cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

cafe_nand.c (24893B)


      1// SPDX-License-Identifier: GPL-2.0-only
      2/*
      3 * Driver for One Laptop Per Child ‘CAFÉ’ controller, aka Marvell 88ALP01
      4 *
      5 * The data sheet for this device can be found at:
      6 *    http://wiki.laptop.org/go/Datasheets 
      7 *
      8 * Copyright © 2006 Red Hat, Inc.
      9 * Copyright © 2006 David Woodhouse <dwmw2@infradead.org>
     10 */
     11
     12#define DEBUG
     13
     14#include <linux/device.h>
     15#undef DEBUG
     16#include <linux/mtd/mtd.h>
     17#include <linux/mtd/rawnand.h>
     18#include <linux/mtd/partitions.h>
     19#include <linux/rslib.h>
     20#include <linux/pci.h>
     21#include <linux/delay.h>
     22#include <linux/interrupt.h>
     23#include <linux/dma-mapping.h>
     24#include <linux/slab.h>
     25#include <linux/module.h>
     26#include <asm/io.h>
     27
     28#define CAFE_NAND_CTRL1		0x00
     29#define CAFE_NAND_CTRL2		0x04
     30#define CAFE_NAND_CTRL3		0x08
     31#define CAFE_NAND_STATUS	0x0c
     32#define CAFE_NAND_IRQ		0x10
     33#define CAFE_NAND_IRQ_MASK	0x14
     34#define CAFE_NAND_DATA_LEN	0x18
     35#define CAFE_NAND_ADDR1		0x1c
     36#define CAFE_NAND_ADDR2		0x20
     37#define CAFE_NAND_TIMING1	0x24
     38#define CAFE_NAND_TIMING2	0x28
     39#define CAFE_NAND_TIMING3	0x2c
     40#define CAFE_NAND_NONMEM	0x30
     41#define CAFE_NAND_ECC_RESULT	0x3C
     42#define CAFE_NAND_DMA_CTRL	0x40
     43#define CAFE_NAND_DMA_ADDR0	0x44
     44#define CAFE_NAND_DMA_ADDR1	0x48
     45#define CAFE_NAND_ECC_SYN01	0x50
     46#define CAFE_NAND_ECC_SYN23	0x54
     47#define CAFE_NAND_ECC_SYN45	0x58
     48#define CAFE_NAND_ECC_SYN67	0x5c
     49#define CAFE_NAND_READ_DATA	0x1000
     50#define CAFE_NAND_WRITE_DATA	0x2000
     51
     52#define CAFE_GLOBAL_CTRL	0x3004
     53#define CAFE_GLOBAL_IRQ		0x3008
     54#define CAFE_GLOBAL_IRQ_MASK	0x300c
     55#define CAFE_NAND_RESET		0x3034
     56
     57/* Missing from the datasheet: bit 19 of CTRL1 sets CE0 vs. CE1 */
     58#define CTRL1_CHIPSELECT	(1<<19)
     59
     60struct cafe_priv {
     61	struct nand_chip nand;
     62	struct pci_dev *pdev;
     63	void __iomem *mmio;
     64	struct rs_control *rs;
     65	uint32_t ctl1;
     66	uint32_t ctl2;
     67	int datalen;
     68	int nr_data;
     69	int data_pos;
     70	int page_addr;
     71	bool usedma;
     72	dma_addr_t dmaaddr;
     73	unsigned char *dmabuf;
     74};
     75
     76static int usedma = 1;
     77module_param(usedma, int, 0644);
     78
     79static int skipbbt = 0;
     80module_param(skipbbt, int, 0644);
     81
     82static int debug = 0;
     83module_param(debug, int, 0644);
     84
     85static int regdebug = 0;
     86module_param(regdebug, int, 0644);
     87
     88static int checkecc = 1;
     89module_param(checkecc, int, 0644);
     90
     91static unsigned int numtimings;
     92static int timing[3];
     93module_param_array(timing, int, &numtimings, 0644);
     94
     95static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
     96
     97/* Hrm. Why isn't this already conditional on something in the struct device? */
     98#define cafe_dev_dbg(dev, args...) do { if (debug) dev_dbg(dev, ##args); } while(0)
     99
    100/* Make it easier to switch to PIO if we need to */
    101#define cafe_readl(cafe, addr)			readl((cafe)->mmio + CAFE_##addr)
    102#define cafe_writel(cafe, datum, addr)		writel(datum, (cafe)->mmio + CAFE_##addr)
    103
    104static int cafe_device_ready(struct nand_chip *chip)
    105{
    106	struct cafe_priv *cafe = nand_get_controller_data(chip);
    107	int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
    108	uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
    109
    110	cafe_writel(cafe, irqs, NAND_IRQ);
    111
    112	cafe_dev_dbg(&cafe->pdev->dev, "NAND device is%s ready, IRQ %x (%x) (%x,%x)\n",
    113		result?"":" not", irqs, cafe_readl(cafe, NAND_IRQ),
    114		cafe_readl(cafe, GLOBAL_IRQ), cafe_readl(cafe, GLOBAL_IRQ_MASK));
    115
    116	return result;
    117}
    118
    119
    120static void cafe_write_buf(struct nand_chip *chip, const uint8_t *buf, int len)
    121{
    122	struct cafe_priv *cafe = nand_get_controller_data(chip);
    123
    124	if (cafe->usedma)
    125		memcpy(cafe->dmabuf + cafe->datalen, buf, len);
    126	else
    127		memcpy_toio(cafe->mmio + CAFE_NAND_WRITE_DATA + cafe->datalen, buf, len);
    128
    129	cafe->datalen += len;
    130
    131	cafe_dev_dbg(&cafe->pdev->dev, "Copy 0x%x bytes to write buffer. datalen 0x%x\n",
    132		len, cafe->datalen);
    133}
    134
    135static void cafe_read_buf(struct nand_chip *chip, uint8_t *buf, int len)
    136{
    137	struct cafe_priv *cafe = nand_get_controller_data(chip);
    138
    139	if (cafe->usedma)
    140		memcpy(buf, cafe->dmabuf + cafe->datalen, len);
    141	else
    142		memcpy_fromio(buf, cafe->mmio + CAFE_NAND_READ_DATA + cafe->datalen, len);
    143
    144	cafe_dev_dbg(&cafe->pdev->dev, "Copy 0x%x bytes from position 0x%x in read buffer.\n",
    145		  len, cafe->datalen);
    146	cafe->datalen += len;
    147}
    148
    149static uint8_t cafe_read_byte(struct nand_chip *chip)
    150{
    151	struct cafe_priv *cafe = nand_get_controller_data(chip);
    152	uint8_t d;
    153
    154	cafe_read_buf(chip, &d, 1);
    155	cafe_dev_dbg(&cafe->pdev->dev, "Read %02x\n", d);
    156
    157	return d;
    158}
    159
    160static void cafe_nand_cmdfunc(struct nand_chip *chip, unsigned command,
    161			      int column, int page_addr)
    162{
    163	struct mtd_info *mtd = nand_to_mtd(chip);
    164	struct cafe_priv *cafe = nand_get_controller_data(chip);
    165	int adrbytes = 0;
    166	uint32_t ctl1;
    167	uint32_t doneint = 0x80000000;
    168
    169	cafe_dev_dbg(&cafe->pdev->dev, "cmdfunc %02x, 0x%x, 0x%x\n",
    170		command, column, page_addr);
    171
    172	if (command == NAND_CMD_ERASE2 || command == NAND_CMD_PAGEPROG) {
    173		/* Second half of a command we already calculated */
    174		cafe_writel(cafe, cafe->ctl2 | 0x100 | command, NAND_CTRL2);
    175		ctl1 = cafe->ctl1;
    176		cafe->ctl2 &= ~(1<<30);
    177		cafe_dev_dbg(&cafe->pdev->dev, "Continue command, ctl1 %08x, #data %d\n",
    178			  cafe->ctl1, cafe->nr_data);
    179		goto do_command;
    180	}
    181	/* Reset ECC engine */
    182	cafe_writel(cafe, 0, NAND_CTRL2);
    183
    184	/* Emulate NAND_CMD_READOOB on large-page chips */
    185	if (mtd->writesize > 512 &&
    186	    command == NAND_CMD_READOOB) {
    187		column += mtd->writesize;
    188		command = NAND_CMD_READ0;
    189	}
    190
    191	/* FIXME: Do we need to send read command before sending data
    192	   for small-page chips, to position the buffer correctly? */
    193
    194	if (column != -1) {
    195		cafe_writel(cafe, column, NAND_ADDR1);
    196		adrbytes = 2;
    197		if (page_addr != -1)
    198			goto write_adr2;
    199	} else if (page_addr != -1) {
    200		cafe_writel(cafe, page_addr & 0xffff, NAND_ADDR1);
    201		page_addr >>= 16;
    202	write_adr2:
    203		cafe_writel(cafe, page_addr, NAND_ADDR2);
    204		adrbytes += 2;
    205		if (mtd->size > mtd->writesize << 16)
    206			adrbytes++;
    207	}
    208
    209	cafe->data_pos = cafe->datalen = 0;
    210
    211	/* Set command valid bit, mask in the chip select bit  */
    212	ctl1 = 0x80000000 | command | (cafe->ctl1 & CTRL1_CHIPSELECT);
    213
    214	/* Set RD or WR bits as appropriate */
    215	if (command == NAND_CMD_READID || command == NAND_CMD_STATUS) {
    216		ctl1 |= (1<<26); /* rd */
    217		/* Always 5 bytes, for now */
    218		cafe->datalen = 4;
    219		/* And one address cycle -- even for STATUS, since the controller doesn't work without */
    220		adrbytes = 1;
    221	} else if (command == NAND_CMD_READ0 || command == NAND_CMD_READ1 ||
    222		   command == NAND_CMD_READOOB || command == NAND_CMD_RNDOUT) {
    223		ctl1 |= 1<<26; /* rd */
    224		/* For now, assume just read to end of page */
    225		cafe->datalen = mtd->writesize + mtd->oobsize - column;
    226	} else if (command == NAND_CMD_SEQIN)
    227		ctl1 |= 1<<25; /* wr */
    228
    229	/* Set number of address bytes */
    230	if (adrbytes)
    231		ctl1 |= ((adrbytes-1)|8) << 27;
    232
    233	if (command == NAND_CMD_SEQIN || command == NAND_CMD_ERASE1) {
    234		/* Ignore the first command of a pair; the hardware
    235		   deals with them both at once, later */
    236		cafe->ctl1 = ctl1;
    237		cafe_dev_dbg(&cafe->pdev->dev, "Setup for delayed command, ctl1 %08x, dlen %x\n",
    238			  cafe->ctl1, cafe->datalen);
    239		return;
    240	}
    241	/* RNDOUT and READ0 commands need a following byte */
    242	if (command == NAND_CMD_RNDOUT)
    243		cafe_writel(cafe, cafe->ctl2 | 0x100 | NAND_CMD_RNDOUTSTART, NAND_CTRL2);
    244	else if (command == NAND_CMD_READ0 && mtd->writesize > 512)
    245		cafe_writel(cafe, cafe->ctl2 | 0x100 | NAND_CMD_READSTART, NAND_CTRL2);
    246
    247 do_command:
    248	cafe_dev_dbg(&cafe->pdev->dev, "dlen %x, ctl1 %x, ctl2 %x\n",
    249		cafe->datalen, ctl1, cafe_readl(cafe, NAND_CTRL2));
    250
    251	/* NB: The datasheet lies -- we really should be subtracting 1 here */
    252	cafe_writel(cafe, cafe->datalen, NAND_DATA_LEN);
    253	cafe_writel(cafe, 0x90000000, NAND_IRQ);
    254	if (cafe->usedma && (ctl1 & (3<<25))) {
    255		uint32_t dmactl = 0xc0000000 + cafe->datalen;
    256		/* If WR or RD bits set, set up DMA */
    257		if (ctl1 & (1<<26)) {
    258			/* It's a read */
    259			dmactl |= (1<<29);
    260			/* ... so it's done when the DMA is done, not just
    261			   the command. */
    262			doneint = 0x10000000;
    263		}
    264		cafe_writel(cafe, dmactl, NAND_DMA_CTRL);
    265	}
    266	cafe->datalen = 0;
    267
    268	if (unlikely(regdebug)) {
    269		int i;
    270		printk("About to write command %08x to register 0\n", ctl1);
    271		for (i=4; i< 0x5c; i+=4)
    272			printk("Register %x: %08x\n", i, readl(cafe->mmio + i));
    273	}
    274
    275	cafe_writel(cafe, ctl1, NAND_CTRL1);
    276	/* Apply this short delay always to ensure that we do wait tWB in
    277	 * any case on any machine. */
    278	ndelay(100);
    279
    280	if (1) {
    281		int c;
    282		uint32_t irqs;
    283
    284		for (c = 500000; c != 0; c--) {
    285			irqs = cafe_readl(cafe, NAND_IRQ);
    286			if (irqs & doneint)
    287				break;
    288			udelay(1);
    289			if (!(c % 100000))
    290				cafe_dev_dbg(&cafe->pdev->dev, "Wait for ready, IRQ %x\n", irqs);
    291			cpu_relax();
    292		}
    293		cafe_writel(cafe, doneint, NAND_IRQ);
    294		cafe_dev_dbg(&cafe->pdev->dev, "Command %x completed after %d usec, irqs %x (%x)\n",
    295			     command, 500000-c, irqs, cafe_readl(cafe, NAND_IRQ));
    296	}
    297
    298	WARN_ON(cafe->ctl2 & (1<<30));
    299
    300	switch (command) {
    301
    302	case NAND_CMD_CACHEDPROG:
    303	case NAND_CMD_PAGEPROG:
    304	case NAND_CMD_ERASE1:
    305	case NAND_CMD_ERASE2:
    306	case NAND_CMD_SEQIN:
    307	case NAND_CMD_RNDIN:
    308	case NAND_CMD_STATUS:
    309	case NAND_CMD_RNDOUT:
    310		cafe_writel(cafe, cafe->ctl2, NAND_CTRL2);
    311		return;
    312	}
    313	nand_wait_ready(chip);
    314	cafe_writel(cafe, cafe->ctl2, NAND_CTRL2);
    315}
    316
    317static void cafe_select_chip(struct nand_chip *chip, int chipnr)
    318{
    319	struct cafe_priv *cafe = nand_get_controller_data(chip);
    320
    321	cafe_dev_dbg(&cafe->pdev->dev, "select_chip %d\n", chipnr);
    322
    323	/* Mask the appropriate bit into the stored value of ctl1
    324	   which will be used by cafe_nand_cmdfunc() */
    325	if (chipnr)
    326		cafe->ctl1 |= CTRL1_CHIPSELECT;
    327	else
    328		cafe->ctl1 &= ~CTRL1_CHIPSELECT;
    329}
    330
    331static irqreturn_t cafe_nand_interrupt(int irq, void *id)
    332{
    333	struct mtd_info *mtd = id;
    334	struct nand_chip *chip = mtd_to_nand(mtd);
    335	struct cafe_priv *cafe = nand_get_controller_data(chip);
    336	uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
    337	cafe_writel(cafe, irqs & ~0x90000000, NAND_IRQ);
    338	if (!irqs)
    339		return IRQ_NONE;
    340
    341	cafe_dev_dbg(&cafe->pdev->dev, "irq, bits %x (%x)\n", irqs, cafe_readl(cafe, NAND_IRQ));
    342	return IRQ_HANDLED;
    343}
    344
    345static int cafe_nand_write_oob(struct nand_chip *chip, int page)
    346{
    347	struct mtd_info *mtd = nand_to_mtd(chip);
    348
    349	return nand_prog_page_op(chip, page, mtd->writesize, chip->oob_poi,
    350				 mtd->oobsize);
    351}
    352
    353/* Don't use -- use nand_read_oob_std for now */
    354static int cafe_nand_read_oob(struct nand_chip *chip, int page)
    355{
    356	struct mtd_info *mtd = nand_to_mtd(chip);
    357
    358	return nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
    359}
    360/**
    361 * cafe_nand_read_page_syndrome - [REPLACEABLE] hardware ecc syndrome based page read
    362 * @chip:	nand chip info structure
    363 * @buf:	buffer to store read data
    364 * @oob_required:	caller expects OOB data read to chip->oob_poi
    365 * @page:	page number to read
    366 *
    367 * The hw generator calculates the error syndrome automatically. Therefore
    368 * we need a special oob layout and handling.
    369 */
    370static int cafe_nand_read_page(struct nand_chip *chip, uint8_t *buf,
    371			       int oob_required, int page)
    372{
    373	struct mtd_info *mtd = nand_to_mtd(chip);
    374	struct cafe_priv *cafe = nand_get_controller_data(chip);
    375	unsigned int max_bitflips = 0;
    376
    377	cafe_dev_dbg(&cafe->pdev->dev, "ECC result %08x SYN1,2 %08x\n",
    378		     cafe_readl(cafe, NAND_ECC_RESULT),
    379		     cafe_readl(cafe, NAND_ECC_SYN01));
    380
    381	nand_read_page_op(chip, page, 0, buf, mtd->writesize);
    382	chip->legacy.read_buf(chip, chip->oob_poi, mtd->oobsize);
    383
    384	if (checkecc && cafe_readl(cafe, NAND_ECC_RESULT) & (1<<18)) {
    385		unsigned short syn[8], pat[4];
    386		int pos[4];
    387		u8 *oob = chip->oob_poi;
    388		int i, n;
    389
    390		for (i=0; i<8; i+=2) {
    391			uint32_t tmp = cafe_readl(cafe, NAND_ECC_SYN01 + (i*2));
    392
    393			syn[i] = cafe->rs->codec->index_of[tmp & 0xfff];
    394			syn[i+1] = cafe->rs->codec->index_of[(tmp >> 16) & 0xfff];
    395		}
    396
    397		n = decode_rs16(cafe->rs, NULL, NULL, 1367, syn, 0, pos, 0,
    398				pat);
    399
    400		for (i = 0; i < n; i++) {
    401			int p = pos[i];
    402
    403			/* The 12-bit symbols are mapped to bytes here */
    404
    405			if (p > 1374) {
    406				/* out of range */
    407				n = -1374;
    408			} else if (p == 0) {
    409				/* high four bits do not correspond to data */
    410				if (pat[i] > 0xff)
    411					n = -2048;
    412				else
    413					buf[0] ^= pat[i];
    414			} else if (p == 1365) {
    415				buf[2047] ^= pat[i] >> 4;
    416				oob[0] ^= pat[i] << 4;
    417			} else if (p > 1365) {
    418				if ((p & 1) == 1) {
    419					oob[3*p/2 - 2048] ^= pat[i] >> 4;
    420					oob[3*p/2 - 2047] ^= pat[i] << 4;
    421				} else {
    422					oob[3*p/2 - 2049] ^= pat[i] >> 8;
    423					oob[3*p/2 - 2048] ^= pat[i];
    424				}
    425			} else if ((p & 1) == 1) {
    426				buf[3*p/2] ^= pat[i] >> 4;
    427				buf[3*p/2 + 1] ^= pat[i] << 4;
    428			} else {
    429				buf[3*p/2 - 1] ^= pat[i] >> 8;
    430				buf[3*p/2] ^= pat[i];
    431			}
    432		}
    433
    434		if (n < 0) {
    435			dev_dbg(&cafe->pdev->dev, "Failed to correct ECC at %08x\n",
    436				cafe_readl(cafe, NAND_ADDR2) * 2048);
    437			for (i = 0; i < 0x5c; i += 4)
    438				printk("Register %x: %08x\n", i, readl(cafe->mmio + i));
    439			mtd->ecc_stats.failed++;
    440		} else {
    441			dev_dbg(&cafe->pdev->dev, "Corrected %d symbol errors\n", n);
    442			mtd->ecc_stats.corrected += n;
    443			max_bitflips = max_t(unsigned int, max_bitflips, n);
    444		}
    445	}
    446
    447	return max_bitflips;
    448}
    449
    450static int cafe_ooblayout_ecc(struct mtd_info *mtd, int section,
    451			      struct mtd_oob_region *oobregion)
    452{
    453	struct nand_chip *chip = mtd_to_nand(mtd);
    454
    455	if (section)
    456		return -ERANGE;
    457
    458	oobregion->offset = 0;
    459	oobregion->length = chip->ecc.total;
    460
    461	return 0;
    462}
    463
    464static int cafe_ooblayout_free(struct mtd_info *mtd, int section,
    465			       struct mtd_oob_region *oobregion)
    466{
    467	struct nand_chip *chip = mtd_to_nand(mtd);
    468
    469	if (section)
    470		return -ERANGE;
    471
    472	oobregion->offset = chip->ecc.total;
    473	oobregion->length = mtd->oobsize - chip->ecc.total;
    474
    475	return 0;
    476}
    477
    478static const struct mtd_ooblayout_ops cafe_ooblayout_ops = {
    479	.ecc = cafe_ooblayout_ecc,
    480	.free = cafe_ooblayout_free,
    481};
    482
    483/* Ick. The BBT code really ought to be able to work this bit out
    484   for itself from the above, at least for the 2KiB case */
    485static uint8_t cafe_bbt_pattern_2048[] = { 'B', 'b', 't', '0' };
    486static uint8_t cafe_mirror_pattern_2048[] = { '1', 't', 'b', 'B' };
    487
    488static uint8_t cafe_bbt_pattern_512[] = { 0xBB };
    489static uint8_t cafe_mirror_pattern_512[] = { 0xBC };
    490
    491
    492static struct nand_bbt_descr cafe_bbt_main_descr_2048 = {
    493	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
    494		| NAND_BBT_2BIT | NAND_BBT_VERSION,
    495	.offs =	14,
    496	.len = 4,
    497	.veroffs = 18,
    498	.maxblocks = 4,
    499	.pattern = cafe_bbt_pattern_2048
    500};
    501
    502static struct nand_bbt_descr cafe_bbt_mirror_descr_2048 = {
    503	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
    504		| NAND_BBT_2BIT | NAND_BBT_VERSION,
    505	.offs =	14,
    506	.len = 4,
    507	.veroffs = 18,
    508	.maxblocks = 4,
    509	.pattern = cafe_mirror_pattern_2048
    510};
    511
    512static struct nand_bbt_descr cafe_bbt_main_descr_512 = {
    513	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
    514		| NAND_BBT_2BIT | NAND_BBT_VERSION,
    515	.offs =	14,
    516	.len = 1,
    517	.veroffs = 15,
    518	.maxblocks = 4,
    519	.pattern = cafe_bbt_pattern_512
    520};
    521
    522static struct nand_bbt_descr cafe_bbt_mirror_descr_512 = {
    523	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
    524		| NAND_BBT_2BIT | NAND_BBT_VERSION,
    525	.offs =	14,
    526	.len = 1,
    527	.veroffs = 15,
    528	.maxblocks = 4,
    529	.pattern = cafe_mirror_pattern_512
    530};
    531
    532
    533static int cafe_nand_write_page_lowlevel(struct nand_chip *chip,
    534					 const uint8_t *buf, int oob_required,
    535					 int page)
    536{
    537	struct mtd_info *mtd = nand_to_mtd(chip);
    538	struct cafe_priv *cafe = nand_get_controller_data(chip);
    539
    540	nand_prog_page_begin_op(chip, page, 0, buf, mtd->writesize);
    541	chip->legacy.write_buf(chip, chip->oob_poi, mtd->oobsize);
    542
    543	/* Set up ECC autogeneration */
    544	cafe->ctl2 |= (1<<30);
    545
    546	return nand_prog_page_end_op(chip);
    547}
    548
    549/* F_2[X]/(X**6+X+1)  */
    550static unsigned short gf64_mul(u8 a, u8 b)
    551{
    552	u8 c;
    553	unsigned int i;
    554
    555	c = 0;
    556	for (i = 0; i < 6; i++) {
    557		if (a & 1)
    558			c ^= b;
    559		a >>= 1;
    560		b <<= 1;
    561		if ((b & 0x40) != 0)
    562			b ^= 0x43;
    563	}
    564
    565	return c;
    566}
    567
    568/* F_64[X]/(X**2+X+A**-1) with A the generator of F_64[X]  */
    569static u16 gf4096_mul(u16 a, u16 b)
    570{
    571	u8 ah, al, bh, bl, ch, cl;
    572
    573	ah = a >> 6;
    574	al = a & 0x3f;
    575	bh = b >> 6;
    576	bl = b & 0x3f;
    577
    578	ch = gf64_mul(ah ^ al, bh ^ bl) ^ gf64_mul(al, bl);
    579	cl = gf64_mul(gf64_mul(ah, bh), 0x21) ^ gf64_mul(al, bl);
    580
    581	return (ch << 6) ^ cl;
    582}
    583
    584static int cafe_mul(int x)
    585{
    586	if (x == 0)
    587		return 1;
    588	return gf4096_mul(x, 0xe01);
    589}
    590
    591static int cafe_nand_attach_chip(struct nand_chip *chip)
    592{
    593	struct mtd_info *mtd = nand_to_mtd(chip);
    594	struct cafe_priv *cafe = nand_get_controller_data(chip);
    595	int err = 0;
    596
    597	cafe->dmabuf = dma_alloc_coherent(&cafe->pdev->dev, 2112,
    598					  &cafe->dmaaddr, GFP_KERNEL);
    599	if (!cafe->dmabuf)
    600		return -ENOMEM;
    601
    602	/* Set up DMA address */
    603	cafe_writel(cafe, lower_32_bits(cafe->dmaaddr), NAND_DMA_ADDR0);
    604	cafe_writel(cafe, upper_32_bits(cafe->dmaaddr), NAND_DMA_ADDR1);
    605
    606	cafe_dev_dbg(&cafe->pdev->dev, "Set DMA address to %x (virt %p)\n",
    607		     cafe_readl(cafe, NAND_DMA_ADDR0), cafe->dmabuf);
    608
    609	/* Restore the DMA flag */
    610	cafe->usedma = usedma;
    611
    612	cafe->ctl2 = BIT(27); /* Reed-Solomon ECC */
    613	if (mtd->writesize == 2048)
    614		cafe->ctl2 |= BIT(29); /* 2KiB page size */
    615
    616	/* Set up ECC according to the type of chip we found */
    617	mtd_set_ooblayout(mtd, &cafe_ooblayout_ops);
    618	if (mtd->writesize == 2048) {
    619		cafe->nand.bbt_td = &cafe_bbt_main_descr_2048;
    620		cafe->nand.bbt_md = &cafe_bbt_mirror_descr_2048;
    621	} else if (mtd->writesize == 512) {
    622		cafe->nand.bbt_td = &cafe_bbt_main_descr_512;
    623		cafe->nand.bbt_md = &cafe_bbt_mirror_descr_512;
    624	} else {
    625		dev_warn(&cafe->pdev->dev,
    626			 "Unexpected NAND flash writesize %d. Aborting\n",
    627			 mtd->writesize);
    628		err = -ENOTSUPP;
    629		goto out_free_dma;
    630	}
    631
    632	cafe->nand.ecc.engine_type = NAND_ECC_ENGINE_TYPE_ON_HOST;
    633	cafe->nand.ecc.placement = NAND_ECC_PLACEMENT_INTERLEAVED;
    634	cafe->nand.ecc.size = mtd->writesize;
    635	cafe->nand.ecc.bytes = 14;
    636	cafe->nand.ecc.strength = 4;
    637	cafe->nand.ecc.write_page = cafe_nand_write_page_lowlevel;
    638	cafe->nand.ecc.write_oob = cafe_nand_write_oob;
    639	cafe->nand.ecc.read_page = cafe_nand_read_page;
    640	cafe->nand.ecc.read_oob = cafe_nand_read_oob;
    641
    642	return 0;
    643
    644 out_free_dma:
    645	dma_free_coherent(&cafe->pdev->dev, 2112, cafe->dmabuf, cafe->dmaaddr);
    646
    647	return err;
    648}
    649
    650static void cafe_nand_detach_chip(struct nand_chip *chip)
    651{
    652	struct cafe_priv *cafe = nand_get_controller_data(chip);
    653
    654	dma_free_coherent(&cafe->pdev->dev, 2112, cafe->dmabuf, cafe->dmaaddr);
    655}
    656
    657static const struct nand_controller_ops cafe_nand_controller_ops = {
    658	.attach_chip = cafe_nand_attach_chip,
    659	.detach_chip = cafe_nand_detach_chip,
    660};
    661
    662static int cafe_nand_probe(struct pci_dev *pdev,
    663				     const struct pci_device_id *ent)
    664{
    665	struct mtd_info *mtd;
    666	struct cafe_priv *cafe;
    667	uint32_t ctrl;
    668	int err = 0;
    669
    670	/* Very old versions shared the same PCI ident for all three
    671	   functions on the chip. Verify the class too... */
    672	if ((pdev->class >> 8) != PCI_CLASS_MEMORY_FLASH)
    673		return -ENODEV;
    674
    675	err = pci_enable_device(pdev);
    676	if (err)
    677		return err;
    678
    679	pci_set_master(pdev);
    680
    681	cafe = kzalloc(sizeof(*cafe), GFP_KERNEL);
    682	if (!cafe)
    683		return  -ENOMEM;
    684
    685	mtd = nand_to_mtd(&cafe->nand);
    686	mtd->dev.parent = &pdev->dev;
    687	nand_set_controller_data(&cafe->nand, cafe);
    688
    689	cafe->pdev = pdev;
    690	cafe->mmio = pci_iomap(pdev, 0, 0);
    691	if (!cafe->mmio) {
    692		dev_warn(&pdev->dev, "failed to iomap\n");
    693		err = -ENOMEM;
    694		goto out_free_mtd;
    695	}
    696
    697	cafe->rs = init_rs_non_canonical(12, &cafe_mul, 0, 1, 8);
    698	if (!cafe->rs) {
    699		err = -ENOMEM;
    700		goto out_ior;
    701	}
    702
    703	cafe->nand.legacy.cmdfunc = cafe_nand_cmdfunc;
    704	cafe->nand.legacy.dev_ready = cafe_device_ready;
    705	cafe->nand.legacy.read_byte = cafe_read_byte;
    706	cafe->nand.legacy.read_buf = cafe_read_buf;
    707	cafe->nand.legacy.write_buf = cafe_write_buf;
    708	cafe->nand.legacy.select_chip = cafe_select_chip;
    709	cafe->nand.legacy.set_features = nand_get_set_features_notsupp;
    710	cafe->nand.legacy.get_features = nand_get_set_features_notsupp;
    711
    712	cafe->nand.legacy.chip_delay = 0;
    713
    714	/* Enable the following for a flash based bad block table */
    715	cafe->nand.bbt_options = NAND_BBT_USE_FLASH;
    716
    717	if (skipbbt)
    718		cafe->nand.options |= NAND_SKIP_BBTSCAN | NAND_NO_BBM_QUIRK;
    719
    720	if (numtimings && numtimings != 3) {
    721		dev_warn(&cafe->pdev->dev, "%d timing register values ignored; precisely three are required\n", numtimings);
    722	}
    723
    724	if (numtimings == 3) {
    725		cafe_dev_dbg(&cafe->pdev->dev, "Using provided timings (%08x %08x %08x)\n",
    726			     timing[0], timing[1], timing[2]);
    727	} else {
    728		timing[0] = cafe_readl(cafe, NAND_TIMING1);
    729		timing[1] = cafe_readl(cafe, NAND_TIMING2);
    730		timing[2] = cafe_readl(cafe, NAND_TIMING3);
    731
    732		if (timing[0] | timing[1] | timing[2]) {
    733			cafe_dev_dbg(&cafe->pdev->dev, "Timing registers already set (%08x %08x %08x)\n",
    734				     timing[0], timing[1], timing[2]);
    735		} else {
    736			dev_warn(&cafe->pdev->dev, "Timing registers unset; using most conservative defaults\n");
    737			timing[0] = timing[1] = timing[2] = 0xffffffff;
    738		}
    739	}
    740
    741	/* Start off by resetting the NAND controller completely */
    742	cafe_writel(cafe, 1, NAND_RESET);
    743	cafe_writel(cafe, 0, NAND_RESET);
    744
    745	cafe_writel(cafe, timing[0], NAND_TIMING1);
    746	cafe_writel(cafe, timing[1], NAND_TIMING2);
    747	cafe_writel(cafe, timing[2], NAND_TIMING3);
    748
    749	cafe_writel(cafe, 0xffffffff, NAND_IRQ_MASK);
    750	err = request_irq(pdev->irq, &cafe_nand_interrupt, IRQF_SHARED,
    751			  "CAFE NAND", mtd);
    752	if (err) {
    753		dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq);
    754		goto out_free_rs;
    755	}
    756
    757	/* Disable master reset, enable NAND clock */
    758	ctrl = cafe_readl(cafe, GLOBAL_CTRL);
    759	ctrl &= 0xffffeff0;
    760	ctrl |= 0x00007000;
    761	cafe_writel(cafe, ctrl | 0x05, GLOBAL_CTRL);
    762	cafe_writel(cafe, ctrl | 0x0a, GLOBAL_CTRL);
    763	cafe_writel(cafe, 0, NAND_DMA_CTRL);
    764
    765	cafe_writel(cafe, 0x7006, GLOBAL_CTRL);
    766	cafe_writel(cafe, 0x700a, GLOBAL_CTRL);
    767
    768	/* Enable NAND IRQ in global IRQ mask register */
    769	cafe_writel(cafe, 0x80000007, GLOBAL_IRQ_MASK);
    770	cafe_dev_dbg(&cafe->pdev->dev, "Control %x, IRQ mask %x\n",
    771		cafe_readl(cafe, GLOBAL_CTRL),
    772		cafe_readl(cafe, GLOBAL_IRQ_MASK));
    773
    774	/* Do not use the DMA during the NAND identification */
    775	cafe->usedma = 0;
    776
    777	/* Scan to find existence of the device */
    778	cafe->nand.legacy.dummy_controller.ops = &cafe_nand_controller_ops;
    779	err = nand_scan(&cafe->nand, 2);
    780	if (err)
    781		goto out_irq;
    782
    783	pci_set_drvdata(pdev, mtd);
    784
    785	mtd->name = "cafe_nand";
    786	err = mtd_device_parse_register(mtd, part_probes, NULL, NULL, 0);
    787	if (err)
    788		goto out_cleanup_nand;
    789
    790	goto out;
    791
    792 out_cleanup_nand:
    793	nand_cleanup(&cafe->nand);
    794 out_irq:
    795	/* Disable NAND IRQ in global IRQ mask register */
    796	cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
    797	free_irq(pdev->irq, mtd);
    798 out_free_rs:
    799	free_rs(cafe->rs);
    800 out_ior:
    801	pci_iounmap(pdev, cafe->mmio);
    802 out_free_mtd:
    803	kfree(cafe);
    804 out:
    805	return err;
    806}
    807
    808static void cafe_nand_remove(struct pci_dev *pdev)
    809{
    810	struct mtd_info *mtd = pci_get_drvdata(pdev);
    811	struct nand_chip *chip = mtd_to_nand(mtd);
    812	struct cafe_priv *cafe = nand_get_controller_data(chip);
    813	int ret;
    814
    815	/* Disable NAND IRQ in global IRQ mask register */
    816	cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
    817	free_irq(pdev->irq, mtd);
    818	ret = mtd_device_unregister(mtd);
    819	WARN_ON(ret);
    820	nand_cleanup(chip);
    821	free_rs(cafe->rs);
    822	pci_iounmap(pdev, cafe->mmio);
    823	dma_free_coherent(&cafe->pdev->dev, 2112, cafe->dmabuf, cafe->dmaaddr);
    824	kfree(cafe);
    825}
    826
    827static const struct pci_device_id cafe_nand_tbl[] = {
    828	{ PCI_VENDOR_ID_MARVELL, PCI_DEVICE_ID_MARVELL_88ALP01_NAND,
    829	  PCI_ANY_ID, PCI_ANY_ID },
    830	{ }
    831};
    832
    833MODULE_DEVICE_TABLE(pci, cafe_nand_tbl);
    834
    835static int cafe_nand_resume(struct pci_dev *pdev)
    836{
    837	uint32_t ctrl;
    838	struct mtd_info *mtd = pci_get_drvdata(pdev);
    839	struct nand_chip *chip = mtd_to_nand(mtd);
    840	struct cafe_priv *cafe = nand_get_controller_data(chip);
    841
    842       /* Start off by resetting the NAND controller completely */
    843	cafe_writel(cafe, 1, NAND_RESET);
    844	cafe_writel(cafe, 0, NAND_RESET);
    845	cafe_writel(cafe, 0xffffffff, NAND_IRQ_MASK);
    846
    847	/* Restore timing configuration */
    848	cafe_writel(cafe, timing[0], NAND_TIMING1);
    849	cafe_writel(cafe, timing[1], NAND_TIMING2);
    850	cafe_writel(cafe, timing[2], NAND_TIMING3);
    851
    852        /* Disable master reset, enable NAND clock */
    853	ctrl = cafe_readl(cafe, GLOBAL_CTRL);
    854	ctrl &= 0xffffeff0;
    855	ctrl |= 0x00007000;
    856	cafe_writel(cafe, ctrl | 0x05, GLOBAL_CTRL);
    857	cafe_writel(cafe, ctrl | 0x0a, GLOBAL_CTRL);
    858	cafe_writel(cafe, 0, NAND_DMA_CTRL);
    859	cafe_writel(cafe, 0x7006, GLOBAL_CTRL);
    860	cafe_writel(cafe, 0x700a, GLOBAL_CTRL);
    861
    862	/* Set up DMA address */
    863	cafe_writel(cafe, cafe->dmaaddr & 0xffffffff, NAND_DMA_ADDR0);
    864	if (sizeof(cafe->dmaaddr) > 4)
    865	/* Shift in two parts to shut the compiler up */
    866		cafe_writel(cafe, (cafe->dmaaddr >> 16) >> 16, NAND_DMA_ADDR1);
    867	else
    868		cafe_writel(cafe, 0, NAND_DMA_ADDR1);
    869
    870	/* Enable NAND IRQ in global IRQ mask register */
    871	cafe_writel(cafe, 0x80000007, GLOBAL_IRQ_MASK);
    872	return 0;
    873}
    874
    875static struct pci_driver cafe_nand_pci_driver = {
    876	.name = "CAFÉ NAND",
    877	.id_table = cafe_nand_tbl,
    878	.probe = cafe_nand_probe,
    879	.remove = cafe_nand_remove,
    880	.resume = cafe_nand_resume,
    881};
    882
    883module_pci_driver(cafe_nand_pci_driver);
    884
    885MODULE_LICENSE("GPL");
    886MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
    887MODULE_DESCRIPTION("NAND flash driver for OLPC CAFÉ chip");