xref: /openbmc/linux/drivers/spi/spi-bcm2835.c (revision 6fa24b41)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Driver for Broadcom BCM2835 SPI Controllers
4  *
5  * Copyright (C) 2012 Chris Boot
6  * Copyright (C) 2013 Stephen Warren
7  * Copyright (C) 2015 Martin Sperl
8  *
9  * This driver is inspired by:
10  * spi-ath79.c, Copyright (C) 2009-2011 Gabor Juhos <juhosg@openwrt.org>
11  * spi-atmel.c, Copyright (C) 2006 Atmel Corporation
12  */
13 
14 #include <linux/clk.h>
15 #include <linux/completion.h>
16 #include <linux/debugfs.h>
17 #include <linux/delay.h>
18 #include <linux/dma-mapping.h>
19 #include <linux/dmaengine.h>
20 #include <linux/err.h>
21 #include <linux/interrupt.h>
22 #include <linux/io.h>
23 #include <linux/kernel.h>
24 #include <linux/module.h>
25 #include <linux/of.h>
26 #include <linux/of_address.h>
27 #include <linux/platform_device.h>
28 #include <linux/gpio/consumer.h>
29 #include <linux/gpio/machine.h> /* FIXME: using chip internals */
30 #include <linux/gpio/driver.h> /* FIXME: using chip internals */
31 #include <linux/of_irq.h>
32 #include <linux/spi/spi.h>
33 
34 /* SPI register offsets */
35 #define BCM2835_SPI_CS			0x00
36 #define BCM2835_SPI_FIFO		0x04
37 #define BCM2835_SPI_CLK			0x08
38 #define BCM2835_SPI_DLEN		0x0c
39 #define BCM2835_SPI_LTOH		0x10
40 #define BCM2835_SPI_DC			0x14
41 
42 /* Bitfields in CS */
43 #define BCM2835_SPI_CS_LEN_LONG		0x02000000
44 #define BCM2835_SPI_CS_DMA_LEN		0x01000000
45 #define BCM2835_SPI_CS_CSPOL2		0x00800000
46 #define BCM2835_SPI_CS_CSPOL1		0x00400000
47 #define BCM2835_SPI_CS_CSPOL0		0x00200000
48 #define BCM2835_SPI_CS_RXF		0x00100000
49 #define BCM2835_SPI_CS_RXR		0x00080000
50 #define BCM2835_SPI_CS_TXD		0x00040000
51 #define BCM2835_SPI_CS_RXD		0x00020000
52 #define BCM2835_SPI_CS_DONE		0x00010000
53 #define BCM2835_SPI_CS_LEN		0x00002000
54 #define BCM2835_SPI_CS_REN		0x00001000
55 #define BCM2835_SPI_CS_ADCS		0x00000800
56 #define BCM2835_SPI_CS_INTR		0x00000400
57 #define BCM2835_SPI_CS_INTD		0x00000200
58 #define BCM2835_SPI_CS_DMAEN		0x00000100
59 #define BCM2835_SPI_CS_TA		0x00000080
60 #define BCM2835_SPI_CS_CSPOL		0x00000040
61 #define BCM2835_SPI_CS_CLEAR_RX		0x00000020
62 #define BCM2835_SPI_CS_CLEAR_TX		0x00000010
63 #define BCM2835_SPI_CS_CPOL		0x00000008
64 #define BCM2835_SPI_CS_CPHA		0x00000004
65 #define BCM2835_SPI_CS_CS_10		0x00000002
66 #define BCM2835_SPI_CS_CS_01		0x00000001
67 
68 #define BCM2835_SPI_FIFO_SIZE		64
69 #define BCM2835_SPI_FIFO_SIZE_3_4	48
70 #define BCM2835_SPI_DMA_MIN_LENGTH	96
71 #define BCM2835_SPI_MODE_BITS	(SPI_CPOL | SPI_CPHA | SPI_CS_HIGH \
72 				| SPI_NO_CS | SPI_3WIRE)
73 
74 #define DRV_NAME	"spi-bcm2835"
75 
76 /* define polling limits */
77 static unsigned int polling_limit_us = 30;
78 module_param(polling_limit_us, uint, 0664);
79 MODULE_PARM_DESC(polling_limit_us,
80 		 "time in us to run a transfer in polling mode\n");
81 
82 /**
83  * struct bcm2835_spi - BCM2835 SPI controller
84  * @regs: base address of register map
85  * @clk: core clock, divided to calculate serial clock
86  * @clk_hz: core clock cached speed
87  * @irq: interrupt, signals TX FIFO empty or RX FIFO ¾ full
88  * @tfr: SPI transfer currently processed
89  * @ctlr: SPI controller reverse lookup
90  * @tx_buf: pointer whence next transmitted byte is read
91  * @rx_buf: pointer where next received byte is written
92  * @tx_len: remaining bytes to transmit
93  * @rx_len: remaining bytes to receive
94  * @tx_prologue: bytes transmitted without DMA if first TX sglist entry's
95  *	length is not a multiple of 4 (to overcome hardware limitation)
96  * @rx_prologue: bytes received without DMA if first RX sglist entry's
97  *	length is not a multiple of 4 (to overcome hardware limitation)
98  * @tx_spillover: whether @tx_prologue spills over to second TX sglist entry
99  * @debugfs_dir: the debugfs directory - neede to remove debugfs when
100  *      unloading the module
101  * @count_transfer_polling: count of how often polling mode is used
102  * @count_transfer_irq: count of how often interrupt mode is used
103  * @count_transfer_irq_after_polling: count of how often we fall back to
104  *      interrupt mode after starting in polling mode.
105  *      These are counted as well in @count_transfer_polling and
106  *      @count_transfer_irq
107  * @count_transfer_dma: count how often dma mode is used
108  * @target: SPI target currently selected
109  *	(used by bcm2835_spi_dma_tx_done() to write @clear_rx_cs)
110  * @tx_dma_active: whether a TX DMA descriptor is in progress
111  * @rx_dma_active: whether a RX DMA descriptor is in progress
112  *	(used by bcm2835_spi_dma_tx_done() to handle a race)
113  * @fill_tx_desc: preallocated TX DMA descriptor used for RX-only transfers
114  *	(cyclically copies from zero page to TX FIFO)
115  * @fill_tx_addr: bus address of zero page
116  */
117 struct bcm2835_spi {
118 	void __iomem *regs;
119 	struct clk *clk;
120 	unsigned long clk_hz;
121 	int irq;
122 	struct spi_transfer *tfr;
123 	struct spi_controller *ctlr;
124 	const u8 *tx_buf;
125 	u8 *rx_buf;
126 	int tx_len;
127 	int rx_len;
128 	int tx_prologue;
129 	int rx_prologue;
130 	unsigned int tx_spillover;
131 
132 	struct dentry *debugfs_dir;
133 	u64 count_transfer_polling;
134 	u64 count_transfer_irq;
135 	u64 count_transfer_irq_after_polling;
136 	u64 count_transfer_dma;
137 
138 	struct bcm2835_spidev *target;
139 	unsigned int tx_dma_active;
140 	unsigned int rx_dma_active;
141 	struct dma_async_tx_descriptor *fill_tx_desc;
142 	dma_addr_t fill_tx_addr;
143 };
144 
145 /**
146  * struct bcm2835_spidev - BCM2835 SPI target
147  * @prepare_cs: precalculated CS register value for ->prepare_message()
148  *	(uses target-specific clock polarity and phase settings)
149  * @clear_rx_desc: preallocated RX DMA descriptor used for TX-only transfers
150  *	(cyclically clears RX FIFO by writing @clear_rx_cs to CS register)
151  * @clear_rx_addr: bus address of @clear_rx_cs
152  * @clear_rx_cs: precalculated CS register value to clear RX FIFO
153  *	(uses target-specific clock polarity and phase settings)
154  */
155 struct bcm2835_spidev {
156 	u32 prepare_cs;
157 	struct dma_async_tx_descriptor *clear_rx_desc;
158 	dma_addr_t clear_rx_addr;
159 	u32 clear_rx_cs ____cacheline_aligned;
160 };
161 
162 #if defined(CONFIG_DEBUG_FS)
163 static void bcm2835_debugfs_create(struct bcm2835_spi *bs,
164 				   const char *dname)
165 {
166 	char name[64];
167 	struct dentry *dir;
168 
169 	/* get full name */
170 	snprintf(name, sizeof(name), "spi-bcm2835-%s", dname);
171 
172 	/* the base directory */
173 	dir = debugfs_create_dir(name, NULL);
174 	bs->debugfs_dir = dir;
175 
176 	/* the counters */
177 	debugfs_create_u64("count_transfer_polling", 0444, dir,
178 			   &bs->count_transfer_polling);
179 	debugfs_create_u64("count_transfer_irq", 0444, dir,
180 			   &bs->count_transfer_irq);
181 	debugfs_create_u64("count_transfer_irq_after_polling", 0444, dir,
182 			   &bs->count_transfer_irq_after_polling);
183 	debugfs_create_u64("count_transfer_dma", 0444, dir,
184 			   &bs->count_transfer_dma);
185 }
186 
187 static void bcm2835_debugfs_remove(struct bcm2835_spi *bs)
188 {
189 	debugfs_remove_recursive(bs->debugfs_dir);
190 	bs->debugfs_dir = NULL;
191 }
192 #else
193 static void bcm2835_debugfs_create(struct bcm2835_spi *bs,
194 				   const char *dname)
195 {
196 }
197 
198 static void bcm2835_debugfs_remove(struct bcm2835_spi *bs)
199 {
200 }
201 #endif /* CONFIG_DEBUG_FS */
202 
203 static inline u32 bcm2835_rd(struct bcm2835_spi *bs, unsigned int reg)
204 {
205 	return readl(bs->regs + reg);
206 }
207 
208 static inline void bcm2835_wr(struct bcm2835_spi *bs, unsigned int reg, u32 val)
209 {
210 	writel(val, bs->regs + reg);
211 }
212 
213 static inline void bcm2835_rd_fifo(struct bcm2835_spi *bs)
214 {
215 	u8 byte;
216 
217 	while ((bs->rx_len) &&
218 	       (bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_RXD)) {
219 		byte = bcm2835_rd(bs, BCM2835_SPI_FIFO);
220 		if (bs->rx_buf)
221 			*bs->rx_buf++ = byte;
222 		bs->rx_len--;
223 	}
224 }
225 
226 static inline void bcm2835_wr_fifo(struct bcm2835_spi *bs)
227 {
228 	u8 byte;
229 
230 	while ((bs->tx_len) &&
231 	       (bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_TXD)) {
232 		byte = bs->tx_buf ? *bs->tx_buf++ : 0;
233 		bcm2835_wr(bs, BCM2835_SPI_FIFO, byte);
234 		bs->tx_len--;
235 	}
236 }
237 
238 /**
239  * bcm2835_rd_fifo_count() - blindly read exactly @count bytes from RX FIFO
240  * @bs: BCM2835 SPI controller
241  * @count: bytes to read from RX FIFO
242  *
243  * The caller must ensure that @bs->rx_len is greater than or equal to @count,
244  * that the RX FIFO contains at least @count bytes and that the DMA Enable flag
245  * in the CS register is set (such that a read from the FIFO register receives
246  * 32-bit instead of just 8-bit).  Moreover @bs->rx_buf must not be %NULL.
247  */
248 static inline void bcm2835_rd_fifo_count(struct bcm2835_spi *bs, int count)
249 {
250 	u32 val;
251 	int len;
252 
253 	bs->rx_len -= count;
254 
255 	do {
256 		val = bcm2835_rd(bs, BCM2835_SPI_FIFO);
257 		len = min(count, 4);
258 		memcpy(bs->rx_buf, &val, len);
259 		bs->rx_buf += len;
260 		count -= 4;
261 	} while (count > 0);
262 }
263 
264 /**
265  * bcm2835_wr_fifo_count() - blindly write exactly @count bytes to TX FIFO
266  * @bs: BCM2835 SPI controller
267  * @count: bytes to write to TX FIFO
268  *
269  * The caller must ensure that @bs->tx_len is greater than or equal to @count,
270  * that the TX FIFO can accommodate @count bytes and that the DMA Enable flag
271  * in the CS register is set (such that a write to the FIFO register transmits
272  * 32-bit instead of just 8-bit).
273  */
274 static inline void bcm2835_wr_fifo_count(struct bcm2835_spi *bs, int count)
275 {
276 	u32 val;
277 	int len;
278 
279 	bs->tx_len -= count;
280 
281 	do {
282 		if (bs->tx_buf) {
283 			len = min(count, 4);
284 			memcpy(&val, bs->tx_buf, len);
285 			bs->tx_buf += len;
286 		} else {
287 			val = 0;
288 		}
289 		bcm2835_wr(bs, BCM2835_SPI_FIFO, val);
290 		count -= 4;
291 	} while (count > 0);
292 }
293 
294 /**
295  * bcm2835_wait_tx_fifo_empty() - busy-wait for TX FIFO to empty
296  * @bs: BCM2835 SPI controller
297  *
298  * The caller must ensure that the RX FIFO can accommodate as many bytes
299  * as have been written to the TX FIFO:  Transmission is halted once the
300  * RX FIFO is full, causing this function to spin forever.
301  */
302 static inline void bcm2835_wait_tx_fifo_empty(struct bcm2835_spi *bs)
303 {
304 	while (!(bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_DONE))
305 		cpu_relax();
306 }
307 
308 /**
309  * bcm2835_rd_fifo_blind() - blindly read up to @count bytes from RX FIFO
310  * @bs: BCM2835 SPI controller
311  * @count: bytes available for reading in RX FIFO
312  */
313 static inline void bcm2835_rd_fifo_blind(struct bcm2835_spi *bs, int count)
314 {
315 	u8 val;
316 
317 	count = min(count, bs->rx_len);
318 	bs->rx_len -= count;
319 
320 	do {
321 		val = bcm2835_rd(bs, BCM2835_SPI_FIFO);
322 		if (bs->rx_buf)
323 			*bs->rx_buf++ = val;
324 	} while (--count);
325 }
326 
327 /**
328  * bcm2835_wr_fifo_blind() - blindly write up to @count bytes to TX FIFO
329  * @bs: BCM2835 SPI controller
330  * @count: bytes available for writing in TX FIFO
331  */
332 static inline void bcm2835_wr_fifo_blind(struct bcm2835_spi *bs, int count)
333 {
334 	u8 val;
335 
336 	count = min(count, bs->tx_len);
337 	bs->tx_len -= count;
338 
339 	do {
340 		val = bs->tx_buf ? *bs->tx_buf++ : 0;
341 		bcm2835_wr(bs, BCM2835_SPI_FIFO, val);
342 	} while (--count);
343 }
344 
345 static void bcm2835_spi_reset_hw(struct bcm2835_spi *bs)
346 {
347 	u32 cs = bcm2835_rd(bs, BCM2835_SPI_CS);
348 
349 	/* Disable SPI interrupts and transfer */
350 	cs &= ~(BCM2835_SPI_CS_INTR |
351 		BCM2835_SPI_CS_INTD |
352 		BCM2835_SPI_CS_DMAEN |
353 		BCM2835_SPI_CS_TA);
354 	/*
355 	 * Transmission sometimes breaks unless the DONE bit is written at the
356 	 * end of every transfer.  The spec says it's a RO bit.  Either the
357 	 * spec is wrong and the bit is actually of type RW1C, or it's a
358 	 * hardware erratum.
359 	 */
360 	cs |= BCM2835_SPI_CS_DONE;
361 	/* and reset RX/TX FIFOS */
362 	cs |= BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX;
363 
364 	/* and reset the SPI_HW */
365 	bcm2835_wr(bs, BCM2835_SPI_CS, cs);
366 	/* as well as DLEN */
367 	bcm2835_wr(bs, BCM2835_SPI_DLEN, 0);
368 }
369 
370 static irqreturn_t bcm2835_spi_interrupt(int irq, void *dev_id)
371 {
372 	struct bcm2835_spi *bs = dev_id;
373 	u32 cs = bcm2835_rd(bs, BCM2835_SPI_CS);
374 
375 	/* Bail out early if interrupts are not enabled */
376 	if (!(cs & BCM2835_SPI_CS_INTR))
377 		return IRQ_NONE;
378 
379 	/*
380 	 * An interrupt is signaled either if DONE is set (TX FIFO empty)
381 	 * or if RXR is set (RX FIFO >= ¾ full).
382 	 */
383 	if (cs & BCM2835_SPI_CS_RXF)
384 		bcm2835_rd_fifo_blind(bs, BCM2835_SPI_FIFO_SIZE);
385 	else if (cs & BCM2835_SPI_CS_RXR)
386 		bcm2835_rd_fifo_blind(bs, BCM2835_SPI_FIFO_SIZE_3_4);
387 
388 	if (bs->tx_len && cs & BCM2835_SPI_CS_DONE)
389 		bcm2835_wr_fifo_blind(bs, BCM2835_SPI_FIFO_SIZE);
390 
391 	/* Read as many bytes as possible from FIFO */
392 	bcm2835_rd_fifo(bs);
393 	/* Write as many bytes as possible to FIFO */
394 	bcm2835_wr_fifo(bs);
395 
396 	if (!bs->rx_len) {
397 		/* Transfer complete - reset SPI HW */
398 		bcm2835_spi_reset_hw(bs);
399 		/* wake up the framework */
400 		spi_finalize_current_transfer(bs->ctlr);
401 	}
402 
403 	return IRQ_HANDLED;
404 }
405 
406 static int bcm2835_spi_transfer_one_irq(struct spi_controller *ctlr,
407 					struct spi_device *spi,
408 					struct spi_transfer *tfr,
409 					u32 cs, bool fifo_empty)
410 {
411 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
412 
413 	/* update usage statistics */
414 	bs->count_transfer_irq++;
415 
416 	/*
417 	 * Enable HW block, but with interrupts still disabled.
418 	 * Otherwise the empty TX FIFO would immediately trigger an interrupt.
419 	 */
420 	bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_TA);
421 
422 	/* fill TX FIFO as much as possible */
423 	if (fifo_empty)
424 		bcm2835_wr_fifo_blind(bs, BCM2835_SPI_FIFO_SIZE);
425 	bcm2835_wr_fifo(bs);
426 
427 	/* enable interrupts */
428 	cs |= BCM2835_SPI_CS_INTR | BCM2835_SPI_CS_INTD | BCM2835_SPI_CS_TA;
429 	bcm2835_wr(bs, BCM2835_SPI_CS, cs);
430 
431 	/* signal that we need to wait for completion */
432 	return 1;
433 }
434 
435 /**
436  * bcm2835_spi_transfer_prologue() - transfer first few bytes without DMA
437  * @ctlr: SPI host controller
438  * @tfr: SPI transfer
439  * @bs: BCM2835 SPI controller
440  * @cs: CS register
441  *
442  * A limitation in DMA mode is that the FIFO must be accessed in 4 byte chunks.
443  * Only the final write access is permitted to transmit less than 4 bytes, the
444  * SPI controller deduces its intended size from the DLEN register.
445  *
446  * If a TX or RX sglist contains multiple entries, one per page, and the first
447  * entry starts in the middle of a page, that first entry's length may not be
448  * a multiple of 4.  Subsequent entries are fine because they span an entire
449  * page, hence do have a length that's a multiple of 4.
450  *
451  * This cannot happen with kmalloc'ed buffers (which is what most clients use)
452  * because they are contiguous in physical memory and therefore not split on
453  * page boundaries by spi_map_buf().  But it *can* happen with vmalloc'ed
454  * buffers.
455  *
456  * The DMA engine is incapable of combining sglist entries into a continuous
457  * stream of 4 byte chunks, it treats every entry separately:  A TX entry is
458  * rounded up a to a multiple of 4 bytes by transmitting surplus bytes, an RX
459  * entry is rounded up by throwing away received bytes.
460  *
461  * Overcome this limitation by transferring the first few bytes without DMA:
462  * E.g. if the first TX sglist entry's length is 23 and the first RX's is 42,
463  * write 3 bytes to the TX FIFO but read only 2 bytes from the RX FIFO.
464  * The residue of 1 byte in the RX FIFO is picked up by DMA.  Together with
465  * the rest of the first RX sglist entry it makes up a multiple of 4 bytes.
466  *
467  * Should the RX prologue be larger, say, 3 vis-à-vis a TX prologue of 1,
468  * write 1 + 4 = 5 bytes to the TX FIFO and read 3 bytes from the RX FIFO.
469  * Caution, the additional 4 bytes spill over to the second TX sglist entry
470  * if the length of the first is *exactly* 1.
471  *
472  * At most 6 bytes are written and at most 3 bytes read.  Do we know the
473  * transfer has this many bytes?  Yes, see BCM2835_SPI_DMA_MIN_LENGTH.
474  *
475  * The FIFO is normally accessed with 8-bit width by the CPU and 32-bit width
476  * by the DMA engine.  Toggling the DMA Enable flag in the CS register switches
477  * the width but also garbles the FIFO's contents.  The prologue must therefore
478  * be transmitted in 32-bit width to ensure that the following DMA transfer can
479  * pick up the residue in the RX FIFO in ungarbled form.
480  */
481 static void bcm2835_spi_transfer_prologue(struct spi_controller *ctlr,
482 					  struct spi_transfer *tfr,
483 					  struct bcm2835_spi *bs,
484 					  u32 cs)
485 {
486 	int tx_remaining;
487 
488 	bs->tfr		 = tfr;
489 	bs->tx_prologue  = 0;
490 	bs->rx_prologue  = 0;
491 	bs->tx_spillover = false;
492 
493 	if (bs->tx_buf && !sg_is_last(&tfr->tx_sg.sgl[0]))
494 		bs->tx_prologue = sg_dma_len(&tfr->tx_sg.sgl[0]) & 3;
495 
496 	if (bs->rx_buf && !sg_is_last(&tfr->rx_sg.sgl[0])) {
497 		bs->rx_prologue = sg_dma_len(&tfr->rx_sg.sgl[0]) & 3;
498 
499 		if (bs->rx_prologue > bs->tx_prologue) {
500 			if (!bs->tx_buf || sg_is_last(&tfr->tx_sg.sgl[0])) {
501 				bs->tx_prologue  = bs->rx_prologue;
502 			} else {
503 				bs->tx_prologue += 4;
504 				bs->tx_spillover =
505 					!(sg_dma_len(&tfr->tx_sg.sgl[0]) & ~3);
506 			}
507 		}
508 	}
509 
510 	/* rx_prologue > 0 implies tx_prologue > 0, so check only the latter */
511 	if (!bs->tx_prologue)
512 		return;
513 
514 	/* Write and read RX prologue.  Adjust first entry in RX sglist. */
515 	if (bs->rx_prologue) {
516 		bcm2835_wr(bs, BCM2835_SPI_DLEN, bs->rx_prologue);
517 		bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_TA
518 						  | BCM2835_SPI_CS_DMAEN);
519 		bcm2835_wr_fifo_count(bs, bs->rx_prologue);
520 		bcm2835_wait_tx_fifo_empty(bs);
521 		bcm2835_rd_fifo_count(bs, bs->rx_prologue);
522 		bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_CLEAR_RX
523 						  | BCM2835_SPI_CS_CLEAR_TX
524 						  | BCM2835_SPI_CS_DONE);
525 
526 		dma_sync_single_for_device(ctlr->dma_rx->device->dev,
527 					   sg_dma_address(&tfr->rx_sg.sgl[0]),
528 					   bs->rx_prologue, DMA_FROM_DEVICE);
529 
530 		sg_dma_address(&tfr->rx_sg.sgl[0]) += bs->rx_prologue;
531 		sg_dma_len(&tfr->rx_sg.sgl[0])     -= bs->rx_prologue;
532 	}
533 
534 	if (!bs->tx_buf)
535 		return;
536 
537 	/*
538 	 * Write remaining TX prologue.  Adjust first entry in TX sglist.
539 	 * Also adjust second entry if prologue spills over to it.
540 	 */
541 	tx_remaining = bs->tx_prologue - bs->rx_prologue;
542 	if (tx_remaining) {
543 		bcm2835_wr(bs, BCM2835_SPI_DLEN, tx_remaining);
544 		bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_TA
545 						  | BCM2835_SPI_CS_DMAEN);
546 		bcm2835_wr_fifo_count(bs, tx_remaining);
547 		bcm2835_wait_tx_fifo_empty(bs);
548 		bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_CLEAR_TX
549 						  | BCM2835_SPI_CS_DONE);
550 	}
551 
552 	if (likely(!bs->tx_spillover)) {
553 		sg_dma_address(&tfr->tx_sg.sgl[0]) += bs->tx_prologue;
554 		sg_dma_len(&tfr->tx_sg.sgl[0])     -= bs->tx_prologue;
555 	} else {
556 		sg_dma_len(&tfr->tx_sg.sgl[0])      = 0;
557 		sg_dma_address(&tfr->tx_sg.sgl[1]) += 4;
558 		sg_dma_len(&tfr->tx_sg.sgl[1])     -= 4;
559 	}
560 }
561 
562 /**
563  * bcm2835_spi_undo_prologue() - reconstruct original sglist state
564  * @bs: BCM2835 SPI controller
565  *
566  * Undo changes which were made to an SPI transfer's sglist when transmitting
567  * the prologue.  This is necessary to ensure the same memory ranges are
568  * unmapped that were originally mapped.
569  */
570 static void bcm2835_spi_undo_prologue(struct bcm2835_spi *bs)
571 {
572 	struct spi_transfer *tfr = bs->tfr;
573 
574 	if (!bs->tx_prologue)
575 		return;
576 
577 	if (bs->rx_prologue) {
578 		sg_dma_address(&tfr->rx_sg.sgl[0]) -= bs->rx_prologue;
579 		sg_dma_len(&tfr->rx_sg.sgl[0])     += bs->rx_prologue;
580 	}
581 
582 	if (!bs->tx_buf)
583 		goto out;
584 
585 	if (likely(!bs->tx_spillover)) {
586 		sg_dma_address(&tfr->tx_sg.sgl[0]) -= bs->tx_prologue;
587 		sg_dma_len(&tfr->tx_sg.sgl[0])     += bs->tx_prologue;
588 	} else {
589 		sg_dma_len(&tfr->tx_sg.sgl[0])      = bs->tx_prologue - 4;
590 		sg_dma_address(&tfr->tx_sg.sgl[1]) -= 4;
591 		sg_dma_len(&tfr->tx_sg.sgl[1])     += 4;
592 	}
593 out:
594 	bs->tx_prologue = 0;
595 }
596 
597 /**
598  * bcm2835_spi_dma_rx_done() - callback for DMA RX channel
599  * @data: SPI host controller
600  *
601  * Used for bidirectional and RX-only transfers.
602  */
603 static void bcm2835_spi_dma_rx_done(void *data)
604 {
605 	struct spi_controller *ctlr = data;
606 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
607 
608 	/* terminate tx-dma as we do not have an irq for it
609 	 * because when the rx dma will terminate and this callback
610 	 * is called the tx-dma must have finished - can't get to this
611 	 * situation otherwise...
612 	 */
613 	dmaengine_terminate_async(ctlr->dma_tx);
614 	bs->tx_dma_active = false;
615 	bs->rx_dma_active = false;
616 	bcm2835_spi_undo_prologue(bs);
617 
618 	/* reset fifo and HW */
619 	bcm2835_spi_reset_hw(bs);
620 
621 	/* and mark as completed */;
622 	spi_finalize_current_transfer(ctlr);
623 }
624 
625 /**
626  * bcm2835_spi_dma_tx_done() - callback for DMA TX channel
627  * @data: SPI host controller
628  *
629  * Used for TX-only transfers.
630  */
631 static void bcm2835_spi_dma_tx_done(void *data)
632 {
633 	struct spi_controller *ctlr = data;
634 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
635 
636 	/* busy-wait for TX FIFO to empty */
637 	while (!(bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_DONE))
638 		bcm2835_wr(bs, BCM2835_SPI_CS, bs->target->clear_rx_cs);
639 
640 	bs->tx_dma_active = false;
641 	smp_wmb();
642 
643 	/*
644 	 * In case of a very short transfer, RX DMA may not have been
645 	 * issued yet.  The onus is then on bcm2835_spi_transfer_one_dma()
646 	 * to terminate it immediately after issuing.
647 	 */
648 	if (cmpxchg(&bs->rx_dma_active, true, false))
649 		dmaengine_terminate_async(ctlr->dma_rx);
650 
651 	bcm2835_spi_undo_prologue(bs);
652 	bcm2835_spi_reset_hw(bs);
653 	spi_finalize_current_transfer(ctlr);
654 }
655 
656 /**
657  * bcm2835_spi_prepare_sg() - prepare and submit DMA descriptor for sglist
658  * @ctlr: SPI host controller
659  * @tfr: SPI transfer
660  * @bs: BCM2835 SPI controller
661  * @target: BCM2835 SPI target
662  * @is_tx: whether to submit DMA descriptor for TX or RX sglist
663  *
664  * Prepare and submit a DMA descriptor for the TX or RX sglist of @tfr.
665  * Return 0 on success or a negative error number.
666  */
667 static int bcm2835_spi_prepare_sg(struct spi_controller *ctlr,
668 				  struct spi_transfer *tfr,
669 				  struct bcm2835_spi *bs,
670 				  struct bcm2835_spidev *target,
671 				  bool is_tx)
672 {
673 	struct dma_chan *chan;
674 	struct scatterlist *sgl;
675 	unsigned int nents;
676 	enum dma_transfer_direction dir;
677 	unsigned long flags;
678 
679 	struct dma_async_tx_descriptor *desc;
680 	dma_cookie_t cookie;
681 
682 	if (is_tx) {
683 		dir   = DMA_MEM_TO_DEV;
684 		chan  = ctlr->dma_tx;
685 		nents = tfr->tx_sg.nents;
686 		sgl   = tfr->tx_sg.sgl;
687 		flags = tfr->rx_buf ? 0 : DMA_PREP_INTERRUPT;
688 	} else {
689 		dir   = DMA_DEV_TO_MEM;
690 		chan  = ctlr->dma_rx;
691 		nents = tfr->rx_sg.nents;
692 		sgl   = tfr->rx_sg.sgl;
693 		flags = DMA_PREP_INTERRUPT;
694 	}
695 	/* prepare the channel */
696 	desc = dmaengine_prep_slave_sg(chan, sgl, nents, dir, flags);
697 	if (!desc)
698 		return -EINVAL;
699 
700 	/*
701 	 * Completion is signaled by the RX channel for bidirectional and
702 	 * RX-only transfers; else by the TX channel for TX-only transfers.
703 	 */
704 	if (!is_tx) {
705 		desc->callback = bcm2835_spi_dma_rx_done;
706 		desc->callback_param = ctlr;
707 	} else if (!tfr->rx_buf) {
708 		desc->callback = bcm2835_spi_dma_tx_done;
709 		desc->callback_param = ctlr;
710 		bs->target = target;
711 	}
712 
713 	/* submit it to DMA-engine */
714 	cookie = dmaengine_submit(desc);
715 
716 	return dma_submit_error(cookie);
717 }
718 
719 /**
720  * bcm2835_spi_transfer_one_dma() - perform SPI transfer using DMA engine
721  * @ctlr: SPI host controller
722  * @tfr: SPI transfer
723  * @target: BCM2835 SPI target
724  * @cs: CS register
725  *
726  * For *bidirectional* transfers (both tx_buf and rx_buf are non-%NULL), set up
727  * the TX and RX DMA channel to copy between memory and FIFO register.
728  *
729  * For *TX-only* transfers (rx_buf is %NULL), copying the RX FIFO's contents to
730  * memory is pointless.  However not reading the RX FIFO isn't an option either
731  * because transmission is halted once it's full.  As a workaround, cyclically
732  * clear the RX FIFO by setting the CLEAR_RX bit in the CS register.
733  *
734  * The CS register value is precalculated in bcm2835_spi_setup().  Normally
735  * this is called only once, on target registration.  A DMA descriptor to write
736  * this value is preallocated in bcm2835_dma_init().  All that's left to do
737  * when performing a TX-only transfer is to submit this descriptor to the RX
738  * DMA channel.  Latency is thereby minimized.  The descriptor does not
739  * generate any interrupts while running.  It must be terminated once the
740  * TX DMA channel is done.
741  *
742  * Clearing the RX FIFO is paced by the DREQ signal.  The signal is asserted
743  * when the RX FIFO becomes half full, i.e. 32 bytes.  (Tuneable with the DC
744  * register.)  Reading 32 bytes from the RX FIFO would normally require 8 bus
745  * accesses, whereas clearing it requires only 1 bus access.  So an 8-fold
746  * reduction in bus traffic and thus energy consumption is achieved.
747  *
748  * For *RX-only* transfers (tx_buf is %NULL), fill the TX FIFO by cyclically
749  * copying from the zero page.  The DMA descriptor to do this is preallocated
750  * in bcm2835_dma_init().  It must be terminated once the RX DMA channel is
751  * done and can then be reused.
752  *
753  * The BCM2835 DMA driver autodetects when a transaction copies from the zero
754  * page and utilizes the DMA controller's ability to synthesize zeroes instead
755  * of copying them from memory.  This reduces traffic on the memory bus.  The
756  * feature is not available on so-called "lite" channels, but normally TX DMA
757  * is backed by a full-featured channel.
758  *
759  * Zero-filling the TX FIFO is paced by the DREQ signal.  Unfortunately the
760  * BCM2835 SPI controller continues to assert DREQ even after the DLEN register
761  * has been counted down to zero (hardware erratum).  Thus, when the transfer
762  * has finished, the DMA engine zero-fills the TX FIFO until it is half full.
763  * (Tuneable with the DC register.)  So up to 9 gratuitous bus accesses are
764  * performed at the end of an RX-only transfer.
765  */
766 static int bcm2835_spi_transfer_one_dma(struct spi_controller *ctlr,
767 					struct spi_transfer *tfr,
768 					struct bcm2835_spidev *target,
769 					u32 cs)
770 {
771 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
772 	dma_cookie_t cookie;
773 	int ret;
774 
775 	/* update usage statistics */
776 	bs->count_transfer_dma++;
777 
778 	/*
779 	 * Transfer first few bytes without DMA if length of first TX or RX
780 	 * sglist entry is not a multiple of 4 bytes (hardware limitation).
781 	 */
782 	bcm2835_spi_transfer_prologue(ctlr, tfr, bs, cs);
783 
784 	/* setup tx-DMA */
785 	if (bs->tx_buf) {
786 		ret = bcm2835_spi_prepare_sg(ctlr, tfr, bs, target, true);
787 	} else {
788 		cookie = dmaengine_submit(bs->fill_tx_desc);
789 		ret = dma_submit_error(cookie);
790 	}
791 	if (ret)
792 		goto err_reset_hw;
793 
794 	/* set the DMA length */
795 	bcm2835_wr(bs, BCM2835_SPI_DLEN, bs->tx_len);
796 
797 	/* start the HW */
798 	bcm2835_wr(bs, BCM2835_SPI_CS,
799 		   cs | BCM2835_SPI_CS_TA | BCM2835_SPI_CS_DMAEN);
800 
801 	bs->tx_dma_active = true;
802 	smp_wmb();
803 
804 	/* start TX early */
805 	dma_async_issue_pending(ctlr->dma_tx);
806 
807 	/* setup rx-DMA late - to run transfers while
808 	 * mapping of the rx buffers still takes place
809 	 * this saves 10us or more.
810 	 */
811 	if (bs->rx_buf) {
812 		ret = bcm2835_spi_prepare_sg(ctlr, tfr, bs, target, false);
813 	} else {
814 		cookie = dmaengine_submit(target->clear_rx_desc);
815 		ret = dma_submit_error(cookie);
816 	}
817 	if (ret) {
818 		/* need to reset on errors */
819 		dmaengine_terminate_sync(ctlr->dma_tx);
820 		bs->tx_dma_active = false;
821 		goto err_reset_hw;
822 	}
823 
824 	/* start rx dma late */
825 	dma_async_issue_pending(ctlr->dma_rx);
826 	bs->rx_dma_active = true;
827 	smp_mb();
828 
829 	/*
830 	 * In case of a very short TX-only transfer, bcm2835_spi_dma_tx_done()
831 	 * may run before RX DMA is issued.  Terminate RX DMA if so.
832 	 */
833 	if (!bs->rx_buf && !bs->tx_dma_active &&
834 	    cmpxchg(&bs->rx_dma_active, true, false)) {
835 		dmaengine_terminate_async(ctlr->dma_rx);
836 		bcm2835_spi_reset_hw(bs);
837 	}
838 
839 	/* wait for wakeup in framework */
840 	return 1;
841 
842 err_reset_hw:
843 	bcm2835_spi_reset_hw(bs);
844 	bcm2835_spi_undo_prologue(bs);
845 	return ret;
846 }
847 
848 static bool bcm2835_spi_can_dma(struct spi_controller *ctlr,
849 				struct spi_device *spi,
850 				struct spi_transfer *tfr)
851 {
852 	/* we start DMA efforts only on bigger transfers */
853 	if (tfr->len < BCM2835_SPI_DMA_MIN_LENGTH)
854 		return false;
855 
856 	/* return OK */
857 	return true;
858 }
859 
860 static void bcm2835_dma_release(struct spi_controller *ctlr,
861 				struct bcm2835_spi *bs)
862 {
863 	if (ctlr->dma_tx) {
864 		dmaengine_terminate_sync(ctlr->dma_tx);
865 
866 		if (bs->fill_tx_desc)
867 			dmaengine_desc_free(bs->fill_tx_desc);
868 
869 		if (bs->fill_tx_addr)
870 			dma_unmap_page_attrs(ctlr->dma_tx->device->dev,
871 					     bs->fill_tx_addr, sizeof(u32),
872 					     DMA_TO_DEVICE,
873 					     DMA_ATTR_SKIP_CPU_SYNC);
874 
875 		dma_release_channel(ctlr->dma_tx);
876 		ctlr->dma_tx = NULL;
877 	}
878 
879 	if (ctlr->dma_rx) {
880 		dmaengine_terminate_sync(ctlr->dma_rx);
881 		dma_release_channel(ctlr->dma_rx);
882 		ctlr->dma_rx = NULL;
883 	}
884 }
885 
886 static int bcm2835_dma_init(struct spi_controller *ctlr, struct device *dev,
887 			    struct bcm2835_spi *bs)
888 {
889 	struct dma_slave_config slave_config;
890 	const __be32 *addr;
891 	dma_addr_t dma_reg_base;
892 	int ret;
893 
894 	/* base address in dma-space */
895 	addr = of_get_address(ctlr->dev.of_node, 0, NULL, NULL);
896 	if (!addr) {
897 		dev_err(dev, "could not get DMA-register address - not using dma mode\n");
898 		/* Fall back to interrupt mode */
899 		return 0;
900 	}
901 	dma_reg_base = be32_to_cpup(addr);
902 
903 	/* get tx/rx dma */
904 	ctlr->dma_tx = dma_request_chan(dev, "tx");
905 	if (IS_ERR(ctlr->dma_tx)) {
906 		ret = dev_err_probe(dev, PTR_ERR(ctlr->dma_tx),
907 			"no tx-dma configuration found - not using dma mode\n");
908 		ctlr->dma_tx = NULL;
909 		goto err;
910 	}
911 	ctlr->dma_rx = dma_request_chan(dev, "rx");
912 	if (IS_ERR(ctlr->dma_rx)) {
913 		ret = dev_err_probe(dev, PTR_ERR(ctlr->dma_rx),
914 			"no rx-dma configuration found - not using dma mode\n");
915 		ctlr->dma_rx = NULL;
916 		goto err_release;
917 	}
918 
919 	/*
920 	 * The TX DMA channel either copies a transfer's TX buffer to the FIFO
921 	 * or, in case of an RX-only transfer, cyclically copies from the zero
922 	 * page to the FIFO using a preallocated, reusable descriptor.
923 	 */
924 	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
925 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
926 
927 	ret = dmaengine_slave_config(ctlr->dma_tx, &slave_config);
928 	if (ret)
929 		goto err_config;
930 
931 	bs->fill_tx_addr = dma_map_page_attrs(ctlr->dma_tx->device->dev,
932 					      ZERO_PAGE(0), 0, sizeof(u32),
933 					      DMA_TO_DEVICE,
934 					      DMA_ATTR_SKIP_CPU_SYNC);
935 	if (dma_mapping_error(ctlr->dma_tx->device->dev, bs->fill_tx_addr)) {
936 		dev_err(dev, "cannot map zero page - not using DMA mode\n");
937 		bs->fill_tx_addr = 0;
938 		ret = -ENOMEM;
939 		goto err_release;
940 	}
941 
942 	bs->fill_tx_desc = dmaengine_prep_dma_cyclic(ctlr->dma_tx,
943 						     bs->fill_tx_addr,
944 						     sizeof(u32), 0,
945 						     DMA_MEM_TO_DEV, 0);
946 	if (!bs->fill_tx_desc) {
947 		dev_err(dev, "cannot prepare fill_tx_desc - not using DMA mode\n");
948 		ret = -ENOMEM;
949 		goto err_release;
950 	}
951 
952 	ret = dmaengine_desc_set_reuse(bs->fill_tx_desc);
953 	if (ret) {
954 		dev_err(dev, "cannot reuse fill_tx_desc - not using DMA mode\n");
955 		goto err_release;
956 	}
957 
958 	/*
959 	 * The RX DMA channel is used bidirectionally:  It either reads the
960 	 * RX FIFO or, in case of a TX-only transfer, cyclically writes a
961 	 * precalculated value to the CS register to clear the RX FIFO.
962 	 */
963 	slave_config.src_addr = (u32)(dma_reg_base + BCM2835_SPI_FIFO);
964 	slave_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
965 	slave_config.dst_addr = (u32)(dma_reg_base + BCM2835_SPI_CS);
966 	slave_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
967 
968 	ret = dmaengine_slave_config(ctlr->dma_rx, &slave_config);
969 	if (ret)
970 		goto err_config;
971 
972 	/* all went well, so set can_dma */
973 	ctlr->can_dma = bcm2835_spi_can_dma;
974 
975 	return 0;
976 
977 err_config:
978 	dev_err(dev, "issue configuring dma: %d - not using DMA mode\n",
979 		ret);
980 err_release:
981 	bcm2835_dma_release(ctlr, bs);
982 err:
983 	/*
984 	 * Only report error for deferred probing, otherwise fall back to
985 	 * interrupt mode
986 	 */
987 	if (ret != -EPROBE_DEFER)
988 		ret = 0;
989 
990 	return ret;
991 }
992 
993 static int bcm2835_spi_transfer_one_poll(struct spi_controller *ctlr,
994 					 struct spi_device *spi,
995 					 struct spi_transfer *tfr,
996 					 u32 cs)
997 {
998 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
999 	unsigned long timeout;
1000 
1001 	/* update usage statistics */
1002 	bs->count_transfer_polling++;
1003 
1004 	/* enable HW block without interrupts */
1005 	bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_TA);
1006 
1007 	/* fill in the fifo before timeout calculations
1008 	 * if we are interrupted here, then the data is
1009 	 * getting transferred by the HW while we are interrupted
1010 	 */
1011 	bcm2835_wr_fifo_blind(bs, BCM2835_SPI_FIFO_SIZE);
1012 
1013 	/* set the timeout to at least 2 jiffies */
1014 	timeout = jiffies + 2 + HZ * polling_limit_us / 1000000;
1015 
1016 	/* loop until finished the transfer */
1017 	while (bs->rx_len) {
1018 		/* fill in tx fifo with remaining data */
1019 		bcm2835_wr_fifo(bs);
1020 
1021 		/* read from fifo as much as possible */
1022 		bcm2835_rd_fifo(bs);
1023 
1024 		/* if there is still data pending to read
1025 		 * then check the timeout
1026 		 */
1027 		if (bs->rx_len && time_after(jiffies, timeout)) {
1028 			dev_dbg_ratelimited(&spi->dev,
1029 					    "timeout period reached: jiffies: %lu remaining tx/rx: %d/%d - falling back to interrupt mode\n",
1030 					    jiffies - timeout,
1031 					    bs->tx_len, bs->rx_len);
1032 			/* fall back to interrupt mode */
1033 
1034 			/* update usage statistics */
1035 			bs->count_transfer_irq_after_polling++;
1036 
1037 			return bcm2835_spi_transfer_one_irq(ctlr, spi,
1038 							    tfr, cs, false);
1039 		}
1040 	}
1041 
1042 	/* Transfer complete - reset SPI HW */
1043 	bcm2835_spi_reset_hw(bs);
1044 	/* and return without waiting for completion */
1045 	return 0;
1046 }
1047 
1048 static int bcm2835_spi_transfer_one(struct spi_controller *ctlr,
1049 				    struct spi_device *spi,
1050 				    struct spi_transfer *tfr)
1051 {
1052 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
1053 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
1054 	unsigned long spi_hz, cdiv;
1055 	unsigned long hz_per_byte, byte_limit;
1056 	u32 cs = target->prepare_cs;
1057 
1058 	/* set clock */
1059 	spi_hz = tfr->speed_hz;
1060 
1061 	if (spi_hz >= bs->clk_hz / 2) {
1062 		cdiv = 2; /* clk_hz/2 is the fastest we can go */
1063 	} else if (spi_hz) {
1064 		/* CDIV must be a multiple of two */
1065 		cdiv = DIV_ROUND_UP(bs->clk_hz, spi_hz);
1066 		cdiv += (cdiv % 2);
1067 
1068 		if (cdiv >= 65536)
1069 			cdiv = 0; /* 0 is the slowest we can go */
1070 	} else {
1071 		cdiv = 0; /* 0 is the slowest we can go */
1072 	}
1073 	tfr->effective_speed_hz = cdiv ? (bs->clk_hz / cdiv) : (bs->clk_hz / 65536);
1074 	bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv);
1075 
1076 	/* handle all the 3-wire mode */
1077 	if (spi->mode & SPI_3WIRE && tfr->rx_buf)
1078 		cs |= BCM2835_SPI_CS_REN;
1079 
1080 	/* set transmit buffers and length */
1081 	bs->tx_buf = tfr->tx_buf;
1082 	bs->rx_buf = tfr->rx_buf;
1083 	bs->tx_len = tfr->len;
1084 	bs->rx_len = tfr->len;
1085 
1086 	/* Calculate the estimated time in us the transfer runs.  Note that
1087 	 * there is 1 idle clocks cycles after each byte getting transferred
1088 	 * so we have 9 cycles/byte.  This is used to find the number of Hz
1089 	 * per byte per polling limit.  E.g., we can transfer 1 byte in 30 us
1090 	 * per 300,000 Hz of bus clock.
1091 	 */
1092 	hz_per_byte = polling_limit_us ? (9 * 1000000) / polling_limit_us : 0;
1093 	byte_limit = hz_per_byte ? tfr->effective_speed_hz / hz_per_byte : 1;
1094 
1095 	/* run in polling mode for short transfers */
1096 	if (tfr->len < byte_limit)
1097 		return bcm2835_spi_transfer_one_poll(ctlr, spi, tfr, cs);
1098 
1099 	/* run in dma mode if conditions are right
1100 	 * Note that unlike poll or interrupt mode DMA mode does not have
1101 	 * this 1 idle clock cycle pattern but runs the spi clock without gaps
1102 	 */
1103 	if (ctlr->can_dma && bcm2835_spi_can_dma(ctlr, spi, tfr))
1104 		return bcm2835_spi_transfer_one_dma(ctlr, tfr, target, cs);
1105 
1106 	/* run in interrupt-mode */
1107 	return bcm2835_spi_transfer_one_irq(ctlr, spi, tfr, cs, true);
1108 }
1109 
1110 static int bcm2835_spi_prepare_message(struct spi_controller *ctlr,
1111 				       struct spi_message *msg)
1112 {
1113 	struct spi_device *spi = msg->spi;
1114 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
1115 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
1116 	int ret;
1117 
1118 	if (ctlr->can_dma) {
1119 		/*
1120 		 * DMA transfers are limited to 16 bit (0 to 65535 bytes) by
1121 		 * the SPI HW due to DLEN. Split up transfers (32-bit FIFO
1122 		 * aligned) if the limit is exceeded.
1123 		 */
1124 		ret = spi_split_transfers_maxsize(ctlr, msg, 65532,
1125 						  GFP_KERNEL | GFP_DMA);
1126 		if (ret)
1127 			return ret;
1128 	}
1129 
1130 	/*
1131 	 * Set up clock polarity before spi_transfer_one_message() asserts
1132 	 * chip select to avoid a gratuitous clock signal edge.
1133 	 */
1134 	bcm2835_wr(bs, BCM2835_SPI_CS, target->prepare_cs);
1135 
1136 	return 0;
1137 }
1138 
1139 static void bcm2835_spi_handle_err(struct spi_controller *ctlr,
1140 				   struct spi_message *msg)
1141 {
1142 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
1143 
1144 	/* if an error occurred and we have an active dma, then terminate */
1145 	if (ctlr->dma_tx) {
1146 		dmaengine_terminate_sync(ctlr->dma_tx);
1147 		bs->tx_dma_active = false;
1148 	}
1149 	if (ctlr->dma_rx) {
1150 		dmaengine_terminate_sync(ctlr->dma_rx);
1151 		bs->rx_dma_active = false;
1152 	}
1153 	bcm2835_spi_undo_prologue(bs);
1154 
1155 	/* and reset */
1156 	bcm2835_spi_reset_hw(bs);
1157 }
1158 
1159 static int chip_match_name(struct gpio_chip *chip, void *data)
1160 {
1161 	return !strcmp(chip->label, data);
1162 }
1163 
1164 static void bcm2835_spi_cleanup(struct spi_device *spi)
1165 {
1166 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
1167 	struct spi_controller *ctlr = spi->controller;
1168 
1169 	if (target->clear_rx_desc)
1170 		dmaengine_desc_free(target->clear_rx_desc);
1171 
1172 	if (target->clear_rx_addr)
1173 		dma_unmap_single(ctlr->dma_rx->device->dev,
1174 				 target->clear_rx_addr,
1175 				 sizeof(u32),
1176 				 DMA_TO_DEVICE);
1177 
1178 	kfree(target);
1179 }
1180 
1181 static int bcm2835_spi_setup_dma(struct spi_controller *ctlr,
1182 				 struct spi_device *spi,
1183 				 struct bcm2835_spi *bs,
1184 				 struct bcm2835_spidev *target)
1185 {
1186 	int ret;
1187 
1188 	if (!ctlr->dma_rx)
1189 		return 0;
1190 
1191 	target->clear_rx_addr = dma_map_single(ctlr->dma_rx->device->dev,
1192 					       &target->clear_rx_cs,
1193 					       sizeof(u32),
1194 					       DMA_TO_DEVICE);
1195 	if (dma_mapping_error(ctlr->dma_rx->device->dev, target->clear_rx_addr)) {
1196 		dev_err(&spi->dev, "cannot map clear_rx_cs\n");
1197 		target->clear_rx_addr = 0;
1198 		return -ENOMEM;
1199 	}
1200 
1201 	target->clear_rx_desc = dmaengine_prep_dma_cyclic(ctlr->dma_rx,
1202 						          target->clear_rx_addr,
1203 						          sizeof(u32), 0,
1204 						          DMA_MEM_TO_DEV, 0);
1205 	if (!target->clear_rx_desc) {
1206 		dev_err(&spi->dev, "cannot prepare clear_rx_desc\n");
1207 		return -ENOMEM;
1208 	}
1209 
1210 	ret = dmaengine_desc_set_reuse(target->clear_rx_desc);
1211 	if (ret) {
1212 		dev_err(&spi->dev, "cannot reuse clear_rx_desc\n");
1213 		return ret;
1214 	}
1215 
1216 	return 0;
1217 }
1218 
1219 static int bcm2835_spi_setup(struct spi_device *spi)
1220 {
1221 	struct spi_controller *ctlr = spi->controller;
1222 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
1223 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
1224 	struct gpio_chip *chip;
1225 	int ret;
1226 	u32 cs;
1227 
1228 	if (!target) {
1229 		target = kzalloc(ALIGN(sizeof(*target), dma_get_cache_alignment()),
1230 			      GFP_KERNEL);
1231 		if (!target)
1232 			return -ENOMEM;
1233 
1234 		spi_set_ctldata(spi, target);
1235 
1236 		ret = bcm2835_spi_setup_dma(ctlr, spi, bs, target);
1237 		if (ret)
1238 			goto err_cleanup;
1239 	}
1240 
1241 	/*
1242 	 * Precalculate SPI target's CS register value for ->prepare_message():
1243 	 * The driver always uses software-controlled GPIO chip select, hence
1244 	 * set the hardware-controlled native chip select to an invalid value
1245 	 * to prevent it from interfering.
1246 	 */
1247 	cs = BCM2835_SPI_CS_CS_10 | BCM2835_SPI_CS_CS_01;
1248 	if (spi->mode & SPI_CPOL)
1249 		cs |= BCM2835_SPI_CS_CPOL;
1250 	if (spi->mode & SPI_CPHA)
1251 		cs |= BCM2835_SPI_CS_CPHA;
1252 	target->prepare_cs = cs;
1253 
1254 	/*
1255 	 * Precalculate SPI target's CS register value to clear RX FIFO
1256 	 * in case of a TX-only DMA transfer.
1257 	 */
1258 	if (ctlr->dma_rx) {
1259 		target->clear_rx_cs = cs | BCM2835_SPI_CS_TA |
1260 					BCM2835_SPI_CS_DMAEN |
1261 					BCM2835_SPI_CS_CLEAR_RX;
1262 		dma_sync_single_for_device(ctlr->dma_rx->device->dev,
1263 					   target->clear_rx_addr,
1264 					   sizeof(u32),
1265 					   DMA_TO_DEVICE);
1266 	}
1267 
1268 	/*
1269 	 * sanity checking the native-chipselects
1270 	 */
1271 	if (spi->mode & SPI_NO_CS)
1272 		return 0;
1273 	/*
1274 	 * The SPI core has successfully requested the CS GPIO line from the
1275 	 * device tree, so we are done.
1276 	 */
1277 	if (spi_get_csgpiod(spi, 0))
1278 		return 0;
1279 	if (spi_get_chipselect(spi, 0) > 1) {
1280 		/* error in the case of native CS requested with CS > 1
1281 		 * officially there is a CS2, but it is not documented
1282 		 * which GPIO is connected with that...
1283 		 */
1284 		dev_err(&spi->dev,
1285 			"setup: only two native chip-selects are supported\n");
1286 		ret = -EINVAL;
1287 		goto err_cleanup;
1288 	}
1289 
1290 	/*
1291 	 * Translate native CS to GPIO
1292 	 *
1293 	 * FIXME: poking around in the gpiolib internals like this is
1294 	 * not very good practice. Find a way to locate the real problem
1295 	 * and fix it. Why is the GPIO descriptor in spi->cs_gpiod
1296 	 * sometimes not assigned correctly? Erroneous device trees?
1297 	 */
1298 
1299 	/* get the gpio chip for the base */
1300 	chip = gpiochip_find("pinctrl-bcm2835", chip_match_name);
1301 	if (!chip)
1302 		return 0;
1303 
1304 	spi_set_csgpiod(spi, 0, gpiochip_request_own_desc(chip,
1305 							  8 - (spi_get_chipselect(spi, 0)),
1306 							  DRV_NAME,
1307 							  GPIO_LOOKUP_FLAGS_DEFAULT,
1308 							  GPIOD_OUT_LOW));
1309 	if (IS_ERR(spi_get_csgpiod(spi, 0))) {
1310 		ret = PTR_ERR(spi_get_csgpiod(spi, 0));
1311 		goto err_cleanup;
1312 	}
1313 
1314 	/* and set up the "mode" and level */
1315 	dev_info(&spi->dev, "setting up native-CS%i to use GPIO\n",
1316 		 spi_get_chipselect(spi, 0));
1317 
1318 	return 0;
1319 
1320 err_cleanup:
1321 	bcm2835_spi_cleanup(spi);
1322 	return ret;
1323 }
1324 
1325 static int bcm2835_spi_probe(struct platform_device *pdev)
1326 {
1327 	struct spi_controller *ctlr;
1328 	struct bcm2835_spi *bs;
1329 	int err;
1330 
1331 	ctlr = devm_spi_alloc_host(&pdev->dev, sizeof(*bs));
1332 	if (!ctlr)
1333 		return -ENOMEM;
1334 
1335 	platform_set_drvdata(pdev, ctlr);
1336 
1337 	ctlr->use_gpio_descriptors = true;
1338 	ctlr->mode_bits = BCM2835_SPI_MODE_BITS;
1339 	ctlr->bits_per_word_mask = SPI_BPW_MASK(8);
1340 	ctlr->num_chipselect = 3;
1341 	ctlr->setup = bcm2835_spi_setup;
1342 	ctlr->cleanup = bcm2835_spi_cleanup;
1343 	ctlr->transfer_one = bcm2835_spi_transfer_one;
1344 	ctlr->handle_err = bcm2835_spi_handle_err;
1345 	ctlr->prepare_message = bcm2835_spi_prepare_message;
1346 	ctlr->dev.of_node = pdev->dev.of_node;
1347 
1348 	bs = spi_controller_get_devdata(ctlr);
1349 	bs->ctlr = ctlr;
1350 
1351 	bs->regs = devm_platform_ioremap_resource(pdev, 0);
1352 	if (IS_ERR(bs->regs))
1353 		return PTR_ERR(bs->regs);
1354 
1355 	bs->clk = devm_clk_get(&pdev->dev, NULL);
1356 	if (IS_ERR(bs->clk))
1357 		return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
1358 				     "could not get clk\n");
1359 
1360 	ctlr->max_speed_hz = clk_get_rate(bs->clk) / 2;
1361 
1362 	bs->irq = platform_get_irq(pdev, 0);
1363 	if (bs->irq < 0)
1364 		return bs->irq;
1365 
1366 	err = clk_prepare_enable(bs->clk);
1367 	if (err)
1368 		return err;
1369 	bs->clk_hz = clk_get_rate(bs->clk);
1370 
1371 	err = bcm2835_dma_init(ctlr, &pdev->dev, bs);
1372 	if (err)
1373 		goto out_clk_disable;
1374 
1375 	/* initialise the hardware with the default polarities */
1376 	bcm2835_wr(bs, BCM2835_SPI_CS,
1377 		   BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
1378 
1379 	err = devm_request_irq(&pdev->dev, bs->irq, bcm2835_spi_interrupt,
1380 			       IRQF_SHARED, dev_name(&pdev->dev), bs);
1381 	if (err) {
1382 		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
1383 		goto out_dma_release;
1384 	}
1385 
1386 	err = spi_register_controller(ctlr);
1387 	if (err) {
1388 		dev_err(&pdev->dev, "could not register SPI controller: %d\n",
1389 			err);
1390 		goto out_dma_release;
1391 	}
1392 
1393 	bcm2835_debugfs_create(bs, dev_name(&pdev->dev));
1394 
1395 	return 0;
1396 
1397 out_dma_release:
1398 	bcm2835_dma_release(ctlr, bs);
1399 out_clk_disable:
1400 	clk_disable_unprepare(bs->clk);
1401 	return err;
1402 }
1403 
1404 static void bcm2835_spi_remove(struct platform_device *pdev)
1405 {
1406 	struct spi_controller *ctlr = platform_get_drvdata(pdev);
1407 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
1408 
1409 	bcm2835_debugfs_remove(bs);
1410 
1411 	spi_unregister_controller(ctlr);
1412 
1413 	bcm2835_dma_release(ctlr, bs);
1414 
1415 	/* Clear FIFOs, and disable the HW block */
1416 	bcm2835_wr(bs, BCM2835_SPI_CS,
1417 		   BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
1418 
1419 	clk_disable_unprepare(bs->clk);
1420 }
1421 
1422 static const struct of_device_id bcm2835_spi_match[] = {
1423 	{ .compatible = "brcm,bcm2835-spi", },
1424 	{}
1425 };
1426 MODULE_DEVICE_TABLE(of, bcm2835_spi_match);
1427 
1428 static struct platform_driver bcm2835_spi_driver = {
1429 	.driver		= {
1430 		.name		= DRV_NAME,
1431 		.of_match_table	= bcm2835_spi_match,
1432 	},
1433 	.probe		= bcm2835_spi_probe,
1434 	.remove_new	= bcm2835_spi_remove,
1435 	.shutdown	= bcm2835_spi_remove,
1436 };
1437 module_platform_driver(bcm2835_spi_driver);
1438 
1439 MODULE_DESCRIPTION("SPI controller driver for Broadcom BCM2835");
1440 MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
1441 MODULE_LICENSE("GPL");
1442