OMAPDSS: VENC: fix NULL pointer dereference in DSS2 VENC sysfs debug attr on OMAP4
[zen-stable.git] / drivers / mtd / devices / lart.c
blob5f12668efb8c74aa87aa66d52e37240c1ee33898
2 /*
3 * MTD driver for the 28F160F3 Flash Memory (non-CFI) on LART.
5 * Author: Abraham vd Merwe <abraham@2d3d.co.za>
7 * Copyright (c) 2001, 2d3D, Inc.
9 * This code is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
13 * References:
15 * [1] 3 Volt Fast Boot Block Flash Memory" Intel Datasheet
16 * - Order Number: 290644-005
17 * - January 2000
19 * [2] MTD internal API documentation
20 * - http://www.linux-mtd.infradead.org/
22 * Limitations:
24 * Even though this driver is written for 3 Volt Fast Boot
25 * Block Flash Memory, it is rather specific to LART. With
26 * Minor modifications, notably the without data/address line
27 * mangling and different bus settings, etc. it should be
28 * trivial to adapt to other platforms.
30 * If somebody would sponsor me a different board, I'll
31 * adapt the driver (:
34 /* debugging */
35 //#define LART_DEBUG
37 #include <linux/kernel.h>
38 #include <linux/module.h>
39 #include <linux/types.h>
40 #include <linux/init.h>
41 #include <linux/errno.h>
42 #include <linux/string.h>
43 #include <linux/mtd/mtd.h>
44 #include <linux/mtd/partitions.h>
46 #ifndef CONFIG_SA1100_LART
47 #error This is for LART architecture only
48 #endif
50 static char module_name[] = "lart";
53 * These values is specific to 28Fxxxx3 flash memory.
54 * See section 2.3.1 in "3 Volt Fast Boot Block Flash Memory" Intel Datasheet
56 #define FLASH_BLOCKSIZE_PARAM (4096 * BUSWIDTH)
57 #define FLASH_NUMBLOCKS_16m_PARAM 8
58 #define FLASH_NUMBLOCKS_8m_PARAM 8
61 * These values is specific to 28Fxxxx3 flash memory.
62 * See section 2.3.2 in "3 Volt Fast Boot Block Flash Memory" Intel Datasheet
64 #define FLASH_BLOCKSIZE_MAIN (32768 * BUSWIDTH)
65 #define FLASH_NUMBLOCKS_16m_MAIN 31
66 #define FLASH_NUMBLOCKS_8m_MAIN 15
69 * These values are specific to LART
72 /* general */
73 #define BUSWIDTH 4 /* don't change this - a lot of the code _will_ break if you change this */
74 #define FLASH_OFFSET 0xe8000000 /* see linux/arch/arm/mach-sa1100/lart.c */
76 /* blob */
77 #define NUM_BLOB_BLOCKS FLASH_NUMBLOCKS_16m_PARAM
78 #define BLOB_START 0x00000000
79 #define BLOB_LEN (NUM_BLOB_BLOCKS * FLASH_BLOCKSIZE_PARAM)
81 /* kernel */
82 #define NUM_KERNEL_BLOCKS 7
83 #define KERNEL_START (BLOB_START + BLOB_LEN)
84 #define KERNEL_LEN (NUM_KERNEL_BLOCKS * FLASH_BLOCKSIZE_MAIN)
86 /* initial ramdisk */
87 #define NUM_INITRD_BLOCKS 24
88 #define INITRD_START (KERNEL_START + KERNEL_LEN)
89 #define INITRD_LEN (NUM_INITRD_BLOCKS * FLASH_BLOCKSIZE_MAIN)
92 * See section 4.0 in "3 Volt Fast Boot Block Flash Memory" Intel Datasheet
94 #define READ_ARRAY 0x00FF00FF /* Read Array/Reset */
95 #define READ_ID_CODES 0x00900090 /* Read Identifier Codes */
96 #define ERASE_SETUP 0x00200020 /* Block Erase */
97 #define ERASE_CONFIRM 0x00D000D0 /* Block Erase and Program Resume */
98 #define PGM_SETUP 0x00400040 /* Program */
99 #define STATUS_READ 0x00700070 /* Read Status Register */
100 #define STATUS_CLEAR 0x00500050 /* Clear Status Register */
101 #define STATUS_BUSY 0x00800080 /* Write State Machine Status (WSMS) */
102 #define STATUS_ERASE_ERR 0x00200020 /* Erase Status (ES) */
103 #define STATUS_PGM_ERR 0x00100010 /* Program Status (PS) */
106 * See section 4.2 in "3 Volt Fast Boot Block Flash Memory" Intel Datasheet
108 #define FLASH_MANUFACTURER 0x00890089
109 #define FLASH_DEVICE_8mbit_TOP 0x88f188f1
110 #define FLASH_DEVICE_8mbit_BOTTOM 0x88f288f2
111 #define FLASH_DEVICE_16mbit_TOP 0x88f388f3
112 #define FLASH_DEVICE_16mbit_BOTTOM 0x88f488f4
114 /***************************************************************************************************/
117 * The data line mapping on LART is as follows:
119 * U2 CPU | U3 CPU
120 * -------------------
121 * 0 20 | 0 12
122 * 1 22 | 1 14
123 * 2 19 | 2 11
124 * 3 17 | 3 9
125 * 4 24 | 4 0
126 * 5 26 | 5 2
127 * 6 31 | 6 7
128 * 7 29 | 7 5
129 * 8 21 | 8 13
130 * 9 23 | 9 15
131 * 10 18 | 10 10
132 * 11 16 | 11 8
133 * 12 25 | 12 1
134 * 13 27 | 13 3
135 * 14 30 | 14 6
136 * 15 28 | 15 4
139 /* Mangle data (x) */
140 #define DATA_TO_FLASH(x) \
142 (((x) & 0x08009000) >> 11) + \
143 (((x) & 0x00002000) >> 10) + \
144 (((x) & 0x04004000) >> 8) + \
145 (((x) & 0x00000010) >> 4) + \
146 (((x) & 0x91000820) >> 3) + \
147 (((x) & 0x22080080) >> 2) + \
148 ((x) & 0x40000400) + \
149 (((x) & 0x00040040) << 1) + \
150 (((x) & 0x00110000) << 4) + \
151 (((x) & 0x00220100) << 5) + \
152 (((x) & 0x00800208) << 6) + \
153 (((x) & 0x00400004) << 9) + \
154 (((x) & 0x00000001) << 12) + \
155 (((x) & 0x00000002) << 13) \
158 /* Unmangle data (x) */
159 #define FLASH_TO_DATA(x) \
161 (((x) & 0x00010012) << 11) + \
162 (((x) & 0x00000008) << 10) + \
163 (((x) & 0x00040040) << 8) + \
164 (((x) & 0x00000001) << 4) + \
165 (((x) & 0x12200104) << 3) + \
166 (((x) & 0x08820020) << 2) + \
167 ((x) & 0x40000400) + \
168 (((x) & 0x00080080) >> 1) + \
169 (((x) & 0x01100000) >> 4) + \
170 (((x) & 0x04402000) >> 5) + \
171 (((x) & 0x20008200) >> 6) + \
172 (((x) & 0x80000800) >> 9) + \
173 (((x) & 0x00001000) >> 12) + \
174 (((x) & 0x00004000) >> 13) \
178 * The address line mapping on LART is as follows:
180 * U3 CPU | U2 CPU
181 * -------------------
182 * 0 2 | 0 2
183 * 1 3 | 1 3
184 * 2 9 | 2 9
185 * 3 13 | 3 8
186 * 4 8 | 4 7
187 * 5 12 | 5 6
188 * 6 11 | 6 5
189 * 7 10 | 7 4
190 * 8 4 | 8 10
191 * 9 5 | 9 11
192 * 10 6 | 10 12
193 * 11 7 | 11 13
195 * BOOT BLOCK BOUNDARY
197 * 12 15 | 12 15
198 * 13 14 | 13 14
199 * 14 16 | 14 16
201 * MAIN BLOCK BOUNDARY
203 * 15 17 | 15 18
204 * 16 18 | 16 17
205 * 17 20 | 17 20
206 * 18 19 | 18 19
207 * 19 21 | 19 21
209 * As we can see from above, the addresses aren't mangled across
210 * block boundaries, so we don't need to worry about address
211 * translations except for sending/reading commands during
212 * initialization
215 /* Mangle address (x) on chip U2 */
216 #define ADDR_TO_FLASH_U2(x) \
218 (((x) & 0x00000f00) >> 4) + \
219 (((x) & 0x00042000) << 1) + \
220 (((x) & 0x0009c003) << 2) + \
221 (((x) & 0x00021080) << 3) + \
222 (((x) & 0x00000010) << 4) + \
223 (((x) & 0x00000040) << 5) + \
224 (((x) & 0x00000024) << 7) + \
225 (((x) & 0x00000008) << 10) \
228 /* Unmangle address (x) on chip U2 */
229 #define FLASH_U2_TO_ADDR(x) \
231 (((x) << 4) & 0x00000f00) + \
232 (((x) >> 1) & 0x00042000) + \
233 (((x) >> 2) & 0x0009c003) + \
234 (((x) >> 3) & 0x00021080) + \
235 (((x) >> 4) & 0x00000010) + \
236 (((x) >> 5) & 0x00000040) + \
237 (((x) >> 7) & 0x00000024) + \
238 (((x) >> 10) & 0x00000008) \
241 /* Mangle address (x) on chip U3 */
242 #define ADDR_TO_FLASH_U3(x) \
244 (((x) & 0x00000080) >> 3) + \
245 (((x) & 0x00000040) >> 1) + \
246 (((x) & 0x00052020) << 1) + \
247 (((x) & 0x00084f03) << 2) + \
248 (((x) & 0x00029010) << 3) + \
249 (((x) & 0x00000008) << 5) + \
250 (((x) & 0x00000004) << 7) \
253 /* Unmangle address (x) on chip U3 */
254 #define FLASH_U3_TO_ADDR(x) \
256 (((x) << 3) & 0x00000080) + \
257 (((x) << 1) & 0x00000040) + \
258 (((x) >> 1) & 0x00052020) + \
259 (((x) >> 2) & 0x00084f03) + \
260 (((x) >> 3) & 0x00029010) + \
261 (((x) >> 5) & 0x00000008) + \
262 (((x) >> 7) & 0x00000004) \
265 /***************************************************************************************************/
267 static __u8 read8 (__u32 offset)
269 volatile __u8 *data = (__u8 *) (FLASH_OFFSET + offset);
270 #ifdef LART_DEBUG
271 printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.2x\n", __func__, offset, *data);
272 #endif
273 return (*data);
276 static __u32 read32 (__u32 offset)
278 volatile __u32 *data = (__u32 *) (FLASH_OFFSET + offset);
279 #ifdef LART_DEBUG
280 printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.8x\n", __func__, offset, *data);
281 #endif
282 return (*data);
285 static void write32 (__u32 x,__u32 offset)
287 volatile __u32 *data = (__u32 *) (FLASH_OFFSET + offset);
288 *data = x;
289 #ifdef LART_DEBUG
290 printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n", __func__, offset, *data);
291 #endif
294 /***************************************************************************************************/
297 * Probe for 16mbit flash memory on a LART board without doing
298 * too much damage. Since we need to write 1 dword to memory,
299 * we're f**cked if this happens to be DRAM since we can't
300 * restore the memory (otherwise we might exit Read Array mode).
302 * Returns 1 if we found 16mbit flash memory on LART, 0 otherwise.
304 static int flash_probe (void)
306 __u32 manufacturer,devtype;
308 /* setup "Read Identifier Codes" mode */
309 write32 (DATA_TO_FLASH (READ_ID_CODES),0x00000000);
311 /* probe U2. U2/U3 returns the same data since the first 3
312 * address lines is mangled in the same way */
313 manufacturer = FLASH_TO_DATA (read32 (ADDR_TO_FLASH_U2 (0x00000000)));
314 devtype = FLASH_TO_DATA (read32 (ADDR_TO_FLASH_U2 (0x00000001)));
316 /* put the flash back into command mode */
317 write32 (DATA_TO_FLASH (READ_ARRAY),0x00000000);
319 return (manufacturer == FLASH_MANUFACTURER && (devtype == FLASH_DEVICE_16mbit_TOP || devtype == FLASH_DEVICE_16mbit_BOTTOM));
323 * Erase one block of flash memory at offset ``offset'' which is any
324 * address within the block which should be erased.
326 * Returns 1 if successful, 0 otherwise.
328 static inline int erase_block (__u32 offset)
330 __u32 status;
332 #ifdef LART_DEBUG
333 printk (KERN_DEBUG "%s(): 0x%.8x\n", __func__, offset);
334 #endif
336 /* erase and confirm */
337 write32 (DATA_TO_FLASH (ERASE_SETUP),offset);
338 write32 (DATA_TO_FLASH (ERASE_CONFIRM),offset);
340 /* wait for block erase to finish */
343 write32 (DATA_TO_FLASH (STATUS_READ),offset);
344 status = FLASH_TO_DATA (read32 (offset));
346 while ((~status & STATUS_BUSY) != 0);
348 /* put the flash back into command mode */
349 write32 (DATA_TO_FLASH (READ_ARRAY),offset);
351 /* was the erase successful? */
352 if ((status & STATUS_ERASE_ERR))
354 printk (KERN_WARNING "%s: erase error at address 0x%.8x.\n",module_name,offset);
355 return (0);
358 return (1);
361 static int flash_erase (struct mtd_info *mtd,struct erase_info *instr)
363 __u32 addr,len;
364 int i,first;
366 #ifdef LART_DEBUG
367 printk (KERN_DEBUG "%s(addr = 0x%.8x, len = %d)\n", __func__, instr->addr, instr->len);
368 #endif
370 /* sanity checks */
371 if (instr->addr + instr->len > mtd->size) return (-EINVAL);
374 * check that both start and end of the requested erase are
375 * aligned with the erasesize at the appropriate addresses.
377 * skip all erase regions which are ended before the start of
378 * the requested erase. Actually, to save on the calculations,
379 * we skip to the first erase region which starts after the
380 * start of the requested erase, and then go back one.
382 for (i = 0; i < mtd->numeraseregions && instr->addr >= mtd->eraseregions[i].offset; i++) ;
383 i--;
386 * ok, now i is pointing at the erase region in which this
387 * erase request starts. Check the start of the requested
388 * erase range is aligned with the erase size which is in
389 * effect here.
391 if (i < 0 || (instr->addr & (mtd->eraseregions[i].erasesize - 1)))
392 return -EINVAL;
394 /* Remember the erase region we start on */
395 first = i;
398 * next, check that the end of the requested erase is aligned
399 * with the erase region at that address.
401 * as before, drop back one to point at the region in which
402 * the address actually falls
404 for (; i < mtd->numeraseregions && instr->addr + instr->len >= mtd->eraseregions[i].offset; i++) ;
405 i--;
407 /* is the end aligned on a block boundary? */
408 if (i < 0 || ((instr->addr + instr->len) & (mtd->eraseregions[i].erasesize - 1)))
409 return -EINVAL;
411 addr = instr->addr;
412 len = instr->len;
414 i = first;
416 /* now erase those blocks */
417 while (len)
419 if (!erase_block (addr))
421 instr->state = MTD_ERASE_FAILED;
422 return (-EIO);
425 addr += mtd->eraseregions[i].erasesize;
426 len -= mtd->eraseregions[i].erasesize;
428 if (addr == mtd->eraseregions[i].offset + (mtd->eraseregions[i].erasesize * mtd->eraseregions[i].numblocks)) i++;
431 instr->state = MTD_ERASE_DONE;
432 mtd_erase_callback(instr);
434 return (0);
437 static int flash_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retlen,u_char *buf)
439 #ifdef LART_DEBUG
440 printk (KERN_DEBUG "%s(from = 0x%.8x, len = %d)\n", __func__, (__u32)from, len);
441 #endif
443 /* sanity checks */
444 if (!len) return (0);
445 if (from + len > mtd->size) return (-EINVAL);
447 /* we always read len bytes */
448 *retlen = len;
450 /* first, we read bytes until we reach a dword boundary */
451 if (from & (BUSWIDTH - 1))
453 int gap = BUSWIDTH - (from & (BUSWIDTH - 1));
455 while (len && gap--) *buf++ = read8 (from++), len--;
458 /* now we read dwords until we reach a non-dword boundary */
459 while (len >= BUSWIDTH)
461 *((__u32 *) buf) = read32 (from);
463 buf += BUSWIDTH;
464 from += BUSWIDTH;
465 len -= BUSWIDTH;
468 /* top up the last unaligned bytes */
469 if (len & (BUSWIDTH - 1))
470 while (len--) *buf++ = read8 (from++);
472 return (0);
476 * Write one dword ``x'' to flash memory at offset ``offset''. ``offset''
477 * must be 32 bits, i.e. it must be on a dword boundary.
479 * Returns 1 if successful, 0 otherwise.
481 static inline int write_dword (__u32 offset,__u32 x)
483 __u32 status;
485 #ifdef LART_DEBUG
486 printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n", __func__, offset, x);
487 #endif
489 /* setup writing */
490 write32 (DATA_TO_FLASH (PGM_SETUP),offset);
492 /* write the data */
493 write32 (x,offset);
495 /* wait for the write to finish */
498 write32 (DATA_TO_FLASH (STATUS_READ),offset);
499 status = FLASH_TO_DATA (read32 (offset));
501 while ((~status & STATUS_BUSY) != 0);
503 /* put the flash back into command mode */
504 write32 (DATA_TO_FLASH (READ_ARRAY),offset);
506 /* was the write successful? */
507 if ((status & STATUS_PGM_ERR) || read32 (offset) != x)
509 printk (KERN_WARNING "%s: write error at address 0x%.8x.\n",module_name,offset);
510 return (0);
513 return (1);
516 static int flash_write (struct mtd_info *mtd,loff_t to,size_t len,size_t *retlen,const u_char *buf)
518 __u8 tmp[4];
519 int i,n;
521 #ifdef LART_DEBUG
522 printk (KERN_DEBUG "%s(to = 0x%.8x, len = %d)\n", __func__, (__u32)to, len);
523 #endif
525 *retlen = 0;
527 /* sanity checks */
528 if (!len) return (0);
529 if (to + len > mtd->size) return (-EINVAL);
531 /* first, we write a 0xFF.... padded byte until we reach a dword boundary */
532 if (to & (BUSWIDTH - 1))
534 __u32 aligned = to & ~(BUSWIDTH - 1);
535 int gap = to - aligned;
537 i = n = 0;
539 while (gap--) tmp[i++] = 0xFF;
540 while (len && i < BUSWIDTH) tmp[i++] = buf[n++], len--;
541 while (i < BUSWIDTH) tmp[i++] = 0xFF;
543 if (!write_dword (aligned,*((__u32 *) tmp))) return (-EIO);
545 to += n;
546 buf += n;
547 *retlen += n;
550 /* now we write dwords until we reach a non-dword boundary */
551 while (len >= BUSWIDTH)
553 if (!write_dword (to,*((__u32 *) buf))) return (-EIO);
555 to += BUSWIDTH;
556 buf += BUSWIDTH;
557 *retlen += BUSWIDTH;
558 len -= BUSWIDTH;
561 /* top up the last unaligned bytes, padded with 0xFF.... */
562 if (len & (BUSWIDTH - 1))
564 i = n = 0;
566 while (len--) tmp[i++] = buf[n++];
567 while (i < BUSWIDTH) tmp[i++] = 0xFF;
569 if (!write_dword (to,*((__u32 *) tmp))) return (-EIO);
571 *retlen += n;
574 return (0);
577 /***************************************************************************************************/
579 static struct mtd_info mtd;
581 static struct mtd_erase_region_info erase_regions[] = {
582 /* parameter blocks */
584 .offset = 0x00000000,
585 .erasesize = FLASH_BLOCKSIZE_PARAM,
586 .numblocks = FLASH_NUMBLOCKS_16m_PARAM,
588 /* main blocks */
590 .offset = FLASH_BLOCKSIZE_PARAM * FLASH_NUMBLOCKS_16m_PARAM,
591 .erasesize = FLASH_BLOCKSIZE_MAIN,
592 .numblocks = FLASH_NUMBLOCKS_16m_MAIN,
596 static struct mtd_partition lart_partitions[] = {
597 /* blob */
599 .name = "blob",
600 .offset = BLOB_START,
601 .size = BLOB_LEN,
603 /* kernel */
605 .name = "kernel",
606 .offset = KERNEL_START, /* MTDPART_OFS_APPEND */
607 .size = KERNEL_LEN,
609 /* initial ramdisk / file system */
611 .name = "file system",
612 .offset = INITRD_START, /* MTDPART_OFS_APPEND */
613 .size = INITRD_LEN, /* MTDPART_SIZ_FULL */
616 #define NUM_PARTITIONS ARRAY_SIZE(lart_partitions)
618 static int __init lart_flash_init (void)
620 int result;
621 memset (&mtd,0,sizeof (mtd));
622 printk ("MTD driver for LART. Written by Abraham vd Merwe <abraham@2d3d.co.za>\n");
623 printk ("%s: Probing for 28F160x3 flash on LART...\n",module_name);
624 if (!flash_probe ())
626 printk (KERN_WARNING "%s: Found no LART compatible flash device\n",module_name);
627 return (-ENXIO);
629 printk ("%s: This looks like a LART board to me.\n",module_name);
630 mtd.name = module_name;
631 mtd.type = MTD_NORFLASH;
632 mtd.writesize = 1;
633 mtd.writebufsize = 4;
634 mtd.flags = MTD_CAP_NORFLASH;
635 mtd.size = FLASH_BLOCKSIZE_PARAM * FLASH_NUMBLOCKS_16m_PARAM + FLASH_BLOCKSIZE_MAIN * FLASH_NUMBLOCKS_16m_MAIN;
636 mtd.erasesize = FLASH_BLOCKSIZE_MAIN;
637 mtd.numeraseregions = ARRAY_SIZE(erase_regions);
638 mtd.eraseregions = erase_regions;
639 mtd.erase = flash_erase;
640 mtd.read = flash_read;
641 mtd.write = flash_write;
642 mtd.owner = THIS_MODULE;
644 #ifdef LART_DEBUG
645 printk (KERN_DEBUG
646 "mtd.name = %s\n"
647 "mtd.size = 0x%.8x (%uM)\n"
648 "mtd.erasesize = 0x%.8x (%uK)\n"
649 "mtd.numeraseregions = %d\n",
650 mtd.name,
651 mtd.size,mtd.size / (1024*1024),
652 mtd.erasesize,mtd.erasesize / 1024,
653 mtd.numeraseregions);
655 if (mtd.numeraseregions)
656 for (result = 0; result < mtd.numeraseregions; result++)
657 printk (KERN_DEBUG
658 "\n\n"
659 "mtd.eraseregions[%d].offset = 0x%.8x\n"
660 "mtd.eraseregions[%d].erasesize = 0x%.8x (%uK)\n"
661 "mtd.eraseregions[%d].numblocks = %d\n",
662 result,mtd.eraseregions[result].offset,
663 result,mtd.eraseregions[result].erasesize,mtd.eraseregions[result].erasesize / 1024,
664 result,mtd.eraseregions[result].numblocks);
666 printk ("\npartitions = %d\n", ARRAY_SIZE(lart_partitions));
668 for (result = 0; result < ARRAY_SIZE(lart_partitions); result++)
669 printk (KERN_DEBUG
670 "\n\n"
671 "lart_partitions[%d].name = %s\n"
672 "lart_partitions[%d].offset = 0x%.8x\n"
673 "lart_partitions[%d].size = 0x%.8x (%uK)\n",
674 result,lart_partitions[result].name,
675 result,lart_partitions[result].offset,
676 result,lart_partitions[result].size,lart_partitions[result].size / 1024);
677 #endif
679 result = mtd_device_register(&mtd, lart_partitions,
680 ARRAY_SIZE(lart_partitions));
682 return (result);
685 static void __exit lart_flash_exit (void)
687 mtd_device_unregister(&mtd);
690 module_init (lart_flash_init);
691 module_exit (lart_flash_exit);
693 MODULE_LICENSE("GPL");
694 MODULE_AUTHOR("Abraham vd Merwe <abraham@2d3d.co.za>");
695 MODULE_DESCRIPTION("MTD driver for Intel 28F160F3 on LART board");