/*
   * drivers/sbus/char/jsflash.c
   *
   *  Copyright (C) 1991, 1992  Linus Torvalds	(drivers/char/mem.c)
   *  Copyright (C) 1997  Eddie C. Dost		(drivers/sbus/char/flash.c)
   *  Copyright (C) 1997-2000 Pavel Machek <pavel@ucw.cz>   (drivers/block/nbd.c)
   *  Copyright (C) 1999-2000 Pete Zaitcev
   *
   * This driver is used to program OS into a Flash SIMM on
   * Krups and Espresso platforms.
   *
   * TODO: do not allow erase/programming if file systems are mounted.
   * TODO: Erase/program both banks of a 8MB SIMM.
   *
   * It is anticipated that programming an OS Flash will be a routine
   * procedure. In the same time it is exceedingly dangerous because
   * a user can program its OBP flash with OS image and effectively
   * kill the machine.
   *
   * This driver uses an interface different from Eddie's flash.c
   * as a silly safeguard.
   *
   * XXX The flash.c manipulates page caching characteristics in a certain
   * dubious way; also it assumes that remap_pfn_range() can remap
   * PCI bus locations, which may be false. ioremap() must be used
   * instead. We should discuss this.
   */
  
  #include <linux/module.h>
  #include <linux/mutex.h>
  #include <linux/types.h>
  #include <linux/errno.h>
  #include <linux/miscdevice.h>
  #include <linux/fcntl.h>
  #include <linux/poll.h>
  #include <linux/init.h>
  #include <linux/string.h>
  #include <linux/genhd.h>
  #include <linux/blkdev.h>
  #include <asm/uaccess.h>
  #include <asm/pgtable.h>
  #include <asm/io.h>
  #include <asm/pcic.h>
  #include <asm/oplib.h>
  
  #include <asm/jsflash.h>		/* ioctl arguments. <linux/> ?? */
  #define JSFIDSZ		(sizeof(struct jsflash_ident_arg))
  #define JSFPRGSZ	(sizeof(struct jsflash_program_arg))
  
  /*
   * Our device numbers have no business in system headers.
   * The only thing a user knows is the device name /dev/jsflash.
   *
   * Block devices are laid out like this:
   *   minor+0	- Bootstrap, for 8MB SIMM 0x20400000[0x800000]
   *   minor+1	- Filesystem to mount, normally 0x20400400[0x7ffc00]
   *   minor+2	- Whole flash area for any case... 0x20000000[0x01000000]
   * Total 3 minors per flash device.
   *
   * It is easier to have static size vectors, so we define
   * a total minor range JSF_MAX, which must cover all minors.
   */
  /* character device */
  #define JSF_MINOR	178	/* 178 is registered with hpa */
  /* block device */
  #define JSF_MAX		 3	/* 3 minors wasted total so far. */
  #define JSF_NPART	 3	/* 3 minors per flash device */
  #define JSF_PART_BITS	 2	/* 2 bits of minors to cover JSF_NPART */
  #define JSF_PART_MASK	 0x3	/* 2 bits mask */
  
  static DEFINE_MUTEX(jsf_mutex);
  
  /*
   * Access functions.
   * We could ioremap(), but it's easier this way.
   */
  static unsigned int jsf_inl(unsigned long addr)
  {
  	unsigned long retval;
  
  	__asm__ __volatile__("lda [%1] %2, %0
  \t" :
  				"=r" (retval) :
  				"r" (addr), "i" (ASI_M_BYPASS));
          return retval;
  }
  
  static void jsf_outl(unsigned long addr, __u32 data)
  {
  
  	__asm__ __volatile__("sta %0, [%1] %2
  \t" : :
  				"r" (data), "r" (addr), "i" (ASI_M_BYPASS) :
  				"memory");
  }
  
  /*
   * soft carrier
   */
  
  struct jsfd_part {
  	unsigned long dbase;
  	unsigned long dsize;
  };
  
  struct jsflash {
  	unsigned long base;
  	unsigned long size;
  	unsigned long busy;		/* In use? */
  	struct jsflash_ident_arg id;
  	/* int mbase; */		/* Minor base, typically zero */
  	struct jsfd_part dv[JSF_NPART];
  };
  
  /*
   * We do not map normal memory or obio as a safety precaution.
   * But offsets are real, for ease of userland programming.
   */
  #define JSF_BASE_TOP	0x30000000
  #define JSF_BASE_ALL	0x20000000
  
  #define JSF_BASE_JK	0x20400000
  
  /*
   */
  static struct gendisk *jsfd_disk[JSF_MAX];
  
  /*
   * Let's pretend we may have several of these...
   */
  static struct jsflash jsf0;
  
  /*
   * Wait for AMD to finish its embedded algorithm.
   * We use the Toggle bit DQ6 (0x40) because it does not
   * depend on the data value as /DATA bit DQ7 does.
   *
   * XXX Do we need any timeout here? So far it never hanged, beware broken hw.
   */
  static void jsf_wait(unsigned long p) {
  	unsigned int x1, x2;
  
  	for (;;) {
  		x1 = jsf_inl(p);
  		x2 = jsf_inl(p);
  		if ((x1 & 0x40404040) == (x2 & 0x40404040)) return;
  	}
  }
  
  /*
   * Programming will only work if Flash is clean,
   * we leave it to the programmer application.
   *
   * AMD must be programmed one byte at a time;
   * thus, Simple Tech SIMM must be written 4 bytes at a time.
   *
   * Write waits for the chip to become ready after the write
   * was finished. This is done so that application would read
   * consistent data after the write is done.
   */
  static void jsf_write4(unsigned long fa, u32 data) {
  
  	jsf_outl(fa, 0xAAAAAAAA);		/* Unlock 1 Write 1 */
  	jsf_outl(fa, 0x55555555);		/* Unlock 1 Write 2 */
  	jsf_outl(fa, 0xA0A0A0A0);		/* Byte Program */
  	jsf_outl(fa, data);
  
  	jsf_wait(fa);
  }
  
  /*
   */
  static void jsfd_read(char *buf, unsigned long p, size_t togo) {
  	union byte4 {
  		char s[4];
  		unsigned int n;
  	} b;
  
  	while (togo >= 4) {
  		togo -= 4;
  		b.n = jsf_inl(p);
  		memcpy(buf, b.s, 4);
  		p += 4;
  		buf += 4;
  	}
  }
  
  static void jsfd_do_request(struct request_queue *q)
  {
  	struct request *req;
  
  	req = blk_fetch_request(q);
  	while (req) {
  		struct jsfd_part *jdp = req->rq_disk->private_data;
  		unsigned long offset = blk_rq_pos(req) << 9;
  		size_t len = blk_rq_cur_bytes(req);
  		int err = -EIO;
  
  		if ((offset + len) > jdp->dsize)
  			goto end;
  
  		if (rq_data_dir(req) != READ) {
  			printk(KERN_ERR "jsfd: write
  ");
  			goto end;
  		}
  
  		if ((jdp->dbase & 0xff000000) != 0x20000000) {
  			printk(KERN_ERR "jsfd: bad base %x
  ", (int)jdp->dbase);
  			goto end;
  		}
  
  		jsfd_read(req->buffer, jdp->dbase + offset, len);
  		err = 0;
  	end:
  		if (!__blk_end_request_cur(req, err))
  			req = blk_fetch_request(q);
  	}
  }
  
  /*
   * The memory devices use the full 32/64 bits of the offset, and so we cannot
   * check against negative addresses: they are ok. The return value is weird,
   * though, in that case (0).
   *
   * also note that seeking relative to the "end of file" isn't supported:
   * it has no meaning, so it returns -EINVAL.
   */
  static loff_t jsf_lseek(struct file * file, loff_t offset, int orig)
  {
  	loff_t ret;
  
  	mutex_lock(&jsf_mutex);
  	switch (orig) {
  		case 0:
  			file->f_pos = offset;
  			ret = file->f_pos;
  			break;
  		case 1:
  			file->f_pos += offset;
  			ret = file->f_pos;
  			break;
  		default:
  			ret = -EINVAL;
  	}
  	mutex_unlock(&jsf_mutex);
  	return ret;
  }
  
  /*
   * OS SIMM Cannot be read in other size but a 32bits word.
   */
  static ssize_t jsf_read(struct file * file, char __user * buf, 
      size_t togo, loff_t *ppos)
  {
  	unsigned long p = *ppos;
  	char __user *tmp = buf;
  
  	union byte4 {
  		char s[4];
  		unsigned int n;
  	} b;
  
  	if (p < JSF_BASE_ALL || p >= JSF_BASE_TOP) {
  		return 0;
  	}
  
  	if ((p + togo) < p	/* wrap */
  	   || (p + togo) >= JSF_BASE_TOP) {
  		togo = JSF_BASE_TOP - p;
  	}
  
  	if (p < JSF_BASE_ALL && togo != 0) {
  #if 0 /* __bzero XXX */
  		size_t x = JSF_BASE_ALL - p;
  		if (x > togo) x = togo;
  		clear_user(tmp, x);
  		tmp += x;
  		p += x;
  		togo -= x;
  #else
  		/*
  		 * Implementation of clear_user() calls __bzero
  		 * without regard to modversions,
  		 * so we cannot build a module.
  		 */
  		return 0;
  #endif
  	}
  
  	while (togo >= 4) {
  		togo -= 4;
  		b.n = jsf_inl(p);
  		if (copy_to_user(tmp, b.s, 4))
  			return -EFAULT;
  		tmp += 4;
  		p += 4;
  	}
  
  	/*
  	 * XXX Small togo may remain if 1 byte is ordered.
  	 * It would be nice if we did a word size read and unpacked it.
  	 */
  
  	*ppos = p;
  	return tmp-buf;
  }
  
  static ssize_t jsf_write(struct file * file, const char __user * buf,
      size_t count, loff_t *ppos)
  {
  	return -ENOSPC;
  }
  
  /*
   */
  static int jsf_ioctl_erase(unsigned long arg)
  {
  	unsigned long p;
  
  	/* p = jsf0.base;	hits wrong bank */
  	p = 0x20400000;
  
  	jsf_outl(p, 0xAAAAAAAA);		/* Unlock 1 Write 1 */
  	jsf_outl(p, 0x55555555);		/* Unlock 1 Write 2 */
  	jsf_outl(p, 0x80808080);		/* Erase setup */
  	jsf_outl(p, 0xAAAAAAAA);		/* Unlock 2 Write 1 */
  	jsf_outl(p, 0x55555555);		/* Unlock 2 Write 2 */
  	jsf_outl(p, 0x10101010);		/* Chip erase */
  
  #if 0
  	/*
  	 * This code is ok, except that counter based timeout
  	 * has no place in this world. Let's just drop timeouts...
  	 */
  	{
  		int i;
  		__u32 x;
  		for (i = 0; i < 1000000; i++) {
  			x = jsf_inl(p);
  			if ((x & 0x80808080) == 0x80808080) break;
  		}
  		if ((x & 0x80808080) != 0x80808080) {
  			printk("jsf0: erase timeout with 0x%08x
  ", x);
  		} else {
  			printk("jsf0: erase done with 0x%08x
  ", x);
  		}
  	}
  #else
  	jsf_wait(p);
  #endif
  
  	return 0;
  }
  
  /*
   * Program a block of flash.
   * Very simple because we can do it byte by byte anyway.
   */
  static int jsf_ioctl_program(void __user *arg)
  {
  	struct jsflash_program_arg abuf;
  	char __user *uptr;
  	unsigned long p;
  	unsigned int togo;
  	union {
  		unsigned int n;
  		char s[4];
  	} b;
  
  	if (copy_from_user(&abuf, arg, JSFPRGSZ))
  		return -EFAULT; 
  	p = abuf.off;
  	togo = abuf.size;
  	if ((togo & 3) || (p & 3)) return -EINVAL;
  
  	uptr = (char __user *) (unsigned long) abuf.data;
  	while (togo != 0) {
  		togo -= 4;
  		if (copy_from_user(&b.s[0], uptr, 4))
  			return -EFAULT;
  		jsf_write4(p, b.n);
  		p += 4;
  		uptr += 4;
  	}
  
  	return 0;
  }
  
  static long jsf_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
  {
  	mutex_lock(&jsf_mutex);
  	int error = -ENOTTY;
  	void __user *argp = (void __user *)arg;
  
  	if (!capable(CAP_SYS_ADMIN)) {
  		mutex_unlock(&jsf_mutex);
  		return -EPERM;
  	}
  	switch (cmd) {
  	case JSFLASH_IDENT:
  		if (copy_to_user(argp, &jsf0.id, JSFIDSZ)) {
  			mutex_unlock(&jsf_mutex);
  			return -EFAULT;
  		}
  		break;
  	case JSFLASH_ERASE:
  		error = jsf_ioctl_erase(arg);
  		break;
  	case JSFLASH_PROGRAM:
  		error = jsf_ioctl_program(argp);
  		break;
  	}
  
  	mutex_unlock(&jsf_mutex);
  	return error;
  }
  
  static int jsf_mmap(struct file * file, struct vm_area_struct * vma)
  {
  	return -ENXIO;
  }
  
  static int jsf_open(struct inode * inode, struct file * filp)
  {
  	mutex_lock(&jsf_mutex);
  	if (jsf0.base == 0) {
  		mutex_unlock(&jsf_mutex);
  		return -ENXIO;
  	}
  	if (test_and_set_bit(0, (void *)&jsf0.busy) != 0) {
  		mutex_unlock(&jsf_mutex);
  		return -EBUSY;
  	}
  
  	mutex_unlock(&jsf_mutex);
  	return 0;	/* XXX What security? */
  }
  
  static int jsf_release(struct inode *inode, struct file *file)
  {
  	jsf0.busy = 0;
  	return 0;
  }
  
  static const struct file_operations jsf_fops = {
  	.owner =	THIS_MODULE,
  	.llseek =	jsf_lseek,
  	.read =		jsf_read,
  	.write =	jsf_write,
  	.unlocked_ioctl =	jsf_ioctl,
  	.mmap =		jsf_mmap,
  	.open =		jsf_open,
  	.release =	jsf_release,
  };
  
  static struct miscdevice jsf_dev = { JSF_MINOR, "jsflash", &jsf_fops };
  
  static const struct block_device_operations jsfd_fops = {
  	.owner =	THIS_MODULE,
  };
  
  static int jsflash_init(void)
  {
  	int rc;
  	struct jsflash *jsf;
  	phandle node;
  	char banner[128];
  	struct linux_prom_registers reg0;
  
  	node = prom_getchild(prom_root_node);
  	node = prom_searchsiblings(node, "flash-memory");
  	if (node != 0 && (s32)node != -1) {
  		if (prom_getproperty(node, "reg",
  		    (char *)&reg0, sizeof(reg0)) == -1) {
  			printk("jsflash: no \"reg\" property
  ");
  			return -ENXIO;
  		}
  		if (reg0.which_io != 0) {
  			printk("jsflash: bus number nonzero: 0x%x:%x
  ",
  			    reg0.which_io, reg0.phys_addr);
  			return -ENXIO;
  		}
  		/*
  		 * Flash may be somewhere else, for instance on Ebus.
  		 * So, don't do the following check for IIep flash space.
  		 */
  #if 0
  		if ((reg0.phys_addr >> 24) != 0x20) {
  			printk("jsflash: suspicious address: 0x%x:%x
  ",
  			    reg0.which_io, reg0.phys_addr);
  			return -ENXIO;
  		}
  #endif
  		if ((int)reg0.reg_size <= 0) {
  			printk("jsflash: bad size 0x%x
  ", (int)reg0.reg_size);
  			return -ENXIO;
  		}
  	} else {
  		/* XXX Remove this code once PROLL ID12 got widespread */
  		printk("jsflash: no /flash-memory node, use PROLL >= 12
  ");
  		prom_getproperty(prom_root_node, "banner-name", banner, 128);
  		if (strcmp (banner, "JavaStation-NC") != 0 &&
  		    strcmp (banner, "JavaStation-E") != 0) {
  			return -ENXIO;
  		}
  		reg0.which_io = 0;
  		reg0.phys_addr = 0x20400000;
  		reg0.reg_size  = 0x00800000;
  	}
  
  	/* Let us be really paranoid for modifications to probing code. */
  	if (sparc_cpu_model != sun4m) {
  		/* We must be on sun4m because we use MMU Bypass ASI. */
  		return -ENXIO;
  	}
  
  	if (jsf0.base == 0) {
  		jsf = &jsf0;
  
  		jsf->base = reg0.phys_addr;
  		jsf->size = reg0.reg_size;
  
  		/* XXX Redo the userland interface. */
  		jsf->id.off = JSF_BASE_ALL;
  		jsf->id.size = 0x01000000;	/* 16M - all segments */
  		strcpy(jsf->id.name, "Krups_all");
  
  		jsf->dv[0].dbase = jsf->base;
  		jsf->dv[0].dsize = jsf->size;
  		jsf->dv[1].dbase = jsf->base + 1024;
  		jsf->dv[1].dsize = jsf->size - 1024;
  		jsf->dv[2].dbase = JSF_BASE_ALL;
  		jsf->dv[2].dsize = 0x01000000;
  
  		printk("Espresso Flash @0x%lx [%d MB]
  ", jsf->base,
  		    (int) (jsf->size / (1024*1024)));
  	}
  
  	if ((rc = misc_register(&jsf_dev)) != 0) {
  		printk(KERN_ERR "jsf: unable to get misc minor %d
  ",
  		    JSF_MINOR);
  		jsf0.base = 0;
  		return rc;
  	}
  
  	return 0;
  }
  
  static struct request_queue *jsf_queue;
  
  static int jsfd_init(void)
  {
  	static DEFINE_SPINLOCK(lock);
  	struct jsflash *jsf;
  	struct jsfd_part *jdp;
  	int err;
  	int i;
  
  	if (jsf0.base == 0)
  		return -ENXIO;
  
  	err = -ENOMEM;
  	for (i = 0; i < JSF_MAX; i++) {
  		struct gendisk *disk = alloc_disk(1);
  		if (!disk)
  			goto out;
  		jsfd_disk[i] = disk;
  	}
  
  	if (register_blkdev(JSFD_MAJOR, "jsfd")) {
  		err = -EIO;
  		goto out;
  	}
  
  	jsf_queue = blk_init_queue(jsfd_do_request, &lock);
  	if (!jsf_queue) {
  		err = -ENOMEM;
  		unregister_blkdev(JSFD_MAJOR, "jsfd");
  		goto out;
  	}
  
  	for (i = 0; i < JSF_MAX; i++) {
  		struct gendisk *disk = jsfd_disk[i];
  		if ((i & JSF_PART_MASK) >= JSF_NPART) continue;
  		jsf = &jsf0;	/* actually, &jsfv[i >> JSF_PART_BITS] */
  		jdp = &jsf->dv[i&JSF_PART_MASK];
  
  		disk->major = JSFD_MAJOR;
  		disk->first_minor = i;
  		sprintf(disk->disk_name, "jsfd%d", i);
  		disk->fops = &jsfd_fops;
  		set_capacity(disk, jdp->dsize >> 9);
  		disk->private_data = jdp;
  		disk->queue = jsf_queue;
  		add_disk(disk);
  		set_disk_ro(disk, 1);
  	}
  	return 0;
  out:
  	while (i--)
  		put_disk(jsfd_disk[i]);
  	return err;
  }
  
  MODULE_LICENSE("GPL");
  
  static int __init jsflash_init_module(void) {
  	int rc;
  
  	if ((rc = jsflash_init()) == 0) {
  		jsfd_init();
  		return 0;
  	}
  	return rc;
  }
  
  static void __exit jsflash_cleanup_module(void)
  {
  	int i;
  
  	for (i = 0; i < JSF_MAX; i++) {
  		if ((i & JSF_PART_MASK) >= JSF_NPART) continue;
  		del_gendisk(jsfd_disk[i]);
  		put_disk(jsfd_disk[i]);
  	}
  	if (jsf0.busy)
  		printk("jsf0: cleaning busy unit
  ");
  	jsf0.base = 0;
  	jsf0.busy = 0;
  
  	misc_deregister(&jsf_dev);
  	unregister_blkdev(JSFD_MAJOR, "jsfd");
  	blk_cleanup_queue(jsf_queue);
  }
  
  module_init(jsflash_init_module);
  module_exit(jsflash_cleanup_module);