.size != 512)) {
2585 		dev_err(ctrl->dev, "invalid Hamming params: %d bits per %d bytes\n",
2586 			chip->ecc.strength, chip->ecc.size);
2587 		return -EINVAL;
2588 	}
2589 
2590 	if (chip->ecc.mode != NAND_ECC_NONE &&
2591 	    (!chip->ecc.size || !chip->ecc.strength)) {
2592 		if (chip->base.eccreq.step_size && chip->base.eccreq.strength) {
2593 			/* use detected ECC parameters */
2594 			chip->ecc.size = chip->base.eccreq.step_size;
2595 			chip->ecc.strength = chip->base.eccreq.strength;
2596 			dev_info(ctrl->dev, "Using ECC step-size %d, strength %d\n",
2597 				chip->ecc.size, chip->ecc.strength);
2598 		}
2599 	}
2600 
2601 	switch (chip->ecc.size) {
2602 	case 512:
2603 		if (chip->ecc.algo == NAND_ECC_HAMMING)
2604 			cfg->ecc_level = 15;
2605 		else
2606 			cfg->ecc_level = chip->ecc.strength;
2607 		cfg->sector_size_1k = 0;
2608 		break;
2609 	case 1024:
2610 		if (!(ctrl->features & BRCMNAND_HAS_1K_SECTORS)) {
2611 			dev_err(ctrl->dev, "1KB sectors not supported\n");
2612 			return -EINVAL;
2613 		}
2614 		if (chip->ecc.strength & 0x1) {
2615 			dev_err(ctrl->dev,
2616 				"odd ECC not supported with 1KB sectors\n");
2617 			return -EINVAL;
2618 		}
2619 
2620 		cfg->ecc_level = chip->ecc.strength >> 1;
2621 		cfg->sector_size_1k = 1;
2622 		break;
2623 	default:
2624 		dev_err(ctrl->dev, "unsupported ECC size: %d\n",
2625 			chip->ecc.size);
2626 		return -EINVAL;
2627 	}
2628 
2629 	cfg->ful_adr_bytes = cfg->blk_adr_bytes;
2630 	if (mtd->writesize > 512)
2631 		cfg->ful_adr_bytes += cfg->col_adr_bytes;
2632 	else
2633 		cfg->ful_adr_bytes += 1;
2634 
2635 	ret = brcmnand_set_cfg(host, cfg);
2636 	if (ret)
2637 		return ret;
2638 
2639 	brcmnand_set_ecc_enabled(host, 1);
2640 
2641 	brcmnand_print_cfg(host, msg, cfg);
2642 	dev_info(ctrl->dev, "detected %s\n", msg);
2643 
2644 	/* Configure ACC_CONTROL */
2645 	offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
2646 	tmp = nand_readreg(ctrl, offs);
2647 	tmp &= ~ACC_CONTROL_PARTIAL_PAGE;
2648 	tmp &= ~ACC_CONTROL_RD_ERASED;
2649 
2650 	/* We need to turn on Read from erased paged protected by ECC */
2651 	if (ctrl->nand_version >= 0x0702)
2652 		tmp |= ACC_CONTROL_RD_ERASED;
2653 	tmp &= ~ACC_CONTROL_FAST_PGM_RDIN;
2654 	if (ctrl->features & BRCMNAND_HAS_PREFETCH)
2655 		tmp &= ~ACC_CONTROL_PREFETCH;
2656 
2657 	nand_writereg(ctrl, offs, tmp);
2658 
2659 	return 0;
2660 }
2661 
2662 static int brcmnand_attach_chip(struct nand_chip *chip)
2663 {
2664 	struct mtd_info *mtd = nand_to_mtd(chip);
2665 	struct brcmnand_host *host = nand_get_controller_data(chip);
2666 	int ret;
2667 
2668 	chip->options |= NAND_NO_SUBPAGE_WRITE;
2669 	/*
2670 	 * Avoid (for instance) kmap()'d buffers from JFFS2, which we can't DMA
2671 	 * to/from, and have nand_base pass us a bounce buffer instead, as
2672 	 * needed.
2673 	 */
2674 	chip->options |= NAND_USES_DMA;
2675 
2676 	if (chip->bbt_options & NAND_BBT_USE_FLASH)
2677 		chip->bbt_options |= NAND_BBT_NO_OOB;
2678 
2679 	if (brcmnand_setup_dev(host))
2680 		return -ENXIO;
2681 
2682 	chip->ecc.size = host->hwcfg.sector_size_1k ? 1024 : 512;
2683 
2684 	/* only use our internal HW threshold */
2685 	mtd->bitflip_threshold = 1;
2686 
2687 	ret = brcmstb_choose_ecc_layout(host);
2688 
2689 	return ret;
2690 }
2691 
2692 static const struct nand_controller_ops brcmnand_controller_ops = {
2693 	.attach_chip = brcmnand_attach_chip,
2694 };
2695 
2696 static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
2697 {
2698 	struct brcmnand_controller *ctrl = host->ctrl;
2699 	struct platform_device *pdev = host->pdev;
2700 	struct mtd_info *mtd;
2701 	struct nand_chip *chip;
2702 	int ret;
2703 	u16 cfg_offs;
2704 
2705 	ret = of_property_read_u32(dn, "reg", &host->cs);
2706 	if (ret) {
2707 		dev_err(&pdev->dev, "can't get chip-select\n");
2708 		return -ENXIO;
2709 	}
2710 
2711 	mtd = nand_to_mtd(&host->chip);
2712 	chip = &host->chip;
2713 
2714 	nand_set_flash_node(chip, dn);
2715 	nand_set_controller_data(chip, host);
2716 	mtd->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "brcmnand.%d",
2717 				   host->cs);
2718 	if (!mtd->name)
2719 		return -ENOMEM;
2720 
2721 	mtd->owner = THIS_MODULE;
2722 	mtd->dev.parent = &pdev->dev;
2723 
2724 	chip->legacy.cmd_ctrl = brcmnand_cmd_ctrl;
2725 	chip->legacy.cmdfunc = brcmnand_cmdfunc;
2726 	chip->legacy.waitfunc = brcmnand_waitfunc;
2727 	chip->legacy.read_byte = brcmnand_read_byte;
2728 	chip->legacy.read_buf = brcmnand_read_buf;
2729 	chip->legacy.write_buf = brcmnand_write_buf;
2730 
2731 	chip->ecc.mode = NAND_ECC_HW;
2732 	chip->ecc.read_page = brcmnand_read_page;
2733 	chip->ecc.write_page = brcmnand_write_page;
2734 	chip->ecc.read_page_raw = brcmnand_read_page_raw;
2735 	chip->ecc.write_page_raw = brcmnand_write_page_raw;
2736 	chip->ecc.write_oob_raw = brcmnand_write_oob_raw;
2737 	chip->ecc.read_oob_raw = brcmnand_read_oob_raw;
2738 	chip->ecc.read_oob = brcmnand_read_oob;
2739 	chip->ecc.write_oob = brcmnand_write_oob;
2740 
2741 	chip->controller = &ctrl->controller;
2742 
2743 	/*
2744 	 * The bootloader might have configured 16bit mode but
2745 	 * NAND READID command only works in 8bit mode. We force
2746 	 * 8bit mode here to ensure that NAND READID commands works.
2747 	 */
2748 	cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2749 	nand_writereg(ctrl, cfg_offs,
2750 		      nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
2751 
2752 	ret = nand_scan(chip, 1);
2753 	if (ret)
2754 		return ret;
2755 
2756 	ret = mtd_device_register(mtd, NULL, 0);
2757 	if (ret)
2758 		nand_cleanup(chip);
2759 
2760 	return ret;
2761 }
2762 
2763 static void brcmnand_save_restore_cs_config(struct brcmnand_host *host,
2764 					    int restore)
2765 {
2766 	struct brcmnand_controller *ctrl = host->ctrl;
2767 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2768 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
2769 			BRCMNAND_CS_CFG_EXT);
2770 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
2771 			BRCMNAND_CS_ACC_CONTROL);
2772 	u16 t1_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING1);
2773 	u16 t2_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING2);
2774 
2775 	if (restore) {
2776 		nand_writereg(ctrl, cfg_offs, host->hwcfg.config);
2777 		if (cfg_offs != cfg_ext_offs)
2778 			nand_writereg(ctrl, cfg_ext_offs,
2779 				      host->hwcfg.config_ext);
2780 		nand_writereg(ctrl, acc_control_offs, host->hwcfg.acc_control);
2781 		nand_writereg(ctrl, t1_offs, host->hwcfg.timing_1);
2782 		nand_writereg(ctrl, t2_offs, host->hwcfg.timing_2);
2783 	} else {
2784 		host->hwcfg.config = nand_readreg(ctrl, cfg_offs);
2785 		if (cfg_offs != cfg_ext_offs)
2786 			host->hwcfg.config_ext =
2787 				nand_readreg(ctrl, cfg_ext_offs);
2788 		host->hwcfg.acc_control = nand_readreg(ctrl, acc_control_offs);
2789 		host->hwcfg.timing_1 = nand_readreg(ctrl, t1_offs);
2790 		host->hwcfg.timing_2 = nand_readreg(ctrl, t2_offs);
2791 	}
2792 }
2793 
2794 static int brcmnand_suspend(struct device *dev)
2795 {
2796 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2797 	struct brcmnand_host *host;
2798 
2799 	list_for_each_entry(host, &ctrl->host_list, node)
2800 		brcmnand_save_restore_cs_config(host, 0);
2801 
2802 	ctrl->nand_cs_nand_select = brcmnand_read_reg(ctrl, BRCMNAND_CS_SELECT);
2803 	ctrl->nand_cs_nand_xor = brcmnand_read_reg(ctrl, BRCMNAND_CS_XOR);
2804 	ctrl->corr_stat_threshold =
2805 		brcmnand_read_reg(ctrl, BRCMNAND_CORR_THRESHOLD);
2806 
2807 	if (has_flash_dma(ctrl))
2808 		ctrl->flash_dma_mode = flash_dma_readl(ctrl, FLASH_DMA_MODE);
2809 	else if (has_edu(ctrl))
2810 		ctrl->edu_config = edu_readl(ctrl, EDU_CONFIG);
2811 
2812 	return 0;
2813 }
2814 
2815 static int brcmnand_resume(struct device *dev)
2816 {
2817 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2818 	struct brcmnand_host *host;
2819 
2820 	if (has_flash_dma(ctrl)) {
2821 		flash_dma_writel(ctrl, FLASH_DMA_MODE, ctrl->flash_dma_mode);
2822 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
2823 	}
2824 
2825 	if (has_edu(ctrl)) {
2826 		ctrl->edu_config = edu_readl(ctrl, EDU_CONFIG);
2827 		edu_writel(ctrl, EDU_CONFIG, ctrl->edu_config);
2828 		edu_readl(ctrl, EDU_CONFIG);
2829 		brcmnand_edu_init(ctrl);
2830 	}
2831 
2832 	brcmnand_write_reg(ctrl, BRCMNAND_CS_SELECT, ctrl->nand_cs_nand_select);
2833 	brcmnand_write_reg(ctrl, BRCMNAND_CS_XOR, ctrl->nand_cs_nand_xor);
2834 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_THRESHOLD,
2835 			ctrl->corr_stat_threshold);
2836 	if (ctrl->soc) {
2837 		/* Clear/re-enable interrupt */
2838 		ctrl->soc->ctlrdy_ack(ctrl->soc);
2839 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
2840 	}
2841 
2842 	list_for_each_entry(host, &ctrl->host_list, node) {
2843 		struct nand_chip *chip = &host->chip;
2844 
2845 		brcmnand_save_restore_cs_config(host, 1);
2846 
2847 		/* Reset the chip, required by some chips after power-up */
2848 		nand_reset_op(chip);
2849 	}
2850 
2851 	return 0;
2852 }
2853 
2854 const struct dev_pm_ops brcmnand_pm_ops = {
2855 	.suspend		= brcmnand_suspend,
2856 	.resume			= brcmnand_resume,
2857 };
2858 EXPORT_SYMBOL_GPL(brcmnand_pm_ops);
2859 
2860 static const struct of_device_id brcmnand_of_match[] = {
2861 	{ .compatible = "brcm,brcmnand-v2.1" },
2862 	{ .compatible = "brcm,brcmnand-v2.2" },
2863 	{ .compatible = "brcm,brcmnand-v4.0" },
2864 	{ .compatible = "brcm,brcmnand-v5.0" },
2865 	{ .compatible = "brcm,brcmnand-v6.0" },
2866 	{ .compatible = "brcm,brcmnand-v6.1" },
2867 	{ .compatible = "brcm,brcmnand-v6.2" },
2868 	{ .compatible = "brcm,brcmnand-v7.0" },
2869 	{ .compatible = "brcm,brcmnand-v7.1" },
2870 	{ .compatible = "brcm,brcmnand-v7.2" },
2871 	{ .compatible = "brcm,brcmnand-v7.3" },
2872 	{},
2873 };
2874 MODULE_DEVICE_TABLE(of, brcmnand_of_match);
2875 
2876 /***********************************************************************
2877  * Platform driver setup (per controller)
2878  ***********************************************************************/
2879 static int brcmnand_edu_setup(struct platform_device *pdev)
2880 {
2881 	struct device *dev = &pdev->dev;
2882 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
2883 	struct resource *res;
2884 	int ret;
2885 
2886 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "flash-edu");
2887 	if (res) {
2888 		ctrl->edu_base = devm_ioremap_resource(dev, res);
2889 		if (IS_ERR(ctrl->edu_base))
2890 			return PTR_ERR(ctrl->edu_base);
2891 
2892 		ctrl->edu_offsets = edu_regs;
2893 
2894 		edu_writel(ctrl, EDU_CONFIG, EDU_CONFIG_MODE_NAND |
2895 			   EDU_CONFIG_SWAP_CFG);
2896 		edu_readl(ctrl, EDU_CONFIG);
2897 
2898 		/* initialize edu */
2899 		brcmnand_edu_init(ctrl);
2900 
2901 		ctrl->edu_irq = platform_get_irq_optional(pdev, 1);
2902 		if (ctrl->edu_irq < 0) {
2903 			dev_warn(dev,
2904 				 "FLASH EDU enabled, using ctlrdy irq\n");
2905 		} else {
2906 			ret = devm_request_irq(dev, ctrl->edu_irq,
2907 					       brcmnand_edu_irq, 0,
2908 					       "brcmnand-edu", ctrl);
2909 			if (ret < 0) {
2910 				dev_err(ctrl->dev, "can't allocate IRQ %d: error %d\n",
2911 					ctrl->edu_irq, ret);
2912 				return ret;
2913 			}
2914 
2915 			dev_info(dev, "FLASH EDU enabled using irq %u\n",
2916 				 ctrl->edu_irq);
2917 		}
2918 	}
2919 
2920 	return 0;
2921 }
2922 
2923 int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
2924 {
2925 	struct device *dev = &pdev->dev;
2926 	struct device_node *dn = dev->of_node, *child;
2927 	struct brcmnand_controller *ctrl;
2928 	struct resource *res;
2929 	int ret;
2930 
2931 	/* We only support device-tree instantiation */
2932 	if (!dn)
2933 		return -ENODEV;
2934 
2935 	if (!of_match_node(brcmnand_of_match, dn))
2936 		return -ENODEV;
2937 
2938 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
2939 	if (!ctrl)
2940 		return -ENOMEM;
2941 
2942 	dev_set_drvdata(dev, ctrl);
2943 	ctrl->dev = dev;
2944 
2945 	init_completion(&ctrl->done);
2946 	init_completion(&ctrl->dma_done);
2947 	init_completion(&ctrl->edu_done);
2948 	nand_controller_init(&ctrl->controller);
2949 	ctrl->controller.ops = &brcmnand_controller_ops;
2950 	INIT_LIST_HEAD(&ctrl->host_list);
2951 
2952 	/* NAND register range */
2953 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
2954 	ctrl->nand_base = devm_ioremap_resource(dev, res);
2955 	if (IS_ERR(ctrl->nand_base))
2956 		return PTR_ERR(ctrl->nand_base);
2957 
2958 	/* Enable clock before using NAND registers */
2959 	ctrl->clk = devm_clk_get(dev, "nand");
2960 	if (!IS_ERR(ctrl->clk)) {
2961 		ret = clk_prepare_enable(ctrl->clk);
2962 		if (ret)
2963 			return ret;
2964 	} else {
2965 		ret = PTR_ERR(ctrl->clk);
2966 		if (ret == -EPROBE_DEFER)
2967 			return ret;
2968 
2969 		ctrl->clk = NULL;
2970 	}
2971 
2972 	/* Initialize NAND revision */
2973 	ret = brcmnand_revision_init(ctrl);
2974 	if (ret)
2975 		goto err;
2976 
2977 	/*
2978 	 * Most chips have this cache at a fixed offset within 'nand' block.
2979 	 * Some must specify this region separately.
2980 	 */
2981 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "nand-cache");
2982 	if (res) {
2983 		ctrl->nand_fc = devm_ioremap_resource(dev, res);
2984 		if (IS_ERR(ctrl->nand_fc)) {
2985 			ret = PTR_ERR(ctrl->nand_fc);
2986 			goto err;
2987 		}
2988 	} else {
2989 		ctrl->nand_fc = ctrl->nand_base +
2990 				ctrl->reg_offsets[BRCMNAND_FC_BASE];
2991 	}
2992 
2993 	/* FLASH_DMA */
2994 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "flash-dma");
2995 	if (res) {
2996 		ctrl->flash_dma_base = devm_ioremap_resource(dev, res);
2997 		if (IS_ERR(ctrl->flash_dma_base)) {
2998 			ret = PTR_ERR(ctrl->flash_dma_base);
2999 			goto err;
3000 		}
3001 
3002 		/* initialize the dma version */
3003 		brcmnand_flash_dma_revision_init(ctrl);
3004 
3005 		ret = -EIO;
3006 		if (ctrl->nand_version >= 0x0700)
3007 			ret = dma_set_mask_and_coherent(&pdev->dev,
3008 							DMA_BIT_MASK(40));
3009 		if (ret)
3010 			ret = dma_set_mask_and_coherent(&pdev->dev,
3011 							DMA_BIT_MASK(32));
3012 		if (ret)
3013 			goto err;
3014 
3015 		/* linked-list and stop on error */
3016 		flash_dma_writel(ctrl, FLASH_DMA_MODE, FLASH_DMA_MODE_MASK);
3017 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
3018 
3019 		/* Allocate descriptor(s) */
3020 		ctrl->dma_desc = dmam_alloc_coherent(dev,
3021 						     sizeof(*ctrl->dma_desc),
3022 						     &ctrl->dma_pa, GFP_KERNEL);
3023 		if (!ctrl->dma_desc) {
3024 			ret = -ENOMEM;
3025 			goto err;
3026 		}
3027 
3028 		ctrl->dma_irq = platform_get_irq(pdev, 1);
3029 		if ((int)ctrl->dma_irq < 0) {
3030 			dev_err(dev, "missing FLASH_DMA IRQ\n");
3031 			ret = -ENODEV;
3032 			goto err;
3033 		}
3034 
3035 		ret = devm_request_irq(dev, ctrl->dma_irq,
3036 				brcmnand_dma_irq, 0, DRV_NAME,
3037 				ctrl);
3038 		if (ret < 0) {
3039 			dev_err(dev, "can't allocate IRQ %d: error %d\n",
3040 					ctrl->dma_irq, ret);
3041 			goto err;
3042 		}
3043 
3044 		dev_info(dev, "enabling FLASH_DMA\n");
3045 		/* set flash dma transfer function to call */
3046 		ctrl->dma_trans = brcmnand_dma_trans;
3047 	} else	{
3048 		ret = brcmnand_edu_setup(pdev);
3049 		if (ret < 0)
3050 			goto err;
3051 
3052 		if (has_edu(ctrl))
3053 			/* set edu transfer function to call */
3054 			ctrl->dma_trans = brcmnand_edu_trans;
3055 	}
3056 
3057 	/* Disable automatic device ID config, direct addressing */
3058 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT,
3059 			 CS_SELECT_AUTO_DEVICE_ID_CFG | 0xff, 0, 0);
3060 	/* Disable XOR addressing */
3061 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_XOR, 0xff, 0, 0);
3062 
3063 	if (ctrl->features & BRCMNAND_HAS_WP) {
3064 		/* Permanently disable write protection */
3065 		if (wp_on == 2)
3066 			brcmnand_set_wp(ctrl, false);
3067 	} else {
3068 		wp_on = 0;
3069 	}
3070 
3071 	/* IRQ */
3072 	ctrl->irq = platform_get_irq(pdev, 0);
3073 	if ((int)ctrl->irq < 0) {
3074 		dev_err(dev, "no IRQ defined\n");
3075 		ret = -ENODEV;
3076 		goto err;
3077 	}
3078 
3079 	/*
3080 	 * Some SoCs integrate this controller (e.g., its interrupt bits) in
3081 	 * interesting ways
3082 	 */
3083 	if (soc) {
3084 		ctrl->soc = soc;
3085 
3086 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
3087 				       DRV_NAME, ctrl);
3088 
3089 		/* Enable interrupt */
3090 		ctrl->soc->ctlrdy_ack(ctrl->soc);
3091 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
3092 	} else {
3093 		/* Use standard interrupt infrastructure */
3094 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_ctlrdy_irq, 0,
3095 				       DRV_NAME, ctrl);
3096 	}
3097 	if (ret < 0) {
3098 		dev_err(dev, "can't allocate IRQ %d: error %d\n",
3099 			ctrl->irq, ret);
3100 		goto err;
3101 	}
3102 
3103 	for_each_available_child_of_node(dn, child) {
3104 		if (of_device_is_compatible(child, "brcm,nandcs")) {
3105 			struct brcmnand_host *host;
3106 
3107 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
3108 			if (!host) {
3109 				of_node_put(child);
3110 				ret = -ENOMEM;
3111 				goto err;
3112 			}
3113 			host->pdev = pdev;
3114 			host->ctrl = ctrl;
3115 
3116 			ret = brcmnand_init_cs(host, child);
3117 			if (ret) {
3118 				devm_kfree(dev, host);
3119 				continue; /* Try all chip-selects */
3120 			}
3121 
3122 			list_add_tail(&host->node, &ctrl->host_list);
3123 		}
3124 	}
3125 
3126 	/* No chip-selects could initialize properly */
3127 	if (list_empty(&ctrl->host_list)) {
3128 		ret = -ENODEV;
3129 		goto err;
3130 	}
3131 
3132 	return 0;
3133 
3134 err:
3135 	clk_disable_unprepare(ctrl->clk);
3136 	return ret;
3137 
3138 }
3139 EXPORT_SYMBOL_GPL(brcmnand_probe);
3140 
3141 int brcmnand_remove(struct platform_device *pdev)
3142 {
3143 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
3144 	struct brcmnand_host *host;
3145 	struct nand_chip *chip;
3146 	int ret;
3147 
3148 	list_for_each_entry(host, &ctrl->host_list, node) {
3149 		chip = &host->chip;
3150 		ret = mtd_device_unregister(nand_to_mtd(chip));
3151 		WARN_ON(ret);
3152 		nand_cleanup(chip);
3153 	}
3154 
3155 	clk_disable_unprepare(ctrl->clk);
3156 
3157 	dev_set_drvdata(&pdev->dev, NULL);
3158 
3159 	return 0;
3160 }
3161 EXPORT_SYMBOL_GPL(brcmnand_remove);
3162 
3163 MODULE_LICENSE("GPL v2");
3164 MODULE_AUTHOR("Kevin Cernekee");
3165 MODULE_AUTHOR("Brian Norris");
3166 MODULE_DESCRIPTION("NAND driver for Broadcom chips");
3167 MODULE_ALIAS("platform:brcmnand");
3168