1/*
   2 * Handles the M-Systems DiskOnChip G3 chip
   3 *
   4 * Copyright (C) 2011 Robert Jarzmik
   5 *
   6 * This program is free software; you can redistribute it and/or modify
   7 * it under the terms of the GNU General Public License as published by
   8 * the Free Software Foundation; either version 2 of the License, or
   9 * (at your option) any later version.
  10 *
  11 * This program is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 * GNU General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU General Public License
  17 * along with this program; if not, write to the Free Software
  18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19 *
  20 */
  21
  22#include <linux/kernel.h>
  23#include <linux/module.h>
  24#include <linux/errno.h>
  25#include <linux/of.h>
  26#include <linux/platform_device.h>
  27#include <linux/string.h>
  28#include <linux/slab.h>
  29#include <linux/io.h>
  30#include <linux/delay.h>
  31#include <linux/mtd/mtd.h>
  32#include <linux/mtd/partitions.h>
  33#include <linux/bitmap.h>
  34#include <linux/bitrev.h>
  35#include <linux/bch.h>
  36
  37#include <linux/debugfs.h>
  38#include <linux/seq_file.h>
  39
  40#define CREATE_TRACE_POINTS
  41#include "docg3.h"
  42
  43/*
  44 * This driver handles the DiskOnChip G3 flash memory.
  45 *
  46 * As no specification is available from M-Systems/Sandisk, this drivers lacks
  47 * several functions available on the chip, as :
  48 *  - IPL write
  49 *
  50 * The bus data width (8bits versus 16bits) is not handled (if_cfg flag), and
  51 * the driver assumes a 16bits data bus.
  52 *
  53 * DocG3 relies on 2 ECC algorithms, which are handled in hardware :
  54 *  - a 1 byte Hamming code stored in the OOB for each page
  55 *  - a 7 bytes BCH code stored in the OOB for each page
  56 * The BCH ECC is :
  57 *  - BCH is in GF(2^14)
  58 *  - BCH is over data of 520 bytes (512 page + 7 page_info bytes
  59 *                                   + 1 hamming byte)
  60 *  - BCH can correct up to 4 bits (t = 4)
  61 *  - BCH syndroms are calculated in hardware, and checked in hardware as well
  62 *
  63 */
  64
  65static unsigned int reliable_mode;
  66module_param(reliable_mode, uint, 0);
  67MODULE_PARM_DESC(reliable_mode, "Set the docg3 mode (0=normal MLC, 1=fast, "
  68		 "2=reliable) : MLC normal operations are in normal mode");
  69
  70/**
  71 * struct docg3_oobinfo - DiskOnChip G3 OOB layout
  72 * @eccbytes: 8 bytes are used (1 for Hamming ECC, 7 for BCH ECC)
  73 * @eccpos: ecc positions (byte 7 is Hamming ECC, byte 8-14 are BCH ECC)
  74 * @oobfree: free pageinfo bytes (byte 0 until byte 6, byte 15
  75 */
  76static struct nand_ecclayout docg3_oobinfo = {
  77	.eccbytes = 8,
  78	.eccpos = {7, 8, 9, 10, 11, 12, 13, 14},
  79	.oobfree = {{0, 7}, {15, 1} },
  80};
  81
  82static inline u8 doc_readb(struct docg3 *docg3, u16 reg)
  83{
  84	u8 val = readb(docg3->cascade->base + reg);
  85
  86	trace_docg3_io(0, 8, reg, (int)val);
  87	return val;
  88}
  89
  90static inline u16 doc_readw(struct docg3 *docg3, u16 reg)
  91{
  92	u16 val = readw(docg3->cascade->base + reg);
  93
  94	trace_docg3_io(0, 16, reg, (int)val);
  95	return val;
  96}
  97
  98static inline void doc_writeb(struct docg3 *docg3, u8 val, u16 reg)
  99{
 100	writeb(val, docg3->cascade->base + reg);
 101	trace_docg3_io(1, 8, reg, val);
 102}
 103
 104static inline void doc_writew(struct docg3 *docg3, u16 val, u16 reg)
 105{
 106	writew(val, docg3->cascade->base + reg);
 107	trace_docg3_io(1, 16, reg, val);
 108}
 109
 110static inline void doc_flash_command(struct docg3 *docg3, u8 cmd)
 111{
 112	doc_writeb(docg3, cmd, DOC_FLASHCOMMAND);
 113}
 114
 115static inline void doc_flash_sequence(struct docg3 *docg3, u8 seq)
 116{
 117	doc_writeb(docg3, seq, DOC_FLASHSEQUENCE);
 118}
 119
 120static inline void doc_flash_address(struct docg3 *docg3, u8 addr)
 121{
 122	doc_writeb(docg3, addr, DOC_FLASHADDRESS);
 123}
 124
 125static char const * const part_probes[] = { "cmdlinepart", "saftlpart", NULL };
 126
 127static int doc_register_readb(struct docg3 *docg3, int reg)
 128{
 129	u8 val;
 130
 131	doc_writew(docg3, reg, DOC_READADDRESS);
 132	val = doc_readb(docg3, reg);
 133	doc_vdbg("Read register %04x : %02x\n", reg, val);
 134	return val;
 135}
 136
 137static int doc_register_readw(struct docg3 *docg3, int reg)
 138{
 139	u16 val;
 140
 141	doc_writew(docg3, reg, DOC_READADDRESS);
 142	val = doc_readw(docg3, reg);
 143	doc_vdbg("Read register %04x : %04x\n", reg, val);
 144	return val;
 145}
 146
 147/**
 148 * doc_delay - delay docg3 operations
 149 * @docg3: the device
 150 * @nbNOPs: the number of NOPs to issue
 151 *
 152 * As no specification is available, the right timings between chip commands are
 153 * unknown. The only available piece of information are the observed nops on a
 154 * working docg3 chip.
 155 * Therefore, doc_delay relies on a busy loop of NOPs, instead of scheduler
 156 * friendlier msleep() functions or blocking mdelay().
 157 */
 158static void doc_delay(struct docg3 *docg3, int nbNOPs)
 159{
 160	int i;
 161
 162	doc_vdbg("NOP x %d\n", nbNOPs);
 163	for (i = 0; i < nbNOPs; i++)
 164		doc_writeb(docg3, 0, DOC_NOP);
 165}
 166
 167static int is_prot_seq_error(struct docg3 *docg3)
 168{
 169	int ctrl;
 170
 171	ctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
 172	return ctrl & (DOC_CTRL_PROTECTION_ERROR | DOC_CTRL_SEQUENCE_ERROR);
 173}
 174
 175static int doc_is_ready(struct docg3 *docg3)
 176{
 177	int ctrl;
 178
 179	ctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
 180	return ctrl & DOC_CTRL_FLASHREADY;
 181}
 182
 183static int doc_wait_ready(struct docg3 *docg3)
 184{
 185	int maxWaitCycles = 100;
 186
 187	do {
 188		doc_delay(docg3, 4);
 189		cpu_relax();
 190	} while (!doc_is_ready(docg3) && maxWaitCycles--);
 191	doc_delay(docg3, 2);
 192	if (maxWaitCycles > 0)
 193		return 0;
 194	else
 195		return -EIO;
 196}
 197
 198static int doc_reset_seq(struct docg3 *docg3)
 199{
 200	int ret;
 201
 202	doc_writeb(docg3, 0x10, DOC_FLASHCONTROL);
 203	doc_flash_sequence(docg3, DOC_SEQ_RESET);
 204	doc_flash_command(docg3, DOC_CMD_RESET);
 205	doc_delay(docg3, 2);
 206	ret = doc_wait_ready(docg3);
 207
 208	doc_dbg("doc_reset_seq() -> isReady=%s\n", ret ? "false" : "true");
 209	return ret;
 210}
 211
 212/**
 213 * doc_read_data_area - Read data from data area
 214 * @docg3: the device
 215 * @buf: the buffer to fill in (might be NULL is dummy reads)
 216 * @len: the length to read
 217 * @first: first time read, DOC_READADDRESS should be set
 218 *
 219 * Reads bytes from flash data. Handles the single byte / even bytes reads.
 220 */
 221static void doc_read_data_area(struct docg3 *docg3, void *buf, int len,
 222			       int first)
 223{
 224	int i, cdr, len4;
 225	u16 data16, *dst16;
 226	u8 data8, *dst8;
 227
 228	doc_dbg("doc_read_data_area(buf=%p, len=%d)\n", buf, len);
 229	cdr = len & 0x1;
 230	len4 = len - cdr;
 231
 232	if (first)
 233		doc_writew(docg3, DOC_IOSPACE_DATA, DOC_READADDRESS);
 234	dst16 = buf;
 235	for (i = 0; i < len4; i += 2) {
 236		data16 = doc_readw(docg3, DOC_IOSPACE_DATA);
 237		if (dst16) {
 238			*dst16 = data16;
 239			dst16++;
 240		}
 241	}
 242
 243	if (cdr) {
 244		doc_writew(docg3, DOC_IOSPACE_DATA | DOC_READADDR_ONE_BYTE,
 245			   DOC_READADDRESS);
 246		doc_delay(docg3, 1);
 247		dst8 = (u8 *)dst16;
 248		for (i = 0; i < cdr; i++) {
 249			data8 = doc_readb(docg3, DOC_IOSPACE_DATA);
 250			if (dst8) {
 251				*dst8 = data8;
 252				dst8++;
 253			}
 254		}
 255	}
 256}
 257
 258/**
 259 * doc_write_data_area - Write data into data area
 260 * @docg3: the device
 261 * @buf: the buffer to get input bytes from
 262 * @len: the length to write
 263 *
 264 * Writes bytes into flash data. Handles the single byte / even bytes writes.
 265 */
 266static void doc_write_data_area(struct docg3 *docg3, const void *buf, int len)
 267{
 268	int i, cdr, len4;
 269	u16 *src16;
 270	u8 *src8;
 271
 272	doc_dbg("doc_write_data_area(buf=%p, len=%d)\n", buf, len);
 273	cdr = len & 0x3;
 274	len4 = len - cdr;
 275
 276	doc_writew(docg3, DOC_IOSPACE_DATA, DOC_READADDRESS);
 277	src16 = (u16 *)buf;
 278	for (i = 0; i < len4; i += 2) {
 279		doc_writew(docg3, *src16, DOC_IOSPACE_DATA);
 280		src16++;
 281	}
 282
 283	src8 = (u8 *)src16;
 284	for (i = 0; i < cdr; i++) {
 285		doc_writew(docg3, DOC_IOSPACE_DATA | DOC_READADDR_ONE_BYTE,
 286			   DOC_READADDRESS);
 287		doc_writeb(docg3, *src8, DOC_IOSPACE_DATA);
 288		src8++;
 289	}
 290}
 291
 292/**
 293 * doc_set_data_mode - Sets the flash to normal or reliable data mode
 294 * @docg3: the device
 295 *
 296 * The reliable data mode is a bit slower than the fast mode, but less errors
 297 * occur.  Entering the reliable mode cannot be done without entering the fast
 298 * mode first.
 299 *
 300 * In reliable mode, pages 2*n and 2*n+1 are clones. Writing to page 0 of blocks
 301 * (4,5) make the hardware write also to page 1 of blocks blocks(4,5). Reading
 302 * from page 0 of blocks (4,5) or from page 1 of blocks (4,5) gives the same
 303 * result, which is a logical and between bytes from page 0 and page 1 (which is
 304 * consistent with the fact that writing to a page is _clearing_ bits of that
 305 * page).
 306 */
 307static void doc_set_reliable_mode(struct docg3 *docg3)
 308{
 309	static char *strmode[] = { "normal", "fast", "reliable", "invalid" };
 310
 311	doc_dbg("doc_set_reliable_mode(%s)\n", strmode[docg3->reliable]);
 312	switch (docg3->reliable) {
 313	case 0:
 314		break;
 315	case 1:
 316		doc_flash_sequence(docg3, DOC_SEQ_SET_FASTMODE);
 317		doc_flash_command(docg3, DOC_CMD_FAST_MODE);
 318		break;
 319	case 2:
 320		doc_flash_sequence(docg3, DOC_SEQ_SET_RELIABLEMODE);
 321		doc_flash_command(docg3, DOC_CMD_FAST_MODE);
 322		doc_flash_command(docg3, DOC_CMD_RELIABLE_MODE);
 323		break;
 324	default:
 325		doc_err("doc_set_reliable_mode(): invalid mode\n");
 326		break;
 327	}
 328	doc_delay(docg3, 2);
 329}
 330
 331/**
 332 * doc_set_asic_mode - Set the ASIC mode
 333 * @docg3: the device
 334 * @mode: the mode
 335 *
 336 * The ASIC can work in 3 modes :
 337 *  - RESET: all registers are zeroed
 338 *  - NORMAL: receives and handles commands
 339 *  - POWERDOWN: minimal poweruse, flash parts shut off
 340 */
 341static void doc_set_asic_mode(struct docg3 *docg3, u8 mode)
 342{
 343	int i;
 344
 345	for (i = 0; i < 12; i++)
 346		doc_readb(docg3, DOC_IOSPACE_IPL);
 347
 348	mode |= DOC_ASICMODE_MDWREN;
 349	doc_dbg("doc_set_asic_mode(%02x)\n", mode);
 350	doc_writeb(docg3, mode, DOC_ASICMODE);
 351	doc_writeb(docg3, ~mode, DOC_ASICMODECONFIRM);
 352	doc_delay(docg3, 1);
 353}
 354
 355/**
 356 * doc_set_device_id - Sets the devices id for cascaded G3 chips
 357 * @docg3: the device
 358 * @id: the chip to select (amongst 0, 1, 2, 3)
 359 *
 360 * There can be 4 cascaded G3 chips. This function selects the one which will
 361 * should be the active one.
 362 */
 363static void doc_set_device_id(struct docg3 *docg3, int id)
 364{
 365	u8 ctrl;
 366
 367	doc_dbg("doc_set_device_id(%d)\n", id);
 368	doc_writeb(docg3, id, DOC_DEVICESELECT);
 369	ctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
 370
 371	ctrl &= ~DOC_CTRL_VIOLATION;
 372	ctrl |= DOC_CTRL_CE;
 373	doc_writeb(docg3, ctrl, DOC_FLASHCONTROL);
 374}
 375
 376/**
 377 * doc_set_extra_page_mode - Change flash page layout
 378 * @docg3: the device
 379 *
 380 * Normally, the flash page is split into the data (512 bytes) and the out of
 381 * band data (16 bytes). For each, 4 more bytes can be accessed, where the wear
 382 * leveling counters are stored.  To access this last area of 4 bytes, a special
 383 * mode must be input to the flash ASIC.
 384 *
 385 * Returns 0 if no error occurred, -EIO else.
 386 */
 387static int doc_set_extra_page_mode(struct docg3 *docg3)
 388{
 389	int fctrl;
 390
 391	doc_dbg("doc_set_extra_page_mode()\n");
 392	doc_flash_sequence(docg3, DOC_SEQ_PAGE_SIZE_532);
 393	doc_flash_command(docg3, DOC_CMD_PAGE_SIZE_532);
 394	doc_delay(docg3, 2);
 395
 396	fctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
 397	if (fctrl & (DOC_CTRL_PROTECTION_ERROR | DOC_CTRL_SEQUENCE_ERROR))
 398		return -EIO;
 399	else
 400		return 0;
 401}
 402
 403/**
 404 * doc_setup_addr_sector - Setup blocks/page/ofs address for one plane
 405 * @docg3: the device
 406 * @sector: the sector
 407 */
 408static void doc_setup_addr_sector(struct docg3 *docg3, int sector)
 409{
 410	doc_delay(docg3, 1);
 411	doc_flash_address(docg3, sector & 0xff);
 412	doc_flash_address(docg3, (sector >> 8) & 0xff);
 413	doc_flash_address(docg3, (sector >> 16) & 0xff);
 414	doc_delay(docg3, 1);
 415}
 416
 417/**
 418 * doc_setup_writeaddr_sector - Setup blocks/page/ofs address for one plane
 419 * @docg3: the device
 420 * @sector: the sector
 421 * @ofs: the offset in the page, between 0 and (512 + 16 + 512)
 422 */
 423static void doc_setup_writeaddr_sector(struct docg3 *docg3, int sector, int ofs)
 424{
 425	ofs = ofs >> 2;
 426	doc_delay(docg3, 1);
 427	doc_flash_address(docg3, ofs & 0xff);
 428	doc_flash_address(docg3, sector & 0xff);
 429	doc_flash_address(docg3, (sector >> 8) & 0xff);
 430	doc_flash_address(docg3, (sector >> 16) & 0xff);
 431	doc_delay(docg3, 1);
 432}
 433
 434/**
 435 * doc_seek - Set both flash planes to the specified block, page for reading
 436 * @docg3: the device
 437 * @block0: the first plane block index
 438 * @block1: the second plane block index
 439 * @page: the page index within the block
 440 * @wear: if true, read will occur on the 4 extra bytes of the wear area
 441 * @ofs: offset in page to read
 442 *
 443 * Programs the flash even and odd planes to the specific block and page.
 444 * Alternatively, programs the flash to the wear area of the specified page.
 445 */
 446static int doc_read_seek(struct docg3 *docg3, int block0, int block1, int page,
 447			 int wear, int ofs)
 448{
 449	int sector, ret = 0;
 450
 451	doc_dbg("doc_seek(blocks=(%d,%d), page=%d, ofs=%d, wear=%d)\n",
 452		block0, block1, page, ofs, wear);
 453
 454	if (!wear && (ofs < 2 * DOC_LAYOUT_PAGE_SIZE)) {
 455		doc_flash_sequence(docg3, DOC_SEQ_SET_PLANE1);
 456		doc_flash_command(docg3, DOC_CMD_READ_PLANE1);
 457		doc_delay(docg3, 2);
 458	} else {
 459		doc_flash_sequence(docg3, DOC_SEQ_SET_PLANE2);
 460		doc_flash_command(docg3, DOC_CMD_READ_PLANE2);
 461		doc_delay(docg3, 2);
 462	}
 463
 464	doc_set_reliable_mode(docg3);
 465	if (wear)
 466		ret = doc_set_extra_page_mode(docg3);
 467	if (ret)
 468		goto out;
 469
 470	doc_flash_sequence(docg3, DOC_SEQ_READ);
 471	sector = (block0 << DOC_ADDR_BLOCK_SHIFT) + (page & DOC_ADDR_PAGE_MASK);
 472	doc_flash_command(docg3, DOC_CMD_PROG_BLOCK_ADDR);
 473	doc_setup_addr_sector(docg3, sector);
 474
 475	sector = (block1 << DOC_ADDR_BLOCK_SHIFT) + (page & DOC_ADDR_PAGE_MASK);
 476	doc_flash_command(docg3, DOC_CMD_PROG_BLOCK_ADDR);
 477	doc_setup_addr_sector(docg3, sector);
 478	doc_delay(docg3, 1);
 479
 480out:
 481	return ret;
 482}
 483
 484/**
 485 * doc_write_seek - Set both flash planes to the specified block, page for writing
 486 * @docg3: the device
 487 * @block0: the first plane block index
 488 * @block1: the second plane block index
 489 * @page: the page index within the block
 490 * @ofs: offset in page to write
 491 *
 492 * Programs the flash even and odd planes to the specific block and page.
 493 * Alternatively, programs the flash to the wear area of the specified page.
 494 */
 495static int doc_write_seek(struct docg3 *docg3, int block0, int block1, int page,
 496			 int ofs)
 497{
 498	int ret = 0, sector;
 499
 500	doc_dbg("doc_write_seek(blocks=(%d,%d), page=%d, ofs=%d)\n",
 501		block0, block1, page, ofs);
 502
 503	doc_set_reliable_mode(docg3);
 504
 505	if (ofs < 2 * DOC_LAYOUT_PAGE_SIZE) {
 506		doc_flash_sequence(docg3, DOC_SEQ_SET_PLANE1);
 507		doc_flash_command(docg3, DOC_CMD_READ_PLANE1);
 508		doc_delay(docg3, 2);
 509	} else {
 510		doc_flash_sequence(docg3, DOC_SEQ_SET_PLANE2);
 511		doc_flash_command(docg3, DOC_CMD_READ_PLANE2);
 512		doc_delay(docg3, 2);
 513	}
 514
 515	doc_flash_sequence(docg3, DOC_SEQ_PAGE_SETUP);
 516	doc_flash_command(docg3, DOC_CMD_PROG_CYCLE1);
 517
 518	sector = (block0 << DOC_ADDR_BLOCK_SHIFT) + (page & DOC_ADDR_PAGE_MASK);
 519	doc_setup_writeaddr_sector(docg3, sector, ofs);
 520
 521	doc_flash_command(docg3, DOC_CMD_PROG_CYCLE3);
 522	doc_delay(docg3, 2);
 523	ret = doc_wait_ready(docg3);
 524	if (ret)
 525		goto out;
 526
 527	doc_flash_command(docg3, DOC_CMD_PROG_CYCLE1);
 528	sector = (block1 << DOC_ADDR_BLOCK_SHIFT) + (page & DOC_ADDR_PAGE_MASK);
 529	doc_setup_writeaddr_sector(docg3, sector, ofs);
 530	doc_delay(docg3, 1);
 531
 532out:
 533	return ret;
 534}
 535
 536
 537/**
 538 * doc_read_page_ecc_init - Initialize hardware ECC engine
 539 * @docg3: the device
 540 * @len: the number of bytes covered by the ECC (BCH covered)
 541 *
 542 * The function does initialize the hardware ECC engine to compute the Hamming
 543 * ECC (on 1 byte) and the BCH hardware ECC (on 7 bytes).
 544 *
 545 * Return 0 if succeeded, -EIO on error
 546 */
 547static int doc_read_page_ecc_init(struct docg3 *docg3, int len)
 548{
 549	doc_writew(docg3, DOC_ECCCONF0_READ_MODE
 550		   | DOC_ECCCONF0_BCH_ENABLE | DOC_ECCCONF0_HAMMING_ENABLE
 551		   | (len & DOC_ECCCONF0_DATA_BYTES_MASK),
 552		   DOC_ECCCONF0);
 553	doc_delay(docg3, 4);
 554	doc_register_readb(docg3, DOC_FLASHCONTROL);
 555	return doc_wait_ready(docg3);
 556}
 557
 558/**
 559 * doc_write_page_ecc_init - Initialize hardware BCH ECC engine
 560 * @docg3: the device
 561 * @len: the number of bytes covered by the ECC (BCH covered)
 562 *
 563 * The function does initialize the hardware ECC engine to compute the Hamming
 564 * ECC (on 1 byte) and the BCH hardware ECC (on 7 bytes).
 565 *
 566 * Return 0 if succeeded, -EIO on error
 567 */
 568static int doc_write_page_ecc_init(struct docg3 *docg3, int len)
 569{
 570	doc_writew(docg3, DOC_ECCCONF0_WRITE_MODE
 571		   | DOC_ECCCONF0_BCH_ENABLE | DOC_ECCCONF0_HAMMING_ENABLE
 572		   | (len & DOC_ECCCONF0_DATA_BYTES_MASK),
 573		   DOC_ECCCONF0);
 574	doc_delay(docg3, 4);
 575	doc_register_readb(docg3, DOC_FLASHCONTROL);
 576	return doc_wait_ready(docg3);
 577}
 578
 579/**
 580 * doc_ecc_disable - Disable Hamming and BCH ECC hardware calculator
 581 * @docg3: the device
 582 *
 583 * Disables the hardware ECC generator and checker, for unchecked reads (as when
 584 * reading OOB only or write status byte).
 585 */
 586static void doc_ecc_disable(struct docg3 *docg3)
 587{
 588	doc_writew(docg3, DOC_ECCCONF0_READ_MODE, DOC_ECCCONF0);
 589	doc_delay(docg3, 4);
 590}
 591
 592/**
 593 * doc_hamming_ecc_init - Initialize hardware Hamming ECC engine
 594 * @docg3: the device
 595 * @nb_bytes: the number of bytes covered by the ECC (Hamming covered)
 596 *
 597 * This function programs the ECC hardware to compute the hamming code on the
 598 * last provided N bytes to the hardware generator.
 599 */
 600static void doc_hamming_ecc_init(struct docg3 *docg3, int nb_bytes)
 601{
 602	u8 ecc_conf1;
 603
 604	ecc_conf1 = doc_register_readb(docg3, DOC_ECCCONF1);
 605	ecc_conf1 &= ~DOC_ECCCONF1_HAMMING_BITS_MASK;
 606	ecc_conf1 |= (nb_bytes & DOC_ECCCONF1_HAMMING_BITS_MASK);
 607	doc_writeb(docg3, ecc_conf1, DOC_ECCCONF1);
 608}
 609
 610/**
 611 * doc_ecc_bch_fix_data - Fix if need be read data from flash
 612 * @docg3: the device
 613 * @buf: the buffer of read data (512 + 7 + 1 bytes)
 614 * @hwecc: the hardware calculated ECC.
 615 *         It's in fact recv_ecc ^ calc_ecc, where recv_ecc was read from OOB
 616 *         area data, and calc_ecc the ECC calculated by the hardware generator.
 617 *
 618 * Checks if the received data matches the ECC, and if an error is detected,
 619 * tries to fix the bit flips (at most 4) in the buffer buf.  As the docg3
 620 * understands the (data, ecc, syndroms) in an inverted order in comparison to
 621 * the BCH library, the function reverses the order of bits (ie. bit7 and bit0,
 622 * bit6 and bit 1, ...) for all ECC data.
 623 *
 624 * The hardware ecc unit produces oob_ecc ^ calc_ecc.  The kernel's bch
 625 * algorithm is used to decode this.  However the hw operates on page
 626 * data in a bit order that is the reverse of that of the bch alg,
 627 * requiring that the bits be reversed on the result.  Thanks to Ivan
 628 * Djelic for his analysis.
 629 *
 630 * Returns number of fixed bits (0, 1, 2, 3, 4) or -EBADMSG if too many bit
 631 * errors were detected and cannot be fixed.
 632 */
 633static int doc_ecc_bch_fix_data(struct docg3 *docg3, void *buf, u8 *hwecc)
 634{
 635	u8 ecc[DOC_ECC_BCH_SIZE];
 636	int errorpos[DOC_ECC_BCH_T], i, numerrs;
 637
 638	for (i = 0; i < DOC_ECC_BCH_SIZE; i++)
 639		ecc[i] = bitrev8(hwecc[i]);
 640	numerrs = decode_bch(docg3->cascade->bch, NULL,
 641			     DOC_ECC_BCH_COVERED_BYTES,
 642			     NULL, ecc, NULL, errorpos);
 643	BUG_ON(numerrs == -EINVAL);
 644	if (numerrs < 0)
 645		goto out;
 646
 647	for (i = 0; i < numerrs; i++)
 648		errorpos[i] = (errorpos[i] & ~7) | (7 - (errorpos[i] & 7));
 649	for (i = 0; i < numerrs; i++)
 650		if (errorpos[i] < DOC_ECC_BCH_COVERED_BYTES*8)
 651			/* error is located in data, correct it */
 652			change_bit(errorpos[i], buf);
 653out:
 654	doc_dbg("doc_ecc_bch_fix_data: flipped %d bits\n", numerrs);
 655	return numerrs;
 656}
 657
 658
 659/**
 660 * doc_read_page_prepare - Prepares reading data from a flash page
 661 * @docg3: the device
 662 * @block0: the first plane block index on flash memory
 663 * @block1: the second plane block index on flash memory
 664 * @page: the page index in the block
 665 * @offset: the offset in the page (must be a multiple of 4)
 666 *
 667 * Prepares the page to be read in the flash memory :
 668 *   - tell ASIC to map the flash pages
 669 *   - tell ASIC to be in read mode
 670 *
 671 * After a call to this method, a call to doc_read_page_finish is mandatory,
 672 * to end the read cycle of the flash.
 673 *
 674 * Read data from a flash page. The length to be read must be between 0 and
 675 * (page_size + oob_size + wear_size), ie. 532, and a multiple of 4 (because
 676 * the extra bytes reading is not implemented).
 677 *
 678 * As pages are grouped by 2 (in 2 planes), reading from a page must be done
 679 * in two steps:
 680 *  - one read of 512 bytes at offset 0
 681 *  - one read of 512 bytes at offset 512 + 16
 682 *
 683 * Returns 0 if successful, -EIO if a read error occurred.
 684 */
 685static int doc_read_page_prepare(struct docg3 *docg3, int block0, int block1,
 686				 int page, int offset)
 687{
 688	int wear_area = 0, ret = 0;
 689
 690	doc_dbg("doc_read_page_prepare(blocks=(%d,%d), page=%d, ofsInPage=%d)\n",
 691		block0, block1, page, offset);
 692	if (offset >= DOC_LAYOUT_WEAR_OFFSET)
 693		wear_area = 1;
 694	if (!wear_area && offset > (DOC_LAYOUT_PAGE_OOB_SIZE * 2))
 695		return -EINVAL;
 696
 697	doc_set_device_id(docg3, docg3->device_id);
 698	ret = doc_reset_seq(docg3);
 699	if (ret)
 700		goto err;
 701
 702	/* Program the flash address block and page */
 703	ret = doc_read_seek(docg3, block0, block1, page, wear_area, offset);
 704	if (ret)
 705		goto err;
 706
 707	doc_flash_command(docg3, DOC_CMD_READ_ALL_PLANES);
 708	doc_delay(docg3, 2);
 709	doc_wait_ready(docg3);
 710
 711	doc_flash_command(docg3, DOC_CMD_SET_ADDR_READ);
 712	doc_delay(docg3, 1);
 713	if (offset >= DOC_LAYOUT_PAGE_SIZE * 2)
 714		offset -= 2 * DOC_LAYOUT_PAGE_SIZE;
 715	doc_flash_address(docg3, offset >> 2);
 716	doc_delay(docg3, 1);
 717	doc_wait_ready(docg3);
 718
 719	doc_flash_command(docg3, DOC_CMD_READ_FLASH);
 720
 721	return 0;
 722err:
 723	doc_writeb(docg3, 0, DOC_DATAEND);
 724	doc_delay(docg3, 2);
 725	return -EIO;
 726}
 727
 728/**
 729 * doc_read_page_getbytes - Reads bytes from a prepared page
 730 * @docg3: the device
 731 * @len: the number of bytes to be read (must be a multiple of 4)
 732 * @buf: the buffer to be filled in (or NULL is forget bytes)
 733 * @first: 1 if first time read, DOC_READADDRESS should be set
 734 * @last_odd: 1 if last read ended up on an odd byte
 735 *
 736 * Reads bytes from a prepared page. There is a trickery here : if the last read
 737 * ended up on an odd offset in the 1024 bytes double page, ie. between the 2
 738 * planes, the first byte must be read apart. If a word (16bit) read was used,
 739 * the read would return the byte of plane 2 as low *and* high endian, which
 740 * will mess the read.
 741 *
 742 */
 743static int doc_read_page_getbytes(struct docg3 *docg3, int len, u_char *buf,
 744				  int first, int last_odd)
 745{
 746	if (last_odd && len > 0) {
 747		doc_read_data_area(docg3, buf, 1, first);
 748		doc_read_data_area(docg3, buf ? buf + 1 : buf, len - 1, 0);
 749	} else {
 750		doc_read_data_area(docg3, buf, len, first);
 751	}
 752	doc_delay(docg3, 2);
 753	return len;
 754}
 755
 756/**
 757 * doc_write_page_putbytes - Writes bytes into a prepared page
 758 * @docg3: the device
 759 * @len: the number of bytes to be written
 760 * @buf: the buffer of input bytes
 761 *
 762 */
 763static void doc_write_page_putbytes(struct docg3 *docg3, int len,
 764				    const u_char *buf)
 765{
 766	doc_write_data_area(docg3, buf, len);
 767	doc_delay(docg3, 2);
 768}
 769
 770/**
 771 * doc_get_bch_hw_ecc - Get hardware calculated BCH ECC
 772 * @docg3: the device
 773 * @hwecc:  the array of 7 integers where the hardware ecc will be stored
 774 */
 775static void doc_get_bch_hw_ecc(struct docg3 *docg3, u8 *hwecc)
 776{
 777	int i;
 778
 779	for (i = 0; i < DOC_ECC_BCH_SIZE; i++)
 780		hwecc[i] = doc_register_readb(docg3, DOC_BCH_HW_ECC(i));
 781}
 782
 783/**
 784 * doc_page_finish - Ends reading/writing of a flash page
 785 * @docg3: the device
 786 */
 787static void doc_page_finish(struct docg3 *docg3)
 788{
 789	doc_writeb(docg3, 0, DOC_DATAEND);
 790	doc_delay(docg3, 2);
 791}
 792
 793/**
 794 * doc_read_page_finish - Ends reading of a flash page
 795 * @docg3: the device
 796 *
 797 * As a side effect, resets the chip selector to 0. This ensures that after each
 798 * read operation, the floor 0 is selected. Therefore, if the systems halts, the
 799 * reboot will boot on floor 0, where the IPL is.
 800 */
 801static void doc_read_page_finish(struct docg3 *docg3)
 802{
 803	doc_page_finish(docg3);
 804	doc_set_device_id(docg3, 0);
 805}
 806
 807/**
 808 * calc_block_sector - Calculate blocks, pages and ofs.
 809
 810 * @from: offset in flash
 811 * @block0: first plane block index calculated
 812 * @block1: second plane block index calculated
 813 * @page: page calculated
 814 * @ofs: offset in page
 815 * @reliable: 0 if docg3 in normal mode, 1 if docg3 in fast mode, 2 if docg3 in
 816 * reliable mode.
 817 *
 818 * The calculation is based on the reliable/normal mode. In normal mode, the 64
 819 * pages of a block are available. In reliable mode, as pages 2*n and 2*n+1 are
 820 * clones, only 32 pages per block are available.
 821 */
 822static void calc_block_sector(loff_t from, int *block0, int *block1, int *page,
 823			      int *ofs, int reliable)
 824{
 825	uint sector, pages_biblock;
 826
 827	pages_biblock = DOC_LAYOUT_PAGES_PER_BLOCK * DOC_LAYOUT_NBPLANES;
 828	if (reliable == 1 || reliable == 2)
 829		pages_biblock /= 2;
 830
 831	sector = from / DOC_LAYOUT_PAGE_SIZE;
 832	*block0 = sector / pages_biblock * DOC_LAYOUT_NBPLANES;
 833	*block1 = *block0 + 1;
 834	*page = sector % pages_biblock;
 835	*page /= DOC_LAYOUT_NBPLANES;
 836	if (reliable == 1 || reliable == 2)
 837		*page *= 2;
 838	if (sector % 2)
 839		*ofs = DOC_LAYOUT_PAGE_OOB_SIZE;
 840	else
 841		*ofs = 0;
 842}
 843
 844/**
 845 * doc_read_oob - Read out of band bytes from flash
 846 * @mtd: the device
 847 * @from: the offset from first block and first page, in bytes, aligned on page
 848 *        size
 849 * @ops: the mtd oob structure
 850 *
 851 * Reads flash memory OOB area of pages.
 852 *
 853 * Returns 0 if read successful, of -EIO, -EINVAL if an error occurred
 854 */
 855static int doc_read_oob(struct mtd_info *mtd, loff_t from,
 856			struct mtd_oob_ops *ops)
 857{
 858	struct docg3 *docg3 = mtd->priv;
 859	int block0, block1, page, ret, skip, ofs = 0;
 860	u8 *oobbuf = ops->oobbuf;
 861	u8 *buf = ops->datbuf;
 862	size_t len, ooblen, nbdata, nboob;
 863	u8 hwecc[DOC_ECC_BCH_SIZE], eccconf1;
 864	int max_bitflips = 0;
 865
 866	if (buf)
 867		len = ops->len;
 868	else
 869		len = 0;
 870	if (oobbuf)
 871		ooblen = ops->ooblen;
 872	else
 873		ooblen = 0;
 874
 875	if (oobbuf && ops->mode == MTD_OPS_PLACE_OOB)
 876		oobbuf += ops->ooboffs;
 877
 878	doc_dbg("doc_read_oob(from=%lld, mode=%d, data=(%p:%zu), oob=(%p:%zu))\n",
 879		from, ops->mode, buf, len, oobbuf, ooblen);
 880	if (ooblen % DOC_LAYOUT_OOB_SIZE)
 881		return -EINVAL;
 882
 883	if (from + len > mtd->size)
 884		return -EINVAL;
 885
 886	ops->oobretlen = 0;
 887	ops->retlen = 0;
 888	ret = 0;
 889	skip = from % DOC_LAYOUT_PAGE_SIZE;
 890	mutex_lock(&docg3->cascade->lock);
 891	while (ret >= 0 && (len > 0 || ooblen > 0)) {
 892		calc_block_sector(from - skip, &block0, &block1, &page, &ofs,
 893			docg3->reliable);
 894		nbdata = min_t(size_t, len, DOC_LAYOUT_PAGE_SIZE - skip);
 895		nboob = min_t(size_t, ooblen, (size_t)DOC_LAYOUT_OOB_SIZE);
 896		ret = doc_read_page_prepare(docg3, block0, block1, page, ofs);
 897		if (ret < 0)
 898			goto out;
 899		ret = doc_read_page_ecc_init(docg3, DOC_ECC_BCH_TOTAL_BYTES);
 900		if (ret < 0)
 901			goto err_in_read;
 902		ret = doc_read_page_getbytes(docg3, skip, NULL, 1, 0);
 903		if (ret < skip)
 904			goto err_in_read;
 905		ret = doc_read_page_getbytes(docg3, nbdata, buf, 0, skip % 2);
 906		if (ret < nbdata)
 907			goto err_in_read;
 908		doc_read_page_getbytes(docg3,
 909				       DOC_LAYOUT_PAGE_SIZE - nbdata - skip,
 910				       NULL, 0, (skip + nbdata) % 2);
 911		ret = doc_read_page_getbytes(docg3, nboob, oobbuf, 0, 0);
 912		if (ret < nboob)
 913			goto err_in_read;
 914		doc_read_page_getbytes(docg3, DOC_LAYOUT_OOB_SIZE - nboob,
 915				       NULL, 0, nboob % 2);
 916
 917		doc_get_bch_hw_ecc(docg3, hwecc);
 918		eccconf1 = doc_register_readb(docg3, DOC_ECCCONF1);
 919
 920		if (nboob >= DOC_LAYOUT_OOB_SIZE) {
 921			doc_dbg("OOB - INFO: %*phC\n", 7, oobbuf);
 922			doc_dbg("OOB - HAMMING: %02x\n", oobbuf[7]);
 923			doc_dbg("OOB - BCH_ECC: %*phC\n", 7, oobbuf + 8);
 924			doc_dbg("OOB - UNUSED: %02x\n", oobbuf[15]);
 925		}
 926		doc_dbg("ECC checks: ECCConf1=%x\n", eccconf1);
 927		doc_dbg("ECC HW_ECC: %*phC\n", 7, hwecc);
 928
 929		ret = -EIO;
 930		if (is_prot_seq_error(docg3))
 931			goto err_in_read;
 932		ret = 0;
 933		if ((block0 >= DOC_LAYOUT_BLOCK_FIRST_DATA) &&
 934		    (eccconf1 & DOC_ECCCONF1_BCH_SYNDROM_ERR) &&
 935		    (eccconf1 & DOC_ECCCONF1_PAGE_IS_WRITTEN) &&
 936		    (ops->mode != MTD_OPS_RAW) &&
 937		    (nbdata == DOC_LAYOUT_PAGE_SIZE)) {
 938			ret = doc_ecc_bch_fix_data(docg3, buf, hwecc);
 939			if (ret < 0) {
 940				mtd->ecc_stats.failed++;
 941				ret = -EBADMSG;
 942			}
 943			if (ret > 0) {
 944				mtd->ecc_stats.corrected += ret;
 945				max_bitflips = max(max_bitflips, ret);
 946				ret = max_bitflips;
 947			}
 948		}
 949
 950		doc_read_page_finish(docg3);
 951		ops->retlen += nbdata;
 952		ops->oobretlen += nboob;
 953		buf += nbdata;
 954		oobbuf += nboob;
 955		len -= nbdata;
 956		ooblen -= nboob;
 957		from += DOC_LAYOUT_PAGE_SIZE;
 958		skip = 0;
 959	}
 960
 961out:
 962	mutex_unlock(&docg3->cascade->lock);
 963	return ret;
 964err_in_read:
 965	doc_read_page_finish(docg3);
 966	goto out;
 967}
 968
 969/**
 970 * doc_read - Read bytes from flash
 971 * @mtd: the device
 972 * @from: the offset from first block and first page, in bytes, aligned on page
 973 *        size
 974 * @len: the number of bytes to read (must be a multiple of 4)
 975 * @retlen: the number of bytes actually read
 976 * @buf: the filled in buffer
 977 *
 978 * Reads flash memory pages. This function does not read the OOB chunk, but only
 979 * the page data.
 980 *
 981 * Returns 0 if read successful, of -EIO, -EINVAL if an error occurred
 982 */
 983static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
 984	     size_t *retlen, u_char *buf)
 985{
 986	struct mtd_oob_ops ops;
 987	size_t ret;
 988
 989	memset(&ops, 0, sizeof(ops));
 990	ops.datbuf = buf;
 991	ops.len = len;
 992	ops.mode = MTD_OPS_AUTO_OOB;
 993
 994	ret = doc_read_oob(mtd, from, &ops);
 995	*retlen = ops.retlen;
 996	return ret;
 997}
 998
 999static int doc_reload_bbt(struct docg3 *docg3)
1000{
1001	int block = DOC_LAYOUT_BLOCK_BBT;
1002	int ret = 0, nbpages, page;
1003	u_char *buf = docg3->bbt;
1004
1005	nbpages = DIV_ROUND_UP(docg3->max_block + 1, 8 * DOC_LAYOUT_PAGE_SIZE);
1006	for (page = 0; !ret && (page < nbpages); page++) {
1007		ret = doc_read_page_prepare(docg3, block, block + 1,
1008					    page + DOC_LAYOUT_PAGE_BBT, 0);
1009		if (!ret)
1010			ret = doc_read_page_ecc_init(docg3,
1011						     DOC_LAYOUT_PAGE_SIZE);
1012		if (!ret)
1013			doc_read_page_getbytes(docg3, DOC_LAYOUT_PAGE_SIZE,
1014					       buf, 1, 0);
1015		buf += DOC_LAYOUT_PAGE_SIZE;
1016	}
1017	doc_read_page_finish(docg3);
1018	return ret;
1019}
1020
1021/**
1022 * doc_block_isbad - Checks whether a block is good or not
1023 * @mtd: the device
1024 * @from: the offset to find the correct block
1025 *
1026 * Returns 1 if block is bad, 0 if block is good
1027 */
1028static int doc_block_isbad(struct mtd_info *mtd, loff_t from)
1029{
1030	struct docg3 *docg3 = mtd->priv;
1031	int block0, block1, page, ofs, is_good;
1032
1033	calc_block_sector(from, &block0, &block1, &page, &ofs,
1034		docg3->reliable);
1035	doc_dbg("doc_block_isbad(from=%lld) => block=(%d,%d), page=%d, ofs=%d\n",
1036		from, block0, block1, page, ofs);
1037
1038	if (block0 < DOC_LAYOUT_BLOCK_FIRST_DATA)
1039		return 0;
1040	if (block1 > docg3->max_block)
1041		return -EINVAL;
1042
1043	is_good = docg3->bbt[block0 >> 3] & (1 << (block0 & 0x7));
1044	return !is_good;
1045}
1046
1047#if 0
1048/**
1049 * doc_get_erase_count - Get block erase count
1050 * @docg3: the device
1051 * @from: the offset in which the block is.
1052 *
1053 * Get the number of times a block was erased. The number is the maximum of
1054 * erase times between first and second plane (which should be equal normally).
1055 *
1056 * Returns The number of erases, or -EINVAL or -EIO on error.
1057 */
1058static int doc_get_erase_count(struct docg3 *docg3, loff_t from)
1059{
1060	u8 buf[DOC_LAYOUT_WEAR_SIZE];
1061	int ret, plane1_erase_count, plane2_erase_count;
1062	int block0, block1, page, ofs;
1063
1064	doc_dbg("doc_get_erase_count(from=%lld, buf=%p)\n", from, buf);
1065	if (from % DOC_LAYOUT_PAGE_SIZE)
1066		return -EINVAL;
1067	calc_block_sector(from, &block0, &block1, &page, &ofs, docg3->reliable);
1068	if (block1 > docg3->max_block)
1069		return -EINVAL;
1070
1071	ret = doc_reset_seq(docg3);
1072	if (!ret)
1073		ret = doc_read_page_prepare(docg3, block0, block1, page,
1074					    ofs + DOC_LAYOUT_WEAR_OFFSET, 0);
1075	if (!ret)
1076		ret = doc_read_page_getbytes(docg3, DOC_LAYOUT_WEAR_SIZE,
1077					     buf, 1, 0);
1078	doc_read_page_finish(docg3);
1079
1080	if (ret || (buf[0] != DOC_ERASE_MARK) || (buf[2] != DOC_ERASE_MARK))
1081		return -EIO;
1082	plane1_erase_count = (u8)(~buf[1]) | ((u8)(~buf[4]) << 8)
1083		| ((u8)(~buf[5]) << 16);
1084	plane2_erase_count = (u8)(~buf[3]) | ((u8)(~buf[6]) << 8)
1085		| ((u8)(~buf[7]) << 16);
1086
1087	return max(plane1_erase_count, plane2_erase_count);
1088}
1089#endif
1090
1091/**
1092 * doc_get_op_status - get erase/write operation status
1093 * @docg3: the device
1094 *
1095 * Queries the status from the chip, and returns it
1096 *
1097 * Returns the status (bits DOC_PLANES_STATUS_*)
1098 */
1099static int doc_get_op_status(struct docg3 *docg3)
1100{
1101	u8 status;
1102
1103	doc_flash_sequence(docg3, DOC_SEQ_PLANES_STATUS);
1104	doc_flash_command(docg3, DOC_CMD_PLANES_STATUS);
1105	doc_delay(docg3, 5);
1106
1107	doc_ecc_disable(docg3);
1108	doc_read_data_area(docg3, &status, 1, 1);
1109	return status;
1110}
1111
1112/**
1113 * doc_write_erase_wait_status - wait for write or erase completion
1114 * @docg3: the device
1115 *
1116 * Wait for the chip to be ready again after erase or write operation, and check
1117 * erase/write status.
1118 *
1119 * Returns 0 if erase successful, -EIO if erase/write issue, -ETIMEOUT if
1120 * timeout
1121 */
1122static int doc_write_erase_wait_status(struct docg3 *docg3)
1123{
1124	int i, status, ret = 0;
1125
1126	for (i = 0; !doc_is_ready(docg3) && i < 5; i++)
1127		msleep(20);
1128	if (!doc_is_ready(docg3)) {
1129		doc_dbg("Timeout reached and the chip is still not ready\n");
1130		ret = -EAGAIN;
1131		goto out;
1132	}
1133
1134	status = doc_get_op_status(docg3);
1135	if (status & DOC_PLANES_STATUS_FAIL) {
1136		doc_dbg("Erase/Write failed on (a) plane(s), status = %x\n",
1137			status);
1138		ret = -EIO;
1139	}
1140
1141out:
1142	doc_page_finish(docg3);
1143	return ret;
1144}
1145
1146/**
1147 * doc_erase_block - Erase a couple of blocks
1148 * @docg3: the device
1149 * @block0: the first block to erase (leftmost plane)
1150 * @block1: the second block to erase (rightmost plane)
1151 *
1152 * Erase both blocks, and return operation status
1153 *
1154 * Returns 0 if erase successful, -EIO if erase issue, -ETIMEOUT if chip not
1155 * ready for too long
1156 */
1157static int doc_erase_block(struct docg3 *docg3, int block0, int block1)
1158{
1159	int ret, sector;
1160
1161	doc_dbg("doc_erase_block(blocks=(%d,%d))\n", block0, block1);
1162	ret = doc_reset_seq(docg3);
1163	if (ret)
1164		return -EIO;
1165
1166	doc_set_reliable_mode(docg3);
1167	doc_flash_sequence(docg3, DOC_SEQ_ERASE);
1168
1169	sector = block0 << DOC_ADDR_BLOCK_SHIFT;
1170	doc_flash_command(docg3, DOC_CMD_PROG_BLOCK_ADDR);
1171	doc_setup_addr_sector(docg3, sector);
1172	sector = block1 << DOC_ADDR_BLOCK_SHIFT;
1173	doc_flash_command(docg3, DOC_CMD_PROG_BLOCK_ADDR);
1174	doc_setup_addr_sector(docg3, sector);
1175	doc_delay(docg3, 1);
1176
1177	doc_flash_command(docg3, DOC_CMD_ERASECYCLE2);
1178	doc_delay(docg3, 2);
1179
1180	if (is_prot_seq_error(docg3)) {
1181		doc_err("Erase blocks %d,%d error\n", block0, block1);
1182		return -EIO;
1183	}
1184
1185	return doc_write_erase_wait_status(docg3);
1186}
1187
1188/**
1189 * doc_erase - Erase a portion of the chip
1190 * @mtd: the device
1191 * @info: the erase info
1192 *
1193 * Erase a bunch of contiguous blocks, by pairs, as a "mtd" page of 1024 is
1194 * split into 2 pages of 512 bytes on 2 contiguous blocks.
1195 *
1196 * Returns 0 if erase successful, -EINVAL if addressing error, -EIO if erase
1197 * issue
1198 */
1199static int doc_erase(struct mtd_info *mtd, struct erase_info *info)
1200{
1201	struct docg3 *docg3 = mtd->priv;
1202	uint64_t len;
1203	int block0, block1, page, ret, ofs = 0;
1204
1205	doc_dbg("doc_erase(from=%lld, len=%lld\n", info->addr, info->len);
1206
1207	info->state = MTD_ERASE_PENDING;
1208	calc_block_sector(info->addr + info->len, &block0, &block1, &page,
1209			  &ofs, docg3->reliable);
1210	ret = -EINVAL;
1211	if (info->addr + info->len > mtd->size || page || ofs)
1212		goto reset_err;
1213
1214	ret = 0;
1215	calc_block_sector(info->addr, &block0, &block1, &page, &ofs,
1216			  docg3->reliable);
1217	mutex_lock(&docg3->cascade->lock);
1218	doc_set_device_id(docg3, docg3->device_id);
1219	doc_set_reliable_mode(docg3);
1220	for (len = info->len; !ret && len > 0; len -= mtd->erasesize) {
1221		info->state = MTD_ERASING;
1222		ret = doc_erase_block(docg3, block0, block1);
1223		block0 += 2;
1224		block1 += 2;
1225	}
1226	mutex_unlock(&docg3->cascade->lock);
1227
1228	if (ret)
1229		goto reset_err;
1230
1231	info->state = MTD_ERASE_DONE;
1232	return 0;
1233
1234reset_err:
1235	info->state = MTD_ERASE_FAILED;
1236	return ret;
1237}
1238
1239/**
1240 * doc_write_page - Write a single page to the chip
1241 * @docg3: the device
1242 * @to: the offset from first block and first page, in bytes, aligned on page
1243 *      size
1244 * @buf: buffer to get bytes from
1245 * @oob: buffer to get out of band bytes from (can be NULL if no OOB should be
1246 *       written)
1247 * @autoecc: if 0, all 16 bytes from OOB are taken, regardless of HW Hamming or
1248 *           BCH computations. If 1, only bytes 0-7 and byte 15 are taken,
1249 *           remaining ones are filled with hardware Hamming and BCH
1250 *           computations. Its value is not meaningfull is oob == NULL.
1251 *
1252 * Write one full page (ie. 1 page split on two planes), of 512 bytes, with the
1253 * OOB data. The OOB ECC is automatically computed by the hardware Hamming and
1254 * BCH generator if autoecc is not null.
1255 *
1256 * Returns 0 if write successful, -EIO if write error, -EAGAIN if timeout
1257 */
1258static int doc_write_page(struct docg3 *docg3, loff_t to, const u_char *buf,
1259			  const u_char *oob, int autoecc)
1260{
1261	int block0, block1, page, ret, ofs = 0;
1262	u8 hwecc[DOC_ECC_BCH_SIZE], hamming;
1263
1264	doc_dbg("doc_write_page(to=%lld)\n", to);
1265	calc_block_sector(to, &block0, &block1, &page, &ofs, docg3->reliable);
1266
1267	doc_set_device_id(docg3, docg3->device_id);
1268	ret = doc_reset_seq(docg3);
1269	if (ret)
1270		goto err;
1271
1272	/* Program the flash address block and page */
1273	ret = doc_write_seek(docg3, block0, block1, page, ofs);
1274	if (ret)
1275		goto err;
1276
1277	doc_write_page_ecc_init(docg3, DOC_ECC_BCH_TOTAL_BYTES);
1278	doc_delay(docg3, 2);
1279	doc_write_page_putbytes(docg3, DOC_LAYOUT_PAGE_SIZE, buf);
1280
1281	if (oob && autoecc) {
1282		doc_write_page_putbytes(docg3, DOC_LAYOUT_OOB_PAGEINFO_SZ, oob);
1283		doc_delay(docg3, 2);
1284		oob += DOC_LAYOUT_OOB_UNUSED_OFS;
1285
1286		hamming = doc_register_readb(docg3, DOC_HAMMINGPARITY);
1287		doc_delay(docg3, 2);
1288		doc_write_page_putbytes(docg3, DOC_LAYOUT_OOB_HAMMING_SZ,
1289					&hamming);
1290		doc_delay(docg3, 2);
1291
1292		doc_get_bch_hw_ecc(docg3, hwecc);
1293		doc_write_page_putbytes(docg3, DOC_LAYOUT_OOB_BCH_SZ, hwecc);
1294		doc_delay(docg3, 2);
1295
1296		doc_write_page_putbytes(docg3, DOC_LAYOUT_OOB_UNUSED_SZ, oob);
1297	}
1298	if (oob && !autoecc)
1299		doc_write_page_putbytes(docg3, DOC_LAYOUT_OOB_SIZE, oob);
1300
1301	doc_delay(docg3, 2);
1302	doc_page_finish(docg3);
1303	doc_delay(docg3, 2);
1304	doc_flash_command(docg3, DOC_CMD_PROG_CYCLE2);
1305	doc_delay(docg3, 2);
1306
1307	/*
1308	 * The wait status will perform another doc_page_finish() call, but that
1309	 * seems to please the docg3, so leave it.
1310	 */
1311	ret = doc_write_erase_wait_status(docg3);
1312	return ret;
1313err:
1314	doc_read_page_finish(docg3);
1315	return ret;
1316}
1317
1318/**
1319 * doc_guess_autoecc - Guess autoecc mode from mbd_oob_ops
1320 * @ops: the oob operations
1321 *
1322 * Returns 0 or 1 if success, -EINVAL if invalid oob mode
1323 */
1324static int doc_guess_autoecc(struct mtd_oob_ops *ops)
1325{
1326	int autoecc;
1327
1328	switch (ops->mode) {
1329	case MTD_OPS_PLACE_OOB:
1330	case MTD_OPS_AUTO_OOB:
1331		autoecc = 1;
1332		break;
1333	case MTD_OPS_RAW:
1334		autoecc = 0;
1335		break;
1336	default:
1337		autoecc = -EINVAL;
1338	}
1339	return autoecc;
1340}
1341
1342/**
1343 * doc_fill_autooob - Fill a 16 bytes OOB from 8 non-ECC bytes
1344 * @dst: the target 16 bytes OOB buffer
1345 * @oobsrc: the source 8 bytes non-ECC OOB buffer
1346 *
1347 */
1348static void doc_fill_autooob(u8 *dst, u8 *oobsrc)
1349{
1350	memcpy(dst, oobsrc, DOC_LAYOUT_OOB_PAGEINFO_SZ);
1351	dst[DOC_LAYOUT_OOB_UNUSED_OFS] = oobsrc[DOC_LAYOUT_OOB_PAGEINFO_SZ];
1352}
1353
1354/**
1355 * doc_backup_oob - Backup OOB into docg3 structure
1356 * @docg3: the device
1357 * @to: the page offset in the chip
1358 * @ops: the OOB size and buffer
1359 *
1360 * As the docg3 should write a page with its OOB in one pass, and some userland
1361 * applications do write_oob() to setup the OOB and then write(), store the OOB
1362 * into a temporary storage. This is very dangerous, as 2 concurrent
1363 * applications could store an OOB, and then write their pages (which will
1364 * result into one having its OOB corrupted).
1365 *
1366 * The only reliable way would be for userland to call doc_write_oob() with both
1367 * the page data _and_ the OOB area.
1368 *
1369 * Returns 0 if success, -EINVAL if ops content invalid
1370 */
1371static int doc_backup_oob(struct docg3 *docg3, loff_t to,
1372			  struct mtd_oob_ops *ops)
1373{
1374	int ooblen = ops->ooblen, autoecc;
1375
1376	if (ooblen != DOC_LAYOUT_OOB_SIZE)
1377		return -EINVAL;
1378	autoecc = doc_guess_autoecc(ops);
1379	if (autoecc < 0)
1380		return autoecc;
1381
1382	docg3->oob_write_ofs = to;
1383	docg3->oob_autoecc = autoecc;
1384	if (ops->mode == MTD_OPS_AUTO_OOB) {
1385		doc_fill_autooob(docg3->oob_write_buf, ops->oobbuf);
1386		ops->oobretlen = 8;
1387	} else {
1388		memcpy(docg3->oob_write_buf, ops->oobbuf, DOC_LAYOUT_OOB_SIZE);
1389		ops->oobretlen = DOC_LAYOUT_OOB_SIZE;
1390	}
1391	return 0;
1392}
1393
1394/**
1395 * doc_write_oob - Write out of band bytes to flash
1396 * @mtd: the device
1397 * @ofs: the offset from first block and first page, in bytes, aligned on page
1398 *       size
1399 * @ops: the mtd oob structure
1400 *
1401 * Either write OOB data into a temporary buffer, for the subsequent write
1402 * page. The provided OOB should be 16 bytes long. If a data buffer is provided
1403 * as well, issue the page write.
1404 * Or provide data without OOB, and then a all zeroed OOB will be used (ECC will
1405 * still be filled in if asked for).
1406 *
1407 * Returns 0 is successful, EINVAL if length is not 14 bytes
1408 */
1409static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
1410			 struct mtd_oob_ops *ops)
1411{
1412	struct docg3 *docg3 = mtd->priv;
1413	int ret, autoecc, oobdelta;
1414	u8 *oobbuf = ops->oobbuf;
1415	u8 *buf = ops->datbuf;
1416	size_t len, ooblen;
1417	u8 oob[DOC_LAYOUT_OOB_SIZE];
1418
1419	if (buf)
1420		len = ops->len;
1421	else
1422		len = 0;
1423	if (oobbuf)
1424		ooblen = ops->ooblen;
1425	else
1426		ooblen = 0;
1427
1428	if (oobbuf && ops->mode == MTD_OPS_PLACE_OOB)
1429		oobbuf += ops->ooboffs;
1430
1431	doc_dbg("doc_write_oob(from=%lld, mode=%d, data=(%p:%zu), oob=(%p:%zu))\n",
1432		ofs, ops->mode, buf, len, oobbuf, ooblen);
1433	switch (ops->mode) {
1434	case MTD_OPS_PLACE_OOB:
1435	case MTD_OPS_RAW:
1436		oobdelta = mtd->oobsize;
1437		break;
1438	case MTD_OPS_AUTO_OOB:
1439		oobdelta = mtd->oobavail;
1440		break;
1441	default:
1442		return -EINVAL;
1443	}
1444	if ((len % DOC_LAYOUT_PAGE_SIZE) || (ooblen % oobdelta) ||
1445	    (ofs % DOC_LAYOUT_PAGE_SIZE))
1446		return -EINVAL;
1447	if (len && ooblen &&
1448	    (len / DOC_LAYOUT_PAGE_SIZE) != (ooblen / oobdelta))
1449		return -EINVAL;
1450	if (ofs + len > mtd->size)
1451		return -EINVAL;
1452
1453	ops->oobretlen = 0;
1454	ops->retlen = 0;
1455	ret = 0;
1456	if (len == 0 && ooblen == 0)
1457		return -EINVAL;
1458	if (len == 0 && ooblen > 0)
1459		return doc_backup_oob(docg3, ofs, ops);
1460
1461	autoecc = doc_guess_autoecc(ops);
1462	if (autoecc < 0)
1463		return autoecc;
1464
1465	mutex_lock(&docg3->cascade->lock);
1466	while (!ret && len > 0) {
1467		memset(oob, 0, sizeof(oob));
1468		if (ofs == docg3->oob_write_ofs)
1469			memcpy(oob, docg3->oob_write_buf, DOC_LAYOUT_OOB_SIZE);
1470		else if (ooblen > 0 && ops->mode == MTD_OPS_AUTO_OOB)
1471			doc_fill_autooob(oob, oobbuf);
1472		else if (ooblen > 0)
1473			memcpy(oob, oobbuf, DOC_LAYOUT_OOB_SIZE);
1474		ret = doc_write_page(docg3, ofs, buf, oob, autoecc);
1475
1476		ofs += DOC_LAYOUT_PAGE_SIZE;
1477		len -= DOC_LAYOUT_PAGE_SIZE;
1478		buf += DOC_LAYOUT_PAGE_SIZE;
1479		if (ooblen) {
1480			oobbuf += oobdelta;
1481			ooblen -= oobdelta;
1482			ops->oobretlen += oobdelta;
1483		}
1484		ops->retlen += DOC_LAYOUT_PAGE_SIZE;
1485	}
1486
1487	doc_set_device_id(docg3, 0);
1488	mutex_unlock(&docg3->cascade->lock);
1489	return ret;
1490}
1491
1492/**
1493 * doc_write - Write a buffer to the chip
1494 * @mtd: the device
1495 * @to: the offset from first block and first page, in bytes, aligned on page
1496 *      size
1497 * @len: the number of bytes to write (must be a full page size, ie. 512)
1498 * @retlen: the number of bytes actually written (0 or 512)
1499 * @buf: the buffer to get bytes from
1500 *
1501 * Writes data to the chip.
1502 *
1503 * Returns 0 if write successful, -EIO if write error
1504 */
1505static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
1506		     size_t *retlen, const u_char *buf)
1507{
1508	struct docg3 *docg3 = mtd->priv;
1509	int ret;
1510	struct mtd_oob_ops ops;
1511
1512	doc_dbg("doc_write(to=%lld, len=%zu)\n", to, len);
1513	ops.datbuf = (char *)buf;
1514	ops.len = len;
1515	ops.mode = MTD_OPS_PLACE_OOB;
1516	ops.oobbuf = NULL;
1517	ops.ooblen = 0;
1518	ops.ooboffs = 0;
1519
1520	ret = doc_write_oob(mtd, to, &ops);
1521	*retlen = ops.retlen;
1522	return ret;
1523}
1524
1525static struct docg3 *sysfs_dev2docg3(struct device *dev,
1526				     struct device_attribute *attr)
1527{
1528	int floor;
1529	struct platform_device *pdev = to_platform_device(dev);
1530	struct mtd_info **docg3_floors = platform_get_drvdata(pdev);
1531
1532	floor = attr->attr.name[1] - '0';
1533	if (floor < 0 || floor >= DOC_MAX_NBFLOORS)
1534		return NULL;
1535	else
1536		return docg3_floors[floor]->priv;
1537}
1538
1539static ssize_t dps0_is_key_locked(struct device *dev,
1540				  struct device_attribute *attr, char *buf)
1541{
1542	struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
1543	int dps0;
1544
1545	mutex_lock(&docg3->cascade->lock);
1546	doc_set_device_id(docg3, docg3->device_id);
1547	dps0 = doc_register_readb(docg3, DOC_DPS0_STATUS);
1548	doc_set_device_id(docg3, 0);
1549	mutex_unlock(&docg3->cascade->lock);
1550
1551	return sprintf(buf, "%d\n", !(dps0 & DOC_DPS_KEY_OK));
1552}
1553
1554static ssize_t dps1_is_key_locked(struct device *dev,
1555				  struct device_attribute *attr, char *buf)
1556{
1557	struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
1558	int dps1;
1559
1560	mutex_lock(&docg3->cascade->lock);
1561	doc_set_device_id(docg3, docg3->device_id);
1562	dps1 = doc_register_readb(docg3, DOC_DPS1_STATUS);
1563	doc_set_device_id(docg3, 0);
1564	mutex_unlock(&docg3->cascade->lock);
1565
1566	return sprintf(buf, "%d\n", !(dps1 & DOC_DPS_KEY_OK));
1567}
1568
1569static ssize_t dps0_insert_key(struct device *dev,
1570			       struct device_attribute *attr,
1571			       const char *buf, size_t count)
1572{
1573	struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
1574	int i;
1575
1576	if (count != DOC_LAYOUT_DPS_KEY_LENGTH)
1577		return -EINVAL;
1578
1579	mutex_lock(&docg3->cascade->lock);
1580	doc_set_device_id(docg3, docg3->device_id);
1581	for (i = 0; i < DOC_LAYOUT_DPS_KEY_LENGTH; i++)
1582		doc_writeb(docg3, buf[i], DOC_DPS0_KEY);
1583	doc_set_device_id(docg3, 0);
1584	mutex_unlock(&docg3->cascade->lock);
1585	return count;
1586}
1587
1588static ssize_t dps1_insert_key(struct device *dev,
1589			       struct device_attribute *attr,
1590			       const char *buf, size_t count)
1591{
1592	struct docg3 *docg3 = sysfs_dev2docg3(dev, attr);
1593	int i;
1594
1595	if (count != DOC_LAYOUT_DPS_KEY_LENGTH)
1596		return -EINVAL;
1597
1598	mutex_lock(&docg3->cascade->lock);
1599	doc_set_device_id(docg3, docg3->device_id);
1600	for (i = 0; i < DOC_LAYOUT_DPS_KEY_LENGTH; i++)
1601		doc_writeb(docg3, buf[i], DOC_DPS1_KEY);
1602	doc_set_device_id(docg3, 0);
1603	mutex_unlock(&docg3->cascade->lock);
1604	return count;
1605}
1606
1607#define FLOOR_SYSFS(id) { \
1608	__ATTR(f##id##_dps0_is_keylocked, S_IRUGO, dps0_is_key_locked, NULL), \
1609	__ATTR(f##id##_dps1_is_keylocked, S_IRUGO, dps1_is_key_locked, NULL), \
1610	__ATTR(f##id##_dps0_protection_key, S_IWUSR|S_IWGRP, NULL, dps0_insert_key), \
1611	__ATTR(f##id##_dps1_protection_key, S_IWUSR|S_IWGRP, NULL, dps1_insert_key), \
1612}
1613
1614static struct device_attribute doc_sys_attrs[DOC_MAX_NBFLOORS][4] = {
1615	FLOOR_SYSFS(0), FLOOR_SYSFS(1), FLOOR_SYSFS(2), FLOOR_SYSFS(3)
1616};
1617
1618static int doc_register_sysfs(struct platform_device *pdev,
1619			      struct docg3_cascade *cascade)
1620{
1621	struct device *dev = &pdev->dev;
1622	int floor;
1623	int ret;
1624	int i;
1625
1626	for (floor = 0;
1627	     floor < DOC_MAX_NBFLOORS && cascade->floors[floor];
1628	     floor++) {
1629		for (i = 0; i < 4; i++) {
1630			ret = device_create_file(dev, &doc_sys_attrs[floor][i]);
1631			if (ret)
1632				goto remove_files;
1633		}
1634	}
1635
1636	return 0;
1637
1638remove_files:
1639	do {
1640		while (--i >= 0)
1641			device_remove_file(dev, &doc_sys_attrs[floor][i]);
1642		i = 4;
1643	} while (--floor >= 0);
1644
1645	return ret;
1646}
1647
1648static void doc_unregister_sysfs(struct platform_device *pdev,
1649				 struct docg3_cascade *cascade)
1650{
1651	struct device *dev = &pdev->dev;
1652	int floor, i;
1653
1654	for (floor = 0; floor < DOC_MAX_NBFLOORS && cascade->floors[floor];
1655	     floor++)
1656		for (i = 0; i < 4; i++)
1657			device_remove_file(dev, &doc_sys_attrs[floor][i]);
1658}
1659
1660/*
1661 * Debug sysfs entries
1662 */
1663static int dbg_flashctrl_show(struct seq_file *s, void *p)
1664{
1665	struct docg3 *docg3 = (struct docg3 *)s->private;
1666
1667	u8 fctrl;
1668
1669	mutex_lock(&docg3->cascade->lock);
1670	fctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
1671	mutex_unlock(&docg3->cascade->lock);
1672
1673	seq_printf(s, "FlashControl : 0x%02x (%s,CE# %s,%s,%s,flash %s)\n",
1674		   fctrl,
1675		   fctrl & DOC_CTRL_VIOLATION ? "protocol violation" : "-",
1676		   fctrl & DOC_CTRL_CE ? "active" : "inactive",
1677		   fctrl & DOC_CTRL_PROTECTION_ERROR ? "protection error" : "-",
1678		   fctrl & DOC_CTRL_SEQUENCE_ERROR ? "sequence error" : "-",
1679		   fctrl & DOC_CTRL_FLASHREADY ? "ready" : "not ready");
1680
1681	return 0;
1682}
1683DEBUGFS_RO_ATTR(flashcontrol, dbg_flashctrl_show);
1684
1685static int dbg_asicmode_show(struct seq_file *s, void *p)
1686{
1687	struct docg3 *docg3 = (struct docg3 *)s->private;
1688
1689	int pctrl, mode;
1690
1691	mutex_lock(&docg3->cascade->lock);
1692	pctrl = doc_register_readb(docg3, DOC_ASICMODE);
1693	mode = pctrl & 0x03;
1694	mutex_unlock(&docg3->cascade->lock);
1695
1696	seq_printf(s,
1697		   "%04x : RAM_WE=%d,RSTIN_RESET=%d,BDETCT_RESET=%d,WRITE_ENABLE=%d,POWERDOWN=%d,MODE=%d%d (",
1698		   pctrl,
1699		   pctrl & DOC_ASICMODE_RAM_WE ? 1 : 0,
1700		   pctrl & DOC_ASICMODE_RSTIN_RESET ? 1 : 0,
1701		   pctrl & DOC_ASICMODE_BDETCT_RESET ? 1 : 0,
1702		   pctrl & DOC_ASICMODE_MDWREN ? 1 : 0,
1703		   pctrl & DOC_ASICMODE_POWERDOWN ? 1 : 0,
1704		   mode >> 1, mode & 0x1);
1705
1706	switch (mode) {
1707	case DOC_ASICMODE_RESET:
1708		seq_puts(s, "reset");
1709		break;
1710	case DOC_ASICMODE_NORMAL:
1711		seq_puts(s, "normal");
1712		break;
1713	case DOC_ASICMODE_POWERDOWN:
1714		seq_puts(s, "powerdown");
1715		break;
1716	}
1717	seq_puts(s, ")\n");
1718	return 0;
1719}
1720DEBUGFS_RO_ATTR(asic_mode, dbg_asicmode_show);
1721
1722static int dbg_device_id_show(struct seq_file *s, void *p)
1723{
1724	struct docg3 *docg3 = (struct docg3 *)s->private;
1725	int id;
1726
1727	mutex_lock(&docg3->cascade->lock);
1728	id = doc_register_readb(docg3, DOC_DEVICESELECT);
1729	mutex_unlock(&docg3->cascade->lock);
1730
1731	seq_printf(s, "DeviceId = %d\n", id);
1732	return 0;
1733}
1734DEBUGFS_RO_ATTR(device_id, dbg_device_id_show);
1735
1736static int dbg_protection_show(struct seq_file *s, void *p)
1737{
1738	struct docg3 *docg3 = (struct docg3 *)s->private;
1739	int protect, dps0, dps0_low, dps0_high, dps1, dps1_low, dps1_high;
1740
1741	mutex_lock(&docg3->cascade->lock);
1742	protect = doc_register_readb(docg3, DOC_PROTECTION);
1743	dps0 = doc_register_readb(docg3, DOC_DPS0_STATUS);
1744	dps0_low = doc_register_readw(docg3, DOC_DPS0_ADDRLOW);
1745	dps0_high = doc_register_readw(docg3, DOC_DPS0_ADDRHIGH);
1746	dps1 = doc_register_readb(docg3, DOC_DPS1_STATUS);
1747	dps1_low = doc_register_readw(docg3, DOC_DPS1_ADDRLOW);
1748	dps1_high = doc_register_readw(docg3, DOC_DPS1_ADDRHIGH);
1749	mutex_unlock(&docg3->cascade->lock);
1750
1751	seq_printf(s, "Protection = 0x%02x (", protect);
1752	if (protect & DOC_PROTECT_FOUNDRY_OTP_LOCK)
1753		seq_puts(s, "FOUNDRY_OTP_LOCK,");
1754	if (protect & DOC_PROTECT_CUSTOMER_OTP_LOCK)
1755		seq_puts(s, "CUSTOMER_OTP_LOCK,");
1756	if (protect & DOC_PROTECT_LOCK_INPUT)
1757		seq_puts(s, "LOCK_INPUT,");
1758	if (protect & DOC_PROTECT_STICKY_LOCK)
1759		seq_puts(s, "STICKY_LOCK,");
1760	if (protect & DOC_PROTECT_PROTECTION_ENABLED)
1761		seq_puts(s, "PROTECTION ON,");
1762	if (protect & DOC_PROTECT_IPL_DOWNLOAD_LOCK)
1763		seq_puts(s, "IPL_DOWNLOAD_LOCK,");
1764	if (protect & DOC_PROTECT_PROTECTION_ERROR)
1765		seq_puts(s, "PROTECT_ERR,");
1766	else
1767		seq_puts(s, "NO_PROTECT_ERR");
1768	seq_puts(s, ")\n");
1769
1770	seq_printf(s, "DPS0 = 0x%02x : Protected area [0x%x - 0x%x] : OTP=%d, READ=%d, WRITE=%d, HW_LOCK=%d, KEY_OK=%d\n",
1771		   dps0, dps0_low, dps0_high,
1772		   !!(dps0 & DOC_DPS_OTP_PROTECTED),
1773		   !!(dps0 & DOC_DPS_READ_PROTECTED),
1774		   !!(dps0 & DOC_DPS_WRITE_PROTECTED),
1775		   !!(dps0 & DOC_DPS_HW_LOCK_ENABLED),
1776		   !!(dps0 & DOC_DPS_KEY_OK));
1777	seq_printf(s, "DPS1 = 0x%02x : Protected area [0x%x - 0x%x] : OTP=%d, READ=%d, WRITE=%d, HW_LOCK=%d, KEY_OK=%d\n",
1778		   dps1, dps1_low, dps1_high,
1779		   !!(dps1 & DOC_DPS_OTP_PROTECTED),
1780		   !!(dps1 & DOC_DPS_READ_PROTECTED),
1781		   !!(dps1 & DOC_DPS_WRITE_PROTECTED),
1782		   !!(dps1 & DOC_DPS_HW_LOCK_ENABLED),
1783		   !!(dps1 & DOC_DPS_KEY_OK));
1784	return 0;
1785}
1786DEBUGFS_RO_ATTR(protection, dbg_protection_show);
1787
1788static int __init doc_dbg_register(struct docg3 *docg3)
1789{
1790	struct dentry *root, *entry;
1791
1792	root = debugfs_create_dir("docg3", NULL);
1793	if (!root)
1794		return -ENOMEM;
1795
1796	entry = debugfs_create_file("flashcontrol", S_IRUSR, root, docg3,
1797				  &flashcontrol_fops);
1798	if (entry)
1799		entry = debugfs_create_file("asic_mode", S_IRUSR, root,
1800					    docg3, &asic_mode_fops);
1801	if (entry)
1802		entry = debugfs_create_file("device_id", S_IRUSR, root,
1803					    docg3, &device_id_fops);
1804	if (entry)
1805		entry = debugfs_create_file("protection", S_IRUSR, root,
1806					    docg3, &protection_fops);
1807	if (entry) {
1808		docg3->debugfs_root = root;
1809		return 0;
1810	} else {
1811		debugfs_remove_recursive(root);
1812		return -ENOMEM;
1813	}
1814}
1815
1816static void doc_dbg_unregister(struct docg3 *docg3)
1817{
1818	debugfs_remove_recursive(docg3->debugfs_root);
1819}
1820
1821/**
1822 * doc_set_driver_info - Fill the mtd_info structure and docg3 structure
1823 * @chip_id: The chip ID of the supported chip
1824 * @mtd: The structure to fill
1825 */
1826static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
1827{
1828	struct docg3 *docg3 = mtd->priv;
1829	int cfg;
1830
1831	cfg = doc_register_readb(docg3, DOC_CONFIGURATION);
1832	docg3->if_cfg = (cfg & DOC_CONF_IF_CFG ? 1 : 0);
1833	docg3->reliable = reliable_mode;
1834
1835	switch (chip_id) {
1836	case DOC_CHIPID_G3:
1837		mtd->name = kasprintf(GFP_KERNEL, "docg3.%d",
1838				      docg3->device_id);
1839		if (!mtd->name)
1840			return -ENOMEM;
1841		docg3->max_block = 2047;
1842		break;
1843	}
1844	mtd->type = MTD_NANDFLASH;
1845	mtd->flags = MTD_CAP_NANDFLASH;
1846	mtd->size = (docg3->max_block + 1) * DOC_LAYOUT_BLOCK_SIZE;
1847	if (docg3->reliable == 2)
1848		mtd->size /= 2;
1849	mtd->erasesize = DOC_LAYOUT_BLOCK_SIZE * DOC_LAYOUT_NBPLANES;
1850	if (docg3->reliable == 2)
1851		mtd->erasesize /= 2;
1852	mtd->writebufsize = mtd->writesize = DOC_LAYOUT_PAGE_SIZE;
1853	mtd->oobsize = DOC_LAYOUT_OOB_SIZE;
1854	mtd->_erase = doc_erase;
1855	mtd->_read = doc_read;
1856	mtd->_write = doc_write;
1857	mtd->_read_oob = doc_read_oob;
1858	mtd->_write_oob = doc_write_oob;
1859	mtd->_block_isbad = doc_block_isbad;
1860	mtd->ecclayout = &docg3_oobinfo;
1861	mtd->oobavail = 8;
1862	mtd->ecc_strength = DOC_ECC_BCH_T;
1863
1864	return 0;
1865}
1866
1867/**
1868 * doc_probe_device - Check if a device is available
1869 * @base: the io space where the device is probed
1870 * @floor: the floor of the probed device
1871 * @dev: the device
1872 * @cascade: the cascade of chips this devices will belong to
1873 *
1874 * Checks whether a device at the specified IO range, and floor is available.
1875 *
1876 * Returns a mtd_info struct if there is a device, ENODEV if none found, ENOMEM
1877 * if a memory allocation failed. If floor 0 is checked, a reset of the ASIC is
1878 * launched.
1879 */
1880static struct mtd_info * __init
1881doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
1882{
1883	int ret, bbt_nbpages;
1884	u16 chip_id, chip_id_inv;
1885	struct docg3 *docg3;
1886	struct mtd_info *mtd;
1887
1888	ret = -ENOMEM;
1889	docg3 = kzalloc(sizeof(struct docg3), GFP_KERNEL);
1890	if (!docg3)
1891		goto nomem1;
1892	mtd = kzalloc(sizeof(struct mtd_info), GFP_KERNEL);
1893	if (!mtd)
1894		goto nomem2;
1895	mtd->priv = docg3;
1896	mtd->dev.parent = dev;
1897	bbt_nbpages = DIV_ROUND_UP(docg3->max_block + 1,
1898				   8 * DOC_LAYOUT_PAGE_SIZE);
1899	docg3->bbt = kzalloc(bbt_nbpages * DOC_LAYOUT_PAGE_SIZE, GFP_KERNEL);
1900	if (!docg3->bbt)
1901		goto nomem3;
1902
1903	docg3->dev = dev;
1904	docg3->device_id = floor;
1905	docg3->cascade = cascade;
1906	doc_set_device_id(docg3, docg3->device_id);
1907	if (!floor)
1908		doc_set_asic_mode(docg3, DOC_ASICMODE_RESET);
1909	doc_set_asic_mode(docg3, DOC_ASICMODE_NORMAL);
1910
1911	chip_id = doc_register_readw(docg3, DOC_CHIPID);
1912	chip_id_inv = doc_register_readw(docg3, DOC_CHIPID_INV);
1913
1914	ret = 0;
1915	if (chip_id != (u16)(~chip_id_inv)) {
1916		goto nomem4;
1917	}
1918
1919	switch (chip_id) {
1920	case DOC_CHIPID_G3:
1921		doc_info("Found a G3 DiskOnChip at addr %p, floor %d\n",
1922			 docg3->cascade->base, floor);
1923		break;
1924	default:
1925		doc_err("Chip id %04x is not a DiskOnChip G3 chip\n", chip_id);
1926		goto nomem4;
1927	}
1928
1929	ret = doc_set_driver_info(chip_id, mtd);
1930	if (ret)
1931		goto nomem4;
1932
1933	doc_hamming_ecc_init(docg3, DOC_LAYOUT_OOB_PAGEINFO_SZ);
1934	doc_reload_bbt(docg3);
1935	return mtd;
1936
1937nomem4:
1938	kfree(docg3->bbt);
1939nomem3:
1940	kfree(mtd);
1941nomem2:
1942	kfree(docg3);
1943nomem1:
1944	return ERR_PTR(ret);
1945}
1946
1947/**
1948 * doc_release_device - Release a docg3 floor
1949 * @mtd: the device
1950 */
1951static void doc_release_device(struct mtd_info *mtd)
1952{
1953	struct docg3 *docg3 = mtd->priv;
1954
1955	mtd_device_unregister(mtd);
1956	kfree(docg3->bbt);
1957	kfree(docg3);
1958	kfree(mtd->name);
1959	kfree(mtd);
1960}
1961
1962/**
1963 * docg3_resume - Awakens docg3 floor
1964 * @pdev: platfrom device
1965 *
1966 * Returns 0 (always successful)
1967 */
1968static int docg3_resume(struct platform_device *pdev)
1969{
1970	int i;
1971	struct docg3_cascade *cascade;
1972	struct mtd_info **docg3_floors, *mtd;
1973	struct docg3 *docg3;
1974
1975	cascade = platform_get_drvdata(pdev);
1976	docg3_floors = cascade->floors;
1977	mtd = docg3_floors[0];
1978	docg3 = mtd->priv;
1979
1980	doc_dbg("docg3_resume()\n");
1981	for (i = 0; i < 12; i++)
1982		doc_readb(docg3, DOC_IOSPACE_IPL);
1983	return 0;
1984}
1985
1986/**
1987 * docg3_suspend - Put in low power mode the docg3 floor
1988 * @pdev: platform device
1989 * @state: power state
1990 *
1991 * Shuts off most of docg3 circuitery to lower power consumption.
1992 *
1993 * Returns 0 if suspend succeeded, -EIO if chip refused suspend
1994 */
1995static int docg3_suspend(struct platform_device *pdev, pm_message_t state)
1996{
1997	int floor, i;
1998	struct docg3_cascade *cascade;
1999	struct mtd_info **docg3_floors, *mtd;
2000	struct docg3 *docg3;
2001	u8 ctrl, pwr_down;
2002
2003	cascade = platform_get_drvdata(pdev);
2004	docg3_floors = cascade->floors;
2005	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
2006		mtd = docg3_floors[floor];
2007		if (!mtd)
2008			continue;
2009		docg3 = mtd->priv;
2010
2011		doc_writeb(docg3, floor, DOC_DEVICESELECT);
2012		ctrl = doc_register_readb(docg3, DOC_FLASHCONTROL);
2013		ctrl &= ~DOC_CTRL_VIOLATION & ~DOC_CTRL_CE;
2014		doc_writeb(docg3, ctrl, DOC_FLASHCONTROL);
2015
2016		for (i = 0; i < 10; i++) {
2017			usleep_range(3000, 4000);
2018			pwr_down = doc_register_readb(docg3, DOC_POWERMODE);
2019			if (pwr_down & DOC_POWERDOWN_READY)
2020				break;
2021		}
2022		if (pwr_down & DOC_POWERDOWN_READY) {
2023			doc_dbg("docg3_suspend(): floor %d powerdown ok\n",
2024				floor);
2025		} else {
2026			doc_err("docg3_suspend(): floor %d powerdown failed\n",
2027				floor);
2028			return -EIO;
2029		}
2030	}
2031
2032	mtd = docg3_floors[0];
2033	docg3 = mtd->priv;
2034	doc_set_asic_mode(docg3, DOC_ASICMODE_POWERDOWN);
2035	return 0;
2036}
2037
2038/**
2039 * doc_probe - Probe the IO space for a DiskOnChip G3 chip
2040 * @pdev: platform device
2041 *
2042 * Probes for a G3 chip at the specified IO space in the platform data
2043 * ressources. The floor 0 must be available.
2044 *
2045 * Returns 0 on success, -ENOMEM, -ENXIO on error
2046 */
2047static int __init docg3_probe(struct platform_device *pdev)
2048{
2049	struct device *dev = &pdev->dev;
2050	struct mtd_info *mtd;
2051	struct resource *ress;
2052	void __iomem *base;
2053	int ret, floor;
2054	struct docg3_cascade *cascade;
2055
2056	ret = -ENXIO;
2057	ress = platform_get_resource(pdev, IORESOURCE_MEM, 0);
2058	if (!ress) {
2059		dev_err(dev, "No I/O memory resource defined\n");
2060		return ret;
2061	}
2062	base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
2063
2064	ret = -ENOMEM;
2065	cascade = devm_kzalloc(dev, sizeof(*cascade) * DOC_MAX_NBFLOORS,
2066			       GFP_KERNEL);
2067	if (!cascade)
2068		return ret;
2069	cascade->base = base;
2070	mutex_init(&cascade->lock);
2071	cascade->bch = init_bch(DOC_ECC_BCH_M, DOC_ECC_BCH_T,
2072			     DOC_ECC_BCH_PRIMPOLY);
2073	if (!cascade->bch)
2074		return ret;
2075
2076	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
2077		mtd = doc_probe_device(cascade, floor, dev);
2078		if (IS_ERR(mtd)) {
2079			ret = PTR_ERR(mtd);
2080			goto err_probe;
2081		}
2082		if (!mtd) {
2083			if (floor == 0)
2084				goto notfound;
2085			else
2086				continue;
2087		}
2088		cascade->floors[floor] = mtd;
2089		ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
2090						0);
2091		if (ret)
2092			goto err_probe;
2093	}
2094
2095	ret = doc_register_sysfs(pdev, cascade);
2096	if (ret)
2097		goto err_probe;
2098
2099	platform_set_drvdata(pdev, cascade);
2100	doc_dbg_register(cascade->floors[0]->priv);
2101	return 0;
2102
2103notfound:
2104	ret = -ENODEV;
2105	dev_info(dev, "No supported DiskOnChip found\n");
2106err_probe:
2107	free_bch(cascade->bch);
2108	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++)
2109		if (cascade->floors[floor])
2110			doc_release_device(cascade->floors[floor]);
2111	return ret;
2112}
2113
2114/**
2115 * docg3_release - Release the driver
2116 * @pdev: the platform device
2117 *
2118 * Returns 0
2119 */
2120static int docg3_release(struct platform_device *pdev)
2121{
2122	struct docg3_cascade *cascade = platform_get_drvdata(pdev);
2123	struct docg3 *docg3 = cascade->floors[0]->priv;
2124	int floor;
2125
2126	doc_unregister_sysfs(pdev, cascade);
2127	doc_dbg_unregister(docg3);
2128	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++)
2129		if (cascade->floors[floor])
2130			doc_release_device(cascade->floors[floor]);
2131
2132	free_bch(docg3->cascade->bch);
2133	return 0;
2134}
2135
2136#ifdef CONFIG_OF
2137static const struct of_device_id docg3_dt_ids[] = {
2138	{ .compatible = "m-systems,diskonchip-g3" },
2139	{}
2140};
2141MODULE_DEVICE_TABLE(of, docg3_dt_ids);
2142#endif
2143
2144static struct platform_driver g3_driver = {
2145	.driver		= {
2146		.name	= "docg3",
2147		.of_match_table = of_match_ptr(docg3_dt_ids),
2148	},
2149	.suspend	= docg3_suspend,
2150	.resume		= docg3_resume,
2151	.remove		= docg3_release,
2152};
2153
2154module_platform_driver_probe(g3_driver, docg3_probe);
2155
2156MODULE_LICENSE("GPL");
2157MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>");
2158MODULE_DESCRIPTION("MTD driver for DiskOnChip G3");