cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

mtd_dataflash.c (24890B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 * Atmel AT45xxx DataFlash MTD driver for lightweight SPI framework
      4 *
      5 * Largely derived from at91_dataflash.c:
      6 *  Copyright (C) 2003-2005 SAN People (Pty) Ltd
      7*/
      8#include <linux/module.h>
      9#include <linux/slab.h>
     10#include <linux/delay.h>
     11#include <linux/device.h>
     12#include <linux/mutex.h>
     13#include <linux/err.h>
     14#include <linux/math64.h>
     15#include <linux/of.h>
     16#include <linux/of_device.h>
     17
     18#include <linux/spi/spi.h>
     19#include <linux/spi/flash.h>
     20
     21#include <linux/mtd/mtd.h>
     22#include <linux/mtd/partitions.h>
     23
     24/*
     25 * DataFlash is a kind of SPI flash.  Most AT45 chips have two buffers in
     26 * each chip, which may be used for double buffered I/O; but this driver
     27 * doesn't (yet) use these for any kind of i/o overlap or prefetching.
     28 *
     29 * Sometimes DataFlash is packaged in MMC-format cards, although the
     30 * MMC stack can't (yet?) distinguish between MMC and DataFlash
     31 * protocols during enumeration.
     32 */
     33
     34/* reads can bypass the buffers */
     35#define OP_READ_CONTINUOUS	0xE8
     36#define OP_READ_PAGE		0xD2
     37
     38/* group B requests can run even while status reports "busy" */
     39#define OP_READ_STATUS		0xD7	/* group B */
     40
     41/* move data between host and buffer */
     42#define OP_READ_BUFFER1		0xD4	/* group B */
     43#define OP_READ_BUFFER2		0xD6	/* group B */
     44#define OP_WRITE_BUFFER1	0x84	/* group B */
     45#define OP_WRITE_BUFFER2	0x87	/* group B */
     46
     47/* erasing flash */
     48#define OP_ERASE_PAGE		0x81
     49#define OP_ERASE_BLOCK		0x50
     50
     51/* move data between buffer and flash */
     52#define OP_TRANSFER_BUF1	0x53
     53#define OP_TRANSFER_BUF2	0x55
     54#define OP_MREAD_BUFFER1	0xD4
     55#define OP_MREAD_BUFFER2	0xD6
     56#define OP_MWERASE_BUFFER1	0x83
     57#define OP_MWERASE_BUFFER2	0x86
     58#define OP_MWRITE_BUFFER1	0x88	/* sector must be pre-erased */
     59#define OP_MWRITE_BUFFER2	0x89	/* sector must be pre-erased */
     60
     61/* write to buffer, then write-erase to flash */
     62#define OP_PROGRAM_VIA_BUF1	0x82
     63#define OP_PROGRAM_VIA_BUF2	0x85
     64
     65/* compare buffer to flash */
     66#define OP_COMPARE_BUF1		0x60
     67#define OP_COMPARE_BUF2		0x61
     68
     69/* read flash to buffer, then write-erase to flash */
     70#define OP_REWRITE_VIA_BUF1	0x58
     71#define OP_REWRITE_VIA_BUF2	0x59
     72
     73/* newer chips report JEDEC manufacturer and device IDs; chip
     74 * serial number and OTP bits; and per-sector writeprotect.
     75 */
     76#define OP_READ_ID		0x9F
     77#define OP_READ_SECURITY	0x77
     78#define OP_WRITE_SECURITY_REVC	0x9A
     79#define OP_WRITE_SECURITY	0x9B	/* revision D */
     80
     81#define CFI_MFR_ATMEL		0x1F
     82
     83#define DATAFLASH_SHIFT_EXTID	24
     84#define DATAFLASH_SHIFT_ID	40
     85
     86struct dataflash {
     87	u8			command[4];
     88	char			name[24];
     89
     90	unsigned short		page_offset;	/* offset in flash address */
     91	unsigned int		page_size;	/* of bytes per page */
     92
     93	struct mutex		lock;
     94	struct spi_device	*spi;
     95
     96	struct mtd_info		mtd;
     97};
     98
     99static const struct spi_device_id dataflash_dev_ids[] = {
    100	{ "at45" },
    101	{ "dataflash" },
    102	{ },
    103};
    104MODULE_DEVICE_TABLE(spi, dataflash_dev_ids);
    105
    106#ifdef CONFIG_OF
    107static const struct of_device_id dataflash_dt_ids[] = {
    108	{ .compatible = "atmel,at45", },
    109	{ .compatible = "atmel,dataflash", },
    110	{ /* sentinel */ }
    111};
    112MODULE_DEVICE_TABLE(of, dataflash_dt_ids);
    113#endif
    114
    115/* ......................................................................... */
    116
    117/*
    118 * Return the status of the DataFlash device.
    119 */
    120static inline int dataflash_status(struct spi_device *spi)
    121{
    122	/* NOTE:  at45db321c over 25 MHz wants to write
    123	 * a dummy byte after the opcode...
    124	 */
    125	return spi_w8r8(spi, OP_READ_STATUS);
    126}
    127
    128/*
    129 * Poll the DataFlash device until it is READY.
    130 * This usually takes 5-20 msec or so; more for sector erase.
    131 */
    132static int dataflash_waitready(struct spi_device *spi)
    133{
    134	int	status;
    135
    136	for (;;) {
    137		status = dataflash_status(spi);
    138		if (status < 0) {
    139			dev_dbg(&spi->dev, "status %d?\n", status);
    140			status = 0;
    141		}
    142
    143		if (status & (1 << 7))	/* RDY/nBSY */
    144			return status;
    145
    146		usleep_range(3000, 4000);
    147	}
    148}
    149
    150/* ......................................................................... */
    151
    152/*
    153 * Erase pages of flash.
    154 */
    155static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
    156{
    157	struct dataflash	*priv = mtd->priv;
    158	struct spi_device	*spi = priv->spi;
    159	struct spi_transfer	x = { };
    160	struct spi_message	msg;
    161	unsigned		blocksize = priv->page_size << 3;
    162	u8			*command;
    163	u32			rem;
    164
    165	dev_dbg(&spi->dev, "erase addr=0x%llx len 0x%llx\n",
    166		(long long)instr->addr, (long long)instr->len);
    167
    168	div_u64_rem(instr->len, priv->page_size, &rem);
    169	if (rem)
    170		return -EINVAL;
    171	div_u64_rem(instr->addr, priv->page_size, &rem);
    172	if (rem)
    173		return -EINVAL;
    174
    175	spi_message_init(&msg);
    176
    177	x.tx_buf = command = priv->command;
    178	x.len = 4;
    179	spi_message_add_tail(&x, &msg);
    180
    181	mutex_lock(&priv->lock);
    182	while (instr->len > 0) {
    183		unsigned int	pageaddr;
    184		int		status;
    185		int		do_block;
    186
    187		/* Calculate flash page address; use block erase (for speed) if
    188		 * we're at a block boundary and need to erase the whole block.
    189		 */
    190		pageaddr = div_u64(instr->addr, priv->page_size);
    191		do_block = (pageaddr & 0x7) == 0 && instr->len >= blocksize;
    192		pageaddr = pageaddr << priv->page_offset;
    193
    194		command[0] = do_block ? OP_ERASE_BLOCK : OP_ERASE_PAGE;
    195		command[1] = (u8)(pageaddr >> 16);
    196		command[2] = (u8)(pageaddr >> 8);
    197		command[3] = 0;
    198
    199		dev_dbg(&spi->dev, "ERASE %s: (%x) %x %x %x [%i]\n",
    200			do_block ? "block" : "page",
    201			command[0], command[1], command[2], command[3],
    202			pageaddr);
    203
    204		status = spi_sync(spi, &msg);
    205		(void) dataflash_waitready(spi);
    206
    207		if (status < 0) {
    208			dev_err(&spi->dev, "erase %x, err %d\n",
    209				pageaddr, status);
    210			/* REVISIT:  can retry instr->retries times; or
    211			 * giveup and instr->fail_addr = instr->addr;
    212			 */
    213			continue;
    214		}
    215
    216		if (do_block) {
    217			instr->addr += blocksize;
    218			instr->len -= blocksize;
    219		} else {
    220			instr->addr += priv->page_size;
    221			instr->len -= priv->page_size;
    222		}
    223	}
    224	mutex_unlock(&priv->lock);
    225
    226	return 0;
    227}
    228
    229/*
    230 * Read from the DataFlash device.
    231 *   from   : Start offset in flash device
    232 *   len    : Amount to read
    233 *   retlen : About of data actually read
    234 *   buf    : Buffer containing the data
    235 */
    236static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
    237			       size_t *retlen, u_char *buf)
    238{
    239	struct dataflash	*priv = mtd->priv;
    240	struct spi_transfer	x[2] = { };
    241	struct spi_message	msg;
    242	unsigned int		addr;
    243	u8			*command;
    244	int			status;
    245
    246	dev_dbg(&priv->spi->dev, "read 0x%x..0x%x\n",
    247		  (unsigned int)from, (unsigned int)(from + len));
    248
    249	/* Calculate flash page/byte address */
    250	addr = (((unsigned)from / priv->page_size) << priv->page_offset)
    251		+ ((unsigned)from % priv->page_size);
    252
    253	command = priv->command;
    254
    255	dev_dbg(&priv->spi->dev, "READ: (%x) %x %x %x\n",
    256		command[0], command[1], command[2], command[3]);
    257
    258	spi_message_init(&msg);
    259
    260	x[0].tx_buf = command;
    261	x[0].len = 8;
    262	spi_message_add_tail(&x[0], &msg);
    263
    264	x[1].rx_buf = buf;
    265	x[1].len = len;
    266	spi_message_add_tail(&x[1], &msg);
    267
    268	mutex_lock(&priv->lock);
    269
    270	/* Continuous read, max clock = f(car) which may be less than
    271	 * the peak rate available.  Some chips support commands with
    272	 * fewer "don't care" bytes.  Both buffers stay unchanged.
    273	 */
    274	command[0] = OP_READ_CONTINUOUS;
    275	command[1] = (u8)(addr >> 16);
    276	command[2] = (u8)(addr >> 8);
    277	command[3] = (u8)(addr >> 0);
    278	/* plus 4 "don't care" bytes */
    279
    280	status = spi_sync(priv->spi, &msg);
    281	mutex_unlock(&priv->lock);
    282
    283	if (status >= 0) {
    284		*retlen = msg.actual_length - 8;
    285		status = 0;
    286	} else
    287		dev_dbg(&priv->spi->dev, "read %x..%x --> %d\n",
    288			(unsigned)from, (unsigned)(from + len),
    289			status);
    290	return status;
    291}
    292
    293/*
    294 * Write to the DataFlash device.
    295 *   to     : Start offset in flash device
    296 *   len    : Amount to write
    297 *   retlen : Amount of data actually written
    298 *   buf    : Buffer containing the data
    299 */
    300static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
    301				size_t * retlen, const u_char * buf)
    302{
    303	struct dataflash	*priv = mtd->priv;
    304	struct spi_device	*spi = priv->spi;
    305	struct spi_transfer	x[2] = { };
    306	struct spi_message	msg;
    307	unsigned int		pageaddr, addr, offset, writelen;
    308	size_t			remaining = len;
    309	u_char			*writebuf = (u_char *) buf;
    310	int			status = -EINVAL;
    311	u8			*command;
    312
    313	dev_dbg(&spi->dev, "write 0x%x..0x%x\n",
    314		(unsigned int)to, (unsigned int)(to + len));
    315
    316	spi_message_init(&msg);
    317
    318	x[0].tx_buf = command = priv->command;
    319	x[0].len = 4;
    320	spi_message_add_tail(&x[0], &msg);
    321
    322	pageaddr = ((unsigned)to / priv->page_size);
    323	offset = ((unsigned)to % priv->page_size);
    324	if (offset + len > priv->page_size)
    325		writelen = priv->page_size - offset;
    326	else
    327		writelen = len;
    328
    329	mutex_lock(&priv->lock);
    330	while (remaining > 0) {
    331		dev_dbg(&spi->dev, "write @ %i:%i len=%i\n",
    332			pageaddr, offset, writelen);
    333
    334		/* REVISIT:
    335		 * (a) each page in a sector must be rewritten at least
    336		 *     once every 10K sibling erase/program operations.
    337		 * (b) for pages that are already erased, we could
    338		 *     use WRITE+MWRITE not PROGRAM for ~30% speedup.
    339		 * (c) WRITE to buffer could be done while waiting for
    340		 *     a previous MWRITE/MWERASE to complete ...
    341		 * (d) error handling here seems to be mostly missing.
    342		 *
    343		 * Two persistent bits per page, plus a per-sector counter,
    344		 * could support (a) and (b) ... we might consider using
    345		 * the second half of sector zero, which is just one block,
    346		 * to track that state.  (On AT91, that sector should also
    347		 * support boot-from-DataFlash.)
    348		 */
    349
    350		addr = pageaddr << priv->page_offset;
    351
    352		/* (1) Maybe transfer partial page to Buffer1 */
    353		if (writelen != priv->page_size) {
    354			command[0] = OP_TRANSFER_BUF1;
    355			command[1] = (addr & 0x00FF0000) >> 16;
    356			command[2] = (addr & 0x0000FF00) >> 8;
    357			command[3] = 0;
    358
    359			dev_dbg(&spi->dev, "TRANSFER: (%x) %x %x %x\n",
    360				command[0], command[1], command[2], command[3]);
    361
    362			status = spi_sync(spi, &msg);
    363			if (status < 0)
    364				dev_dbg(&spi->dev, "xfer %u -> %d\n",
    365					addr, status);
    366
    367			(void) dataflash_waitready(priv->spi);
    368		}
    369
    370		/* (2) Program full page via Buffer1 */
    371		addr += offset;
    372		command[0] = OP_PROGRAM_VIA_BUF1;
    373		command[1] = (addr & 0x00FF0000) >> 16;
    374		command[2] = (addr & 0x0000FF00) >> 8;
    375		command[3] = (addr & 0x000000FF);
    376
    377		dev_dbg(&spi->dev, "PROGRAM: (%x) %x %x %x\n",
    378			command[0], command[1], command[2], command[3]);
    379
    380		x[1].tx_buf = writebuf;
    381		x[1].len = writelen;
    382		spi_message_add_tail(x + 1, &msg);
    383		status = spi_sync(spi, &msg);
    384		spi_transfer_del(x + 1);
    385		if (status < 0)
    386			dev_dbg(&spi->dev, "pgm %u/%u -> %d\n",
    387				addr, writelen, status);
    388
    389		(void) dataflash_waitready(priv->spi);
    390
    391
    392#ifdef CONFIG_MTD_DATAFLASH_WRITE_VERIFY
    393
    394		/* (3) Compare to Buffer1 */
    395		addr = pageaddr << priv->page_offset;
    396		command[0] = OP_COMPARE_BUF1;
    397		command[1] = (addr & 0x00FF0000) >> 16;
    398		command[2] = (addr & 0x0000FF00) >> 8;
    399		command[3] = 0;
    400
    401		dev_dbg(&spi->dev, "COMPARE: (%x) %x %x %x\n",
    402			command[0], command[1], command[2], command[3]);
    403
    404		status = spi_sync(spi, &msg);
    405		if (status < 0)
    406			dev_dbg(&spi->dev, "compare %u -> %d\n",
    407				addr, status);
    408
    409		status = dataflash_waitready(priv->spi);
    410
    411		/* Check result of the compare operation */
    412		if (status & (1 << 6)) {
    413			dev_err(&spi->dev, "compare page %u, err %d\n",
    414				pageaddr, status);
    415			remaining = 0;
    416			status = -EIO;
    417			break;
    418		} else
    419			status = 0;
    420
    421#endif	/* CONFIG_MTD_DATAFLASH_WRITE_VERIFY */
    422
    423		remaining = remaining - writelen;
    424		pageaddr++;
    425		offset = 0;
    426		writebuf += writelen;
    427		*retlen += writelen;
    428
    429		if (remaining > priv->page_size)
    430			writelen = priv->page_size;
    431		else
    432			writelen = remaining;
    433	}
    434	mutex_unlock(&priv->lock);
    435
    436	return status;
    437}
    438
    439/* ......................................................................... */
    440
    441#ifdef CONFIG_MTD_DATAFLASH_OTP
    442
    443static int dataflash_get_otp_info(struct mtd_info *mtd, size_t len,
    444				  size_t *retlen, struct otp_info *info)
    445{
    446	/* Report both blocks as identical:  bytes 0..64, locked.
    447	 * Unless the user block changed from all-ones, we can't
    448	 * tell whether it's still writable; so we assume it isn't.
    449	 */
    450	info->start = 0;
    451	info->length = 64;
    452	info->locked = 1;
    453	*retlen = sizeof(*info);
    454	return 0;
    455}
    456
    457static ssize_t otp_read(struct spi_device *spi, unsigned base,
    458		u8 *buf, loff_t off, size_t len)
    459{
    460	struct spi_message	m;
    461	size_t			l;
    462	u8			*scratch;
    463	struct spi_transfer	t;
    464	int			status;
    465
    466	if (off > 64)
    467		return -EINVAL;
    468
    469	if ((off + len) > 64)
    470		len = 64 - off;
    471
    472	spi_message_init(&m);
    473
    474	l = 4 + base + off + len;
    475	scratch = kzalloc(l, GFP_KERNEL);
    476	if (!scratch)
    477		return -ENOMEM;
    478
    479	/* OUT: OP_READ_SECURITY, 3 don't-care bytes, zeroes
    480	 * IN:  ignore 4 bytes, data bytes 0..N (max 127)
    481	 */
    482	scratch[0] = OP_READ_SECURITY;
    483
    484	memset(&t, 0, sizeof t);
    485	t.tx_buf = scratch;
    486	t.rx_buf = scratch;
    487	t.len = l;
    488	spi_message_add_tail(&t, &m);
    489
    490	dataflash_waitready(spi);
    491
    492	status = spi_sync(spi, &m);
    493	if (status >= 0) {
    494		memcpy(buf, scratch + 4 + base + off, len);
    495		status = len;
    496	}
    497
    498	kfree(scratch);
    499	return status;
    500}
    501
    502static int dataflash_read_fact_otp(struct mtd_info *mtd,
    503		loff_t from, size_t len, size_t *retlen, u_char *buf)
    504{
    505	struct dataflash	*priv = mtd->priv;
    506	int			status;
    507
    508	/* 64 bytes, from 0..63 ... start at 64 on-chip */
    509	mutex_lock(&priv->lock);
    510	status = otp_read(priv->spi, 64, buf, from, len);
    511	mutex_unlock(&priv->lock);
    512
    513	if (status < 0)
    514		return status;
    515	*retlen = status;
    516	return 0;
    517}
    518
    519static int dataflash_read_user_otp(struct mtd_info *mtd,
    520		loff_t from, size_t len, size_t *retlen, u_char *buf)
    521{
    522	struct dataflash	*priv = mtd->priv;
    523	int			status;
    524
    525	/* 64 bytes, from 0..63 ... start at 0 on-chip */
    526	mutex_lock(&priv->lock);
    527	status = otp_read(priv->spi, 0, buf, from, len);
    528	mutex_unlock(&priv->lock);
    529
    530	if (status < 0)
    531		return status;
    532	*retlen = status;
    533	return 0;
    534}
    535
    536static int dataflash_write_user_otp(struct mtd_info *mtd,
    537		loff_t from, size_t len, size_t *retlen, const u_char *buf)
    538{
    539	struct spi_message	m;
    540	const size_t		l = 4 + 64;
    541	u8			*scratch;
    542	struct spi_transfer	t;
    543	struct dataflash	*priv = mtd->priv;
    544	int			status;
    545
    546	if (from >= 64) {
    547		/*
    548		 * Attempting to write beyond the end of OTP memory,
    549		 * no data can be written.
    550		 */
    551		*retlen = 0;
    552		return 0;
    553	}
    554
    555	/* Truncate the write to fit into OTP memory. */
    556	if ((from + len) > 64)
    557		len = 64 - from;
    558
    559	/* OUT: OP_WRITE_SECURITY, 3 zeroes, 64 data-or-zero bytes
    560	 * IN:  ignore all
    561	 */
    562	scratch = kzalloc(l, GFP_KERNEL);
    563	if (!scratch)
    564		return -ENOMEM;
    565	scratch[0] = OP_WRITE_SECURITY;
    566	memcpy(scratch + 4 + from, buf, len);
    567
    568	spi_message_init(&m);
    569
    570	memset(&t, 0, sizeof t);
    571	t.tx_buf = scratch;
    572	t.len = l;
    573	spi_message_add_tail(&t, &m);
    574
    575	/* Write the OTP bits, if they've not yet been written.
    576	 * This modifies SRAM buffer1.
    577	 */
    578	mutex_lock(&priv->lock);
    579	dataflash_waitready(priv->spi);
    580	status = spi_sync(priv->spi, &m);
    581	mutex_unlock(&priv->lock);
    582
    583	kfree(scratch);
    584
    585	if (status >= 0) {
    586		status = 0;
    587		*retlen = len;
    588	}
    589	return status;
    590}
    591
    592static char *otp_setup(struct mtd_info *device, char revision)
    593{
    594	device->_get_fact_prot_info = dataflash_get_otp_info;
    595	device->_read_fact_prot_reg = dataflash_read_fact_otp;
    596	device->_get_user_prot_info = dataflash_get_otp_info;
    597	device->_read_user_prot_reg = dataflash_read_user_otp;
    598
    599	/* rev c parts (at45db321c and at45db1281 only!) use a
    600	 * different write procedure; not (yet?) implemented.
    601	 */
    602	if (revision > 'c')
    603		device->_write_user_prot_reg = dataflash_write_user_otp;
    604
    605	return ", OTP";
    606}
    607
    608#else
    609
    610static char *otp_setup(struct mtd_info *device, char revision)
    611{
    612	return " (OTP)";
    613}
    614
    615#endif
    616
    617/* ......................................................................... */
    618
    619/*
    620 * Register DataFlash device with MTD subsystem.
    621 */
    622static int add_dataflash_otp(struct spi_device *spi, char *name, int nr_pages,
    623			     int pagesize, int pageoffset, char revision)
    624{
    625	struct dataflash		*priv;
    626	struct mtd_info			*device;
    627	struct flash_platform_data	*pdata = dev_get_platdata(&spi->dev);
    628	char				*otp_tag = "";
    629	int				err = 0;
    630
    631	priv = kzalloc(sizeof *priv, GFP_KERNEL);
    632	if (!priv)
    633		return -ENOMEM;
    634
    635	mutex_init(&priv->lock);
    636	priv->spi = spi;
    637	priv->page_size = pagesize;
    638	priv->page_offset = pageoffset;
    639
    640	/* name must be usable with cmdlinepart */
    641	sprintf(priv->name, "spi%d.%d-%s",
    642			spi->master->bus_num, spi->chip_select,
    643			name);
    644
    645	device = &priv->mtd;
    646	device->name = (pdata && pdata->name) ? pdata->name : priv->name;
    647	device->size = nr_pages * pagesize;
    648	device->erasesize = pagesize;
    649	device->writesize = pagesize;
    650	device->type = MTD_DATAFLASH;
    651	device->flags = MTD_WRITEABLE;
    652	device->_erase = dataflash_erase;
    653	device->_read = dataflash_read;
    654	device->_write = dataflash_write;
    655	device->priv = priv;
    656
    657	device->dev.parent = &spi->dev;
    658	mtd_set_of_node(device, spi->dev.of_node);
    659
    660	if (revision >= 'c')
    661		otp_tag = otp_setup(device, revision);
    662
    663	dev_info(&spi->dev, "%s (%lld KBytes) pagesize %d bytes%s\n",
    664			name, (long long)((device->size + 1023) >> 10),
    665			pagesize, otp_tag);
    666	spi_set_drvdata(spi, priv);
    667
    668	err = mtd_device_register(device,
    669			pdata ? pdata->parts : NULL,
    670			pdata ? pdata->nr_parts : 0);
    671
    672	if (!err)
    673		return 0;
    674
    675	kfree(priv);
    676	return err;
    677}
    678
    679static inline int add_dataflash(struct spi_device *spi, char *name,
    680				int nr_pages, int pagesize, int pageoffset)
    681{
    682	return add_dataflash_otp(spi, name, nr_pages, pagesize,
    683			pageoffset, 0);
    684}
    685
    686struct flash_info {
    687	char		*name;
    688
    689	/* JEDEC id has a high byte of zero plus three data bytes:
    690	 * the manufacturer id, then a two byte device id.
    691	 */
    692	u64		jedec_id;
    693
    694	/* The size listed here is what works with OP_ERASE_PAGE. */
    695	unsigned	nr_pages;
    696	u16		pagesize;
    697	u16		pageoffset;
    698
    699	u16		flags;
    700#define SUP_EXTID	0x0004		/* supports extended ID data */
    701#define SUP_POW2PS	0x0002		/* supports 2^N byte pages */
    702#define IS_POW2PS	0x0001		/* uses 2^N byte pages */
    703};
    704
    705static struct flash_info dataflash_data[] = {
    706
    707	/*
    708	 * NOTE:  chips with SUP_POW2PS (rev D and up) need two entries,
    709	 * one with IS_POW2PS and the other without.  The entry with the
    710	 * non-2^N byte page size can't name exact chip revisions without
    711	 * losing backwards compatibility for cmdlinepart.
    712	 *
    713	 * These newer chips also support 128-byte security registers (with
    714	 * 64 bytes one-time-programmable) and software write-protection.
    715	 */
    716	{ "AT45DB011B",  0x1f2200, 512, 264, 9, SUP_POW2PS},
    717	{ "at45db011d",  0x1f2200, 512, 256, 8, SUP_POW2PS | IS_POW2PS},
    718
    719	{ "AT45DB021B",  0x1f2300, 1024, 264, 9, SUP_POW2PS},
    720	{ "at45db021d",  0x1f2300, 1024, 256, 8, SUP_POW2PS | IS_POW2PS},
    721
    722	{ "AT45DB041x",  0x1f2400, 2048, 264, 9, SUP_POW2PS},
    723	{ "at45db041d",  0x1f2400, 2048, 256, 8, SUP_POW2PS | IS_POW2PS},
    724
    725	{ "AT45DB081B",  0x1f2500, 4096, 264, 9, SUP_POW2PS},
    726	{ "at45db081d",  0x1f2500, 4096, 256, 8, SUP_POW2PS | IS_POW2PS},
    727
    728	{ "AT45DB161x",  0x1f2600, 4096, 528, 10, SUP_POW2PS},
    729	{ "at45db161d",  0x1f2600, 4096, 512, 9, SUP_POW2PS | IS_POW2PS},
    730
    731	{ "AT45DB321x",  0x1f2700, 8192, 528, 10, 0},		/* rev C */
    732
    733	{ "AT45DB321x",  0x1f2701, 8192, 528, 10, SUP_POW2PS},
    734	{ "at45db321d",  0x1f2701, 8192, 512, 9, SUP_POW2PS | IS_POW2PS},
    735
    736	{ "AT45DB642x",  0x1f2800, 8192, 1056, 11, SUP_POW2PS},
    737	{ "at45db642d",  0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS},
    738
    739	{ "AT45DB641E",  0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
    740	{ "at45db641e",  0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
    741};
    742
    743static struct flash_info *jedec_lookup(struct spi_device *spi,
    744				       u64 jedec, bool use_extid)
    745{
    746	struct flash_info *info;
    747	int status;
    748
    749	for (info = dataflash_data;
    750	     info < dataflash_data + ARRAY_SIZE(dataflash_data);
    751	     info++) {
    752		if (use_extid && !(info->flags & SUP_EXTID))
    753			continue;
    754
    755		if (info->jedec_id == jedec) {
    756			dev_dbg(&spi->dev, "OTP, sector protect%s\n",
    757				(info->flags & SUP_POW2PS) ?
    758				", binary pagesize" : "");
    759			if (info->flags & SUP_POW2PS) {
    760				status = dataflash_status(spi);
    761				if (status < 0) {
    762					dev_dbg(&spi->dev, "status error %d\n",
    763						status);
    764					return ERR_PTR(status);
    765				}
    766				if (status & 0x1) {
    767					if (info->flags & IS_POW2PS)
    768						return info;
    769				} else {
    770					if (!(info->flags & IS_POW2PS))
    771						return info;
    772				}
    773			} else
    774				return info;
    775		}
    776	}
    777
    778	return ERR_PTR(-ENODEV);
    779}
    780
    781static struct flash_info *jedec_probe(struct spi_device *spi)
    782{
    783	int ret;
    784	u8 code = OP_READ_ID;
    785	u64 jedec;
    786	u8 id[sizeof(jedec)] = {0};
    787	const unsigned int id_size = 5;
    788	struct flash_info *info;
    789
    790	/*
    791	 * JEDEC also defines an optional "extended device information"
    792	 * string for after vendor-specific data, after the three bytes
    793	 * we use here.  Supporting some chips might require using it.
    794	 *
    795	 * If the vendor ID isn't Atmel's (0x1f), assume this call failed.
    796	 * That's not an error; only rev C and newer chips handle it, and
    797	 * only Atmel sells these chips.
    798	 */
    799	ret = spi_write_then_read(spi, &code, 1, id, id_size);
    800	if (ret < 0) {
    801		dev_dbg(&spi->dev, "error %d reading JEDEC ID\n", ret);
    802		return ERR_PTR(ret);
    803	}
    804
    805	if (id[0] != CFI_MFR_ATMEL)
    806		return NULL;
    807
    808	jedec = be64_to_cpup((__be64 *)id);
    809
    810	/*
    811	 * First, try to match device using extended device
    812	 * information
    813	 */
    814	info = jedec_lookup(spi, jedec >> DATAFLASH_SHIFT_EXTID, true);
    815	if (!IS_ERR(info))
    816		return info;
    817	/*
    818	 * If that fails, make another pass using regular ID
    819	 * information
    820	 */
    821	info = jedec_lookup(spi, jedec >> DATAFLASH_SHIFT_ID, false);
    822	if (!IS_ERR(info))
    823		return info;
    824	/*
    825	 * Treat other chips as errors ... we won't know the right page
    826	 * size (it might be binary) even when we can tell which density
    827	 * class is involved (legacy chip id scheme).
    828	 */
    829	dev_warn(&spi->dev, "JEDEC id %016llx not handled\n", jedec);
    830	return ERR_PTR(-ENODEV);
    831}
    832
    833/*
    834 * Detect and initialize DataFlash device, using JEDEC IDs on newer chips
    835 * or else the ID code embedded in the status bits:
    836 *
    837 *   Device      Density         ID code          #Pages PageSize  Offset
    838 *   AT45DB011B  1Mbit   (128K)  xx0011xx (0x0c)    512    264      9
    839 *   AT45DB021B  2Mbit   (256K)  xx0101xx (0x14)   1024    264      9
    840 *   AT45DB041B  4Mbit   (512K)  xx0111xx (0x1c)   2048    264      9
    841 *   AT45DB081B  8Mbit   (1M)    xx1001xx (0x24)   4096    264      9
    842 *   AT45DB0161B 16Mbit  (2M)    xx1011xx (0x2c)   4096    528     10
    843 *   AT45DB0321B 32Mbit  (4M)    xx1101xx (0x34)   8192    528     10
    844 *   AT45DB0642  64Mbit  (8M)    xx111xxx (0x3c)   8192   1056     11
    845 *   AT45DB1282  128Mbit (16M)   xx0100xx (0x10)  16384   1056     11
    846 */
    847static int dataflash_probe(struct spi_device *spi)
    848{
    849	int status;
    850	struct flash_info	*info;
    851
    852	/*
    853	 * Try to detect dataflash by JEDEC ID.
    854	 * If it succeeds we know we have either a C or D part.
    855	 * D will support power of 2 pagesize option.
    856	 * Both support the security register, though with different
    857	 * write procedures.
    858	 */
    859	info = jedec_probe(spi);
    860	if (IS_ERR(info))
    861		return PTR_ERR(info);
    862	if (info != NULL)
    863		return add_dataflash_otp(spi, info->name, info->nr_pages,
    864				info->pagesize, info->pageoffset,
    865				(info->flags & SUP_POW2PS) ? 'd' : 'c');
    866
    867	/*
    868	 * Older chips support only legacy commands, identifing
    869	 * capacity using bits in the status byte.
    870	 */
    871	status = dataflash_status(spi);
    872	if (status <= 0 || status == 0xff) {
    873		dev_dbg(&spi->dev, "status error %d\n", status);
    874		if (status == 0 || status == 0xff)
    875			status = -ENODEV;
    876		return status;
    877	}
    878
    879	/* if there's a device there, assume it's dataflash.
    880	 * board setup should have set spi->max_speed_max to
    881	 * match f(car) for continuous reads, mode 0 or 3.
    882	 */
    883	switch (status & 0x3c) {
    884	case 0x0c:	/* 0 0 1 1 x x */
    885		status = add_dataflash(spi, "AT45DB011B", 512, 264, 9);
    886		break;
    887	case 0x14:	/* 0 1 0 1 x x */
    888		status = add_dataflash(spi, "AT45DB021B", 1024, 264, 9);
    889		break;
    890	case 0x1c:	/* 0 1 1 1 x x */
    891		status = add_dataflash(spi, "AT45DB041x", 2048, 264, 9);
    892		break;
    893	case 0x24:	/* 1 0 0 1 x x */
    894		status = add_dataflash(spi, "AT45DB081B", 4096, 264, 9);
    895		break;
    896	case 0x2c:	/* 1 0 1 1 x x */
    897		status = add_dataflash(spi, "AT45DB161x", 4096, 528, 10);
    898		break;
    899	case 0x34:	/* 1 1 0 1 x x */
    900		status = add_dataflash(spi, "AT45DB321x", 8192, 528, 10);
    901		break;
    902	case 0x38:	/* 1 1 1 x x x */
    903	case 0x3c:
    904		status = add_dataflash(spi, "AT45DB642x", 8192, 1056, 11);
    905		break;
    906	/* obsolete AT45DB1282 not (yet?) supported */
    907	default:
    908		dev_info(&spi->dev, "unsupported device (%x)\n",
    909				status & 0x3c);
    910		status = -ENODEV;
    911	}
    912
    913	if (status < 0)
    914		dev_dbg(&spi->dev, "add_dataflash --> %d\n", status);
    915
    916	return status;
    917}
    918
    919static void dataflash_remove(struct spi_device *spi)
    920{
    921	struct dataflash	*flash = spi_get_drvdata(spi);
    922
    923	dev_dbg(&spi->dev, "remove\n");
    924
    925	WARN_ON(mtd_device_unregister(&flash->mtd));
    926
    927	kfree(flash);
    928}
    929
    930static struct spi_driver dataflash_driver = {
    931	.driver = {
    932		.name		= "mtd_dataflash",
    933		.of_match_table = of_match_ptr(dataflash_dt_ids),
    934	},
    935	.id_table = dataflash_dev_ids,
    936
    937	.probe		= dataflash_probe,
    938	.remove		= dataflash_remove,
    939
    940	/* FIXME:  investigate suspend and resume... */
    941};
    942
    943module_spi_driver(dataflash_driver);
    944
    945MODULE_LICENSE("GPL");
    946MODULE_AUTHOR("Andrew Victor, David Brownell");
    947MODULE_DESCRIPTION("MTD DataFlash driver");
    948MODULE_ALIAS("spi:mtd_dataflash");