branch Attitude Adjustment

git-svn-id: svn://svn.openwrt.org/openwrt/branches/attitude_adjustment@33625 3c298f89-4303-0410-b956-a3cf2f4a3e73

3 files changed, 3271 insertions, 0 deletions

diff --git a/target/linux/ubicom32/files/drivers/mtd/devices/nand-spi-er.c b/target/linux/ubicom32/files/drivers/mtd/devices/nand-spi-er.c
new file mode 100644
index 000000000..73938c882
--- /dev/null
+++ b/target/linux/ubicom32/files/drivers/mtd/devices/nand-spi-er.c
@@ -0,0 +1,1017 @@
+/*
+ * Micron SPI-ER NAND Flash Memory
+ *
+ * (C) Copyright 2009, Ubicom, Inc.
+ *
+ * This file is part of the Ubicom32 Linux Kernel Port.
+ *
+ * The Ubicom32 Linux Kernel Port is free software: you can redistribute
+ * it and/or modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * The Ubicom32 Linux Kernel Port is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ * the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with the Ubicom32 Linux Kernel Port.  If not,
+ * see <http://www.gnu.org/licenses/>.
+*/
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/mutex.h>
+#include <linux/err.h>
+
+#include <linux/spi/spi.h>
+#include <linux/spi/flash.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+
+#define NAND_SPI_ER_BLOCK_FROM_ROW(row)		(row >> 6)
+
+#define NAND_SPI_ER_STATUS_P_FAIL		(1 << 3)
+#define NAND_SPI_ER_STATUS_E_FAIL		(1 << 2)
+#define NAND_SPI_ER_STATUS_OIP			(1 << 0)
+
+#define NAND_SPI_ER_LAST_ROW_INVALID		0xFFFFFFFF
+#define	NAND_SPI_ER_BAD_BLOCK_MARK_OFFSET	0x08
+
+struct nand_spi_er_device {
+	const char		*name;
+
+	uint8_t			id0;
+	uint8_t			id1;
+
+	unsigned int		blocks;
+	unsigned int		pages_per_block;
+	unsigned int		page_size;
+	unsigned int		write_size;
+	unsigned int		erase_size;
+};
+
+struct nand_spi_er {
+	char				name[24];
+
+	const struct nand_spi_er_device	*device;
+
+	struct mutex			lock;
+	struct spi_device		*spi;
+
+	struct mtd_info			mtd;
+
+	unsigned int			last_row;	/* the last row we fetched */
+
+	/*
+	 * Bad block table (MUST be last in strcuture)
+	 */
+	unsigned long			nbb;
+	unsigned long			bbt[0];
+};
+
+const struct nand_spi_er_device nand_spi_er_devices[] = {
+	{
+		name:			"MT29F1G01ZDC",
+		id0:			0x2C,
+		id1:			0x12,
+		blocks:			1024,
+		pages_per_block:	64,
+		page_size:		2048,
+		write_size:		512,
+		erase_size:		64 * 2048,
+	},
+	{
+		name:			"MT29F1G01ZDC",
+		id0:			0x2C,
+		id1:			0x13,
+		blocks:			1024,
+		pages_per_block:	64,
+		page_size:		2048,
+		write_size:		512,
+		erase_size:		64 * 2048,
+	},
+};
+
+static int read_only = 0;
+module_param(read_only, int, 0);
+MODULE_PARM_DESC(read_only, "Leave device locked");
+
+/*
+ * nand_spi_er_get_feature
+ *	Get Feature register
+ */
+static int nand_spi_er_get_feature(struct nand_spi_er *chip, int reg, uint8_t *data)
+{
+	uint8_t txbuf[2];
+	uint8_t rxbuf[1];
+	int res;
+
+	txbuf[0] = 0x0F;
+	txbuf[1] = reg;
+	res = spi_write_then_read(chip->spi, txbuf, 2, rxbuf, 1);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed get feature res=%d\n", chip->name, res);
+		return res;
+	}
+	*data = rxbuf[0];
+	return 0;
+}
+
+/*
+ * nand_spi_er_busywait
+ *	Wait until the chip is not busy
+ */
+static int nand_spi_er_busywait(struct nand_spi_er *chip, uint8_t *data)
+{
+	int i;
+
+	for (i = 0; i < 100; i++) {
+		int res = nand_spi_er_get_feature(chip, 0xC0, data);
+		if (res) {
+			return res;
+		}
+		if (!(*data & NAND_SPI_ER_STATUS_OIP)) {
+			break;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * nand_spi_er_erase
+ *	Erase a block, parameters must be block aligned
+ */
+static int nand_spi_er_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+	struct nand_spi_er *chip = mtd->priv;
+	struct spi_device *spi = chip->spi;
+	uint8_t txbuf[4];
+	int res;
+
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: erase addr:%x len:%x\n", chip->name, instr->addr, instr->len);
+
+	if ((instr->addr + instr->len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	if (instr->addr & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: erase address is not aligned %x\n", chip->name, instr->addr);
+		return -EINVAL;
+	}
+
+	if (instr->len & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: erase len is not aligned %x\n", chip->name, instr->len);
+		return -EINVAL;
+	}
+
+	mutex_lock(&chip->lock);
+	chip->last_row = NAND_SPI_ER_LAST_ROW_INVALID;
+
+	while (instr->len) {
+		uint32_t block = instr->addr >> 17;
+		uint32_t row = block << 6;
+		uint8_t stat;
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: block erase row:%x block:%x addr:%x rem:%x\n", chip->name, row, block, instr->addr, instr->len);
+
+		/*
+		 * Write enable
+		 */
+		txbuf[0] = 0x06;
+		res = spi_write(spi, txbuf, 1);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write enable res=%d\n", chip->name, res);
+			mutex_unlock(&chip->lock);
+			return res;
+		}
+
+		/*
+		 * Test for bad block
+		 */
+		if (test_bit(block, chip->bbt)) {
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			res = -EBADMSG;
+			goto done;
+		}
+
+		/*
+		 * Block erase
+		 */
+		txbuf[0] = 0xD8;
+		txbuf[1] = 0x00;
+		txbuf[2] = row >> 8;
+		txbuf[3] = row & 0xFF;
+		res = spi_write(spi, txbuf, 4);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed block erase res=%d\n", chip->name, res);
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			goto done;
+		}
+
+		/*
+		 * Wait
+		 */
+		res = nand_spi_er_busywait(chip, &stat);
+		if (res || (stat & NAND_SPI_ER_STATUS_OIP)) {
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive res=%d stat=%02x\n", chip->name, res, stat);
+			if (res) {
+				goto done;
+			}
+
+			/*
+			 * Chip is stuck?
+			 */
+			res = -EIO;
+			goto done;
+		}
+
+		/*
+		 * Check the status register
+		 */
+		if (stat & NAND_SPI_ER_STATUS_E_FAIL) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: E_FAIL signalled (%02x)\n", chip->name, stat);
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			goto done;
+		}
+
+		/*
+		 * Next
+		 */
+		block++;
+		instr->len -= chip->device->erase_size;
+		instr->addr += chip->device->erase_size;
+	}
+
+	instr->state = MTD_ERASE_DONE;
+
+	mutex_unlock(&chip->lock);
+	return 0;
+
+done:
+	/*
+	 * Write disable
+	 */
+	txbuf[0] = 0x04;
+	res = spi_write(spi, txbuf, 1);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write disable res=%d\n", chip->name, res);
+	}
+
+	mutex_unlock(&chip->lock);
+
+	mtd_erase_callback(instr);
+	return 0;
+}
+
+/*
+ * nand_spi_er_read
+ *
+ * return -EUCLEAN: ecc error recovered
+ * return -EBADMSG: ecc error not recovered
+*/
+static int nand_spi_er_read(struct mtd_info *mtd, loff_t from, size_t len,
+			       size_t *retlen, u_char *buf)
+{
+	struct nand_spi_er *chip = mtd->priv;
+	struct spi_device *spi = chip->spi;
+
+	uint32_t row;
+	uint32_t column;
+	int retval = 0;
+
+	*retlen = 0;
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: read block from %llx len %d into %p\n", chip->name, from, len, buf);
+
+	/*
+	 * Zero length reads, nothing to do
+	 */
+	if (len == 0) {
+		return 0;
+	}
+
+	/*
+	 * Reject reads which go over the end of the flash
+	 */
+	if ((from + len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	/*
+	 * Get the row and column address to start at
+	 */
+	row = from >> 11;
+	column = from & 0x7FF;
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: row=%x %d column=%x %d last_row=%x %d\n", chip->name, row, row, column, column, chip->last_row, chip->last_row);
+
+	/*
+	 * Read the data from the chip
+	 */
+	mutex_lock(&chip->lock);
+	while (len) {
+		uint8_t stat;
+		uint8_t txbuf[4];
+		struct spi_message message;
+		struct spi_transfer x[2];
+		int res;
+		size_t toread;
+
+		/*
+		 * Figure out how much to read
+		 *
+		 * If we are reading from the middle of a page then the most we
+		 * can read is to the end of the page
+		 */
+		toread = len;
+		if (toread > (chip->device->page_size - column)) {
+			toread = chip->device->page_size - column;
+		}
+
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: buf=%p toread=%x row=%x column=%x last_row=%x\n", chip->name, buf, toread, row, column, chip->last_row);
+
+		if (chip->last_row != row) {
+			/*
+			 * Check if the block is bad
+			 */
+			if (test_bit(NAND_SPI_ER_BLOCK_FROM_ROW(row), chip->bbt)) {
+				mutex_unlock(&chip->lock);
+				return -EBADMSG;
+			}
+
+			/*
+			 * Load the appropriate page
+			 */
+			txbuf[0] = 0x13;
+			txbuf[1] = 0x00;
+			txbuf[2] = row >> 8;
+			txbuf[3] = row & 0xFF;
+			res = spi_write(spi, txbuf, 4);
+			if (res) {
+				DEBUG(MTD_DEBUG_LEVEL1, "%s: failed page load res=%d\n", chip->name, res);
+				mutex_unlock(&chip->lock);
+				return res;
+			}
+
+			/*
+			 * Wait
+			 */
+			res = nand_spi_er_busywait(chip, &stat);
+			if (res || (stat & NAND_SPI_ER_STATUS_OIP)) {
+				DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive res=%d stat=%02x\n", chip->name, res, stat);
+				if (res) {
+					mutex_unlock(&chip->lock);
+					return res;
+				}
+
+				/*
+				 * Chip is stuck?
+				 */
+				mutex_unlock(&chip->lock);
+				return -EIO;
+			}
+
+			/*
+			 * Check the ECC bits
+			 */
+			stat >>= 4;
+			if (stat == 1) {
+				DEBUG(MTD_DEBUG_LEVEL1, "%s: ECC recovered, row=%x\n", chip->name, row);
+				retval = -EUCLEAN;
+			}
+			if (stat == 2) {
+				DEBUG(MTD_DEBUG_LEVEL0, "%s: failed ECC, row=%x\n", chip->name, row);
+				chip->last_row = NAND_SPI_ER_LAST_ROW_INVALID;
+				mutex_unlock(&chip->lock);
+				return -EBADMSG;
+			}
+
+		}
+
+		chip->last_row = row;
+
+		/*
+		 * Read out the data
+		 */
+		spi_message_init(&message);
+		memset(x, 0, sizeof(x));
+
+		txbuf[0] = 0x03;
+		txbuf[1] = column >> 8;
+		txbuf[2] = column & 0xFF;
+		txbuf[3] = 0;
+		x[0].tx_buf = txbuf;
+		x[0].len = 4;
+		spi_message_add_tail(&x[0], &message);
+
+		x[1].rx_buf = buf;
+		x[1].len = toread;
+		spi_message_add_tail(&x[1], &message);
+
+		res = spi_sync(spi, &message);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed data read res=%d\n", chip->name, res);
+			mutex_unlock(&chip->lock);
+			return res;
+		}
+		buf += toread;
+		len -= toread;
+		*retlen += toread;
+
+		/*
+		 * For the next page, increment the row and always start at column 0
+		 */
+		column = 0;
+		row++;
+	}
+
+	mutex_unlock(&chip->lock);
+	return retval;
+}
+
+/*
+ * nand_spi_er_write
+ */
+#define NOT_ALIGNED(x) ((x & (device->write_size - 1)) != 0)
+static int nand_spi_er_write(struct mtd_info *mtd, loff_t to, size_t len,
+				size_t *retlen, const u_char *buf)
+{
+	struct nand_spi_er *chip = mtd->priv;
+	struct spi_device *spi = chip->spi;
+	const struct nand_spi_er_device *device = chip->device;
+	uint32_t row;
+	uint32_t col;
+	uint8_t txbuf[4];
+	int res;
+	size_t towrite;
+
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: write block to %llx len %d from %p\n", chip->name, to, len, buf);
+
+	*retlen = 0;
+
+	/*
+	 * nothing to write
+	 */
+	if (!len) {
+		return 0;
+	}
+
+	/*
+	 * Reject writes which go over the end of the flash
+	 */
+	if ((to + len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	/*
+	 * Check to see if everything is page aligned
+	 */
+	if (NOT_ALIGNED(to) || NOT_ALIGNED(len)) {
+		printk(KERN_NOTICE "nand_spi_er_write: Attempt to write non page aligned data\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&chip->lock);
+	chip->last_row = NAND_SPI_ER_LAST_ROW_INVALID;
+
+	/*
+	 * If the first write is a partial write then write at most the number of
+	 * bytes to get us page aligned and then the remainder will be
+	 * page aligned.  The last bit may be a partial page as well.
+	 */
+	col = to & (device->page_size - 1);
+	towrite = device->page_size - col;
+	if (towrite > len) {
+		towrite = len;
+	}
+
+	/*
+	 * Write the data
+	 */
+	row = to >> 11;
+	while (len) {
+		struct spi_message message;
+		struct spi_transfer x[2];
+		uint8_t stat;
+
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: write %p to row:%x col:%x len:%x rem:%x\n", chip->name, buf, row, col, towrite, len);
+
+		/*
+		 * Write enable
+		 */
+		txbuf[0] = 0x06;
+		res = spi_write(spi, txbuf, 1);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write enable res=%d\n", chip->name, res);
+			mutex_unlock(&chip->lock);
+			return res;
+		}
+
+		/*
+		 * Write the data into the cache
+		 */
+		spi_message_init(&message);
+		memset(x, 0, sizeof(x));
+		txbuf[0] = 0x02;
+		txbuf[1] = col >> 8;
+		txbuf[2] = col & 0xFF;
+		x[0].tx_buf = txbuf;
+		x[0].len = 3;
+		spi_message_add_tail(&x[0], &message);
+		x[1].tx_buf = buf;
+		x[1].len = towrite;
+		spi_message_add_tail(&x[1], &message);
+		res = spi_sync(spi, &message);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed cache write res=%d\n", chip->name, res);
+			goto done;
+		}
+
+		/*
+		 * Program execute
+		 */
+		txbuf[0] = 0x10;
+		txbuf[1] = 0x00;
+		txbuf[2] = row >> 8;
+		txbuf[3] = row & 0xFF;
+		res = spi_write(spi, txbuf, 4);
+		if (res) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: failed prog execute res=%d\n", chip->name, res);
+			goto done;
+		}
+
+		/*
+		 * Wait
+		 */
+		res = nand_spi_er_busywait(chip, &stat);
+		if (res || (stat & NAND_SPI_ER_STATUS_OIP)) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive res=%d stat=%02x\n", chip->name, res, stat);
+			if (res) {
+				goto done;
+			}
+
+			/*
+			 * Chip is stuck?
+			 */
+			res = -EIO;
+			goto done;
+		}
+
+		if (stat & (1 << 3)) {
+			res = -EBADMSG;
+			goto done;
+		}
+
+		row++;
+		buf += towrite;
+		len -= towrite;
+		*retlen += towrite;
+
+		/*
+		 * At this point, we are always page aligned so start at column 0.
+		 * Note we may not have a full page to write at the end, hence the
+		 * check if towrite > len.
+		 */
+		col = 0;
+		towrite = device->page_size;
+		if (towrite > len) {
+			towrite = len;
+		}
+	}
+
+	mutex_unlock(&chip->lock);
+	return res;
+
+done:
+	/*
+	 * Write disable
+	 */
+	txbuf[0] = 0x04;
+	res = spi_write(spi, txbuf, 1);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write disable res=%d\n", chip->name, res);
+	}
+
+	mutex_unlock(&chip->lock);
+
+	return res;
+}
+
+/*
+ * nand_spi_er_isbad
+ */
+static int nand_spi_er_isbad(struct mtd_info *mtd, loff_t ofs)
+{
+	struct nand_spi_er *chip = mtd->priv;
+	uint32_t block;
+
+	if (ofs & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: address not aligned %llx\n", chip->name, ofs);
+		return -EINVAL;
+	}
+
+	block = ofs >> 17;
+
+	return test_bit(block, chip->bbt);
+}
+
+/*
+ * nand_spi_er_markbad
+ */
+static int nand_spi_er_markbad(struct mtd_info *mtd, loff_t ofs)
+{
+	struct nand_spi_er *chip = mtd->priv;
+	struct spi_device *spi = chip->spi;
+	uint32_t block;
+	uint32_t row;
+	uint8_t txbuf[7];
+	int res;
+	uint8_t stat;
+
+	if (ofs & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: address not aligned %llx\n", chip->name, ofs);
+		return -EINVAL;
+	}
+
+	block = ofs >> 17;
+
+	/*
+	 * If it's already marked bad, no need to mark it
+	 */
+	if (test_bit(block, chip->bbt)) {
+		return 0;
+	}
+
+	/*
+	 * Mark it in our cache
+	 */
+	__set_bit(block, chip->bbt);
+
+	/*
+	 * Write the user bad block mark.  If it fails, then we really
+	 * can't do anything about it.
+	 */
+	mutex_lock(&chip->lock);
+	chip->last_row = NAND_SPI_ER_LAST_ROW_INVALID;
+
+	/*
+	 * Write enable
+	 */
+	txbuf[0] = 0x06;
+	res = spi_write(spi, txbuf, 1);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write enable res=%d\n", chip->name, res);
+		mutex_unlock(&chip->lock);
+		return res;
+	}
+
+	/*
+	 * Write the mark
+	 */
+	txbuf[0] = 0x84;
+	txbuf[1] = 0x08;
+	txbuf[2] = NAND_SPI_ER_BAD_BLOCK_MARK_OFFSET;
+	txbuf[3] = 0xde;
+	txbuf[4] = 0xad;
+	txbuf[5] = 0xbe;
+	txbuf[6] = 0xef;
+	res = spi_write(spi, txbuf, 7);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write mark res=%d\n", chip->name, res);
+		goto done;
+	}
+
+	/*
+	 * Program execute
+	 */
+	row = ofs >> 11;
+	txbuf[0] = 0x10;
+	txbuf[1] = 0x00;
+	txbuf[2] = row >> 8;
+	txbuf[3] = row & 0xFF;
+	res = spi_write(spi, txbuf, 4);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed program execute res=%d\n", chip->name, res);
+		goto done;
+	}
+
+	/*
+	 * Wait
+	 */
+	res = nand_spi_er_busywait(chip, &stat);
+	if (res || (stat & NAND_SPI_ER_STATUS_OIP)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive res=%d stat=%02x\n", chip->name, res, stat);
+		if (res) {
+			goto done;
+		}
+
+		/*
+		 * Chip is stuck?
+		 */
+		res = -EIO;
+		goto done;
+	}
+
+	if (stat & (1 << 3)) {
+		res = -EBADMSG;
+	}
+
+done:
+	/*
+	 * Write disable
+	 */
+	txbuf[0] = 0x04;
+	res = spi_write(spi, txbuf, 1);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed write disable res=%d\n", chip->name, res);
+	}
+
+	mutex_unlock(&chip->lock);
+
+	return res;
+}
+
+/*
+ * nand_spi_er_read_bbt
+ */
+static int nand_spi_er_read_bbt(struct nand_spi_er *chip)
+{
+	int j;
+	for (j = 0; j < chip->device->blocks; j++) {
+		uint8_t txbuf[4];
+		uint8_t rxbuf[16];
+		uint32_t bbmark;
+		int res;
+		unsigned short row = j << 6;
+		uint8_t stat;
+
+		/*
+		 * Read Page
+		 */
+		txbuf[0] = 0x13;
+		txbuf[1] = 0x00;
+		txbuf[2] = row >> 8;
+		txbuf[3] = row & 0xFF;
+		res = spi_write(chip->spi, txbuf, 4);
+		if (res) {
+			return res;
+		}
+
+		/*
+		 * Wait
+		 */
+		res = nand_spi_er_busywait(chip, &stat);
+		if (res || (stat & NAND_SPI_ER_STATUS_OIP)) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive res=%d stat=%02x\n", chip->name, res, stat);
+			if (res) {
+				return res;
+			}
+
+			/*
+			 * Chip is stuck?
+			 */
+			return -EIO;
+		}
+
+		/*
+		 * Check factory bad block mark
+		 */
+		txbuf[0] = 0x03;
+		txbuf[1] = 0x08;
+		txbuf[2] = 0x00;
+		txbuf[3] = 0x00;
+		res = spi_write_then_read(chip->spi, txbuf, 4, rxbuf, 16);
+		if (res) {
+			return res;
+		}
+		if (rxbuf[0] != 0xFF) {
+			chip->nbb++;
+			__set_bit(j, chip->bbt);
+			continue;
+		}
+
+		memcpy(&bbmark, &rxbuf[8], 4);
+		if (bbmark == 0xdeadbeef) {
+			chip->nbb++;
+			__set_bit(j, chip->bbt);
+		}
+	}
+
+#if defined(CONFIG_MTD_DEBUG) && (MTD_DEBUG_LEVEL3 <= CONFIG_MTD_DEBUG_VERBOSE)
+	printk("%s: Bad Block Table:", chip->name);
+	for (j = 0; j < chip->device->blocks; j++) {
+		if ((j % 64) == 0) {
+			printk("\n%s: block %03x: ", chip->name, j);
+		}
+		printk("%c", test_bit(j, chip->bbt) ? 'X' : '.');
+	}
+	printk("\n%s: Bad Block Numbers: ", chip->name);
+	for (j = 0; j < chip->device->blocks; j++) {
+		if (test_bit(j, chip->bbt)) {
+			printk("%x ", j);
+		}
+	}
+	printk("\n");
+#endif
+
+	return 0;
+}
+
+#ifndef MODULE
+/*
+ * Called at boot time:
+ *
+ * nand_spi_er=read_only
+ *	if read_only specified then do not unlock device
+ */
+static int __init nand_spi_er_setup(char *str)
+{
+	if (str && (strncasecmp(str, "read_only", 9) == 0)) {
+		read_only = 1;
+	}
+	return 0;
+}
+
+__setup("nand_spi_er=", nand_spi_er_setup);
+#endif
+
+/*
+ * nand_spi_er_probe
+ *	Detect and initialize nand_spi_er device.
+ */
+static int __devinit nand_spi_er_probe(struct spi_device *spi)
+{
+	uint8_t txbuf[3];
+	uint8_t rxbuf[2];
+	int i;
+	int res;
+	size_t bbt_bytes;
+	struct nand_spi_er *chip;
+	const struct nand_spi_er_device *device;
+
+	res = spi_setup(spi);
+	if (res) {
+		return res;
+	}
+
+	/*
+	 * Reset
+	 */
+	for (i = 0; i < 2; i++) {
+		txbuf[0] = 0xFF;
+		res = spi_write(spi, txbuf, 1);
+		if (res) {
+			return res;
+		}
+		udelay(250);
+	}
+	udelay(1000);
+
+	/*
+	 * Read ID
+	 */
+	txbuf[0] = 0x9F;
+	txbuf[1] = 0x00;
+	res = spi_write_then_read(spi, txbuf, 2, rxbuf, 2);
+	if (res) {
+		return res;
+	}
+
+	device = nand_spi_er_devices;
+	for (i = 0; i < ARRAY_SIZE(nand_spi_er_devices); i++) {
+		if ((device->id0 == rxbuf[0]) && (device->id1 == rxbuf[1])) {
+			break;
+		}
+		device++;
+	}
+	if (i == ARRAY_SIZE(nand_spi_er_devices)) {
+		return -ENODEV;
+	}
+
+	/*
+	 * Initialize our chip structure
+	 */
+	bbt_bytes = DIV_ROUND_UP(device->blocks, BITS_PER_BYTE);
+	chip = kzalloc(sizeof(struct nand_spi_er) + bbt_bytes, GFP_KERNEL);
+	if (!chip) {
+		return -ENOMEM;
+	}
+	snprintf(chip->name, sizeof(chip->name), "%s.%d.%d", device->name, spi->master->bus_num, spi->chip_select);
+
+	chip->spi = spi;
+	chip->device = device;
+	chip->last_row = NAND_SPI_ER_LAST_ROW_INVALID;
+
+	mutex_init(&chip->lock);
+
+	chip->mtd.type = MTD_NANDFLASH;
+	chip->mtd.flags = MTD_WRITEABLE;
+
+	/*
+	 * #blocks * block size * n blocks
+	 */
+	chip->mtd.size = device->blocks * device->pages_per_block * device->page_size;
+	chip->mtd.erasesize = device->erase_size;
+
+	/*
+	 * 1 page, optionally we can support partial write (512)
+	 */
+	chip->mtd.writesize = device->write_size;
+	chip->mtd.name = device->name;
+	chip->mtd.erase = nand_spi_er_erase;
+	chip->mtd.read = nand_spi_er_read;
+	chip->mtd.write = nand_spi_er_write;
+	chip->mtd.block_isbad = nand_spi_er_isbad;
+	chip->mtd.block_markbad = nand_spi_er_markbad;
+	chip->mtd.priv = chip;
+
+	/*
+	 * Cache the bad block table
+	 */
+	res = nand_spi_er_read_bbt(chip);
+	if (res) {
+		kfree(chip);
+		return res;
+	}
+
+	/*
+	 * Un/lock the chip
+	 */
+	txbuf[0] = 0x1F;
+	txbuf[1] = 0xA0;
+	if (read_only) {
+		txbuf[2] = 0x38;
+	} else {
+		txbuf[2] = 0x00;
+	}
+	res = spi_write(spi, txbuf, 3);
+	if (res) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: failed lock operation res=%d\n", chip->name, res);
+		mutex_unlock(&chip->lock);
+		return res;
+	}
+
+	spi_set_drvdata(spi, chip);
+
+	printk(KERN_INFO "%s: added device %s size: %u KBytes %u bad blocks %s\n", spi->dev.bus_id, chip->mtd.name, DIV_ROUND_UP(chip->mtd.size, 1024), chip->nbb, read_only ? "[read only]" : "");
+	return add_mtd_device(&chip->mtd);
+}
+
+/*
+ * nand_spi_er_remove
+ */
+static int __devexit nand_spi_er_remove(struct spi_device *spi)
+{
+	struct nand_spi_er *chip = spi_get_drvdata(spi);
+	int status = 0;
+
+	DEBUG(MTD_DEBUG_LEVEL1, "%s: remove\n", spi->dev.bus_id);
+	status = del_mtd_device(&chip->mtd);
+	if (status == 0)
+		kfree(chip);
+	return status;
+}
+
+static struct spi_driver nand_spi_er_driver = {
+	.driver = {
+		.name		= "nand-spi-er",
+		.bus		= &spi_bus_type,
+		.owner		= THIS_MODULE,
+	},
+
+	.probe		= nand_spi_er_probe,
+	.remove		= __devexit_p(nand_spi_er_remove),
+
+	/* FIXME:  investigate suspend and resume... */
+};
+
+/*
+ * nand_spi_er_init
+ */
+static int __init nand_spi_er_init(void)
+{
+	return spi_register_driver(&nand_spi_er_driver);
+}
+module_init(nand_spi_er_init);
+
+/*
+ * nand_spi_er_exit
+ */
+static void __exit nand_spi_er_exit(void)
+{
+	spi_unregister_driver(&nand_spi_er_driver);
+}
+module_exit(nand_spi_er_exit);
+
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick Tjin");
+MODULE_DESCRIPTION("MTD nand_spi_er driver");
diff --git a/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-m25p80.c b/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-m25p80.c
new file mode 100644
index 000000000..405491cc4
--- /dev/null
+++ b/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-m25p80.c
@@ -0,0 +1,1066 @@
+/*
+ * drivers/mtd/devices/ubi32-m25p80.c
+ *   NOR flash driver, Ubicom processor internal SPI flash interface.
+ *
+ *   This code instantiates the serial flash that contains the
+ *   original bootcode.  The serial flash start at address 0x60000000
+ *   in both Ubicom32V3 and Ubicom32V4 ISAs.
+ *
+ *   This piece of flash is made to appear as a Memory Technology
+ *   Device (MTD) with this driver to allow Read/Write/Erase operations.
+ *
+ * (C) Copyright 2009, Ubicom, Inc.
+ *
+ * This file is part of the Ubicom32 Linux Kernel Port.
+ *
+ * The Ubicom32 Linux Kernel Port is free software: you can redistribute
+ * it and/or modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * The Ubicom32 Linux Kernel Port is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ * the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with the Ubicom32 Linux Kernel Port.  If not,
+ * see <http://www.gnu.org/licenses/>.
+ *
+ * Ubicom32 implementation derived from (with many thanks):
+ *   arch/m68knommu
+ *   arch/blackfin
+ *   arch/parisc
+ */
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/physmap.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/flash.h>
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/mutex.h>
+
+#include <asm/ip5000.h>
+#include <asm/devtree.h>
+
+#define UBICOM32_FLASH_BASE	0x60000000
+#define UBICOM32_FLASH_MAX_SIZE 0x01000000
+#define UBICOM32_FLASH_START	0x00000000
+#define UBICOM32_KERNEL_OFFSET	0x00010000 /* The kernel starts after Ubicom
+					    * .protect section. */
+
+static struct mtd_partition ubicom32_flash_partitions[] = {
+	{
+		.name	= "Bootloader",		/* Protected Section
+						 * Partition */
+		.size	= 0x10000,
+		.offset	= UBICOM32_FLASH_START,
+//		.mask_flags = MTD_WRITEABLE	/* Mark Read-only */
+	},
+	{
+		.name	= "Kernel",		/* Kernel Partition. */
+		.size	= 0,			/* this will be set up during
+						 * probe stage. At that time we
+						 * will know end of linux image
+						 * in flash. */
+		.offset	= MTDPART_OFS_APPEND,	/* Starts right after Protected
+						 * section. */
+//		.mask_flags = MTD_WRITEABLE	/* Mark Read-only */
+	},
+	{
+		.name	= "Rest",		/* Rest of the flash. */
+		.size	= 0x200000,		/* Use up what remains in the
+						 * flash. */
+		.offset	= MTDPART_OFS_NXTBLK,	/* Starts right after Protected
+						 * section. */
+	}
+};
+
+static struct flash_platform_data ubicom32_flash_data = {
+	.name = "ubicom32_boot_flash",
+	.parts = ubicom32_flash_partitions,
+	.nr_parts = ARRAY_SIZE(ubicom32_flash_partitions),
+};
+
+static struct resource ubicom32_flash_resource[] = {
+	{
+		.start	= UBICOM32_FLASH_BASE,
+		.end	= UBICOM32_FLASH_BASE +
+		UBICOM32_FLASH_MAX_SIZE - 1,
+		.flags	= IORESOURCE_MEM,
+	},
+};
+
+static struct platform_device ubicom32_flash_device = {
+	.name = "ubicom32flashdriver",
+	.id = 0, /* Bus number */
+	.num_resources = ARRAY_SIZE(ubicom32_flash_resource),
+	.resource = ubicom32_flash_resource,
+	.dev = {
+		.platform_data = &ubicom32_flash_data,
+	},
+};
+
+static struct platform_device *ubicom32_flash_devices[] = {
+	&ubicom32_flash_device,
+};
+
+static int __init ubicom32_flash_init(void)
+{
+	printk(KERN_INFO "%s(): registering device resources\n",
+	       __FUNCTION__);
+	platform_add_devices(ubicom32_flash_devices,
+			     ARRAY_SIZE(ubicom32_flash_devices));
+	return 0;
+}
+
+arch_initcall(ubicom32_flash_init);
+
+/*
+ * MTD SPI driver for ST M25Pxx (and similar) serial flash chips through
+ * Ubicom32 SPI controller.
+ *
+ * Author: Mike Lavender, mike@steroidmicros.com
+ *
+ * Copyright (c) 2005, Intec Automation Inc.
+ *
+ * Some parts are based on lart.c by Abraham Van Der Merwe
+ *
+ * Cleaned up and generalized based on mtd_dataflash.c
+ *
+ * This code is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#define FLASH_PAGESIZE		256
+
+/* Flash opcodes. */
+#define	OPCODE_WREN		0x06	/* Write enable */
+#define	OPCODE_RDSR		0x05	/* Read status register */
+#define	OPCODE_READ		0x03	/* Read data bytes (low frequency) */
+#define	OPCODE_FAST_READ	0x0b	/* Read data bytes (high frequency) */
+#define	OPCODE_PP		0x02	/* Page program (up to 256 bytes) */
+#define	OPCODE_BE_4K		0x20	/* Erase 4KiB block */
+#define	OPCODE_BE_32K		0x52	/* Erase 32KiB block */
+#define	OPCODE_SE		0xd8	/* Sector erase (usually 64KiB) */
+#define	OPCODE_RDID		0x9f	/* Read JEDEC ID */
+
+/* Status Register bits. */
+#define	SR_WIP			1	/* Write in progress */
+#define	SR_WEL			2	/* Write enable latch */
+/* meaning of other SR_* bits may differ between vendors */
+#define	SR_BP0			4	/* Block protect 0 */
+#define	SR_BP1			8	/* Block protect 1 */
+#define	SR_BP2			0x10	/* Block protect 2 */
+#define	SR_SRWD			0x80	/* SR write protect */
+
+/* Define max times to check status register before we give up. */
+#define	MAX_READY_WAIT_COUNT	100000
+
+
+#ifdef CONFIG_MTD_PARTITIONS
+#define	mtd_has_partitions()	(1)
+#else
+#define	mtd_has_partitions()	(0)
+#endif
+
+/*
+ * Ubicom32 FLASH Command Set
+ */
+#define FLASH_FC_INST_CMD	0x00	/* for SPI command only transaction */
+#define FLASH_FC_INST_WR	0x01	/* for SPI write transaction */
+#define FLASH_FC_INST_RD	0x02	/* for SPI read transaction */
+
+#define ALIGN_DOWN(v, a) ((v) & ~((a) - 1))
+#define ALIGN_UP(v, a) (((v) + ((a) - 1)) & ~((a) - 1))
+
+#define	FLASH_COMMAND_KICK_OFF(io)							\
+	asm volatile(									\
+	"	bset	"D(IO_INT_CLR)"(%0), #0, #%%bit("D(IO_XFL_INT_DONE)")	\n\t"	\
+	"	jmpt.t	.+4							\n\t"	\
+	"	bset	"D(IO_INT_SET)"(%0), #0, #%%bit("D(IO_XFL_INT_START)")	\n\t"	\
+		:									\
+		: "a" (io)								\
+		: "memory", "cc"							\
+	);
+
+#define	FLASH_COMMAND_WAIT_FOR_COMPLETION(io)						\
+	asm volatile(									\
+	"	btst	"D(IO_INT_STATUS)"(%0), #%%bit("D(IO_XFL_INT_DONE)")	\n\t"	\
+	"	jmpeq.f	.-4							\n\t"	\
+		:									\
+		: "a" (io)								\
+		: "memory", "cc"									\
+	);
+
+#define	FLASH_COMMAND_EXEC(io)								\
+	FLASH_COMMAND_KICK_OFF(io)							\
+	FLASH_COMMAND_WAIT_FOR_COMPLETION(io)
+
+
+#define OSC1_FREQ 12000000
+#define TEN_MICRO_SECONDS (OSC1_FREQ * 10 / 1000000)
+
+/*
+ * We will have to eventually replace this null definition with the real thing.
+ */
+#define WATCHDOG_RESET()
+
+#define EXTFLASH_WRITE_FIFO_SIZE 32
+#define EXTFLASH_WRITE_BLOCK_SIZE EXTFLASH_WRITE_FIFO_SIZE /* limit the size to
+							    * FIFO capacity, so
+							    * the thread can be
+							    * suspended. */
+
+#define JFFS2_FILESYSTEM_SIZE 0x100000
+
+/****************************************************************************/
+
+struct m25p {
+	struct platform_device	*plt_dev;
+	struct mutex		lock;
+	struct mtd_info		mtd;
+	unsigned		partitioned:1;
+	u8			erase_opcode;
+	u8			command[4];
+};
+
+static inline struct m25p *mtd_to_m25p(struct mtd_info *mtd)
+{
+	return container_of(mtd, struct m25p, mtd);
+}
+
+/****************************************************************************/
+
+/*
+ * Internal helper functions
+ */
+
+/*
+ * Read the status register, returning its value in the location
+ * Return the status register value.
+ * Returns negative if error occurred.
+ */
+static int read_sr(struct m25p *flash)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) |
+		IO_XFL_CTL1_FC_DATA(1);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_RDSR);
+	FLASH_COMMAND_EXEC(io);
+
+	return io->status1 & 0xff;
+}
+
+/*
+ * mem_flash_io_read_u32()
+ */
+static u32 mem_flash_io_read_u32(u32 addr)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) |
+		IO_XFL_CTL1_FC_DATA(4) | IO_XFL_CTL1_FC_DUMMY(1) |
+		IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_FAST_READ) |
+		IO_XFL_CTL2_FC_ADDR(addr);
+	FLASH_COMMAND_EXEC(io);
+	return io->status1;
+}
+
+/*
+ * mem_flash_read_u8()
+ */
+static u8 mem_flash_read_u8(u32 addr)
+{
+	u32 tmp_addr = ALIGN_DOWN(addr, 4);
+	u32 tmp_data = mem_flash_io_read_u32(tmp_addr);
+	u8 *ptr = (u8 *)&tmp_data;
+	return ptr[addr & 0x3];
+}
+
+/*
+ * mem_flash_read()
+ *	No need to lock as read is implemented with ireads (same as normal flash
+ *	execution).
+ */
+static void mem_flash_read(u32 addr, void *dst, size_t length)
+{
+	/*
+	 * Range check
+	 */
+	/*
+	 * Fix source alignment.
+	 */
+	while (addr & 0x03) {
+		if (length == 0) {
+			return;
+		}
+		*((u8 *)dst) = mem_flash_read_u8(addr++);
+		dst++;
+		length--;
+	}
+
+	while (length >= 4) {
+		u32 tmp_data = mem_flash_io_read_u32(addr);
+		addr += 4;
+		length -= 4;
+
+		/*
+		 * Send the data to the destination.
+		 */
+		memcpy((void *)dst, (void *)&tmp_data, 4);
+		dst += 4;
+	}
+
+	while (length--) {
+		*((u8 *)dst) = mem_flash_read_u8(addr++);
+		dst++;
+	}
+}
+
+/*
+ * mem_flash_wait_until_complete()
+ */
+static void mem_flash_wait_until_complete(void)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+
+	do {
+		/*
+		 * Put a delay here to deal with flash programming problem.
+		 */
+		u32 mptval = UBICOM32_IO_TIMER->mptval + TEN_MICRO_SECONDS;
+		while (UBICOM32_IO_TIMER->mptval < mptval)
+			;
+
+		io->ctl1 &= ~IO_XFL_CTL1_MASK;
+		io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) |
+			IO_XFL_CTL1_FC_DATA(1);
+		io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_RDSR);
+		FLASH_COMMAND_EXEC(io);
+	} while (io->status1 & SR_WIP);
+}
+
+/*
+ * mem_flash_write_next()
+ */
+static size_t mem_flash_write_next(u32 addr, u8 *buf, size_t length)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+	u32 data_start = addr;
+	u32 data_end = addr + length;
+	size_t count;
+	u32 i, j;
+
+	/*
+	 * Top limit address.
+	 */
+	u32 block_start = ALIGN_DOWN(data_start, 4);
+	u32 block_end = block_start + EXTFLASH_WRITE_BLOCK_SIZE;
+
+	union {
+		u8 byte[EXTFLASH_WRITE_BLOCK_SIZE];
+		u32 word[EXTFLASH_WRITE_BLOCK_SIZE / 4];
+	} write_buf;
+
+	u32 *flash_addr = (u32 *)block_start;
+
+	/*
+	 * The write block must be limited by FLASH internal buffer.
+	 */
+	u32 block_end_align = ALIGN_DOWN(block_end, 256);
+	bool write_needed;
+
+	block_end = (block_end_align > block_start)
+		? block_end_align : block_end;
+	data_end = (data_end <= block_end) ? data_end : block_end;
+	block_end = ALIGN_UP(data_end, 4);
+	count = data_end - data_start;
+
+	/*
+	 * Transfer data to a buffer.
+	 */
+	for (i = 0; i < (block_end - block_start) / 4; i++) {
+		/*
+		 * The FLASH read can hold D-cache for a long time.
+		 * Use I/O operation to read FLASH to avoid starving other
+		 * threads, especially HRT.  (Do this for application only)
+		 */
+		write_buf.word[i] = mem_flash_io_read_u32(
+			(u32)(&flash_addr[i]));
+	}
+
+	write_needed = false;
+	for (i = 0, j = (data_start - block_start);
+	     i < (data_end - data_start); i++, j++) {
+		write_needed = write_needed || (write_buf.byte[j] != buf[i]);
+		write_buf.byte[j] &= buf[i];
+	}
+
+
+	/*
+	 * If the data in FLASH is identical to what to be written. Then skip
+	 * it.
+	 */
+	if (write_needed) {
+		/*
+		 * Write to flash.
+		 */
+		void *tmp __attribute__((unused));
+		s32 extra_words;
+
+		asm volatile(
+		"	move.4	%0, %2									\n\t"
+		"	bset	"D(IO_INT_SET)"(%1), #0, #%%bit("D(IO_PORTX_INT_FIFO_TX_RESET)")	\n\t"
+		"	pipe_flush 0									\n\t"
+		"	.rept	"D(EXTFLASH_WRITE_FIFO_SIZE / 4)"					\n\t"
+		"	move.4	"D(IO_TX_FIFO)"(%1), (%0)4++						\n\t"
+		"	.endr										\n\t"
+			: "=&a" (tmp)
+			: "a" (io), "r" (&write_buf.word[0])
+			: "memory", "cc"
+		);
+
+		/* Lock FLASH for write access. */
+		io->ctl0 |= IO_XFL_CTL0_MCB_LOCK;
+
+		/* Command: WREN */
+		io->ctl1 &= ~IO_XFL_CTL1_MASK;
+		io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD);
+		io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_WREN);
+		FLASH_COMMAND_EXEC(io);
+
+		/* Command: BYTE PROGRAM */
+		io->ctl1 &= ~IO_XFL_CTL1_MASK;
+		io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_WR) |
+			IO_XFL_CTL1_FC_DATA(block_end - block_start) |
+			IO_XFL_CTL1_FC_ADDR;
+		io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_PP) |
+			IO_XFL_CTL2_FC_ADDR(block_start);
+		FLASH_COMMAND_KICK_OFF(io);
+
+		extra_words = (s32)(block_end - block_start -
+				    EXTFLASH_WRITE_FIFO_SIZE) / 4;
+		if (extra_words > 0) {
+			asm volatile(
+			"	move.4		%0, %3				\n\t"
+			"1:	cmpi		"D(IO_FIFO_LEVEL)"(%1), #4	\n\t"
+			"	jmpgt.s.t	1b				\n\t"
+			"	move.4		"D(IO_TX_FIFO)"(%1), (%0)4++	\n\t"
+			"	add.4		%2, #-1, %2			\n\t"
+			"	jmpgt.t		1b				\n\t"
+				: "=&a" (tmp)
+				: "a" (io), "d" (extra_words),
+				  "r" (&write_buf.word[EXTFLASH_WRITE_FIFO_SIZE / 4])
+				: "memory", "cc"
+			);
+		}
+		FLASH_COMMAND_WAIT_FOR_COMPLETION(io);
+
+		mem_flash_wait_until_complete();
+
+
+		/* Unlock FLASH for cache access. */
+		io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+	}
+
+	/*
+	 * Complete.
+	 */
+	return count;
+}
+
+/*
+ * mem_flash_write()
+ */
+static void mem_flash_write(u32 addr, const void *src, size_t length)
+{
+	/*
+	 * Write data
+	 */
+	u8_t *ptr = (u8_t *)src;
+	while (length) {
+		size_t count = mem_flash_write_next(addr, ptr, length);
+		addr += count;
+		ptr += count;
+		length -= count;
+	}
+}
+
+/*
+ * Service routine to read status register until ready, or timeout occurs.
+ * Returns non-zero if error.
+ */
+static int wait_till_ready(struct m25p *flash)
+{
+	int count;
+	int sr;
+
+	/* one chip guarantees max 5 msec wait here after page writes,
+	 * but potentially three seconds (!) after page erase.
+	 */
+	for (count = 0; count < MAX_READY_WAIT_COUNT; count++) {
+		u32 mptval;
+		sr = read_sr(flash);
+		if (sr < 0)
+			break;
+		else if (!(sr & SR_WIP))
+			return 0;
+
+		/*
+		 * Put a 10us delay here to deal with flash programming problem.
+		 */
+		mptval = UBICOM32_IO_TIMER->mptval + TEN_MICRO_SECONDS;
+		while ((s32)(mptval - UBICOM32_IO_TIMER->mptval) > 0) {
+			WATCHDOG_RESET();
+		}
+		/* REVISIT sometimes sleeping would be best */
+	}
+
+	return 1;
+}
+
+/*
+ * mem_flash_erase_page()
+ */
+static void mem_flash_erase_page(u32 addr)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+
+	/* Lock FLASH for write access. */
+	io->ctl0 |= IO_XFL_CTL0_MCB_LOCK;
+
+	/* Command: WREN */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_WREN);
+	FLASH_COMMAND_EXEC(io);
+
+	/* Command: ERASE */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD) |
+		IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_SE) |
+		IO_XFL_CTL2_FC_ADDR(addr);
+	FLASH_COMMAND_EXEC(io);
+
+	mem_flash_wait_until_complete();
+
+	/* Unlock FLASH for cache access. */
+	io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+}
+
+/*
+ * mem_flash_erase()
+ */
+static u32 mem_flash_erase(u32 addr, u32 length)
+{
+	/*
+	 * Calculate the endaddress to be the first address of the page
+	 * just beyond this erase section of pages.
+	 */
+	u32 endaddr = addr + length;
+
+	/*
+	 * Erase.
+	 */
+	while (addr < endaddr) {
+		u32 test_addr = addr;
+		mem_flash_erase_page(addr);
+
+		/*
+		 * Test how much was erased as actual flash page at this address
+		 * may be smaller than the expected page size.
+		 */
+		while (test_addr < endaddr) {
+			/*
+			 * The FLASH read can hold D-cache for a long time.  Use
+			 * I/O operation to read FLASH to avoid starving other
+			 * threads, especially HRT.  (Do this for application
+			 * only)
+			 */
+			if (mem_flash_io_read_u32(test_addr) != 0xFFFFFFFF) {
+				break;
+			}
+			test_addr += 4;
+		}
+		if (test_addr == addr) {
+			printk("erase failed at address 0x%x, skipping",
+			       test_addr);
+			test_addr += 4;
+			return 1;
+		}
+		addr = test_addr;
+	}
+	return 0;
+}
+
+
+/****************************************************************************/
+
+/*
+ * MTD implementation
+ */
+
+/*
+ * Erase an address range on the flash chip.  The address range may extend
+ * one or more erase sectors.  Return an error is there is a problem erasing.
+ */
+static int ubicom32_flash_driver_erase(struct mtd_info *mtd,
+				       struct erase_info *instr)
+{
+	struct m25p *flash = mtd_to_m25p(mtd);
+	u32 addr, len;
+
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %lld\n",
+	      dev_name(&flash->plt_dev->dev), __FUNCTION__, "at",
+	      (u32)instr->addr, instr->len);
+
+	/* sanity checks */
+	if (instr->addr + instr->len > flash->mtd.size)
+		return -EINVAL;
+	if ((instr->addr % mtd->erasesize) != 0
+			|| (instr->len % mtd->erasesize) != 0) {
+		return -EINVAL;
+	}
+
+	addr = instr->addr + UBICOM32_FLASH_BASE;
+	len = instr->len;
+
+	mutex_lock(&flash->lock);
+
+	/* REVISIT in some cases we could speed up erasing large regions
+	 * by using OPCODE_SE instead of OPCODE_BE_4K
+	 */
+
+	/* now erase those sectors */
+	if (mem_flash_erase(addr, len)) {
+		instr->state = MTD_ERASE_FAILED;
+		mutex_unlock(&flash->lock);
+		return -EIO;
+	}
+
+	mutex_unlock(&flash->lock);
+	instr->state = MTD_ERASE_DONE;
+	mtd_erase_callback(instr);
+	return 0;
+}
+
+/*
+ * Read an address range from the flash chip.  The address range
+ * may be any size provided it is within the physical boundaries.
+ */
+static int ubicom32_flash_driver_read(struct mtd_info *mtd, loff_t from,
+				      size_t len, size_t *retlen, u_char *buf)
+{
+	struct m25p *flash = mtd_to_m25p(mtd);
+	u32 base_addr = UBICOM32_FLASH_BASE + from;
+
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %d\n",
+	      dev_name(&flash->plt_dev->dev), __FUNCTION__, "from",
+	      (u32)from, len);
+
+	/* sanity checks */
+	if (!len)
+		return 0;
+
+	if (from + len > flash->mtd.size)
+		return -EINVAL;
+
+	/* Byte count starts at zero. */
+	if (retlen)
+		*retlen = 0;
+
+	mutex_lock(&flash->lock);
+
+	/* Wait till previous write/erase is done. */
+	if (wait_till_ready(flash)) {
+		/* REVISIT status return?? */
+		mutex_unlock(&flash->lock);
+		return 1;
+	}
+
+	mem_flash_read(base_addr, (void *)buf, len);
+
+	if (retlen)
+		*retlen = len;
+
+	mutex_unlock(&flash->lock);
+
+	return 0;
+}
+
+/*
+ * Write an address range to the flash chip.  Data must be written in
+ * FLASH_PAGESIZE chunks.  The address range may be any size provided
+ * it is within the physical boundaries.
+ */
+static int ubicom32_flash_driver_write(struct mtd_info *mtd, loff_t to,
+				       size_t len, size_t *retlen,
+				       const u_char *buf)
+{
+	struct m25p *flash = mtd_to_m25p(mtd);
+	u32 base_addr = UBICOM32_FLASH_BASE + to;
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %d\n",
+	      dev_name(&flash->plt_dev->dev), __FUNCTION__, "to",
+	      (u32)to, len);
+
+	if (retlen)
+		*retlen = 0;
+
+	/* sanity checks */
+	if (!len)
+		return 0;
+
+	if (to + len > flash->mtd.size)
+		return -EINVAL;
+
+	mutex_lock(&flash->lock);
+
+	mem_flash_write(base_addr, (void *) buf, len);
+
+	/* Wait until finished previous write command. */
+	if (wait_till_ready(flash)) {
+		mutex_unlock(&flash->lock);
+		return 1;
+	}
+
+	if (retlen)
+		*retlen = len;
+
+	mutex_unlock(&flash->lock);
+	return 0;
+}
+
+
+/****************************************************************************/
+
+/*
+ * SPI device driver setup and teardown
+ */
+
+struct flash_info {
+	char		*name;
+
+	/* JEDEC id zero means "no ID" (most older chips); otherwise it has
+	 * a high byte of zero plus three data bytes: the manufacturer id,
+	 * then a two byte device id.
+	 */
+	u32		jedec_id;
+
+	/* The size listed here is what works with OPCODE_SE, which isn't
+	 * necessarily called a "sector" by the vendor.
+	 */
+	unsigned	sector_size;
+	u16		n_sectors;
+
+	u16		flags;
+#define	SECT_4K		0x01		/* OPCODE_BE_4K works uniformly */
+};
+
+
+/* NOTE: double check command sets and memory organization when you add
+ * more flash chips.  This current list focusses on newer chips, which
+ * have been converging on command sets which including JEDEC ID.
+ */
+static struct flash_info __devinitdata m25p_data[] = {
+
+	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
+	{ "at25fs010",  0x1f6601, 32 * 1024, 4, SECT_4K, },
+	{ "at25fs040",  0x1f6604, 64 * 1024, 8, SECT_4K, },
+
+	{ "at25df041a", 0x1f4401, 64 * 1024, 8, SECT_4K, },
+
+	{ "at26f004",   0x1f0400, 64 * 1024, 8, SECT_4K, },
+	{ "at26df081a", 0x1f4501, 64 * 1024, 16, SECT_4K, },
+	{ "at26df161a", 0x1f4601, 64 * 1024, 32, SECT_4K, },
+	{ "at26df321",  0x1f4701, 64 * 1024, 64, SECT_4K, },
+
+	/* Spansion -- single (large) sector size only, at least
+	 * for the chips listed here (without boot sectors).
+	 */
+	{ "s25sl004a", 0x010212, 64 * 1024, 8, },
+	{ "s25sl008a", 0x010213, 64 * 1024, 16, },
+	{ "s25sl016a", 0x010214, 64 * 1024, 32, },
+	{ "s25sl032a", 0x010215, 64 * 1024, 64, },
+	{ "s25sl064a", 0x010216, 64 * 1024, 128, },
+
+	/* SST -- large erase sizes are "overlays", "sectors" are 4K */
+	{ "sst25vf040b", 0xbf258d, 64 * 1024, 8, SECT_4K, },
+	{ "sst25vf080b", 0xbf258e, 64 * 1024, 16, SECT_4K, },
+	{ "sst25vf016b", 0xbf2541, 64 * 1024, 32, SECT_4K, },
+	{ "sst25vf032b", 0xbf254a, 64 * 1024, 64, SECT_4K, },
+
+	/* ST Microelectronics -- newer production may have feature updates */
+	{ "m25p05",  0x202010,  32 * 1024, 2, },
+	{ "m25p10",  0x202011,  32 * 1024, 4, },
+	{ "m25p20",  0x202012,  64 * 1024, 4, },
+	{ "m25p40",  0x202013,  64 * 1024, 8, },
+	{ "m25p80",         0,  64 * 1024, 16, },
+	{ "m25p16",  0x202015,  64 * 1024, 32, },
+	{ "m25p32",  0x202016,  64 * 1024, 64, },
+	{ "m25p64",  0x202017,  64 * 1024, 128, },
+	{ "m25p128", 0x202018, 256 * 1024, 64, },
+
+	{ "m45pe80", 0x204014,  64 * 1024, 16, },
+	{ "m45pe16", 0x204015,  64 * 1024, 32, },
+
+	{ "m25pe80", 0x208014,  64 * 1024, 16, },
+	{ "m25pe16", 0x208015,  64 * 1024, 32, SECT_4K, },
+
+	/* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
+	{ "w25x10", 0xef3011, 64 * 1024, 2, SECT_4K, },
+	{ "w25x20", 0xef3012, 64 * 1024, 4, SECT_4K, },
+	{ "w25x40", 0xef3013, 64 * 1024, 8, SECT_4K, },
+	{ "w25x80", 0xef3014, 64 * 1024, 16, SECT_4K, },
+	{ "w25x16", 0xef3015, 64 * 1024, 32, SECT_4K, },
+	{ "w25x32", 0xef3016, 64 * 1024, 64, SECT_4K, },
+	{ "w25x64", 0xef3017, 64 * 1024, 128, SECT_4K, },
+
+	/* Macronix -- mx25lxxx */
+	{ "mx25l32",  0xc22016, 64 * 1024,  64, },
+	{ "mx25l64",  0xc22017, 64 * 1024, 128, },
+	{ "mx25l128", 0xc22018, 64 * 1024, 256, },
+
+};
+
+struct flash_info *__devinit jedec_probe(struct platform_device *spi)
+{
+	int			tmp;
+	u32			jedec;
+	struct flash_info	*info;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)RA;
+
+	/*
+	 * Setup and run RDID command on the flash.
+	 */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) |
+		IO_XFL_CTL1_FC_DATA(3);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(OPCODE_RDID);
+	FLASH_COMMAND_EXEC(io);
+
+	jedec = io->status1 & 0x00ffffff;
+
+	for (tmp = 0, info = m25p_data;
+			tmp < ARRAY_SIZE(m25p_data);
+			tmp++, info++) {
+		if (info->jedec_id == jedec)
+			return info;
+	}
+	dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
+	return NULL;
+}
+
+
+/*
+ * board specific setup should have ensured the SPI clock used here
+ * matches what the READ command supports, at least until this driver
+ * understands FAST_READ (for clocks over 25 MHz).
+ */
+static int __devinit ubicom32_flash_probe(struct platform_device *spi)
+{
+	struct flash_platform_data	*data;
+	struct m25p			*flash;
+	struct flash_info		*info;
+	unsigned			i;
+
+	/* Platform data helps sort out which chip type we have, as
+	 * well as how this board partitions it.  If we don't have
+	 * a chip ID, try the JEDEC id commands; they'll work for most
+	 * newer chips, even if we don't recognize the particular chip.
+	 */
+	data = spi->dev.platform_data;
+	if (data && data->type) {
+		for (i = 0, info = m25p_data;
+				i < ARRAY_SIZE(m25p_data);
+				i++, info++) {
+			if (strcmp(data->type, info->name) == 0)
+				break;
+		}
+
+		/* unrecognized chip? */
+		if (i == ARRAY_SIZE(m25p_data)) {
+			DEBUG(MTD_DEBUG_LEVEL0, "%s: unrecognized id %s\n",
+			      dev_name(&spi->dev), data->type);
+			info = NULL;
+
+		/* recognized; is that chip really what's there? */
+		} else if (info->jedec_id) {
+			struct flash_info	*chip = jedec_probe(spi);
+
+			if (!chip || chip != info) {
+				dev_warn(&spi->dev, "found %s, expected %s\n",
+						chip ? chip->name : "UNKNOWN",
+						info->name);
+				info = NULL;
+			}
+		}
+	} else
+		info = jedec_probe(spi);
+
+	if (!info)
+		return -ENODEV;
+
+	flash = kzalloc(sizeof *flash, GFP_KERNEL);
+	if (!flash)
+		return -ENOMEM;
+
+	flash->plt_dev = spi;
+	mutex_init(&flash->lock);
+	dev_set_drvdata(&spi->dev, flash);
+
+	if (data && data->name)
+		flash->mtd.name = data->name;
+	else
+		flash->mtd.name = dev_name(&spi->dev);
+
+	flash->mtd.type = MTD_NORFLASH;
+	flash->mtd.writesize = 1;
+	flash->mtd.flags = MTD_CAP_NORFLASH;
+	flash->mtd.size = info->sector_size * info->n_sectors;
+	flash->mtd.erase = ubicom32_flash_driver_erase;
+	flash->mtd.read = ubicom32_flash_driver_read;
+	flash->mtd.write = ubicom32_flash_driver_write;
+
+	/* prefer "small sector" erase if possible */
+	/*
+	 * The Ubicom erase code does not use the opcode for smaller sectors,
+	 * so disable that functionality and keep erasesize == sector_size
+	 * so that the test in ubicom32_flash_driver_erase works properly.
+	 *
+	 * This was: `if (info->flags & SECT_4K) {' instead of `if (0) {'
+	 */
+	if (0) {
+		flash->erase_opcode = OPCODE_BE_4K;
+		flash->mtd.erasesize = 4096;
+	} else {
+		flash->erase_opcode = OPCODE_SE;
+		flash->mtd.erasesize = info->sector_size;
+	}
+
+	dev_info(&spi->dev, "%s (%lld Kbytes)\n", info->name,
+		 flash->mtd.size / 1024);
+
+	DEBUG(MTD_DEBUG_LEVEL2,
+		"mtd .name = %s, .size = 0x%.8llx (%lluMiB) "
+			".erasesize = 0x%.8x (%uKiB) .numeraseregions = %d\n",
+		flash->mtd.name,
+		flash->mtd.size, flash->mtd.size / (1024*1024),
+		flash->mtd.erasesize, flash->mtd.erasesize / 1024,
+		flash->mtd.numeraseregions);
+
+	if (flash->mtd.numeraseregions)
+		for (i = 0; i < flash->mtd.numeraseregions; i++)
+			DEBUG(MTD_DEBUG_LEVEL2,
+				"mtd.eraseregions[%d] = { .offset = 0x%.8llx, "
+				".erasesize = 0x%.8x (%uKiB), "
+				".numblocks = %d }\n",
+				i, flash->mtd.eraseregions[i].offset,
+				flash->mtd.eraseregions[i].erasesize,
+				flash->mtd.eraseregions[i].erasesize / 1024,
+				flash->mtd.eraseregions[i].numblocks);
+
+
+	/* partitions should match sector boundaries; and it may be good to
+	 * use readonly partitions for writeprotected sectors (BP2..BP0).
+	 */
+	if (mtd_has_partitions()) {
+		struct mtd_partition	*parts = NULL;
+		int			nr_parts = 0;
+
+#ifdef CONFIG_MTD_CMDLINE_PARTS
+		static const char *part_probes[] = { "cmdlinepart", NULL, };
+
+		nr_parts = parse_mtd_partitions(&flash->mtd,
+				part_probes, &parts, 0);
+#endif
+
+		if (nr_parts <= 0 && data && data->parts) {
+			parts = data->parts;
+			nr_parts = data->nr_parts;
+			if (nr_parts >= 2) {
+				/*
+				 * Set last partition size to be 1M.
+				 */
+				parts[1].size = flash->mtd.size -
+					parts[0].size - JFFS2_FILESYSTEM_SIZE;
+				parts[2].size = JFFS2_FILESYSTEM_SIZE;
+			}
+		}
+
+		if (nr_parts > 0) {
+			for (i = 0; i < nr_parts; i++) {
+				DEBUG(MTD_DEBUG_LEVEL2, "partitions[%d] = "
+					"{.name = %s, .offset = 0x%.8llx, "
+						".size = 0x%.8llx (%lluKiB) }\n",
+					i, parts[i].name,
+					parts[i].offset,
+					parts[i].size,
+					parts[i].size / 1024);
+			}
+			flash->partitioned = 1;
+			return add_mtd_partitions(&flash->mtd, parts, nr_parts);
+		}
+	} else if (data->nr_parts)
+		dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
+				data->nr_parts, data->name);
+
+	return add_mtd_device(&flash->mtd) == 1 ? -ENODEV : 0;
+}
+
+
+static int __devexit ubicom32_flash_remove(struct spi_device *spi)
+{
+	struct m25p	*flash = dev_get_drvdata(&spi->dev);
+	int		status;
+
+	/* Clean up MTD stuff. */
+	if (mtd_has_partitions() && flash->partitioned)
+		status = del_mtd_partitions(&flash->mtd);
+	else
+		status = del_mtd_device(&flash->mtd);
+	if (status == 0)
+		kfree(flash);
+	return 0;
+}
+
+static struct platform_driver ubicom32_flash_driver = {
+	.driver = {
+		.name	= "ubicom32flashdriver",
+		.bus	= &platform_bus_type,
+		.owner	= THIS_MODULE,
+	},
+	.probe	= ubicom32_flash_probe,
+	.remove	= NULL,
+};
+
+static int ubicom32_flash_driver_init(void)
+{
+	return platform_driver_register(&ubicom32_flash_driver);
+}
+
+
+static void ubicom32_flash_driver_exit(void)
+{
+	platform_driver_unregister(&ubicom32_flash_driver);
+}
+
+
+module_init(ubicom32_flash_driver_init);
+module_exit(ubicom32_flash_driver_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Mike Lavender");
+MODULE_DESCRIPTION("Ubicom32 MTD SPI driver for ST M25Pxx flash chips");
diff --git a/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-nand-spi-er.c b/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-nand-spi-er.c
new file mode 100644
index 000000000..897bed787
--- /dev/null
+++ b/target/linux/ubicom32/files/drivers/mtd/devices/ubi32-nand-spi-er.c
@@ -0,0 +1,1188 @@
+/*
+ * Micron SPI-ER NAND Flash Memory
+ *	This code uses the built in Ubicom flash controller
+ *
+ * (C) Copyright 2009, Ubicom, Inc.
+ *
+ * This file is part of the Ubicom32 Linux Kernel Port.
+ *
+ * The Ubicom32 Linux Kernel Port is free software: you can redistribute
+ * it and/or modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * The Ubicom32 Linux Kernel Port is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ * the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with the Ubicom32 Linux Kernel Port.  If not,
+ * see <http://www.gnu.org/licenses/>.
+*/
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/mutex.h>
+#include <linux/err.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+
+#define DRIVER_NAME				"ubi32-nand-spi-er"
+#define UBI32_NAND_SPI_ER_BLOCK_FROM_ROW(row)	(row >> 6)
+
+#define UBI32_NAND_SPI_ER_STATUS_P_FAIL		(1 << 3)
+#define UBI32_NAND_SPI_ER_STATUS_E_FAIL		(1 << 2)
+#define UBI32_NAND_SPI_ER_STATUS_OIP		(1 << 0)
+
+#define UBI32_NAND_SPI_ER_LAST_ROW_INVALID	0xFFFFFFFF
+#define	UBI32_NAND_SPI_ER_BAD_BLOCK_MARK_OFFSET	0x08
+
+struct ubi32_nand_spi_er_device {
+	const char		*name;
+
+	uint16_t		id;
+
+	unsigned int		blocks;
+	unsigned int		pages_per_block;
+	unsigned int		page_size;
+	unsigned int		write_size;
+	unsigned int		erase_size;
+};
+
+struct ubi32_nand_spi_er {
+	char				name[24];
+
+	const struct ubi32_nand_spi_er_device	*device;
+
+	struct mutex			lock;
+	struct platform_device		*pdev;
+
+	struct mtd_info			mtd;
+
+	unsigned int			last_row;	/* the last row we fetched */
+
+	/*
+	 * Bad block table (MUST be last in strcuture)
+	 */
+	unsigned long			nbb;
+	unsigned long			bbt[0];
+};
+
+/*
+ * Chip supports a write_size of 512, but we cannot do partial
+ * page with command 0x84.
+ *
+ * We need to use command 0x84 because we cannot fill the FIFO fast
+ * enough to transfer the whole 512 bytes at a time. (maybe through
+ * OCM?)
+ */
+const struct ubi32_nand_spi_er_device ubi32_nand_spi_er_devices[] = {
+	{
+		name:			"MT29F1G01ZDC",
+		id:			0x2C12,
+		blocks:			1024,
+		pages_per_block:	64,
+		page_size:		2048,
+		write_size:		2048,
+		erase_size:		64 * 2048,
+	},
+	{
+		name:			"MT29F1G01ZDC",
+		id:			0x2C13,
+		blocks:			1024,
+		pages_per_block:	64,
+		page_size:		2048,
+		write_size:		2048,
+		erase_size:		64 * 2048,
+	},
+};
+
+static int read_only = 0;
+module_param(read_only, int, 0);
+MODULE_PARM_DESC(read_only, "Leave device locked");
+
+/*
+ * Ubicom32 FLASH Command Set
+ */
+#define FLASH_PORT		RA
+
+#define FLASH_FC_INST_CMD	0x00	/* for SPI command only transaction */
+#define FLASH_FC_INST_WR	0x01	/* for SPI write transaction */
+#define FLASH_FC_INST_RD	0x02	/* for SPI read transaction */
+
+#define FLASH_COMMAND_KICK_OFF(io)								\
+	asm volatile(										\
+		"	bset	"D(IO_INT_CLR)"(%0), #0, #%%bit("D(IO_XFL_INT_DONE)")	\n\t"	\
+		"	jmpt.t	.+4							\n\t"	\
+		"	bset	"D(IO_INT_SET)"(%0), #0, #%%bit("D(IO_XFL_INT_START)")	\n\t"	\
+		:										\
+		: "a" (io)									\
+		: "cc"										\
+		);
+
+#define FLASH_COMMAND_WAIT_FOR_COMPLETION(io)							\
+	asm volatile(										\
+		"	btst	"D(IO_INT_STATUS)"(%0), #%%bit("D(IO_XFL_INT_DONE)")	\n\t"	\
+		"	jmpeq.f	.-4							\n\t"	\
+		:										\
+		: "a" (io)									\
+		: "cc"										\
+	);
+
+#define FLASH_COMMAND_EXEC(io)				\
+		FLASH_COMMAND_KICK_OFF(io)		\
+		FLASH_COMMAND_WAIT_FOR_COMPLETION(io)
+
+/*
+ * ubi32_nand_spi_er_get_feature
+ *	Get Feature register
+ */
+static uint8_t ubi32_nand_spi_er_get_feature(uint32_t reg)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	/*
+	 * Note that this will produce the sequence:
+	 * 	SI [0F][REG][00][00]
+	 * 	SO ---------[SR][SR][SR]
+	 * Since the flash controller can only output 24 bits of address, this is
+	 * ok for this command since the data will just repeat as long as the CS
+	 * is asserted and the clock is running.
+	 */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) | IO_XFL_CTL1_FC_DATA(1) |
+		    IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x0F) | IO_XFL_CTL2_FC_ADDR(reg << 16);
+	FLASH_COMMAND_EXEC(io);
+
+	return io->status1 & 0xFF;
+}
+
+/*
+ * ubi32_nand_spi_er_write_buf
+ *	writes a buffer to the bus
+ *
+ * Writes 511 + 1 bytes to the bus, we have to stuff one data byte into the address.
+ */
+static void ubi32_nand_spi_er_write_buf(const uint8_t *buf, uint32_t col)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+	uint32_t tmp;
+
+	asm volatile (
+		"	bset		"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_PORTX_INT_FIFO_TX_RESET)")	\n\t"
+		"	pipe_flush	0									\n\t"
+		:
+		: [port] "a" (FLASH_PORT)
+		: "cc"
+	);
+
+	/*
+	 * Write the data into the cache
+	 */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+#ifdef SUPPORT_512_FIFO
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_WR) | IO_XFL_CTL1_FC_DATA(511) |
+#endif
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_WR) | IO_XFL_CTL1_FC_DATA(31) |
+		    IO_XFL_CTL1_FC_ADDR;
+
+	/*
+	 * Construct the address with the first byte of data
+	 */
+	tmp = (col << 8) | *buf++;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x84) | IO_XFL_CTL2_FC_ADDR(tmp);
+
+	asm volatile (
+
+		/*
+		 * Move 32 bytes
+		 *
+		 * The first word needs to be [11][22][33][33] to work around a flash
+		 * controller bug.
+		 */
+		"	move.2		%[tmp], (%[data])2++							\n\t"
+		"	shmrg.1		%[tmp], (%[data]), %[tmp]						\n\t"
+		"	shmrg.1		%[tmp], (%[data])1++, %[tmp]						\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), %[tmp]					\n\t"
+
+		/*
+		 * We're aligned again!
+		 */
+		"	.rept 7											\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), (%[data])4++					\n\t"
+		"	.endr											\n\t"
+
+		/*
+		 * Kick off the flash command
+		 */
+		"	bset	"D(IO_INT_CLR)"(%[port]), #0, #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpt.t	.+4										\n\t"
+		"	bset	"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_XFL_INT_START)")			\n\t"
+
+#ifdef SUPPORT_512_FIFO
+		/*
+		 * Fill the remaining 120 words as space becomes available
+		 */
+		"1:												\n\t"
+		"	cmpi		"D(IO_FIFO_LEVEL)"(%[port]), #4						\n\t"
+		"	jmpgt.s.t	1b									\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), (%[data])4++					\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), (%[data])4++					\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), (%[data])4++					\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), (%[data])4++					\n\t"
+		"	add.4		%[cnt], #-4, %[cnt]							\n\t"
+		"	jmpgt.t		1b									\n\t"
+#endif
+		/*
+		 * Wait for the transaction to finish
+		 */
+		"	btst	"D(IO_INT_STATUS)"(%[port]), #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpeq.f	.-4										\n\t"
+
+		: [tmp] "=&d" (tmp),
+		  [data] "+&a" (buf)
+		: [column] "d" (col),
+		  [port] "a" (FLASH_PORT),
+		  [cnt] "d" (120)		// see above comment
+		: "cc"
+	);
+}
+
+/*
+ * ubi32_nand_spi_er_send_rd_addr
+ *	perform FC_RD: CMD + address
+ */
+static void ubi32_nand_spi_er_send_rd_addr(uint8_t command, uint32_t address)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) | IO_XFL_CTL1_FC_DATA(4) |
+		    IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(command) | IO_XFL_CTL2_FC_ADDR(address);
+	FLASH_COMMAND_EXEC(io);
+}
+
+/*
+ * ubi32_nand_spi_er_send_cmd_addr
+ *	perform FC_(xxx): CMD + address
+ */
+static void ubi32_nand_spi_er_send_cmd_addr(uint8_t command, uint32_t address)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD) | IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(command) | IO_XFL_CTL2_FC_ADDR(address);
+	FLASH_COMMAND_EXEC(io);
+}
+
+/*
+ * ubi32_nand_spi_er_write_disable
+ *	clear the write enable bit
+ */
+static void ubi32_nand_spi_er_write_disable(void)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x04);
+	FLASH_COMMAND_EXEC(io);
+}
+
+/*
+ * ubi32_nand_spi_er_write_enable
+ *	set the write enable bit
+ */
+static void ubi32_nand_spi_er_write_enable(void)
+{
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x06);
+	FLASH_COMMAND_EXEC(io);
+}
+
+/*
+ * ubi32_nand_spi_er_busywait
+ *	Wait until the chip is not busy
+ */
+static uint8_t ubi32_nand_spi_er_busywait(void)
+{
+	int i;
+	uint8_t data;
+
+	/*
+	 * tRD is 100us, so don't delay too long, however, tERS is
+	 * 10ms so you'd better loop enough.
+	 */
+	for (i = 0; i < 200; i++) {
+		data = ubi32_nand_spi_er_get_feature(0xC0);
+		if (!(data & UBI32_NAND_SPI_ER_STATUS_OIP)) {
+			break;
+		}
+
+		udelay(50);
+	}
+
+	return data;
+}
+
+/*
+ * ubi32_nand_spi_er_erase
+ *	Erase a block, parameters must be block aligned
+ */
+static int ubi32_nand_spi_er_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+	struct ubi32_nand_spi_er *chip = mtd->priv;
+	int res;
+
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: erase addr:%x len:%x\n", chip->name, instr->addr, instr->len);
+
+	if ((instr->addr + instr->len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	if (instr->addr & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: erase address is not aligned %x\n", chip->name, instr->addr);
+		return -EINVAL;
+	}
+
+	if (instr->len & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: erase len is not aligned %x\n", chip->name, instr->len);
+		return -EINVAL;
+	}
+
+	mutex_lock(&chip->lock);
+	chip->last_row = UBI32_NAND_SPI_ER_LAST_ROW_INVALID;
+
+	while (instr->len) {
+		uint32_t block = instr->addr >> 17;
+		uint32_t row = block << 6;
+		uint8_t stat;
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: block erase row:%x block:%x addr:%x rem:%x\n", chip->name, row, block, instr->addr, instr->len);
+
+		/*
+		 * Test for bad block
+		 */
+		if (test_bit(block, chip->bbt)) {
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			res = -EBADMSG;
+			goto done;
+		}
+
+		ubi32_nand_spi_er_write_enable();
+
+		/*
+		 * Block erase
+		 */
+		ubi32_nand_spi_er_send_cmd_addr(0xD8, row);
+
+		/*
+		 * Wait
+		 */
+		stat = ubi32_nand_spi_er_busywait();
+		if (stat & UBI32_NAND_SPI_ER_STATUS_OIP) {
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive stat=%02x\n", chip->name, stat);
+
+			/*
+			 * Chip is stuck?
+			 */
+			res = -EIO;
+			goto done;
+		}
+
+		/*
+		 * Check the status register
+		 */
+		if (stat & UBI32_NAND_SPI_ER_STATUS_E_FAIL) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: E_FAIL signalled (%02x)\n", chip->name, stat);
+			instr->fail_addr = block << 17;
+			instr->state = MTD_ERASE_FAILED;
+			goto done;
+		}
+
+		/*
+		 * Next
+		 */
+		block++;
+		instr->len -= chip->device->erase_size;
+		instr->addr += chip->device->erase_size;
+	}
+
+	instr->state = MTD_ERASE_DONE;
+
+	mutex_unlock(&chip->lock);
+	return 0;
+
+done:
+	ubi32_nand_spi_er_write_disable();
+
+	mutex_unlock(&chip->lock);
+
+	mtd_erase_callback(instr);
+	return 0;
+}
+
+/*
+ * ubi32_nand_spi_er_read
+ *
+ * return -EUCLEAN: ecc error recovered
+ * return -EBADMSG: ecc error not recovered
+*/
+static int ubi32_nand_spi_er_read(struct mtd_info *mtd, loff_t from, size_t len,
+				  size_t *retlen, u_char *buf)
+{
+	struct ubi32_nand_spi_er *chip = mtd->priv;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	uint32_t row;
+	uint32_t column;
+	int retval = 0;
+	uint32_t *pbuf = (uint32_t *)buf;
+
+	*retlen = 0;
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: read block from %llx len %d into %p\n", chip->name, from, len, buf);
+
+	/*
+	 * buf should be aligned
+	 */
+	if ((uint32_t)buf & 0x03) {
+		return -EINVAL;
+	}
+
+	/*
+	 * Zero length reads, nothing to do
+	 */
+	if (len == 0) {
+		return 0;
+	}
+
+	/*
+	 * Reject reads which go over the end of the flash
+	 */
+	if ((from + len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	/*
+	 * Get the row and column address to start at
+	 */
+	row = from >> 11;
+	column = from & 0x7FF;
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: row=%x %d column=%x %d last_row=%x %d\n", chip->name, row, row, column, column, chip->last_row, chip->last_row);
+
+	/*
+	 * Read the data from the chip
+	 */
+	mutex_lock(&chip->lock);
+	while (len) {
+		uint8_t stat;
+		size_t toread;
+		int i;
+		int tmp;
+
+		/*
+		 * Figure out how much to read
+		 *
+		 * If we are reading from the middle of a page then the most we
+		 * can read is to the end of the page
+		 */
+		toread = len;
+		if (toread > (chip->device->page_size - column)) {
+			toread = chip->device->page_size - column;
+		}
+
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: buf=%p toread=%x row=%x column=%x last_row=%x\n", chip->name, pbuf, toread, row, column, chip->last_row);
+
+		if (chip->last_row != row) {
+			/*
+			 * Check if the block is bad
+			 */
+			if (test_bit(UBI32_NAND_SPI_ER_BLOCK_FROM_ROW(row), chip->bbt)) {
+				mutex_unlock(&chip->lock);
+				return -EBADMSG;
+			}
+
+			/*
+			 * Load the appropriate page
+			 */
+			ubi32_nand_spi_er_send_cmd_addr(0x13, row);
+
+			/*
+			 * Wait
+			 */
+			stat = ubi32_nand_spi_er_busywait();
+			if (stat & UBI32_NAND_SPI_ER_STATUS_OIP) {
+				DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive stat=%02x\n", chip->name, stat);
+
+				/*
+				 * Chip is stuck?
+				 */
+				mutex_unlock(&chip->lock);
+				return -EIO;
+			}
+
+			/*
+			 * Check the ECC bits
+			 */
+			stat >>= 4;
+			if (stat == 1) {
+				DEBUG(MTD_DEBUG_LEVEL1, "%s: ECC recovered, row=%x\n", chip->name, row);
+				retval = -EUCLEAN;
+			}
+			if (stat == 2) {
+				DEBUG(MTD_DEBUG_LEVEL0, "%s: failed ECC, row=%x\n", chip->name, row);
+				chip->last_row = UBI32_NAND_SPI_ER_LAST_ROW_INVALID;
+				mutex_unlock(&chip->lock);
+				return -EBADMSG;
+			}
+
+		}
+
+		chip->last_row = row;
+
+		/*
+		 * Read out the data:
+		 *	We can always read a little too much since there is the
+		 *	OOB after byte addr 2047.  The most we'll overread is 3 bytes.
+		 */
+		if (((uint32_t)pbuf & 0x03) == 0) {
+			/*
+			 * Aligned read
+			 */
+			tmp = toread & (~0x03);
+			for (i = 0; i < tmp; i += 4) {
+				ubi32_nand_spi_er_send_rd_addr(0x03, column << 8);
+				*pbuf++ = io->status1;
+				column += 4;
+			}
+		} else {
+			/*
+			 * Unaligned read
+			 */
+			tmp = toread & (~0x03);
+			for (i = 0; i < tmp; i += 4) {
+				ubi32_nand_spi_er_send_rd_addr(0x03, column << 8);
+				memcpy(pbuf, &io->status1, 4);
+				column += 4;
+			}
+		}
+
+		/*
+		 * Fill in any single bytes
+		 */
+		tmp = toread & 0x03;
+		if (tmp) {
+			uint8_t *bbuf = pbuf;
+			uint32_t val;
+			ubi32_nand_spi_er_send_rd_addr(0x03, column << 8);
+			val = io->status1;
+			for (i = 0; i < tmp; i++) {
+				*bbuf++ = val >> 24;
+				val <<= 8;
+			}
+		}
+
+		len -= toread;
+		*retlen += toread;
+
+		/*
+		 * For the next page, increment the row and always start at column 0
+		 */
+		column = 0;
+		row++;
+	}
+
+	mutex_unlock(&chip->lock);
+	return retval;
+}
+
+/*
+ * ubi32_nand_spi_er_write
+ */
+#define WRITE_NOT_ALIGNED(x) ((x & (device->write_size - 1)) != 0)
+static int ubi32_nand_spi_er_write(struct mtd_info *mtd, loff_t to, size_t len,
+				   size_t *retlen, const u_char *buf)
+{
+	struct ubi32_nand_spi_er *chip = mtd->priv;
+	const struct ubi32_nand_spi_er_device *device = chip->device;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+	uint32_t row;
+	uint32_t col;
+	int res = 0;
+	size_t towrite;
+
+	DEBUG(MTD_DEBUG_LEVEL2, "%s: write block to %llx len %d from %p\n", chip->name, to, len, buf);
+
+	*retlen = 0;
+
+	/*
+	 * nothing to write
+	 */
+	if (!len) {
+		return 0;
+	}
+
+	/*
+	 * Reject writes which go over the end of the flash
+	 */
+	if ((to + len) > mtd->size) {
+		return -EINVAL;
+	}
+
+	/*
+	 * buf should be aligned to 16 bits
+	 */
+	if ((uint32_t)buf & 0x01) {
+		return -EINVAL;
+	}
+
+	/*
+	 * Check to see if everything is page aligned
+	 */
+	if (WRITE_NOT_ALIGNED(to) || WRITE_NOT_ALIGNED(len)) {
+		printk(KERN_NOTICE "ubi32_nand_spi_er_write: Attempt to write non page aligned data\n");
+		return -EINVAL;
+	}
+
+	mutex_lock(&chip->lock);
+
+	io->ctl0 |= IO_XFL_CTL0_MCB_LOCK;
+
+	chip->last_row = UBI32_NAND_SPI_ER_LAST_ROW_INVALID;
+
+	/*
+	 * If the first write is a partial write then write at most the number of
+	 * bytes to get us page aligned and then the remainder will be
+	 * page aligned.  The last bit may be a partial page as well.
+	 */
+	col = to & (device->page_size - 1);
+	towrite = device->page_size - col;
+	if (towrite > len) {
+		towrite = len;
+	}
+
+	/*
+	 * Write the data
+	 */
+	row = to >> 11;
+	while (len) {
+		uint8_t stat;
+		uint32_t my_towrite;
+
+		DEBUG(MTD_DEBUG_LEVEL3, "%s: write %p to row:%x col:%x len:%x rem:%x\n", chip->name, buf, row, col, towrite, len);
+
+		ubi32_nand_spi_er_write_enable();
+
+		/*
+		 * Move the data into the cache
+		 */
+		my_towrite = towrite;
+		while (my_towrite) {
+			uint32_t len = my_towrite;
+			if (len > 32) {
+				len = 32;
+			}
+
+			ubi32_nand_spi_er_write_buf(buf, col);
+			buf += len;
+			col += len;
+			my_towrite -= len;
+		}
+
+		/*
+		 * Program execute
+		 */
+		ubi32_nand_spi_er_send_cmd_addr(0x10, row);
+
+		/*
+		 * Wait
+		 */
+		stat = ubi32_nand_spi_er_busywait();
+		if (stat & UBI32_NAND_SPI_ER_STATUS_OIP) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive stat=%02x\n", chip->name, stat);
+
+			/*
+			 * Chip is stuck?
+			 */
+			res = -EIO;
+			goto done;
+		}
+
+		if (stat & (1 << 3)) {
+			res = -EBADMSG;
+			goto done;
+		}
+
+		row++;
+		len -= towrite;
+		*retlen += towrite;
+
+		/*
+		 * At this point, we are always page aligned so start at column 0.
+		 * Note we may not have a full page to write at the end, hence the
+		 * check if towrite > len.
+		 */
+		col = 0;
+		towrite = device->page_size;
+		if (towrite > len) {
+			towrite = len;
+		}
+	}
+
+	io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+
+	mutex_unlock(&chip->lock);
+	return res;
+
+done:
+	ubi32_nand_spi_er_write_disable();
+
+	io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+
+	mutex_unlock(&chip->lock);
+
+	return res;
+}
+
+/*
+ * ubi32_nand_spi_er_isbad
+ */
+static int ubi32_nand_spi_er_isbad(struct mtd_info *mtd, loff_t ofs)
+{
+	struct ubi32_nand_spi_er *chip = mtd->priv;
+	uint32_t block;
+
+	if (ofs & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: address not aligned %llx\n", chip->name, ofs);
+		return -EINVAL;
+	}
+
+	block = ofs >> 17;
+
+	return test_bit(block, chip->bbt);
+}
+
+/*
+ * ubi32_nand_spi_er_markbad
+ */
+static int ubi32_nand_spi_er_markbad(struct mtd_info *mtd, loff_t ofs)
+{
+	struct ubi32_nand_spi_er *chip = mtd->priv;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+	uint32_t block;
+	uint32_t row;
+	int res = 0;
+	uint8_t stat;
+
+	if (ofs & (chip->device->erase_size - 1)) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: address not aligned %llx\n", chip->name, ofs);
+		return -EINVAL;
+	}
+
+	block = ofs >> 17;
+
+	/*
+	 * If it's already marked bad, no need to mark it
+	 */
+	if (test_bit(block, chip->bbt)) {
+		return 0;
+	}
+
+	/*
+	 * Mark it in our cache
+	 */
+	__set_bit(block, chip->bbt);
+
+	/*
+	 * Write the user bad block mark.  If it fails, then we really
+	 * can't do anything about it.
+	 */
+	mutex_lock(&chip->lock);
+	chip->last_row = UBI32_NAND_SPI_ER_LAST_ROW_INVALID;
+
+	ubi32_nand_spi_er_write_enable();
+
+	/*
+	 * Write the mark
+	 */
+	io->ctl0 |= IO_XFL_CTL0_MCB_LOCK;
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_WR) | IO_XFL_CTL1_FC_DATA(6);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x84);
+
+	asm volatile (
+		"	bset		"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_PORTX_INT_FIFO_TX_RESET)")	\n\t"
+		"	pipe_flush	0									\n\t"
+
+		/*
+		 * Move the data into the FIFO
+		 */
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), %[word1]					\n\t"
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), %[word2]					\n\t"
+
+		/*
+		 * Kick off the flash command
+		 */
+		"	bset	"D(IO_INT_CLR)"(%[port]), #0, #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpt.t	.+4										\n\t"
+		"	bset	"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_XFL_INT_START)")			\n\t"
+
+		/*
+		 * Wait for the transaction to finish
+		 */
+		"	btst	"D(IO_INT_STATUS)"(%[port]), #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpeq.f	.-4										\n\t"
+
+		:
+		: [word1] "d" (0x0800dead | (UBI32_NAND_SPI_ER_BAD_BLOCK_MARK_OFFSET << 16)),
+		  [word2] "d" (0xbeef0000),
+		  [port] "a" (FLASH_PORT)
+		: "cc"
+	);
+
+	io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+
+	/*
+	 * Program execute
+	 */
+	row = block << 6;
+	ubi32_nand_spi_er_send_cmd_addr(0x10, row);
+
+	/*
+	 * Wait
+	 */
+	stat = ubi32_nand_spi_er_busywait();
+	if (stat & UBI32_NAND_SPI_ER_STATUS_OIP) {
+		DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive stat=%02x\n", chip->name, stat);
+
+		/*
+		 * Chip is stuck?
+		 */
+		res = -EIO;
+		goto done;
+	}
+
+	if (stat & (1 << 3)) {
+		res = -EBADMSG;
+	}
+
+done:
+	ubi32_nand_spi_er_write_disable();
+
+	mutex_unlock(&chip->lock);
+
+	return res;
+}
+
+/*
+ * ubi32_nand_spi_er_read_bbt
+ */
+static int ubi32_nand_spi_er_read_bbt(struct ubi32_nand_spi_er *chip)
+{
+	int j;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	for (j = 0; j < chip->device->blocks; j++) {
+		unsigned short row = j << 6;
+		uint8_t stat;
+
+		/*
+		 * Read Page
+		 */
+		ubi32_nand_spi_er_send_cmd_addr(0x13, row);
+
+		/*
+		 * Wait
+		 */
+		stat = ubi32_nand_spi_er_busywait();
+		if (stat & UBI32_NAND_SPI_ER_STATUS_OIP) {
+			DEBUG(MTD_DEBUG_LEVEL1, "%s: chip is busy or nonresponsive stat=%02x\n", chip->name, stat);
+
+			/*
+			 * Chip is stuck?
+			 */
+			return -EIO;
+		}
+
+		/*
+		 * Check factory bad block mark
+		 */
+		ubi32_nand_spi_er_send_rd_addr(0x03, 0x080000);
+
+		if ((io->status1 >> 24) != 0xFF) {
+			chip->nbb++;
+			__set_bit(j, chip->bbt);
+			continue;
+		}
+
+		ubi32_nand_spi_er_send_rd_addr(0x03, 0x080000 | (UBI32_NAND_SPI_ER_BAD_BLOCK_MARK_OFFSET << 8));
+		if (io->status1 == 0xdeadbeef) {
+			chip->nbb++;
+			__set_bit(j, chip->bbt);
+		}
+	}
+
+#if defined(CONFIG_MTD_DEBUG) && (MTD_DEBUG_LEVEL3 <= CONFIG_MTD_DEBUG_VERBOSE)
+	printk("%s: Bad Block Table:", chip->name);
+	for (j = 0; j < chip->device->blocks; j++) {
+		if ((j % 64) == 0) {
+			printk("\n%s: block %03x: ", chip->name, j);
+		}
+		printk("%c", test_bit(j, chip->bbt) ? 'X' : '.');
+	}
+	printk("\n%s: Bad Block Numbers: ", chip->name);
+	for (j = 0; j < chip->device->blocks; j++) {
+		if (test_bit(j, chip->bbt)) {
+			printk("%x ", j);
+		}
+	}
+	printk("\n");
+#endif
+
+	return 0;
+}
+
+#ifndef MODULE
+/*
+ * Called at boot time:
+ *
+ * ubi32_nand_spi_er=read_only
+ *	if read_only specified then do not unlock device
+ */
+static int __init ubi32_nand_spi_er_setup(char *str)
+{
+	if (str && (strncasecmp(str, "read_only", 9) == 0)) {
+		read_only = 1;
+	}
+	return 0;
+}
+
+__setup("ubi32_nand_spi_er=", ubi32_nand_spi_er_setup);
+#endif
+
+/*
+ * ubi32_nand_spi_er_probe
+ *	Detect and initialize ubi32_nand_spi_er device.
+ */
+static int __devinit ubi32_nand_spi_er_probe(struct platform_device *pdev)
+{
+	uint32_t i;
+	uint32_t id;
+	int res;
+	size_t bbt_bytes;
+	struct ubi32_nand_spi_er *chip;
+	const struct ubi32_nand_spi_er_device *device;
+	struct ubicom32_io_port *io = (struct ubicom32_io_port *)FLASH_PORT;
+
+	/*
+	 * Reset
+	 */
+	for (i = 0; i < 2; i++) {
+		io->ctl1 &= ~IO_XFL_CTL1_MASK;
+		io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_CMD);
+		io->ctl2 = IO_XFL_CTL2_FC_CMD(0xFF);
+		FLASH_COMMAND_EXEC(io);
+		udelay(250);
+	}
+	udelay(1000);
+
+	/*
+	 * Read out ID
+	 */
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_RD) | IO_XFL_CTL1_FC_DATA(2) |
+		    IO_XFL_CTL1_FC_ADDR;
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x9F);
+	FLASH_COMMAND_EXEC(io);
+
+	id = io->status1 >> 16;
+	device = ubi32_nand_spi_er_devices;
+	for (i = 0; i < ARRAY_SIZE(ubi32_nand_spi_er_devices); i++) {
+		if (device->id == id) {
+			break;
+		}
+		device++;
+	}
+	if (i == ARRAY_SIZE(ubi32_nand_spi_er_devices)) {
+		return -ENODEV;
+	}
+
+	/*
+	 * Initialize our chip structure
+	 */
+	bbt_bytes = DIV_ROUND_UP(device->blocks, BITS_PER_BYTE);
+	chip = kzalloc(sizeof(struct ubi32_nand_spi_er) + bbt_bytes, GFP_KERNEL);
+	if (!chip) {
+		return -ENOMEM;
+	}
+	snprintf(chip->name, sizeof(chip->name), "%s", device->name);
+
+	chip->device = device;
+	chip->last_row = UBI32_NAND_SPI_ER_LAST_ROW_INVALID;
+
+	mutex_init(&chip->lock);
+
+	chip->mtd.type = MTD_NANDFLASH;
+	chip->mtd.flags = MTD_WRITEABLE;
+
+	/*
+	 * #blocks * block size * n blocks
+	 */
+	chip->mtd.size = device->blocks * device->pages_per_block * device->page_size;
+	chip->mtd.erasesize = device->erase_size;
+
+	/*
+	 * 1 page, optionally we can support partial write (512)
+	 */
+	chip->mtd.writesize = device->write_size;
+	chip->mtd.name = device->name;
+	chip->mtd.erase = ubi32_nand_spi_er_erase;
+	chip->mtd.read = ubi32_nand_spi_er_read;
+	chip->mtd.write = ubi32_nand_spi_er_write;
+	chip->mtd.block_isbad = ubi32_nand_spi_er_isbad;
+	chip->mtd.block_markbad = ubi32_nand_spi_er_markbad;
+	chip->mtd.priv = chip;
+
+	/*
+	 * Cache the bad block table
+	 */
+	res = ubi32_nand_spi_er_read_bbt(chip);
+	if (res) {
+		kfree(chip);
+		return res;
+	}
+
+	/*
+	 * Un/lock the chip
+	 */
+	io->ctl0 |= IO_XFL_CTL0_MCB_LOCK;
+	io->ctl1 &= ~IO_XFL_CTL1_MASK;
+	io->ctl1 |= IO_XFL_CTL1_FC_INST(FLASH_FC_INST_WR) | IO_XFL_CTL1_FC_DATA(2);
+	io->ctl2 = IO_XFL_CTL2_FC_CMD(0x1F);
+
+	if (read_only) {
+		i = 0xa0380000;
+	} else {
+		i = 0xa0000000;
+	}
+	asm volatile (
+		"	bset		"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_PORTX_INT_FIFO_TX_RESET)")	\n\t"
+		"	pipe_flush	0									\n\t"
+
+		/*
+		 * Move the data into the FIFO
+		 */
+		"	move.4		"D(IO_TX_FIFO)"(%[port]), %[word1]					\n\t"
+
+		/*
+		 * Kick off the flash command
+		 */
+		"	bset	"D(IO_INT_CLR)"(%[port]), #0, #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpt.t	.+4										\n\t"
+		"	bset	"D(IO_INT_SET)"(%[port]), #0, #%%bit("D(IO_XFL_INT_START)")			\n\t"
+
+		/*
+		 * Wait for the transaction to finish
+		 */
+		"	btst	"D(IO_INT_STATUS)"(%[port]), #%%bit("D(IO_XFL_INT_DONE)")			\n\t"
+		"	jmpeq.f	.-4										\n\t"
+
+		:
+		: [word1] "d" (i),
+		  [port] "a" (FLASH_PORT)
+		: "cc"
+	);
+	io->ctl0 &= ~IO_XFL_CTL0_MCB_LOCK;
+
+	dev_set_drvdata(&pdev->dev, chip);
+
+	printk(KERN_INFO "%s: added device size: %u KBytes %lu bad blocks %s\n", chip->mtd.name, DIV_ROUND_UP(chip->mtd.size, 1024), chip->nbb, read_only ? "[read only]" : "");
+	return add_mtd_device(&chip->mtd);
+}
+
+/*
+ * ubi32_nand_spi_er_remove
+ */
+static int __devexit ubi32_nand_spi_er_remove(struct platform_device *pdev)
+{
+	struct ubi32_nand_spi_er *chip = dev_get_drvdata(&pdev->dev);
+	int status;
+
+	DEBUG(MTD_DEBUG_LEVEL1, "%s: remove\n", chip->name);
+
+	status = del_mtd_device(&chip->mtd);
+	if (status == 0) {
+		kfree(chip);
+	}
+
+	dev_set_drvdata(&pdev->dev, NULL);
+	return status;
+}
+
+static struct platform_device *ubi32_nand_spi_er_device;
+
+static struct platform_driver ubi32_nand_spi_er_driver = {
+	.driver = {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+	},
+
+	.probe		= ubi32_nand_spi_er_probe,
+	.remove		= ubi32_nand_spi_er_remove,
+};
+
+/*
+ * ubi32_nand_spi_er_init
+ */
+static int __init ubi32_nand_spi_er_init(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&ubi32_nand_spi_er_driver);
+
+	if (ret) {
+		return ret;
+	}
+
+	ubi32_nand_spi_er_device = platform_device_alloc(DRIVER_NAME, 0);
+	if (!ubi32_nand_spi_er_device) {
+		return -ENOMEM;
+	}
+
+	ret = platform_device_add(ubi32_nand_spi_er_device);
+	if (ret) {
+		platform_device_put(ubi32_nand_spi_er_device);
+		platform_driver_unregister(&ubi32_nand_spi_er_driver);
+	}
+
+	return ret;
+}
+module_init(ubi32_nand_spi_er_init);
+
+/*
+ * ubi32_nand_spi_er_exit
+ */
+static void __exit ubi32_nand_spi_er_exit(void)
+{
+	platform_device_unregister(ubi32_nand_spi_er_device);
+	platform_driver_unregister(&ubi32_nand_spi_er_driver);
+}
+module_exit(ubi32_nand_spi_er_exit);
+
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick Tjin");
+MODULE_DESCRIPTION("MTD ubi32_nand_spi_er driver for ubicom32 SPI flash controller.");