1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Common Flash Interface support:
   4 *   Intel Extended Vendor Command Set (ID 0x0001)
   5 *
   6 * (C) 2000 Red Hat.
   7 *
   8 *
   9 * 10/10/2000	Nicolas Pitre <nico@fluxnic.net>
  10 * 	- completely revamped method functions so they are aware and
  11 * 	  independent of the flash geometry (buswidth, interleave, etc.)
  12 * 	- scalability vs code size is completely set at compile-time
  13 * 	  (see include/linux/mtd/cfi.h for selection)
  14 *	- optimized write buffer method
  15 * 02/05/2002	Christopher Hoover <ch@hpl.hp.com>/<ch@murgatroid.com>
  16 *	- reworked lock/unlock/erase support for var size flash
  17 * 21/03/2007   Rodolfo Giometti <giometti@linux.it>
  18 * 	- auto unlock sectors on resume for auto locking flash on power up
  19 */
  20
  21#include <linux/module.h>
  22#include <linux/types.h>
  23#include <linux/kernel.h>
  24#include <linux/sched.h>
  25#include <asm/io.h>
  26#include <asm/byteorder.h>
  27
  28#include <linux/errno.h>
  29#include <linux/slab.h>
  30#include <linux/delay.h>
  31#include <linux/interrupt.h>
  32#include <linux/reboot.h>
  33#include <linux/bitmap.h>
  34#include <linux/mtd/xip.h>
  35#include <linux/mtd/map.h>
  36#include <linux/mtd/mtd.h>
  37#include <linux/mtd/cfi.h>
  38
  39/* #define CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE */
  40/* #define CMDSET0001_DISABLE_WRITE_SUSPEND */
  41
  42// debugging, turns off buffer write mode if set to 1
  43#define FORCE_WORD_WRITE 0
  44
  45/* Intel chips */
  46#define I82802AB	0x00ad
  47#define I82802AC	0x00ac
  48#define PF38F4476	0x881c
  49#define M28F00AP30	0x8963
  50/* STMicroelectronics chips */
  51#define M50LPW080       0x002F
  52#define M50FLW080A	0x0080
  53#define M50FLW080B	0x0081
  54/* Atmel chips */
  55#define AT49BV640D	0x02de
  56#define AT49BV640DT	0x02db
  57/* Sharp chips */
  58#define LH28F640BFHE_PTTL90	0x00b0
  59#define LH28F640BFHE_PBTL90	0x00b1
  60#define LH28F640BFHE_PTTL70A	0x00b2
  61#define LH28F640BFHE_PBTL70A	0x00b3
  62
  63static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  64static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
  65static int cfi_intelext_write_buffers(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
  66static int cfi_intelext_writev(struct mtd_info *, const struct kvec *, unsigned long, loff_t, size_t *);
  67static int cfi_intelext_erase_varsize(struct mtd_info *, struct erase_info *);
  68static void cfi_intelext_sync (struct mtd_info *);
  69static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
  70static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
  71static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
  72				  uint64_t len);
  73#ifdef CONFIG_MTD_OTP
  74static int cfi_intelext_read_fact_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  75static int cfi_intelext_read_user_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  76static int cfi_intelext_write_user_prot_reg(struct mtd_info *, loff_t, size_t,
  77					    size_t *, const u_char *);
  78static int cfi_intelext_lock_user_prot_reg (struct mtd_info *, loff_t, size_t);
  79static int cfi_intelext_get_fact_prot_info(struct mtd_info *, size_t,
  80					   size_t *, struct otp_info *);
  81static int cfi_intelext_get_user_prot_info(struct mtd_info *, size_t,
  82					   size_t *, struct otp_info *);
  83#endif
  84static int cfi_intelext_suspend (struct mtd_info *);
  85static void cfi_intelext_resume (struct mtd_info *);
  86static int cfi_intelext_reboot (struct notifier_block *, unsigned long, void *);
  87
  88static void cfi_intelext_destroy(struct mtd_info *);
  89
  90struct mtd_info *cfi_cmdset_0001(struct map_info *, int);
  91
  92static struct mtd_info *cfi_intelext_setup (struct mtd_info *);
  93static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **);
  94
  95static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
  96		     size_t *retlen, void **virt, resource_size_t *phys);
  97static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
  98
  99static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 100static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 101static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr);
 102#include "fwh_lock.h"
 103
 104
 105
 106/*
 107 *  *********** SETUP AND PROBE BITS  ***********
 108 */
 109
 110static struct mtd_chip_driver cfi_intelext_chipdrv = {
 111	.probe		= NULL, /* Not usable directly */
 112	.destroy	= cfi_intelext_destroy,
 113	.name		= "cfi_cmdset_0001",
 114	.module		= THIS_MODULE
 115};
 116
 117/* #define DEBUG_LOCK_BITS */
 118/* #define DEBUG_CFI_FEATURES */
 119
 120#ifdef DEBUG_CFI_FEATURES
 121static void cfi_tell_features(struct cfi_pri_intelext *extp)
 122{
 123	int i;
 124	printk("  Extended Query version %c.%c\n", extp->MajorVersion, extp->MinorVersion);
 125	printk("  Feature/Command Support:      %4.4X\n", extp->FeatureSupport);
 126	printk("     - Chip Erase:              %s\n", extp->FeatureSupport&1?"supported":"unsupported");
 127	printk("     - Suspend Erase:           %s\n", extp->FeatureSupport&2?"supported":"unsupported");
 128	printk("     - Suspend Program:         %s\n", extp->FeatureSupport&4?"supported":"unsupported");
 129	printk("     - Legacy Lock/Unlock:      %s\n", extp->FeatureSupport&8?"supported":"unsupported");
 130	printk("     - Queued Erase:            %s\n", extp->FeatureSupport&16?"supported":"unsupported");
 131	printk("     - Instant block lock:      %s\n", extp->FeatureSupport&32?"supported":"unsupported");
 132	printk("     - Protection Bits:         %s\n", extp->FeatureSupport&64?"supported":"unsupported");
 133	printk("     - Page-mode read:          %s\n", extp->FeatureSupport&128?"supported":"unsupported");
 134	printk("     - Synchronous read:        %s\n", extp->FeatureSupport&256?"supported":"unsupported");
 135	printk("     - Simultaneous operations: %s\n", extp->FeatureSupport&512?"supported":"unsupported");
 136	printk("     - Extended Flash Array:    %s\n", extp->FeatureSupport&1024?"supported":"unsupported");
 137	for (i=11; i<32; i++) {
 138		if (extp->FeatureSupport & (1<<i))
 139			printk("     - Unknown Bit %X:      supported\n", i);
 140	}
 141
 142	printk("  Supported functions after Suspend: %2.2X\n", extp->SuspendCmdSupport);
 143	printk("     - Program after Erase Suspend: %s\n", extp->SuspendCmdSupport&1?"supported":"unsupported");
 144	for (i=1; i<8; i++) {
 145		if (extp->SuspendCmdSupport & (1<<i))
 146			printk("     - Unknown Bit %X:               supported\n", i);
 147	}
 148
 149	printk("  Block Status Register Mask: %4.4X\n", extp->BlkStatusRegMask);
 150	printk("     - Lock Bit Active:      %s\n", extp->BlkStatusRegMask&1?"yes":"no");
 151	printk("     - Lock-Down Bit Active: %s\n", extp->BlkStatusRegMask&2?"yes":"no");
 152	for (i=2; i<3; i++) {
 153		if (extp->BlkStatusRegMask & (1<<i))
 154			printk("     - Unknown Bit %X Active: yes\n",i);
 155	}
 156	printk("     - EFA Lock Bit:         %s\n", extp->BlkStatusRegMask&16?"yes":"no");
 157	printk("     - EFA Lock-Down Bit:    %s\n", extp->BlkStatusRegMask&32?"yes":"no");
 158	for (i=6; i<16; i++) {
 159		if (extp->BlkStatusRegMask & (1<<i))
 160			printk("     - Unknown Bit %X Active: yes\n",i);
 161	}
 162
 163	printk("  Vcc Logic Supply Optimum Program/Erase Voltage: %d.%d V\n",
 164	       extp->VccOptimal >> 4, extp->VccOptimal & 0xf);
 165	if (extp->VppOptimal)
 166		printk("  Vpp Programming Supply Optimum Program/Erase Voltage: %d.%d V\n",
 167		       extp->VppOptimal >> 4, extp->VppOptimal & 0xf);
 168}
 169#endif
 170
 171/* Atmel chips don't use the same PRI format as Intel chips */
 172static void fixup_convert_atmel_pri(struct mtd_info *mtd)
 173{
 174	struct map_info *map = mtd->priv;
 175	struct cfi_private *cfi = map->fldrv_priv;
 176	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 177	struct cfi_pri_atmel atmel_pri;
 178	uint32_t features = 0;
 179
 180	/* Reverse byteswapping */
 181	extp->FeatureSupport = cpu_to_le32(extp->FeatureSupport);
 182	extp->BlkStatusRegMask = cpu_to_le16(extp->BlkStatusRegMask);
 183	extp->ProtRegAddr = cpu_to_le16(extp->ProtRegAddr);
 184
 185	memcpy(&atmel_pri, extp, sizeof(atmel_pri));
 186	memset((char *)extp + 5, 0, sizeof(*extp) - 5);
 187
 188	printk(KERN_ERR "atmel Features: %02x\n", atmel_pri.Features);
 189
 190	if (atmel_pri.Features & 0x01) /* chip erase supported */
 191		features |= (1<<0);
 192	if (atmel_pri.Features & 0x02) /* erase suspend supported */
 193		features |= (1<<1);
 194	if (atmel_pri.Features & 0x04) /* program suspend supported */
 195		features |= (1<<2);
 196	if (atmel_pri.Features & 0x08) /* simultaneous operations supported */
 197		features |= (1<<9);
 198	if (atmel_pri.Features & 0x20) /* page mode read supported */
 199		features |= (1<<7);
 200	if (atmel_pri.Features & 0x40) /* queued erase supported */
 201		features |= (1<<4);
 202	if (atmel_pri.Features & 0x80) /* Protection bits supported */
 203		features |= (1<<6);
 204
 205	extp->FeatureSupport = features;
 206
 207	/* burst write mode not supported */
 208	cfi->cfiq->BufWriteTimeoutTyp = 0;
 209	cfi->cfiq->BufWriteTimeoutMax = 0;
 210}
 211
 212static void fixup_at49bv640dx_lock(struct mtd_info *mtd)
 213{
 214	struct map_info *map = mtd->priv;
 215	struct cfi_private *cfi = map->fldrv_priv;
 216	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 217
 218	cfip->FeatureSupport |= (1 << 5);
 219	mtd->flags |= MTD_POWERUP_LOCK;
 220}
 221
 222#ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 223/* Some Intel Strata Flash prior to FPO revision C has bugs in this area */
 224static void fixup_intel_strataflash(struct mtd_info *mtd)
 225{
 226	struct map_info *map = mtd->priv;
 227	struct cfi_private *cfi = map->fldrv_priv;
 228	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 229
 230	printk(KERN_WARNING "cfi_cmdset_0001: Suspend "
 231	                    "erase on write disabled.\n");
 232	extp->SuspendCmdSupport &= ~1;
 233}
 234#endif
 235
 236#ifdef CMDSET0001_DISABLE_WRITE_SUSPEND
 237static void fixup_no_write_suspend(struct mtd_info *mtd)
 238{
 239	struct map_info *map = mtd->priv;
 240	struct cfi_private *cfi = map->fldrv_priv;
 241	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 242
 243	if (cfip && (cfip->FeatureSupport&4)) {
 244		cfip->FeatureSupport &= ~4;
 245		printk(KERN_WARNING "cfi_cmdset_0001: write suspend disabled\n");
 246	}
 247}
 248#endif
 249
 250static void fixup_st_m28w320ct(struct mtd_info *mtd)
 251{
 252	struct map_info *map = mtd->priv;
 253	struct cfi_private *cfi = map->fldrv_priv;
 254
 255	cfi->cfiq->BufWriteTimeoutTyp = 0;	/* Not supported */
 256	cfi->cfiq->BufWriteTimeoutMax = 0;	/* Not supported */
 257}
 258
 259static void fixup_st_m28w320cb(struct mtd_info *mtd)
 260{
 261	struct map_info *map = mtd->priv;
 262	struct cfi_private *cfi = map->fldrv_priv;
 263
 264	/* Note this is done after the region info is endian swapped */
 265	cfi->cfiq->EraseRegionInfo[1] =
 266		(cfi->cfiq->EraseRegionInfo[1] & 0xffff0000) | 0x3e;
 267};
 268
 269static int is_LH28F640BF(struct cfi_private *cfi)
 270{
 271	/* Sharp LH28F640BF Family */
 272	if (cfi->mfr == CFI_MFR_SHARP && (
 273	    cfi->id == LH28F640BFHE_PTTL90 || cfi->id == LH28F640BFHE_PBTL90 ||
 274	    cfi->id == LH28F640BFHE_PTTL70A || cfi->id == LH28F640BFHE_PBTL70A))
 275		return 1;
 276	return 0;
 277}
 278
 279static void fixup_LH28F640BF(struct mtd_info *mtd)
 280{
 281	struct map_info *map = mtd->priv;
 282	struct cfi_private *cfi = map->fldrv_priv;
 283	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 284
 285	/* Reset the Partition Configuration Register on LH28F640BF
 286	 * to a single partition (PCR = 0x000): PCR is embedded into A0-A15. */
 287	if (is_LH28F640BF(cfi)) {
 288		printk(KERN_INFO "Reset Partition Config. Register: 1 Partition of 4 planes\n");
 289		map_write(map, CMD(0x60), 0);
 290		map_write(map, CMD(0x04), 0);
 291
 292		/* We have set one single partition thus
 293		 * Simultaneous Operations are not allowed */
 294		printk(KERN_INFO "cfi_cmdset_0001: Simultaneous Operations disabled\n");
 295		extp->FeatureSupport &= ~512;
 296	}
 297}
 298
 299static void fixup_use_point(struct mtd_info *mtd)
 300{
 301	struct map_info *map = mtd->priv;
 302	if (!mtd->_point && map_is_linear(map)) {
 303		mtd->_point   = cfi_intelext_point;
 304		mtd->_unpoint = cfi_intelext_unpoint;
 305	}
 306}
 307
 308static void fixup_use_write_buffers(struct mtd_info *mtd)
 309{
 310	struct map_info *map = mtd->priv;
 311	struct cfi_private *cfi = map->fldrv_priv;
 312	if (cfi->cfiq->BufWriteTimeoutTyp) {
 313		printk(KERN_INFO "Using buffer write method\n" );
 314		mtd->_write = cfi_intelext_write_buffers;
 315		mtd->_writev = cfi_intelext_writev;
 316	}
 317}
 318
 319/*
 320 * Some chips power-up with all sectors locked by default.
 321 */
 322static void fixup_unlock_powerup_lock(struct mtd_info *mtd)
 323{
 324	struct map_info *map = mtd->priv;
 325	struct cfi_private *cfi = map->fldrv_priv;
 326	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 327
 328	if (cfip->FeatureSupport&32) {
 329		printk(KERN_INFO "Using auto-unlock on power-up/resume\n" );
 330		mtd->flags |= MTD_POWERUP_LOCK;
 331	}
 332}
 333
 334static struct cfi_fixup cfi_fixup_table[] = {
 335	{ CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri },
 336	{ CFI_MFR_ATMEL, AT49BV640D, fixup_at49bv640dx_lock },
 337	{ CFI_MFR_ATMEL, AT49BV640DT, fixup_at49bv640dx_lock },
 338#ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 339	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_intel_strataflash },
 340#endif
 341#ifdef CMDSET0001_DISABLE_WRITE_SUSPEND
 342	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_no_write_suspend },
 343#endif
 344#if !FORCE_WORD_WRITE
 345	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers },
 346#endif
 347	{ CFI_MFR_ST, 0x00ba, /* M28W320CT */ fixup_st_m28w320ct },
 348	{ CFI_MFR_ST, 0x00bb, /* M28W320CB */ fixup_st_m28w320cb },
 349	{ CFI_MFR_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock },
 350	{ CFI_MFR_SHARP, CFI_ID_ANY, fixup_unlock_powerup_lock },
 351	{ CFI_MFR_SHARP, CFI_ID_ANY, fixup_LH28F640BF },
 352	{ 0, 0, NULL }
 353};
 354
 355static struct cfi_fixup jedec_fixup_table[] = {
 356	{ CFI_MFR_INTEL, I82802AB,   fixup_use_fwh_lock },
 357	{ CFI_MFR_INTEL, I82802AC,   fixup_use_fwh_lock },
 358	{ CFI_MFR_ST,    M50LPW080,  fixup_use_fwh_lock },
 359	{ CFI_MFR_ST,    M50FLW080A, fixup_use_fwh_lock },
 360	{ CFI_MFR_ST,    M50FLW080B, fixup_use_fwh_lock },
 361	{ 0, 0, NULL }
 362};
 363static struct cfi_fixup fixup_table[] = {
 364	/* The CFI vendor ids and the JEDEC vendor IDs appear
 365	 * to be common.  It is like the devices id's are as
 366	 * well.  This table is to pick all cases where
 367	 * we know that is the case.
 368	 */
 369	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_use_point },
 370	{ 0, 0, NULL }
 371};
 372
 373static void cfi_fixup_major_minor(struct cfi_private *cfi,
 374						struct cfi_pri_intelext *extp)
 375{
 376	if (cfi->mfr == CFI_MFR_INTEL &&
 377			cfi->id == PF38F4476 && extp->MinorVersion == '3')
 378		extp->MinorVersion = '1';
 379}
 380
 381static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
 382{
 383	/*
 384	 * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
 385	 * Erase Supend for their small Erase Blocks(0x8000)
 386	 */
 387	if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
 388		return 1;
 389	return 0;
 390}
 391
 392static inline struct cfi_pri_intelext *
 393read_pri_intelext(struct map_info *map, __u16 adr)
 394{
 395	struct cfi_private *cfi = map->fldrv_priv;
 396	struct cfi_pri_intelext *extp;
 397	unsigned int extra_size = 0;
 398	unsigned int extp_size = sizeof(*extp);
 399
 400 again:
 401	extp = (struct cfi_pri_intelext *)cfi_read_pri(map, adr, extp_size, "Intel/Sharp");
 402	if (!extp)
 403		return NULL;
 404
 405	cfi_fixup_major_minor(cfi, extp);
 406
 407	if (extp->MajorVersion != '1' ||
 408	    (extp->MinorVersion < '0' || extp->MinorVersion > '5')) {
 409		printk(KERN_ERR "  Unknown Intel/Sharp Extended Query "
 410		       "version %c.%c.\n",  extp->MajorVersion,
 411		       extp->MinorVersion);
 412		kfree(extp);
 413		return NULL;
 414	}
 415
 416	/* Do some byteswapping if necessary */
 417	extp->FeatureSupport = le32_to_cpu(extp->FeatureSupport);
 418	extp->BlkStatusRegMask = le16_to_cpu(extp->BlkStatusRegMask);
 419	extp->ProtRegAddr = le16_to_cpu(extp->ProtRegAddr);
 420
 421	if (extp->MinorVersion >= '0') {
 422		extra_size = 0;
 423
 424		/* Protection Register info */
 425		if (extp->NumProtectionFields) {
 426			struct cfi_intelext_otpinfo *otp =
 427				(struct cfi_intelext_otpinfo *)&extp->extra[0];
 428
 429			extra_size += (extp->NumProtectionFields - 1) *
 430				sizeof(struct cfi_intelext_otpinfo);
 431
 432			if (extp_size >= sizeof(*extp) + extra_size) {
 433				int i;
 434
 435				/* Do some byteswapping if necessary */
 436				for (i = 0; i < extp->NumProtectionFields - 1; i++) {
 437					otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr);
 438					otp->FactGroups = le16_to_cpu(otp->FactGroups);
 439					otp->UserGroups = le16_to_cpu(otp->UserGroups);
 440					otp++;
 441				}
 442			}
 443		}
 444	}
 445
 446	if (extp->MinorVersion >= '1') {
 447		/* Burst Read info */
 448		extra_size += 2;
 449		if (extp_size < sizeof(*extp) + extra_size)
 450			goto need_more;
 451		extra_size += extp->extra[extra_size - 1];
 452	}
 453
 454	if (extp->MinorVersion >= '3') {
 455		int nb_parts, i;
 456
 457		/* Number of hardware-partitions */
 458		extra_size += 1;
 459		if (extp_size < sizeof(*extp) + extra_size)
 460			goto need_more;
 461		nb_parts = extp->extra[extra_size - 1];
 462
 463		/* skip the sizeof(partregion) field in CFI 1.4 */
 464		if (extp->MinorVersion >= '4')
 465			extra_size += 2;
 466
 467		for (i = 0; i < nb_parts; i++) {
 468			struct cfi_intelext_regioninfo *rinfo;
 469			rinfo = (struct cfi_intelext_regioninfo *)&extp->extra[extra_size];
 470			extra_size += sizeof(*rinfo);
 471			if (extp_size < sizeof(*extp) + extra_size)
 472				goto need_more;
 473			rinfo->NumIdentPartitions=le16_to_cpu(rinfo->NumIdentPartitions);
 474			extra_size += (rinfo->NumBlockTypes - 1)
 475				      * sizeof(struct cfi_intelext_blockinfo);
 476		}
 477
 478		if (extp->MinorVersion >= '4')
 479			extra_size += sizeof(struct cfi_intelext_programming_regioninfo);
 480
 481		if (extp_size < sizeof(*extp) + extra_size) {
 482			need_more:
 483			extp_size = sizeof(*extp) + extra_size;
 484			kfree(extp);
 485			if (extp_size > 4096) {
 486				printk(KERN_ERR
 487					"%s: cfi_pri_intelext is too fat\n",
 488					__func__);
 489				return NULL;
 490			}
 491			goto again;
 492		}
 493	}
 494
 495	return extp;
 496}
 497
 498struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
 499{
 500	struct cfi_private *cfi = map->fldrv_priv;
 501	struct mtd_info *mtd;
 502	int i;
 503
 504	mtd = kzalloc(sizeof(*mtd), GFP_KERNEL);
 505	if (!mtd)
 506		return NULL;
 507	mtd->priv = map;
 508	mtd->type = MTD_NORFLASH;
 509
 510	/* Fill in the default mtd operations */
 511	mtd->_erase   = cfi_intelext_erase_varsize;
 512	mtd->_read    = cfi_intelext_read;
 513	mtd->_write   = cfi_intelext_write_words;
 514	mtd->_sync    = cfi_intelext_sync;
 515	mtd->_lock    = cfi_intelext_lock;
 516	mtd->_unlock  = cfi_intelext_unlock;
 517	mtd->_is_locked = cfi_intelext_is_locked;
 518	mtd->_suspend = cfi_intelext_suspend;
 519	mtd->_resume  = cfi_intelext_resume;
 520	mtd->flags   = MTD_CAP_NORFLASH;
 521	mtd->name    = map->name;
 522	mtd->writesize = 1;
 523	mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
 524
 525	mtd->reboot_notifier.notifier_call = cfi_intelext_reboot;
 526
 527	if (cfi->cfi_mode == CFI_MODE_CFI) {
 528		/*
 529		 * It's a real CFI chip, not one for which the probe
 530		 * routine faked a CFI structure. So we read the feature
 531		 * table from it.
 532		 */
 533		__u16 adr = primary?cfi->cfiq->P_ADR:cfi->cfiq->A_ADR;
 534		struct cfi_pri_intelext *extp;
 535
 536		extp = read_pri_intelext(map, adr);
 537		if (!extp) {
 538			kfree(mtd);
 539			return NULL;
 540		}
 541
 542		/* Install our own private info structure */
 543		cfi->cmdset_priv = extp;
 544
 545		cfi_fixup(mtd, cfi_fixup_table);
 546
 547#ifdef DEBUG_CFI_FEATURES
 548		/* Tell the user about it in lots of lovely detail */
 549		cfi_tell_features(extp);
 550#endif
 551
 552		if(extp->SuspendCmdSupport & 1) {
 553			printk(KERN_NOTICE "cfi_cmdset_0001: Erase suspend on write enabled\n");
 554		}
 555	}
 556	else if (cfi->cfi_mode == CFI_MODE_JEDEC) {
 557		/* Apply jedec specific fixups */
 558		cfi_fixup(mtd, jedec_fixup_table);
 559	}
 560	/* Apply generic fixups */
 561	cfi_fixup(mtd, fixup_table);
 562
 563	for (i=0; i< cfi->numchips; i++) {
 564		if (cfi->cfiq->WordWriteTimeoutTyp)
 565			cfi->chips[i].word_write_time =
 566				1<<cfi->cfiq->WordWriteTimeoutTyp;
 567		else
 568			cfi->chips[i].word_write_time = 50000;
 569
 570		if (cfi->cfiq->BufWriteTimeoutTyp)
 571			cfi->chips[i].buffer_write_time =
 572				1<<cfi->cfiq->BufWriteTimeoutTyp;
 573		/* No default; if it isn't specified, we won't use it */
 574
 575		if (cfi->cfiq->BlockEraseTimeoutTyp)
 576			cfi->chips[i].erase_time =
 577				1000<<cfi->cfiq->BlockEraseTimeoutTyp;
 578		else
 579			cfi->chips[i].erase_time = 2000000;
 580
 581		if (cfi->cfiq->WordWriteTimeoutTyp &&
 582		    cfi->cfiq->WordWriteTimeoutMax)
 583			cfi->chips[i].word_write_time_max =
 584				1<<(cfi->cfiq->WordWriteTimeoutTyp +
 585				    cfi->cfiq->WordWriteTimeoutMax);
 586		else
 587			cfi->chips[i].word_write_time_max = 50000 * 8;
 588
 589		if (cfi->cfiq->BufWriteTimeoutTyp &&
 590		    cfi->cfiq->BufWriteTimeoutMax)
 591			cfi->chips[i].buffer_write_time_max =
 592				1<<(cfi->cfiq->BufWriteTimeoutTyp +
 593				    cfi->cfiq->BufWriteTimeoutMax);
 594
 595		if (cfi->cfiq->BlockEraseTimeoutTyp &&
 596		    cfi->cfiq->BlockEraseTimeoutMax)
 597			cfi->chips[i].erase_time_max =
 598				1000<<(cfi->cfiq->BlockEraseTimeoutTyp +
 599				       cfi->cfiq->BlockEraseTimeoutMax);
 600		else
 601			cfi->chips[i].erase_time_max = 2000000 * 8;
 602
 603		cfi->chips[i].ref_point_counter = 0;
 604		init_waitqueue_head(&(cfi->chips[i].wq));
 605	}
 606
 607	map->fldrv = &cfi_intelext_chipdrv;
 608
 609	return cfi_intelext_setup(mtd);
 610}
 611struct mtd_info *cfi_cmdset_0003(struct map_info *map, int primary) __attribute__((alias("cfi_cmdset_0001")));
 612struct mtd_info *cfi_cmdset_0200(struct map_info *map, int primary) __attribute__((alias("cfi_cmdset_0001")));
 613EXPORT_SYMBOL_GPL(cfi_cmdset_0001);
 614EXPORT_SYMBOL_GPL(cfi_cmdset_0003);
 615EXPORT_SYMBOL_GPL(cfi_cmdset_0200);
 616
 617static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
 618{
 619	struct map_info *map = mtd->priv;
 620	struct cfi_private *cfi = map->fldrv_priv;
 621	unsigned long offset = 0;
 622	int i,j;
 623	unsigned long devsize = (1<<cfi->cfiq->DevSize) * cfi->interleave;
 624
 625	//printk(KERN_DEBUG "number of CFI chips: %d\n", cfi->numchips);
 626
 627	mtd->size = devsize * cfi->numchips;
 628
 629	mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
 630	mtd->eraseregions = kcalloc(mtd->numeraseregions,
 631				    sizeof(struct mtd_erase_region_info),
 632				    GFP_KERNEL);
 633	if (!mtd->eraseregions)
 634		goto setup_err;
 635
 636	for (i=0; i<cfi->cfiq->NumEraseRegions; i++) {
 637		unsigned long ernum, ersize;
 638		ersize = ((cfi->cfiq->EraseRegionInfo[i] >> 8) & ~0xff) * cfi->interleave;
 639		ernum = (cfi->cfiq->EraseRegionInfo[i] & 0xffff) + 1;
 640
 641		if (mtd->erasesize < ersize) {
 642			mtd->erasesize = ersize;
 643		}
 644		for (j=0; j<cfi->numchips; j++) {
 645			mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].offset = (j*devsize)+offset;
 646			mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].erasesize = ersize;
 647			mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].numblocks = ernum;
 648			mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap = kmalloc(ernum / 8 + 1, GFP_KERNEL);
 649			if (!mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap)
 650				goto setup_err;
 651		}
 652		offset += (ersize * ernum);
 653	}
 654
 655	if (offset != devsize) {
 656		/* Argh */
 657		printk(KERN_WARNING "Sum of regions (%lx) != total size of set of interleaved chips (%lx)\n", offset, devsize);
 658		goto setup_err;
 659	}
 660
 661	for (i=0; i<mtd->numeraseregions;i++){
 662		printk(KERN_DEBUG "erase region %d: offset=0x%llx,size=0x%x,blocks=%d\n",
 663		       i,(unsigned long long)mtd->eraseregions[i].offset,
 664		       mtd->eraseregions[i].erasesize,
 665		       mtd->eraseregions[i].numblocks);
 666	}
 667
 668#ifdef CONFIG_MTD_OTP
 669	mtd->_read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
 670	mtd->_read_user_prot_reg = cfi_intelext_read_user_prot_reg;
 671	mtd->_write_user_prot_reg = cfi_intelext_write_user_prot_reg;
 672	mtd->_lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
 673	mtd->_get_fact_prot_info = cfi_intelext_get_fact_prot_info;
 674	mtd->_get_user_prot_info = cfi_intelext_get_user_prot_info;
 675#endif
 676
 677	/* This function has the potential to distort the reality
 678	   a bit and therefore should be called last. */
 679	if (cfi_intelext_partition_fixup(mtd, &cfi) != 0)
 680		goto setup_err;
 681
 682	__module_get(THIS_MODULE);
 683	register_reboot_notifier(&mtd->reboot_notifier);
 684	return mtd;
 685
 686 setup_err:
 687	if (mtd->eraseregions)
 688		for (i=0; i<cfi->cfiq->NumEraseRegions; i++)
 689			for (j=0; j<cfi->numchips; j++)
 690				kfree(mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap);
 691	kfree(mtd->eraseregions);
 692	kfree(mtd);
 693	kfree(cfi->cmdset_priv);
 694	return NULL;
 695}
 696
 697static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
 698					struct cfi_private **pcfi)
 699{
 700	struct map_info *map = mtd->priv;
 701	struct cfi_private *cfi = *pcfi;
 702	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 703
 704	/*
 705	 * Probing of multi-partition flash chips.
 706	 *
 707	 * To support multiple partitions when available, we simply arrange
 708	 * for each of them to have their own flchip structure even if they
 709	 * are on the same physical chip.  This means completely recreating
 710	 * a new cfi_private structure right here which is a blatent code
 711	 * layering violation, but this is still the least intrusive
 712	 * arrangement at this point. This can be rearranged in the future
 713	 * if someone feels motivated enough.  --nico
 714	 */
 715	if (extp && extp->MajorVersion == '1' && extp->MinorVersion >= '3'
 716	    && extp->FeatureSupport & (1 << 9)) {
 717		int offs = 0;
 718		struct cfi_private *newcfi;
 719		struct flchip *chip;
 720		struct flchip_shared *shared;
 721		int numregions, numparts, partshift, numvirtchips, i, j;
 722
 723		/* Protection Register info */
 724		if (extp->NumProtectionFields)
 725			offs = (extp->NumProtectionFields - 1) *
 726			       sizeof(struct cfi_intelext_otpinfo);
 727
 728		/* Burst Read info */
 729		offs += extp->extra[offs+1]+2;
 730
 731		/* Number of partition regions */
 732		numregions = extp->extra[offs];
 733		offs += 1;
 734
 735		/* skip the sizeof(partregion) field in CFI 1.4 */
 736		if (extp->MinorVersion >= '4')
 737			offs += 2;
 738
 739		/* Number of hardware partitions */
 740		numparts = 0;
 741		for (i = 0; i < numregions; i++) {
 742			struct cfi_intelext_regioninfo *rinfo;
 743			rinfo = (struct cfi_intelext_regioninfo *)&extp->extra[offs];
 744			numparts += rinfo->NumIdentPartitions;
 745			offs += sizeof(*rinfo)
 746				+ (rinfo->NumBlockTypes - 1) *
 747				  sizeof(struct cfi_intelext_blockinfo);
 748		}
 749
 750		if (!numparts)
 751			numparts = 1;
 752
 753		/* Programming Region info */
 754		if (extp->MinorVersion >= '4') {
 755			struct cfi_intelext_programming_regioninfo *prinfo;
 756			prinfo = (struct cfi_intelext_programming_regioninfo *)&extp->extra[offs];
 757			mtd->writesize = cfi->interleave << prinfo->ProgRegShift;
 758			mtd->flags &= ~MTD_BIT_WRITEABLE;
 759			printk(KERN_DEBUG "%s: program region size/ctrl_valid/ctrl_inval = %d/%d/%d\n",
 760			       map->name, mtd->writesize,
 761			       cfi->interleave * prinfo->ControlValid,
 762			       cfi->interleave * prinfo->ControlInvalid);
 763		}
 764
 765		/*
 766		 * All functions below currently rely on all chips having
 767		 * the same geometry so we'll just assume that all hardware
 768		 * partitions are of the same size too.
 769		 */
 770		partshift = cfi->chipshift - __ffs(numparts);
 771
 772		if ((1 << partshift) < mtd->erasesize) {
 773			printk( KERN_ERR
 774				"%s: bad number of hw partitions (%d)\n",
 775				__func__, numparts);
 776			return -EINVAL;
 777		}
 778
 779		numvirtchips = cfi->numchips * numparts;
 780		newcfi = kmalloc(struct_size(newcfi, chips, numvirtchips),
 781				 GFP_KERNEL);
 782		if (!newcfi)
 783			return -ENOMEM;
 784		shared = kmalloc_array(cfi->numchips,
 785				       sizeof(struct flchip_shared),
 786				       GFP_KERNEL);
 787		if (!shared) {
 788			kfree(newcfi);
 789			return -ENOMEM;
 790		}
 791		memcpy(newcfi, cfi, sizeof(struct cfi_private));
 792		newcfi->numchips = numvirtchips;
 793		newcfi->chipshift = partshift;
 794
 795		chip = &newcfi->chips[0];
 796		for (i = 0; i < cfi->numchips; i++) {
 797			shared[i].writing = shared[i].erasing = NULL;
 798			mutex_init(&shared[i].lock);
 799			for (j = 0; j < numparts; j++) {
 800				*chip = cfi->chips[i];
 801				chip->start += j << partshift;
 802				chip->priv = &shared[i];
 803				/* those should be reset too since
 804				   they create memory references. */
 805				init_waitqueue_head(&chip->wq);
 806				mutex_init(&chip->mutex);
 807				chip++;
 808			}
 809		}
 810
 811		printk(KERN_DEBUG "%s: %d set(s) of %d interleaved chips "
 812				  "--> %d partitions of %d KiB\n",
 813				  map->name, cfi->numchips, cfi->interleave,
 814				  newcfi->numchips, 1<<(newcfi->chipshift-10));
 815
 816		map->fldrv_priv = newcfi;
 817		*pcfi = newcfi;
 818		kfree(cfi);
 819	}
 820
 821	return 0;
 822}
 823
 824/*
 825 *  *********** CHIP ACCESS FUNCTIONS ***********
 826 */
 827static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode)
 828{
 829	DECLARE_WAITQUEUE(wait, current);
 830	struct cfi_private *cfi = map->fldrv_priv;
 831	map_word status, status_OK = CMD(0x80), status_PWS = CMD(0x01);
 832	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 833	unsigned long timeo = jiffies + HZ;
 834
 835	/* Prevent setting state FL_SYNCING for chip in suspended state. */
 836	if (mode == FL_SYNCING && chip->oldstate != FL_READY)
 837		goto sleep;
 838
 839	switch (chip->state) {
 840
 841	case FL_STATUS:
 842		for (;;) {
 843			status = map_read(map, adr);
 844			if (map_word_andequal(map, status, status_OK, status_OK))
 845				break;
 846
 847			/* At this point we're fine with write operations
 848			   in other partitions as they don't conflict. */
 849			if (chip->priv && map_word_andequal(map, status, status_PWS, status_PWS))
 850				break;
 851
 852			mutex_unlock(&chip->mutex);
 853			cfi_udelay(1);
 854			mutex_lock(&chip->mutex);
 855			/* Someone else might have been playing with it. */
 856			return -EAGAIN;
 857		}
 858		fallthrough;
 859	case FL_READY:
 860	case FL_CFI_QUERY:
 861	case FL_JEDEC_QUERY:
 862		return 0;
 863
 864	case FL_ERASING:
 865		if (!cfip ||
 866		    !(cfip->FeatureSupport & 2) ||
 867		    !(mode == FL_READY || mode == FL_POINT ||
 868		     (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
 869			goto sleep;
 870
 871		/* Do not allow suspend iff read/write to EB address */
 872		if ((adr & chip->in_progress_block_mask) ==
 873		    chip->in_progress_block_addr)
 874			goto sleep;
 875
 876		/* do not suspend small EBs, buggy Micron Chips */
 877		if (cfi_is_micron_28F00AP30(cfi, chip) &&
 878		    (chip->in_progress_block_mask == ~(0x8000-1)))
 879			goto sleep;
 880
 881		/* Erase suspend */
 882		map_write(map, CMD(0xB0), chip->in_progress_block_addr);
 883
 884		/* If the flash has finished erasing, then 'erase suspend'
 885		 * appears to make some (28F320) flash devices switch to
 886		 * 'read' mode.  Make sure that we switch to 'read status'
 887		 * mode so we get the right data. --rmk
 888		 */
 889		map_write(map, CMD(0x70), chip->in_progress_block_addr);
 890		chip->oldstate = FL_ERASING;
 891		chip->state = FL_ERASE_SUSPENDING;
 892		chip->erase_suspended = 1;
 893		for (;;) {
 894			status = map_read(map, chip->in_progress_block_addr);
 895			if (map_word_andequal(map, status, status_OK, status_OK))
 896			        break;
 897
 898			if (time_after(jiffies, timeo)) {
 899				/* Urgh. Resume and pretend we weren't here.
 900				 * Make sure we're in 'read status' mode if it had finished */
 901				put_chip(map, chip, adr);
 902				printk(KERN_ERR "%s: Chip not ready after erase "
 903				       "suspended: status = 0x%lx\n", map->name, status.x[0]);
 904				return -EIO;
 905			}
 906
 907			mutex_unlock(&chip->mutex);
 908			cfi_udelay(1);
 909			mutex_lock(&chip->mutex);
 910			/* Nobody will touch it while it's in state FL_ERASE_SUSPENDING.
 911			   So we can just loop here. */
 912		}
 913		chip->state = FL_STATUS;
 914		return 0;
 915
 916	case FL_XIP_WHILE_ERASING:
 917		if (mode != FL_READY && mode != FL_POINT &&
 918		    (mode != FL_WRITING || !cfip || !(cfip->SuspendCmdSupport&1)))
 919			goto sleep;
 920		chip->oldstate = chip->state;
 921		chip->state = FL_READY;
 922		return 0;
 923
 924	case FL_SHUTDOWN:
 925		/* The machine is rebooting now,so no one can get chip anymore */
 926		return -EIO;
 927	case FL_POINT:
 928		/* Only if there's no operation suspended... */
 929		if (mode == FL_READY && chip->oldstate == FL_READY)
 930			return 0;
 931		fallthrough;
 932	default:
 933	sleep:
 934		set_current_state(TASK_UNINTERRUPTIBLE);
 935		add_wait_queue(&chip->wq, &wait);
 936		mutex_unlock(&chip->mutex);
 937		schedule();
 938		remove_wait_queue(&chip->wq, &wait);
 939		mutex_lock(&chip->mutex);
 940		return -EAGAIN;
 941	}
 942}
 943
 944static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode)
 945{
 946	int ret;
 947	DECLARE_WAITQUEUE(wait, current);
 948
 949 retry:
 950	if (chip->priv &&
 951	    (mode == FL_WRITING || mode == FL_ERASING || mode == FL_OTP_WRITE
 952	    || mode == FL_SHUTDOWN) && chip->state != FL_SYNCING) {
 953		/*
 954		 * OK. We have possibility for contention on the write/erase
 955		 * operations which are global to the real chip and not per
 956		 * partition.  So let's fight it over in the partition which
 957		 * currently has authority on the operation.
 958		 *
 959		 * The rules are as follows:
 960		 *
 961		 * - any write operation must own shared->writing.
 962		 *
 963		 * - any erase operation must own _both_ shared->writing and
 964		 *   shared->erasing.
 965		 *
 966		 * - contention arbitration is handled in the owner's context.
 967		 *
 968		 * The 'shared' struct can be read and/or written only when
 969		 * its lock is taken.
 970		 */
 971		struct flchip_shared *shared = chip->priv;
 972		struct flchip *contender;
 973		mutex_lock(&shared->lock);
 974		contender = shared->writing;
 975		if (contender && contender != chip) {
 976			/*
 977			 * The engine to perform desired operation on this
 978			 * partition is already in use by someone else.
 979			 * Let's fight over it in the context of the chip
 980			 * currently using it.  If it is possible to suspend,
 981			 * that other partition will do just that, otherwise
 982			 * it'll happily send us to sleep.  In any case, when
 983			 * get_chip returns success we're clear to go ahead.
 984			 */
 985			ret = mutex_trylock(&contender->mutex);
 986			mutex_unlock(&shared->lock);
 987			if (!ret)
 988				goto retry;
 989			mutex_unlock(&chip->mutex);
 990			ret = chip_ready(map, contender, contender->start, mode);
 991			mutex_lock(&chip->mutex);
 992
 993			if (ret == -EAGAIN) {
 994				mutex_unlock(&contender->mutex);
 995				goto retry;
 996			}
 997			if (ret) {
 998				mutex_unlock(&contender->mutex);
 999				return ret;
1000			}
1001			mutex_lock(&shared->lock);
1002
1003			/* We should not own chip if it is already
1004			 * in FL_SYNCING state. Put contender and retry. */
1005			if (chip->state == FL_SYNCING) {
1006				put_chip(map, contender, contender->start);
1007				mutex_unlock(&contender->mutex);
1008				goto retry;
1009			}
1010			mutex_unlock(&contender->mutex);
1011		}
1012
1013		/* Check if we already have suspended erase
1014		 * on this chip. Sleep. */
1015		if (mode == FL_ERASING && shared->erasing
1016		    && shared->erasing->oldstate == FL_ERASING) {
1017			mutex_unlock(&shared->lock);
1018			set_current_state(TASK_UNINTERRUPTIBLE);
1019			add_wait_queue(&chip->wq, &wait);
1020			mutex_unlock(&chip->mutex);
1021			schedule();
1022			remove_wait_queue(&chip->wq, &wait);
1023			mutex_lock(&chip->mutex);
1024			goto retry;
1025		}
1026
1027		/* We now own it */
1028		shared->writing = chip;
1029		if (mode == FL_ERASING)
1030			shared->erasing = chip;
1031		mutex_unlock(&shared->lock);
1032	}
1033	ret = chip_ready(map, chip, adr, mode);
1034	if (ret == -EAGAIN)
1035		goto retry;
1036
1037	return ret;
1038}
1039
1040static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr)
1041{
1042	struct cfi_private *cfi = map->fldrv_priv;
1043
1044	if (chip->priv) {
1045		struct flchip_shared *shared = chip->priv;
1046		mutex_lock(&shared->lock);
1047		if (shared->writing == chip && chip->oldstate == FL_READY) {
1048			/* We own the ability to write, but we're done */
1049			shared->writing = shared->erasing;
1050			if (shared->writing && shared->writing != chip) {
1051				/* give back ownership to who we loaned it from */
1052				struct flchip *loaner = shared->writing;
1053				mutex_lock(&loaner->mutex);
1054				mutex_unlock(&shared->lock);
1055				mutex_unlock(&chip->mutex);
1056				put_chip(map, loaner, loaner->start);
1057				mutex_lock(&chip->mutex);
1058				mutex_unlock(&loaner->mutex);
1059				wake_up(&chip->wq);
1060				return;
1061			}
1062			shared->erasing = NULL;
1063			shared->writing = NULL;
1064		} else if (shared->erasing == chip && shared->writing != chip) {
1065			/*
1066			 * We own the ability to erase without the ability
1067			 * to write, which means the erase was suspended
1068			 * and some other partition is currently writing.
1069			 * Don't let the switch below mess things up since
1070			 * we don't have ownership to resume anything.
1071			 */
1072			mutex_unlock(&shared->lock);
1073			wake_up(&chip->wq);
1074			return;
1075		}
1076		mutex_unlock(&shared->lock);
1077	}
1078
1079	switch(chip->oldstate) {
1080	case FL_ERASING:
1081		/* What if one interleaved chip has finished and the
1082		   other hasn't? The old code would leave the finished
1083		   one in READY mode. That's bad, and caused -EROFS
1084		   errors to be returned from do_erase_oneblock because
1085		   that's the only bit it checked for at the time.
1086		   As the state machine appears to explicitly allow
1087		   sending the 0x70 (Read Status) command to an erasing
1088		   chip and expecting it to be ignored, that's what we
1089		   do. */
1090		map_write(map, CMD(0xd0), chip->in_progress_block_addr);
1091		map_write(map, CMD(0x70), chip->in_progress_block_addr);
1092		chip->oldstate = FL_READY;
1093		chip->state = FL_ERASING;
1094		break;
1095
1096	case FL_XIP_WHILE_ERASING:
1097		chip->state = chip->oldstate;
1098		chip->oldstate = FL_READY;
1099		break;
1100
1101	case FL_READY:
1102	case FL_STATUS:
1103	case FL_JEDEC_QUERY:
1104		break;
1105	default:
1106		printk(KERN_ERR "%s: put_chip() called with oldstate %d!!\n", map->name, chip->oldstate);
1107	}
1108	wake_up(&chip->wq);
1109}
1110
1111#ifdef CONFIG_MTD_XIP
1112
1113/*
1114 * No interrupt what so ever can be serviced while the flash isn't in array
1115 * mode.  This is ensured by the xip_disable() and xip_enable() functions
1116 * enclosing any code path where the flash is known not to be in array mode.
1117 * And within a XIP disabled code path, only functions marked with __xipram
1118 * may be called and nothing else (it's a good thing to inspect generated
1119 * assembly to make sure inline functions were actually inlined and that gcc
1120 * didn't emit calls to its own support functions). Also configuring MTD CFI
1121 * support to a single buswidth and a single interleave is also recommended.
1122 */
1123
1124static void xip_disable(struct map_info *map, struct flchip *chip,
1125			unsigned long adr)
1126{
1127	/* TODO: chips with no XIP use should ignore and return */
1128	(void) map_read(map, adr); /* ensure mmu mapping is up to date */
1129	local_irq_disable();
1130}
1131
1132static void __xipram xip_enable(struct map_info *map, struct flchip *chip,
1133				unsigned long adr)
1134{
1135	struct cfi_private *cfi = map->fldrv_priv;
1136	if (chip->state != FL_POINT && chip->state != FL_READY) {
1137		map_write(map, CMD(0xff), adr);
1138		chip->state = FL_READY;
1139	}
1140	(void) map_read(map, adr);
1141	xip_iprefetch();
1142	local_irq_enable();
1143}
1144
1145/*
1146 * When a delay is required for the flash operation to complete, the
1147 * xip_wait_for_operation() function is polling for both the given timeout
1148 * and pending (but still masked) hardware interrupts.  Whenever there is an
1149 * interrupt pending then the flash erase or write operation is suspended,
1150 * array mode restored and interrupts unmasked.  Task scheduling might also
1151 * happen at that point.  The CPU eventually returns from the interrupt or
1152 * the call to schedule() and the suspended flash operation is resumed for
1153 * the remaining of the delay period.
1154 *
1155 * Warning: this function _will_ fool interrupt latency tracing tools.
1156 */
1157
1158static int __xipram xip_wait_for_operation(
1159		struct map_info *map, struct flchip *chip,
1160		unsigned long adr, unsigned int chip_op_time_max)
1161{
1162	struct cfi_private *cfi = map->fldrv_priv;
1163	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
1164	map_word status, OK = CMD(0x80);
1165	unsigned long usec, suspended, start, done;
1166	flstate_t oldstate, newstate;
1167
1168       	start = xip_currtime();
1169	usec = chip_op_time_max;
1170	if (usec == 0)
1171		usec = 500000;
1172	done = 0;
1173
1174	do {
1175		cpu_relax();
1176		if (xip_irqpending() && cfip &&
1177		    ((chip->state == FL_ERASING && (cfip->FeatureSupport&2)) ||
1178		     (chip->state == FL_WRITING && (cfip->FeatureSupport&4))) &&
1179		    (cfi_interleave_is_1(cfi) || chip->oldstate == FL_READY)) {
1180			/*
1181			 * Let's suspend the erase or write operation when
1182			 * supported.  Note that we currently don't try to
1183			 * suspend interleaved chips if there is already
1184			 * another operation suspended (imagine what happens
1185			 * when one chip was already done with the current
1186			 * operation while another chip suspended it, then
1187			 * we resume the whole thing at once).  Yes, it
1188			 * can happen!
1189			 */
1190			usec -= done;
1191			map_write(map, CMD(0xb0), adr);
1192			map_write(map, CMD(0x70), adr);
1193			suspended = xip_currtime();
1194			do {
1195				if (xip_elapsed_since(suspended) > 100000) {
1196					/*
1197					 * The chip doesn't want to suspend
1198					 * after waiting for 100 msecs.
1199					 * This is a critical error but there
1200					 * is not much we can do here.
1201					 */
1202					return -EIO;
1203				}
1204				status = map_read(map, adr);
1205			} while (!map_word_andequal(map, status, OK, OK));
1206
1207			/* Suspend succeeded */
1208			oldstate = chip->state;
1209			if (oldstate == FL_ERASING) {
1210				if (!map_word_bitsset(map, status, CMD(0x40)))
1211					break;
1212				newstate = FL_XIP_WHILE_ERASING;
1213				chip->erase_suspended = 1;
1214			} else {
1215				if (!map_word_bitsset(map, status, CMD(0x04)))
1216					break;
1217				newstate = FL_XIP_WHILE_WRITING;
1218				chip->write_suspended = 1;
1219			}
1220			chip->state = newstate;
1221			map_write(map, CMD(0xff), adr);
1222			(void) map_read(map, adr);
1223			xip_iprefetch();
1224			local_irq_enable();
1225			mutex_unlock(&chip->mutex);
1226			xip_iprefetch();
1227			cond_resched();
1228
1229			/*
1230			 * We're back.  However someone else might have
1231			 * decided to go write to the chip if we are in
1232			 * a suspended erase state.  If so let's wait
1233			 * until it's done.
1234			 */
1235			mutex_lock(&chip->mutex);
1236			while (chip->state != newstate) {
1237				DECLARE_WAITQUEUE(wait, current);
1238				set_current_state(TASK_UNINTERRUPTIBLE);
1239				add_wait_queue(&chip->wq, &wait);
1240				mutex_unlock(&chip->mutex);
1241				schedule();
1242				remove_wait_queue(&chip->wq, &wait);
1243				mutex_lock(&chip->mutex);
1244			}
1245			/* Disallow XIP again */
1246			local_irq_disable();
1247
1248			/* Resume the write or erase operation */
1249			map_write(map, CMD(0xd0), adr);
1250			map_write(map, CMD(0x70), adr);
1251			chip->state = oldstate;
1252			start = xip_currtime();
1253		} else if (usec >= 1000000/HZ) {
1254			/*
1255			 * Try to save on CPU power when waiting delay
1256			 * is at least a system timer tick period.
1257			 * No need to be extremely accurate here.
1258			 */
1259			xip_cpu_idle();
1260		}
1261		status = map_read(map, adr);
1262		done = xip_elapsed_since(start);
1263	} while (!map_word_andequal(map, status, OK, OK)
1264		 && done < usec);
1265
1266	return (done >= usec) ? -ETIME : 0;
1267}
1268
1269/*
1270 * The INVALIDATE_CACHED_RANGE() macro is normally used in parallel while
1271 * the flash is actively programming or erasing since we have to poll for
1272 * the operation to complete anyway.  We can't do that in a generic way with
1273 * a XIP setup so do it before the actual flash operation in this case
1274 * and stub it out from INVAL_CACHE_AND_WAIT.
1275 */
1276#define XIP_INVAL_CACHED_RANGE(map, from, size)  \
1277	INVALIDATE_CACHED_RANGE(map, from, size)
1278
1279#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec, usec_max) \
1280	xip_wait_for_operation(map, chip, cmd_adr, usec_max)
1281
1282#else
1283
1284#define xip_disable(map, chip, adr)
1285#define xip_enable(map, chip, adr)
1286#define XIP_INVAL_CACHED_RANGE(x...)
1287#define INVAL_CACHE_AND_WAIT inval_cache_and_wait_for_operation
1288
1289static int inval_cache_and_wait_for_operation(
1290		struct map_info *map, struct flchip *chip,
1291		unsigned long cmd_adr, unsigned long inval_adr, int inval_len,
1292		unsigned int chip_op_time, unsigned int chip_op_time_max)
1293{
1294	struct cfi_private *cfi = map->fldrv_priv;
1295	map_word status, status_OK = CMD(0x80);
1296	int chip_state = chip->state;
1297	unsigned int timeo, sleep_time, reset_timeo;
1298
1299	mutex_unlock(&chip->mutex);
1300	if (inval_len)
1301		INVALIDATE_CACHED_RANGE(map, inval_adr, inval_len);
1302	mutex_lock(&chip->mutex);
1303
1304	timeo = chip_op_time_max;
1305	if (!timeo)
1306		timeo = 500000;
1307	reset_timeo = timeo;
1308	sleep_time = chip_op_time / 2;
1309
1310	for (;;) {
1311		if (chip->state != chip_state) {
1312			/* Someone's suspended the operation: sleep */
1313			DECLARE_WAITQUEUE(wait, current);
1314			set_current_state(TASK_UNINTERRUPTIBLE);
1315			add_wait_queue(&chip->wq, &wait);
1316			mutex_unlock(&chip->mutex);
1317			schedule();
1318			remove_wait_queue(&chip->wq, &wait);
1319			mutex_lock(&chip->mutex);
1320			continue;
1321		}
1322
1323		status = map_read(map, cmd_adr);
1324		if (map_word_andequal(map, status, status_OK, status_OK))
1325			break;
1326
1327		if (chip->erase_suspended && chip_state == FL_ERASING)  {
1328			/* Erase suspend occurred while sleep: reset timeout */
1329			timeo = reset_timeo;
1330			chip->erase_suspended = 0;
1331		}
1332		if (chip->write_suspended && chip_state == FL_WRITING)  {
1333			/* Write suspend occurred while sleep: reset timeout */
1334			timeo = reset_timeo;
1335			chip->write_suspended = 0;
1336		}
1337		if (!timeo) {
1338			map_write(map, CMD(0x70), cmd_adr);
1339			chip->state = FL_STATUS;
1340			return -ETIME;
1341		}
1342
1343		/* OK Still waiting. Drop the lock, wait a while and retry. */
1344		mutex_unlock(&chip->mutex);
1345		if (sleep_time >= 1000000/HZ) {
1346			/*
1347			 * Half of the normal delay still remaining
1348			 * can be performed with a sleeping delay instead
1349			 * of busy waiting.
1350			 */
1351			msleep(sleep_time/1000);
1352			timeo -= sleep_time;
1353			sleep_time = 1000000/HZ;
1354		} else {
1355			udelay(1);
1356			cond_resched();
1357			timeo--;
1358		}
1359		mutex_lock(&chip->mutex);
1360	}
1361
1362	/* Done and happy. */
1363 	chip->state = FL_STATUS;
1364	return 0;
1365}
1366
1367#endif
1368
1369#define WAIT_TIMEOUT(map, chip, adr, udelay, udelay_max) \
1370	INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay, udelay_max);
1371
1372
1373static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t adr, size_t len)
1374{
1375	unsigned long cmd_addr;
1376	struct cfi_private *cfi = map->fldrv_priv;
1377	int ret;
1378
1379	adr += chip->start;
1380
1381	/* Ensure cmd read/writes are aligned. */
1382	cmd_addr = adr & ~(map_bankwidth(map)-1);
1383
1384	mutex_lock(&chip->mutex);
1385
1386	ret = get_chip(map, chip, cmd_addr, FL_POINT);
1387
1388	if (!ret) {
1389		if (chip->state != FL_POINT && chip->state != FL_READY)
1390			map_write(map, CMD(0xff), cmd_addr);
1391
1392		chip->state = FL_POINT;
1393		chip->ref_point_counter++;
1394	}
1395	mutex_unlock(&chip->mutex);
1396
1397	return ret;
1398}
1399
1400static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
1401		size_t *retlen, void **virt, resource_size_t *phys)
1402{
1403	struct map_info *map = mtd->priv;
1404	struct cfi_private *cfi = map->fldrv_priv;
1405	unsigned long ofs, last_end = 0;
1406	int chipnum;
1407	int ret;
1408
1409	if (!map->virt)
1410		return -EINVAL;
1411
1412	/* Now lock the chip(s) to POINT state */
1413
1414	/* ofs: offset within the first chip that the first read should start */
1415	chipnum = (from >> cfi->chipshift);
1416	ofs = from - (chipnum << cfi->chipshift);
1417
1418	*virt = map->virt + cfi->chips[chipnum].start + ofs;
1419	if (phys)
1420		*phys = map->phys + cfi->chips[chipnum].start + ofs;
1421
1422	while (len) {
1423		unsigned long thislen;
1424
1425		if (chipnum >= cfi->numchips)
1426			break;
1427
1428		/* We cannot point across chips that are virtually disjoint */
1429		if (!last_end)
1430			last_end = cfi->chips[chipnum].start;
1431		else if (cfi->chips[chipnum].start != last_end)
1432			break;
1433
1434		if ((len + ofs -1) >> cfi->chipshift)
1435			thislen = (1<<cfi->chipshift) - ofs;
1436		else
1437			thislen = len;
1438
1439		ret = do_point_onechip(map, &cfi->chips[chipnum], ofs, thislen);
1440		if (ret)
1441			break;
1442
1443		*retlen += thislen;
1444		len -= thislen;
1445
1446		ofs = 0;
1447		last_end += 1 << cfi->chipshift;
1448		chipnum++;
1449	}
1450	return 0;
1451}
1452
1453static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
1454{
1455	struct map_info *map = mtd->priv;
1456	struct cfi_private *cfi = map->fldrv_priv;
1457	unsigned long ofs;
1458	int chipnum, err = 0;
1459
1460	/* Now unlock the chip(s) POINT state */
1461
1462	/* ofs: offset within the first chip that the first read should start */
1463	chipnum = (from >> cfi->chipshift);
1464	ofs = from - (chipnum <<  cfi->chipshift);
1465
1466	while (len && !err) {
1467		unsigned long thislen;
1468		struct flchip *chip;
1469
1470		chip = &cfi->chips[chipnum];
1471		if (chipnum >= cfi->numchips)
1472			break;
1473
1474		if ((len + ofs -1) >> cfi->chipshift)
1475			thislen = (1<<cfi->chipshift) - ofs;
1476		else
1477			thislen = len;
1478
1479		mutex_lock(&chip->mutex);
1480		if (chip->state == FL_POINT) {
1481			chip->ref_point_counter--;
1482			if(chip->ref_point_counter == 0)
1483				chip->state = FL_READY;
1484		} else {
1485			printk(KERN_ERR "%s: Error: unpoint called on non pointed region\n", map->name);
1486			err = -EINVAL;
1487		}
1488
1489		put_chip(map, chip, chip->start);
1490		mutex_unlock(&chip->mutex);
1491
1492		len -= thislen;
1493		ofs = 0;
1494		chipnum++;
1495	}
1496
1497	return err;
1498}
1499
1500static inline int do_read_onechip(struct map_info *map, struct flchip *chip, loff_t adr, size_t len, u_char *buf)
1501{
1502	unsigned long cmd_addr;
1503	struct cfi_private *cfi = map->fldrv_priv;
1504	int ret;
1505
1506	adr += chip->start;
1507
1508	/* Ensure cmd read/writes are aligned. */
1509	cmd_addr = adr & ~(map_bankwidth(map)-1);
1510
1511	mutex_lock(&chip->mutex);
1512	ret = get_chip(map, chip, cmd_addr, FL_READY);
1513	if (ret) {
1514		mutex_unlock(&chip->mutex);
1515		return ret;
1516	}
1517
1518	if (chip->state != FL_POINT && chip->state != FL_READY) {
1519		map_write(map, CMD(0xff), cmd_addr);
1520
1521		chip->state = FL_READY;
1522	}
1523
1524	map_copy_from(map, buf, adr, len);
1525
1526	put_chip(map, chip, cmd_addr);
1527
1528	mutex_unlock(&chip->mutex);
1529	return 0;
1530}
1531
1532static int cfi_intelext_read (struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf)
1533{
1534	struct map_info *map = mtd->priv;
1535	struct cfi_private *cfi = map->fldrv_priv;
1536	unsigned long ofs;
1537	int chipnum;
1538	int ret = 0;
1539
1540	/* ofs: offset within the first chip that the first read should start */
1541	chipnum = (from >> cfi->chipshift);
1542	ofs = from - (chipnum <<  cfi->chipshift);
1543
1544	while (len) {
1545		unsigned long thislen;
1546
1547		if (chipnum >= cfi->numchips)
1548			break;
1549
1550		if ((len + ofs -1) >> cfi->chipshift)
1551			thislen = (1<<cfi->chipshift) - ofs;
1552		else
1553			thislen = len;
1554
1555		ret = do_read_onechip(map, &cfi->chips[chipnum], ofs, thislen, buf);
1556		if (ret)
1557			break;
1558
1559		*retlen += thislen;
1560		len -= thislen;
1561		buf += thislen;
1562
1563		ofs = 0;
1564		chipnum++;
1565	}
1566	return ret;
1567}
1568
1569static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
1570				     unsigned long adr, map_word datum, int mode)
1571{
1572	struct cfi_private *cfi = map->fldrv_priv;
1573	map_word status, write_cmd;
1574	int ret;
1575
1576	adr += chip->start;
1577
1578	switch (mode) {
1579	case FL_WRITING:
1580		write_cmd = (cfi->cfiq->P_ID != P_ID_INTEL_PERFORMANCE) ? CMD(0x40) : CMD(0x41);
1581		break;
1582	case FL_OTP_WRITE:
1583		write_cmd = CMD(0xc0);
1584		break;
1585	default:
1586		return -EINVAL;
1587	}
1588
1589	mutex_lock(&chip->mutex);
1590	ret = get_chip(map, chip, adr, mode);
1591	if (ret) {
1592		mutex_unlock(&chip->mutex);
1593		return ret;
1594	}
1595
1596	XIP_INVAL_CACHED_RANGE(map, adr, map_bankwidth(map));
1597	ENABLE_VPP(map);
1598	xip_disable(map, chip, adr);
1599	map_write(map, write_cmd, adr);
1600	map_write(map, datum, adr);
1601	chip->state = mode;
1602
1603	ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
1604				   adr, map_bankwidth(map),
1605				   chip->word_write_time,
1606				   chip->word_write_time_max);
1607	if (ret) {
1608		xip_enable(map, chip, adr);
1609		printk(KERN_ERR "%s: word write error (status timeout)\n", map->name);
1610		goto out;
1611	}
1612
1613	/* check for errors */
1614	status = map_read(map, adr);
1615	if (map_word_bitsset(map, status, CMD(0x1a))) {
1616		unsigned long chipstatus = MERGESTATUS(status);
1617
1618		/* reset status */
1619		map_write(map, CMD(0x50), adr);
1620		map_write(map, CMD(0x70), adr);
1621		xip_enable(map, chip, adr);
1622
1623		if (chipstatus & 0x02) {
1624			ret = -EROFS;
1625		} else if (chipstatus & 0x08) {
1626			printk(KERN_ERR "%s: word write error (bad VPP)\n", map->name);
1627			ret = -EIO;
1628		} else {
1629			printk(KERN_ERR "%s: word write error (status 0x%lx)\n", map->name, chipstatus);
1630			ret = -EINVAL;
1631		}
1632
1633		goto out;
1634	}
1635
1636	xip_enable(map, chip, adr);
1637 out:	DISABLE_VPP(map);
1638	put_chip(map, chip, adr);
1639	mutex_unlock(&chip->mutex);
1640	return ret;
1641}
1642
1643
1644static int cfi_intelext_write_words (struct mtd_info *mtd, loff_t to , size_t len, size_t *retlen, const u_char *buf)
1645{
1646	struct map_info *map = mtd->priv;
1647	struct cfi_private *cfi = map->fldrv_priv;
1648	int ret;
1649	int chipnum;
1650	unsigned long ofs;
1651
1652	chipnum = to >> cfi->chipshift;
1653	ofs = to  - (chipnum << cfi->chipshift);
1654
1655	/* If it's not bus-aligned, do the first byte write */
1656	if (ofs & (map_bankwidth(map)-1)) {
1657		unsigned long bus_ofs = ofs & ~(map_bankwidth(map)-1);
1658		int gap = ofs - bus_ofs;
1659		int n;
1660		map_word datum;
1661
1662		n = min_t(int, len, map_bankwidth(map)-gap);
1663		datum = map_word_ff(map);
1664		datum = map_word_load_partial(map, datum, buf, gap, n);
1665
1666		ret = do_write_oneword(map, &cfi->chips[chipnum],
1667					       bus_ofs, datum, FL_WRITING);
1668		if (ret)
1669			return ret;
1670
1671		len -= n;
1672		ofs += n;
1673		buf += n;
1674		(*retlen) += n;
1675
1676		if (ofs >> cfi->chipshift) {
1677			chipnum ++;
1678			ofs = 0;
1679			if (chipnum == cfi->numchips)
1680				return 0;
1681		}
1682	}
1683
1684	while(len >= map_bankwidth(map)) {
1685		map_word datum = map_word_load(map, buf);
1686
1687		ret = do_write_oneword(map, &cfi->chips[chipnum],
1688				       ofs, datum, FL_WRITING);
1689		if (ret)
1690			return ret;
1691
1692		ofs += map_bankwidth(map);
1693		buf += map_bankwidth(map);
1694		(*retlen) += map_bankwidth(map);
1695		len -= map_bankwidth(map);
1696
1697		if (ofs >> cfi->chipshift) {
1698			chipnum ++;
1699			ofs = 0;
1700			if (chipnum == cfi->numchips)
1701				return 0;
1702		}
1703	}
1704
1705	if (len & (map_bankwidth(map)-1)) {
1706		map_word datum;
1707
1708		datum = map_word_ff(map);
1709		datum = map_word_load_partial(map, datum, buf, 0, len);
1710
1711		ret = do_write_oneword(map, &cfi->chips[chipnum],
1712				       ofs, datum, FL_WRITING);
1713		if (ret)
1714			return ret;
1715
1716		(*retlen) += len;
1717	}
1718
1719	return 0;
1720}
1721
1722
1723static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
1724				    unsigned long adr, const struct kvec **pvec,
1725				    unsigned long *pvec_seek, int len)
1726{
1727	struct cfi_private *cfi = map->fldrv_priv;
1728	map_word status, write_cmd, datum;
1729	unsigned long cmd_adr;
1730	int ret, wbufsize, word_gap, words;
1731	const struct kvec *vec;
1732	unsigned long vec_seek;
1733	unsigned long initial_adr;
1734	int initial_len = len;
1735
1736	wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
1737	adr += chip->start;
1738	initial_adr = adr;
1739	cmd_adr = adr & ~(wbufsize-1);
1740
1741	/* Sharp LH28F640BF chips need the first address for the
1742	 * Page Buffer Program command. See Table 5 of
1743	 * LH28F320BF, LH28F640BF, LH28F128BF Series (Appendix FUM00701) */
1744	if (is_LH28F640BF(cfi))
1745		cmd_adr = adr;
1746
1747	/* Let's determine this according to the interleave only once */
1748	write_cmd = (cfi->cfiq->P_ID != P_ID_INTEL_PERFORMANCE) ? CMD(0xe8) : CMD(0xe9);
1749
1750	mutex_lock(&chip->mutex);
1751	ret = get_chip(map, chip, cmd_adr, FL_WRITING);
1752	if (ret) {
1753		mutex_unlock(&chip->mutex);
1754		return ret;
1755	}
1756
1757	XIP_INVAL_CACHED_RANGE(map, initial_adr, initial_len);
1758	ENABLE_VPP(map);
1759	xip_disable(map, chip, cmd_adr);
1760
1761	/* §4.8 of the 28FxxxJ3A datasheet says "Any time SR.4 and/or SR.5 is set
1762	   [...], the device will not accept any more Write to Buffer commands".
1763	   So we must check here and reset those bits if they're set. Otherwise
1764	   we're just pissing in the wind */
1765	if (chip->state != FL_STATUS) {
1766		map_write(map, CMD(0x70), cmd_adr);
1767		chip->state = FL_STATUS;
1768	}
1769	status = map_read(map, cmd_adr);
1770	if (map_word_bitsset(map, status, CMD(0x30))) {
1771		xip_enable(map, chip, cmd_adr);
1772		printk(KERN_WARNING "SR.4 or SR.5 bits set in buffer write (status %lx). Clearing.\n", status.x[0]);
1773		xip_disable(map, chip, cmd_adr);
1774		map_write(map, CMD(0x50), cmd_adr);
1775		map_write(map, CMD(0x70), cmd_adr);
1776	}
1777
1778	chip->state = FL_WRITING_TO_BUFFER;
1779	map_write(map, write_cmd, cmd_adr);
1780	ret = WAIT_TIMEOUT(map, chip, cmd_adr, 0, 0);
1781	if (ret) {
1782		/* Argh. Not ready for write to buffer */
1783		map_word Xstatus = map_read(map, cmd_adr);
1784		map_write(map, CMD(0x70), cmd_adr);
1785		chip->state = FL_STATUS;
1786		status = map_read(map, cmd_adr);
1787		map_write(map, CMD(0x50), cmd_adr);
1788		map_write(map, CMD(0x70), cmd_adr);
1789		xip_enable(map, chip, cmd_adr);
1790		printk(KERN_ERR "%s: Chip not ready for buffer write. Xstatus = %lx, status = %lx\n",
1791				map->name, Xstatus.x[0], status.x[0]);
1792		goto out;
1793	}
1794
1795	/* Figure out the number of words to write */
1796	word_gap = (-adr & (map_bankwidth(map)-1));
1797	words = DIV_ROUND_UP(len - word_gap, map_bankwidth(map));
1798	if (!word_gap) {
1799		words--;
1800	} else {
1801		word_gap = map_bankwidth(map) - word_gap;
1802		adr -= word_gap;
1803		datum = map_word_ff(map);
1804	}
1805
1806	/* Write length of data to come */
1807	map_write(map, CMD(words), cmd_adr );
1808
1809	/* Write data */
1810	vec = *pvec;
1811	vec_seek = *pvec_seek;
1812	do {
1813		int n = map_bankwidth(map) - word_gap;
1814		if (n > vec->iov_len - vec_seek)
1815			n = vec->iov_len - vec_seek;
1816		if (n > len)
1817			n = len;
1818
1819		if (!word_gap && len < map_bankwidth(map))
1820			datum = map_word_ff(map);
1821
1822		datum = map_word_load_partial(map, datum,
1823					      vec->iov_base + vec_seek,
1824					      word_gap, n);
1825
1826		len -= n;
1827		word_gap += n;
1828		if (!len || word_gap == map_bankwidth(map)) {
1829			map_write(map, datum, adr);
1830			adr += map_bankwidth(map);
1831			word_gap = 0;
1832		}
1833
1834		vec_seek += n;
1835		if (vec_seek == vec->iov_len) {
1836			vec++;
1837			vec_seek = 0;
1838		}
1839	} while (len);
1840	*pvec = vec;
1841	*pvec_seek = vec_seek;
1842
1843	/* GO GO GO */
1844	map_write(map, CMD(0xd0), cmd_adr);
1845	chip->state = FL_WRITING;
1846
1847	ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
1848				   initial_adr, initial_len,
1849				   chip->buffer_write_time,
1850				   chip->buffer_write_time_max);
1851	if (ret) {
1852		map_write(map, CMD(0x70), cmd_adr);
1853		chip->state = FL_STATUS;
1854		xip_enable(map, chip, cmd_adr);
1855		printk(KERN_ERR "%s: buffer write error (status timeout)\n", map->name);
1856		goto out;
1857	}
1858
1859	/* check for errors */
1860	status = map_read(map, cmd_adr);
1861	if (map_word_bitsset(map, status, CMD(0x1a))) {
1862		unsigned long chipstatus = MERGESTATUS(status);
1863
1864		/* reset status */
1865		map_write(map, CMD(0x50), cmd_adr);
1866		map_write(map, CMD(0x70), cmd_adr);
1867		xip_enable(map, chip, cmd_adr);
1868
1869		if (chipstatus & 0x02) {
1870			ret = -EROFS;
1871		} else if (chipstatus & 0x08) {
1872			printk(KERN_ERR "%s: buffer write error (bad VPP)\n", map->name);
1873			ret = -EIO;
1874		} else {
1875			printk(KERN_ERR "%s: buffer write error (status 0x%lx)\n", map->name, chipstatus);
1876			ret = -EINVAL;
1877		}
1878
1879		goto out;
1880	}
1881
1882	xip_enable(map, chip, cmd_adr);
1883 out:	DISABLE_VPP(map);
1884	put_chip(map, chip, cmd_adr);
1885	mutex_unlock(&chip->mutex);
1886	return ret;
1887}
1888
1889static int cfi_intelext_writev (struct mtd_info *mtd, const struct kvec *vecs,
1890				unsigned long count, loff_t to, size_t *retlen)
1891{
1892	struct map_info *map = mtd->priv;
1893	struct cfi_private *cfi = map->fldrv_priv;
1894	int wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
1895	int ret;
1896	int chipnum;
1897	unsigned long ofs, vec_seek, i;
1898	size_t len = 0;
1899
1900	for (i = 0; i < count; i++)
1901		len += vecs[i].iov_len;
1902
1903	if (!len)
1904		return 0;
1905
1906	chipnum = to >> cfi->chipshift;
1907	ofs = to - (chipnum << cfi->chipshift);
1908	vec_seek = 0;
1909
1910	do {
1911		/* We must not cross write block boundaries */
1912		int size = wbufsize - (ofs & (wbufsize-1));
1913
1914		if (size > len)
1915			size = len;
1916		ret = do_write_buffer(map, &cfi->chips[chipnum],
1917				      ofs, &vecs, &vec_seek, size);
1918		if (ret)
1919			return ret;
1920
1921		ofs += size;
1922		(*retlen) += size;
1923		len -= size;
1924
1925		if (ofs >> cfi->chipshift) {
1926			chipnum ++;
1927			ofs = 0;
1928			if (chipnum == cfi->numchips)
1929				return 0;
1930		}
1931
1932		/* Be nice and reschedule with the chip in a usable state for other
1933		   processes. */
1934		cond_resched();
1935
1936	} while (len);
1937
1938	return 0;
1939}
1940
1941static int cfi_intelext_write_buffers (struct mtd_info *mtd, loff_t to,
1942				       size_t len, size_t *retlen, const u_char *buf)
1943{
1944	struct kvec vec;
1945
1946	vec.iov_base = (void *) buf;
1947	vec.iov_len = len;
1948
1949	return cfi_intelext_writev(mtd, &vec, 1, to, retlen);
1950}
1951
1952static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
1953				      unsigned long adr, int len, void *thunk)
1954{
1955	struct cfi_private *cfi = map->fldrv_priv;
1956	map_word status;
1957	int retries = 3;
1958	int ret;
1959
1960	adr += chip->start;
1961
1962 retry:
1963	mutex_lock(&chip->mutex);
1964	ret = get_chip(map, chip, adr, FL_ERASING);
1965	if (ret) {
1966		mutex_unlock(&chip->mutex);
1967		return ret;
1968	}
1969
1970	XIP_INVAL_CACHED_RANGE(map, adr, len);
1971	ENABLE_VPP(map);
1972	xip_disable(map, chip, adr);
1973
1974	/* Clear the status register first */
1975	map_write(map, CMD(0x50), adr);
1976
1977	/* Now erase */
1978	map_write(map, CMD(0x20), adr);
1979	map_write(map, CMD(0xD0), adr);
1980	chip->state = FL_ERASING;
1981	chip->erase_suspended = 0;
1982	chip->in_progress_block_addr = adr;
1983	chip->in_progress_block_mask = ~(len - 1);
1984
1985	ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
1986				   adr, len,
1987				   chip->erase_time,
1988				   chip->erase_time_max);
1989	if (ret) {
1990		map_write(map, CMD(0x70), adr);
1991		chip->state = FL_STATUS;
1992		xip_enable(map, chip, adr);
1993		printk(KERN_ERR "%s: block erase error: (status timeout)\n", map->name);
1994		goto out;
1995	}
1996
1997	/* We've broken this before. It doesn't hurt to be safe */
1998	map_write(map, CMD(0x70), adr);
1999	chip->state = FL_STATUS;
2000	status = map_read(map, adr);
2001
2002	/* check for errors */
2003	if (map_word_bitsset(map, status, CMD(0x3a))) {
2004		unsigned long chipstatus = MERGESTATUS(status);
2005
2006		/* Reset the error bits */
2007		map_write(map, CMD(0x50), adr);
2008		map_write(map, CMD(0x70), adr);
2009		xip_enable(map, chip, adr);
2010
2011		if ((chipstatus & 0x30) == 0x30) {
2012			printk(KERN_ERR "%s: block erase error: (bad command sequence, status 0x%lx)\n", map->name, chipstatus);
2013			ret = -EINVAL;
2014		} else if (chipstatus & 0x02) {
2015			/* Protection bit set */
2016			ret = -EROFS;
2017		} else if (chipstatus & 0x8) {
2018			/* Voltage */
2019			printk(KERN_ERR "%s: block erase error: (bad VPP)\n", map->name);
2020			ret = -EIO;
2021		} else if (chipstatus & 0x20 && retries--) {
2022			printk(KERN_DEBUG "block erase failed at 0x%08lx: status 0x%lx. Retrying...\n", adr, chipstatus);
2023			DISABLE_VPP(map);
2024			put_chip(map, chip, adr);
2025			mutex_unlock(&chip->mutex);
2026			goto retry;
2027		} else {
2028			printk(KERN_ERR "%s: block erase failed at 0x%08lx (status 0x%lx)\n", map->name, adr, chipstatus);
2029			ret = -EIO;
2030		}
2031
2032		goto out;
2033	}
2034
2035	xip_enable(map, chip, adr);
2036 out:	DISABLE_VPP(map);
2037	put_chip(map, chip, adr);
2038	mutex_unlock(&chip->mutex);
2039	return ret;
2040}
2041
2042static int cfi_intelext_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
2043{
2044	return cfi_varsize_frob(mtd, do_erase_oneblock, instr->addr,
2045				instr->len, NULL);
2046}
2047
2048static void cfi_intelext_sync (struct mtd_info *mtd)
2049{
2050	struct map_info *map = mtd->priv;
2051	struct cfi_private *cfi = map->fldrv_priv;
2052	int i;
2053	struct flchip *chip;
2054	int ret = 0;
2055
2056	for (i=0; !ret && i<cfi->numchips; i++) {
2057		chip = &cfi->chips[i];
2058
2059		mutex_lock(&chip->mutex);
2060		ret = get_chip(map, chip, chip->start, FL_SYNCING);
2061
2062		if (!ret) {
2063			chip->oldstate = chip->state;
2064			chip->state = FL_SYNCING;
2065			/* No need to wake_up() on this state change -
2066			 * as the whole point is that nobody can do anything
2067			 * with the chip now anyway.
2068			 */
2069		}
2070		mutex_unlock(&chip->mutex);
2071	}
2072
2073	/* Unlock the chips again */
2074
2075	for (i--; i >=0; i--) {
2076		chip = &cfi->chips[i];
2077
2078		mutex_lock(&chip->mutex);
2079
2080		if (chip->state == FL_SYNCING) {
2081			chip->state = chip->oldstate;
2082			chip->oldstate = FL_READY;
2083			wake_up(&chip->wq);
2084		}
2085		mutex_unlock(&chip->mutex);
2086	}
2087}
2088
2089static int __xipram do_getlockstatus_oneblock(struct map_info *map,
2090						struct flchip *chip,
2091						unsigned long adr,
2092						int len, void *thunk)
2093{
2094	struct cfi_private *cfi = map->fldrv_priv;
2095	int status, ofs_factor = cfi->interleave * cfi->device_type;
2096
2097	adr += chip->start;
2098	xip_disable(map, chip, adr+(2*ofs_factor));
2099	map_write(map, CMD(0x90), adr+(2*ofs_factor));
2100	chip->state = FL_JEDEC_QUERY;
2101	status = cfi_read_query(map, adr+(2*ofs_factor));
2102	xip_enable(map, chip, 0);
2103	return status;
2104}
2105
2106#ifdef DEBUG_LOCK_BITS
2107static int __xipram do_printlockstatus_oneblock(struct map_info *map,
2108						struct flchip *chip,
2109						unsigned long adr,
2110						int len, void *thunk)
2111{
2112	printk(KERN_DEBUG "block status register for 0x%08lx is %x\n",
2113	       adr, do_getlockstatus_oneblock(map, chip, adr, len, thunk));
2114	return 0;
2115}
2116#endif
2117
2118#define DO_XXLOCK_ONEBLOCK_LOCK		((void *) 1)
2119#define DO_XXLOCK_ONEBLOCK_UNLOCK	((void *) 2)
2120
2121static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip,
2122				       unsigned long adr, int len, void *thunk)
2123{
2124	struct cfi_private *cfi = map->fldrv_priv;
2125	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2126	int mdelay;
2127	int ret;
2128
2129	adr += chip->start;
2130
2131	mutex_lock(&chip->mutex);
2132	ret = get_chip(map, chip, adr, FL_LOCKING);
2133	if (ret) {
2134		mutex_unlock(&chip->mutex);
2135		return ret;
2136	}
2137
2138	ENABLE_VPP(map);
2139	xip_disable(map, chip, adr);
2140
2141	map_write(map, CMD(0x60), adr);
2142	if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) {
2143		map_write(map, CMD(0x01), adr);
2144		chip->state = FL_LOCKING;
2145	} else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) {
2146		map_write(map, CMD(0xD0), adr);
2147		chip->state = FL_UNLOCKING;
2148	} else
2149		BUG();
2150
2151	/*
2152	 * If Instant Individual Block Locking supported then no need
2153	 * to delay.
2154	 */
2155	/*
2156	 * Unlocking may take up to 1.4 seconds on some Intel flashes. So
2157	 * lets use a max of 1.5 seconds (1500ms) as timeout.
2158	 *
2159	 * See "Clear Block Lock-Bits Time" on page 40 in
2160	 * "3 Volt Intel StrataFlash Memory" 28F128J3,28F640J3,28F320J3 manual
2161	 * from February 2003
2162	 */
2163	mdelay = (!extp || !(extp->FeatureSupport & (1 << 5))) ? 1500 : 0;
2164
2165	ret = WAIT_TIMEOUT(map, chip, adr, mdelay, mdelay * 1000);
2166	if (ret) {
2167		map_write(map, CMD(0x70), adr);
2168		chip->state = FL_STATUS;
2169		xip_enable(map, chip, adr);
2170		printk(KERN_ERR "%s: block unlock error: (status timeout)\n", map->name);
2171		goto out;
2172	}
2173
2174	xip_enable(map, chip, adr);
2175 out:	DISABLE_VPP(map);
2176	put_chip(map, chip, adr);
2177	mutex_unlock(&chip->mutex);
2178	return ret;
2179}
2180
2181static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
2182{
2183	int ret;
2184
2185#ifdef DEBUG_LOCK_BITS
2186	printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
2187	       __func__, ofs, len);
2188	cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2189		ofs, len, NULL);
2190#endif
2191
2192	ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
2193		ofs, len, DO_XXLOCK_ONEBLOCK_LOCK);
2194
2195#ifdef DEBUG_LOCK_BITS
2196	printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
2197	       __func__, ret);
2198	cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2199		ofs, len, NULL);
2200#endif
2201
2202	return ret;
2203}
2204
2205static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
2206{
2207	int ret;
2208
2209#ifdef DEBUG_LOCK_BITS
2210	printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
2211	       __func__, ofs, len);
2212	cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2213		ofs, len, NULL);
2214#endif
2215
2216	ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
2217					ofs, len, DO_XXLOCK_ONEBLOCK_UNLOCK);
2218
2219#ifdef DEBUG_LOCK_BITS
2220	printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
2221	       __func__, ret);
2222	cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2223		ofs, len, NULL);
2224#endif
2225
2226	return ret;
2227}
2228
2229static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
2230				  uint64_t len)
2231{
2232	return cfi_varsize_frob(mtd, do_getlockstatus_oneblock,
2233				ofs, len, NULL) ? 1 : 0;
2234}
2235
2236#ifdef CONFIG_MTD_OTP
2237
2238typedef int (*otp_op_t)(struct map_info *map, struct flchip *chip,
2239			u_long data_offset, u_char *buf, u_int size,
2240			u_long prot_offset, u_int groupno, u_int groupsize);
2241
2242static int __xipram
2243do_otp_read(struct map_info *map, struct flchip *chip, u_long offset,
2244	    u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2245{
2246	struct cfi_private *cfi = map->fldrv_priv;
2247	int ret;
2248
2249	mutex_lock(&chip->mutex);
2250	ret = get_chip(map, chip, chip->start, FL_JEDEC_QUERY);
2251	if (ret) {
2252		mutex_unlock(&chip->mutex);
2253		return ret;
2254	}
2255
2256	/* let's ensure we're not reading back cached data from array mode */
2257	INVALIDATE_CACHED_RANGE(map, chip->start + offset, size);
2258
2259	xip_disable(map, chip, chip->start);
2260	if (chip->state != FL_JEDEC_QUERY) {
2261		map_write(map, CMD(0x90), chip->start);
2262		chip->state = FL_JEDEC_QUERY;
2263	}
2264	map_copy_from(map, buf, chip->start + offset, size);
2265	xip_enable(map, chip, chip->start);
2266
2267	/* then ensure we don't keep OTP data in the cache */
2268	INVALIDATE_CACHED_RANGE(map, chip->start + offset, size);
2269
2270	put_chip(map, chip, chip->start);
2271	mutex_unlock(&chip->mutex);
2272	return 0;
2273}
2274
2275static int
2276do_otp_write(struct map_info *map, struct flchip *chip, u_long offset,
2277	     u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2278{
2279	int ret;
2280
2281	while (size) {
2282		unsigned long bus_ofs = offset & ~(map_bankwidth(map)-1);
2283		int gap = offset - bus_ofs;
2284		int n = min_t(int, size, map_bankwidth(map)-gap);
2285		map_word datum = map_word_ff(map);
2286
2287		datum = map_word_load_partial(map, datum, buf, gap, n);
2288		ret = do_write_oneword(map, chip, bus_ofs, datum, FL_OTP_WRITE);
2289		if (ret)
2290			return ret;
2291
2292		offset += n;
2293		buf += n;
2294		size -= n;
2295	}
2296
2297	return 0;
2298}
2299
2300static int
2301do_otp_lock(struct map_info *map, struct flchip *chip, u_long offset,
2302	    u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2303{
2304	struct cfi_private *cfi = map->fldrv_priv;
2305	map_word datum;
2306
2307	/* make sure area matches group boundaries */
2308	if (size != grpsz)
2309		return -EXDEV;
2310
2311	datum = map_word_ff(map);
2312	datum = map_word_clr(map, datum, CMD(1 << grpno));
2313	return do_write_oneword(map, chip, prot, datum, FL_OTP_WRITE);
2314}
2315
2316static int cfi_intelext_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
2317				 size_t *retlen, u_char *buf,
2318				 otp_op_t action, int user_regs)
2319{
2320	struct map_info *map = mtd->priv;
2321	struct cfi_private *cfi = map->fldrv_priv;
2322	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2323	struct flchip *chip;
2324	struct cfi_intelext_otpinfo *otp;
2325	u_long devsize, reg_prot_offset, data_offset;
2326	u_int chip_num, chip_step, field, reg_fact_size, reg_user_size;
2327	u_int groups, groupno, groupsize, reg_fact_groups, reg_user_groups;
2328	int ret;
2329
2330	*retlen = 0;
2331
2332	/* Check that we actually have some OTP registers */
2333	if (!extp || !(extp->FeatureSupport & 64) || !extp->NumProtectionFields)
2334		return -ENODATA;
2335
2336	/* we need real chips here not virtual ones */
2337	devsize = (1 << cfi->cfiq->DevSize) * cfi->interleave;
2338	chip_step = devsize >> cfi->chipshift;
2339	chip_num = 0;
2340
2341	/* Some chips have OTP located in the _top_ partition only.
2342	   For example: Intel 28F256L18T (T means top-parameter device) */
2343	if (cfi->mfr == CFI_MFR_INTEL) {
2344		switch (cfi->id) {
2345		case 0x880b:
2346		case 0x880c:
2347		case 0x880d:
2348			chip_num = chip_step - 1;
2349		}
2350	}
2351
2352	for ( ; chip_num < cfi->numchips; chip_num += chip_step) {
2353		chip = &cfi->chips[chip_num];
2354		otp = (struct cfi_intelext_otpinfo *)&extp->extra[0];
2355
2356		/* first OTP region */
2357		field = 0;
2358		reg_prot_offset = extp->ProtRegAddr;
2359		reg_fact_groups = 1;
2360		reg_fact_size = 1 << extp->FactProtRegSize;
2361		reg_user_groups = 1;
2362		reg_user_size = 1 << extp->UserProtRegSize;
2363
2364		while (len > 0) {
2365			/* flash geometry fixup */
2366			data_offset = reg_prot_offset + 1;
2367			data_offset *= cfi->interleave * cfi->device_type;
2368			reg_prot_offset *= cfi->interleave * cfi->device_type;
2369			reg_fact_size *= cfi->interleave;
2370			reg_user_size *= cfi->interleave;
2371
2372			if (user_regs) {
2373				groups = reg_user_groups;
2374				groupsize = reg_user_size;
2375				/* skip over factory reg area */
2376				groupno = reg_fact_groups;
2377				data_offset += reg_fact_groups * reg_fact_size;
2378			} else {
2379				groups = reg_fact_groups;
2380				groupsize = reg_fact_size;
2381				groupno = 0;
2382			}
2383
2384			while (len > 0 && groups > 0) {
2385				if (!action) {
2386					/*
2387					 * Special case: if action is NULL
2388					 * we fill buf with otp_info records.
2389					 */
2390					struct otp_info *otpinfo;
2391					map_word lockword;
2392					len -= sizeof(struct otp_info);
2393					if (len <= 0)
2394						return -ENOSPC;
2395					ret = do_otp_read(map, chip,
2396							  reg_prot_offset,
2397							  (u_char *)&lockword,
2398							  map_bankwidth(map),
2399							  0, 0,  0);
2400					if (ret)
2401						return ret;
2402					otpinfo = (struct otp_info *)buf;
2403					otpinfo->start = from;
2404					otpinfo->length = groupsize;
2405					otpinfo->locked =
2406					   !map_word_bitsset(map, lockword,
2407							     CMD(1 << groupno));
2408					from += groupsize;
2409					buf += sizeof(*otpinfo);
2410					*retlen += sizeof(*otpinfo);
2411				} else if (from >= groupsize) {
2412					from -= groupsize;
2413					data_offset += groupsize;
2414				} else {
2415					int size = groupsize;
2416					data_offset += from;
2417					size -= from;
2418					from = 0;
2419					if (size > len)
2420						size = len;
2421					ret = action(map, chip, data_offset,
2422						     buf, size, reg_prot_offset,
2423						     groupno, groupsize);
2424					if (ret < 0)
2425						return ret;
2426					buf += size;
2427					len -= size;
2428					*retlen += size;
2429					data_offset += size;
2430				}
2431				groupno++;
2432				groups--;
2433			}
2434
2435			/* next OTP region */
2436			if (++field == extp->NumProtectionFields)
2437				break;
2438			reg_prot_offset = otp->ProtRegAddr;
2439			reg_fact_groups = otp->FactGroups;
2440			reg_fact_size = 1 << otp->FactProtRegSize;
2441			reg_user_groups = otp->UserGroups;
2442			reg_user_size = 1 << otp->UserProtRegSize;
2443			otp++;
2444		}
2445	}
2446
2447	return 0;
2448}
2449
2450static int cfi_intelext_read_fact_prot_reg(struct mtd_info *mtd, loff_t from,
2451					   size_t len, size_t *retlen,
2452					    u_char *buf)
2453{
2454	return cfi_intelext_otp_walk(mtd, from, len, retlen,
2455				     buf, do_otp_read, 0);
2456}
2457
2458static int cfi_intelext_read_user_prot_reg(struct mtd_info *mtd, loff_t from,
2459					   size_t len, size_t *retlen,
2460					    u_char *buf)
2461{
2462	return cfi_intelext_otp_walk(mtd, from, len, retlen,
2463				     buf, do_otp_read, 1);
2464}
2465
2466static int cfi_intelext_write_user_prot_reg(struct mtd_info *mtd, loff_t from,
2467					    size_t len, size_t *retlen,
2468					    const u_char *buf)
2469{
2470	return cfi_intelext_otp_walk(mtd, from, len, retlen,
2471				     (u_char *)buf, do_otp_write, 1);
2472}
2473
2474static int cfi_intelext_lock_user_prot_reg(struct mtd_info *mtd,
2475					   loff_t from, size_t len)
2476{
2477	size_t retlen;
2478	return cfi_intelext_otp_walk(mtd, from, len, &retlen,
2479				     NULL, do_otp_lock, 1);
2480}
2481
2482static int cfi_intelext_get_fact_prot_info(struct mtd_info *mtd, size_t len,
2483					   size_t *retlen, struct otp_info *buf)
2484
2485{
2486	return cfi_intelext_otp_walk(mtd, 0, len, retlen, (u_char *)buf,
2487				     NULL, 0);
2488}
2489
2490static int cfi_intelext_get_user_prot_info(struct mtd_info *mtd, size_t len,
2491					   size_t *retlen, struct otp_info *buf)
2492{
2493	return cfi_intelext_otp_walk(mtd, 0, len, retlen, (u_char *)buf,
2494				     NULL, 1);
2495}
2496
2497#endif
2498
2499static void cfi_intelext_save_locks(struct mtd_info *mtd)
2500{
2501	struct mtd_erase_region_info *region;
2502	int block, status, i;
2503	unsigned long adr;
2504	size_t len;
2505
2506	for (i = 0; i < mtd->numeraseregions; i++) {
2507		region = &mtd->eraseregions[i];
2508		if (!region->lockmap)
2509			continue;
2510
2511		for (block = 0; block < region->numblocks; block++){
2512			len = region->erasesize;
2513			adr = region->offset + block * len;
2514
2515			status = cfi_varsize_frob(mtd,
2516					do_getlockstatus_oneblock, adr, len, NULL);
2517			if (status)
2518				set_bit(block, region->lockmap);
2519			else
2520				clear_bit(block, region->lockmap);
2521		}
2522	}
2523}
2524
2525static int cfi_intelext_suspend(struct mtd_info *mtd)
2526{
2527	struct map_info *map = mtd->priv;
2528	struct cfi_private *cfi = map->fldrv_priv;
2529	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2530	int i;
2531	struct flchip *chip;
2532	int ret = 0;
2533
2534	if ((mtd->flags & MTD_POWERUP_LOCK)
2535	    && extp && (extp->FeatureSupport & (1 << 5)))
2536		cfi_intelext_save_locks(mtd);
2537
2538	for (i=0; !ret && i<cfi->numchips; i++) {
2539		chip = &cfi->chips[i];
2540
2541		mutex_lock(&chip->mutex);
2542
2543		switch (chip->state) {
2544		case FL_READY:
2545		case FL_STATUS:
2546		case FL_CFI_QUERY:
2547		case FL_JEDEC_QUERY:
2548			if (chip->oldstate == FL_READY) {
2549				/* place the chip in a known state before suspend */
2550				map_write(map, CMD(0xFF), cfi->chips[i].start);
2551				chip->oldstate = chip->state;
2552				chip->state = FL_PM_SUSPENDED;
2553				/* No need to wake_up() on this state change -
2554				 * as the whole point is that nobody can do anything
2555				 * with the chip now anyway.
2556				 */
2557			} else {
2558				/* There seems to be an operation pending. We must wait for it. */
2559				printk(KERN_NOTICE "Flash device refused suspend due to pending operation (oldstate %d)\n", chip->oldstate);
2560				ret = -EAGAIN;
2561			}
2562			break;
2563		default:
2564			/* Should we actually wait? Once upon a time these routines weren't
2565			   allowed to. Or should we return -EAGAIN, because the upper layers
2566			   ought to have already shut down anything which was using the device
2567			   anyway? The latter for now. */
2568			printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->state);
2569			ret = -EAGAIN;
2570			break;
2571		case FL_PM_SUSPENDED:
2572			break;
2573		}
2574		mutex_unlock(&chip->mutex);
2575	}
2576
2577	/* Unlock the chips again */
2578
2579	if (ret) {
2580		for (i--; i >=0; i--) {
2581			chip = &cfi->chips[i];
2582
2583			mutex_lock(&chip->mutex);
2584
2585			if (chip->state == FL_PM_SUSPENDED) {
2586				/* No need to force it into a known state here,
2587				   because we're returning failure, and it didn't
2588				   get power cycled */
2589				chip->state = chip->oldstate;
2590				chip->oldstate = FL_READY;
2591				wake_up(&chip->wq);
2592			}
2593			mutex_unlock(&chip->mutex);
2594		}
2595	}
2596
2597	return ret;
2598}
2599
2600static void cfi_intelext_restore_locks(struct mtd_info *mtd)
2601{
2602	struct mtd_erase_region_info *region;
2603	int block, i;
2604	unsigned long adr;
2605	size_t len;
2606
2607	for (i = 0; i < mtd->numeraseregions; i++) {
2608		region = &mtd->eraseregions[i];
2609		if (!region->lockmap)
2610			continue;
2611
2612		for_each_clear_bit(block, region->lockmap, region->numblocks) {
2613			len = region->erasesize;
2614			adr = region->offset + block * len;
2615			cfi_intelext_unlock(mtd, adr, len);
2616		}
2617	}
2618}
2619
2620static void cfi_intelext_resume(struct mtd_info *mtd)
2621{
2622	struct map_info *map = mtd->priv;
2623	struct cfi_private *cfi = map->fldrv_priv;
2624	struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2625	int i;
2626	struct flchip *chip;
2627
2628	for (i=0; i<cfi->numchips; i++) {
2629
2630		chip = &cfi->chips[i];
2631
2632		mutex_lock(&chip->mutex);
2633
2634		/* Go to known state. Chip may have been power cycled */
2635		if (chip->state == FL_PM_SUSPENDED) {
2636			/* Refresh LH28F640BF Partition Config. Register */
2637			fixup_LH28F640BF(mtd);
2638			map_write(map, CMD(0xFF), cfi->chips[i].start);
2639			chip->oldstate = chip->state = FL_READY;
2640			wake_up(&chip->wq);
2641		}
2642
2643		mutex_unlock(&chip->mutex);
2644	}
2645
2646	if ((mtd->flags & MTD_POWERUP_LOCK)
2647	    && extp && (extp->FeatureSupport & (1 << 5)))
2648		cfi_intelext_restore_locks(mtd);
2649}
2650
2651static int cfi_intelext_reset(struct mtd_info *mtd)
2652{
2653	struct map_info *map = mtd->priv;
2654	struct cfi_private *cfi = map->fldrv_priv;
2655	int i, ret;
2656
2657	for (i=0; i < cfi->numchips; i++) {
2658		struct flchip *chip = &cfi->chips[i];
2659
2660		/* force the completion of any ongoing operation
2661		   and switch to array mode so any bootloader in
2662		   flash is accessible for soft reboot. */
2663		mutex_lock(&chip->mutex);
2664		ret = get_chip(map, chip, chip->start, FL_SHUTDOWN);
2665		if (!ret) {
2666			map_write(map, CMD(0xff), chip->start);
2667			chip->state = FL_SHUTDOWN;
2668			put_chip(map, chip, chip->start);
2669		}
2670		mutex_unlock(&chip->mutex);
2671	}
2672
2673	return 0;
2674}
2675
2676static int cfi_intelext_reboot(struct notifier_block *nb, unsigned long val,
2677			       void *v)
2678{
2679	struct mtd_info *mtd;
2680
2681	mtd = container_of(nb, struct mtd_info, reboot_notifier);
2682	cfi_intelext_reset(mtd);
2683	return NOTIFY_DONE;
2684}
2685
2686static void cfi_intelext_destroy(struct mtd_info *mtd)
2687{
2688	struct map_info *map = mtd->priv;
2689	struct cfi_private *cfi = map->fldrv_priv;
2690	struct mtd_erase_region_info *region;
2691	int i;
2692	cfi_intelext_reset(mtd);
2693	unregister_reboot_notifier(&mtd->reboot_notifier);
2694	kfree(cfi->cmdset_priv);
2695	kfree(cfi->cfiq);
2696	kfree(cfi->chips[0].priv);
2697	kfree(cfi);
2698	for (i = 0; i < mtd->numeraseregions; i++) {
2699		region = &mtd->eraseregions[i];
2700		kfree(region->lockmap);
2701	}
2702	kfree(mtd->eraseregions);
2703}
2704
2705MODULE_LICENSE("GPL");
2706MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org> et al.");
2707MODULE_DESCRIPTION("MTD chip driver for Intel/Sharp flash chips");
2708MODULE_ALIAS("cfi_cmdset_0003");
2709MODULE_ALIAS("cfi_cmdset_0200");