1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright © 2010-2015 Broadcom Corporation
4  */
5 
6 #include <linux/clk.h>
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/delay.h>
10 #include <linux/device.h>
11 #include <linux/platform_device.h>
12 #include <linux/err.h>
13 #include <linux/completion.h>
14 #include <linux/interrupt.h>
15 #include <linux/spinlock.h>
16 #include <linux/dma-mapping.h>
17 #include <linux/ioport.h>
18 #include <linux/bug.h>
19 #include <linux/kernel.h>
20 #include <linux/bitops.h>
21 #include <linux/mm.h>
22 #include <linux/mtd/mtd.h>
23 #include <linux/mtd/rawnand.h>
24 #include <linux/mtd/partitions.h>
25 #include <linux/of.h>
26 #include <linux/of_platform.h>
27 #include <linux/slab.h>
28 #include <linux/list.h>
29 #include <linux/log2.h>
30 
31 #include "brcmnand.h"
32 
33 /*
34  * This flag controls if WP stays on between erase/write commands to mitigate
35  * flash corruption due to power glitches. Values:
36  * 0: NAND_WP is not used or not available
37  * 1: NAND_WP is set by default, cleared for erase/write operations
38  * 2: NAND_WP is always cleared
39  */
40 static int wp_on = 1;
41 module_param(wp_on, int, 0444);
42 
43 /***********************************************************************
44  * Definitions
45  ***********************************************************************/
46 
47 #define DRV_NAME			"brcmnand"
48 
49 #define CMD_NULL			0x00
50 #define CMD_PAGE_READ			0x01
51 #define CMD_SPARE_AREA_READ		0x02
52 #define CMD_STATUS_READ			0x03
53 #define CMD_PROGRAM_PAGE		0x04
54 #define CMD_PROGRAM_SPARE_AREA		0x05
55 #define CMD_COPY_BACK			0x06
56 #define CMD_DEVICE_ID_READ		0x07
57 #define CMD_BLOCK_ERASE			0x08
58 #define CMD_FLASH_RESET			0x09
59 #define CMD_BLOCKS_LOCK			0x0a
60 #define CMD_BLOCKS_LOCK_DOWN		0x0b
61 #define CMD_BLOCKS_UNLOCK		0x0c
62 #define CMD_READ_BLOCKS_LOCK_STATUS	0x0d
63 #define CMD_PARAMETER_READ		0x0e
64 #define CMD_PARAMETER_CHANGE_COL	0x0f
65 #define CMD_LOW_LEVEL_OP		0x10
66 
67 struct brcm_nand_dma_desc {
68 	u32 next_desc;
69 	u32 next_desc_ext;
70 	u32 cmd_irq;
71 	u32 dram_addr;
72 	u32 dram_addr_ext;
73 	u32 tfr_len;
74 	u32 total_len;
75 	u32 flash_addr;
76 	u32 flash_addr_ext;
77 	u32 cs;
78 	u32 pad2[5];
79 	u32 status_valid;
80 } __packed;
81 
82 /* Bitfields for brcm_nand_dma_desc::status_valid */
83 #define FLASH_DMA_ECC_ERROR	(1 << 8)
84 #define FLASH_DMA_CORR_ERROR	(1 << 9)
85 
86 /* Bitfields for DMA_MODE */
87 #define FLASH_DMA_MODE_STOP_ON_ERROR	BIT(1) /* stop in Uncorr ECC error */
88 #define FLASH_DMA_MODE_MODE		BIT(0) /* link list */
89 #define FLASH_DMA_MODE_MASK		(FLASH_DMA_MODE_STOP_ON_ERROR |	\
90 						FLASH_DMA_MODE_MODE)
91 
92 /* 512B flash cache in the NAND controller HW */
93 #define FC_SHIFT		9U
94 #define FC_BYTES		512U
95 #define FC_WORDS		(FC_BYTES >> 2)
96 
97 #define BRCMNAND_MIN_PAGESIZE	512
98 #define BRCMNAND_MIN_BLOCKSIZE	(8 * 1024)
99 #define BRCMNAND_MIN_DEVSIZE	(4ULL * 1024 * 1024)
100 
101 #define NAND_CTRL_RDY			(INTFC_CTLR_READY | INTFC_FLASH_READY)
102 #define NAND_POLL_STATUS_TIMEOUT_MS	100
103 
104 #define EDU_CMD_WRITE          0x00
105 #define EDU_CMD_READ           0x01
106 #define EDU_STATUS_ACTIVE      BIT(0)
107 #define EDU_ERR_STATUS_ERRACK  BIT(0)
108 #define EDU_DONE_MASK		GENMASK(1, 0)
109 
110 #define EDU_CONFIG_MODE_NAND   BIT(0)
111 #define EDU_CONFIG_SWAP_BYTE   BIT(1)
112 #ifdef CONFIG_CPU_BIG_ENDIAN
113 #define EDU_CONFIG_SWAP_CFG     EDU_CONFIG_SWAP_BYTE
114 #else
115 #define EDU_CONFIG_SWAP_CFG     0
116 #endif
117 
118 /* edu registers */
119 enum edu_reg {
120 	EDU_CONFIG = 0,
121 	EDU_DRAM_ADDR,
122 	EDU_EXT_ADDR,
123 	EDU_LENGTH,
124 	EDU_CMD,
125 	EDU_STOP,
126 	EDU_STATUS,
127 	EDU_DONE,
128 	EDU_ERR_STATUS,
129 };
130 
131 static const u16  edu_regs[] = {
132 	[EDU_CONFIG] = 0x00,
133 	[EDU_DRAM_ADDR] = 0x04,
134 	[EDU_EXT_ADDR] = 0x08,
135 	[EDU_LENGTH] = 0x0c,
136 	[EDU_CMD] = 0x10,
137 	[EDU_STOP] = 0x14,
138 	[EDU_STATUS] = 0x18,
139 	[EDU_DONE] = 0x1c,
140 	[EDU_ERR_STATUS] = 0x20,
141 };
142 
143 /* flash_dma registers */
144 enum flash_dma_reg {
145 	FLASH_DMA_REVISION = 0,
146 	FLASH_DMA_FIRST_DESC,
147 	FLASH_DMA_FIRST_DESC_EXT,
148 	FLASH_DMA_CTRL,
149 	FLASH_DMA_MODE,
150 	FLASH_DMA_STATUS,
151 	FLASH_DMA_INTERRUPT_DESC,
152 	FLASH_DMA_INTERRUPT_DESC_EXT,
153 	FLASH_DMA_ERROR_STATUS,
154 	FLASH_DMA_CURRENT_DESC,
155 	FLASH_DMA_CURRENT_DESC_EXT,
156 };
157 
158 /* flash_dma registers v0*/
159 static const u16 flash_dma_regs_v0[] = {
160 	[FLASH_DMA_REVISION]		= 0x00,
161 	[FLASH_DMA_FIRST_DESC]		= 0x04,
162 	[FLASH_DMA_CTRL]		= 0x08,
163 	[FLASH_DMA_MODE]		= 0x0c,
164 	[FLASH_DMA_STATUS]		= 0x10,
165 	[FLASH_DMA_INTERRUPT_DESC]	= 0x14,
166 	[FLASH_DMA_ERROR_STATUS]	= 0x18,
167 	[FLASH_DMA_CURRENT_DESC]	= 0x1c,
168 };
169 
170 /* flash_dma registers v1*/
171 static const u16 flash_dma_regs_v1[] = {
172 	[FLASH_DMA_REVISION]		= 0x00,
173 	[FLASH_DMA_FIRST_DESC]		= 0x04,
174 	[FLASH_DMA_FIRST_DESC_EXT]	= 0x08,
175 	[FLASH_DMA_CTRL]		= 0x0c,
176 	[FLASH_DMA_MODE]		= 0x10,
177 	[FLASH_DMA_STATUS]		= 0x14,
178 	[FLASH_DMA_INTERRUPT_DESC]	= 0x18,
179 	[FLASH_DMA_INTERRUPT_DESC_EXT]	= 0x1c,
180 	[FLASH_DMA_ERROR_STATUS]	= 0x20,
181 	[FLASH_DMA_CURRENT_DESC]	= 0x24,
182 	[FLASH_DMA_CURRENT_DESC_EXT]	= 0x28,
183 };
184 
185 /* flash_dma registers v4 */
186 static const u16 flash_dma_regs_v4[] = {
187 	[FLASH_DMA_REVISION]		= 0x00,
188 	[FLASH_DMA_FIRST_DESC]		= 0x08,
189 	[FLASH_DMA_FIRST_DESC_EXT]	= 0x0c,
190 	[FLASH_DMA_CTRL]		= 0x10,
191 	[FLASH_DMA_MODE]		= 0x14,
192 	[FLASH_DMA_STATUS]		= 0x18,
193 	[FLASH_DMA_INTERRUPT_DESC]	= 0x20,
194 	[FLASH_DMA_INTERRUPT_DESC_EXT]	= 0x24,
195 	[FLASH_DMA_ERROR_STATUS]	= 0x28,
196 	[FLASH_DMA_CURRENT_DESC]	= 0x30,
197 	[FLASH_DMA_CURRENT_DESC_EXT]	= 0x34,
198 };
199 
200 /* Controller feature flags */
201 enum {
202 	BRCMNAND_HAS_1K_SECTORS			= BIT(0),
203 	BRCMNAND_HAS_PREFETCH			= BIT(1),
204 	BRCMNAND_HAS_CACHE_MODE			= BIT(2),
205 	BRCMNAND_HAS_WP				= BIT(3),
206 };
207 
208 struct brcmnand_host;
209 
210 struct brcmnand_controller {
211 	struct device		*dev;
212 	struct nand_controller	controller;
213 	void __iomem		*nand_base;
214 	void __iomem		*nand_fc; /* flash cache */
215 	void __iomem		*flash_dma_base;
216 	unsigned int		irq;
217 	unsigned int		dma_irq;
218 	int			nand_version;
219 
220 	/* Some SoCs provide custom interrupt status register(s) */
221 	struct brcmnand_soc	*soc;
222 
223 	/* Some SoCs have a gateable clock for the controller */
224 	struct clk		*clk;
225 
226 	int			cmd_pending;
227 	bool			dma_pending;
228 	bool                    edu_pending;
229 	struct completion	done;
230 	struct completion	dma_done;
231 	struct completion       edu_done;
232 
233 	/* List of NAND hosts (one for each chip-select) */
234 	struct list_head host_list;
235 
236 	/* EDU info, per-transaction */
237 	const u16               *edu_offsets;
238 	void __iomem            *edu_base;
239 	int			edu_irq;
240 	int                     edu_count;
241 	u64                     edu_dram_addr;
242 	u32                     edu_ext_addr;
243 	u32                     edu_cmd;
244 	u32                     edu_config;
245 	int			sas; /* spare area size, per flash cache */
246 	int			sector_size_1k;
247 	u8			*oob;
248 
249 	/* flash_dma reg */
250 	const u16		*flash_dma_offsets;
251 	struct brcm_nand_dma_desc *dma_desc;
252 	dma_addr_t		dma_pa;
253 
254 	int (*dma_trans)(struct brcmnand_host *host, u64 addr, u32 *buf,
255 			 u8 *oob, u32 len, u8 dma_cmd);
256 
257 	/* in-memory cache of the FLASH_CACHE, used only for some commands */
258 	u8			flash_cache[FC_BYTES];
259 
260 	/* Controller revision details */
261 	const u16		*reg_offsets;
262 	unsigned int		reg_spacing; /* between CS1, CS2, ... regs */
263 	const u8		*cs_offsets; /* within each chip-select */
264 	const u8		*cs0_offsets; /* within CS0, if different */
265 	unsigned int		max_block_size;
266 	const unsigned int	*block_sizes;
267 	unsigned int		max_page_size;
268 	const unsigned int	*page_sizes;
269 	unsigned int		page_size_shift;
270 	unsigned int		max_oob;
271 	u32			features;
272 
273 	/* for low-power standby/resume only */
274 	u32			nand_cs_nand_select;
275 	u32			nand_cs_nand_xor;
276 	u32			corr_stat_threshold;
277 	u32			flash_dma_mode;
278 	u32                     flash_edu_mode;
279 	bool			pio_poll_mode;
280 };
281 
282 struct brcmnand_cfg {
283 	u64			device_size;
284 	unsigned int		block_size;
285 	unsigned int		page_size;
286 	unsigned int		spare_area_size;
287 	unsigned int		device_width;
288 	unsigned int		col_adr_bytes;
289 	unsigned int		blk_adr_bytes;
290 	unsigned int		ful_adr_bytes;
291 	unsigned int		sector_size_1k;
292 	unsigned int		ecc_level;
293 	/* use for low-power standby/resume only */
294 	u32			acc_control;
295 	u32			config;
296 	u32			config_ext;
297 	u32			timing_1;
298 	u32			timing_2;
299 };
300 
301 struct brcmnand_host {
302 	struct list_head	node;
303 
304 	struct nand_chip	chip;
305 	struct platform_device	*pdev;
306 	int			cs;
307 
308 	unsigned int		last_cmd;
309 	unsigned int		last_byte;
310 	u64			last_addr;
311 	struct brcmnand_cfg	hwcfg;
312 	struct brcmnand_controller *ctrl;
313 };
314 
315 enum brcmnand_reg {
316 	BRCMNAND_CMD_START = 0,
317 	BRCMNAND_CMD_EXT_ADDRESS,
318 	BRCMNAND_CMD_ADDRESS,
319 	BRCMNAND_INTFC_STATUS,
320 	BRCMNAND_CS_SELECT,
321 	BRCMNAND_CS_XOR,
322 	BRCMNAND_LL_OP,
323 	BRCMNAND_CS0_BASE,
324 	BRCMNAND_CS1_BASE,		/* CS1 regs, if non-contiguous */
325 	BRCMNAND_CORR_THRESHOLD,
326 	BRCMNAND_CORR_THRESHOLD_EXT,
327 	BRCMNAND_UNCORR_COUNT,
328 	BRCMNAND_CORR_COUNT,
329 	BRCMNAND_CORR_EXT_ADDR,
330 	BRCMNAND_CORR_ADDR,
331 	BRCMNAND_UNCORR_EXT_ADDR,
332 	BRCMNAND_UNCORR_ADDR,
333 	BRCMNAND_SEMAPHORE,
334 	BRCMNAND_ID,
335 	BRCMNAND_ID_EXT,
336 	BRCMNAND_LL_RDATA,
337 	BRCMNAND_OOB_READ_BASE,
338 	BRCMNAND_OOB_READ_10_BASE,	/* offset 0x10, if non-contiguous */
339 	BRCMNAND_OOB_WRITE_BASE,
340 	BRCMNAND_OOB_WRITE_10_BASE,	/* offset 0x10, if non-contiguous */
341 	BRCMNAND_FC_BASE,
342 };
343 
344 /* BRCMNAND v2.1-v2.2 */
345 static const u16 brcmnand_regs_v21[] = {
346 	[BRCMNAND_CMD_START]		=  0x04,
347 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
348 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
349 	[BRCMNAND_INTFC_STATUS]		=  0x5c,
350 	[BRCMNAND_CS_SELECT]		=  0x14,
351 	[BRCMNAND_CS_XOR]		=  0x18,
352 	[BRCMNAND_LL_OP]		=     0,
353 	[BRCMNAND_CS0_BASE]		=  0x40,
354 	[BRCMNAND_CS1_BASE]		=     0,
355 	[BRCMNAND_CORR_THRESHOLD]	=     0,
356 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
357 	[BRCMNAND_UNCORR_COUNT]		=     0,
358 	[BRCMNAND_CORR_COUNT]		=     0,
359 	[BRCMNAND_CORR_EXT_ADDR]	=  0x60,
360 	[BRCMNAND_CORR_ADDR]		=  0x64,
361 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x68,
362 	[BRCMNAND_UNCORR_ADDR]		=  0x6c,
363 	[BRCMNAND_SEMAPHORE]		=  0x50,
364 	[BRCMNAND_ID]			=  0x54,
365 	[BRCMNAND_ID_EXT]		=     0,
366 	[BRCMNAND_LL_RDATA]		=     0,
367 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
368 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
369 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
370 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
371 	[BRCMNAND_FC_BASE]		= 0x200,
372 };
373 
374 /* BRCMNAND v3.3-v4.0 */
375 static const u16 brcmnand_regs_v33[] = {
376 	[BRCMNAND_CMD_START]		=  0x04,
377 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
378 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
379 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
380 	[BRCMNAND_CS_SELECT]		=  0x14,
381 	[BRCMNAND_CS_XOR]		=  0x18,
382 	[BRCMNAND_LL_OP]		= 0x178,
383 	[BRCMNAND_CS0_BASE]		=  0x40,
384 	[BRCMNAND_CS1_BASE]		=  0xd0,
385 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
386 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
387 	[BRCMNAND_UNCORR_COUNT]		=     0,
388 	[BRCMNAND_CORR_COUNT]		=     0,
389 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
390 	[BRCMNAND_CORR_ADDR]		=  0x74,
391 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
392 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
393 	[BRCMNAND_SEMAPHORE]		=  0x58,
394 	[BRCMNAND_ID]			=  0x60,
395 	[BRCMNAND_ID_EXT]		=  0x64,
396 	[BRCMNAND_LL_RDATA]		= 0x17c,
397 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
398 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
399 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
400 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
401 	[BRCMNAND_FC_BASE]		= 0x200,
402 };
403 
404 /* BRCMNAND v5.0 */
405 static const u16 brcmnand_regs_v50[] = {
406 	[BRCMNAND_CMD_START]		=  0x04,
407 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
408 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
409 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
410 	[BRCMNAND_CS_SELECT]		=  0x14,
411 	[BRCMNAND_CS_XOR]		=  0x18,
412 	[BRCMNAND_LL_OP]		= 0x178,
413 	[BRCMNAND_CS0_BASE]		=  0x40,
414 	[BRCMNAND_CS1_BASE]		=  0xd0,
415 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
416 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
417 	[BRCMNAND_UNCORR_COUNT]		=     0,
418 	[BRCMNAND_CORR_COUNT]		=     0,
419 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
420 	[BRCMNAND_CORR_ADDR]		=  0x74,
421 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
422 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
423 	[BRCMNAND_SEMAPHORE]		=  0x58,
424 	[BRCMNAND_ID]			=  0x60,
425 	[BRCMNAND_ID_EXT]		=  0x64,
426 	[BRCMNAND_LL_RDATA]		= 0x17c,
427 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
428 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
429 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
430 	[BRCMNAND_OOB_WRITE_10_BASE]	= 0x140,
431 	[BRCMNAND_FC_BASE]		= 0x200,
432 };
433 
434 /* BRCMNAND v6.0 - v7.1 */
435 static const u16 brcmnand_regs_v60[] = {
436 	[BRCMNAND_CMD_START]		=  0x04,
437 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
438 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
439 	[BRCMNAND_INTFC_STATUS]		=  0x14,
440 	[BRCMNAND_CS_SELECT]		=  0x18,
441 	[BRCMNAND_CS_XOR]		=  0x1c,
442 	[BRCMNAND_LL_OP]		=  0x20,
443 	[BRCMNAND_CS0_BASE]		=  0x50,
444 	[BRCMNAND_CS1_BASE]		=     0,
445 	[BRCMNAND_CORR_THRESHOLD]	=  0xc0,
446 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xc4,
447 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
448 	[BRCMNAND_CORR_COUNT]		= 0x100,
449 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
450 	[BRCMNAND_CORR_ADDR]		= 0x110,
451 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
452 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
453 	[BRCMNAND_SEMAPHORE]		= 0x150,
454 	[BRCMNAND_ID]			= 0x194,
455 	[BRCMNAND_ID_EXT]		= 0x198,
456 	[BRCMNAND_LL_RDATA]		= 0x19c,
457 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
458 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
459 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
460 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
461 	[BRCMNAND_FC_BASE]		= 0x400,
462 };
463 
464 /* BRCMNAND v7.1 */
465 static const u16 brcmnand_regs_v71[] = {
466 	[BRCMNAND_CMD_START]		=  0x04,
467 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
468 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
469 	[BRCMNAND_INTFC_STATUS]		=  0x14,
470 	[BRCMNAND_CS_SELECT]		=  0x18,
471 	[BRCMNAND_CS_XOR]		=  0x1c,
472 	[BRCMNAND_LL_OP]		=  0x20,
473 	[BRCMNAND_CS0_BASE]		=  0x50,
474 	[BRCMNAND_CS1_BASE]		=     0,
475 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
476 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
477 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
478 	[BRCMNAND_CORR_COUNT]		= 0x100,
479 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
480 	[BRCMNAND_CORR_ADDR]		= 0x110,
481 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
482 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
483 	[BRCMNAND_SEMAPHORE]		= 0x150,
484 	[BRCMNAND_ID]			= 0x194,
485 	[BRCMNAND_ID_EXT]		= 0x198,
486 	[BRCMNAND_LL_RDATA]		= 0x19c,
487 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
488 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
489 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
490 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
491 	[BRCMNAND_FC_BASE]		= 0x400,
492 };
493 
494 /* BRCMNAND v7.2 */
495 static const u16 brcmnand_regs_v72[] = {
496 	[BRCMNAND_CMD_START]		=  0x04,
497 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
498 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
499 	[BRCMNAND_INTFC_STATUS]		=  0x14,
500 	[BRCMNAND_CS_SELECT]		=  0x18,
501 	[BRCMNAND_CS_XOR]		=  0x1c,
502 	[BRCMNAND_LL_OP]		=  0x20,
503 	[BRCMNAND_CS0_BASE]		=  0x50,
504 	[BRCMNAND_CS1_BASE]		=     0,
505 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
506 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
507 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
508 	[BRCMNAND_CORR_COUNT]		= 0x100,
509 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
510 	[BRCMNAND_CORR_ADDR]		= 0x110,
511 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
512 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
513 	[BRCMNAND_SEMAPHORE]		= 0x150,
514 	[BRCMNAND_ID]			= 0x194,
515 	[BRCMNAND_ID_EXT]		= 0x198,
516 	[BRCMNAND_LL_RDATA]		= 0x19c,
517 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
518 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
519 	[BRCMNAND_OOB_WRITE_BASE]	= 0x400,
520 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
521 	[BRCMNAND_FC_BASE]		= 0x600,
522 };
523 
524 enum brcmnand_cs_reg {
525 	BRCMNAND_CS_CFG_EXT = 0,
526 	BRCMNAND_CS_CFG,
527 	BRCMNAND_CS_ACC_CONTROL,
528 	BRCMNAND_CS_TIMING1,
529 	BRCMNAND_CS_TIMING2,
530 };
531 
532 /* Per chip-select offsets for v7.1 */
533 static const u8 brcmnand_cs_offsets_v71[] = {
534 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
535 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
536 	[BRCMNAND_CS_CFG]		= 0x08,
537 	[BRCMNAND_CS_TIMING1]		= 0x0c,
538 	[BRCMNAND_CS_TIMING2]		= 0x10,
539 };
540 
541 /* Per chip-select offsets for pre v7.1, except CS0 on <= v5.0 */
542 static const u8 brcmnand_cs_offsets[] = {
543 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
544 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
545 	[BRCMNAND_CS_CFG]		= 0x04,
546 	[BRCMNAND_CS_TIMING1]		= 0x08,
547 	[BRCMNAND_CS_TIMING2]		= 0x0c,
548 };
549 
550 /* Per chip-select offset for <= v5.0 on CS0 only */
551 static const u8 brcmnand_cs_offsets_cs0[] = {
552 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
553 	[BRCMNAND_CS_CFG_EXT]		= 0x08,
554 	[BRCMNAND_CS_CFG]		= 0x08,
555 	[BRCMNAND_CS_TIMING1]		= 0x10,
556 	[BRCMNAND_CS_TIMING2]		= 0x14,
557 };
558 
559 /*
560  * Bitfields for the CFG and CFG_EXT registers. Pre-v7.1 controllers only had
561  * one config register, but once the bitfields overflowed, newer controllers
562  * (v7.1 and newer) added a CFG_EXT register and shuffled a few fields around.
563  */
564 enum {
565 	CFG_BLK_ADR_BYTES_SHIFT		= 8,
566 	CFG_COL_ADR_BYTES_SHIFT		= 12,
567 	CFG_FUL_ADR_BYTES_SHIFT		= 16,
568 	CFG_BUS_WIDTH_SHIFT		= 23,
569 	CFG_BUS_WIDTH			= BIT(CFG_BUS_WIDTH_SHIFT),
570 	CFG_DEVICE_SIZE_SHIFT		= 24,
571 
572 	/* Only for v2.1 */
573 	CFG_PAGE_SIZE_SHIFT_v2_1	= 30,
574 
575 	/* Only for pre-v7.1 (with no CFG_EXT register) */
576 	CFG_PAGE_SIZE_SHIFT		= 20,
577 	CFG_BLK_SIZE_SHIFT		= 28,
578 
579 	/* Only for v7.1+ (with CFG_EXT register) */
580 	CFG_EXT_PAGE_SIZE_SHIFT		= 0,
581 	CFG_EXT_BLK_SIZE_SHIFT		= 4,
582 };
583 
584 /* BRCMNAND_INTFC_STATUS */
585 enum {
586 	INTFC_FLASH_STATUS		= GENMASK(7, 0),
587 
588 	INTFC_ERASED			= BIT(27),
589 	INTFC_OOB_VALID			= BIT(28),
590 	INTFC_CACHE_VALID		= BIT(29),
591 	INTFC_FLASH_READY		= BIT(30),
592 	INTFC_CTLR_READY		= BIT(31),
593 };
594 
595 static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
596 {
597 	return brcmnand_readl(ctrl->nand_base + offs);
598 }
599 
600 static inline void nand_writereg(struct brcmnand_controller *ctrl, u32 offs,
601 				 u32 val)
602 {
603 	brcmnand_writel(val, ctrl->nand_base + offs);
604 }
605 
606 static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
607 {
608 	static const unsigned int block_sizes_v6[] = { 8, 16, 128, 256, 512, 1024, 2048, 0 };
609 	static const unsigned int block_sizes_v4[] = { 16, 128, 8, 512, 256, 1024, 2048, 0 };
610 	static const unsigned int block_sizes_v2_2[] = { 16, 128, 8, 512, 256, 0 };
611 	static const unsigned int block_sizes_v2_1[] = { 16, 128, 8, 512, 0 };
612 	static const unsigned int page_sizes_v3_4[] = { 512, 2048, 4096, 8192, 0 };
613 	static const unsigned int page_sizes_v2_2[] = { 512, 2048, 4096, 0 };
614 	static const unsigned int page_sizes_v2_1[] = { 512, 2048, 0 };
615 
616 	ctrl->nand_version = nand_readreg(ctrl, 0) & 0xffff;
617 
618 	/* Only support v2.1+ */
619 	if (ctrl->nand_version < 0x0201) {
620 		dev_err(ctrl->dev, "version %#x not supported\n",
621 			ctrl->nand_version);
622 		return -ENODEV;
623 	}
624 
625 	/* Register offsets */
626 	if (ctrl->nand_version >= 0x0702)
627 		ctrl->reg_offsets = brcmnand_regs_v72;
628 	else if (ctrl->nand_version == 0x0701)
629 		ctrl->reg_offsets = brcmnand_regs_v71;
630 	else if (ctrl->nand_version >= 0x0600)
631 		ctrl->reg_offsets = brcmnand_regs_v60;
632 	else if (ctrl->nand_version >= 0x0500)
633 		ctrl->reg_offsets = brcmnand_regs_v50;
634 	else if (ctrl->nand_version >= 0x0303)
635 		ctrl->reg_offsets = brcmnand_regs_v33;
636 	else if (ctrl->nand_version >= 0x0201)
637 		ctrl->reg_offsets = brcmnand_regs_v21;
638 
639 	/* Chip-select stride */
640 	if (ctrl->nand_version >= 0x0701)
641 		ctrl->reg_spacing = 0x14;
642 	else
643 		ctrl->reg_spacing = 0x10;
644 
645 	/* Per chip-select registers */
646 	if (ctrl->nand_version >= 0x0701) {
647 		ctrl->cs_offsets = brcmnand_cs_offsets_v71;
648 	} else {
649 		ctrl->cs_offsets = brcmnand_cs_offsets;
650 
651 		/* v3.3-5.0 have a different CS0 offset layout */
652 		if (ctrl->nand_version >= 0x0303 &&
653 		    ctrl->nand_version <= 0x0500)
654 			ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
655 	}
656 
657 	/* Page / block sizes */
658 	if (ctrl->nand_version >= 0x0701) {
659 		/* >= v7.1 use nice power-of-2 values! */
660 		ctrl->max_page_size = 16 * 1024;
661 		ctrl->max_block_size = 2 * 1024 * 1024;
662 	} else {
663 		if (ctrl->nand_version >= 0x0304)
664 			ctrl->page_sizes = page_sizes_v3_4;
665 		else if (ctrl->nand_version >= 0x0202)
666 			ctrl->page_sizes = page_sizes_v2_2;
667 		else
668 			ctrl->page_sizes = page_sizes_v2_1;
669 
670 		if (ctrl->nand_version >= 0x0202)
671 			ctrl->page_size_shift = CFG_PAGE_SIZE_SHIFT;
672 		else
673 			ctrl->page_size_shift = CFG_PAGE_SIZE_SHIFT_v2_1;
674 
675 		if (ctrl->nand_version >= 0x0600)
676 			ctrl->block_sizes = block_sizes_v6;
677 		else if (ctrl->nand_version >= 0x0400)
678 			ctrl->block_sizes = block_sizes_v4;
679 		else if (ctrl->nand_version >= 0x0202)
680 			ctrl->block_sizes = block_sizes_v2_2;
681 		else
682 			ctrl->block_sizes = block_sizes_v2_1;
683 
684 		if (ctrl->nand_version < 0x0400) {
685 			if (ctrl->nand_version < 0x0202)
686 				ctrl->max_page_size = 2048;
687 			else
688 				ctrl->max_page_size = 4096;
689 			ctrl->max_block_size = 512 * 1024;
690 		}
691 	}
692 
693 	/* Maximum spare area sector size (per 512B) */
694 	if (ctrl->nand_version == 0x0702)
695 		ctrl->max_oob = 128;
696 	else if (ctrl->nand_version >= 0x0600)
697 		ctrl->max_oob = 64;
698 	else if (ctrl->nand_version >= 0x0500)
699 		ctrl->max_oob = 32;
700 	else
701 		ctrl->max_oob = 16;
702 
703 	/* v6.0 and newer (except v6.1) have prefetch support */
704 	if (ctrl->nand_version >= 0x0600 && ctrl->nand_version != 0x0601)
705 		ctrl->features |= BRCMNAND_HAS_PREFETCH;
706 
707 	/*
708 	 * v6.x has cache mode, but it's implemented differently. Ignore it for
709 	 * now.
710 	 */
711 	if (ctrl->nand_version >= 0x0700)
712 		ctrl->features |= BRCMNAND_HAS_CACHE_MODE;
713 
714 	if (ctrl->nand_version >= 0x0500)
715 		ctrl->features |= BRCMNAND_HAS_1K_SECTORS;
716 
717 	if (ctrl->nand_version >= 0x0700)
718 		ctrl->features |= BRCMNAND_HAS_WP;
719 	else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp"))
720 		ctrl->features |= BRCMNAND_HAS_WP;
721 
722 	return 0;
723 }
724 
725 static void brcmnand_flash_dma_revision_init(struct brcmnand_controller *ctrl)
726 {
727 	/* flash_dma register offsets */
728 	if (ctrl->nand_version >= 0x0703)
729 		ctrl->flash_dma_offsets = flash_dma_regs_v4;
730 	else if (ctrl->nand_version == 0x0602)
731 		ctrl->flash_dma_offsets = flash_dma_regs_v0;
732 	else
733 		ctrl->flash_dma_offsets = flash_dma_regs_v1;
734 }
735 
736 static inline u32 brcmnand_read_reg(struct brcmnand_controller *ctrl,
737 		enum brcmnand_reg reg)
738 {
739 	u16 offs = ctrl->reg_offsets[reg];
740 
741 	if (offs)
742 		return nand_readreg(ctrl, offs);
743 	else
744 		return 0;
745 }
746 
747 static inline void brcmnand_write_reg(struct brcmnand_controller *ctrl,
748 				      enum brcmnand_reg reg, u32 val)
749 {
750 	u16 offs = ctrl->reg_offsets[reg];
751 
752 	if (offs)
753 		nand_writereg(ctrl, offs, val);
754 }
755 
756 static inline void brcmnand_rmw_reg(struct brcmnand_controller *ctrl,
757 				    enum brcmnand_reg reg, u32 mask, unsigned
758 				    int shift, u32 val)
759 {
760 	u32 tmp = brcmnand_read_reg(ctrl, reg);
761 
762 	tmp &= ~mask;
763 	tmp |= val << shift;
764 	brcmnand_write_reg(ctrl, reg, tmp);
765 }
766 
767 static inline u32 brcmnand_read_fc(struct brcmnand_controller *ctrl, int word)
768 {
769 	return __raw_readl(ctrl->nand_fc + word * 4);
770 }
771 
772 static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
773 				     int word, u32 val)
774 {
775 	__raw_writel(val, ctrl->nand_fc + word * 4);
776 }
777 
778 static inline void edu_writel(struct brcmnand_controller *ctrl,
779 			      enum edu_reg reg, u32 val)
780 {
781 	u16 offs = ctrl->edu_offsets[reg];
782 
783 	brcmnand_writel(val, ctrl->edu_base + offs);
784 }
785 
786 static inline u32 edu_readl(struct brcmnand_controller *ctrl,
787 			    enum edu_reg reg)
788 {
789 	u16 offs = ctrl->edu_offsets[reg];
790 
791 	return brcmnand_readl(ctrl->edu_base + offs);
792 }
793 
794 static void brcmnand_clear_ecc_addr(struct brcmnand_controller *ctrl)
795 {
796 
797 	/* Clear error addresses */
798 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
799 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
800 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
801 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
802 }
803 
804 static u64 brcmnand_get_uncorrecc_addr(struct brcmnand_controller *ctrl)
805 {
806 	u64 err_addr;
807 
808 	err_addr = brcmnand_read_reg(ctrl, BRCMNAND_UNCORR_ADDR);
809 	err_addr |= ((u64)(brcmnand_read_reg(ctrl,
810 					     BRCMNAND_UNCORR_EXT_ADDR)
811 					     & 0xffff) << 32);
812 
813 	return err_addr;
814 }
815 
816 static u64 brcmnand_get_correcc_addr(struct brcmnand_controller *ctrl)
817 {
818 	u64 err_addr;
819 
820 	err_addr = brcmnand_read_reg(ctrl, BRCMNAND_CORR_ADDR);
821 	err_addr |= ((u64)(brcmnand_read_reg(ctrl,
822 					     BRCMNAND_CORR_EXT_ADDR)
823 					     & 0xffff) << 32);
824 
825 	return err_addr;
826 }
827 
828 static void brcmnand_set_cmd_addr(struct mtd_info *mtd, u64 addr)
829 {
830 	struct nand_chip *chip =  mtd_to_nand(mtd);
831 	struct brcmnand_host *host = nand_get_controller_data(chip);
832 	struct brcmnand_controller *ctrl = host->ctrl;
833 
834 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
835 			   (host->cs << 16) | ((addr >> 32) & 0xffff));
836 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
837 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
838 			   lower_32_bits(addr));
839 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
840 }
841 
842 static inline u16 brcmnand_cs_offset(struct brcmnand_controller *ctrl, int cs,
843 				     enum brcmnand_cs_reg reg)
844 {
845 	u16 offs_cs0 = ctrl->reg_offsets[BRCMNAND_CS0_BASE];
846 	u16 offs_cs1 = ctrl->reg_offsets[BRCMNAND_CS1_BASE];
847 	u8 cs_offs;
848 
849 	if (cs == 0 && ctrl->cs0_offsets)
850 		cs_offs = ctrl->cs0_offsets[reg];
851 	else
852 		cs_offs = ctrl->cs_offsets[reg];
853 
854 	if (cs && offs_cs1)
855 		return offs_cs1 + (cs - 1) * ctrl->reg_spacing + cs_offs;
856 
857 	return offs_cs0 + cs * ctrl->reg_spacing + cs_offs;
858 }
859 
860 static inline u32 brcmnand_count_corrected(struct brcmnand_controller *ctrl)
861 {
862 	if (ctrl->nand_version < 0x0600)
863 		return 1;
864 	return brcmnand_read_reg(ctrl, BRCMNAND_CORR_COUNT);
865 }
866 
867 static void brcmnand_wr_corr_thresh(struct brcmnand_host *host, u8 val)
868 {
869 	struct brcmnand_controller *ctrl = host->ctrl;
870 	unsigned int shift = 0, bits;
871 	enum brcmnand_reg reg = BRCMNAND_CORR_THRESHOLD;
872 	int cs = host->cs;
873 
874 	if (!ctrl->reg_offsets[reg])
875 		return;
876 
877 	if (ctrl->nand_version == 0x0702)
878 		bits = 7;
879 	else if (ctrl->nand_version >= 0x0600)
880 		bits = 6;
881 	else if (ctrl->nand_version >= 0x0500)
882 		bits = 5;
883 	else
884 		bits = 4;
885 
886 	if (ctrl->nand_version >= 0x0702) {
887 		if (cs >= 4)
888 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
889 		shift = (cs % 4) * bits;
890 	} else if (ctrl->nand_version >= 0x0600) {
891 		if (cs >= 5)
892 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
893 		shift = (cs % 5) * bits;
894 	}
895 	brcmnand_rmw_reg(ctrl, reg, (bits - 1) << shift, shift, val);
896 }
897 
898 static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
899 {
900 	if (ctrl->nand_version < 0x0602)
901 		return 24;
902 	return 0;
903 }
904 
905 /***********************************************************************
906  * NAND ACC CONTROL bitfield
907  *
908  * Some bits have remained constant throughout hardware revision, while
909  * others have shifted around.
910  ***********************************************************************/
911 
912 /* Constant for all versions (where supported) */
913 enum {
914 	/* See BRCMNAND_HAS_CACHE_MODE */
915 	ACC_CONTROL_CACHE_MODE				= BIT(22),
916 
917 	/* See BRCMNAND_HAS_PREFETCH */
918 	ACC_CONTROL_PREFETCH				= BIT(23),
919 
920 	ACC_CONTROL_PAGE_HIT				= BIT(24),
921 	ACC_CONTROL_WR_PREEMPT				= BIT(25),
922 	ACC_CONTROL_PARTIAL_PAGE			= BIT(26),
923 	ACC_CONTROL_RD_ERASED				= BIT(27),
924 	ACC_CONTROL_FAST_PGM_RDIN			= BIT(28),
925 	ACC_CONTROL_WR_ECC				= BIT(30),
926 	ACC_CONTROL_RD_ECC				= BIT(31),
927 };
928 
929 static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
930 {
931 	if (ctrl->nand_version == 0x0702)
932 		return GENMASK(7, 0);
933 	else if (ctrl->nand_version >= 0x0600)
934 		return GENMASK(6, 0);
935 	else if (ctrl->nand_version >= 0x0303)
936 		return GENMASK(5, 0);
937 	else
938 		return GENMASK(4, 0);
939 }
940 
941 #define NAND_ACC_CONTROL_ECC_SHIFT	16
942 #define NAND_ACC_CONTROL_ECC_EXT_SHIFT	13
943 
944 static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl)
945 {
946 	u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f;
947 
948 	mask <<= NAND_ACC_CONTROL_ECC_SHIFT;
949 
950 	/* v7.2 includes additional ECC levels */
951 	if (ctrl->nand_version >= 0x0702)
952 		mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT;
953 
954 	return mask;
955 }
956 
957 static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
958 {
959 	struct brcmnand_controller *ctrl = host->ctrl;
960 	u16 offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
961 	u32 acc_control = nand_readreg(ctrl, offs);
962 	u32 ecc_flags = ACC_CONTROL_WR_ECC | ACC_CONTROL_RD_ECC;
963 
964 	if (en) {
965 		acc_control |= ecc_flags; /* enable RD/WR ECC */
966 		acc_control |= host->hwcfg.ecc_level
967 			       << NAND_ACC_CONTROL_ECC_SHIFT;
968 	} else {
969 		acc_control &= ~ecc_flags; /* disable RD/WR ECC */
970 		acc_control &= ~brcmnand_ecc_level_mask(ctrl);
971 	}
972 
973 	nand_writereg(ctrl, offs, acc_control);
974 }
975 
976 static inline int brcmnand_sector_1k_shift(struct brcmnand_controller *ctrl)
977 {
978 	if (ctrl->nand_version >= 0x0702)
979 		return 9;
980 	else if (ctrl->nand_version >= 0x0600)
981 		return 7;
982 	else if (ctrl->nand_version >= 0x0500)
983 		return 6;
984 	else
985 		return -1;
986 }
987 
988 static int brcmnand_get_sector_size_1k(struct brcmnand_host *host)
989 {
990 	struct brcmnand_controller *ctrl = host->ctrl;
991 	int shift = brcmnand_sector_1k_shift(ctrl);
992 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
993 						  BRCMNAND_CS_ACC_CONTROL);
994 
995 	if (shift < 0)
996 		return 0;
997 
998 	return (nand_readreg(ctrl, acc_control_offs) >> shift) & 0x1;
999 }
1000 
1001 static void brcmnand_set_sector_size_1k(struct brcmnand_host *host, int val)
1002 {
1003 	struct brcmnand_controller *ctrl = host->ctrl;
1004 	int shift = brcmnand_sector_1k_shift(ctrl);
1005 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
1006 						  BRCMNAND_CS_ACC_CONTROL);
1007 	u32 tmp;
1008 
1009 	if (shift < 0)
1010 		return;
1011 
1012 	tmp = nand_readreg(ctrl, acc_control_offs);
1013 	tmp &= ~(1 << shift);
1014 	tmp |= (!!val) << shift;
1015 	nand_writereg(ctrl, acc_control_offs, tmp);
1016 }
1017 
1018 /***********************************************************************
1019  * CS_NAND_SELECT
1020  ***********************************************************************/
1021 
1022 enum {
1023 	CS_SELECT_NAND_WP			= BIT(29),
1024 	CS_SELECT_AUTO_DEVICE_ID_CFG		= BIT(30),
1025 };
1026 
1027 static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,
1028 				    u32 mask, u32 expected_val,
1029 				    unsigned long timeout_ms)
1030 {
1031 	unsigned long limit;
1032 	u32 val;
1033 
1034 	if (!timeout_ms)
1035 		timeout_ms = NAND_POLL_STATUS_TIMEOUT_MS;
1036 
1037 	limit = jiffies + msecs_to_jiffies(timeout_ms);
1038 	do {
1039 		val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
1040 		if ((val & mask) == expected_val)
1041 			return 0;
1042 
1043 		cpu_relax();
1044 	} while (time_after(limit, jiffies));
1045 
1046 	dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
1047 		 expected_val, val & mask);
1048 
1049 	return -ETIMEDOUT;
1050 }
1051 
1052 static inline void brcmnand_set_wp(struct brcmnand_controller *ctrl, bool en)
1053 {
1054 	u32 val = en ? CS_SELECT_NAND_WP : 0;
1055 
1056 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT, CS_SELECT_NAND_WP, 0, val);
1057 }
1058 
1059 /***********************************************************************
1060  * Flash DMA
1061  ***********************************************************************/
1062 
1063 static inline bool has_flash_dma(struct brcmnand_controller *ctrl)
1064 {
1065 	return ctrl->flash_dma_base;
1066 }
1067 
1068 static inline bool has_edu(struct brcmnand_controller *ctrl)
1069 {
1070 	return ctrl->edu_base;
1071 }
1072 
1073 static inline bool use_dma(struct brcmnand_controller *ctrl)
1074 {
1075 	return has_flash_dma(ctrl) || has_edu(ctrl);
1076 }
1077 
1078 static inline void disable_ctrl_irqs(struct brcmnand_controller *ctrl)
1079 {
1080 	if (ctrl->pio_poll_mode)
1081 		return;
1082 
1083 	if (has_flash_dma(ctrl)) {
1084 		ctrl->flash_dma_base = NULL;
1085 		disable_irq(ctrl->dma_irq);
1086 	}
1087 
1088 	disable_irq(ctrl->irq);
1089 	ctrl->pio_poll_mode = true;
1090 }
1091 
1092 static inline bool flash_dma_buf_ok(const void *buf)
1093 {
1094 	return buf && !is_vmalloc_addr(buf) &&
1095 		likely(IS_ALIGNED((uintptr_t)buf, 4));
1096 }
1097 
1098 static inline void flash_dma_writel(struct brcmnand_controller *ctrl,
1099 				    enum flash_dma_reg dma_reg, u32 val)
1100 {
1101 	u16 offs = ctrl->flash_dma_offsets[dma_reg];
1102 
1103 	brcmnand_writel(val, ctrl->flash_dma_base + offs);
1104 }
1105 
1106 static inline u32 flash_dma_readl(struct brcmnand_controller *ctrl,
1107 				  enum flash_dma_reg dma_reg)
1108 {
1109 	u16 offs = ctrl->flash_dma_offsets[dma_reg];
1110 
1111 	return brcmnand_readl(ctrl->flash_dma_base + offs);
1112 }
1113 
1114 /* Low-level operation types: command, address, write, or read */
1115 enum brcmnand_llop_type {
1116 	LL_OP_CMD,
1117 	LL_OP_ADDR,
1118 	LL_OP_WR,
1119 	LL_OP_RD,
1120 };
1121 
1122 /***********************************************************************
1123  * Internal support functions
1124  ***********************************************************************/
1125 
1126 static inline bool is_hamming_ecc(struct brcmnand_controller *ctrl,
1127 				  struct brcmnand_cfg *cfg)
1128 {
1129 	if (ctrl->nand_version <= 0x0701)
1130 		return cfg->sector_size_1k == 0 && cfg->spare_area_size == 16 &&
1131 			cfg->ecc_level == 15;
1132 	else
1133 		return cfg->sector_size_1k == 0 && ((cfg->spare_area_size == 16 &&
1134 			cfg->ecc_level == 15) ||
1135 			(cfg->spare_area_size == 28 && cfg->ecc_level == 16));
1136 }
1137 
1138 /*
1139  * Set mtd->ooblayout to the appropriate mtd_ooblayout_ops given
1140  * the layout/configuration.
1141  * Returns -ERRCODE on failure.
1142  */
1143 static int brcmnand_hamming_ooblayout_ecc(struct mtd_info *mtd, int section,
1144 					  struct mtd_oob_region *oobregion)
1145 {
1146 	struct nand_chip *chip = mtd_to_nand(mtd);
1147 	struct brcmnand_host *host = nand_get_controller_data(chip);
1148 	struct brcmnand_cfg *cfg = &host->hwcfg;
1149 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1150 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1151 
1152 	if (section >= sectors)
1153 		return -ERANGE;
1154 
1155 	oobregion->offset = (section * sas) + 6;
1156 	oobregion->length = 3;
1157 
1158 	return 0;
1159 }
1160 
1161 static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section,
1162 					   struct mtd_oob_region *oobregion)
1163 {
1164 	struct nand_chip *chip = mtd_to_nand(mtd);
1165 	struct brcmnand_host *host = nand_get_controller_data(chip);
1166 	struct brcmnand_cfg *cfg = &host->hwcfg;
1167 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1168 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1169 	u32 next;
1170 
1171 	if (section > sectors)
1172 		return -ERANGE;
1173 
1174 	next = (section * sas);
1175 	if (section < sectors)
1176 		next += 6;
1177 
1178 	if (section) {
1179 		oobregion->offset = ((section - 1) * sas) + 9;
1180 	} else {
1181 		if (cfg->page_size > 512) {
1182 			/* Large page NAND uses first 2 bytes for BBI */
1183 			oobregion->offset = 2;
1184 		} else {
1185 			/* Small page NAND uses last byte before ECC for BBI */
1186 			oobregion->offset = 0;
1187 			next--;
1188 		}
1189 	}
1190 
1191 	oobregion->length = next - oobregion->offset;
1192 
1193 	return 0;
1194 }
1195 
1196 static const struct mtd_ooblayout_ops brcmnand_hamming_ooblayout_ops = {
1197 	.ecc = brcmnand_hamming_ooblayout_ecc,
1198 	.free = brcmnand_hamming_ooblayout_free,
1199 };
1200 
1201 static int brcmnand_bch_ooblayout_ecc(struct mtd_info *mtd, int section,
1202 				      struct mtd_oob_region *oobregion)
1203 {
1204 	struct nand_chip *chip = mtd_to_nand(mtd);
1205 	struct brcmnand_host *host = nand_get_controller_data(chip);
1206 	struct brcmnand_cfg *cfg = &host->hwcfg;
1207 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1208 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1209 
1210 	if (section >= sectors)
1211 		return -ERANGE;
1212 
1213 	oobregion->offset = ((section + 1) * sas) - chip->ecc.bytes;
1214 	oobregion->length = chip->ecc.bytes;
1215 
1216 	return 0;
1217 }
1218 
1219 static int brcmnand_bch_ooblayout_free_lp(struct mtd_info *mtd, int section,
1220 					  struct mtd_oob_region *oobregion)
1221 {
1222 	struct nand_chip *chip = mtd_to_nand(mtd);
1223 	struct brcmnand_host *host = nand_get_controller_data(chip);
1224 	struct brcmnand_cfg *cfg = &host->hwcfg;
1225 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1226 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
1227 
1228 	if (section >= sectors)
1229 		return -ERANGE;
1230 
1231 	if (sas <= chip->ecc.bytes)
1232 		return 0;
1233 
1234 	oobregion->offset = section * sas;
1235 	oobregion->length = sas - chip->ecc.bytes;
1236 
1237 	if (!section) {
1238 		oobregion->offset++;
1239 		oobregion->length--;
1240 	}
1241 
1242 	return 0;
1243 }
1244 
1245 static int brcmnand_bch_ooblayout_free_sp(struct mtd_info *mtd, int section,
1246 					  struct mtd_oob_region *oobregion)
1247 {
1248 	struct nand_chip *chip = mtd_to_nand(mtd);
1249 	struct brcmnand_host *host = nand_get_controller_data(chip);
1250 	struct brcmnand_cfg *cfg = &host->hwcfg;
1251 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
1252 
1253 	if (section > 1 || sas - chip->ecc.bytes < 6 ||
1254 	    (section && sas - chip->ecc.bytes == 6))
1255 		return -ERANGE;
1256 
1257 	if (!section) {
1258 		oobregion->offset = 0;
1259 		oobregion->length = 5;
1260 	} else {
1261 		oobregion->offset = 6;
1262 		oobregion->length = sas - chip->ecc.bytes - 6;
1263 	}
1264 
1265 	return 0;
1266 }
1267 
1268 static const struct mtd_ooblayout_ops brcmnand_bch_lp_ooblayout_ops = {
1269 	.ecc = brcmnand_bch_ooblayout_ecc,
1270 	.free = brcmnand_bch_ooblayout_free_lp,
1271 };
1272 
1273 static const struct mtd_ooblayout_ops brcmnand_bch_sp_ooblayout_ops = {
1274 	.ecc = brcmnand_bch_ooblayout_ecc,
1275 	.free = brcmnand_bch_ooblayout_free_sp,
1276 };
1277 
1278 static int brcmstb_choose_ecc_layout(struct brcmnand_host *host)
1279 {
1280 	struct brcmnand_cfg *p = &host->hwcfg;
1281 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
1282 	struct nand_ecc_ctrl *ecc = &host->chip.ecc;
1283 	unsigned int ecc_level = p->ecc_level;
1284 	int sas = p->spare_area_size << p->sector_size_1k;
1285 	int sectors = p->page_size / (512 << p->sector_size_1k);
1286 
1287 	if (p->sector_size_1k)
1288 		ecc_level <<= 1;
1289 
1290 	if (is_hamming_ecc(host->ctrl, p)) {
1291 		ecc->bytes = 3 * sectors;
1292 		mtd_set_ooblayout(mtd, &brcmnand_hamming_ooblayout_ops);
1293 		return 0;
1294 	}
1295 
1296 	/*
1297 	 * CONTROLLER_VERSION:
1298 	 *   < v5.0: ECC_REQ = ceil(BCH_T * 13/8)
1299 	 *  >= v5.0: ECC_REQ = ceil(BCH_T * 14/8)
1300 	 * But we will just be conservative.
1301 	 */
1302 	ecc->bytes = DIV_ROUND_UP(ecc_level * 14, 8);
1303 	if (p->page_size == 512)
1304 		mtd_set_ooblayout(mtd, &brcmnand_bch_sp_ooblayout_ops);
1305 	else
1306 		mtd_set_ooblayout(mtd, &brcmnand_bch_lp_ooblayout_ops);
1307 
1308 	if (ecc->bytes >= sas) {
1309 		dev_err(&host->pdev->dev,
1310 			"error: ECC too large for OOB (ECC bytes %d, spare sector %d)\n",
1311 			ecc->bytes, sas);
1312 		return -EINVAL;
1313 	}
1314 
1315 	return 0;
1316 }
1317 
1318 static void brcmnand_wp(struct mtd_info *mtd, int wp)
1319 {
1320 	struct nand_chip *chip = mtd_to_nand(mtd);
1321 	struct brcmnand_host *host = nand_get_controller_data(chip);
1322 	struct brcmnand_controller *ctrl = host->ctrl;
1323 
1324 	if ((ctrl->features & BRCMNAND_HAS_WP) && wp_on == 1) {
1325 		static int old_wp = -1;
1326 		int ret;
1327 
1328 		if (old_wp != wp) {
1329 			dev_dbg(ctrl->dev, "WP %s\n", wp ? "on" : "off");
1330 			old_wp = wp;
1331 		}
1332 
1333 		/*
1334 		 * make sure ctrl/flash ready before and after
1335 		 * changing state of #WP pin
1336 		 */
1337 		ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY |
1338 					       NAND_STATUS_READY,
1339 					       NAND_CTRL_RDY |
1340 					       NAND_STATUS_READY, 0);
1341 		if (ret)
1342 			return;
1343 
1344 		brcmnand_set_wp(ctrl, wp);
1345 		nand_status_op(chip, NULL);
1346 		/* NAND_STATUS_WP 0x00 = protected, 0x80 = not protected */
1347 		ret = bcmnand_ctrl_poll_status(ctrl,
1348 					       NAND_CTRL_RDY |
1349 					       NAND_STATUS_READY |
1350 					       NAND_STATUS_WP,
1351 					       NAND_CTRL_RDY |
1352 					       NAND_STATUS_READY |
1353 					       (wp ? 0 : NAND_STATUS_WP), 0);
1354 
1355 		if (ret)
1356 			dev_err_ratelimited(&host->pdev->dev,
1357 					    "nand #WP expected %s\n",
1358 					    wp ? "on" : "off");
1359 	}
1360 }
1361 
1362 /* Helper functions for reading and writing OOB registers */
1363 static inline u8 oob_reg_read(struct brcmnand_controller *ctrl, u32 offs)
1364 {
1365 	u16 offset0, offset10, reg_offs;
1366 
1367 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_READ_BASE];
1368 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_READ_10_BASE];
1369 
1370 	if (offs >= ctrl->max_oob)
1371 		return 0x77;
1372 
1373 	if (offs >= 16 && offset10)
1374 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1375 	else
1376 		reg_offs = offset0 + (offs & ~0x03);
1377 
1378 	return nand_readreg(ctrl, reg_offs) >> (24 - ((offs & 0x03) << 3));
1379 }
1380 
1381 static inline void oob_reg_write(struct brcmnand_controller *ctrl, u32 offs,
1382 				 u32 data)
1383 {
1384 	u16 offset0, offset10, reg_offs;
1385 
1386 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_BASE];
1387 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_10_BASE];
1388 
1389 	if (offs >= ctrl->max_oob)
1390 		return;
1391 
1392 	if (offs >= 16 && offset10)
1393 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1394 	else
1395 		reg_offs = offset0 + (offs & ~0x03);
1396 
1397 	nand_writereg(ctrl, reg_offs, data);
1398 }
1399 
1400 /*
1401  * read_oob_from_regs - read data from OOB registers
1402  * @ctrl: NAND controller
1403  * @i: sub-page sector index
1404  * @oob: buffer to read to
1405  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1406  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1407  */
1408 static int read_oob_from_regs(struct brcmnand_controller *ctrl, int i, u8 *oob,
1409 			      int sas, int sector_1k)
1410 {
1411 	int tbytes = sas << sector_1k;
1412 	int j;
1413 
1414 	/* Adjust OOB values for 1K sector size */
1415 	if (sector_1k && (i & 0x01))
1416 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1417 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1418 
1419 	for (j = 0; j < tbytes; j++)
1420 		oob[j] = oob_reg_read(ctrl, j);
1421 	return tbytes;
1422 }
1423 
1424 /*
1425  * write_oob_to_regs - write data to OOB registers
1426  * @i: sub-page sector index
1427  * @oob: buffer to write from
1428  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1429  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1430  */
1431 static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
1432 			     const u8 *oob, int sas, int sector_1k)
1433 {
1434 	int tbytes = sas << sector_1k;
1435 	int j;
1436 
1437 	/* Adjust OOB values for 1K sector size */
1438 	if (sector_1k && (i & 0x01))
1439 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1440 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1441 
1442 	for (j = 0; j < tbytes; j += 4)
1443 		oob_reg_write(ctrl, j,
1444 				(oob[j + 0] << 24) |
1445 				(oob[j + 1] << 16) |
1446 				(oob[j + 2] <<  8) |
1447 				(oob[j + 3] <<  0));
1448 	return tbytes;
1449 }
1450 
1451 static void brcmnand_edu_init(struct brcmnand_controller *ctrl)
1452 {
1453 	/* initialize edu */
1454 	edu_writel(ctrl, EDU_ERR_STATUS, 0);
1455 	edu_readl(ctrl, EDU_ERR_STATUS);
1456 	edu_writel(ctrl, EDU_DONE, 0);
1457 	edu_writel(ctrl, EDU_DONE, 0);
1458 	edu_writel(ctrl, EDU_DONE, 0);
1459 	edu_writel(ctrl, EDU_DONE, 0);
1460 	edu_readl(ctrl, EDU_DONE);
1461 }
1462 
1463 /* edu irq */
1464 static irqreturn_t brcmnand_edu_irq(int irq, void *data)
1465 {
1466 	struct brcmnand_controller *ctrl = data;
1467 
1468 	if (ctrl->edu_count) {
1469 		ctrl->edu_count--;
1470 		while (!(edu_readl(ctrl, EDU_DONE) & EDU_DONE_MASK))
1471 			udelay(1);
1472 		edu_writel(ctrl, EDU_DONE, 0);
1473 		edu_readl(ctrl, EDU_DONE);
1474 	}
1475 
1476 	if (ctrl->edu_count) {
1477 		ctrl->edu_dram_addr += FC_BYTES;
1478 		ctrl->edu_ext_addr += FC_BYTES;
1479 
1480 		edu_writel(ctrl, EDU_DRAM_ADDR, (u32)ctrl->edu_dram_addr);
1481 		edu_readl(ctrl, EDU_DRAM_ADDR);
1482 		edu_writel(ctrl, EDU_EXT_ADDR, ctrl->edu_ext_addr);
1483 		edu_readl(ctrl, EDU_EXT_ADDR);
1484 
1485 		if (ctrl->oob) {
1486 			if (ctrl->edu_cmd == EDU_CMD_READ) {
1487 				ctrl->oob += read_oob_from_regs(ctrl,
1488 							ctrl->edu_count + 1,
1489 							ctrl->oob, ctrl->sas,
1490 							ctrl->sector_size_1k);
1491 			} else {
1492 				brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
1493 						   ctrl->edu_ext_addr);
1494 				brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1495 				ctrl->oob += write_oob_to_regs(ctrl,
1496 							       ctrl->edu_count,
1497 							       ctrl->oob, ctrl->sas,
1498 							       ctrl->sector_size_1k);
1499 			}
1500 		}
1501 
1502 		mb(); /* flush previous writes */
1503 		edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
1504 		edu_readl(ctrl, EDU_CMD);
1505 
1506 		return IRQ_HANDLED;
1507 	}
1508 
1509 	complete(&ctrl->edu_done);
1510 
1511 	return IRQ_HANDLED;
1512 }
1513 
1514 static irqreturn_t brcmnand_ctlrdy_irq(int irq, void *data)
1515 {
1516 	struct brcmnand_controller *ctrl = data;
1517 
1518 	/* Discard all NAND_CTLRDY interrupts during DMA */
1519 	if (ctrl->dma_pending)
1520 		return IRQ_HANDLED;
1521 
1522 	/* check if you need to piggy back on the ctrlrdy irq */
1523 	if (ctrl->edu_pending) {
1524 		if (irq == ctrl->irq && ((int)ctrl->edu_irq >= 0))
1525 	/* Discard interrupts while using dedicated edu irq */
1526 			return IRQ_HANDLED;
1527 
1528 	/* no registered edu irq, call handler */
1529 		return brcmnand_edu_irq(irq, data);
1530 	}
1531 
1532 	complete(&ctrl->done);
1533 	return IRQ_HANDLED;
1534 }
1535 
1536 /* Handle SoC-specific interrupt hardware */
1537 static irqreturn_t brcmnand_irq(int irq, void *data)
1538 {
1539 	struct brcmnand_controller *ctrl = data;
1540 
1541 	if (ctrl->soc->ctlrdy_ack(ctrl->soc))
1542 		return brcmnand_ctlrdy_irq(irq, data);
1543 
1544 	return IRQ_NONE;
1545 }
1546 
1547 static irqreturn_t brcmnand_dma_irq(int irq, void *data)
1548 {
1549 	struct brcmnand_controller *ctrl = data;
1550 
1551 	complete(&ctrl->dma_done);
1552 
1553 	return IRQ_HANDLED;
1554 }
1555 
1556 static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
1557 {
1558 	struct brcmnand_controller *ctrl = host->ctrl;
1559 	int ret;
1560 	u64 cmd_addr;
1561 
1562 	cmd_addr = brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1563 
1564 	dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
1565 
1566 	BUG_ON(ctrl->cmd_pending != 0);
1567 	ctrl->cmd_pending = cmd;
1568 
1569 	ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
1570 	WARN_ON(ret);
1571 
1572 	mb(); /* flush previous writes */
1573 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_START,
1574 			   cmd << brcmnand_cmd_shift(ctrl));
1575 }
1576 
1577 /***********************************************************************
1578  * NAND MTD API: read/program/erase
1579  ***********************************************************************/
1580 
1581 static void brcmnand_cmd_ctrl(struct nand_chip *chip, int dat,
1582 			      unsigned int ctrl)
1583 {
1584 	/* intentionally left blank */
1585 }
1586 
1587 static bool brcmstb_nand_wait_for_completion(struct nand_chip *chip)
1588 {
1589 	struct brcmnand_host *host = nand_get_controller_data(chip);
1590 	struct brcmnand_controller *ctrl = host->ctrl;
1591 	struct mtd_info *mtd = nand_to_mtd(chip);
1592 	bool err = false;
1593 	int sts;
1594 
1595 	if (mtd->oops_panic_write) {
1596 		/* switch to interrupt polling and PIO mode */
1597 		disable_ctrl_irqs(ctrl);
1598 		sts = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY,
1599 					       NAND_CTRL_RDY, 0);
1600 		err = (sts < 0) ? true : false;
1601 	} else {
1602 		unsigned long timeo = msecs_to_jiffies(
1603 						NAND_POLL_STATUS_TIMEOUT_MS);
1604 		/* wait for completion interrupt */
1605 		sts = wait_for_completion_timeout(&ctrl->done, timeo);
1606 		err = (sts <= 0) ? true : false;
1607 	}
1608 
1609 	return err;
1610 }
1611 
1612 static int brcmnand_waitfunc(struct nand_chip *chip)
1613 {
1614 	struct brcmnand_host *host = nand_get_controller_data(chip);
1615 	struct brcmnand_controller *ctrl = host->ctrl;
1616 	bool err = false;
1617 
1618 	dev_dbg(ctrl->dev, "wait on native cmd %d\n", ctrl->cmd_pending);
1619 	if (ctrl->cmd_pending)
1620 		err = brcmstb_nand_wait_for_completion(chip);
1621 
1622 	if (err) {
1623 		u32 cmd = brcmnand_read_reg(ctrl, BRCMNAND_CMD_START)
1624 					>> brcmnand_cmd_shift(ctrl);
1625 
1626 		dev_err_ratelimited(ctrl->dev,
1627 			"timeout waiting for command %#02x\n", cmd);
1628 		dev_err_ratelimited(ctrl->dev, "intfc status %08x\n",
1629 			brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS));
1630 	}
1631 	ctrl->cmd_pending = 0;
1632 	return brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1633 				 INTFC_FLASH_STATUS;
1634 }
1635 
1636 enum {
1637 	LLOP_RE				= BIT(16),
1638 	LLOP_WE				= BIT(17),
1639 	LLOP_ALE			= BIT(18),
1640 	LLOP_CLE			= BIT(19),
1641 	LLOP_RETURN_IDLE		= BIT(31),
1642 
1643 	LLOP_DATA_MASK			= GENMASK(15, 0),
1644 };
1645 
1646 static int brcmnand_low_level_op(struct brcmnand_host *host,
1647 				 enum brcmnand_llop_type type, u32 data,
1648 				 bool last_op)
1649 {
1650 	struct nand_chip *chip = &host->chip;
1651 	struct brcmnand_controller *ctrl = host->ctrl;
1652 	u32 tmp;
1653 
1654 	tmp = data & LLOP_DATA_MASK;
1655 	switch (type) {
1656 	case LL_OP_CMD:
1657 		tmp |= LLOP_WE | LLOP_CLE;
1658 		break;
1659 	case LL_OP_ADDR:
1660 		/* WE | ALE */
1661 		tmp |= LLOP_WE | LLOP_ALE;
1662 		break;
1663 	case LL_OP_WR:
1664 		/* WE */
1665 		tmp |= LLOP_WE;
1666 		break;
1667 	case LL_OP_RD:
1668 		/* RE */
1669 		tmp |= LLOP_RE;
1670 		break;
1671 	}
1672 	if (last_op)
1673 		/* RETURN_IDLE */
1674 		tmp |= LLOP_RETURN_IDLE;
1675 
1676 	dev_dbg(ctrl->dev, "ll_op cmd %#x\n", tmp);
1677 
1678 	brcmnand_write_reg(ctrl, BRCMNAND_LL_OP, tmp);
1679 	(void)brcmnand_read_reg(ctrl, BRCMNAND_LL_OP);
1680 
1681 	brcmnand_send_cmd(host, CMD_LOW_LEVEL_OP);
1682 	return brcmnand_waitfunc(chip);
1683 }
1684 
1685 static void brcmnand_cmdfunc(struct nand_chip *chip, unsigned command,
1686 			     int column, int page_addr)
1687 {
1688 	struct mtd_info *mtd = nand_to_mtd(chip);
1689 	struct brcmnand_host *host = nand_get_controller_data(chip);
1690 	struct brcmnand_controller *ctrl = host->ctrl;
1691 	u64 addr = (u64)page_addr << chip->page_shift;
1692 	int native_cmd = 0;
1693 
1694 	if (command == NAND_CMD_READID || command == NAND_CMD_PARAM ||
1695 			command == NAND_CMD_RNDOUT)
1696 		addr = (u64)column;
1697 	/* Avoid propagating a negative, don't-care address */
1698 	else if (page_addr < 0)
1699 		addr = 0;
1700 
1701 	dev_dbg(ctrl->dev, "cmd 0x%x addr 0x%llx\n", command,
1702 		(unsigned long long)addr);
1703 
1704 	host->last_cmd = command;
1705 	host->last_byte = 0;
1706 	host->last_addr = addr;
1707 
1708 	switch (command) {
1709 	case NAND_CMD_RESET:
1710 		native_cmd = CMD_FLASH_RESET;
1711 		break;
1712 	case NAND_CMD_STATUS:
1713 		native_cmd = CMD_STATUS_READ;
1714 		break;
1715 	case NAND_CMD_READID:
1716 		native_cmd = CMD_DEVICE_ID_READ;
1717 		break;
1718 	case NAND_CMD_READOOB:
1719 		native_cmd = CMD_SPARE_AREA_READ;
1720 		break;
1721 	case NAND_CMD_ERASE1:
1722 		native_cmd = CMD_BLOCK_ERASE;
1723 		brcmnand_wp(mtd, 0);
1724 		break;
1725 	case NAND_CMD_PARAM:
1726 		native_cmd = CMD_PARAMETER_READ;
1727 		break;
1728 	case NAND_CMD_SET_FEATURES:
1729 	case NAND_CMD_GET_FEATURES:
1730 		brcmnand_low_level_op(host, LL_OP_CMD, command, false);
1731 		brcmnand_low_level_op(host, LL_OP_ADDR, column, false);
1732 		break;
1733 	case NAND_CMD_RNDOUT:
1734 		native_cmd = CMD_PARAMETER_CHANGE_COL;
1735 		addr &= ~((u64)(FC_BYTES - 1));
1736 		/*
1737 		 * HW quirk: PARAMETER_CHANGE_COL requires SECTOR_SIZE_1K=0
1738 		 * NB: hwcfg.sector_size_1k may not be initialized yet
1739 		 */
1740 		if (brcmnand_get_sector_size_1k(host)) {
1741 			host->hwcfg.sector_size_1k =
1742 				brcmnand_get_sector_size_1k(host);
1743 			brcmnand_set_sector_size_1k(host, 0);
1744 		}
1745 		break;
1746 	}
1747 
1748 	if (!native_cmd)
1749 		return;
1750 
1751 	brcmnand_set_cmd_addr(mtd, addr);
1752 	brcmnand_send_cmd(host, native_cmd);
1753 	brcmnand_waitfunc(chip);
1754 
1755 	if (native_cmd == CMD_PARAMETER_READ ||
1756 			native_cmd == CMD_PARAMETER_CHANGE_COL) {
1757 		/* Copy flash cache word-wise */
1758 		u32 *flash_cache = (u32 *)ctrl->flash_cache;
1759 		int i;
1760 
1761 		brcmnand_soc_data_bus_prepare(ctrl->soc, true);
1762 
1763 		/*
1764 		 * Must cache the FLASH_CACHE now, since changes in
1765 		 * SECTOR_SIZE_1K may invalidate it
1766 		 */
1767 		for (i = 0; i < FC_WORDS; i++)
1768 			/*
1769 			 * Flash cache is big endian for parameter pages, at
1770 			 * least on STB SoCs
1771 			 */
1772 			flash_cache[i] = be32_to_cpu(brcmnand_read_fc(ctrl, i));
1773 
1774 		brcmnand_soc_data_bus_unprepare(ctrl->soc, true);
1775 
1776 		/* Cleanup from HW quirk: restore SECTOR_SIZE_1K */
1777 		if (host->hwcfg.sector_size_1k)
1778 			brcmnand_set_sector_size_1k(host,
1779 						    host->hwcfg.sector_size_1k);
1780 	}
1781 
1782 	/* Re-enable protection is necessary only after erase */
1783 	if (command == NAND_CMD_ERASE1)
1784 		brcmnand_wp(mtd, 1);
1785 }
1786 
1787 static uint8_t brcmnand_read_byte(struct nand_chip *chip)
1788 {
1789 	struct brcmnand_host *host = nand_get_controller_data(chip);
1790 	struct brcmnand_controller *ctrl = host->ctrl;
1791 	uint8_t ret = 0;
1792 	int addr, offs;
1793 
1794 	switch (host->last_cmd) {
1795 	case NAND_CMD_READID:
1796 		if (host->last_byte < 4)
1797 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID) >>
1798 				(24 - (host->last_byte << 3));
1799 		else if (host->last_byte < 8)
1800 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID_EXT) >>
1801 				(56 - (host->last_byte << 3));
1802 		break;
1803 
1804 	case NAND_CMD_READOOB:
1805 		ret = oob_reg_read(ctrl, host->last_byte);
1806 		break;
1807 
1808 	case NAND_CMD_STATUS:
1809 		ret = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1810 					INTFC_FLASH_STATUS;
1811 		if (wp_on) /* hide WP status */
1812 			ret |= NAND_STATUS_WP;
1813 		break;
1814 
1815 	case NAND_CMD_PARAM:
1816 	case NAND_CMD_RNDOUT:
1817 		addr = host->last_addr + host->last_byte;
1818 		offs = addr & (FC_BYTES - 1);
1819 
1820 		/* At FC_BYTES boundary, switch to next column */
1821 		if (host->last_byte > 0 && offs == 0)
1822 			nand_change_read_column_op(chip, addr, NULL, 0, false);
1823 
1824 		ret = ctrl->flash_cache[offs];
1825 		break;
1826 	case NAND_CMD_GET_FEATURES:
1827 		if (host->last_byte >= ONFI_SUBFEATURE_PARAM_LEN) {
1828 			ret = 0;
1829 		} else {
1830 			bool last = host->last_byte ==
1831 				ONFI_SUBFEATURE_PARAM_LEN - 1;
1832 			brcmnand_low_level_op(host, LL_OP_RD, 0, last);
1833 			ret = brcmnand_read_reg(ctrl, BRCMNAND_LL_RDATA) & 0xff;
1834 		}
1835 	}
1836 
1837 	dev_dbg(ctrl->dev, "read byte = 0x%02x\n", ret);
1838 	host->last_byte++;
1839 
1840 	return ret;
1841 }
1842 
1843 static void brcmnand_read_buf(struct nand_chip *chip, uint8_t *buf, int len)
1844 {
1845 	int i;
1846 
1847 	for (i = 0; i < len; i++, buf++)
1848 		*buf = brcmnand_read_byte(chip);
1849 }
1850 
1851 static void brcmnand_write_buf(struct nand_chip *chip, const uint8_t *buf,
1852 			       int len)
1853 {
1854 	int i;
1855 	struct brcmnand_host *host = nand_get_controller_data(chip);
1856 
1857 	switch (host->last_cmd) {
1858 	case NAND_CMD_SET_FEATURES:
1859 		for (i = 0; i < len; i++)
1860 			brcmnand_low_level_op(host, LL_OP_WR, buf[i],
1861 						  (i + 1) == len);
1862 		break;
1863 	default:
1864 		BUG();
1865 		break;
1866 	}
1867 }
1868 
1869 /*
1870  *  Kick EDU engine
1871  */
1872 static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
1873 			      u8 *oob, u32 len, u8 cmd)
1874 {
1875 	struct brcmnand_controller *ctrl = host->ctrl;
1876 	struct brcmnand_cfg *cfg = &host->hwcfg;
1877 	unsigned long timeo = msecs_to_jiffies(200);
1878 	int ret = 0;
1879 	int dir = (cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE);
1880 	u8 edu_cmd = (cmd == CMD_PAGE_READ ? EDU_CMD_READ : EDU_CMD_WRITE);
1881 	unsigned int trans = len >> FC_SHIFT;
1882 	dma_addr_t pa;
1883 
1884 	dev_dbg(ctrl->dev, "EDU %s %p:%p\n", ((edu_cmd == EDU_CMD_READ) ?
1885 					      "read" : "write"), buf, oob);
1886 
1887 	pa = dma_map_single(ctrl->dev, buf, len, dir);
1888 	if (dma_mapping_error(ctrl->dev, pa)) {
1889 		dev_err(ctrl->dev, "unable to map buffer for EDU DMA\n");
1890 		return -ENOMEM;
1891 	}
1892 
1893 	ctrl->edu_pending = true;
1894 	ctrl->edu_dram_addr = pa;
1895 	ctrl->edu_ext_addr = addr;
1896 	ctrl->edu_cmd = edu_cmd;
1897 	ctrl->edu_count = trans;
1898 	ctrl->sas = cfg->spare_area_size;
1899 	ctrl->oob = oob;
1900 
1901 	edu_writel(ctrl, EDU_DRAM_ADDR, (u32)ctrl->edu_dram_addr);
1902 	edu_readl(ctrl,  EDU_DRAM_ADDR);
1903 	edu_writel(ctrl, EDU_EXT_ADDR, ctrl->edu_ext_addr);
1904 	edu_readl(ctrl, EDU_EXT_ADDR);
1905 	edu_writel(ctrl, EDU_LENGTH, FC_BYTES);
1906 	edu_readl(ctrl, EDU_LENGTH);
1907 
1908 	if (ctrl->oob && (ctrl->edu_cmd == EDU_CMD_WRITE)) {
1909 		brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
1910 				   ctrl->edu_ext_addr);
1911 		brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1912 		ctrl->oob += write_oob_to_regs(ctrl,
1913 					       1,
1914 					       ctrl->oob, ctrl->sas,
1915 					       ctrl->sector_size_1k);
1916 	}
1917 
1918 	/* Start edu engine */
1919 	mb(); /* flush previous writes */
1920 	edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
1921 	edu_readl(ctrl, EDU_CMD);
1922 
1923 	if (wait_for_completion_timeout(&ctrl->edu_done, timeo) <= 0) {
1924 		dev_err(ctrl->dev,
1925 			"timeout waiting for EDU; status %#x, error status %#x\n",
1926 			edu_readl(ctrl, EDU_STATUS),
1927 			edu_readl(ctrl, EDU_ERR_STATUS));
1928 	}
1929 
1930 	dma_unmap_single(ctrl->dev, pa, len, dir);
1931 
1932 	/* read last subpage oob */
1933 	if (ctrl->oob && (ctrl->edu_cmd == EDU_CMD_READ)) {
1934 		ctrl->oob += read_oob_from_regs(ctrl,
1935 						1,
1936 						ctrl->oob, ctrl->sas,
1937 						ctrl->sector_size_1k);
1938 	}
1939 
1940 	/* for program page check NAND status */
1941 	if (((brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1942 	      INTFC_FLASH_STATUS) & NAND_STATUS_FAIL) &&
1943 	    edu_cmd == EDU_CMD_WRITE) {
1944 		dev_info(ctrl->dev, "program failed at %llx\n",
1945 			 (unsigned long long)addr);
1946 		ret = -EIO;
1947 	}
1948 
1949 	/* Make sure the EDU status is clean */
1950 	if (edu_readl(ctrl, EDU_STATUS) & EDU_STATUS_ACTIVE)
1951 		dev_warn(ctrl->dev, "EDU still active: %#x\n",
1952 			 edu_readl(ctrl, EDU_STATUS));
1953 
1954 	if (unlikely(edu_readl(ctrl, EDU_ERR_STATUS) & EDU_ERR_STATUS_ERRACK)) {
1955 		dev_warn(ctrl->dev, "EDU RBUS error at addr %llx\n",
1956 			 (unsigned long long)addr);
1957 		ret = -EIO;
1958 	}
1959 
1960 	ctrl->edu_pending = false;
1961 	brcmnand_edu_init(ctrl);
1962 	edu_writel(ctrl, EDU_STOP, 0); /* force stop */
1963 	edu_readl(ctrl, EDU_STOP);
1964 
1965 	if (!ret && edu_cmd == EDU_CMD_READ) {
1966 		u64 err_addr = 0;
1967 
1968 		/*
1969 		 * check for ECC errors here, subpage ECC errors are
1970 		 * retained in ECC error address register
1971 		 */
1972 		err_addr = brcmnand_get_uncorrecc_addr(ctrl);
1973 		if (!err_addr) {
1974 			err_addr = brcmnand_get_correcc_addr(ctrl);
1975 			if (err_addr)
1976 				ret = -EUCLEAN;
1977 		} else
1978 			ret = -EBADMSG;
1979 	}
1980 
1981 	return ret;
1982 }
1983 
1984 /*
1985  * Construct a FLASH_DMA descriptor as part of a linked list. You must know the
1986  * following ahead of time:
1987  *  - Is this descriptor the beginning or end of a linked list?
1988  *  - What is the (DMA) address of the next descriptor in the linked list?
1989  */
1990 static int brcmnand_fill_dma_desc(struct brcmnand_host *host,
1991 				  struct brcm_nand_dma_desc *desc, u64 addr,
1992 				  dma_addr_t buf, u32 len, u8 dma_cmd,
1993 				  bool begin, bool end,
1994 				  dma_addr_t next_desc)
1995 {
1996 	memset(desc, 0, sizeof(*desc));
1997 	/* Descriptors are written in native byte order (wordwise) */
1998 	desc->next_desc = lower_32_bits(next_desc);
1999 	desc->next_desc_ext = upper_32_bits(next_desc);
2000 	desc->cmd_irq = (dma_cmd << 24) |
2001 		(end ? (0x03 << 8) : 0) | /* IRQ | STOP */
2002 		(!!begin) | ((!!end) << 1); /* head, tail */
2003 #ifdef CONFIG_CPU_BIG_ENDIAN
2004 	desc->cmd_irq |= 0x01 << 12;
2005 #endif
2006 	desc->dram_addr = lower_32_bits(buf);
2007 	desc->dram_addr_ext = upper_32_bits(buf);
2008 	desc->tfr_len = len;
2009 	desc->total_len = len;
2010 	desc->flash_addr = lower_32_bits(addr);
2011 	desc->flash_addr_ext = upper_32_bits(addr);
2012 	desc->cs = host->cs;
2013 	desc->status_valid = 0x01;
2014 	return 0;
2015 }
2016 
2017 /*
2018  * Kick the FLASH_DMA engine, with a given DMA descriptor
2019  */
2020 static void brcmnand_dma_run(struct brcmnand_host *host, dma_addr_t desc)
2021 {
2022 	struct brcmnand_controller *ctrl = host->ctrl;
2023 	unsigned long timeo = msecs_to_jiffies(100);
2024 
2025 	flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC, lower_32_bits(desc));
2026 	(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC);
2027 	if (ctrl->nand_version > 0x0602) {
2028 		flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC_EXT,
2029 				 upper_32_bits(desc));
2030 		(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC_EXT);
2031 	}
2032 
2033 	/* Start FLASH_DMA engine */
2034 	ctrl->dma_pending = true;
2035 	mb(); /* flush previous writes */
2036 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0x03); /* wake | run */
2037 
2038 	if (wait_for_completion_timeout(&ctrl->dma_done, timeo) <= 0) {
2039 		dev_err(ctrl->dev,
2040 				"timeout waiting for DMA; status %#x, error status %#x\n",
2041 				flash_dma_readl(ctrl, FLASH_DMA_STATUS),
2042 				flash_dma_readl(ctrl, FLASH_DMA_ERROR_STATUS));
2043 	}
2044 	ctrl->dma_pending = false;
2045 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0); /* force stop */
2046 }
2047 
2048 static int brcmnand_dma_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
2049 			      u8 *oob, u32 len, u8 dma_cmd)
2050 {
2051 	struct brcmnand_controller *ctrl = host->ctrl;
2052 	dma_addr_t buf_pa;
2053 	int dir = dma_cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
2054 
2055 	buf_pa = dma_map_single(ctrl->dev, buf, len, dir);
2056 	if (dma_mapping_error(ctrl->dev, buf_pa)) {
2057 		dev_err(ctrl->dev, "unable to map buffer for DMA\n");
2058 		return -ENOMEM;
2059 	}
2060 
2061 	brcmnand_fill_dma_desc(host, ctrl->dma_desc, addr, buf_pa, len,
2062 				   dma_cmd, true, true, 0);
2063 
2064 	brcmnand_dma_run(host, ctrl->dma_pa);
2065 
2066 	dma_unmap_single(ctrl->dev, buf_pa, len, dir);
2067 
2068 	if (ctrl->dma_desc->status_valid & FLASH_DMA_ECC_ERROR)
2069 		return -EBADMSG;
2070 	else if (ctrl->dma_desc->status_valid & FLASH_DMA_CORR_ERROR)
2071 		return -EUCLEAN;
2072 
2073 	return 0;
2074 }
2075 
2076 /*
2077  * Assumes proper CS is already set
2078  */
2079 static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
2080 				u64 addr, unsigned int trans, u32 *buf,
2081 				u8 *oob, u64 *err_addr)
2082 {
2083 	struct brcmnand_host *host = nand_get_controller_data(chip);
2084 	struct brcmnand_controller *ctrl = host->ctrl;
2085 	int i, j, ret = 0;
2086 
2087 	brcmnand_clear_ecc_addr(ctrl);
2088 
2089 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
2090 		brcmnand_set_cmd_addr(mtd, addr);
2091 		/* SPARE_AREA_READ does not use ECC, so just use PAGE_READ */
2092 		brcmnand_send_cmd(host, CMD_PAGE_READ);
2093 		brcmnand_waitfunc(chip);
2094 
2095 		if (likely(buf)) {
2096 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
2097 
2098 			for (j = 0; j < FC_WORDS; j++, buf++)
2099 				*buf = brcmnand_read_fc(ctrl, j);
2100 
2101 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
2102 		}
2103 
2104 		if (oob)
2105 			oob += read_oob_from_regs(ctrl, i, oob,
2106 					mtd->oobsize / trans,
2107 					host->hwcfg.sector_size_1k);
2108 
2109 		if (!ret) {
2110 			*err_addr = brcmnand_get_uncorrecc_addr(ctrl);
2111 
2112 			if (*err_addr)
2113 				ret = -EBADMSG;
2114 		}
2115 
2116 		if (!ret) {
2117 			*err_addr = brcmnand_get_correcc_addr(ctrl);
2118 
2119 			if (*err_addr)
2120 				ret = -EUCLEAN;
2121 		}
2122 	}
2123 
2124 	return ret;
2125 }
2126 
2127 /*
2128  * Check a page to see if it is erased (w/ bitflips) after an uncorrectable ECC
2129  * error
2130  *
2131  * Because the HW ECC signals an ECC error if an erase paged has even a single
2132  * bitflip, we must check each ECC error to see if it is actually an erased
2133  * page with bitflips, not a truly corrupted page.
2134  *
2135  * On a real error, return a negative error code (-EBADMSG for ECC error), and
2136  * buf will contain raw data.
2137  * Otherwise, buf gets filled with 0xffs and return the maximum number of
2138  * bitflips-per-ECC-sector to the caller.
2139  *
2140  */
2141 static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
2142 		  struct nand_chip *chip, void *buf, u64 addr)
2143 {
2144 	struct mtd_oob_region ecc;
2145 	int i;
2146 	int bitflips = 0;
2147 	int page = addr >> chip->page_shift;
2148 	int ret;
2149 	void *ecc_bytes;
2150 	void *ecc_chunk;
2151 
2152 	if (!buf)
2153 		buf = nand_get_data_buf(chip);
2154 
2155 	/* read without ecc for verification */
2156 	ret = chip->ecc.read_page_raw(chip, buf, true, page);
2157 	if (ret)
2158 		return ret;
2159 
2160 	for (i = 0; i < chip->ecc.steps; i++) {
2161 		ecc_chunk = buf + chip->ecc.size * i;
2162 
2163 		mtd_ooblayout_ecc(mtd, i, &ecc);
2164 		ecc_bytes = chip->oob_poi + ecc.offset;
2165 
2166 		ret = nand_check_erased_ecc_chunk(ecc_chunk, chip->ecc.size,
2167 						  ecc_bytes, ecc.length,
2168 						  NULL, 0,
2169 						  chip->ecc.strength);
2170 		if (ret < 0)
2171 			return ret;
2172 
2173 		bitflips = max(bitflips, ret);
2174 	}
2175 
2176 	return bitflips;
2177 }
2178 
2179 static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
2180 			 u64 addr, unsigned int trans, u32 *buf, u8 *oob)
2181 {
2182 	struct brcmnand_host *host = nand_get_controller_data(chip);
2183 	struct brcmnand_controller *ctrl = host->ctrl;
2184 	u64 err_addr = 0;
2185 	int err;
2186 	bool retry = true;
2187 	bool edu_err = false;
2188 
2189 	dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
2190 
2191 try_dmaread:
2192 	brcmnand_clear_ecc_addr(ctrl);
2193 
2194 	if (ctrl->dma_trans && (has_edu(ctrl) || !oob) &&
2195 	    flash_dma_buf_ok(buf)) {
2196 		err = ctrl->dma_trans(host, addr, buf, oob,
2197 				      trans * FC_BYTES,
2198 				      CMD_PAGE_READ);
2199 
2200 		if (err) {
2201 			if (mtd_is_bitflip_or_eccerr(err))
2202 				err_addr = addr;
2203 			else
2204 				return -EIO;
2205 		}
2206 
2207 		if (has_edu(ctrl) && err_addr)
2208 			edu_err = true;
2209 
2210 	} else {
2211 		if (oob)
2212 			memset(oob, 0x99, mtd->oobsize);
2213 
2214 		err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
2215 					       oob, &err_addr);
2216 	}
2217 
2218 	if (mtd_is_eccerr(err)) {
2219 		/*
2220 		 * On controller version and 7.0, 7.1 , DMA read after a
2221 		 * prior PIO read that reported uncorrectable error,
2222 		 * the DMA engine captures this error following DMA read
2223 		 * cleared only on subsequent DMA read, so just retry once
2224 		 * to clear a possible false error reported for current DMA
2225 		 * read
2226 		 */
2227 		if ((ctrl->nand_version == 0x0700) ||
2228 		    (ctrl->nand_version == 0x0701)) {
2229 			if (retry) {
2230 				retry = false;
2231 				goto try_dmaread;
2232 			}
2233 		}
2234 
2235 		/*
2236 		 * Controller version 7.2 has hw encoder to detect erased page
2237 		 * bitflips, apply sw verification for older controllers only
2238 		 */
2239 		if (ctrl->nand_version < 0x0702) {
2240 			err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
2241 							      addr);
2242 			/* erased page bitflips corrected */
2243 			if (err >= 0)
2244 				return err;
2245 		}
2246 
2247 		dev_dbg(ctrl->dev, "uncorrectable error at 0x%llx\n",
2248 			(unsigned long long)err_addr);
2249 		mtd->ecc_stats.failed++;
2250 		/* NAND layer expects zero on ECC errors */
2251 		return 0;
2252 	}
2253 
2254 	if (mtd_is_bitflip(err)) {
2255 		unsigned int corrected = brcmnand_count_corrected(ctrl);
2256 
2257 		/* in case of EDU correctable error we read again using PIO */
2258 		if (edu_err)
2259 			err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
2260 						   oob, &err_addr);
2261 
2262 		dev_dbg(ctrl->dev, "corrected error at 0x%llx\n",
2263 			(unsigned long long)err_addr);
2264 		mtd->ecc_stats.corrected += corrected;
2265 		/* Always exceed the software-imposed threshold */
2266 		return max(mtd->bitflip_threshold, corrected);
2267 	}
2268 
2269 	return 0;
2270 }
2271 
2272 static int brcmnand_read_page(struct nand_chip *chip, uint8_t *buf,
2273 			      int oob_required, int page)
2274 {
2275 	struct mtd_info *mtd = nand_to_mtd(chip);
2276 	struct brcmnand_host *host = nand_get_controller_data(chip);
2277 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
2278 
2279 	nand_read_page_op(chip, page, 0, NULL, 0);
2280 
2281 	return brcmnand_read(mtd, chip, host->last_addr,
2282 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
2283 }
2284 
2285 static int brcmnand_read_page_raw(struct nand_chip *chip, uint8_t *buf,
2286 				  int oob_required, int page)
2287 {
2288 	struct brcmnand_host *host = nand_get_controller_data(chip);
2289 	struct mtd_info *mtd = nand_to_mtd(chip);
2290 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
2291 	int ret;
2292 
2293 	nand_read_page_op(chip, page, 0, NULL, 0);
2294 
2295 	brcmnand_set_ecc_enabled(host, 0);
2296 	ret = brcmnand_read(mtd, chip, host->last_addr,
2297 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
2298 	brcmnand_set_ecc_enabled(host, 1);
2299 	return ret;
2300 }
2301 
2302 static int brcmnand_read_oob(struct nand_chip *chip, int page)
2303 {
2304 	struct mtd_info *mtd = nand_to_mtd(chip);
2305 
2306 	return brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
2307 			mtd->writesize >> FC_SHIFT,
2308 			NULL, (u8 *)chip->oob_poi);
2309 }
2310 
2311 static int brcmnand_read_oob_raw(struct nand_chip *chip, int page)
2312 {
2313 	struct mtd_info *mtd = nand_to_mtd(chip);
2314 	struct brcmnand_host *host = nand_get_controller_data(chip);
2315 
2316 	brcmnand_set_ecc_enabled(host, 0);
2317 	brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
2318 		mtd->writesize >> FC_SHIFT,
2319 		NULL, (u8 *)chip->oob_poi);
2320 	brcmnand_set_ecc_enabled(host, 1);
2321 	return 0;
2322 }
2323 
2324 static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
2325 			  u64 addr, const u32 *buf, u8 *oob)
2326 {
2327 	struct brcmnand_host *host = nand_get_controller_data(chip);
2328 	struct brcmnand_controller *ctrl = host->ctrl;
2329 	unsigned int i, j, trans = mtd->writesize >> FC_SHIFT;
2330 	int status, ret = 0;
2331 
2332 	dev_dbg(ctrl->dev, "write %llx <- %p\n", (unsigned long long)addr, buf);
2333 
2334 	if (unlikely((unsigned long)buf & 0x03)) {
2335 		dev_warn(ctrl->dev, "unaligned buffer: %p\n", buf);
2336 		buf = (u32 *)((unsigned long)buf & ~0x03);
2337 	}
2338 
2339 	brcmnand_wp(mtd, 0);
2340 
2341 	for (i = 0; i < ctrl->max_oob; i += 4)
2342 		oob_reg_write(ctrl, i, 0xffffffff);
2343 
2344 	if (mtd->oops_panic_write)
2345 		/* switch to interrupt polling and PIO mode */
2346 		disable_ctrl_irqs(ctrl);
2347 
2348 	if (use_dma(ctrl) && (has_edu(ctrl) || !oob) && flash_dma_buf_ok(buf)) {
2349 		if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,
2350 				    CMD_PROGRAM_PAGE))
2351 
2352 			ret = -EIO;
2353 
2354 		goto out;
2355 	}
2356 
2357 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
2358 		/* full address MUST be set before populating FC */
2359 		brcmnand_set_cmd_addr(mtd, addr);
2360 
2361 		if (buf) {
2362 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
2363 
2364 			for (j = 0; j < FC_WORDS; j++, buf++)
2365 				brcmnand_write_fc(ctrl, j, *buf);
2366 
2367 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
2368 		} else if (oob) {
2369 			for (j = 0; j < FC_WORDS; j++)
2370 				brcmnand_write_fc(ctrl, j, 0xffffffff);
2371 		}
2372 
2373 		if (oob) {
2374 			oob += write_oob_to_regs(ctrl, i, oob,
2375 					mtd->oobsize / trans,
2376 					host->hwcfg.sector_size_1k);
2377 		}
2378 
2379 		/* we cannot use SPARE_AREA_PROGRAM when PARTIAL_PAGE_EN=0 */
2380 		brcmnand_send_cmd(host, CMD_PROGRAM_PAGE);
2381 		status = brcmnand_waitfunc(chip);
2382 
2383 		if (status & NAND_STATUS_FAIL) {
2384 			dev_info(ctrl->dev, "program failed at %llx\n",
2385 				(unsigned long long)addr);
2386 			ret = -EIO;
2387 			goto out;
2388 		}
2389 	}
2390 out:
2391 	brcmnand_wp(mtd, 1);
2392 	return ret;
2393 }
2394 
2395 static int brcmnand_write_page(struct nand_chip *chip, const uint8_t *buf,
2396 			       int oob_required, int page)
2397 {
2398 	struct mtd_info *mtd = nand_to_mtd(chip);
2399 	struct brcmnand_host *host = nand_get_controller_data(chip);
2400 	void *oob = oob_required ? chip->oob_poi : NULL;
2401 
2402 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
2403 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
2404 
2405 	return nand_prog_page_end_op(chip);
2406 }
2407 
2408 static int brcmnand_write_page_raw(struct nand_chip *chip, const uint8_t *buf,
2409 				   int oob_required, int page)
2410 {
2411 	struct mtd_info *mtd = nand_to_mtd(chip);
2412 	struct brcmnand_host *host = nand_get_controller_data(chip);
2413 	void *oob = oob_required ? chip->oob_poi : NULL;
2414 
2415 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
2416 	brcmnand_set_ecc_enabled(host, 0);
2417 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
2418 	brcmnand_set_ecc_enabled(host, 1);
2419 
2420 	return nand_prog_page_end_op(chip);
2421 }
2422 
2423 static int brcmnand_write_oob(struct nand_chip *chip, int page)
2424 {
2425 	return brcmnand_write(nand_to_mtd(chip), chip,
2426 			      (u64)page << chip->page_shift, NULL,
2427 			      chip->oob_poi);
2428 }
2429 
2430 static int brcmnand_write_oob_raw(struct nand_chip *chip, int page)
2431 {
2432 	struct mtd_info *mtd = nand_to_mtd(chip);
2433 	struct brcmnand_host *host = nand_get_controller_data(chip);
2434 	int ret;
2435 
2436 	brcmnand_set_ecc_enabled(host, 0);
2437 	ret = brcmnand_write(mtd, chip, (u64)page << chip->page_shift, NULL,
2438 				 (u8 *)chip->oob_poi);
2439 	brcmnand_set_ecc_enabled(host, 1);
2440 
2441 	return ret;
2442 }
2443 
2444 /***********************************************************************
2445  * Per-CS setup (1 NAND device)
2446  ***********************************************************************/
2447 
2448 static int brcmnand_set_cfg(struct brcmnand_host *host,
2449 			    struct brcmnand_cfg *cfg)
2450 {
2451 	struct brcmnand_controller *ctrl = host->ctrl;
2452 	struct nand_chip *chip = &host->chip;
2453 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2454 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
2455 			BRCMNAND_CS_CFG_EXT);
2456 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
2457 			BRCMNAND_CS_ACC_CONTROL);
2458 	u8 block_size = 0, page_size = 0, device_size = 0;
2459 	u32 tmp;
2460 
2461 	if (ctrl->block_sizes) {
2462 		int i, found;
2463 
2464 		for (i = 0, found = 0; ctrl->block_sizes[i]; i++)
2465 			if (ctrl->block_sizes[i] * 1024 == cfg->block_size) {
2466 				block_size = i;
2467 				found = 1;
2468 			}
2469 		if (!found) {
2470 			dev_warn(ctrl->dev, "invalid block size %u\n",
2471 					cfg->block_size);
2472 			return -EINVAL;
2473 		}
2474 	} else {
2475 		block_size = ffs(cfg->block_size) - ffs(BRCMNAND_MIN_BLOCKSIZE);
2476 	}
2477 
2478 	if (cfg->block_size < BRCMNAND_MIN_BLOCKSIZE || (ctrl->max_block_size &&
2479 				cfg->block_size > ctrl->max_block_size)) {
2480 		dev_warn(ctrl->dev, "invalid block size %u\n",
2481 				cfg->block_size);
2482 		block_size = 0;
2483 	}
2484 
2485 	if (ctrl->page_sizes) {
2486 		int i, found;
2487 
2488 		for (i = 0, found = 0; ctrl->page_sizes[i]; i++)
2489 			if (ctrl->page_sizes[i] == cfg->page_size) {
2490 				page_size = i;
2491 				found = 1;
2492 			}
2493 		if (!found) {
2494 			dev_warn(ctrl->dev, "invalid page size %u\n",
2495 					cfg->page_size);
2496 			return -EINVAL;
2497 		}
2498 	} else {
2499 		page_size = ffs(cfg->page_size) - ffs(BRCMNAND_MIN_PAGESIZE);
2500 	}
2501 
2502 	if (cfg->page_size < BRCMNAND_MIN_PAGESIZE || (ctrl->max_page_size &&
2503 				cfg->page_size > ctrl->max_page_size)) {
2504 		dev_warn(ctrl->dev, "invalid page size %u\n", cfg->page_size);
2505 		return -EINVAL;
2506 	}
2507 
2508 	if (fls64(cfg->device_size) < fls64(BRCMNAND_MIN_DEVSIZE)) {
2509 		dev_warn(ctrl->dev, "invalid device size 0x%llx\n",
2510 			(unsigned long long)cfg->device_size);
2511 		return -EINVAL;
2512 	}
2513 	device_size = fls64(cfg->device_size) - fls64(BRCMNAND_MIN_DEVSIZE);
2514 
2515 	tmp = (cfg->blk_adr_bytes << CFG_BLK_ADR_BYTES_SHIFT) |
2516 		(cfg->col_adr_bytes << CFG_COL_ADR_BYTES_SHIFT) |
2517 		(cfg->ful_adr_bytes << CFG_FUL_ADR_BYTES_SHIFT) |
2518 		(!!(cfg->device_width == 16) << CFG_BUS_WIDTH_SHIFT) |
2519 		(device_size << CFG_DEVICE_SIZE_SHIFT);
2520 	if (cfg_offs == cfg_ext_offs) {
2521 		tmp |= (page_size << ctrl->page_size_shift) |
2522 		       (block_size << CFG_BLK_SIZE_SHIFT);
2523 		nand_writereg(ctrl, cfg_offs, tmp);
2524 	} else {
2525 		nand_writereg(ctrl, cfg_offs, tmp);
2526 		tmp = (page_size << CFG_EXT_PAGE_SIZE_SHIFT) |
2527 		      (block_size << CFG_EXT_BLK_SIZE_SHIFT);
2528 		nand_writereg(ctrl, cfg_ext_offs, tmp);
2529 	}
2530 
2531 	tmp = nand_readreg(ctrl, acc_control_offs);
2532 	tmp &= ~brcmnand_ecc_level_mask(ctrl);
2533 	tmp &= ~brcmnand_spare_area_mask(ctrl);
2534 	if (ctrl->nand_version >= 0x0302) {
2535 		tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT;
2536 		tmp |= cfg->spare_area_size;
2537 	}
2538 	nand_writereg(ctrl, acc_control_offs, tmp);
2539 
2540 	brcmnand_set_sector_size_1k(host, cfg->sector_size_1k);
2541 
2542 	/* threshold = ceil(BCH-level * 0.75) */
2543 	brcmnand_wr_corr_thresh(host, DIV_ROUND_UP(chip->ecc.strength * 3, 4));
2544 
2545 	return 0;
2546 }
2547 
2548 static void brcmnand_print_cfg(struct brcmnand_host *host,
2549 			       char *buf, struct brcmnand_cfg *cfg)
2550 {
2551 	buf += sprintf(buf,
2552 		"%lluMiB total, %uKiB blocks, %u%s pages, %uB OOB, %u-bit",
2553 		(unsigned long long)cfg->device_size >> 20,
2554 		cfg->block_size >> 10,
2555 		cfg->page_size >= 1024 ? cfg->page_size >> 10 : cfg->page_size,
2556 		cfg->page_size >= 1024 ? "KiB" : "B",
2557 		cfg->spare_area_size, cfg->device_width);
2558 
2559 	/* Account for Hamming ECC and for BCH 512B vs 1KiB sectors */
2560 	if (is_hamming_ecc(host->ctrl, cfg))
2561 		sprintf(buf, ", Hamming ECC");
2562 	else if (cfg->sector_size_1k)
2563 		sprintf(buf, ", BCH-%u (1KiB sector)", cfg->ecc_level << 1);
2564 	else
2565 		sprintf(buf, ", BCH-%u", cfg->ecc_level);
2566 }
2567 
2568 /*
2569  * Minimum number of bytes to address a page. Calculated as:
2570  *     roundup(log2(size / page-size) / 8)
2571  *
2572  * NB: the following does not "round up" for non-power-of-2 'size'; but this is
2573  *     OK because many other things will break if 'size' is irregular...
2574  */
2575 static inline int get_blk_adr_bytes(u64 size, u32 writesize)
2576 {
2577 	return ALIGN(ilog2(size) - ilog2(writesize), 8) >> 3;
2578 }
2579 
2580 static int brcmnand_setup_dev(struct brcmnand_host *host)
2581 {
2582 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
2583 	struct nand_chip *chip = &host->chip;
2584 	const struct nand_ecc_props *requirements =
2585 		nanddev_get_ecc_requirements(&chip->base);
2586 	struct brcmnand_controller *ctrl = host->ctrl;
2587 	struct brcmnand_cfg *cfg = &host->hwcfg;
2588 	char msg[128];
2589 	u32 offs, tmp, oob_sector;
2590 	int ret;
2591 
2592 	memset(cfg, 0, sizeof(*cfg));
2593 
2594 	ret = of_property_read_u32(nand_get_flash_node(chip),
2595 				   "brcm,nand-oob-sector-size",
2596 				   &oob_sector);
2597 	if (ret) {
2598 		/* Use detected size */
2599 		cfg->spare_area_size = mtd->oobsize /
2600 					(mtd->writesize >> FC_SHIFT);
2601 	} else {
2602 		cfg->spare_area_size = oob_sector;
2603 	}
2604 	if (cfg->spare_area_size > ctrl->max_oob)
2605 		cfg->spare_area_size = ctrl->max_oob;
2606 	/*
2607 	 * Set oobsize to be consistent with controller's spare_area_size, as
2608 	 * the rest is inaccessible.
2609 	 */
2610 	mtd->oobsize = cfg->spare_area_size * (mtd->writesize >> FC_SHIFT);
2611 
2612 	cfg->device_size = mtd->size;
2613 	cfg->block_size = mtd->erasesize;
2614 	cfg->page_size = mtd->writesize;
2615 	cfg->device_width = (chip->options & NAND_BUSWIDTH_16) ? 16 : 8;
2616 	cfg->col_adr_bytes = 2;
2617 	cfg->blk_adr_bytes = get_blk_adr_bytes(mtd->size, mtd->writesize);
2618 
2619 	if (chip->ecc.engine_type != NAND_ECC_ENGINE_TYPE_ON_HOST) {
2620 		dev_err(ctrl->dev, "only HW ECC supported; selected: %d\n",
2621 			chip->ecc.engine_type);
2622 		return -EINVAL;
2623 	}
2624 
2625 	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN) {
2626 		if (chip->ecc.strength == 1 && chip->ecc.size == 512)
2627 			/* Default to Hamming for 1-bit ECC, if unspecified */
2628 			chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
2629 		else
2630 			/* Otherwise, BCH */
2631 			chip->ecc.algo = NAND_ECC_ALGO_BCH;
2632 	}
2633 
2634 	if (chip->ecc.algo == NAND_ECC_ALGO_HAMMING &&
2635 	    (chip->ecc.strength != 1 || chip->ecc.size != 512)) {
2636 		dev_err(ctrl->dev, "invalid Hamming params: %d bits per %d bytes\n",
2637 			chip->ecc.strength, chip->ecc.size);
2638 		return -EINVAL;
2639 	}
2640 
2641 	if (chip->ecc.engine_type != NAND_ECC_ENGINE_TYPE_NONE &&
2642 	    (!chip->ecc.size || !chip->ecc.strength)) {
2643 		if (requirements->step_size && requirements->strength) {
2644 			/* use detected ECC parameters */
2645 			chip->ecc.size = requirements->step_size;
2646 			chip->ecc.strength = requirements->strength;
2647 			dev_info(ctrl->dev, "Using ECC step-size %d, strength %d\n",
2648 				chip->ecc.size, chip->ecc.strength);
2649 		}
2650 	}
2651 
2652 	switch (chip->ecc.size) {
2653 	case 512:
2654 		if (chip->ecc.algo == NAND_ECC_ALGO_HAMMING)
2655 			cfg->ecc_level = 15;
2656 		else
2657 			cfg->ecc_level = chip->ecc.strength;
2658 		cfg->sector_size_1k = 0;
2659 		break;
2660 	case 1024:
2661 		if (!(ctrl->features & BRCMNAND_HAS_1K_SECTORS)) {
2662 			dev_err(ctrl->dev, "1KB sectors not supported\n");
2663 			return -EINVAL;
2664 		}
2665 		if (chip->ecc.strength & 0x1) {
2666 			dev_err(ctrl->dev,
2667 				"odd ECC not supported with 1KB sectors\n");
2668 			return -EINVAL;
2669 		}
2670 
2671 		cfg->ecc_level = chip->ecc.strength >> 1;
2672 		cfg->sector_size_1k = 1;
2673 		break;
2674 	default:
2675 		dev_err(ctrl->dev, "unsupported ECC size: %d\n",
2676 			chip->ecc.size);
2677 		return -EINVAL;
2678 	}
2679 
2680 	cfg->ful_adr_bytes = cfg->blk_adr_bytes;
2681 	if (mtd->writesize > 512)
2682 		cfg->ful_adr_bytes += cfg->col_adr_bytes;
2683 	else
2684 		cfg->ful_adr_bytes += 1;
2685 
2686 	ret = brcmnand_set_cfg(host, cfg);
2687 	if (ret)
2688 		return ret;
2689 
2690 	brcmnand_set_ecc_enabled(host, 1);
2691 
2692 	brcmnand_print_cfg(host, msg, cfg);
2693 	dev_info(ctrl->dev, "detected %s\n", msg);
2694 
2695 	/* Configure ACC_CONTROL */
2696 	offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
2697 	tmp = nand_readreg(ctrl, offs);
2698 	tmp &= ~ACC_CONTROL_PARTIAL_PAGE;
2699 	tmp &= ~ACC_CONTROL_RD_ERASED;
2700 
2701 	/* We need to turn on Read from erased paged protected by ECC */
2702 	if (ctrl->nand_version >= 0x0702)
2703 		tmp |= ACC_CONTROL_RD_ERASED;
2704 	tmp &= ~ACC_CONTROL_FAST_PGM_RDIN;
2705 	if (ctrl->features & BRCMNAND_HAS_PREFETCH)
2706 		tmp &= ~ACC_CONTROL_PREFETCH;
2707 
2708 	nand_writereg(ctrl, offs, tmp);
2709 
2710 	return 0;
2711 }
2712 
2713 static int brcmnand_attach_chip(struct nand_chip *chip)
2714 {
2715 	struct mtd_info *mtd = nand_to_mtd(chip);
2716 	struct brcmnand_host *host = nand_get_controller_data(chip);
2717 	int ret;
2718 
2719 	chip->options |= NAND_NO_SUBPAGE_WRITE;
2720 	/*
2721 	 * Avoid (for instance) kmap()'d buffers from JFFS2, which we can't DMA
2722 	 * to/from, and have nand_base pass us a bounce buffer instead, as
2723 	 * needed.
2724 	 */
2725 	chip->options |= NAND_USES_DMA;
2726 
2727 	if (chip->bbt_options & NAND_BBT_USE_FLASH)
2728 		chip->bbt_options |= NAND_BBT_NO_OOB;
2729 
2730 	if (brcmnand_setup_dev(host))
2731 		return -ENXIO;
2732 
2733 	chip->ecc.size = host->hwcfg.sector_size_1k ? 1024 : 512;
2734 
2735 	/* only use our internal HW threshold */
2736 	mtd->bitflip_threshold = 1;
2737 
2738 	ret = brcmstb_choose_ecc_layout(host);
2739 
2740 	/* If OOB is written with ECC enabled it will cause ECC errors */
2741 	if (is_hamming_ecc(host->ctrl, &host->hwcfg)) {
2742 		chip->ecc.write_oob = brcmnand_write_oob_raw;
2743 		chip->ecc.read_oob = brcmnand_read_oob_raw;
2744 	}
2745 
2746 	return ret;
2747 }
2748 
2749 static const struct nand_controller_ops brcmnand_controller_ops = {
2750 	.attach_chip = brcmnand_attach_chip,
2751 };
2752 
2753 static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
2754 {
2755 	struct brcmnand_controller *ctrl = host->ctrl;
2756 	struct platform_device *pdev = host->pdev;
2757 	struct mtd_info *mtd;
2758 	struct nand_chip *chip;
2759 	int ret;
2760 	u16 cfg_offs;
2761 
2762 	ret = of_property_read_u32(dn, "reg", &host->cs);
2763 	if (ret) {
2764 		dev_err(&pdev->dev, "can't get chip-select\n");
2765 		return -ENXIO;
2766 	}
2767 
2768 	mtd = nand_to_mtd(&host->chip);
2769 	chip = &host->chip;
2770 
2771 	nand_set_flash_node(chip, dn);
2772 	nand_set_controller_data(chip, host);
2773 	mtd->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "brcmnand.%d",
2774 				   host->cs);
2775 	if (!mtd->name)
2776 		return -ENOMEM;
2777 
2778 	mtd->owner = THIS_MODULE;
2779 	mtd->dev.parent = &pdev->dev;
2780 
2781 	chip->legacy.cmd_ctrl = brcmnand_cmd_ctrl;
2782 	chip->legacy.cmdfunc = brcmnand_cmdfunc;
2783 	chip->legacy.waitfunc = brcmnand_waitfunc;
2784 	chip->legacy.read_byte = brcmnand_read_byte;
2785 	chip->legacy.read_buf = brcmnand_read_buf;
2786 	chip->legacy.write_buf = brcmnand_write_buf;
2787 
2788 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_ON_HOST;
2789 	chip->ecc.read_page = brcmnand_read_page;
2790 	chip->ecc.write_page = brcmnand_write_page;
2791 	chip->ecc.read_page_raw = brcmnand_read_page_raw;
2792 	chip->ecc.write_page_raw = brcmnand_write_page_raw;
2793 	chip->ecc.write_oob_raw = brcmnand_write_oob_raw;
2794 	chip->ecc.read_oob_raw = brcmnand_read_oob_raw;
2795 	chip->ecc.read_oob = brcmnand_read_oob;
2796 	chip->ecc.write_oob = brcmnand_write_oob;
2797 
2798 	chip->controller = &ctrl->controller;
2799 
2800 	/*
2801 	 * The bootloader might have configured 16bit mode but
2802 	 * NAND READID command only works in 8bit mode. We force
2803 	 * 8bit mode here to ensure that NAND READID commands works.
2804 	 */
2805 	cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2806 	nand_writereg(ctrl, cfg_offs,
2807 		      nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
2808 
2809 	ret = nand_scan(chip, 1);
2810 	if (ret)
2811 		return ret;
2812 
2813 	ret = mtd_device_register(mtd, NULL, 0);
2814 	if (ret)
2815 		nand_cleanup(chip);
2816 
2817 	return ret;
2818 }
2819 
2820 static void brcmnand_save_restore_cs_config(struct brcmnand_host *host,
2821 					    int restore)
2822 {
2823 	struct brcmnand_controller *ctrl = host->ctrl;
2824 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2825 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
2826 			BRCMNAND_CS_CFG_EXT);
2827 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
2828 			BRCMNAND_CS_ACC_CONTROL);
2829 	u16 t1_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING1);
2830 	u16 t2_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING2);
2831 
2832 	if (restore) {
2833 		nand_writereg(ctrl, cfg_offs, host->hwcfg.config);
2834 		if (cfg_offs != cfg_ext_offs)
2835 			nand_writereg(ctrl, cfg_ext_offs,
2836 				      host->hwcfg.config_ext);
2837 		nand_writereg(ctrl, acc_control_offs, host->hwcfg.acc_control);
2838 		nand_writereg(ctrl, t1_offs, host->hwcfg.timing_1);
2839 		nand_writereg(ctrl, t2_offs, host->hwcfg.timing_2);
2840 	} else {
2841 		host->hwcfg.config = nand_readreg(ctrl, cfg_offs);
2842 		if (cfg_offs != cfg_ext_offs)
2843 			host->hwcfg.config_ext =
2844 				nand_readreg(ctrl, cfg_ext_offs);
2845 		host->hwcfg.acc_control = nand_readreg(ctrl, acc_control_offs);
2846 		host->hwcfg.timing_1 = nand_readreg(ctrl, t1_offs);
2847 		host->hwcfg.timing_2 = nand_readreg(ctrl, t2_offs);
2848 	}
2849 }
2850 
2851 static int brcmnand_suspend(struct device *dev)
2852 {
2853 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2854 	struct brcmnand_host *host;
2855 
2856 	list_for_each_entry(host, &ctrl->host_list, node)
2857 		brcmnand_save_restore_cs_config(host, 0);
2858 
2859 	ctrl->nand_cs_nand_select = brcmnand_read_reg(ctrl, BRCMNAND_CS_SELECT);
2860 	ctrl->nand_cs_nand_xor = brcmnand_read_reg(ctrl, BRCMNAND_CS_XOR);
2861 	ctrl->corr_stat_threshold =
2862 		brcmnand_read_reg(ctrl, BRCMNAND_CORR_THRESHOLD);
2863 
2864 	if (has_flash_dma(ctrl))
2865 		ctrl->flash_dma_mode = flash_dma_readl(ctrl, FLASH_DMA_MODE);
2866 	else if (has_edu(ctrl))
2867 		ctrl->edu_config = edu_readl(ctrl, EDU_CONFIG);
2868 
2869 	return 0;
2870 }
2871 
2872 static int brcmnand_resume(struct device *dev)
2873 {
2874 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2875 	struct brcmnand_host *host;
2876 
2877 	if (has_flash_dma(ctrl)) {
2878 		flash_dma_writel(ctrl, FLASH_DMA_MODE, ctrl->flash_dma_mode);
2879 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
2880 	}
2881 
2882 	if (has_edu(ctrl)) {
2883 		ctrl->edu_config = edu_readl(ctrl, EDU_CONFIG);
2884 		edu_writel(ctrl, EDU_CONFIG, ctrl->edu_config);
2885 		edu_readl(ctrl, EDU_CONFIG);
2886 		brcmnand_edu_init(ctrl);
2887 	}
2888 
2889 	brcmnand_write_reg(ctrl, BRCMNAND_CS_SELECT, ctrl->nand_cs_nand_select);
2890 	brcmnand_write_reg(ctrl, BRCMNAND_CS_XOR, ctrl->nand_cs_nand_xor);
2891 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_THRESHOLD,
2892 			ctrl->corr_stat_threshold);
2893 	if (ctrl->soc) {
2894 		/* Clear/re-enable interrupt */
2895 		ctrl->soc->ctlrdy_ack(ctrl->soc);
2896 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
2897 	}
2898 
2899 	list_for_each_entry(host, &ctrl->host_list, node) {
2900 		struct nand_chip *chip = &host->chip;
2901 
2902 		brcmnand_save_restore_cs_config(host, 1);
2903 
2904 		/* Reset the chip, required by some chips after power-up */
2905 		nand_reset_op(chip);
2906 	}
2907 
2908 	return 0;
2909 }
2910 
2911 const struct dev_pm_ops brcmnand_pm_ops = {
2912 	.suspend		= brcmnand_suspend,
2913 	.resume			= brcmnand_resume,
2914 };
2915 EXPORT_SYMBOL_GPL(brcmnand_pm_ops);
2916 
2917 static const struct of_device_id brcmnand_of_match[] = {
2918 	{ .compatible = "brcm,brcmnand-v2.1" },
2919 	{ .compatible = "brcm,brcmnand-v2.2" },
2920 	{ .compatible = "brcm,brcmnand-v4.0" },
2921 	{ .compatible = "brcm,brcmnand-v5.0" },
2922 	{ .compatible = "brcm,brcmnand-v6.0" },
2923 	{ .compatible = "brcm,brcmnand-v6.1" },
2924 	{ .compatible = "brcm,brcmnand-v6.2" },
2925 	{ .compatible = "brcm,brcmnand-v7.0" },
2926 	{ .compatible = "brcm,brcmnand-v7.1" },
2927 	{ .compatible = "brcm,brcmnand-v7.2" },
2928 	{ .compatible = "brcm,brcmnand-v7.3" },
2929 	{},
2930 };
2931 MODULE_DEVICE_TABLE(of, brcmnand_of_match);
2932 
2933 /***********************************************************************
2934  * Platform driver setup (per controller)
2935  ***********************************************************************/
2936 static int brcmnand_edu_setup(struct platform_device *pdev)
2937 {
2938 	struct device *dev = &pdev->dev;
2939 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
2940 	struct resource *res;
2941 	int ret;
2942 
2943 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "flash-edu");
2944 	if (res) {
2945 		ctrl->edu_base = devm_ioremap_resource(dev, res);
2946 		if (IS_ERR(ctrl->edu_base))
2947 			return PTR_ERR(ctrl->edu_base);
2948 
2949 		ctrl->edu_offsets = edu_regs;
2950 
2951 		edu_writel(ctrl, EDU_CONFIG, EDU_CONFIG_MODE_NAND |
2952 			   EDU_CONFIG_SWAP_CFG);
2953 		edu_readl(ctrl, EDU_CONFIG);
2954 
2955 		/* initialize edu */
2956 		brcmnand_edu_init(ctrl);
2957 
2958 		ctrl->edu_irq = platform_get_irq_optional(pdev, 1);
2959 		if (ctrl->edu_irq < 0) {
2960 			dev_warn(dev,
2961 				 "FLASH EDU enabled, using ctlrdy irq\n");
2962 		} else {
2963 			ret = devm_request_irq(dev, ctrl->edu_irq,
2964 					       brcmnand_edu_irq, 0,
2965 					       "brcmnand-edu", ctrl);
2966 			if (ret < 0) {
2967 				dev_err(ctrl->dev, "can't allocate IRQ %d: error %d\n",
2968 					ctrl->edu_irq, ret);
2969 				return ret;
2970 			}
2971 
2972 			dev_info(dev, "FLASH EDU enabled using irq %u\n",
2973 				 ctrl->edu_irq);
2974 		}
2975 	}
2976 
2977 	return 0;
2978 }
2979 
2980 int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
2981 {
2982 	struct device *dev = &pdev->dev;
2983 	struct device_node *dn = dev->of_node, *child;
2984 	struct brcmnand_controller *ctrl;
2985 	struct resource *res;
2986 	int ret;
2987 
2988 	/* We only support device-tree instantiation */
2989 	if (!dn)
2990 		return -ENODEV;
2991 
2992 	if (!of_match_node(brcmnand_of_match, dn))
2993 		return -ENODEV;
2994 
2995 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
2996 	if (!ctrl)
2997 		return -ENOMEM;
2998 
2999 	dev_set_drvdata(dev, ctrl);
3000 	ctrl->dev = dev;
3001 
3002 	init_completion(&ctrl->done);
3003 	init_completion(&ctrl->dma_done);
3004 	init_completion(&ctrl->edu_done);
3005 	nand_controller_init(&ctrl->controller);
3006 	ctrl->controller.ops = &brcmnand_controller_ops;
3007 	INIT_LIST_HEAD(&ctrl->host_list);
3008 
3009 	/* NAND register range */
3010 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
3011 	ctrl->nand_base = devm_ioremap_resource(dev, res);
3012 	if (IS_ERR(ctrl->nand_base))
3013 		return PTR_ERR(ctrl->nand_base);
3014 
3015 	/* Enable clock before using NAND registers */
3016 	ctrl->clk = devm_clk_get(dev, "nand");
3017 	if (!IS_ERR(ctrl->clk)) {
3018 		ret = clk_prepare_enable(ctrl->clk);
3019 		if (ret)
3020 			return ret;
3021 	} else {
3022 		ret = PTR_ERR(ctrl->clk);
3023 		if (ret == -EPROBE_DEFER)
3024 			return ret;
3025 
3026 		ctrl->clk = NULL;
3027 	}
3028 
3029 	/* Initialize NAND revision */
3030 	ret = brcmnand_revision_init(ctrl);
3031 	if (ret)
3032 		goto err;
3033 
3034 	/*
3035 	 * Most chips have this cache at a fixed offset within 'nand' block.
3036 	 * Some must specify this region separately.
3037 	 */
3038 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "nand-cache");
3039 	if (res) {
3040 		ctrl->nand_fc = devm_ioremap_resource(dev, res);
3041 		if (IS_ERR(ctrl->nand_fc)) {
3042 			ret = PTR_ERR(ctrl->nand_fc);
3043 			goto err;
3044 		}
3045 	} else {
3046 		ctrl->nand_fc = ctrl->nand_base +
3047 				ctrl->reg_offsets[BRCMNAND_FC_BASE];
3048 	}
3049 
3050 	/* FLASH_DMA */
3051 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "flash-dma");
3052 	if (res) {
3053 		ctrl->flash_dma_base = devm_ioremap_resource(dev, res);
3054 		if (IS_ERR(ctrl->flash_dma_base)) {
3055 			ret = PTR_ERR(ctrl->flash_dma_base);
3056 			goto err;
3057 		}
3058 
3059 		/* initialize the dma version */
3060 		brcmnand_flash_dma_revision_init(ctrl);
3061 
3062 		ret = -EIO;
3063 		if (ctrl->nand_version >= 0x0700)
3064 			ret = dma_set_mask_and_coherent(&pdev->dev,
3065 							DMA_BIT_MASK(40));
3066 		if (ret)
3067 			ret = dma_set_mask_and_coherent(&pdev->dev,
3068 							DMA_BIT_MASK(32));
3069 		if (ret)
3070 			goto err;
3071 
3072 		/* linked-list and stop on error */
3073 		flash_dma_writel(ctrl, FLASH_DMA_MODE, FLASH_DMA_MODE_MASK);
3074 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
3075 
3076 		/* Allocate descriptor(s) */
3077 		ctrl->dma_desc = dmam_alloc_coherent(dev,
3078 						     sizeof(*ctrl->dma_desc),
3079 						     &ctrl->dma_pa, GFP_KERNEL);
3080 		if (!ctrl->dma_desc) {
3081 			ret = -ENOMEM;
3082 			goto err;
3083 		}
3084 
3085 		ctrl->dma_irq = platform_get_irq(pdev, 1);
3086 		if ((int)ctrl->dma_irq < 0) {
3087 			dev_err(dev, "missing FLASH_DMA IRQ\n");
3088 			ret = -ENODEV;
3089 			goto err;
3090 		}
3091 
3092 		ret = devm_request_irq(dev, ctrl->dma_irq,
3093 				brcmnand_dma_irq, 0, DRV_NAME,
3094 				ctrl);
3095 		if (ret < 0) {
3096 			dev_err(dev, "can't allocate IRQ %d: error %d\n",
3097 					ctrl->dma_irq, ret);
3098 			goto err;
3099 		}
3100 
3101 		dev_info(dev, "enabling FLASH_DMA\n");
3102 		/* set flash dma transfer function to call */
3103 		ctrl->dma_trans = brcmnand_dma_trans;
3104 	} else	{
3105 		ret = brcmnand_edu_setup(pdev);
3106 		if (ret < 0)
3107 			goto err;
3108 
3109 		if (has_edu(ctrl))
3110 			/* set edu transfer function to call */
3111 			ctrl->dma_trans = brcmnand_edu_trans;
3112 	}
3113 
3114 	/* Disable automatic device ID config, direct addressing */
3115 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT,
3116 			 CS_SELECT_AUTO_DEVICE_ID_CFG | 0xff, 0, 0);
3117 	/* Disable XOR addressing */
3118 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_XOR, 0xff, 0, 0);
3119 
3120 	if (ctrl->features & BRCMNAND_HAS_WP) {
3121 		/* Permanently disable write protection */
3122 		if (wp_on == 2)
3123 			brcmnand_set_wp(ctrl, false);
3124 	} else {
3125 		wp_on = 0;
3126 	}
3127 
3128 	/* IRQ */
3129 	ctrl->irq = platform_get_irq(pdev, 0);
3130 	if ((int)ctrl->irq < 0) {
3131 		dev_err(dev, "no IRQ defined\n");
3132 		ret = -ENODEV;
3133 		goto err;
3134 	}
3135 
3136 	/*
3137 	 * Some SoCs integrate this controller (e.g., its interrupt bits) in
3138 	 * interesting ways
3139 	 */
3140 	if (soc) {
3141 		ctrl->soc = soc;
3142 
3143 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
3144 				       DRV_NAME, ctrl);
3145 
3146 		/* Enable interrupt */
3147 		ctrl->soc->ctlrdy_ack(ctrl->soc);
3148 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
3149 	} else {
3150 		/* Use standard interrupt infrastructure */
3151 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_ctlrdy_irq, 0,
3152 				       DRV_NAME, ctrl);
3153 	}
3154 	if (ret < 0) {
3155 		dev_err(dev, "can't allocate IRQ %d: error %d\n",
3156 			ctrl->irq, ret);
3157 		goto err;
3158 	}
3159 
3160 	for_each_available_child_of_node(dn, child) {
3161 		if (of_device_is_compatible(child, "brcm,nandcs")) {
3162 			struct brcmnand_host *host;
3163 
3164 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
3165 			if (!host) {
3166 				of_node_put(child);
3167 				ret = -ENOMEM;
3168 				goto err;
3169 			}
3170 			host->pdev = pdev;
3171 			host->ctrl = ctrl;
3172 
3173 			ret = brcmnand_init_cs(host, child);
3174 			if (ret) {
3175 				devm_kfree(dev, host);
3176 				continue; /* Try all chip-selects */
3177 			}
3178 
3179 			list_add_tail(&host->node, &ctrl->host_list);
3180 		}
3181 	}
3182 
3183 	/* No chip-selects could initialize properly */
3184 	if (list_empty(&ctrl->host_list)) {
3185 		ret = -ENODEV;
3186 		goto err;
3187 	}
3188 
3189 	return 0;
3190 
3191 err:
3192 	clk_disable_unprepare(ctrl->clk);
3193 	return ret;
3194 
3195 }
3196 EXPORT_SYMBOL_GPL(brcmnand_probe);
3197 
3198 int brcmnand_remove(struct platform_device *pdev)
3199 {
3200 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
3201 	struct brcmnand_host *host;
3202 	struct nand_chip *chip;
3203 	int ret;
3204 
3205 	list_for_each_entry(host, &ctrl->host_list, node) {
3206 		chip = &host->chip;
3207 		ret = mtd_device_unregister(nand_to_mtd(chip));
3208 		WARN_ON(ret);
3209 		nand_cleanup(chip);
3210 	}
3211 
3212 	clk_disable_unprepare(ctrl->clk);
3213 
3214 	dev_set_drvdata(&pdev->dev, NULL);
3215 
3216 	return 0;
3217 }
3218 EXPORT_SYMBOL_GPL(brcmnand_remove);
3219 
3220 MODULE_LICENSE("GPL v2");
3221 MODULE_AUTHOR("Kevin Cernekee");
3222 MODULE_AUTHOR("Brian Norris");
3223 MODULE_DESCRIPTION("NAND driver for Broadcom chips");
3224 MODULE_ALIAS("platform:brcmnand");
3225