drivers/mtd/chips/cfi_cmdset_0001.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Common Flash Interface support:
   4  *   Intel Extended Vendor Command Set (ID 0x0001)
   5  *
   6  * (C) 2000 Red Hat.
   7  *
   8  *
   9  * 10/10/2000   Nicolas Pitre <nico@fluxnic.net>
  10  *      - completely revamped method functions so they are aware and
  11  *        independent of the flash geometry (buswidth, interleave, etc.)
  12  *      - scalability vs code size is completely set at compile-time
  13  *        (see include/linux/mtd/cfi.h for selection)
  14  *      - optimized write buffer method
  15  * 02/05/2002   Christopher Hoover <ch@hpl.hp.com>/<ch@murgatroid.com>
  16  *      - reworked lock/unlock/erase support for var size flash
  17  * 21/03/2007   Rodolfo Giometti <giometti@linux.it>
  18  *      - auto unlock sectors on resume for auto locking flash on power up
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/types.h>
  23 #include <linux/kernel.h>
  24 #include <linux/sched.h>
  25 #include <asm/io.h>
  26 #include <asm/byteorder.h>
  27
  28 #include <linux/errno.h>
  29 #include <linux/slab.h>
  30 #include <linux/delay.h>
  31 #include <linux/interrupt.h>
  32 #include <linux/reboot.h>
  33 #include <linux/bitmap.h>
  34 #include <linux/mtd/xip.h>
  35 #include <linux/mtd/map.h>
  36 #include <linux/mtd/mtd.h>
  37 #include <linux/mtd/cfi.h>
  38
  39 /* #define CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE */
  40 /* #define CMDSET0001_DISABLE_WRITE_SUSPEND */
  41
  42 // debugging, turns off buffer write mode if set to 1
  43 #define FORCE_WORD_WRITE 0
  44
  45 /* Intel chips */
  46 #define I82802AB        0x00ad
  47 #define I82802AC        0x00ac
  48 #define PF38F4476       0x881c
  49 #define M28F00AP30      0x8963
  50 /* STMicroelectronics chips */
  51 #define M50LPW080       0x002F
  52 #define M50FLW080A      0x0080
  53 #define M50FLW080B      0x0081
  54 /* Atmel chips */
  55 #define AT49BV640D      0x02de
  56 #define AT49BV640DT     0x02db
  57 /* Sharp chips */
  58 #define LH28F640BFHE_PTTL90     0x00b0
  59 #define LH28F640BFHE_PBTL90     0x00b1
  60 #define LH28F640BFHE_PTTL70A    0x00b2
  61 #define LH28F640BFHE_PBTL70A    0x00b3
  62
  63 static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  64 static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
  65 static int cfi_intelext_write_buffers(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
  66 static int cfi_intelext_writev(struct mtd_info *, const struct kvec *, unsigned long, loff_t, size_t *);
  67 static int cfi_intelext_erase_varsize(struct mtd_info *, struct erase_info *);
  68 static void cfi_intelext_sync (struct mtd_info *);
  69 static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
  70 static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
  71 static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
  72                                   uint64_t len);
  73 #ifdef CONFIG_MTD_OTP
  74 static int cfi_intelext_read_fact_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  75 static int cfi_intelext_read_user_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  76 static int cfi_intelext_write_user_prot_reg(struct mtd_info *, loff_t, size_t,
  77                                             size_t *, const u_char *);
  78 static int cfi_intelext_lock_user_prot_reg (struct mtd_info *, loff_t, size_t);
  79 static int cfi_intelext_get_fact_prot_info(struct mtd_info *, size_t,
  80                                            size_t *, struct otp_info *);
  81 static int cfi_intelext_get_user_prot_info(struct mtd_info *, size_t,
  82                                            size_t *, struct otp_info *);
  83 #endif
  84 static int cfi_intelext_suspend (struct mtd_info *);
  85 static void cfi_intelext_resume (struct mtd_info *);
  86 static int cfi_intelext_reboot (struct notifier_block *, unsigned long, void *);
  87
  88 static void cfi_intelext_destroy(struct mtd_info *);
  89
  90 struct mtd_info *cfi_cmdset_0001(struct map_info *, int);
  91
  92 static struct mtd_info *cfi_intelext_setup (struct mtd_info *);
  93 static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **);
  94
  95 static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
  96                      size_t *retlen, void **virt, resource_size_t *phys);
  97 static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
  98
  99 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 100 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 101 static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr);
 102 #include "fwh_lock.h"
 103
 104
 105
 106 /*
 107  *  *********** SETUP AND PROBE BITS  ***********
 108  */
 109
 110 static struct mtd_chip_driver cfi_intelext_chipdrv = {
 111         .probe          = NULL, /* Not usable directly */
 112         .destroy        = cfi_intelext_destroy,
 113         .name           = "cfi_cmdset_0001",
 114         .module         = THIS_MODULE
 115 };
 116
 117 /* #define DEBUG_LOCK_BITS */
 118 /* #define DEBUG_CFI_FEATURES */
 119
 120 #ifdef DEBUG_CFI_FEATURES
 121 static void cfi_tell_features(struct cfi_pri_intelext *extp)
 122 {
 123         int i;
 124         printk("  Extended Query version %c.%c\n", extp->MajorVersion, extp->MinorVersion);
 125         printk("  Feature/Command Support:      %4.4X\n", extp->FeatureSupport);
 126         printk("     - Chip Erase:              %s\n", extp->FeatureSupport&1?"supported":"unsupported");
 127         printk("     - Suspend Erase:           %s\n", extp->FeatureSupport&2?"supported":"unsupported");
 128         printk("     - Suspend Program:         %s\n", extp->FeatureSupport&4?"supported":"unsupported");
 129         printk("     - Legacy Lock/Unlock:      %s\n", extp->FeatureSupport&8?"supported":"unsupported");
 130         printk("     - Queued Erase:            %s\n", extp->FeatureSupport&16?"supported":"unsupported");
 131         printk("     - Instant block lock:      %s\n", extp->FeatureSupport&32?"supported":"unsupported");
 132         printk("     - Protection Bits:         %s\n", extp->FeatureSupport&64?"supported":"unsupported");
 133         printk("     - Page-mode read:          %s\n", extp->FeatureSupport&128?"supported":"unsupported");
 134         printk("     - Synchronous read:        %s\n", extp->FeatureSupport&256?"supported":"unsupported");
 135         printk("     - Simultaneous operations: %s\n", extp->FeatureSupport&512?"supported":"unsupported");
 136         printk("     - Extended Flash Array:    %s\n", extp->FeatureSupport&1024?"supported":"unsupported");
 137         for (i=11; i<32; i++) {
 138                 if (extp->FeatureSupport & (1<<i))
 139                         printk("     - Unknown Bit %X:      supported\n", i);
 140         }
 141
 142         printk("  Supported functions after Suspend: %2.2X\n", extp->SuspendCmdSupport);
 143         printk("     - Program after Erase Suspend: %s\n", extp->SuspendCmdSupport&1?"supported":"unsupported");
 144         for (i=1; i<8; i++) {
 145                 if (extp->SuspendCmdSupport & (1<<i))
 146                         printk("     - Unknown Bit %X:               supported\n", i);
 147         }
 148
 149         printk("  Block Status Register Mask: %4.4X\n", extp->BlkStatusRegMask);
 150         printk("     - Lock Bit Active:      %s\n", extp->BlkStatusRegMask&1?"yes":"no");
 151         printk("     - Lock-Down Bit Active: %s\n", extp->BlkStatusRegMask&2?"yes":"no");
 152         for (i=2; i<3; i++) {
 153                 if (extp->BlkStatusRegMask & (1<<i))
 154                         printk("     - Unknown Bit %X Active: yes\n",i);
 155         }
 156         printk("     - EFA Lock Bit:         %s\n", extp->BlkStatusRegMask&16?"yes":"no");
 157         printk("     - EFA Lock-Down Bit:    %s\n", extp->BlkStatusRegMask&32?"yes":"no");
 158         for (i=6; i<16; i++) {
 159                 if (extp->BlkStatusRegMask & (1<<i))
 160                         printk("     - Unknown Bit %X Active: yes\n",i);
 161         }
 162
 163         printk("  Vcc Logic Supply Optimum Program/Erase Voltage: %d.%d V\n",
 164                extp->VccOptimal >> 4, extp->VccOptimal & 0xf);
 165         if (extp->VppOptimal)
 166                 printk("  Vpp Programming Supply Optimum Program/Erase Voltage: %d.%d V\n",
 167                        extp->VppOptimal >> 4, extp->VppOptimal & 0xf);
 168 }
 169 #endif
 170
 171 /* Atmel chips don't use the same PRI format as Intel chips */
 172 static void fixup_convert_atmel_pri(struct mtd_info *mtd)
 173 {
 174         struct map_info *map = mtd->priv;
 175         struct cfi_private *cfi = map->fldrv_priv;
 176         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 177         struct cfi_pri_atmel atmel_pri;
 178         uint32_t features = 0;
 179
 180         /* Reverse byteswapping */
 181         extp->FeatureSupport = cpu_to_le32(extp->FeatureSupport);
 182         extp->BlkStatusRegMask = cpu_to_le16(extp->BlkStatusRegMask);
 183         extp->ProtRegAddr = cpu_to_le16(extp->ProtRegAddr);
 184
 185         memcpy(&atmel_pri, extp, sizeof(atmel_pri));
 186         memset((char *)extp + 5, 0, sizeof(*extp) - 5);
 187
 188         printk(KERN_ERR "atmel Features: %02x\n", atmel_pri.Features);
 189
 190         if (atmel_pri.Features & 0x01) /* chip erase supported */
 191                 features |= (1<<0);
 192         if (atmel_pri.Features & 0x02) /* erase suspend supported */
 193                 features |= (1<<1);
 194         if (atmel_pri.Features & 0x04) /* program suspend supported */
 195                 features |= (1<<2);
 196         if (atmel_pri.Features & 0x08) /* simultaneous operations supported */
 197                 features |= (1<<9);
 198         if (atmel_pri.Features & 0x20) /* page mode read supported */
 199                 features |= (1<<7);
 200         if (atmel_pri.Features & 0x40) /* queued erase supported */
 201                 features |= (1<<4);
 202         if (atmel_pri.Features & 0x80) /* Protection bits supported */
 203                 features |= (1<<6);
 204
 205         extp->FeatureSupport = features;
 206
 207         /* burst write mode not supported */
 208         cfi->cfiq->BufWriteTimeoutTyp = 0;
 209         cfi->cfiq->BufWriteTimeoutMax = 0;
 210 }
 211
 212 static void fixup_at49bv640dx_lock(struct mtd_info *mtd)
 213 {
 214         struct map_info *map = mtd->priv;
 215         struct cfi_private *cfi = map->fldrv_priv;
 216         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 217
 218         cfip->FeatureSupport |= (1 << 5);
 219         mtd->flags |= MTD_POWERUP_LOCK;
 220 }
 221
 222 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 223 /* Some Intel Strata Flash prior to FPO revision C has bugs in this area */
 224 static void fixup_intel_strataflash(struct mtd_info *mtd)
 225 {
 226         struct map_info *map = mtd->priv;
 227         struct cfi_private *cfi = map->fldrv_priv;
 228         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 229
 230         printk(KERN_WARNING "cfi_cmdset_0001: Suspend "
 231                             "erase on write disabled.\n");
 232         extp->SuspendCmdSupport &= ~1;
 233 }
 234 #endif
 235
 236 #ifdef CMDSET0001_DISABLE_WRITE_SUSPEND
 237 static void fixup_no_write_suspend(struct mtd_info *mtd)
 238 {
 239         struct map_info *map = mtd->priv;
 240         struct cfi_private *cfi = map->fldrv_priv;
 241         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 242
 243         if (cfip && (cfip->FeatureSupport&4)) {
 244                 cfip->FeatureSupport &= ~4;
 245                 printk(KERN_WARNING "cfi_cmdset_0001: write suspend disabled\n");
 246         }
 247 }
 248 #endif
 249
 250 static void fixup_st_m28w320ct(struct mtd_info *mtd)
 251 {
 252         struct map_info *map = mtd->priv;
 253         struct cfi_private *cfi = map->fldrv_priv;
 254
 255         cfi->cfiq->BufWriteTimeoutTyp = 0;      /* Not supported */
 256         cfi->cfiq->BufWriteTimeoutMax = 0;      /* Not supported */
 257 }
 258
 259 static void fixup_st_m28w320cb(struct mtd_info *mtd)
 260 {
 261         struct map_info *map = mtd->priv;
 262         struct cfi_private *cfi = map->fldrv_priv;
 263
 264         /* Note this is done after the region info is endian swapped */
 265         cfi->cfiq->EraseRegionInfo[1] =
 266                 (cfi->cfiq->EraseRegionInfo[1] & 0xffff0000) | 0x3e;
 267 };
 268
 269 static int is_LH28F640BF(struct cfi_private *cfi)
 270 {
 271         /* Sharp LH28F640BF Family */
 272         if (cfi->mfr == CFI_MFR_SHARP && (
 273             cfi->id == LH28F640BFHE_PTTL90 || cfi->id == LH28F640BFHE_PBTL90 ||
 274             cfi->id == LH28F640BFHE_PTTL70A || cfi->id == LH28F640BFHE_PBTL70A))
 275                 return 1;
 276         return 0;
 277 }
 278
 279 static void fixup_LH28F640BF(struct mtd_info *mtd)
 280 {
 281         struct map_info *map = mtd->priv;
 282         struct cfi_private *cfi = map->fldrv_priv;
 283         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 284
 285         /* Reset the Partition Configuration Register on LH28F640BF
 286          * to a single partition (PCR = 0x000): PCR is embedded into A0-A15. */
 287         if (is_LH28F640BF(cfi)) {
 288                 printk(KERN_INFO "Reset Partition Config. Register: 1 Partition of 4 planes\n");
 289                 map_write(map, CMD(0x60), 0);
 290                 map_write(map, CMD(0x04), 0);
 291
 292                 /* We have set one single partition thus
 293                  * Simultaneous Operations are not allowed */
 294                 printk(KERN_INFO "cfi_cmdset_0001: Simultaneous Operations disabled\n");
 295                 extp->FeatureSupport &= ~512;
 296         }
 297 }
 298
 299 static void fixup_use_point(struct mtd_info *mtd)
 300 {
 301         struct map_info *map = mtd->priv;
 302         if (!mtd->_point && map_is_linear(map)) {
 303                 mtd->_point   = cfi_intelext_point;
 304                 mtd->_unpoint = cfi_intelext_unpoint;
 305         }
 306 }
 307
 308 static void fixup_use_write_buffers(struct mtd_info *mtd)
 309 {
 310         struct map_info *map = mtd->priv;
 311         struct cfi_private *cfi = map->fldrv_priv;
 312         if (cfi->cfiq->BufWriteTimeoutTyp) {
 313                 printk(KERN_INFO "Using buffer write method\n" );
 314                 mtd->_write = cfi_intelext_write_buffers;
 315                 mtd->_writev = cfi_intelext_writev;
 316         }
 317 }
 318
 319 /*
 320  * Some chips power-up with all sectors locked by default.
 321  */
 322 static void fixup_unlock_powerup_lock(struct mtd_info *mtd)
 323 {
 324         struct map_info *map = mtd->priv;
 325         struct cfi_private *cfi = map->fldrv_priv;
 326         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 327
 328         if (cfip->FeatureSupport&32) {
 329                 printk(KERN_INFO "Using auto-unlock on power-up/resume\n" );
 330                 mtd->flags |= MTD_POWERUP_LOCK;
 331         }
 332 }
 333
 334 static struct cfi_fixup cfi_fixup_table[] = {
 335         { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri },
 336         { CFI_MFR_ATMEL, AT49BV640D, fixup_at49bv640dx_lock },
 337         { CFI_MFR_ATMEL, AT49BV640DT, fixup_at49bv640dx_lock },
 338 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 339         { CFI_MFR_ANY, CFI_ID_ANY, fixup_intel_strataflash },
 340 #endif
 341 #ifdef CMDSET0001_DISABLE_WRITE_SUSPEND
 342         { CFI_MFR_ANY, CFI_ID_ANY, fixup_no_write_suspend },
 343 #endif
 344 #if !FORCE_WORD_WRITE
 345         { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers },
 346 #endif
 347         { CFI_MFR_ST, 0x00ba, /* M28W320CT */ fixup_st_m28w320ct },
 348         { CFI_MFR_ST, 0x00bb, /* M28W320CB */ fixup_st_m28w320cb },
 349         { CFI_MFR_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock },
 350         { CFI_MFR_SHARP, CFI_ID_ANY, fixup_unlock_powerup_lock },
 351         { CFI_MFR_SHARP, CFI_ID_ANY, fixup_LH28F640BF },
 352         { 0, 0, NULL }
 353 };
 354
 355 static struct cfi_fixup jedec_fixup_table[] = {
 356         { CFI_MFR_INTEL, I82802AB,   fixup_use_fwh_lock },
 357         { CFI_MFR_INTEL, I82802AC,   fixup_use_fwh_lock },
 358         { CFI_MFR_ST,    M50LPW080,  fixup_use_fwh_lock },
 359         { CFI_MFR_ST,    M50FLW080A, fixup_use_fwh_lock },
 360         { CFI_MFR_ST,    M50FLW080B, fixup_use_fwh_lock },
 361         { 0, 0, NULL }
 362 };
 363 static struct cfi_fixup fixup_table[] = {
 364         /* The CFI vendor ids and the JEDEC vendor IDs appear
 365          * to be common.  It is like the devices id's are as
 366          * well.  This table is to pick all cases where
 367          * we know that is the case.
 368          */
 369         { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_point },
 370         { 0, 0, NULL }
 371 };
 372
 373 static void cfi_fixup_major_minor(struct cfi_private *cfi,
 374                                                 struct cfi_pri_intelext *extp)
 375 {
 376         if (cfi->mfr == CFI_MFR_INTEL &&
 377                         cfi->id == PF38F4476 && extp->MinorVersion == '3')
 378                 extp->MinorVersion = '1';
 379 }
 380
 381 static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
 382 {
 383         /*
 384          * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
 385          * Erase Supend for their small Erase Blocks(0x8000)
 386          */
 387         if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
 388                 return 1;
 389         return 0;
 390 }
 391
 392 static inline struct cfi_pri_intelext *
 393 read_pri_intelext(struct map_info *map, __u16 adr)
 394 {
 395         struct cfi_private *cfi = map->fldrv_priv;
 396         struct cfi_pri_intelext *extp;
 397         unsigned int extra_size = 0;
 398         unsigned int extp_size = sizeof(*extp);
 399
 400  again:
 401         extp = (struct cfi_pri_intelext *)cfi_read_pri(map, adr, extp_size, "Intel/Sharp");
 402         if (!extp)
 403                 return NULL;
 404
 405         cfi_fixup_major_minor(cfi, extp);
 406
 407         if (extp->MajorVersion != '1' ||
 408             (extp->MinorVersion < '0' || extp->MinorVersion > '5')) {
 409                 printk(KERN_ERR "  Unknown Intel/Sharp Extended Query "
 410                        "version %c.%c.\n",  extp->MajorVersion,
 411                        extp->MinorVersion);
 412                 kfree(extp);
 413                 return NULL;
 414         }
 415
 416         /* Do some byteswapping if necessary */
 417         extp->FeatureSupport = le32_to_cpu(extp->FeatureSupport);
 418         extp->BlkStatusRegMask = le16_to_cpu(extp->BlkStatusRegMask);
 419         extp->ProtRegAddr = le16_to_cpu(extp->ProtRegAddr);
 420
 421         if (extp->MinorVersion >= '0') {
 422                 extra_size = 0;
 423
 424                 /* Protection Register info */
 425                 if (extp->NumProtectionFields) {
 426                         struct cfi_intelext_otpinfo *otp =
 427                                 (struct cfi_intelext_otpinfo *)&extp->extra[0];
 428
 429                         extra_size += (extp->NumProtectionFields - 1) *
 430                                 sizeof(struct cfi_intelext_otpinfo);
 431
 432                         if (extp_size >= sizeof(*extp) + extra_size) {
 433                                 int i;
 434
 435                                 /* Do some byteswapping if necessary */
 436                                 for (i = 0; i < extp->NumProtectionFields - 1; i++) {
 437                                         otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr);
 438                                         otp->FactGroups = le16_to_cpu(otp->FactGroups);
 439                                         otp->UserGroups = le16_to_cpu(otp->UserGroups);
 440                                         otp++;
 441                                 }
 442                         }
 443                 }
 444         }
 445
 446         if (extp->MinorVersion >= '1') {
 447                 /* Burst Read info */
 448                 extra_size += 2;
 449                 if (extp_size < sizeof(*extp) + extra_size)
 450                         goto need_more;
 451                 extra_size += extp->extra[extra_size - 1];
 452         }
 453
 454         if (extp->MinorVersion >= '3') {
 455                 int nb_parts, i;
 456
 457                 /* Number of hardware-partitions */
 458                 extra_size += 1;
 459                 if (extp_size < sizeof(*extp) + extra_size)
 460                         goto need_more;
 461                 nb_parts = extp->extra[extra_size - 1];
 462
 463                 /* skip the sizeof(partregion) field in CFI 1.4 */
 464                 if (extp->MinorVersion >= '4')
 465                         extra_size += 2;
 466
 467                 for (i = 0; i < nb_parts; i++) {
 468                         struct cfi_intelext_regioninfo *rinfo;
 469                         rinfo = (struct cfi_intelext_regioninfo *)&extp->extra[extra_size];
 470                         extra_size += sizeof(*rinfo);
 471                         if (extp_size < sizeof(*extp) + extra_size)
 472                                 goto need_more;
 473                         rinfo->NumIdentPartitions=le16_to_cpu(rinfo->NumIdentPartitions);
 474                         extra_size += (rinfo->NumBlockTypes - 1)
 475                                       * sizeof(struct cfi_intelext_blockinfo);
 476                 }
 477
 478                 if (extp->MinorVersion >= '4')
 479                         extra_size += sizeof(struct cfi_intelext_programming_regioninfo);
 480
 481                 if (extp_size < sizeof(*extp) + extra_size) {
 482                         need_more:
 483                         extp_size = sizeof(*extp) + extra_size;
 484                         kfree(extp);
 485                         if (extp_size > 4096) {
 486                                 printk(KERN_ERR
 487                                         "%s: cfi_pri_intelext is too fat\n",
 488                                         __func__);
 489                                 return NULL;
 490                         }
 491                         goto again;
 492                 }
 493         }
 494
 495         return extp;
 496 }
 497
 498 struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
 499 {
 500         struct cfi_private *cfi = map->fldrv_priv;
 501         struct mtd_info *mtd;
 502         int i;
 503
 504         mtd = kzalloc(sizeof(*mtd), GFP_KERNEL);
 505         if (!mtd)
 506                 return NULL;
 507         mtd->priv = map;
 508         mtd->type = MTD_NORFLASH;
 509
 510         /* Fill in the default mtd operations */
 511         mtd->_erase   = cfi_intelext_erase_varsize;
 512         mtd->_read    = cfi_intelext_read;
 513         mtd->_write   = cfi_intelext_write_words;
 514         mtd->_sync    = cfi_intelext_sync;
 515         mtd->_lock    = cfi_intelext_lock;
 516         mtd->_unlock  = cfi_intelext_unlock;
 517         mtd->_is_locked = cfi_intelext_is_locked;
 518         mtd->_suspend = cfi_intelext_suspend;
 519         mtd->_resume  = cfi_intelext_resume;
 520         mtd->flags   = MTD_CAP_NORFLASH;
 521         mtd->name    = map->name;
 522         mtd->writesize = 1;
 523         mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
 524
 525         mtd->reboot_notifier.notifier_call = cfi_intelext_reboot;
 526
 527         if (cfi->cfi_mode == CFI_MODE_CFI) {
 528                 /*
 529                  * It's a real CFI chip, not one for which the probe
 530                  * routine faked a CFI structure. So we read the feature
 531                  * table from it.
 532                  */
 533                 __u16 adr = primary?cfi->cfiq->P_ADR:cfi->cfiq->A_ADR;
 534                 struct cfi_pri_intelext *extp;
 535
 536                 extp = read_pri_intelext(map, adr);
 537                 if (!extp) {
 538                         kfree(mtd);
 539                         return NULL;
 540                 }
 541
 542                 /* Install our own private info structure */
 543                 cfi->cmdset_priv = extp;
 544
 545                 cfi_fixup(mtd, cfi_fixup_table);
 546
 547 #ifdef DEBUG_CFI_FEATURES
 548                 /* Tell the user about it in lots of lovely detail */
 549                 cfi_tell_features(extp);
 550 #endif
 551
 552                 if(extp->SuspendCmdSupport & 1) {
 553                         printk(KERN_NOTICE "cfi_cmdset_0001: Erase suspend on write enabled\n");
 554                 }
 555         }
 556         else if (cfi->cfi_mode == CFI_MODE_JEDEC) {
 557                 /* Apply jedec specific fixups */
 558                 cfi_fixup(mtd, jedec_fixup_table);
 559         }
 560         /* Apply generic fixups */
 561         cfi_fixup(mtd, fixup_table);
 562
 563         for (i=0; i< cfi->numchips; i++) {
 564                 if (cfi->cfiq->WordWriteTimeoutTyp)
 565                         cfi->chips[i].word_write_time =
 566                                 1<<cfi->cfiq->WordWriteTimeoutTyp;
 567                 else
 568                         cfi->chips[i].word_write_time = 50000;
 569
 570                 if (cfi->cfiq->BufWriteTimeoutTyp)
 571                         cfi->chips[i].buffer_write_time =
 572                                 1<<cfi->cfiq->BufWriteTimeoutTyp;
 573                 /* No default; if it isn't specified, we won't use it */
 574
 575                 if (cfi->cfiq->BlockEraseTimeoutTyp)
 576                         cfi->chips[i].erase_time =
 577                                 1000<<cfi->cfiq->BlockEraseTimeoutTyp;
 578                 else
 579                         cfi->chips[i].erase_time = 2000000;
 580
 581                 if (cfi->cfiq->WordWriteTimeoutTyp &&
 582                     cfi->cfiq->WordWriteTimeoutMax)
 583                         cfi->chips[i].word_write_time_max =
 584                                 1<<(cfi->cfiq->WordWriteTimeoutTyp +
 585                                     cfi->cfiq->WordWriteTimeoutMax);
 586                 else
 587                         cfi->chips[i].word_write_time_max = 50000 * 8;
 588
 589                 if (cfi->cfiq->BufWriteTimeoutTyp &&
 590                     cfi->cfiq->BufWriteTimeoutMax)
 591                         cfi->chips[i].buffer_write_time_max =
 592                                 1<<(cfi->cfiq->BufWriteTimeoutTyp +
 593                                     cfi->cfiq->BufWriteTimeoutMax);
 594
 595                 if (cfi->cfiq->BlockEraseTimeoutTyp &&
 596                     cfi->cfiq->BlockEraseTimeoutMax)
 597                         cfi->chips[i].erase_time_max =
 598                                 1000<<(cfi->cfiq->BlockEraseTimeoutTyp +
 599                                        cfi->cfiq->BlockEraseTimeoutMax);
 600                 else
 601                         cfi->chips[i].erase_time_max = 2000000 * 8;
 602
 603                 cfi->chips[i].ref_point_counter = 0;
 604                 init_waitqueue_head(&(cfi->chips[i].wq));
 605         }
 606
 607         map->fldrv = &cfi_intelext_chipdrv;
 608
 609         return cfi_intelext_setup(mtd);
 610 }
 611 struct mtd_info *cfi_cmdset_0003(struct map_info *map, int primary) __attribute__((alias("cfi_cmdset_0001")));
 612 struct mtd_info *cfi_cmdset_0200(struct map_info *map, int primary) __attribute__((alias("cfi_cmdset_0001")));
 613 EXPORT_SYMBOL_GPL(cfi_cmdset_0001);
 614 EXPORT_SYMBOL_GPL(cfi_cmdset_0003);
 615 EXPORT_SYMBOL_GPL(cfi_cmdset_0200);
 616
 617 static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
 618 {
 619         struct map_info *map = mtd->priv;
 620         struct cfi_private *cfi = map->fldrv_priv;
 621         unsigned long offset = 0;
 622         int i,j;
 623         unsigned long devsize = (1<<cfi->cfiq->DevSize) * cfi->interleave;
 624
 625         //printk(KERN_DEBUG "number of CFI chips: %d\n", cfi->numchips);
 626
 627         mtd->size = devsize * cfi->numchips;
 628
 629         mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
 630         mtd->eraseregions = kcalloc(mtd->numeraseregions,
 631                                     sizeof(struct mtd_erase_region_info),
 632                                     GFP_KERNEL);
 633         if (!mtd->eraseregions)
 634                 goto setup_err;
 635
 636         for (i=0; i<cfi->cfiq->NumEraseRegions; i++) {
 637                 unsigned long ernum, ersize;
 638                 ersize = ((cfi->cfiq->EraseRegionInfo[i] >> 8) & ~0xff) * cfi->interleave;
 639                 ernum = (cfi->cfiq->EraseRegionInfo[i] & 0xffff) + 1;
 640
 641                 if (mtd->erasesize < ersize) {
 642                         mtd->erasesize = ersize;
 643                 }
 644                 for (j=0; j<cfi->numchips; j++) {
 645                         mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].offset = (j*devsize)+offset;
 646                         mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].erasesize = ersize;
 647                         mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].numblocks = ernum;
 648                         mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap = kmalloc(ernum / 8 + 1, GFP_KERNEL);
 649                         if (!mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap)
 650                                 goto setup_err;
 651                 }
 652                 offset += (ersize * ernum);
 653         }
 654
 655         if (offset != devsize) {
 656                 /* Argh */
 657                 printk(KERN_WARNING "Sum of regions (%lx) != total size of set of interleaved chips (%lx)\n", offset, devsize);
 658                 goto setup_err;
 659         }
 660
 661         for (i=0; i<mtd->numeraseregions;i++){
 662                 printk(KERN_DEBUG "erase region %d: offset=0x%llx,size=0x%x,blocks=%d\n",
 663                        i,(unsigned long long)mtd->eraseregions[i].offset,
 664                        mtd->eraseregions[i].erasesize,
 665                        mtd->eraseregions[i].numblocks);
 666         }
 667
 668 #ifdef CONFIG_MTD_OTP
 669         mtd->_read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
 670         mtd->_read_user_prot_reg = cfi_intelext_read_user_prot_reg;
 671         mtd->_write_user_prot_reg = cfi_intelext_write_user_prot_reg;
 672         mtd->_lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
 673         mtd->_get_fact_prot_info = cfi_intelext_get_fact_prot_info;
 674         mtd->_get_user_prot_info = cfi_intelext_get_user_prot_info;
 675 #endif
 676
 677         /* This function has the potential to distort the reality
 678            a bit and therefore should be called last. */
 679         if (cfi_intelext_partition_fixup(mtd, &cfi) != 0)
 680                 goto setup_err;
 681
 682         __module_get(THIS_MODULE);
 683         register_reboot_notifier(&mtd->reboot_notifier);
 684         return mtd;
 685
 686  setup_err:
 687         if (mtd->eraseregions)
 688                 for (i=0; i<cfi->cfiq->NumEraseRegions; i++)
 689                         for (j=0; j<cfi->numchips; j++)
 690                                 kfree(mtd->eraseregions[(j*cfi->cfiq->NumEraseRegions)+i].lockmap);
 691         kfree(mtd->eraseregions);
 692         kfree(mtd);
 693         kfree(cfi->cmdset_priv);
 694         return NULL;
 695 }
 696
 697 static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
 698                                         struct cfi_private **pcfi)
 699 {
 700         struct map_info *map = mtd->priv;
 701         struct cfi_private *cfi = *pcfi;
 702         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 703
 704         /*
 705          * Probing of multi-partition flash chips.
 706          *
 707          * To support multiple partitions when available, we simply arrange
 708          * for each of them to have their own flchip structure even if they
 709          * are on the same physical chip.  This means completely recreating
 710          * a new cfi_private structure right here which is a blatent code
 711          * layering violation, but this is still the least intrusive
 712          * arrangement at this point. This can be rearranged in the future
 713          * if someone feels motivated enough.  --nico
 714          */
 715         if (extp && extp->MajorVersion == '1' && extp->MinorVersion >= '3'
 716             && extp->FeatureSupport & (1 << 9)) {
 717                 int offs = 0;
 718                 struct cfi_private *newcfi;
 719                 struct flchip *chip;
 720                 struct flchip_shared *shared;
 721                 int numregions, numparts, partshift, numvirtchips, i, j;
 722
 723                 /* Protection Register info */
 724                 if (extp->NumProtectionFields)
 725                         offs = (extp->NumProtectionFields - 1) *
 726                                sizeof(struct cfi_intelext_otpinfo);
 727
 728                 /* Burst Read info */
 729                 offs += extp->extra[offs+1]+2;
 730
 731                 /* Number of partition regions */
 732                 numregions = extp->extra[offs];
 733                 offs += 1;
 734
 735                 /* skip the sizeof(partregion) field in CFI 1.4 */
 736                 if (extp->MinorVersion >= '4')
 737                         offs += 2;
 738
 739                 /* Number of hardware partitions */
 740                 numparts = 0;
 741                 for (i = 0; i < numregions; i++) {
 742                         struct cfi_intelext_regioninfo *rinfo;
 743                         rinfo = (struct cfi_intelext_regioninfo *)&extp->extra[offs];
 744                         numparts += rinfo->NumIdentPartitions;
 745                         offs += sizeof(*rinfo)
 746                                 + (rinfo->NumBlockTypes - 1) *
 747                                   sizeof(struct cfi_intelext_blockinfo);
 748                 }
 749
 750                 if (!numparts)
 751                         numparts = 1;
 752
 753                 /* Programming Region info */
 754                 if (extp->MinorVersion >= '4') {
 755                         struct cfi_intelext_programming_regioninfo *prinfo;
 756                         prinfo = (struct cfi_intelext_programming_regioninfo *)&extp->extra[offs];
 757                         mtd->writesize = cfi->interleave << prinfo->ProgRegShift;
 758                         mtd->flags &= ~MTD_BIT_WRITEABLE;
 759                         printk(KERN_DEBUG "%s: program region size/ctrl_valid/ctrl_inval = %d/%d/%d\n",
 760                                map->name, mtd->writesize,
 761                                cfi->interleave * prinfo->ControlValid,
 762                                cfi->interleave * prinfo->ControlInvalid);
 763                 }
 764
 765                 /*
 766                  * All functions below currently rely on all chips having
 767                  * the same geometry so we'll just assume that all hardware
 768                  * partitions are of the same size too.
 769                  */
 770                 partshift = cfi->chipshift - __ffs(numparts);
 771
 772                 if ((1 << partshift) < mtd->erasesize) {
 773                         printk( KERN_ERR
 774                                 "%s: bad number of hw partitions (%d)\n",
 775                                 __func__, numparts);
 776                         return -EINVAL;
 777                 }
 778
 779                 numvirtchips = cfi->numchips * numparts;
 780                 newcfi = kmalloc(struct_size(newcfi, chips, numvirtchips),
 781                                  GFP_KERNEL);
 782                 if (!newcfi)
 783                         return -ENOMEM;
 784                 shared = kmalloc_array(cfi->numchips,
 785                                        sizeof(struct flchip_shared),
 786                                        GFP_KERNEL);
 787                 if (!shared) {
 788                         kfree(newcfi);
 789                         return -ENOMEM;
 790                 }
 791                 memcpy(newcfi, cfi, sizeof(struct cfi_private));
 792                 newcfi->numchips = numvirtchips;
 793                 newcfi->chipshift = partshift;
 794
 795                 chip = &newcfi->chips[0];
 796                 for (i = 0; i < cfi->numchips; i++) {
 797                         shared[i].writing = shared[i].erasing = NULL;
 798                         mutex_init(&shared[i].lock);
 799                         for (j = 0; j < numparts; j++) {
 800                                 *chip = cfi->chips[i];
 801                                 chip->start += j << partshift;
 802                                 chip->priv = &shared[i];
 803                                 /* those should be reset too since
 804                                    they create memory references. */
 805                                 init_waitqueue_head(&chip->wq);
 806                                 mutex_init(&chip->mutex);
 807                                 chip++;
 808                         }
 809                 }
 810
 811                 printk(KERN_DEBUG "%s: %d set(s) of %d interleaved chips "
 812                                   "--> %d partitions of %d KiB\n",
 813                                   map->name, cfi->numchips, cfi->interleave,
 814                                   newcfi->numchips, 1<<(newcfi->chipshift-10));
 815
 816                 map->fldrv_priv = newcfi;
 817                 *pcfi = newcfi;
 818                 kfree(cfi);
 819         }
 820
 821         return 0;
 822 }
 823
 824 /*
 825  *  *********** CHIP ACCESS FUNCTIONS ***********
 826  */
 827 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode)
 828 {
 829         DECLARE_WAITQUEUE(wait, current);
 830         struct cfi_private *cfi = map->fldrv_priv;
 831         map_word status, status_OK = CMD(0x80), status_PWS = CMD(0x01);
 832         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 833         unsigned long timeo = jiffies + HZ;
 834
 835         /* Prevent setting state FL_SYNCING for chip in suspended state. */
 836         if (mode == FL_SYNCING && chip->oldstate != FL_READY)
 837                 goto sleep;
 838
 839         switch (chip->state) {
 840
 841         case FL_STATUS:
 842                 for (;;) {
 843                         status = map_read(map, adr);
 844                         if (map_word_andequal(map, status, status_OK, status_OK))
 845                                 break;
 846
 847                         /* At this point we're fine with write operations
 848                            in other partitions as they don't conflict. */
 849                         if (chip->priv && map_word_andequal(map, status, status_PWS, status_PWS))
 850                                 break;
 851
 852                         mutex_unlock(&chip->mutex);
 853                         cfi_udelay(1);
 854                         mutex_lock(&chip->mutex);
 855                         /* Someone else might have been playing with it. */
 856                         return -EAGAIN;
 857                 }
 858                 fallthrough;
 859         case FL_READY:
 860         case FL_CFI_QUERY:
 861         case FL_JEDEC_QUERY:
 862                 return 0;
 863
 864         case FL_ERASING:
 865                 if (!cfip ||
 866                     !(cfip->FeatureSupport & 2) ||
 867                     !(mode == FL_READY || mode == FL_POINT ||
 868                      (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
 869                         goto sleep;
 870
 871                 /* Do not allow suspend iff read/write to EB address */
 872                 if ((adr & chip->in_progress_block_mask) ==
 873                     chip->in_progress_block_addr)
 874                         goto sleep;
 875
 876                 /* do not suspend small EBs, buggy Micron Chips */
 877                 if (cfi_is_micron_28F00AP30(cfi, chip) &&
 878                     (chip->in_progress_block_mask == ~(0x8000-1)))
 879                         goto sleep;
 880
 881                 /* Erase suspend */
 882                 map_write(map, CMD(0xB0), chip->in_progress_block_addr);
 883
 884                 /* If the flash has finished erasing, then 'erase suspend'
 885                  * appears to make some (28F320) flash devices switch to
 886                  * 'read' mode.  Make sure that we switch to 'read status'
 887                  * mode so we get the right data. --rmk
 888                  */
 889                 map_write(map, CMD(0x70), chip->in_progress_block_addr);
 890                 chip->oldstate = FL_ERASING;
 891                 chip->state = FL_ERASE_SUSPENDING;
 892                 chip->erase_suspended = 1;
 893                 for (;;) {
 894                         status = map_read(map, chip->in_progress_block_addr);
 895                         if (map_word_andequal(map, status, status_OK, status_OK))
 896                                 break;
 897
 898                         if (time_after(jiffies, timeo)) {
 899                                 /* Urgh. Resume and pretend we weren't here.
 900                                  * Make sure we're in 'read status' mode if it had finished */
 901                                 put_chip(map, chip, adr);
 902                                 printk(KERN_ERR "%s: Chip not ready after erase "
 903                                        "suspended: status = 0x%lx\n", map->name, status.x[0]);
 904                                 return -EIO;
 905                         }
 906
 907                         mutex_unlock(&chip->mutex);
 908                         cfi_udelay(1);
 909                         mutex_lock(&chip->mutex);
 910                         /* Nobody will touch it while it's in state FL_ERASE_SUSPENDING.
 911                            So we can just loop here. */
 912                 }
 913                 chip->state = FL_STATUS;
 914                 return 0;
 915
 916         case FL_XIP_WHILE_ERASING:
 917                 if (mode != FL_READY && mode != FL_POINT &&
 918                     (mode != FL_WRITING || !cfip || !(cfip->SuspendCmdSupport&1)))
 919                         goto sleep;
 920                 chip->oldstate = chip->state;
 921                 chip->state = FL_READY;
 922                 return 0;
 923
 924         case FL_SHUTDOWN:
 925                 /* The machine is rebooting now,so no one can get chip anymore */
 926                 return -EIO;
 927         case FL_POINT:
 928                 /* Only if there's no operation suspended... */
 929                 if (mode == FL_READY && chip->oldstate == FL_READY)
 930                         return 0;
 931                 fallthrough;
 932         default:
 933         sleep:
 934                 set_current_state(TASK_UNINTERRUPTIBLE);
 935                 add_wait_queue(&chip->wq, &wait);
 936                 mutex_unlock(&chip->mutex);
 937                 schedule();
 938                 remove_wait_queue(&chip->wq, &wait);
 939                 mutex_lock(&chip->mutex);
 940                 return -EAGAIN;
 941         }
 942 }
 943
 944 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode)
 945 {
 946         int ret;
 947         DECLARE_WAITQUEUE(wait, current);
 948
 949  retry:
 950         if (chip->priv &&
 951             (mode == FL_WRITING || mode == FL_ERASING || mode == FL_OTP_WRITE
 952             || mode == FL_SHUTDOWN) && chip->state != FL_SYNCING) {
 953                 /*
 954                  * OK. We have possibility for contention on the write/erase
 955                  * operations which are global to the real chip and not per
 956                  * partition.  So let's fight it over in the partition which
 957                  * currently has authority on the operation.
 958                  *
 959                  * The rules are as follows:
 960                  *
 961                  * - any write operation must own shared->writing.
 962                  *
 963                  * - any erase operation must own _both_ shared->writing and
 964                  *   shared->erasing.
 965                  *
 966                  * - contention arbitration is handled in the owner's context.
 967                  *
 968                  * The 'shared' struct can be read and/or written only when
 969                  * its lock is taken.
 970                  */
 971                 struct flchip_shared *shared = chip->priv;
 972                 struct flchip *contender;
 973                 mutex_lock(&shared->lock);
 974                 contender = shared->writing;
 975                 if (contender && contender != chip) {
 976                         /*
 977                          * The engine to perform desired operation on this
 978                          * partition is already in use by someone else.
 979                          * Let's fight over it in the context of the chip
 980                          * currently using it.  If it is possible to suspend,
 981                          * that other partition will do just that, otherwise
 982                          * it'll happily send us to sleep.  In any case, when
 983                          * get_chip returns success we're clear to go ahead.
 984                          */
 985                         ret = mutex_trylock(&contender->mutex);
 986                         mutex_unlock(&shared->lock);
 987                         if (!ret)
 988                                 goto retry;
 989                         mutex_unlock(&chip->mutex);
 990                         ret = chip_ready(map, contender, contender->start, mode);
 991                         mutex_lock(&chip->mutex);
 992
 993                         if (ret == -EAGAIN) {
 994                                 mutex_unlock(&contender->mutex);
 995                                 goto retry;
 996                         }
 997                         if (ret) {
 998                                 mutex_unlock(&contender->mutex);
 999                                 return ret;
1000                         }
1001                         mutex_lock(&shared->lock);
1002
1003                         /* We should not own chip if it is already
1004                          * in FL_SYNCING state. Put contender and retry. */
1005                         if (chip->state == FL_SYNCING) {
1006                                 put_chip(map, contender, contender->start);
1007                                 mutex_unlock(&contender->mutex);
1008                                 goto retry;
1009                         }
1010                         mutex_unlock(&contender->mutex);
1011                 }
1012
1013                 /* Check if we already have suspended erase
1014                  * on this chip. Sleep. */
1015                 if (mode == FL_ERASING && shared->erasing
1016                     && shared->erasing->oldstate == FL_ERASING) {
1017                         mutex_unlock(&shared->lock);
1018                         set_current_state(TASK_UNINTERRUPTIBLE);
1019                         add_wait_queue(&chip->wq, &wait);
1020                         mutex_unlock(&chip->mutex);
1021                         schedule();
1022                         remove_wait_queue(&chip->wq, &wait);
1023                         mutex_lock(&chip->mutex);
1024                         goto retry;
1025                 }
1026
1027                 /* We now own it */
1028                 shared->writing = chip;
1029                 if (mode == FL_ERASING)
1030                         shared->erasing = chip;
1031                 mutex_unlock(&shared->lock);
1032         }
1033         ret = chip_ready(map, chip, adr, mode);
1034         if (ret == -EAGAIN)
1035                 goto retry;
1036
1037         return ret;
1038 }
1039
1040 static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr)
1041 {
1042         struct cfi_private *cfi = map->fldrv_priv;
1043
1044         if (chip->priv) {
1045                 struct flchip_shared *shared = chip->priv;
1046                 mutex_lock(&shared->lock);
1047                 if (shared->writing == chip && chip->oldstate == FL_READY) {
1048                         /* We own the ability to write, but we're done */
1049                         shared->writing = shared->erasing;
1050                         if (shared->writing && shared->writing != chip) {
1051                                 /* give back ownership to who we loaned it from */
1052                                 struct flchip *loaner = shared->writing;
1053                                 mutex_lock(&loaner->mutex);
1054                                 mutex_unlock(&shared->lock);
1055                                 mutex_unlock(&chip->mutex);
1056                                 put_chip(map, loaner, loaner->start);
1057                                 mutex_lock(&chip->mutex);
1058                                 mutex_unlock(&loaner->mutex);
1059                                 wake_up(&chip->wq);
1060                                 return;
1061                         }
1062                         shared->erasing = NULL;
1063                         shared->writing = NULL;
1064                 } else if (shared->erasing == chip && shared->writing != chip) {
1065                         /*
1066                          * We own the ability to erase without the ability
1067                          * to write, which means the erase was suspended
1068                          * and some other partition is currently writing.
1069                          * Don't let the switch below mess things up since
1070                          * we don't have ownership to resume anything.
1071                          */
1072                         mutex_unlock(&shared->lock);
1073                         wake_up(&chip->wq);
1074                         return;
1075                 }
1076                 mutex_unlock(&shared->lock);
1077         }
1078
1079         switch(chip->oldstate) {
1080         case FL_ERASING:
1081                 /* What if one interleaved chip has finished and the
1082                    other hasn't? The old code would leave the finished
1083                    one in READY mode. That's bad, and caused -EROFS
1084                    errors to be returned from do_erase_oneblock because
1085                    that's the only bit it checked for at the time.
1086                    As the state machine appears to explicitly allow
1087                    sending the 0x70 (Read Status) command to an erasing
1088                    chip and expecting it to be ignored, that's what we
1089                    do. */
1090                 map_write(map, CMD(0xd0), chip->in_progress_block_addr);
1091                 map_write(map, CMD(0x70), chip->in_progress_block_addr);
1092                 chip->oldstate = FL_READY;
1093                 chip->state = FL_ERASING;
1094                 break;
1095
1096         case FL_XIP_WHILE_ERASING:
1097                 chip->state = chip->oldstate;
1098                 chip->oldstate = FL_READY;
1099                 break;
1100
1101         case FL_READY:
1102         case FL_STATUS:
1103         case FL_JEDEC_QUERY:
1104                 break;
1105         default:
1106                 printk(KERN_ERR "%s: put_chip() called with oldstate %d!!\n", map->name, chip->oldstate);
1107         }
1108         wake_up(&chip->wq);
1109 }
1110
1111 #ifdef CONFIG_MTD_XIP
1112
1113 /*
1114  * No interrupt what so ever can be serviced while the flash isn't in array
1115  * mode.  This is ensured by the xip_disable() and xip_enable() functions
1116  * enclosing any code path where the flash is known not to be in array mode.
1117  * And within a XIP disabled code path, only functions marked with __xipram
1118  * may be called and nothing else (it's a good thing to inspect generated
1119  * assembly to make sure inline functions were actually inlined and that gcc
1120  * didn't emit calls to its own support functions). Also configuring MTD CFI
1121  * support to a single buswidth and a single interleave is also recommended.
1122  */
1123
1124 static void xip_disable(struct map_info *map, struct flchip *chip,
1125                         unsigned long adr)
1126 {
1127         /* TODO: chips with no XIP use should ignore and return */
1128         (void) map_read(map, adr); /* ensure mmu mapping is up to date */
1129         local_irq_disable();
1130 }
1131
1132 static void __xipram xip_enable(struct map_info *map, struct flchip *chip,
1133                                 unsigned long adr)
1134 {
1135         struct cfi_private *cfi = map->fldrv_priv;
1136         if (chip->state != FL_POINT && chip->state != FL_READY) {
1137                 map_write(map, CMD(0xff), adr);
1138                 chip->state = FL_READY;
1139         }
1140         (void) map_read(map, adr);
1141         xip_iprefetch();
1142         local_irq_enable();
1143 }
1144
1145 /*
1146  * When a delay is required for the flash operation to complete, the
1147  * xip_wait_for_operation() function is polling for both the given timeout
1148  * and pending (but still masked) hardware interrupts.  Whenever there is an
1149  * interrupt pending then the flash erase or write operation is suspended,
1150  * array mode restored and interrupts unmasked.  Task scheduling might also
1151  * happen at that point.  The CPU eventually returns from the interrupt or
1152  * the call to schedule() and the suspended flash operation is resumed for
1153  * the remaining of the delay period.
1154  *
1155  * Warning: this function _will_ fool interrupt latency tracing tools.
1156  */
1157
1158 static int __xipram xip_wait_for_operation(
1159                 struct map_info *map, struct flchip *chip,
1160                 unsigned long adr, unsigned int chip_op_time_max)
1161 {
1162         struct cfi_private *cfi = map->fldrv_priv;
1163         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
1164         map_word status, OK = CMD(0x80);
1165         unsigned long usec, suspended, start, done;
1166         flstate_t oldstate, newstate;
1167
1168         start = xip_currtime();
1169         usec = chip_op_time_max;
1170         if (usec == 0)
1171                 usec = 500000;
1172         done = 0;
1173
1174         do {
1175                 cpu_relax();
1176                 if (xip_irqpending() && cfip &&
1177                     ((chip->state == FL_ERASING && (cfip->FeatureSupport&2)) ||
1178                      (chip->state == FL_WRITING && (cfip->FeatureSupport&4))) &&
1179                     (cfi_interleave_is_1(cfi) || chip->oldstate == FL_READY)) {
1180                         /*
1181                          * Let's suspend the erase or write operation when
1182                          * supported.  Note that we currently don't try to
1183                          * suspend interleaved chips if there is already
1184                          * another operation suspended (imagine what happens
1185                          * when one chip was already done with the current
1186                          * operation while another chip suspended it, then
1187                          * we resume the whole thing at once).  Yes, it
1188                          * can happen!
1189                          */
1190                         usec -= done;
1191                         map_write(map, CMD(0xb0), adr);
1192                         map_write(map, CMD(0x70), adr);
1193                         suspended = xip_currtime();
1194                         do {
1195                                 if (xip_elapsed_since(suspended) > 100000) {
1196                                         /*
1197                                          * The chip doesn't want to suspend
1198                                          * after waiting for 100 msecs.
1199                                          * This is a critical error but there
1200                                          * is not much we can do here.
1201                                          */
1202                                         return -EIO;
1203                                 }
1204                                 status = map_read(map, adr);
1205                         } while (!map_word_andequal(map, status, OK, OK));
1206
1207                         /* Suspend succeeded */
1208                         oldstate = chip->state;
1209                         if (oldstate == FL_ERASING) {
1210                                 if (!map_word_bitsset(map, status, CMD(0x40)))
1211                                         break;
1212                                 newstate = FL_XIP_WHILE_ERASING;
1213                                 chip->erase_suspended = 1;
1214                         } else {
1215                                 if (!map_word_bitsset(map, status, CMD(0x04)))
1216                                         break;
1217                                 newstate = FL_XIP_WHILE_WRITING;
1218                                 chip->write_suspended = 1;
1219                         }
1220                         chip->state = newstate;
1221                         map_write(map, CMD(0xff), adr);
1222                         (void) map_read(map, adr);
1223                         xip_iprefetch();
1224                         local_irq_enable();
1225                         mutex_unlock(&chip->mutex);
1226                         xip_iprefetch();
1227                         cond_resched();
1228
1229                         /*
1230                          * We're back.  However someone else might have
1231                          * decided to go write to the chip if we are in
1232                          * a suspended erase state.  If so let's wait
1233                          * until it's done.
1234                          */
1235                         mutex_lock(&chip->mutex);
1236                         while (chip->state != newstate) {
1237                                 DECLARE_WAITQUEUE(wait, current);
1238                                 set_current_state(TASK_UNINTERRUPTIBLE);
1239                                 add_wait_queue(&chip->wq, &wait);
1240                                 mutex_unlock(&chip->mutex);
1241                                 schedule();
1242                                 remove_wait_queue(&chip->wq, &wait);
1243                                 mutex_lock(&chip->mutex);
1244                         }
1245                         /* Disallow XIP again */
1246                         local_irq_disable();
1247
1248                         /* Resume the write or erase operation */
1249                         map_write(map, CMD(0xd0), adr);
1250                         map_write(map, CMD(0x70), adr);
1251                         chip->state = oldstate;
1252                         start = xip_currtime();
1253                 } else if (usec >= 1000000/HZ) {
1254                         /*
1255                          * Try to save on CPU power when waiting delay
1256                          * is at least a system timer tick period.
1257                          * No need to be extremely accurate here.
1258                          */
1259                         xip_cpu_idle();
1260                 }
1261                 status = map_read(map, adr);
1262                 done = xip_elapsed_since(start);
1263         } while (!map_word_andequal(map, status, OK, OK)
1264                  && done < usec);
1265
1266         return (done >= usec) ? -ETIME : 0;
1267 }
1268
1269 /*
1270  * The INVALIDATE_CACHED_RANGE() macro is normally used in parallel while
1271  * the flash is actively programming or erasing since we have to poll for
1272  * the operation to complete anyway.  We can't do that in a generic way with
1273  * a XIP setup so do it before the actual flash operation in this case
1274  * and stub it out from INVAL_CACHE_AND_WAIT.
1275  */
1276 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
1277         INVALIDATE_CACHED_RANGE(map, from, size)
1278
1279 #define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec, usec_max) \
1280         xip_wait_for_operation(map, chip, cmd_adr, usec_max)
1281
1282 #else
1283
1284 #define xip_disable(map, chip, adr)
1285 #define xip_enable(map, chip, adr)
1286 #define XIP_INVAL_CACHED_RANGE(x...)
1287 #define INVAL_CACHE_AND_WAIT inval_cache_and_wait_for_operation
1288
1289 static int inval_cache_and_wait_for_operation(
1290                 struct map_info *map, struct flchip *chip,
1291                 unsigned long cmd_adr, unsigned long inval_adr, int inval_len,
1292                 unsigned int chip_op_time, unsigned int chip_op_time_max)
1293 {
1294         struct cfi_private *cfi = map->fldrv_priv;
1295         map_word status, status_OK = CMD(0x80);
1296         int chip_state = chip->state;
1297         unsigned int timeo, sleep_time, reset_timeo;
1298
1299         mutex_unlock(&chip->mutex);
1300         if (inval_len)
1301                 INVALIDATE_CACHED_RANGE(map, inval_adr, inval_len);
1302         mutex_lock(&chip->mutex);
1303
1304         timeo = chip_op_time_max;
1305         if (!timeo)
1306                 timeo = 500000;
1307         reset_timeo = timeo;
1308         sleep_time = chip_op_time / 2;
1309
1310         for (;;) {
1311                 if (chip->state != chip_state) {
1312                         /* Someone's suspended the operation: sleep */
1313                         DECLARE_WAITQUEUE(wait, current);
1314                         set_current_state(TASK_UNINTERRUPTIBLE);
1315                         add_wait_queue(&chip->wq, &wait);
1316                         mutex_unlock(&chip->mutex);
1317                         schedule();
1318                         remove_wait_queue(&chip->wq, &wait);
1319                         mutex_lock(&chip->mutex);
1320                         continue;
1321                 }
1322
1323                 status = map_read(map, cmd_adr);
1324                 if (map_word_andequal(map, status, status_OK, status_OK))
1325                         break;
1326
1327                 if (chip->erase_suspended && chip_state == FL_ERASING)  {
1328                         /* Erase suspend occurred while sleep: reset timeout */
1329                         timeo = reset_timeo;
1330                         chip->erase_suspended = 0;
1331                 }
1332                 if (chip->write_suspended && chip_state == FL_WRITING)  {
1333                         /* Write suspend occurred while sleep: reset timeout */
1334                         timeo = reset_timeo;
1335                         chip->write_suspended = 0;
1336                 }
1337                 if (!timeo) {
1338                         map_write(map, CMD(0x70), cmd_adr);
1339                         chip->state = FL_STATUS;
1340                         return -ETIME;
1341                 }
1342
1343                 /* OK Still waiting. Drop the lock, wait a while and retry. */
1344                 mutex_unlock(&chip->mutex);
1345                 if (sleep_time >= 1000000/HZ) {
1346                         /*
1347                          * Half of the normal delay still remaining
1348                          * can be performed with a sleeping delay instead
1349                          * of busy waiting.
1350                          */
1351                         msleep(sleep_time/1000);
1352                         timeo -= sleep_time;
1353                         sleep_time = 1000000/HZ;
1354                 } else {
1355                         udelay(1);
1356                         cond_resched();
1357                         timeo--;
1358                 }
1359                 mutex_lock(&chip->mutex);
1360         }
1361
1362         /* Done and happy. */
1363         chip->state = FL_STATUS;
1364         return 0;
1365 }
1366
1367 #endif
1368
1369 #define WAIT_TIMEOUT(map, chip, adr, udelay, udelay_max) \
1370         INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay, udelay_max);
1371
1372
1373 static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t adr, size_t len)
1374 {
1375         unsigned long cmd_addr;
1376         struct cfi_private *cfi = map->fldrv_priv;
1377         int ret;
1378
1379         adr += chip->start;
1380
1381         /* Ensure cmd read/writes are aligned. */
1382         cmd_addr = adr & ~(map_bankwidth(map)-1);
1383
1384         mutex_lock(&chip->mutex);
1385
1386         ret = get_chip(map, chip, cmd_addr, FL_POINT);
1387
1388         if (!ret) {
1389                 if (chip->state != FL_POINT && chip->state != FL_READY)
1390                         map_write(map, CMD(0xff), cmd_addr);
1391
1392                 chip->state = FL_POINT;
1393                 chip->ref_point_counter++;
1394         }
1395         mutex_unlock(&chip->mutex);
1396
1397         return ret;
1398 }
1399
1400 static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
1401                 size_t *retlen, void **virt, resource_size_t *phys)
1402 {
1403         struct map_info *map = mtd->priv;
1404         struct cfi_private *cfi = map->fldrv_priv;
1405         unsigned long ofs, last_end = 0;
1406         int chipnum;
1407         int ret;
1408
1409         if (!map->virt)
1410                 return -EINVAL;
1411
1412         /* Now lock the chip(s) to POINT state */
1413
1414         /* ofs: offset within the first chip that the first read should start */
1415         chipnum = (from >> cfi->chipshift);
1416         ofs = from - (chipnum << cfi->chipshift);
1417
1418         *virt = map->virt + cfi->chips[chipnum].start + ofs;
1419         if (phys)
1420                 *phys = map->phys + cfi->chips[chipnum].start + ofs;
1421
1422         while (len) {
1423                 unsigned long thislen;
1424
1425                 if (chipnum >= cfi->numchips)
1426                         break;
1427
1428                 /* We cannot point across chips that are virtually disjoint */
1429                 if (!last_end)
1430                         last_end = cfi->chips[chipnum].start;
1431                 else if (cfi->chips[chipnum].start != last_end)
1432                         break;
1433
1434                 if ((len + ofs -1) >> cfi->chipshift)
1435                         thislen = (1<<cfi->chipshift) - ofs;
1436                 else
1437                         thislen = len;
1438
1439                 ret = do_point_onechip(map, &cfi->chips[chipnum], ofs, thislen);
1440                 if (ret)
1441                         break;
1442
1443                 *retlen += thislen;
1444                 len -= thislen;
1445
1446                 ofs = 0;
1447                 last_end += 1 << cfi->chipshift;
1448                 chipnum++;
1449         }
1450         return 0;
1451 }
1452
1453 static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
1454 {
1455         struct map_info *map = mtd->priv;
1456         struct cfi_private *cfi = map->fldrv_priv;
1457         unsigned long ofs;
1458         int chipnum, err = 0;
1459
1460         /* Now unlock the chip(s) POINT state */
1461
1462         /* ofs: offset within the first chip that the first read should start */
1463         chipnum = (from >> cfi->chipshift);
1464         ofs = from - (chipnum <<  cfi->chipshift);
1465
1466         while (len && !err) {
1467                 unsigned long thislen;
1468                 struct flchip *chip;
1469
1470                 chip = &cfi->chips[chipnum];
1471                 if (chipnum >= cfi->numchips)
1472                         break;
1473
1474                 if ((len + ofs -1) >> cfi->chipshift)
1475                         thislen = (1<<cfi->chipshift) - ofs;
1476                 else
1477                         thislen = len;
1478
1479                 mutex_lock(&chip->mutex);
1480                 if (chip->state == FL_POINT) {
1481                         chip->ref_point_counter--;
1482                         if(chip->ref_point_counter == 0)
1483                                 chip->state = FL_READY;
1484                 } else {
1485                         printk(KERN_ERR "%s: Error: unpoint called on non pointed region\n", map->name);
1486                         err = -EINVAL;
1487                 }
1488
1489                 put_chip(map, chip, chip->start);
1490                 mutex_unlock(&chip->mutex);
1491
1492                 len -= thislen;
1493                 ofs = 0;
1494                 chipnum++;
1495         }
1496
1497         return err;
1498 }
1499
1500 static inline int do_read_onechip(struct map_info *map, struct flchip *chip, loff_t adr, size_t len, u_char *buf)
1501 {
1502         unsigned long cmd_addr;
1503         struct cfi_private *cfi = map->fldrv_priv;
1504         int ret;
1505
1506         adr += chip->start;
1507
1508         /* Ensure cmd read/writes are aligned. */
1509         cmd_addr = adr & ~(map_bankwidth(map)-1);
1510
1511         mutex_lock(&chip->mutex);
1512         ret = get_chip(map, chip, cmd_addr, FL_READY);
1513         if (ret) {
1514                 mutex_unlock(&chip->mutex);
1515                 return ret;
1516         }
1517
1518         if (chip->state != FL_POINT && chip->state != FL_READY) {
1519                 map_write(map, CMD(0xff), cmd_addr);
1520
1521                 chip->state = FL_READY;
1522         }
1523
1524         map_copy_from(map, buf, adr, len);
1525
1526         put_chip(map, chip, cmd_addr);
1527
1528         mutex_unlock(&chip->mutex);
1529         return 0;
1530 }
1531
1532 static int cfi_intelext_read (struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf)
1533 {
1534         struct map_info *map = mtd->priv;
1535         struct cfi_private *cfi = map->fldrv_priv;
1536         unsigned long ofs;
1537         int chipnum;
1538         int ret = 0;
1539
1540         /* ofs: offset within the first chip that the first read should start */
1541         chipnum = (from >> cfi->chipshift);
1542         ofs = from - (chipnum <<  cfi->chipshift);
1543
1544         while (len) {
1545                 unsigned long thislen;
1546
1547                 if (chipnum >= cfi->numchips)
1548                         break;
1549
1550                 if ((len + ofs -1) >> cfi->chipshift)
1551                         thislen = (1<<cfi->chipshift) - ofs;
1552                 else
1553                         thislen = len;
1554
1555                 ret = do_read_onechip(map, &cfi->chips[chipnum], ofs, thislen, buf);
1556                 if (ret)
1557                         break;
1558
1559                 *retlen += thislen;
1560                 len -= thislen;
1561                 buf += thislen;
1562
1563                 ofs = 0;
1564                 chipnum++;
1565         }
1566         return ret;
1567 }
1568
1569 static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
1570                                      unsigned long adr, map_word datum, int mode)
1571 {
1572         struct cfi_private *cfi = map->fldrv_priv;
1573         map_word status, write_cmd;
1574         int ret;
1575
1576         adr += chip->start;
1577
1578         switch (mode) {
1579         case FL_WRITING:
1580                 write_cmd = (cfi->cfiq->P_ID != P_ID_INTEL_PERFORMANCE) ? CMD(0x40) : CMD(0x41);
1581                 break;
1582         case FL_OTP_WRITE:
1583                 write_cmd = CMD(0xc0);
1584                 break;
1585         default:
1586                 return -EINVAL;
1587         }
1588
1589         mutex_lock(&chip->mutex);
1590         ret = get_chip(map, chip, adr, mode);
1591         if (ret) {
1592                 mutex_unlock(&chip->mutex);
1593                 return ret;
1594         }
1595
1596         XIP_INVAL_CACHED_RANGE(map, adr, map_bankwidth(map));
1597         ENABLE_VPP(map);
1598         xip_disable(map, chip, adr);
1599         map_write(map, write_cmd, adr);
1600         map_write(map, datum, adr);
1601         chip->state = mode;
1602
1603         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
1604                                    adr, map_bankwidth(map),
1605                                    chip->word_write_time,
1606                                    chip->word_write_time_max);
1607         if (ret) {
1608                 xip_enable(map, chip, adr);
1609                 printk(KERN_ERR "%s: word write error (status timeout)\n", map->name);
1610                 goto out;
1611         }
1612
1613         /* check for errors */
1614         status = map_read(map, adr);
1615         if (map_word_bitsset(map, status, CMD(0x1a))) {
1616                 unsigned long chipstatus = MERGESTATUS(status);
1617
1618                 /* reset status */
1619                 map_write(map, CMD(0x50), adr);
1620                 map_write(map, CMD(0x70), adr);
1621                 xip_enable(map, chip, adr);
1622
1623                 if (chipstatus & 0x02) {
1624                         ret = -EROFS;
1625                 } else if (chipstatus & 0x08) {
1626                         printk(KERN_ERR "%s: word write error (bad VPP)\n", map->name);
1627                         ret = -EIO;
1628                 } else {
1629                         printk(KERN_ERR "%s: word write error (status 0x%lx)\n", map->name, chipstatus);
1630                         ret = -EINVAL;
1631                 }
1632
1633                 goto out;
1634         }
1635
1636         xip_enable(map, chip, adr);
1637  out:   DISABLE_VPP(map);
1638         put_chip(map, chip, adr);
1639         mutex_unlock(&chip->mutex);
1640         return ret;
1641 }
1642
1643
1644 static int cfi_intelext_write_words (struct mtd_info *mtd, loff_t to , size_t len, size_t *retlen, const u_char *buf)
1645 {
1646         struct map_info *map = mtd->priv;
1647         struct cfi_private *cfi = map->fldrv_priv;
1648         int ret;
1649         int chipnum;
1650         unsigned long ofs;
1651
1652         chipnum = to >> cfi->chipshift;
1653         ofs = to  - (chipnum << cfi->chipshift);
1654
1655         /* If it's not bus-aligned, do the first byte write */
1656         if (ofs & (map_bankwidth(map)-1)) {
1657                 unsigned long bus_ofs = ofs & ~(map_bankwidth(map)-1);
1658                 int gap = ofs - bus_ofs;
1659                 int n;
1660                 map_word datum;
1661
1662                 n = min_t(int, len, map_bankwidth(map)-gap);
1663                 datum = map_word_ff(map);
1664                 datum = map_word_load_partial(map, datum, buf, gap, n);
1665
1666                 ret = do_write_oneword(map, &cfi->chips[chipnum],
1667                                                bus_ofs, datum, FL_WRITING);
1668                 if (ret)
1669                         return ret;
1670
1671                 len -= n;
1672                 ofs += n;
1673                 buf += n;
1674                 (*retlen) += n;
1675
1676                 if (ofs >> cfi->chipshift) {
1677                         chipnum ++;
1678                         ofs = 0;
1679                         if (chipnum == cfi->numchips)
1680                                 return 0;
1681                 }
1682         }
1683
1684         while(len >= map_bankwidth(map)) {
1685                 map_word datum = map_word_load(map, buf);
1686
1687                 ret = do_write_oneword(map, &cfi->chips[chipnum],
1688                                        ofs, datum, FL_WRITING);
1689                 if (ret)
1690                         return ret;
1691
1692                 ofs += map_bankwidth(map);
1693                 buf += map_bankwidth(map);
1694                 (*retlen) += map_bankwidth(map);
1695                 len -= map_bankwidth(map);
1696
1697                 if (ofs >> cfi->chipshift) {
1698                         chipnum ++;
1699                         ofs = 0;
1700                         if (chipnum == cfi->numchips)
1701                                 return 0;
1702                 }
1703         }
1704
1705         if (len & (map_bankwidth(map)-1)) {
1706                 map_word datum;
1707
1708                 datum = map_word_ff(map);
1709                 datum = map_word_load_partial(map, datum, buf, 0, len);
1710
1711                 ret = do_write_oneword(map, &cfi->chips[chipnum],
1712                                        ofs, datum, FL_WRITING);
1713                 if (ret)
1714                         return ret;
1715
1716                 (*retlen) += len;
1717         }
1718
1719         return 0;
1720 }
1721
1722
1723 static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
1724                                     unsigned long adr, const struct kvec **pvec,
1725                                     unsigned long *pvec_seek, int len)
1726 {
1727         struct cfi_private *cfi = map->fldrv_priv;
1728         map_word status, write_cmd, datum;
1729         unsigned long cmd_adr;
1730         int ret, wbufsize, word_gap, words;
1731         const struct kvec *vec;
1732         unsigned long vec_seek;
1733         unsigned long initial_adr;
1734         int initial_len = len;
1735
1736         wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
1737         adr += chip->start;
1738         initial_adr = adr;
1739         cmd_adr = adr & ~(wbufsize-1);
1740
1741         /* Sharp LH28F640BF chips need the first address for the
1742          * Page Buffer Program command. See Table 5 of
1743          * LH28F320BF, LH28F640BF, LH28F128BF Series (Appendix FUM00701) */
1744         if (is_LH28F640BF(cfi))
1745                 cmd_adr = adr;
1746
1747         /* Let's determine this according to the interleave only once */
1748         write_cmd = (cfi->cfiq->P_ID != P_ID_INTEL_PERFORMANCE) ? CMD(0xe8) : CMD(0xe9);
1749
1750         mutex_lock(&chip->mutex);
1751         ret = get_chip(map, chip, cmd_adr, FL_WRITING);
1752         if (ret) {
1753                 mutex_unlock(&chip->mutex);
1754                 return ret;
1755         }
1756
1757         XIP_INVAL_CACHED_RANGE(map, initial_adr, initial_len);
1758         ENABLE_VPP(map);
1759         xip_disable(map, chip, cmd_adr);
1760
1761         /* §4.8 of the 28FxxxJ3A datasheet says "Any time SR.4 and/or SR.5 is set
1762            [...], the device will not accept any more Write to Buffer commands".
1763            So we must check here and reset those bits if they're set. Otherwise
1764            we're just pissing in the wind */
1765         if (chip->state != FL_STATUS) {
1766                 map_write(map, CMD(0x70), cmd_adr);
1767                 chip->state = FL_STATUS;
1768         }
1769         status = map_read(map, cmd_adr);
1770         if (map_word_bitsset(map, status, CMD(0x30))) {
1771                 xip_enable(map, chip, cmd_adr);
1772                 printk(KERN_WARNING "SR.4 or SR.5 bits set in buffer write (status %lx). Clearing.\n", status.x[0]);
1773                 xip_disable(map, chip, cmd_adr);
1774                 map_write(map, CMD(0x50), cmd_adr);
1775                 map_write(map, CMD(0x70), cmd_adr);
1776         }
1777
1778         chip->state = FL_WRITING_TO_BUFFER;
1779         map_write(map, write_cmd, cmd_adr);
1780         ret = WAIT_TIMEOUT(map, chip, cmd_adr, 0, 0);
1781         if (ret) {
1782                 /* Argh. Not ready for write to buffer */
1783                 map_word Xstatus = map_read(map, cmd_adr);
1784                 map_write(map, CMD(0x70), cmd_adr);
1785                 chip->state = FL_STATUS;
1786                 status = map_read(map, cmd_adr);
1787                 map_write(map, CMD(0x50), cmd_adr);
1788                 map_write(map, CMD(0x70), cmd_adr);
1789                 xip_enable(map, chip, cmd_adr);
1790                 printk(KERN_ERR "%s: Chip not ready for buffer write. Xstatus = %lx, status = %lx\n",
1791                                 map->name, Xstatus.x[0], status.x[0]);
1792                 goto out;
1793         }
1794
1795         /* Figure out the number of words to write */
1796         word_gap = (-adr & (map_bankwidth(map)-1));
1797         words = DIV_ROUND_UP(len - word_gap, map_bankwidth(map));
1798         if (!word_gap) {
1799                 words--;
1800         } else {
1801                 word_gap = map_bankwidth(map) - word_gap;
1802                 adr -= word_gap;
1803                 datum = map_word_ff(map);
1804         }
1805
1806         /* Write length of data to come */
1807         map_write(map, CMD(words), cmd_adr );
1808
1809         /* Write data */
1810         vec = *pvec;
1811         vec_seek = *pvec_seek;
1812         do {
1813                 int n = map_bankwidth(map) - word_gap;
1814                 if (n > vec->iov_len - vec_seek)
1815                         n = vec->iov_len - vec_seek;
1816                 if (n > len)
1817                         n = len;
1818
1819                 if (!word_gap && len < map_bankwidth(map))
1820                         datum = map_word_ff(map);
1821
1822                 datum = map_word_load_partial(map, datum,
1823                                               vec->iov_base + vec_seek,
1824                                               word_gap, n);
1825
1826                 len -= n;
1827                 word_gap += n;
1828                 if (!len || word_gap == map_bankwidth(map)) {
1829                         map_write(map, datum, adr);
1830                         adr += map_bankwidth(map);
1831                         word_gap = 0;
1832                 }
1833
1834                 vec_seek += n;
1835                 if (vec_seek == vec->iov_len) {
1836                         vec++;
1837                         vec_seek = 0;
1838                 }
1839         } while (len);
1840         *pvec = vec;
1841         *pvec_seek = vec_seek;
1842
1843         /* GO GO GO */
1844         map_write(map, CMD(0xd0), cmd_adr);
1845         chip->state = FL_WRITING;
1846
1847         ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
1848                                    initial_adr, initial_len,
1849                                    chip->buffer_write_time,
1850                                    chip->buffer_write_time_max);
1851         if (ret) {
1852                 map_write(map, CMD(0x70), cmd_adr);
1853                 chip->state = FL_STATUS;
1854                 xip_enable(map, chip, cmd_adr);
1855                 printk(KERN_ERR "%s: buffer write error (status timeout)\n", map->name);
1856                 goto out;
1857         }
1858
1859         /* check for errors */
1860         status = map_read(map, cmd_adr);
1861         if (map_word_bitsset(map, status, CMD(0x1a))) {
1862                 unsigned long chipstatus = MERGESTATUS(status);
1863
1864                 /* reset status */
1865                 map_write(map, CMD(0x50), cmd_adr);
1866                 map_write(map, CMD(0x70), cmd_adr);
1867                 xip_enable(map, chip, cmd_adr);
1868
1869                 if (chipstatus & 0x02) {
1870                         ret = -EROFS;
1871                 } else if (chipstatus & 0x08) {
1872                         printk(KERN_ERR "%s: buffer write error (bad VPP)\n", map->name);
1873                         ret = -EIO;
1874                 } else {
1875                         printk(KERN_ERR "%s: buffer write error (status 0x%lx)\n", map->name, chipstatus);
1876                         ret = -EINVAL;
1877                 }
1878
1879                 goto out;
1880         }
1881
1882         xip_enable(map, chip, cmd_adr);
1883  out:   DISABLE_VPP(map);
1884         put_chip(map, chip, cmd_adr);
1885         mutex_unlock(&chip->mutex);
1886         return ret;
1887 }
1888
1889 static int cfi_intelext_writev (struct mtd_info *mtd, const struct kvec *vecs,
1890                                 unsigned long count, loff_t to, size_t *retlen)
1891 {
1892         struct map_info *map = mtd->priv;
1893         struct cfi_private *cfi = map->fldrv_priv;
1894         int wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
1895         int ret;
1896         int chipnum;
1897         unsigned long ofs, vec_seek, i;
1898         size_t len = 0;
1899
1900         for (i = 0; i < count; i++)
1901                 len += vecs[i].iov_len;
1902
1903         if (!len)
1904                 return 0;
1905
1906         chipnum = to >> cfi->chipshift;
1907         ofs = to - (chipnum << cfi->chipshift);
1908         vec_seek = 0;
1909
1910         do {
1911                 /* We must not cross write block boundaries */
1912                 int size = wbufsize - (ofs & (wbufsize-1));
1913
1914                 if (size > len)
1915                         size = len;
1916                 ret = do_write_buffer(map, &cfi->chips[chipnum],
1917                                       ofs, &vecs, &vec_seek, size);
1918                 if (ret)
1919                         return ret;
1920
1921                 ofs += size;
1922                 (*retlen) += size;
1923                 len -= size;
1924
1925                 if (ofs >> cfi->chipshift) {
1926                         chipnum ++;
1927                         ofs = 0;
1928                         if (chipnum == cfi->numchips)
1929                                 return 0;
1930                 }
1931
1932                 /* Be nice and reschedule with the chip in a usable state for other
1933                    processes. */
1934                 cond_resched();
1935
1936         } while (len);
1937
1938         return 0;
1939 }
1940
1941 static int cfi_intelext_write_buffers (struct mtd_info *mtd, loff_t to,
1942                                        size_t len, size_t *retlen, const u_char *buf)
1943 {
1944         struct kvec vec;
1945
1946         vec.iov_base = (void *) buf;
1947         vec.iov_len = len;
1948
1949         return cfi_intelext_writev(mtd, &vec, 1, to, retlen);
1950 }
1951
1952 static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
1953                                       unsigned long adr, int len, void *thunk)
1954 {
1955         struct cfi_private *cfi = map->fldrv_priv;
1956         map_word status;
1957         int retries = 3;
1958         int ret;
1959
1960         adr += chip->start;
1961
1962  retry:
1963         mutex_lock(&chip->mutex);
1964         ret = get_chip(map, chip, adr, FL_ERASING);
1965         if (ret) {
1966                 mutex_unlock(&chip->mutex);
1967                 return ret;
1968         }
1969
1970         XIP_INVAL_CACHED_RANGE(map, adr, len);
1971         ENABLE_VPP(map);
1972         xip_disable(map, chip, adr);
1973
1974         /* Clear the status register first */
1975         map_write(map, CMD(0x50), adr);
1976
1977         /* Now erase */
1978         map_write(map, CMD(0x20), adr);
1979         map_write(map, CMD(0xD0), adr);
1980         chip->state = FL_ERASING;
1981         chip->erase_suspended = 0;
1982         chip->in_progress_block_addr = adr;
1983         chip->in_progress_block_mask = ~(len - 1);
1984
1985         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
1986                                    adr, len,
1987                                    chip->erase_time,
1988                                    chip->erase_time_max);
1989         if (ret) {
1990                 map_write(map, CMD(0x70), adr);
1991                 chip->state = FL_STATUS;
1992                 xip_enable(map, chip, adr);
1993                 printk(KERN_ERR "%s: block erase error: (status timeout)\n", map->name);
1994                 goto out;
1995         }
1996
1997         /* We've broken this before. It doesn't hurt to be safe */
1998         map_write(map, CMD(0x70), adr);
1999         chip->state = FL_STATUS;
2000         status = map_read(map, adr);
2001
2002         /* check for errors */
2003         if (map_word_bitsset(map, status, CMD(0x3a))) {
2004                 unsigned long chipstatus = MERGESTATUS(status);
2005
2006                 /* Reset the error bits */
2007                 map_write(map, CMD(0x50), adr);
2008                 map_write(map, CMD(0x70), adr);
2009                 xip_enable(map, chip, adr);
2010
2011                 if ((chipstatus & 0x30) == 0x30) {
2012                         printk(KERN_ERR "%s: block erase error: (bad command sequence, status 0x%lx)\n", map->name, chipstatus);
2013                         ret = -EINVAL;
2014                 } else if (chipstatus & 0x02) {
2015                         /* Protection bit set */
2016                         ret = -EROFS;
2017                 } else if (chipstatus & 0x8) {
2018                         /* Voltage */
2019                         printk(KERN_ERR "%s: block erase error: (bad VPP)\n", map->name);
2020                         ret = -EIO;
2021                 } else if (chipstatus & 0x20 && retries--) {
2022                         printk(KERN_DEBUG "block erase failed at 0x%08lx: status 0x%lx. Retrying...\n", adr, chipstatus);
2023                         DISABLE_VPP(map);
2024                         put_chip(map, chip, adr);
2025                         mutex_unlock(&chip->mutex);
2026                         goto retry;
2027                 } else {
2028                         printk(KERN_ERR "%s: block erase failed at 0x%08lx (status 0x%lx)\n", map->name, adr, chipstatus);
2029                         ret = -EIO;
2030                 }
2031
2032                 goto out;
2033         }
2034
2035         xip_enable(map, chip, adr);
2036  out:   DISABLE_VPP(map);
2037         put_chip(map, chip, adr);
2038         mutex_unlock(&chip->mutex);
2039         return ret;
2040 }
2041
2042 static int cfi_intelext_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
2043 {
2044         return cfi_varsize_frob(mtd, do_erase_oneblock, instr->addr,
2045                                 instr->len, NULL);
2046 }
2047
2048 static void cfi_intelext_sync (struct mtd_info *mtd)
2049 {
2050         struct map_info *map = mtd->priv;
2051         struct cfi_private *cfi = map->fldrv_priv;
2052         int i;
2053         struct flchip *chip;
2054         int ret = 0;
2055
2056         for (i=0; !ret && i<cfi->numchips; i++) {
2057                 chip = &cfi->chips[i];
2058
2059                 mutex_lock(&chip->mutex);
2060                 ret = get_chip(map, chip, chip->start, FL_SYNCING);
2061
2062                 if (!ret) {
2063                         chip->oldstate = chip->state;
2064                         chip->state = FL_SYNCING;
2065                         /* No need to wake_up() on this state change -
2066                          * as the whole point is that nobody can do anything
2067                          * with the chip now anyway.
2068                          */
2069                 }
2070                 mutex_unlock(&chip->mutex);
2071         }
2072
2073         /* Unlock the chips again */
2074
2075         for (i--; i >=0; i--) {
2076                 chip = &cfi->chips[i];
2077
2078                 mutex_lock(&chip->mutex);
2079
2080                 if (chip->state == FL_SYNCING) {
2081                         chip->state = chip->oldstate;
2082                         chip->oldstate = FL_READY;
2083                         wake_up(&chip->wq);
2084                 }
2085                 mutex_unlock(&chip->mutex);
2086         }
2087 }
2088
2089 static int __xipram do_getlockstatus_oneblock(struct map_info *map,
2090                                                 struct flchip *chip,
2091                                                 unsigned long adr,
2092                                                 int len, void *thunk)
2093 {
2094         struct cfi_private *cfi = map->fldrv_priv;
2095         int status, ofs_factor = cfi->interleave * cfi->device_type;
2096
2097         adr += chip->start;
2098         xip_disable(map, chip, adr+(2*ofs_factor));
2099         map_write(map, CMD(0x90), adr+(2*ofs_factor));
2100         chip->state = FL_JEDEC_QUERY;
2101         status = cfi_read_query(map, adr+(2*ofs_factor));
2102         xip_enable(map, chip, 0);
2103         return status;
2104 }
2105
2106 #ifdef DEBUG_LOCK_BITS
2107 static int __xipram do_printlockstatus_oneblock(struct map_info *map,
2108                                                 struct flchip *chip,
2109                                                 unsigned long adr,
2110                                                 int len, void *thunk)
2111 {
2112         printk(KERN_DEBUG "block status register for 0x%08lx is %x\n",
2113                adr, do_getlockstatus_oneblock(map, chip, adr, len, thunk));
2114         return 0;
2115 }
2116 #endif
2117
2118 #define DO_XXLOCK_ONEBLOCK_LOCK         ((void *) 1)
2119 #define DO_XXLOCK_ONEBLOCK_UNLOCK       ((void *) 2)
2120
2121 static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip,
2122                                        unsigned long adr, int len, void *thunk)
2123 {
2124         struct cfi_private *cfi = map->fldrv_priv;
2125         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2126         int mdelay;
2127         int ret;
2128
2129         adr += chip->start;
2130
2131         mutex_lock(&chip->mutex);
2132         ret = get_chip(map, chip, adr, FL_LOCKING);
2133         if (ret) {
2134                 mutex_unlock(&chip->mutex);
2135                 return ret;
2136         }
2137
2138         ENABLE_VPP(map);
2139         xip_disable(map, chip, adr);
2140
2141         map_write(map, CMD(0x60), adr);
2142         if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) {
2143                 map_write(map, CMD(0x01), adr);
2144                 chip->state = FL_LOCKING;
2145         } else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) {
2146                 map_write(map, CMD(0xD0), adr);
2147                 chip->state = FL_UNLOCKING;
2148         } else
2149                 BUG();
2150
2151         /*
2152          * If Instant Individual Block Locking supported then no need
2153          * to delay.
2154          */
2155         /*
2156          * Unlocking may take up to 1.4 seconds on some Intel flashes. So
2157          * lets use a max of 1.5 seconds (1500ms) as timeout.
2158          *
2159          * See "Clear Block Lock-Bits Time" on page 40 in
2160          * "3 Volt Intel StrataFlash Memory" 28F128J3,28F640J3,28F320J3 manual
2161          * from February 2003
2162          */
2163         mdelay = (!extp || !(extp->FeatureSupport & (1 << 5))) ? 1500 : 0;
2164
2165         ret = WAIT_TIMEOUT(map, chip, adr, mdelay, mdelay * 1000);
2166         if (ret) {
2167                 map_write(map, CMD(0x70), adr);
2168                 chip->state = FL_STATUS;
2169                 xip_enable(map, chip, adr);
2170                 printk(KERN_ERR "%s: block unlock error: (status timeout)\n", map->name);
2171                 goto out;
2172         }
2173
2174         xip_enable(map, chip, adr);
2175  out:   DISABLE_VPP(map);
2176         put_chip(map, chip, adr);
2177         mutex_unlock(&chip->mutex);
2178         return ret;
2179 }
2180
2181 static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
2182 {
2183         int ret;
2184
2185 #ifdef DEBUG_LOCK_BITS
2186         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
2187                __func__, ofs, len);
2188         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2189                 ofs, len, NULL);
2190 #endif
2191
2192         ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
2193                 ofs, len, DO_XXLOCK_ONEBLOCK_LOCK);
2194
2195 #ifdef DEBUG_LOCK_BITS
2196         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
2197                __func__, ret);
2198         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2199                 ofs, len, NULL);
2200 #endif
2201
2202         return ret;
2203 }
2204
2205 static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
2206 {
2207         int ret;
2208
2209 #ifdef DEBUG_LOCK_BITS
2210         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
2211                __func__, ofs, len);
2212         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2213                 ofs, len, NULL);
2214 #endif
2215
2216         ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
2217                                         ofs, len, DO_XXLOCK_ONEBLOCK_UNLOCK);
2218
2219 #ifdef DEBUG_LOCK_BITS
2220         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
2221                __func__, ret);
2222         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
2223                 ofs, len, NULL);
2224 #endif
2225
2226         return ret;
2227 }
2228
2229 static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
2230                                   uint64_t len)
2231 {
2232         return cfi_varsize_frob(mtd, do_getlockstatus_oneblock,
2233                                 ofs, len, NULL) ? 1 : 0;
2234 }
2235
2236 #ifdef CONFIG_MTD_OTP
2237
2238 typedef int (*otp_op_t)(struct map_info *map, struct flchip *chip,
2239                         u_long data_offset, u_char *buf, u_int size,
2240                         u_long prot_offset, u_int groupno, u_int groupsize);
2241
2242 static int __xipram
2243 do_otp_read(struct map_info *map, struct flchip *chip, u_long offset,
2244             u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2245 {
2246         struct cfi_private *cfi = map->fldrv_priv;
2247         int ret;
2248
2249         mutex_lock(&chip->mutex);
2250         ret = get_chip(map, chip, chip->start, FL_JEDEC_QUERY);
2251         if (ret) {
2252                 mutex_unlock(&chip->mutex);
2253                 return ret;
2254         }
2255
2256         /* let's ensure we're not reading back cached data from array mode */
2257         INVALIDATE_CACHED_RANGE(map, chip->start + offset, size);
2258
2259         xip_disable(map, chip, chip->start);
2260         if (chip->state != FL_JEDEC_QUERY) {
2261                 map_write(map, CMD(0x90), chip->start);
2262                 chip->state = FL_JEDEC_QUERY;
2263         }
2264         map_copy_from(map, buf, chip->start + offset, size);
2265         xip_enable(map, chip, chip->start);
2266
2267         /* then ensure we don't keep OTP data in the cache */
2268         INVALIDATE_CACHED_RANGE(map, chip->start + offset, size);
2269
2270         put_chip(map, chip, chip->start);
2271         mutex_unlock(&chip->mutex);
2272         return 0;
2273 }
2274
2275 static int
2276 do_otp_write(struct map_info *map, struct flchip *chip, u_long offset,
2277              u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2278 {
2279         int ret;
2280
2281         while (size) {
2282                 unsigned long bus_ofs = offset & ~(map_bankwidth(map)-1);
2283                 int gap = offset - bus_ofs;
2284                 int n = min_t(int, size, map_bankwidth(map)-gap);
2285                 map_word datum = map_word_ff(map);
2286
2287                 datum = map_word_load_partial(map, datum, buf, gap, n);
2288                 ret = do_write_oneword(map, chip, bus_ofs, datum, FL_OTP_WRITE);
2289                 if (ret)
2290                         return ret;
2291
2292                 offset += n;
2293                 buf += n;
2294                 size -= n;
2295         }
2296
2297         return 0;
2298 }
2299
2300 static int
2301 do_otp_lock(struct map_info *map, struct flchip *chip, u_long offset,
2302             u_char *buf, u_int size, u_long prot, u_int grpno, u_int grpsz)
2303 {
2304         struct cfi_private *cfi = map->fldrv_priv;
2305         map_word datum;
2306
2307         /* make sure area matches group boundaries */
2308         if (size != grpsz)
2309                 return -EXDEV;
2310
2311         datum = map_word_ff(map);
2312         datum = map_word_clr(map, datum, CMD(1 << grpno));
2313         return do_write_oneword(map, chip, prot, datum, FL_OTP_WRITE);
2314 }
2315
2316 static int cfi_intelext_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
2317                                  size_t *retlen, u_char *buf,
2318                                  otp_op_t action, int user_regs)
2319 {
2320         struct map_info *map = mtd->priv;
2321         struct cfi_private *cfi = map->fldrv_priv;
2322         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2323         struct flchip *chip;
2324         struct cfi_intelext_otpinfo *otp;
2325         u_long devsize, reg_prot_offset, data_offset;
2326         u_int chip_num, chip_step, field, reg_fact_size, reg_user_size;
2327         u_int groups, groupno, groupsize, reg_fact_groups, reg_user_groups;
2328         int ret;
2329
2330         *retlen = 0;
2331
2332         /* Check that we actually have some OTP registers */
2333         if (!extp || !(extp->FeatureSupport & 64) || !extp->NumProtectionFields)
2334                 return -ENODATA;
2335
2336         /* we need real chips here not virtual ones */
2337         devsize = (1 << cfi->cfiq->DevSize) * cfi->interleave;
2338         chip_step = devsize >> cfi->chipshift;
2339         chip_num = 0;
2340
2341         /* Some chips have OTP located in the _top_ partition only.
2342            For example: Intel 28F256L18T (T means top-parameter device) */
2343         if (cfi->mfr == CFI_MFR_INTEL) {
2344                 switch (cfi->id) {
2345                 case 0x880b:
2346                 case 0x880c:
2347                 case 0x880d:
2348                         chip_num = chip_step - 1;
2349                 }
2350         }
2351
2352         for ( ; chip_num < cfi->numchips; chip_num += chip_step) {
2353                 chip = &cfi->chips[chip_num];
2354                 otp = (struct cfi_intelext_otpinfo *)&extp->extra[0];
2355
2356                 /* first OTP region */
2357                 field = 0;
2358                 reg_prot_offset = extp->ProtRegAddr;
2359                 reg_fact_groups = 1;
2360                 reg_fact_size = 1 << extp->FactProtRegSize;
2361                 reg_user_groups = 1;
2362                 reg_user_size = 1 << extp->UserProtRegSize;
2363
2364                 while (len > 0) {
2365                         /* flash geometry fixup */
2366                         data_offset = reg_prot_offset + 1;
2367                         data_offset *= cfi->interleave * cfi->device_type;
2368                         reg_prot_offset *= cfi->interleave * cfi->device_type;
2369                         reg_fact_size *= cfi->interleave;
2370                         reg_user_size *= cfi->interleave;
2371
2372                         if (user_regs) {
2373                                 groups = reg_user_groups;
2374                                 groupsize = reg_user_size;
2375                                 /* skip over factory reg area */
2376                                 groupno = reg_fact_groups;
2377                                 data_offset += reg_fact_groups * reg_fact_size;
2378                         } else {
2379                                 groups = reg_fact_groups;
2380                                 groupsize = reg_fact_size;
2381                                 groupno = 0;
2382                         }
2383
2384                         while (len > 0 && groups > 0) {
2385                                 if (!action) {
2386                                         /*
2387                                          * Special case: if action is NULL
2388                                          * we fill buf with otp_info records.
2389                                          */
2390                                         struct otp_info *otpinfo;
2391                                         map_word lockword;
2392                                         len -= sizeof(struct otp_info);
2393                                         if (len <= 0)
2394                                                 return -ENOSPC;
2395                                         ret = do_otp_read(map, chip,
2396                                                           reg_prot_offset,
2397                                                           (u_char *)&lockword,
2398                                                           map_bankwidth(map),
2399                                                           0, 0,  0);
2400                                         if (ret)
2401                                                 return ret;
2402                                         otpinfo = (struct otp_info *)buf;
2403                                         otpinfo->start = from;
2404                                         otpinfo->length = groupsize;
2405                                         otpinfo->locked =
2406                                            !map_word_bitsset(map, lockword,
2407                                                              CMD(1 << groupno));
2408                                         from += groupsize;
2409                                         buf += sizeof(*otpinfo);
2410                                         *retlen += sizeof(*otpinfo);
2411                                 } else if (from >= groupsize) {
2412                                         from -= groupsize;
2413                                         data_offset += groupsize;
2414                                 } else {
2415                                         int size = groupsize;
2416                                         data_offset += from;
2417                                         size -= from;
2418                                         from = 0;
2419                                         if (size > len)
2420                                                 size = len;
2421                                         ret = action(map, chip, data_offset,
2422                                                      buf, size, reg_prot_offset,
2423                                                      groupno, groupsize);
2424                                         if (ret < 0)
2425                                                 return ret;
2426                                         buf += size;
2427                                         len -= size;
2428                                         *retlen += size;
2429                                         data_offset += size;
2430                                 }
2431                                 groupno++;
2432                                 groups--;
2433                         }
2434
2435                         /* next OTP region */
2436                         if (++field == extp->NumProtectionFields)
2437                                 break;
2438                         reg_prot_offset = otp->ProtRegAddr;
2439                         reg_fact_groups = otp->FactGroups;
2440                         reg_fact_size = 1 << otp->FactProtRegSize;
2441                         reg_user_groups = otp->UserGroups;
2442                         reg_user_size = 1 << otp->UserProtRegSize;
2443                         otp++;
2444                 }
2445         }
2446
2447         return 0;
2448 }
2449
2450 static int cfi_intelext_read_fact_prot_reg(struct mtd_info *mtd, loff_t from,
2451                                            size_t len, size_t *retlen,
2452                                             u_char *buf)
2453 {
2454         return cfi_intelext_otp_walk(mtd, from, len, retlen,
2455                                      buf, do_otp_read, 0);
2456 }
2457
2458 static int cfi_intelext_read_user_prot_reg(struct mtd_info *mtd, loff_t from,
2459                                            size_t len, size_t *retlen,
2460                                             u_char *buf)
2461 {
2462         return cfi_intelext_otp_walk(mtd, from, len, retlen,
2463                                      buf, do_otp_read, 1);
2464 }
2465
2466 static int cfi_intelext_write_user_prot_reg(struct mtd_info *mtd, loff_t from,
2467                                             size_t len, size_t *retlen,
2468                                             const u_char *buf)
2469 {
2470         return cfi_intelext_otp_walk(mtd, from, len, retlen,
2471                                      (u_char *)buf, do_otp_write, 1);
2472 }
2473
2474 static int cfi_intelext_lock_user_prot_reg(struct mtd_info *mtd,
2475                                            loff_t from, size_t len)
2476 {
2477         size_t retlen;
2478         return cfi_intelext_otp_walk(mtd, from, len, &retlen,
2479                                      NULL, do_otp_lock, 1);
2480 }
2481
2482 static int cfi_intelext_get_fact_prot_info(struct mtd_info *mtd, size_t len,
2483                                            size_t *retlen, struct otp_info *buf)
2484
2485 {
2486         return cfi_intelext_otp_walk(mtd, 0, len, retlen, (u_char *)buf,
2487                                      NULL, 0);
2488 }
2489
2490 static int cfi_intelext_get_user_prot_info(struct mtd_info *mtd, size_t len,
2491                                            size_t *retlen, struct otp_info *buf)
2492 {
2493         return cfi_intelext_otp_walk(mtd, 0, len, retlen, (u_char *)buf,
2494                                      NULL, 1);
2495 }
2496
2497 #endif
2498
2499 static void cfi_intelext_save_locks(struct mtd_info *mtd)
2500 {
2501         struct mtd_erase_region_info *region;
2502         int block, status, i;
2503         unsigned long adr;
2504         size_t len;
2505
2506         for (i = 0; i < mtd->numeraseregions; i++) {
2507                 region = &mtd->eraseregions[i];
2508                 if (!region->lockmap)
2509                         continue;
2510
2511                 for (block = 0; block < region->numblocks; block++){
2512                         len = region->erasesize;
2513                         adr = region->offset + block * len;
2514
2515                         status = cfi_varsize_frob(mtd,
2516                                         do_getlockstatus_oneblock, adr, len, NULL);
2517                         if (status)
2518                                 set_bit(block, region->lockmap);
2519                         else
2520                                 clear_bit(block, region->lockmap);
2521                 }
2522         }
2523 }
2524
2525 static int cfi_intelext_suspend(struct mtd_info *mtd)
2526 {
2527         struct map_info *map = mtd->priv;
2528         struct cfi_private *cfi = map->fldrv_priv;
2529         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2530         int i;
2531         struct flchip *chip;
2532         int ret = 0;
2533
2534         if ((mtd->flags & MTD_POWERUP_LOCK)
2535             && extp && (extp->FeatureSupport & (1 << 5)))
2536                 cfi_intelext_save_locks(mtd);
2537
2538         for (i=0; !ret && i<cfi->numchips; i++) {
2539                 chip = &cfi->chips[i];
2540
2541                 mutex_lock(&chip->mutex);
2542
2543                 switch (chip->state) {
2544                 case FL_READY:
2545                 case FL_STATUS:
2546                 case FL_CFI_QUERY:
2547                 case FL_JEDEC_QUERY:
2548                         if (chip->oldstate == FL_READY) {
2549                                 /* place the chip in a known state before suspend */
2550                                 map_write(map, CMD(0xFF), cfi->chips[i].start);
2551                                 chip->oldstate = chip->state;
2552                                 chip->state = FL_PM_SUSPENDED;
2553                                 /* No need to wake_up() on this state change -
2554                                  * as the whole point is that nobody can do anything
2555                                  * with the chip now anyway.
2556                                  */
2557                         } else {
2558                                 /* There seems to be an operation pending. We must wait for it. */
2559                                 printk(KERN_NOTICE "Flash device refused suspend due to pending operation (oldstate %d)\n", chip->oldstate);
2560                                 ret = -EAGAIN;
2561                         }
2562                         break;
2563                 default:
2564                         /* Should we actually wait? Once upon a time these routines weren't
2565                            allowed to. Or should we return -EAGAIN, because the upper layers
2566                            ought to have already shut down anything which was using the device
2567                            anyway? The latter for now. */
2568                         printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->state);
2569                         ret = -EAGAIN;
2570                         break;
2571                 case FL_PM_SUSPENDED:
2572                         break;
2573                 }
2574                 mutex_unlock(&chip->mutex);
2575         }
2576
2577         /* Unlock the chips again */
2578
2579         if (ret) {
2580                 for (i--; i >=0; i--) {
2581                         chip = &cfi->chips[i];
2582
2583                         mutex_lock(&chip->mutex);
2584
2585                         if (chip->state == FL_PM_SUSPENDED) {
2586                                 /* No need to force it into a known state here,
2587                                    because we're returning failure, and it didn't
2588                                    get power cycled */
2589                                 chip->state = chip->oldstate;
2590                                 chip->oldstate = FL_READY;
2591                                 wake_up(&chip->wq);
2592                         }
2593                         mutex_unlock(&chip->mutex);
2594                 }
2595         }
2596
2597         return ret;
2598 }
2599
2600 static void cfi_intelext_restore_locks(struct mtd_info *mtd)
2601 {
2602         struct mtd_erase_region_info *region;
2603         int block, i;
2604         unsigned long adr;
2605         size_t len;
2606
2607         for (i = 0; i < mtd->numeraseregions; i++) {
2608                 region = &mtd->eraseregions[i];
2609                 if (!region->lockmap)
2610                         continue;
2611
2612                 for_each_clear_bit(block, region->lockmap, region->numblocks) {
2613                         len = region->erasesize;
2614                         adr = region->offset + block * len;
2615                         cfi_intelext_unlock(mtd, adr, len);
2616                 }
2617         }
2618 }
2619
2620 static void cfi_intelext_resume(struct mtd_info *mtd)
2621 {
2622         struct map_info *map = mtd->priv;
2623         struct cfi_private *cfi = map->fldrv_priv;
2624         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
2625         int i;
2626         struct flchip *chip;
2627
2628         for (i=0; i<cfi->numchips; i++) {
2629
2630                 chip = &cfi->chips[i];
2631
2632                 mutex_lock(&chip->mutex);
2633
2634                 /* Go to known state. Chip may have been power cycled */
2635                 if (chip->state == FL_PM_SUSPENDED) {
2636                         /* Refresh LH28F640BF Partition Config. Register */
2637                         fixup_LH28F640BF(mtd);
2638                         map_write(map, CMD(0xFF), cfi->chips[i].start);
2639                         chip->oldstate = chip->state = FL_READY;
2640                         wake_up(&chip->wq);
2641                 }
2642
2643                 mutex_unlock(&chip->mutex);
2644         }
2645
2646         if ((mtd->flags & MTD_POWERUP_LOCK)
2647             && extp && (extp->FeatureSupport & (1 << 5)))
2648                 cfi_intelext_restore_locks(mtd);
2649 }
2650
2651 static int cfi_intelext_reset(struct mtd_info *mtd)
2652 {
2653         struct map_info *map = mtd->priv;
2654         struct cfi_private *cfi = map->fldrv_priv;
2655         int i, ret;
2656
2657         for (i=0; i < cfi->numchips; i++) {
2658                 struct flchip *chip = &cfi->chips[i];
2659
2660                 /* force the completion of any ongoing operation
2661                    and switch to array mode so any bootloader in
2662                    flash is accessible for soft reboot. */
2663                 mutex_lock(&chip->mutex);
2664                 ret = get_chip(map, chip, chip->start, FL_SHUTDOWN);
2665                 if (!ret) {
2666                         map_write(map, CMD(0xff), chip->start);
2667                         chip->state = FL_SHUTDOWN;
2668                         put_chip(map, chip, chip->start);
2669                 }
2670                 mutex_unlock(&chip->mutex);
2671         }
2672
2673         return 0;
2674 }
2675
2676 static int cfi_intelext_reboot(struct notifier_block *nb, unsigned long val,
2677                                void *v)
2678 {
2679         struct mtd_info *mtd;
2680
2681         mtd = container_of(nb, struct mtd_info, reboot_notifier);
2682         cfi_intelext_reset(mtd);
2683         return NOTIFY_DONE;
2684 }
2685
2686 static void cfi_intelext_destroy(struct mtd_info *mtd)
2687 {
2688         struct map_info *map = mtd->priv;
2689         struct cfi_private *cfi = map->fldrv_priv;
2690         struct mtd_erase_region_info *region;
2691         int i;
2692         cfi_intelext_reset(mtd);
2693         unregister_reboot_notifier(&mtd->reboot_notifier);
2694         kfree(cfi->cmdset_priv);
2695         kfree(cfi->cfiq);
2696         kfree(cfi->chips[0].priv);
2697         kfree(cfi);
2698         for (i = 0; i < mtd->numeraseregions; i++) {
2699                 region = &mtd->eraseregions[i];
2700                 kfree(region->lockmap);
2701         }
2702         kfree(mtd->eraseregions);
2703 }
2704
2705 MODULE_LICENSE("GPL");
2706 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org> et al.");
2707 MODULE_DESCRIPTION("MTD chip driver for Intel/Sharp flash chips");
2708 MODULE_ALIAS("cfi_cmdset_0003");
2709 MODULE_ALIAS("cfi_cmdset_0200");