kernel: update kernel 4.9 to 4.9.31

Fixes the following security vulnerabilities:

CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.

CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.

CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.

CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.

CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.

CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.

Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.31

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

6 files changed, 655 insertions, 707 deletions

diff --git a/target/linux/ipq806x/patches-4.9/852-ipq4019-pinctrl-Updated-various-Pin-definitions.patch b/target/linux/ipq806x/patches-4.9/852-ipq4019-pinctrl-Updated-various-Pin-definitions.patch
index 4267d47b76..d0a6a26a56 100644
--- a/target/linux/ipq806x/patches-4.9/852-ipq4019-pinctrl-Updated-various-Pin-definitions.patch
+++ b/target/linux/ipq806x/patches-4.9/852-ipq4019-pinctrl-Updated-various-Pin-definitions.patch
@@ -10,13 +10,11 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  drivers/pinctrl/qcom/pinctrl-ipq4019.c | 1189 +++++++++++++++++++++++++++++---
  1 file changed, 1111 insertions(+), 78 deletions(-)
 
-diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
-index 743d1f4..571eb51 100644
 --- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
 +++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
 @@ -276,16 +276,531 @@ DECLARE_QCA_GPIO_PINS(99);
-
-
+ 
+ 
  enum ipq4019_functions {
 +	qca_mux_rmii0_refclk,
 +	qca_mux_wifi0_rfsilient0,
@@ -122,7 +120,7 @@ index 743d1f4..571eb51 100644
 +	qca_mux_wifi034,
 +	qca_mux_wifi134,
 +	qca_mux_jtag_tdi,
-	qca_mux_gpio,
+ 	qca_mux_gpio,
 +	qca_mux_i2s_rx_bclk,
 +	qca_mux_jtag_tck,
 +	qca_mux_i2s_rx_fsync,
@@ -139,7 +137,7 @@ index 743d1f4..571eb51 100644
 +	qca_mux_mdc,
 +	qca_mux_wcss0_dbg19,
 +	qca_mux_wcss1_dbg19,
-	qca_mux_blsp_uart1,
+ 	qca_mux_blsp_uart1,
 +	qca_mux_wifi0_uart,
 +	qca_mux_wifi1_uart,
 +	qca_mux_smart1,
@@ -149,13 +147,13 @@ index 743d1f4..571eb51 100644
 +	qca_mux_wifi1_uart0,
 +	qca_mux_wcss0_dbg21,
 +	qca_mux_wcss1_dbg21,
-	qca_mux_blsp_i2c0,
+ 	qca_mux_blsp_i2c0,
 +	qca_mux_wcss0_dbg22,
 +	qca_mux_wcss1_dbg22,
 +	qca_mux_wcss0_dbg23,
 +	qca_mux_wcss1_dbg23,
 +	qca_mux_blsp_spi0,
-	qca_mux_blsp_i2c1,
+ 	qca_mux_blsp_i2c1,
 +	qca_mux_wcss0_dbg24,
 +	qca_mux_wcss1_dbg24,
 +	qca_mux_wcss0_dbg25,
@@ -164,7 +162,7 @@ index 743d1f4..571eb51 100644
 +	qca_mux_wcss1_dbg26,
 +	qca_mux_wcss0_dbg,
 +	qca_mux_wcss1_dbg,
-	qca_mux_blsp_uart0,
+ 	qca_mux_blsp_uart0,
 -	qca_mux_blsp_spi1,
 -	qca_mux_blsp_spi0,
 +	qca_mux_led0,
@@ -229,9 +227,9 @@ index 743d1f4..571eb51 100644
 +	qca_mux_pcie_clk1,
 +	qca_mux_led3,
 +	qca_mux_sdio_cd,
-	qca_mux_NA,
+ 	qca_mux_NA,
  };
-
+ 
 +static const char * const rmii0_refclk_groups[] = {
 +	"gpio40",
 +};
@@ -546,11 +544,11 @@ index 743d1f4..571eb51 100644
 +	"gpio0",
 +};
  static const char * const gpio_groups[] = {
-	"gpio0", "gpio1", "gpio2", "gpio3", "gpio4", "gpio5", "gpio6", "gpio7",
-	"gpio8", "gpio9", "gpio10", "gpio11", "gpio12", "gpio13", "gpio14",
-@@ -303,13 +818,103 @@ static const char * const gpio_groups[] = {
-	"gpio92", "gpio93", "gpio94", "gpio95", "gpio96", "gpio97", "gpio98",
-	"gpio99",
+ 	"gpio0", "gpio1", "gpio2", "gpio3", "gpio4", "gpio5", "gpio6", "gpio7",
+ 	"gpio8", "gpio9", "gpio10", "gpio11", "gpio12", "gpio13", "gpio14",
+@@ -303,13 +818,103 @@ static const char * const gpio_groups[]
+ 	"gpio92", "gpio93", "gpio94", "gpio95", "gpio96", "gpio97", "gpio98",
+ 	"gpio99",
  };
 -
 +static const char * const i2s_rx_bclk_groups[] = {
@@ -605,7 +603,7 @@ index 743d1f4..571eb51 100644
 +	"gpio7", "gpio23", "gpio40",
 +};
  static const char * const blsp_uart1_groups[] = {
-	"gpio8", "gpio9", "gpio10", "gpio11",
+ 	"gpio8", "gpio9", "gpio10", "gpio11",
  };
 +static const char * const wifi0_uart_groups[] = {
 +	"gpio8", "gpio9", "gpio11", "gpio19", "gpio62",
@@ -636,7 +634,7 @@ index 743d1f4..571eb51 100644
 +	"gpio9", "gpio25", "gpio42",
 +};
  static const char * const blsp_i2c0_groups[] = {
-	"gpio10", "gpio11", "gpio20", "gpio21", "gpio58", "gpio59",
+ 	"gpio10", "gpio11", "gpio20", "gpio21", "gpio58", "gpio59",
  };
 +static const char * const wcss0_dbg22_groups[] = {
 +	"gpio10", "gpio26", "gpio43",
@@ -651,11 +649,11 @@ index 743d1f4..571eb51 100644
 +	"gpio11", "gpio27", "gpio44",
 +};
  static const char * const blsp_spi0_groups[] = {
-	"gpio12", "gpio13", "gpio14", "gpio15", "gpio45",
-	"gpio54", "gpio55", "gpio56", "gpio57",
-@@ -317,94 +922,582 @@ static const char * const blsp_spi0_groups[] = {
+ 	"gpio12", "gpio13", "gpio14", "gpio15", "gpio45",
+ 	"gpio54", "gpio55", "gpio56", "gpio57",
+@@ -317,94 +922,582 @@ static const char * const blsp_spi0_grou
  static const char * const blsp_i2c1_groups[] = {
-	"gpio12", "gpio13", "gpio34", "gpio35",
+ 	"gpio12", "gpio13", "gpio34", "gpio35",
  };
 +static const char * const wcss0_dbg24_groups[] = {
 +	"gpio12", "gpio28", "gpio45",
@@ -682,7 +680,7 @@ index 743d1f4..571eb51 100644
 +	"gpio15",
 +};
  static const char * const blsp_uart0_groups[] = {
-	"gpio16", "gpio17", "gpio60", "gpio61",
+ 	"gpio16", "gpio17", "gpio60", "gpio61",
  };
 -static const char * const blsp_spi1_groups[] = {
 -	"gpio44", "gpio45", "gpio46", "gpio47",
@@ -872,7 +870,7 @@ index 743d1f4..571eb51 100644
 +static const char * const sdio_cd_groups[] = {
 +	"gpio22",
  };
-
+ 
  static const struct msm_function ipq4019_functions[] = {
 +	FUNCTION(rmii0_refclk),
 +	FUNCTION(wifi0_rfsilient0),
@@ -978,7 +976,7 @@ index 743d1f4..571eb51 100644
 +	FUNCTION(wifi034),
 +	FUNCTION(wifi134),
 +	FUNCTION(jtag_tdi),
-	FUNCTION(gpio),
+ 	FUNCTION(gpio),
 +	FUNCTION(i2s_rx_bclk),
 +	FUNCTION(jtag_tck),
 +	FUNCTION(i2s_rx_fsync),
@@ -995,7 +993,7 @@ index 743d1f4..571eb51 100644
 +	FUNCTION(mdc),
 +	FUNCTION(wcss0_dbg19),
 +	FUNCTION(wcss1_dbg19),
-	FUNCTION(blsp_uart1),
+ 	FUNCTION(blsp_uart1),
 +	FUNCTION(wifi0_uart),
 +	FUNCTION(wifi1_uart),
 +	FUNCTION(smart1),
@@ -1005,13 +1003,13 @@ index 743d1f4..571eb51 100644
 +	FUNCTION(wifi1_uart0),
 +	FUNCTION(wcss0_dbg21),
 +	FUNCTION(wcss1_dbg21),
-	FUNCTION(blsp_i2c0),
+ 	FUNCTION(blsp_i2c0),
 +	FUNCTION(wcss0_dbg22),
 +	FUNCTION(wcss1_dbg22),
 +	FUNCTION(wcss0_dbg23),
 +	FUNCTION(wcss1_dbg23),
 +	FUNCTION(blsp_spi0),
-	FUNCTION(blsp_i2c1),
+ 	FUNCTION(blsp_i2c1),
 +	FUNCTION(wcss0_dbg24),
 +	FUNCTION(wcss1_dbg24),
 +	FUNCTION(wcss0_dbg25),
@@ -1020,7 +1018,7 @@ index 743d1f4..571eb51 100644
 +	FUNCTION(wcss1_dbg26),
 +	FUNCTION(wcss0_dbg),
 +	FUNCTION(wcss1_dbg),
-	FUNCTION(blsp_uart0),
+ 	FUNCTION(blsp_uart0),
 -	FUNCTION(blsp_spi1),
 -	FUNCTION(blsp_spi0),
 +	FUNCTION(led0),
@@ -1086,7 +1084,7 @@ index 743d1f4..571eb51 100644
 +	FUNCTION(led3),
 +	FUNCTION(sdio_cd),
  };
-
+ 
  static const struct msm_pingroup ipq4019_groups[] = {
 -	PINGROUP(0, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 -	PINGROUP(1, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
@@ -1307,26 +1305,24 @@ index 743d1f4..571eb51 100644
 +		 NA, NA, NA, NA, NA, NA),
 +	PINGROUP(69, qpic_pad, NA, wcss0_dbg, NA, NA, NA, NA, NA, NA, NA, NA,
 +		 NA, NA, NA),
-	PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-	PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-	PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-@@ -433,7 +1526,8 @@ static const struct msm_pingroup ipq4019_groups[] = {
-	PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-	PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-	PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+@@ -433,7 +1526,8 @@ static const struct msm_pingroup ipq4019
+ 	PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 -	PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 +	PINGROUP(98, wifi034, wifi134, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA,
 +		 NA, NA),
-	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
  };
-
-@@ -460,6 +1554,7 @@ static const struct of_device_id ipq4019_pinctrl_of_match[] = {
+ 
+@@ -460,6 +1554,7 @@ static const struct of_device_id ipq4019
  static struct platform_driver ipq4019_pinctrl_driver = {
-	.driver = {
-		.name = "ipq4019-pinctrl",
+ 	.driver = {
+ 		.name = "ipq4019-pinctrl",
 +		.owner = THIS_MODULE,
-		.of_match_table = ipq4019_pinctrl_of_match,
-	},
-	.probe = ipq4019_pinctrl_probe,
---
-2.7.2
+ 		.of_match_table = ipq4019_pinctrl_of_match,
+ 	},
+ 	.probe = ipq4019_pinctrl_probe,
diff --git a/target/linux/ipq806x/patches-4.9/859-msm-pinctrl-Add-support-to-configure-ipq40xx-GPIO_PU.patch b/target/linux/ipq806x/patches-4.9/859-msm-pinctrl-Add-support-to-configure-ipq40xx-GPIO_PU.patch
index bac9e78772..07cf01b268 100644
--- a/target/linux/ipq806x/patches-4.9/859-msm-pinctrl-Add-support-to-configure-ipq40xx-GPIO_PU.patch
+++ b/target/linux/ipq806x/patches-4.9/859-msm-pinctrl-Add-support-to-configure-ipq40xx-GPIO_PU.patch
@@ -32,38 +32,32 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  drivers/pinctrl/qcom/pinctrl-msm8x74.c |  1 +
  11 files changed, 43 insertions(+), 13 deletions(-)
 
-diff --git a/drivers/pinctrl/qcom/pinctrl-apq8064.c b/drivers/pinctrl/qcom/pinctrl-apq8064.c
-index cd96699..63e9a7e 100644
 --- a/drivers/pinctrl/qcom/pinctrl-apq8064.c
 +++ b/drivers/pinctrl/qcom/pinctrl-apq8064.c
-@@ -597,6 +597,7 @@ static const struct msm_pinctrl_soc_data apq8064_pinctrl = {
-	.groups = apq8064_groups,
-	.ngroups = ARRAY_SIZE(apq8064_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -597,6 +597,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = apq8064_groups,
+ 	.ngroups = ARRAY_SIZE(apq8064_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int apq8064_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-apq8084.c b/drivers/pinctrl/qcom/pinctrl-apq8084.c
-index d07e8df..892250e 100644
 --- a/drivers/pinctrl/qcom/pinctrl-apq8084.c
 +++ b/drivers/pinctrl/qcom/pinctrl-apq8084.c
-@@ -1206,6 +1206,7 @@ static const struct msm_pinctrl_soc_data apq8084_pinctrl = {
-	.groups = apq8084_groups,
-	.ngroups = ARRAY_SIZE(apq8084_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -1206,6 +1206,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = apq8084_groups,
+ 	.ngroups = ARRAY_SIZE(apq8084_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int apq8084_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
-index 571eb51..040e03c 100644
 --- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
 +++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
-@@ -1531,6 +1531,13 @@ static const struct msm_pingroup ipq4019_groups[] = {
-	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+@@ -1531,6 +1531,13 @@ static const struct msm_pingroup ipq4019
+ 	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
  };
-
+ 
 +static const struct msm_pinctrl_gpio_pull ipq4019_gpio_pull = {
 +	.no_pull = 0,
 +	.pull_down = 1,
@@ -72,48 +66,42 @@ index 571eb51..040e03c 100644
 +};
 +
  static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
-	.pins = ipq4019_pins,
-	.npins = ARRAY_SIZE(ipq4019_pins),
-@@ -1539,6 +1546,7 @@ static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
-	.groups = ipq4019_groups,
-	.ngroups = ARRAY_SIZE(ipq4019_groups),
-	.ngpios = 100,
+ 	.pins = ipq4019_pins,
+ 	.npins = ARRAY_SIZE(ipq4019_pins),
+@@ -1539,6 +1546,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = ipq4019_groups,
+ 	.ngroups = ARRAY_SIZE(ipq4019_groups),
+ 	.ngpios = 100,
 +	.gpio_pull = &ipq4019_gpio_pull,
  };
-
+ 
  static int ipq4019_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-ipq8064.c b/drivers/pinctrl/qcom/pinctrl-ipq8064.c
-index bcb29c0..a927251 100644
 --- a/drivers/pinctrl/qcom/pinctrl-ipq8064.c
 +++ b/drivers/pinctrl/qcom/pinctrl-ipq8064.c
-@@ -630,6 +630,7 @@ static const struct msm_pinctrl_soc_data ipq8064_pinctrl = {
-	.groups = ipq8064_groups,
-	.ngroups = ARRAY_SIZE(ipq8064_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -630,6 +630,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = ipq8064_groups,
+ 	.ngroups = ARRAY_SIZE(ipq8064_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int ipq8064_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-mdm9615.c b/drivers/pinctrl/qcom/pinctrl-mdm9615.c
-index 2b8f452..67e6b75 100644
 --- a/drivers/pinctrl/qcom/pinctrl-mdm9615.c
 +++ b/drivers/pinctrl/qcom/pinctrl-mdm9615.c
-@@ -444,6 +444,7 @@ static const struct msm_pinctrl_soc_data mdm9615_pinctrl = {
-	.groups = mdm9615_groups,
-	.ngroups = ARRAY_SIZE(mdm9615_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -444,6 +444,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = mdm9615_groups,
+ 	.ngroups = ARRAY_SIZE(mdm9615_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int mdm9615_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
-index c406b61..ae361a1 100644
 --- a/drivers/pinctrl/qcom/pinctrl-msm.c
 +++ b/drivers/pinctrl/qcom/pinctrl-msm.c
-@@ -203,11 +203,6 @@ static int msm_config_reg(struct msm_pinctrl *pctrl,
-	return 0;
+@@ -203,11 +203,6 @@ static int msm_config_reg(struct msm_pin
+ 	return 0;
  }
-
+ 
 -#define MSM_NO_PULL	0
 -#define MSM_PULL_DOWN	1
 -#define MSM_KEEPER	2
@@ -121,56 +109,54 @@ index c406b61..ae361a1 100644
 -
  static unsigned msm_regval_to_drive(u32 val)
  {
-	return (val + 1) * 2;
-@@ -238,16 +233,16 @@ static int msm_config_group_get(struct pinctrl_dev *pctldev,
-	/* Convert register value to pinconf value */
-	switch (param) {
-	case PIN_CONFIG_BIAS_DISABLE:
+ 	return (val + 1) * 2;
+@@ -238,16 +233,16 @@ static int msm_config_group_get(struct p
+ 	/* Convert register value to pinconf value */
+ 	switch (param) {
+ 	case PIN_CONFIG_BIAS_DISABLE:
 -		arg = arg == MSM_NO_PULL;
 +		arg = arg == pctrl->soc->gpio_pull->no_pull;
-		break;
-	case PIN_CONFIG_BIAS_PULL_DOWN:
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_DOWN:
 -		arg = arg == MSM_PULL_DOWN;
 +		arg = arg == pctrl->soc->gpio_pull->pull_down;
-		break;
-	case PIN_CONFIG_BIAS_BUS_HOLD:
+ 		break;
+ 	case PIN_CONFIG_BIAS_BUS_HOLD:
 -		arg = arg == MSM_KEEPER;
 +		arg = arg == pctrl->soc->gpio_pull->keeper;
-		break;
-	case PIN_CONFIG_BIAS_PULL_UP:
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_UP:
 -		arg = arg == MSM_PULL_UP;
 +		arg = arg == pctrl->soc->gpio_pull->pull_up;
-		break;
-	case PIN_CONFIG_DRIVE_STRENGTH:
-		arg = msm_regval_to_drive(arg);
-@@ -304,16 +299,16 @@ static int msm_config_group_set(struct pinctrl_dev *pctldev,
-		/* Convert pinconf values to register values */
-		switch (param) {
-		case PIN_CONFIG_BIAS_DISABLE:
+ 		break;
+ 	case PIN_CONFIG_DRIVE_STRENGTH:
+ 		arg = msm_regval_to_drive(arg);
+@@ -304,16 +299,16 @@ static int msm_config_group_set(struct p
+ 		/* Convert pinconf values to register values */
+ 		switch (param) {
+ 		case PIN_CONFIG_BIAS_DISABLE:
 -			arg = MSM_NO_PULL;
 +			arg = pctrl->soc->gpio_pull->no_pull;
-			break;
-		case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			break;
+ 		case PIN_CONFIG_BIAS_PULL_DOWN:
 -			arg = MSM_PULL_DOWN;
 +			arg = pctrl->soc->gpio_pull->pull_down;
-			break;
-		case PIN_CONFIG_BIAS_BUS_HOLD:
+ 			break;
+ 		case PIN_CONFIG_BIAS_BUS_HOLD:
 -			arg = MSM_KEEPER;
 +			arg = pctrl->soc->gpio_pull->keeper;
-			break;
-		case PIN_CONFIG_BIAS_PULL_UP:
+ 			break;
+ 		case PIN_CONFIG_BIAS_PULL_UP:
 -			arg = MSM_PULL_UP;
 +			arg = pctrl->soc->gpio_pull->pull_up;
-			break;
-		case PIN_CONFIG_DRIVE_STRENGTH:
-			/* Check for invalid values */
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm.h b/drivers/pinctrl/qcom/pinctrl-msm.h
-index 54fdd04..090aed9 100644
+ 			break;
+ 		case PIN_CONFIG_DRIVE_STRENGTH:
+ 			/* Check for invalid values */
 --- a/drivers/pinctrl/qcom/pinctrl-msm.h
 +++ b/drivers/pinctrl/qcom/pinctrl-msm.h
 @@ -98,6 +98,16 @@ struct msm_pingroup {
  };
-
+ 
  /**
 + * struct msm_pinctrl_gpio_pull - pinctrl pull value bit field descriptor
 + */
@@ -192,11 +178,11 @@ index 54fdd04..090aed9 100644
 + * @gpio_pull_val: The pull value bit field descriptor.
   */
  struct msm_pinctrl_soc_data {
-	const struct pinctrl_pin_desc *pins;
+ 	const struct pinctrl_pin_desc *pins;
 @@ -115,6 +126,14 @@ struct msm_pinctrl_soc_data {
-	const struct msm_pingroup *groups;
-	unsigned ngroups;
-	unsigned ngpios;
+ 	const struct msm_pingroup *groups;
+ 	unsigned ngroups;
+ 	unsigned ngpios;
 +	const struct msm_pinctrl_gpio_pull *gpio_pull;
 +};
 +
@@ -206,55 +192,45 @@ index 54fdd04..090aed9 100644
 +	.keeper = 2,
 +	.pull_up = 3,
  };
-
+ 
  int msm_pinctrl_probe(struct platform_device *pdev,
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm8660.c b/drivers/pinctrl/qcom/pinctrl-msm8660.c
-index 5591d09..a8899d9 100644
 --- a/drivers/pinctrl/qcom/pinctrl-msm8660.c
 +++ b/drivers/pinctrl/qcom/pinctrl-msm8660.c
-@@ -979,6 +979,7 @@ static const struct msm_pinctrl_soc_data msm8660_pinctrl = {
-	.groups = msm8660_groups,
-	.ngroups = ARRAY_SIZE(msm8660_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -979,6 +979,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = msm8660_groups,
+ 	.ngroups = ARRAY_SIZE(msm8660_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int msm8660_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm8916.c b/drivers/pinctrl/qcom/pinctrl-msm8916.c
-index 20ebf24..c45c2bb 100644
 --- a/drivers/pinctrl/qcom/pinctrl-msm8916.c
 +++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c
-@@ -967,6 +967,7 @@ static const struct msm_pinctrl_soc_data msm8916_pinctrl = {
-	.groups = msm8916_groups,
-	.ngroups = ARRAY_SIZE(msm8916_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -967,6 +967,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = msm8916_groups,
+ 	.ngroups = ARRAY_SIZE(msm8916_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int msm8916_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm8960.c b/drivers/pinctrl/qcom/pinctrl-msm8960.c
-index ed23e36..9411176 100644
 --- a/drivers/pinctrl/qcom/pinctrl-msm8960.c
 +++ b/drivers/pinctrl/qcom/pinctrl-msm8960.c
-@@ -1244,6 +1244,7 @@ static const struct msm_pinctrl_soc_data msm8960_pinctrl = {
-	.groups = msm8960_groups,
-	.ngroups = ARRAY_SIZE(msm8960_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -1244,6 +1244,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = msm8960_groups,
+ 	.ngroups = ARRAY_SIZE(msm8960_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int msm8960_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm8x74.c b/drivers/pinctrl/qcom/pinctrl-msm8x74.c
-index 9eb63d3..7740875 100644
 --- a/drivers/pinctrl/qcom/pinctrl-msm8x74.c
 +++ b/drivers/pinctrl/qcom/pinctrl-msm8x74.c
-@@ -1069,6 +1069,7 @@ static const struct msm_pinctrl_soc_data msm8x74_pinctrl = {
-	.groups = msm8x74_groups,
-	.ngroups = ARRAY_SIZE(msm8x74_groups),
-	.ngpios = NUM_GPIO_PINGROUPS,
+@@ -1069,6 +1069,7 @@ static const struct msm_pinctrl_soc_data
+ 	.groups = msm8x74_groups,
+ 	.ngroups = ARRAY_SIZE(msm8x74_groups),
+ 	.ngpios = NUM_GPIO_PINGROUPS,
 +	.gpio_pull = &msm_gpio_pull,
  };
-
+ 
  static int msm8x74_pinctrl_probe(struct platform_device *pdev)
---
-2.7.2
diff --git a/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch b/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
index ad9d1bbf4c..20940514eb 100644
--- a/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
+++ b/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
@@ -17,13 +17,11 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  drivers/mtd/nand/qcom_nandc.c                      | 160 +++++++++++++++++----
  2 files changed, 190 insertions(+), 39 deletions(-)
 
-diff --git a/Documentation/devicetree/bindings/mtd/qcom_nandc.txt b/Documentation/devicetree/bindings/mtd/qcom_nandc.txt
-index 70dd511..9e5c9be 100644
 --- a/Documentation/devicetree/bindings/mtd/qcom_nandc.txt
 +++ b/Documentation/devicetree/bindings/mtd/qcom_nandc.txt
 @@ -1,21 +1,26 @@
  * Qualcomm NAND controller
-
+ 
  Required properties:
 -- compatible:		should be "qcom,ipq806x-nand"
 +- compatible:		"qcom,ipq806x-nand" for IPQ8064 which uses
@@ -33,7 +31,7 @@ index 70dd511..9e5c9be 100644
  - reg:			MMIO address range
  - clocks:		must contain core clock and always on clock
  - clock-names:		must contain "core" for the core clock and "aon" for the
-			always on clock
+ 			always on clock
  - dmas:			DMA specifier, consisting of a phandle to the ADM DMA
 -			controller node and the channel number to be used for
 -			NAND. Refer to dma.txt and qcom_adm.txt for more details
@@ -57,36 +55,20 @@ index 70dd511..9e5c9be 100644
 +			controller on the given platform.
  - #address-cells:	<1> - subnodes give the chip-select number
  - #size-cells:		<0>
-
+ 
 @@ -44,7 +49,7 @@ partition.txt for more detail.
  Example:
-
+ 
  nand@1ac00000 {
 -	compatible = "qcom,ebi2-nandc";
 +	compatible = "qcom,ipq806x-nand","qcom.qcom_nand";
-	reg = <0x1ac00000 0x800>;
-
-	clocks = <&gcc EBI2_CLK>,
-@@ -84,3 +89,45 @@ nand@1ac00000 {
-		};
-	};
- };
-+
-+nand@79B0000 {
-+	compatible = "qcom,ebi2-nandc-bam";
-+	reg = <0x79B0000 0x1000>;
-+
-+	clocks = <&gcc EBI2_CLK>,
-+		 <&gcc EBI2_AON_CLK>;
-+	clock-names = "core", "aon";
-+
-+	dmas = <&qpicbam 0>,
-+		<&qpicbam 1>,
-+		<&qpicbam 2>;
-+	dma-names = "tx", "rx", "cmd";
-+
-+	#address-cells = <1>;
-+	#size-cells = <0>;
+ 	reg = <0x1ac00000 0x800>;
+ 
+ 	clocks = <&gcc EBI2_CLK>,
+@@ -58,6 +63,48 @@ nand@1ac00000 {
+ 
+ 	#address-cells = <1>;
+ 	#size-cells = <0>;
 +
 +	nandcs@0 {
 +		compatible = "qcom,nandcs";
@@ -113,8 +95,25 @@ index 70dd511..9e5c9be 100644
 +		};
 +	};
 +};
-diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c
-index 57d483a..76a0ffc 100644
++
++nand@79B0000 {
++	compatible = "qcom,ebi2-nandc-bam";
++	reg = <0x79B0000 0x1000>;
++
++	clocks = <&gcc EBI2_CLK>,
++		 <&gcc EBI2_AON_CLK>;
++	clock-names = "core", "aon";
++
++	dmas = <&qpicbam 0>,
++		<&qpicbam 1>,
++		<&qpicbam 2>;
++	dma-names = "tx", "rx", "cmd";
++
++	#address-cells = <1>;
++	#size-cells = <0>;
+ 
+ 	nandcs@0 {
+ 		compatible = "qcom,nandcs";
 --- a/drivers/mtd/nand/qcom_nandc.c
 +++ b/drivers/mtd/nand/qcom_nandc.c
 @@ -226,6 +226,7 @@ struct nandc_regs {
@@ -135,16 +134,16 @@ index 57d483a..76a0ffc 100644
 + *				bam dma
 +*/
  struct qcom_nand_controller {
-	struct nand_hw_control controller;
-	struct list_head host_list;
+ 	struct nand_hw_control controller;
+ 	struct list_head host_list;
 @@ -247,17 +251,28 @@ struct qcom_nand_controller {
-	struct clk *core_clk;
-	struct clk *aon_clk;
-
+ 	struct clk *core_clk;
+ 	struct clk *aon_clk;
+ 
 -	struct dma_chan *chan;
 -	unsigned int cmd_crci;
 -	unsigned int data_crci;
-	struct list_head desc_list;
+ 	struct list_head desc_list;
 +	union {
 +		struct {
 +			struct dma_chan *tx_chan;
@@ -157,22 +156,22 @@ index 57d483a..76a0ffc 100644
 +			unsigned int data_crci;
 +		};
 +	};
-
-	u8		*data_buffer;
+ 
+ 	u8		*data_buffer;
 +	bool            dma_bam_enabled;
-	int		buf_size;
-	int		buf_count;
-	int		buf_start;
-
-	__le32 *reg_read_buf;
+ 	int		buf_size;
+ 	int		buf_count;
+ 	int		buf_start;
+ 
+ 	__le32 *reg_read_buf;
 +	dma_addr_t reg_read_buf_phys;
-	int reg_read_pos;
-
-	struct nandc_regs *regs;
+ 	int reg_read_pos;
+ 
+ 	struct nandc_regs *regs;
 @@ -316,6 +331,17 @@ struct qcom_nand_host {
-	u32 clrreadstatus;
+ 	u32 clrreadstatus;
  };
-
+ 
 +/*
 + * This data type corresponds to the nand driver data which will be used at
 + * driver probe time
@@ -186,20 +185,20 @@ index 57d483a..76a0ffc 100644
 +
  static inline struct qcom_nand_host *to_qcom_nand_host(struct nand_chip *chip)
  {
-	return container_of(chip, struct qcom_nand_host, chip);
-@@ -1893,7 +1919,7 @@ static int qcom_nand_host_setup(struct qcom_nand_host *host)
-				| wide_bus << WIDE_FLASH
-				| 1 << DEV0_CFG1_ECC_DISABLE;
-
+ 	return container_of(chip, struct qcom_nand_host, chip);
+@@ -1893,7 +1919,7 @@ static int qcom_nand_host_setup(struct q
+ 				| wide_bus << WIDE_FLASH
+ 				| 1 << DEV0_CFG1_ECC_DISABLE;
+ 
 -	host->ecc_bch_cfg = host->bch_enabled << ECC_CFG_ECC_DISABLE
 +	host->ecc_bch_cfg = !host->bch_enabled << ECC_CFG_ECC_DISABLE
-				| 0 << ECC_SW_RESET
-				| host->cw_data << ECC_NUM_DATA_BYTES
-				| 1 << ECC_FORCE_CLK_OPEN
-@@ -1942,16 +1968,46 @@ static int qcom_nandc_alloc(struct qcom_nand_controller *nandc)
-	if (!nandc->regs)
-		return -ENOMEM;
-
+ 				| 0 << ECC_SW_RESET
+ 				| host->cw_data << ECC_NUM_DATA_BYTES
+ 				| 1 << ECC_FORCE_CLK_OPEN
+@@ -1942,16 +1968,46 @@ static int qcom_nandc_alloc(struct qcom_
+ 	if (!nandc->regs)
+ 		return -ENOMEM;
+ 
 -	nandc->reg_read_buf = devm_kzalloc(nandc->dev,
 -				MAX_REG_RD * sizeof(*nandc->reg_read_buf),
 -				GFP_KERNEL);
@@ -210,7 +209,7 @@ index 57d483a..76a0ffc 100644
 +					MAX_REG_RD *
 +					sizeof(*nandc->reg_read_buf),
 +					GFP_KERNEL);
-
+ 
 -	nandc->chan = dma_request_slave_channel(nandc->dev, "rxtx");
 -	if (!nandc->chan) {
 -		dev_err(nandc->dev, "failed to request slave channel\n");
@@ -249,11 +248,11 @@ index 57d483a..76a0ffc 100644
 +			dev_err(nandc->dev, "failed to request cmd channel\n");
 +			return -ENODEV;
 +		}
-	}
-
-	INIT_LIST_HEAD(&nandc->desc_list);
-@@ -1964,8 +2020,35 @@ static int qcom_nandc_alloc(struct qcom_nand_controller *nandc)
-
+ 	}
+ 
+ 	INIT_LIST_HEAD(&nandc->desc_list);
+@@ -1964,8 +2020,35 @@ static int qcom_nandc_alloc(struct qcom_
+ 
  static void qcom_nandc_unalloc(struct qcom_nand_controller *nandc)
  {
 -	dma_release_channel(nandc->chan);
@@ -287,22 +286,22 @@ index 57d483a..76a0ffc 100644
 +	if (nandc->data_buffer)
 +		devm_kfree(nandc->dev, nandc->data_buffer);
 + }
-
+ 
  /* one time setup of a few nand controller registers */
  static int qcom_nandc_setup(struct qcom_nand_controller *nandc)
-@@ -2002,6 +2085,8 @@ static int qcom_nand_host_init(struct qcom_nand_controller *nandc,
-	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs);
-	mtd->owner = THIS_MODULE;
-	mtd->dev.parent = dev;
+@@ -2002,6 +2085,8 @@ static int qcom_nand_host_init(struct qc
+ 	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs);
+ 	mtd->owner = THIS_MODULE;
+ 	mtd->dev.parent = dev;
 +	mtd->priv = chip;
 +	chip->priv = nandc;
-
-	chip->cmdfunc		= qcom_nandc_command;
-	chip->select_chip	= qcom_nandc_select_chip;
-@@ -2049,16 +2134,20 @@ static int qcom_nandc_parse_dt(struct platform_device *pdev)
-	struct device_node *np = nandc->dev->of_node;
-	int ret;
-
+ 
+ 	chip->cmdfunc		= qcom_nandc_command;
+ 	chip->select_chip	= qcom_nandc_select_chip;
+@@ -2049,16 +2134,20 @@ static int qcom_nandc_parse_dt(struct pl
+ 	struct device_node *np = nandc->dev->of_node;
+ 	int ret;
+ 
 -	ret = of_property_read_u32(np, "qcom,cmd-crci", &nandc->cmd_crci);
 -	if (ret) {
 -		dev_err(nandc->dev, "command CRCI unspecified\n");
@@ -315,7 +314,7 @@ index 57d483a..76a0ffc 100644
 +			dev_err(nandc->dev, "command CRCI unspecified\n");
 +			return ret;
 +		}
-
+ 
 -	ret = of_property_read_u32(np, "qcom,data-crci", &nandc->data_crci);
 -	if (ret) {
 -		dev_err(nandc->dev, "data CRCI unspecified\n");
@@ -326,33 +325,33 @@ index 57d483a..76a0ffc 100644
 +			dev_err(nandc->dev, "data CRCI unspecified\n");
 +			return ret;
 +		}
-	}
-
-	return 0;
-@@ -2073,6 +2162,7 @@ static int qcom_nandc_probe(struct platform_device *pdev)
-	struct device_node *dn = dev->of_node, *child;
-	struct resource *res;
-	int ret;
+ 	}
+ 
+ 	return 0;
+@@ -2073,6 +2162,7 @@ static int qcom_nandc_probe(struct platf
+ 	struct device_node *dn = dev->of_node, *child;
+ 	struct resource *res;
+ 	int ret;
 +	struct qcom_nand_driver_data *driver_data;
-
-	nandc = devm_kzalloc(&pdev->dev, sizeof(*nandc), GFP_KERNEL);
-	if (!nandc)
-@@ -2087,7 +2177,10 @@ static int qcom_nandc_probe(struct platform_device *pdev)
-		return -ENODEV;
-	}
-
+ 
+ 	nandc = devm_kzalloc(&pdev->dev, sizeof(*nandc), GFP_KERNEL);
+ 	if (!nandc)
+@@ -2087,7 +2177,10 @@ static int qcom_nandc_probe(struct platf
+ 		return -ENODEV;
+ 	}
+ 
 -	nandc->ecc_modes = (unsigned long)dev_data;
 +	driver_data = (struct qcom_nand_driver_data *)dev_data;
 +
 +	nandc->ecc_modes = driver_data->ecc_modes;
 +	nandc->dma_bam_enabled = driver_data->dma_bam_enabled;
-
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	nandc->base = devm_ioremap_resource(dev, res);
-@@ -2179,7 +2272,15 @@ static int qcom_nandc_remove(struct platform_device *pdev)
-	return 0;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	nandc->base = devm_ioremap_resource(dev, res);
+@@ -2179,7 +2272,15 @@ static int qcom_nandc_remove(struct plat
+ 	return 0;
  }
-
+ 
 -#define EBI2_NANDC_ECC_MODES	(ECC_RS_4BIT | ECC_BCH_8BIT)
 +struct qcom_nand_driver_data ebi2_nandc_bam_data = {
 +	.ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT),
@@ -363,20 +362,18 @@ index 57d483a..76a0ffc 100644
 +	.ecc_modes = (ECC_RS_4BIT | ECC_BCH_8BIT),
 +	.dma_bam_enabled = false,
 +};
-
+ 
  /*
   * data will hold a struct pointer containing more differences once we support
-@@ -2187,7 +2288,10 @@ static int qcom_nandc_remove(struct platform_device *pdev)
+@@ -2187,7 +2288,10 @@ static int qcom_nandc_remove(struct plat
   */
  static const struct of_device_id qcom_nandc_of_match[] = {
-	{	.compatible = "qcom,ipq806x-nand",
+ 	{	.compatible = "qcom,ipq806x-nand",
 -		.data = (void *)EBI2_NANDC_ECC_MODES,
 +		.data = (void *) &ebi2_nandc_data,
 +	},
 +	{	.compatible = "qcom,ebi2-nandc-bam",
 +		.data = (void *) &ebi2_nandc_bam_data,
-	},
-	{}
+ 	},
+ 	{}
  };
---
-2.7.2
diff --git a/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch b/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
index 674de77d96..84f90b48d6 100644
--- a/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
+++ b/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
@@ -26,8 +26,6 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  2 files changed, 721 insertions(+), 59 deletions(-)
  create mode 100644 include/linux/dma/qcom_bam_dma.h
 
-diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c
-index 76a0ffc..9d941e3 100644
 --- a/drivers/mtd/nand/qcom_nandc.c
 +++ b/drivers/mtd/nand/qcom_nandc.c
 @@ -22,6 +22,7 @@
@@ -35,7 +33,7 @@ index 76a0ffc..9d941e3 100644
  #include <linux/of_device.h>
  #include <linux/delay.h>
 +#include <linux/dma/qcom_bam_dma.h>
-
+ 
  /* NANDc reg offsets */
  #define	NAND_FLASH_CMD			0x00
 @@ -53,6 +54,8 @@
@@ -44,13 +42,13 @@ index 76a0ffc..9d941e3 100644
  #define	NAND_READ_LOCATION_1		0xf24
 +#define	NAND_READ_LOCATION_2		0xf28
 +#define	NAND_READ_LOCATION_3		0xf2c
-
+ 
  /* dummy register offsets, used by write_reg_dma */
  #define	NAND_DEV_CMD1_RESTORE		0xdead
 @@ -131,6 +134,11 @@
  #define	ERASED_PAGE			(PAGE_ALL_ERASED | PAGE_ERASED)
  #define	ERASED_CW			(CODEWORD_ALL_ERASED | CODEWORD_ERASED)
-
+ 
 +/* NAND_READ_LOCATION_n bits */
 +#define READ_LOCATION_OFFSET           0
 +#define READ_LOCATION_SIZE             16
@@ -62,7 +60,7 @@ index 76a0ffc..9d941e3 100644
 @@ -148,6 +156,9 @@
  #define	FETCH_ID			0xb
  #define	RESET_DEVICE			0xd
-
+ 
 +/* NAND_CTRL bits */
 +#define        BAM_MODE_EN                     BIT(0)
 +
@@ -72,7 +70,7 @@ index 76a0ffc..9d941e3 100644
 @@ -169,12 +180,77 @@
  #define	ECC_BCH_4BIT	BIT(2)
  #define	ECC_BCH_8BIT	BIT(3)
-
+ 
 +/* Flags used for BAM DMA desc preparation*/
 +/* Don't set the EOT in current tx sgl */
 +#define DMA_DESC_FLAG_NO_EOT		(0x0001)
@@ -138,19 +136,19 @@ index 76a0ffc..9d941e3 100644
 + * @bam_desc_data - used for bam desc mappings
 + */
  struct desc_info {
-	struct list_head node;
-
-	enum dma_data_direction dir;
-	struct scatterlist sgl;
-	struct dma_async_tx_descriptor *dma_desc;
+ 	struct list_head node;
+ 
+ 	enum dma_data_direction dir;
+ 	struct scatterlist sgl;
+ 	struct dma_async_tx_descriptor *dma_desc;
 +	struct qcom_bam_custom_data bam_desc_data;
  };
-
+ 
  /*
 @@ -202,6 +278,13 @@ struct nandc_regs {
-	__le32 orig_vld;
-
-	__le32 ecc_buf_cfg;
+ 	__le32 orig_vld;
+ 
+ 	__le32 ecc_buf_cfg;
 +	__le32 read_location0;
 +	__le32 read_location1;
 +	__le32 read_location2;
@@ -159,7 +157,7 @@ index 76a0ffc..9d941e3 100644
 +	__le32 erased_cw_detect_cfg_clr;
 +	__le32 erased_cw_detect_cfg_set;
  };
-
+ 
  /*
 @@ -217,6 +300,7 @@ struct nandc_regs {
   * @aon_clk:			another controller clock
@@ -171,16 +169,16 @@ index 76a0ffc..9d941e3 100644
   * @desc_list:			DMA descriptor list (list of desc_infos)
 @@ -242,6 +326,7 @@ struct nandc_regs {
  struct qcom_nand_controller {
-	struct nand_hw_control controller;
-	struct list_head host_list;
+ 	struct nand_hw_control controller;
+ 	struct list_head host_list;
 +	struct bam_transaction *bam_txn;
-
-	struct device *dev;
-
+ 
+ 	struct device *dev;
+ 
 @@ -342,6 +427,45 @@ struct qcom_nand_driver_data {
-	bool dma_bam_enabled;
+ 	bool dma_bam_enabled;
  };
-
+ 
 +/* Allocates and Initializes the BAM transaction */
 +struct bam_transaction *alloc_bam_transaction(
 +	struct qcom_nand_controller *nandc)
@@ -222,11 +220,11 @@ index 76a0ffc..9d941e3 100644
 +
  static inline struct qcom_nand_host *to_qcom_nand_host(struct nand_chip *chip)
  {
-	return container_of(chip, struct qcom_nand_host, chip);
-@@ -398,6 +522,16 @@ static __le32 *offset_to_nandc_reg(struct nandc_regs *regs, int offset)
-		return &regs->orig_vld;
-	case NAND_EBI2_ECC_BUF_CFG:
-		return &regs->ecc_buf_cfg;
+ 	return container_of(chip, struct qcom_nand_host, chip);
+@@ -398,6 +522,16 @@ static __le32 *offset_to_nandc_reg(struc
+ 		return &regs->orig_vld;
+ 	case NAND_EBI2_ECC_BUF_CFG:
+ 		return &regs->ecc_buf_cfg;
 +	case NAND_BUFFER_STATUS:
 +		return &regs->clrreadstatus;
 +	case NAND_READ_LOCATION_0:
@@ -237,48 +235,48 @@ index 76a0ffc..9d941e3 100644
 +		return &regs->read_location2;
 +	case NAND_READ_LOCATION_3:
 +		return &regs->read_location3;
-	default:
-		return NULL;
-	}
-@@ -439,7 +573,7 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
+ 	default:
+ 		return NULL;
+ 	}
+@@ -439,7 +573,7 @@ static void update_rw_regs(struct qcom_n
  {
-	struct nand_chip *chip = &host->chip;
-	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 	struct nand_chip *chip = &host->chip;
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 -	u32 cmd, cfg0, cfg1, ecc_bch_cfg;
 +	u32 cmd, cfg0, cfg1, ecc_bch_cfg, read_location0;
-
-	if (read) {
-		if (host->use_ecc)
-@@ -456,12 +590,20 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
-
-		cfg1 = host->cfg1;
-		ecc_bch_cfg = host->ecc_bch_cfg;
+ 
+ 	if (read) {
+ 		if (host->use_ecc)
+@@ -456,12 +590,20 @@ static void update_rw_regs(struct qcom_n
+ 
+ 		cfg1 = host->cfg1;
+ 		ecc_bch_cfg = host->ecc_bch_cfg;
 +		if (read)
 +			read_location0 = (0 << READ_LOCATION_OFFSET) |
 +				(host->cw_data << READ_LOCATION_SIZE) |
 +				(1 << READ_LOCATION_LAST);
-	} else {
-		cfg0 = (host->cfg0_raw & ~(7U << CW_PER_PAGE)) |
-				(num_cw - 1) << CW_PER_PAGE;
-
-		cfg1 = host->cfg1_raw;
-		ecc_bch_cfg = 1 << ECC_CFG_ECC_DISABLE;
+ 	} else {
+ 		cfg0 = (host->cfg0_raw & ~(7U << CW_PER_PAGE)) |
+ 				(num_cw - 1) << CW_PER_PAGE;
+ 
+ 		cfg1 = host->cfg1_raw;
+ 		ecc_bch_cfg = 1 << ECC_CFG_ECC_DISABLE;
 +		if (read)
 +			read_location0 = (0 << READ_LOCATION_OFFSET) |
 +				(host->cw_size << READ_LOCATION_SIZE) |
 +				(1 << READ_LOCATION_LAST);
-	}
-
-	nandc_set_reg(nandc, NAND_FLASH_CMD, cmd);
-@@ -472,8 +614,104 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
-	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
-	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
-	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
+ 	}
+ 
+ 	nandc_set_reg(nandc, NAND_FLASH_CMD, cmd);
+@@ -472,8 +614,104 @@ static void update_rw_regs(struct qcom_n
+ 	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
+ 	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
+ 	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
 +
 +	if (read)
 +		nandc_set_reg(nandc, NAND_READ_LOCATION_0, read_location0);
- }
-
++}
++
 +/*
 + * Prepares the command descriptor for BAM DMA which will be used for NAND
 + * register read and write. The command descriptor requires the command
@@ -339,8 +337,8 @@ index 76a0ffc..9d941e3 100644
 +	}
 +
 +	return 0;
-+}
-+
+ }
+ 
 +/*
 + * Prepares the data descriptor for BAM DMA which will be used for NAND
 + * data read and write.
@@ -373,25 +371,25 @@ index 76a0ffc..9d941e3 100644
 +
 +/* Prepares the dma desciptor for adm dma engine */
  static int prep_dma_desc(struct qcom_nand_controller *nandc, bool read,
-			 int reg_off, const void *vaddr, int size,
-			 bool flow_control)
-@@ -552,7 +790,7 @@ static int prep_dma_desc(struct qcom_nand_controller *nandc, bool read,
+ 			 int reg_off, const void *vaddr, int size,
+ 			 bool flow_control)
+@@ -552,7 +790,7 @@ err:
   * @num_regs:		number of registers to read
   */
  static int read_reg_dma(struct qcom_nand_controller *nandc, int first,
 -			int num_regs)
 +			int num_regs, unsigned int flags)
  {
-	bool flow_control = false;
-	void *vaddr;
-@@ -561,10 +799,18 @@ static int read_reg_dma(struct qcom_nand_controller *nandc, int first,
-	if (first == NAND_READ_ID || first == NAND_FLASH_STATUS)
-		flow_control = true;
-
+ 	bool flow_control = false;
+ 	void *vaddr;
+@@ -561,10 +799,18 @@ static int read_reg_dma(struct qcom_nand
+ 	if (first == NAND_READ_ID || first == NAND_FLASH_STATUS)
+ 		flow_control = true;
+ 
 -	size = num_regs * sizeof(u32);
-	vaddr = nandc->reg_read_buf + nandc->reg_read_pos;
-	nandc->reg_read_pos += num_regs;
-
+ 	vaddr = nandc->reg_read_buf + nandc->reg_read_pos;
+ 	nandc->reg_read_pos += num_regs;
+ 
 +	if (nandc->dma_bam_enabled) {
 +		size = num_regs;
 +
@@ -401,22 +399,22 @@ index 76a0ffc..9d941e3 100644
 +
 +	size = num_regs * sizeof(u32);
 +
-	return prep_dma_desc(nandc, true, first, vaddr, size, flow_control);
+ 	return prep_dma_desc(nandc, true, first, vaddr, size, flow_control);
  }
-
-@@ -576,7 +822,7 @@ static int read_reg_dma(struct qcom_nand_controller *nandc, int first,
+ 
+@@ -576,7 +822,7 @@ static int read_reg_dma(struct qcom_nand
   * @num_regs:		number of registers to write
   */
  static int write_reg_dma(struct qcom_nand_controller *nandc, int first,
 -			 int num_regs)
 +			 int num_regs, unsigned int flags)
  {
-	bool flow_control = false;
-	struct nandc_regs *regs = nandc->regs;
-@@ -588,12 +834,29 @@ static int write_reg_dma(struct qcom_nand_controller *nandc, int first,
-	if (first == NAND_FLASH_CMD)
-		flow_control = true;
-
+ 	bool flow_control = false;
+ 	struct nandc_regs *regs = nandc->regs;
+@@ -588,12 +834,29 @@ static int write_reg_dma(struct qcom_nan
+ 	if (first == NAND_FLASH_CMD)
+ 		flow_control = true;
+ 
 +	if (first == NAND_ERASED_CW_DETECT_CFG) {
 +		if (flags & DMA_DESC_ERASED_CW_SET)
 +			vaddr = &regs->erased_cw_detect_cfg_set;
@@ -427,12 +425,12 @@ index 76a0ffc..9d941e3 100644
 +	if (first == NAND_EXEC_CMD)
 +		flags |= DMA_DESC_FLAG_BAM_NWD;
 +
-	if (first == NAND_DEV_CMD1_RESTORE)
-		first = NAND_DEV_CMD1;
-
-	if (first == NAND_DEV_CMD_VLD_RESTORE)
-		first = NAND_DEV_CMD_VLD;
-
+ 	if (first == NAND_DEV_CMD1_RESTORE)
+ 		first = NAND_DEV_CMD1;
+ 
+ 	if (first == NAND_DEV_CMD_VLD_RESTORE)
+ 		first = NAND_DEV_CMD_VLD;
+ 
 +	if (nandc->dma_bam_enabled) {
 +		size = num_regs;
 +
@@ -440,10 +438,10 @@ index 76a0ffc..9d941e3 100644
 +						flags);
 +	}
 +
-	size = num_regs * sizeof(u32);
-
-	return prep_dma_desc(nandc, false, first, vaddr, size, flow_control);
-@@ -608,8 +871,12 @@ static int write_reg_dma(struct qcom_nand_controller *nandc, int first,
+ 	size = num_regs * sizeof(u32);
+ 
+ 	return prep_dma_desc(nandc, false, first, vaddr, size, flow_control);
+@@ -608,8 +871,12 @@ static int write_reg_dma(struct qcom_nan
   * @size:		DMA transaction size in bytes
   */
  static int read_data_dma(struct qcom_nand_controller *nandc, int reg_off,
@@ -454,10 +452,10 @@ index 76a0ffc..9d941e3 100644
 +		return prep_dma_desc_data_bam(nandc, true, reg_off, vaddr, size,
 +						flags);
 +
-	return prep_dma_desc(nandc, true, reg_off, vaddr, size, false);
+ 	return prep_dma_desc(nandc, true, reg_off, vaddr, size, false);
  }
-
-@@ -622,8 +889,12 @@ static int read_data_dma(struct qcom_nand_controller *nandc, int reg_off,
+ 
+@@ -622,8 +889,12 @@ static int read_data_dma(struct qcom_nan
   * @size:		DMA transaction size in bytes
   */
  static int write_data_dma(struct qcom_nand_controller *nandc, int reg_off,
@@ -468,17 +466,17 @@ index 76a0ffc..9d941e3 100644
 +		return prep_dma_desc_data_bam(nandc, false, reg_off, vaddr,
 +							size, flags);
 +
-	return prep_dma_desc(nandc, false, reg_off, vaddr, size, false);
+ 	return prep_dma_desc(nandc, false, reg_off, vaddr, size, false);
  }
-
-@@ -633,14 +904,57 @@ static int write_data_dma(struct qcom_nand_controller *nandc, int reg_off,
+ 
+@@ -633,14 +904,57 @@ static int write_data_dma(struct qcom_na
   */
  static void config_cw_read(struct qcom_nand_controller *nandc)
  {
 -	write_reg_dma(nandc, NAND_FLASH_CMD, 3);
 -	write_reg_dma(nandc, NAND_DEV0_CFG0, 3);
 -	write_reg_dma(nandc, NAND_EBI2_ECC_BUF_CFG, 1);
-
+ 
 -	write_reg_dma(nandc, NAND_EXEC_CMD, 1);
 +	write_reg_dma(nandc, NAND_FLASH_CMD, 3, 0);
 +	write_reg_dma(nandc, NAND_DEV0_CFG0, 3, 0);
@@ -490,10 +488,10 @@ index 76a0ffc..9d941e3 100644
 +	if (nandc->dma_bam_enabled)
 +		write_reg_dma(nandc, NAND_READ_LOCATION_0, 1,
 +				DMA_DESC_FLAG_BAM_NEXT_SGL);
-+
-
+ 
 -	read_reg_dma(nandc, NAND_FLASH_STATUS, 2);
 -	read_reg_dma(nandc, NAND_ERASED_CW_DETECT_STATUS, 1);
++
 +	write_reg_dma(nandc, NAND_EXEC_CMD, 1, DMA_DESC_FLAG_BAM_NWD |
 +				DMA_DESC_FLAG_BAM_NEXT_SGL);
 +
@@ -533,9 +531,9 @@ index 76a0ffc..9d941e3 100644
 +	read_reg_dma(nandc, NAND_ERASED_CW_DETECT_STATUS, 1,
 +				DMA_DESC_FLAG_BAM_NEXT_SGL);
  }
-
+ 
  /*
-@@ -649,19 +963,20 @@ static void config_cw_read(struct qcom_nand_controller *nandc)
+@@ -649,19 +963,20 @@ static void config_cw_read(struct qcom_n
   */
  static void config_cw_write_pre(struct qcom_nand_controller *nandc)
  {
@@ -547,137 +545,138 @@ index 76a0ffc..9d941e3 100644
 +	write_reg_dma(nandc, NAND_EBI2_ECC_BUF_CFG, 1,
 +				DMA_DESC_FLAG_BAM_NEXT_SGL);
  }
-
+ 
  static void config_cw_write_post(struct qcom_nand_controller *nandc)
  {
 -	write_reg_dma(nandc, NAND_EXEC_CMD, 1);
 +	write_reg_dma(nandc, NAND_EXEC_CMD, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
+ 
 -	read_reg_dma(nandc, NAND_FLASH_STATUS, 1);
 +	read_reg_dma(nandc, NAND_FLASH_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
+ 
 -	write_reg_dma(nandc, NAND_FLASH_STATUS, 1);
 -	write_reg_dma(nandc, NAND_READ_STATUS, 1);
 +	write_reg_dma(nandc, NAND_FLASH_STATUS, 1, 0);
 +	write_reg_dma(nandc, NAND_READ_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
  }
-
+ 
  /*
-@@ -675,6 +990,8 @@ static int nandc_param(struct qcom_nand_host *host)
-	struct nand_chip *chip = &host->chip;
-	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
-
+@@ -675,6 +990,8 @@ static int nandc_param(struct qcom_nand_
+ 	struct nand_chip *chip = &host->chip;
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 
 +	clear_bam_transaction(nandc);
 +
-	/*
-	 * NAND_CMD_PARAM is called before we know much about the FLASH chip
-	 * in use. we configure the controller to perform a raw read of 512
-@@ -708,9 +1025,13 @@ static int nandc_param(struct qcom_nand_host *host)
-
-	nandc_set_reg(nandc, NAND_DEV_CMD1_RESTORE, nandc->cmd1);
-	nandc_set_reg(nandc, NAND_DEV_CMD_VLD_RESTORE, nandc->vld);
+ 	/*
+ 	 * NAND_CMD_PARAM is called before we know much about the FLASH chip
+ 	 * in use. we configure the controller to perform a raw read of 512
+@@ -708,9 +1025,13 @@ static int nandc_param(struct qcom_nand_
+ 
+ 	nandc_set_reg(nandc, NAND_DEV_CMD1_RESTORE, nandc->cmd1);
+ 	nandc_set_reg(nandc, NAND_DEV_CMD_VLD_RESTORE, nandc->vld);
 +	nandc_set_reg(nandc, NAND_READ_LOCATION_0,
 +				(0 << READ_LOCATION_OFFSET) |
 +				(512 << READ_LOCATION_SIZE) |
 +				(1 << READ_LOCATION_LAST));
-
+ 
 -	write_reg_dma(nandc, NAND_DEV_CMD_VLD, 1);
 -	write_reg_dma(nandc, NAND_DEV_CMD1, 1);
 +	write_reg_dma(nandc, NAND_DEV_CMD_VLD, 1, 0);
 +	write_reg_dma(nandc, NAND_DEV_CMD1, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
-	nandc->buf_count = 512;
-	memset(nandc->data_buffer, 0xff, nandc->buf_count);
-@@ -718,11 +1039,12 @@ static int nandc_param(struct qcom_nand_host *host)
-	config_cw_read(nandc);
-
-	read_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
+ 
+ 	nandc->buf_count = 512;
+ 	memset(nandc->data_buffer, 0xff, nandc->buf_count);
+@@ -718,11 +1039,12 @@ static int nandc_param(struct qcom_nand_
+ 	config_cw_read(nandc);
+ 
+ 	read_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
 -		      nandc->buf_count);
 +		      nandc->buf_count, 0);
-
-	/* restore CMD1 and VLD regs */
+ 
+ 	/* restore CMD1 and VLD regs */
 -	write_reg_dma(nandc, NAND_DEV_CMD1_RESTORE, 1);
 -	write_reg_dma(nandc, NAND_DEV_CMD_VLD_RESTORE, 1);
 +	write_reg_dma(nandc, NAND_DEV_CMD1_RESTORE, 1, 0);
 +	write_reg_dma(nandc, NAND_DEV_CMD_VLD_RESTORE, 1,
 +				DMA_DESC_FLAG_BAM_NEXT_SGL);
-
-	return 0;
+ 
+ 	return 0;
  }
-@@ -733,6 +1055,8 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
-	struct nand_chip *chip = &host->chip;
-	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
-
+@@ -733,6 +1055,8 @@ static int erase_block(struct qcom_nand_
+ 	struct nand_chip *chip = &host->chip;
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 
 +	clear_bam_transaction(nandc);
 +
-	nandc_set_reg(nandc, NAND_FLASH_CMD,
-		      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
-	nandc_set_reg(nandc, NAND_ADDR0, page_addr);
-@@ -744,14 +1068,15 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
-	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
-	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
-
+ 	nandc_set_reg(nandc, NAND_FLASH_CMD,
+ 		      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+ 	nandc_set_reg(nandc, NAND_ADDR0, page_addr);
+@@ -744,14 +1068,15 @@ static int erase_block(struct qcom_nand_
+ 	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
+ 	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
+ 
 -	write_reg_dma(nandc, NAND_FLASH_CMD, 3);
 -	write_reg_dma(nandc, NAND_DEV0_CFG0, 2);
 -	write_reg_dma(nandc, NAND_EXEC_CMD, 1);
-
+ 
 -	read_reg_dma(nandc, NAND_FLASH_STATUS, 1);
 +	write_reg_dma(nandc, NAND_FLASH_CMD, 3, DMA_DESC_FLAG_BAM_NEXT_SGL);
 +	write_reg_dma(nandc, NAND_DEV0_CFG0, 2, DMA_DESC_FLAG_BAM_NEXT_SGL);
 +	write_reg_dma(nandc, NAND_EXEC_CMD, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
++
++	read_reg_dma(nandc, NAND_FLASH_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
+ 
 -	write_reg_dma(nandc, NAND_FLASH_STATUS, 1);
 -	write_reg_dma(nandc, NAND_READ_STATUS, 1);
-+	read_reg_dma(nandc, NAND_FLASH_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-+
 +	write_reg_dma(nandc, NAND_FLASH_STATUS, 1, 0);
 +	write_reg_dma(nandc, NAND_READ_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
-	return 0;
+ 
+ 	return 0;
  }
-@@ -765,16 +1090,19 @@ static int read_id(struct qcom_nand_host *host, int column)
-	if (column == -1)
-		return 0;
-
+@@ -765,16 +1090,19 @@ static int read_id(struct qcom_nand_host
+ 	if (column == -1)
+ 		return 0;
+ 
 +	clear_bam_transaction(nandc);
 +
-	nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
-	nandc_set_reg(nandc, NAND_ADDR0, column);
-	nandc_set_reg(nandc, NAND_ADDR1, 0);
+ 	nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
+ 	nandc_set_reg(nandc, NAND_ADDR0, column);
+ 	nandc_set_reg(nandc, NAND_ADDR1, 0);
 -	nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT, DM_EN);
 +	nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
 +			nandc->dma_bam_enabled ? 0 : DM_EN);
-	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
-
+ 	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
+ 
 -	write_reg_dma(nandc, NAND_FLASH_CMD, 4);
 -	write_reg_dma(nandc, NAND_EXEC_CMD, 1);
 +	write_reg_dma(nandc, NAND_FLASH_CMD, 4, DMA_DESC_FLAG_BAM_NEXT_SGL);
 +	write_reg_dma(nandc, NAND_EXEC_CMD, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
+ 
 -	read_reg_dma(nandc, NAND_READ_ID, 1);
 +	read_reg_dma(nandc, NAND_READ_ID, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-
-	return 0;
+ 
+ 	return 0;
  }
-@@ -785,15 +1113,61 @@ static int reset(struct qcom_nand_host *host)
-	struct nand_chip *chip = &host->chip;
-	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
-
+@@ -785,28 +1113,108 @@ static int reset(struct qcom_nand_host *
+ 	struct nand_chip *chip = &host->chip;
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 
 +	clear_bam_transaction(nandc);
 +
-	nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
-	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
-
+ 	nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
+ 	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
+ 
 -	write_reg_dma(nandc, NAND_FLASH_CMD, 1);
 -	write_reg_dma(nandc, NAND_EXEC_CMD, 1);
 +	write_reg_dma(nandc, NAND_FLASH_CMD, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
 +	write_reg_dma(nandc, NAND_EXEC_CMD, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-+
+ 
+-	read_reg_dma(nandc, NAND_FLASH_STATUS, 1);
 +	read_reg_dma(nandc, NAND_FLASH_STATUS, 1, DMA_DESC_FLAG_BAM_NEXT_SGL);
-+
-+	return 0;
-+}
-+
+ 
+ 	return 0;
+ }
+ 
 +static int prepare_bam_async_desc(struct qcom_nand_controller *nandc,
 +				struct dma_chan *chan,
 +				struct qcom_bam_sgl *bam_sgl,
@@ -715,19 +714,18 @@ index 76a0ffc..9d941e3 100644
 +	}
 +
 +	desc->dma_desc = dma_desc;
-
--	read_reg_dma(nandc, NAND_FLASH_STATUS, 1);
++
 +	list_add_tail(&desc->node, &nandc->desc_list);
-
-	return 0;
 +
- }
-
++	return 0;
++
++}
++
  /* helpers to submit/free our list of dma descriptors */
-@@ -801,12 +1175,46 @@ static int submit_descs(struct qcom_nand_controller *nandc)
+ static int submit_descs(struct qcom_nand_controller *nandc)
  {
-	struct desc_info *desc;
-	dma_cookie_t cookie = 0;
+ 	struct desc_info *desc;
+ 	dma_cookie_t cookie = 0;
 +	struct bam_transaction *bam_txn = nandc->bam_txn;
 +	int r;
 +
@@ -754,10 +752,10 @@ index 76a0ffc..9d941e3 100644
 +		if (r)
 +			return r;
 +	}
-
-	list_for_each_entry(desc, &nandc->desc_list, node)
-		cookie = dmaengine_submit(desc->dma_desc);
-
+ 
+ 	list_for_each_entry(desc, &nandc->desc_list, node)
+ 		cookie = dmaengine_submit(desc->dma_desc);
+ 
 -	if (dma_sync_wait(nandc->chan, cookie) != DMA_COMPLETE)
 -		return -ETIMEDOUT;
 +	if (nandc->dma_bam_enabled) {
@@ -770,13 +768,13 @@ index 76a0ffc..9d941e3 100644
 +		if (dma_sync_wait(nandc->chan, cookie) != DMA_COMPLETE)
 +			return -ETIMEDOUT;
 +	}
-
-	return 0;
+ 
+ 	return 0;
  }
-@@ -817,7 +1225,16 @@ static void free_descs(struct qcom_nand_controller *nandc)
-
-	list_for_each_entry_safe(desc, n, &nandc->desc_list, node) {
-		list_del(&desc->node);
+@@ -817,7 +1225,16 @@ static void free_descs(struct qcom_nand_
+ 
+ 	list_for_each_entry_safe(desc, n, &nandc->desc_list, node) {
+ 		list_del(&desc->node);
 -		dma_unmap_sg(nandc->dev, &desc->sgl, 1, desc->dir);
 +
 +		if (nandc->dma_bam_enabled)
@@ -788,23 +786,23 @@ index 76a0ffc..9d941e3 100644
 +			dma_unmap_sg(nandc->dev, &desc->sgl, 1,
 +				desc->dir);
 +
-		kfree(desc);
-	}
+ 		kfree(desc);
+ 	}
  }
-@@ -1128,6 +1545,9 @@ static int read_page_ecc(struct qcom_nand_host *host, u8 *data_buf,
-	struct nand_ecc_ctrl *ecc = &chip->ecc;
-	int i, ret;
-
+@@ -1128,6 +1545,9 @@ static int read_page_ecc(struct qcom_nan
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+ 	int i, ret;
+ 
 +	if (nandc->dma_bam_enabled)
 +		config_bam_page_read(nandc);
 +
-	/* queue cmd descs for each codeword */
-	for (i = 0; i < ecc->steps; i++) {
-		int data_size, oob_size;
-@@ -1141,11 +1561,36 @@ static int read_page_ecc(struct qcom_nand_host *host, u8 *data_buf,
-			oob_size = host->ecc_bytes_hw + host->spare_bytes;
-		}
-
+ 	/* queue cmd descs for each codeword */
+ 	for (i = 0; i < ecc->steps; i++) {
+ 		int data_size, oob_size;
+@@ -1141,11 +1561,36 @@ static int read_page_ecc(struct qcom_nan
+ 			oob_size = host->ecc_bytes_hw + host->spare_bytes;
+ 		}
+ 
 -		config_cw_read(nandc);
 +		if (nandc->dma_bam_enabled) {
 +			if (data_buf && oob_buf) {
@@ -832,71 +830,71 @@ index 76a0ffc..9d941e3 100644
 +		} else {
 +			config_cw_read(nandc);
 +		}
-
-		if (data_buf)
-			read_data_dma(nandc, FLASH_BUF_ACC, data_buf,
+ 
+ 		if (data_buf)
+ 			read_data_dma(nandc, FLASH_BUF_ACC, data_buf,
 -				      data_size);
 +				      data_size, 0);
-
-		/*
-		 * when ecc is enabled, the controller doesn't read the real
-@@ -1161,7 +1606,7 @@ static int read_page_ecc(struct qcom_nand_host *host, u8 *data_buf,
-				*oob_buf++ = 0xff;
-
-			read_data_dma(nandc, FLASH_BUF_ACC + data_size,
+ 
+ 		/*
+ 		 * when ecc is enabled, the controller doesn't read the real
+@@ -1161,7 +1606,7 @@ static int read_page_ecc(struct qcom_nan
+ 				*oob_buf++ = 0xff;
+ 
+ 			read_data_dma(nandc, FLASH_BUF_ACC + data_size,
 -				      oob_buf, oob_size);
 +				      oob_buf, oob_size, 0);
-		}
-
-		if (data_buf)
-@@ -1200,10 +1645,14 @@ static int copy_last_cw(struct qcom_nand_host *host, int page)
-
-	set_address(host, host->cw_size * (ecc->steps - 1), page);
-	update_rw_regs(host, 1, true);
+ 		}
+ 
+ 		if (data_buf)
+@@ -1200,10 +1645,14 @@ static int copy_last_cw(struct qcom_nand
+ 
+ 	set_address(host, host->cw_size * (ecc->steps - 1), page);
+ 	update_rw_regs(host, 1, true);
 +	nandc_set_reg(nandc, NAND_READ_LOCATION_0,
 +			(0 << READ_LOCATION_OFFSET) |
 +			(size << READ_LOCATION_SIZE) |
 +			(1 << READ_LOCATION_LAST));
-
-	config_cw_read(nandc);
-
+ 
+ 	config_cw_read(nandc);
+ 
 -	read_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, size);
 +	read_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, size, 0);
-
-	ret = submit_descs(nandc);
-	if (ret)
-@@ -1226,6 +1675,7 @@ static int qcom_nandc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
-	data_buf = buf;
-	oob_buf = oob_required ? chip->oob_poi : NULL;
-
+ 
+ 	ret = submit_descs(nandc);
+ 	if (ret)
+@@ -1226,6 +1675,7 @@ static int qcom_nandc_read_page(struct m
+ 	data_buf = buf;
+ 	oob_buf = oob_required ? chip->oob_poi : NULL;
+ 
 +	clear_bam_transaction(nandc);
-	ret = read_page_ecc(host, data_buf, oob_buf);
-	if (ret) {
-		dev_err(nandc->dev, "failure to read page\n");
-@@ -1245,13 +1695,19 @@ static int qcom_nandc_read_page_raw(struct mtd_info *mtd,
-	u8 *data_buf, *oob_buf;
-	struct nand_ecc_ctrl *ecc = &chip->ecc;
-	int i, ret;
+ 	ret = read_page_ecc(host, data_buf, oob_buf);
+ 	if (ret) {
+ 		dev_err(nandc->dev, "failure to read page\n");
+@@ -1245,13 +1695,19 @@ static int qcom_nandc_read_page_raw(stru
+ 	u8 *data_buf, *oob_buf;
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+ 	int i, ret;
 +	int read_location;
-
-	data_buf = buf;
-	oob_buf = chip->oob_poi;
-
-	host->use_ecc = false;
+ 
+ 	data_buf = buf;
+ 	oob_buf = chip->oob_poi;
+ 
+ 	host->use_ecc = false;
 +
 +	clear_bam_transaction(nandc);
-	update_rw_regs(host, ecc->steps, true);
-
+ 	update_rw_regs(host, ecc->steps, true);
+ 
 +	if (nandc->dma_bam_enabled)
 +		config_bam_page_read(nandc);
 +
-	for (i = 0; i < ecc->steps; i++) {
-		int data_size1, data_size2, oob_size1, oob_size2;
-		int reg_off = FLASH_BUF_ACC;
-@@ -1269,21 +1725,49 @@ static int qcom_nandc_read_page_raw(struct mtd_info *mtd,
-			oob_size2 = host->ecc_bytes_hw + host->spare_bytes;
-		}
-
+ 	for (i = 0; i < ecc->steps; i++) {
+ 		int data_size1, data_size2, oob_size1, oob_size2;
+ 		int reg_off = FLASH_BUF_ACC;
+@@ -1269,21 +1725,49 @@ static int qcom_nandc_read_page_raw(stru
+ 			oob_size2 = host->ecc_bytes_hw + host->spare_bytes;
+ 		}
+ 
 -		config_cw_read(nandc);
 +		if (nandc->dma_bam_enabled) {
 +			read_location = 0;
@@ -927,181 +925,181 @@ index 76a0ffc..9d941e3 100644
 +		} else {
 +			config_cw_read(nandc);
 +		}
-
+ 
 -		read_data_dma(nandc, reg_off, data_buf, data_size1);
 +		read_data_dma(nandc, reg_off, data_buf, data_size1, 0);
-		reg_off += data_size1;
-		data_buf += data_size1;
-
+ 		reg_off += data_size1;
+ 		data_buf += data_size1;
+ 
 -		read_data_dma(nandc, reg_off, oob_buf, oob_size1);
 +		read_data_dma(nandc, reg_off, oob_buf, oob_size1, 0);
-		reg_off += oob_size1;
-		oob_buf += oob_size1;
-
+ 		reg_off += oob_size1;
+ 		oob_buf += oob_size1;
+ 
 -		read_data_dma(nandc, reg_off, data_buf, data_size2);
 +		read_data_dma(nandc, reg_off, data_buf, data_size2, 0);
-		reg_off += data_size2;
-		data_buf += data_size2;
-
+ 		reg_off += data_size2;
+ 		data_buf += data_size2;
+ 
 -		read_data_dma(nandc, reg_off, oob_buf, oob_size2);
 +		read_data_dma(nandc, reg_off, oob_buf, oob_size2, 0);
-		oob_buf += oob_size2;
-	}
-
-@@ -1306,6 +1790,7 @@ static int qcom_nandc_read_oob(struct mtd_info *mtd, struct nand_chip *chip,
-	int ret;
-
-	clear_read_regs(nandc);
+ 		oob_buf += oob_size2;
+ 	}
+ 
+@@ -1306,6 +1790,7 @@ static int qcom_nandc_read_oob(struct mt
+ 	int ret;
+ 
+ 	clear_read_regs(nandc);
 +	clear_bam_transaction(nandc);
-
-	host->use_ecc = true;
-	set_address(host, 0, page);
-@@ -1329,6 +1814,7 @@ static int qcom_nandc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
-	int i, ret;
-
-	clear_read_regs(nandc);
+ 
+ 	host->use_ecc = true;
+ 	set_address(host, 0, page);
+@@ -1329,6 +1814,7 @@ static int qcom_nandc_write_page(struct
+ 	int i, ret;
+ 
+ 	clear_read_regs(nandc);
 +	clear_bam_transaction(nandc);
-
-	data_buf = (u8 *)buf;
-	oob_buf = chip->oob_poi;
-@@ -1350,7 +1836,8 @@ static int qcom_nandc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
-
-		config_cw_write_pre(nandc);
-
+ 
+ 	data_buf = (u8 *)buf;
+ 	oob_buf = chip->oob_poi;
+@@ -1350,7 +1836,8 @@ static int qcom_nandc_write_page(struct
+ 
+ 		config_cw_write_pre(nandc);
+ 
 -		write_data_dma(nandc, FLASH_BUF_ACC, data_buf, data_size);
 +		write_data_dma(nandc, FLASH_BUF_ACC, data_buf, data_size,
 +				i == (ecc->steps - 1) ? DMA_DESC_FLAG_NO_EOT : 0);
-
-		/*
-		 * when ECC is enabled, we don't really need to write anything
-@@ -1363,7 +1850,7 @@ static int qcom_nandc_write_page(struct mtd_info *mtd, struct nand_chip *chip,
-			oob_buf += host->bbm_size;
-
-			write_data_dma(nandc, FLASH_BUF_ACC + data_size,
+ 
+ 		/*
+ 		 * when ECC is enabled, we don't really need to write anything
+@@ -1363,7 +1850,7 @@ static int qcom_nandc_write_page(struct
+ 			oob_buf += host->bbm_size;
+ 
+ 			write_data_dma(nandc, FLASH_BUF_ACC + data_size,
 -				       oob_buf, oob_size);
 +				       oob_buf, oob_size, 0);
-		}
-
-		config_cw_write_post(nandc);
-@@ -1393,6 +1880,7 @@ static int qcom_nandc_write_page_raw(struct mtd_info *mtd,
-	int i, ret;
-
-	clear_read_regs(nandc);
+ 		}
+ 
+ 		config_cw_write_post(nandc);
+@@ -1393,6 +1880,7 @@ static int qcom_nandc_write_page_raw(str
+ 	int i, ret;
+ 
+ 	clear_read_regs(nandc);
 +	clear_bam_transaction(nandc);
-
-	data_buf = (u8 *)buf;
-	oob_buf = chip->oob_poi;
-@@ -1419,19 +1907,22 @@ static int qcom_nandc_write_page_raw(struct mtd_info *mtd,
-
-		config_cw_write_pre(nandc);
-
+ 
+ 	data_buf = (u8 *)buf;
+ 	oob_buf = chip->oob_poi;
+@@ -1419,19 +1907,22 @@ static int qcom_nandc_write_page_raw(str
+ 
+ 		config_cw_write_pre(nandc);
+ 
 -		write_data_dma(nandc, reg_off, data_buf, data_size1);
 +		write_data_dma(nandc, reg_off, data_buf, data_size1,
 +					DMA_DESC_FLAG_NO_EOT);
-		reg_off += data_size1;
-		data_buf += data_size1;
-
+ 		reg_off += data_size1;
+ 		data_buf += data_size1;
+ 
 -		write_data_dma(nandc, reg_off, oob_buf, oob_size1);
 +		write_data_dma(nandc, reg_off, oob_buf, oob_size1,
 +					DMA_DESC_FLAG_NO_EOT);
-		reg_off += oob_size1;
-		oob_buf += oob_size1;
-
+ 		reg_off += oob_size1;
+ 		oob_buf += oob_size1;
+ 
 -		write_data_dma(nandc, reg_off, data_buf, data_size2);
 +		write_data_dma(nandc, reg_off, data_buf, data_size2,
 +					DMA_DESC_FLAG_NO_EOT);
-		reg_off += data_size2;
-		data_buf += data_size2;
-
+ 		reg_off += data_size2;
+ 		data_buf += data_size2;
+ 
 -		write_data_dma(nandc, reg_off, oob_buf, oob_size2);
 +		write_data_dma(nandc, reg_off, oob_buf, oob_size2, 0);
-		oob_buf += oob_size2;
-
-		config_cw_write_post(nandc);
-@@ -1467,6 +1958,7 @@ static int qcom_nandc_write_oob(struct mtd_info *mtd, struct nand_chip *chip,
-
-	host->use_ecc = true;
-
+ 		oob_buf += oob_size2;
+ 
+ 		config_cw_write_post(nandc);
+@@ -1467,6 +1958,7 @@ static int qcom_nandc_write_oob(struct m
+ 
+ 	host->use_ecc = true;
+ 
 +	clear_bam_transaction(nandc);
-	ret = copy_last_cw(host, page);
-	if (ret)
-		return ret;
-@@ -1486,7 +1978,7 @@ static int qcom_nandc_write_oob(struct mtd_info *mtd, struct nand_chip *chip,
-
-	config_cw_write_pre(nandc);
-	write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
+ 	ret = copy_last_cw(host, page);
+ 	if (ret)
+ 		return ret;
+@@ -1486,7 +1978,7 @@ static int qcom_nandc_write_oob(struct m
+ 
+ 	config_cw_write_pre(nandc);
+ 	write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
 -		       data_size + oob_size);
 +		       data_size + oob_size, 0);
-	config_cw_write_post(nandc);
-
-	ret = submit_descs(nandc);
-@@ -1524,6 +2016,7 @@ static int qcom_nandc_block_bad(struct mtd_info *mtd, loff_t ofs)
-	 */
-	host->use_ecc = false;
-
+ 	config_cw_write_post(nandc);
+ 
+ 	ret = submit_descs(nandc);
+@@ -1524,6 +2016,7 @@ static int qcom_nandc_block_bad(struct m
+ 	 */
+ 	host->use_ecc = false;
+ 
 +	clear_bam_transaction(nandc);
-	ret = copy_last_cw(host, page);
-	if (ret)
-		goto err;
-@@ -1554,6 +2047,7 @@ static int qcom_nandc_block_markbad(struct mtd_info *mtd, loff_t ofs)
-	int page, ret, status = 0;
-
-	clear_read_regs(nandc);
+ 	ret = copy_last_cw(host, page);
+ 	if (ret)
+ 		goto err;
+@@ -1554,6 +2047,7 @@ static int qcom_nandc_block_markbad(stru
+ 	int page, ret, status = 0;
+ 
+ 	clear_read_regs(nandc);
 +	clear_bam_transaction(nandc);
-
-	/*
-	 * to mark the BBM as bad, we flash the entire last codeword with 0s.
-@@ -1570,7 +2064,8 @@ static int qcom_nandc_block_markbad(struct mtd_info *mtd, loff_t ofs)
-	update_rw_regs(host, 1, false);
-
-	config_cw_write_pre(nandc);
+ 
+ 	/*
+ 	 * to mark the BBM as bad, we flash the entire last codeword with 0s.
+@@ -1570,7 +2064,8 @@ static int qcom_nandc_block_markbad(stru
+ 	update_rw_regs(host, 1, false);
+ 
+ 	config_cw_write_pre(nandc);
 -	write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, host->cw_size);
 +	write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
 +				host->cw_size, 0);
-	config_cw_write_post(nandc);
-
-	ret = submit_descs(nandc);
-@@ -1930,6 +2425,8 @@ static int qcom_nand_host_setup(struct qcom_nand_host *host)
-
-	host->clrflashstatus = FS_READY_BSY_N;
-	host->clrreadstatus = 0xc0;
+ 	config_cw_write_post(nandc);
+ 
+ 	ret = submit_descs(nandc);
+@@ -1930,6 +2425,8 @@ static int qcom_nand_host_setup(struct q
+ 
+ 	host->clrflashstatus = FS_READY_BSY_N;
+ 	host->clrreadstatus = 0xc0;
 +	nandc->regs->erased_cw_detect_cfg_clr = CLR_ERASED_PAGE_DET;
 +	nandc->regs->erased_cw_detect_cfg_set = SET_ERASED_PAGE_DET;
-
-	dev_dbg(nandc->dev,
-		"cfg0 %x cfg1 %x ecc_buf_cfg %x ecc_bch cfg %x cw_size %d cw_data %d strength %d parity_bytes %d steps %d\n",
-@@ -2008,6 +2505,12 @@ static int qcom_nandc_alloc(struct qcom_nand_controller *nandc)
-			dev_err(nandc->dev, "failed to request cmd channel\n");
-			return -ENODEV;
-		}
+ 
+ 	dev_dbg(nandc->dev,
+ 		"cfg0 %x cfg1 %x ecc_buf_cfg %x ecc_bch cfg %x cw_size %d cw_data %d strength %d parity_bytes %d steps %d\n",
+@@ -2008,6 +2505,12 @@ static int qcom_nandc_alloc(struct qcom_
+ 			dev_err(nandc->dev, "failed to request cmd channel\n");
+ 			return -ENODEV;
+ 		}
 +
 +		nandc->bam_txn = alloc_bam_transaction(nandc);
 +		if (!nandc->bam_txn) {
 +			dev_err(nandc->dev, "failed to allocate bam transaction\n");
 +			return -ENOMEM;
 +		}
-	}
-
-	INIT_LIST_HEAD(&nandc->desc_list);
-@@ -2043,6 +2546,9 @@ static void qcom_nandc_unalloc(struct qcom_nand_controller *nandc)
-			devm_kfree(nandc->dev, nandc->reg_read_buf);
-	}
-
+ 	}
+ 
+ 	INIT_LIST_HEAD(&nandc->desc_list);
+@@ -2043,6 +2546,9 @@ static void qcom_nandc_unalloc(struct qc
+ 			devm_kfree(nandc->dev, nandc->reg_read_buf);
+ 	}
+ 
 +	if (nandc->bam_txn)
 +		devm_kfree(nandc->dev, nandc->bam_txn);
 +
-	if (nandc->regs)
-		devm_kfree(nandc->dev, nandc->regs);
-
-@@ -2053,11 +2559,18 @@ static void qcom_nandc_unalloc(struct qcom_nand_controller *nandc)
+ 	if (nandc->regs)
+ 		devm_kfree(nandc->dev, nandc->regs);
+ 
+@@ -2053,11 +2559,18 @@ static void qcom_nandc_unalloc(struct qc
  /* one time setup of a few nand controller registers */
  static int qcom_nandc_setup(struct qcom_nand_controller *nandc)
  {
 +	u32 nand_ctrl;
 +
-	/* kill onenand */
-	nandc_write(nandc, SFLASHC_BURST_CFG, 0);
-
+ 	/* kill onenand */
+ 	nandc_write(nandc, SFLASHC_BURST_CFG, 0);
+ 
 -	/* enable ADM DMA */
 -	nandc_write(nandc, NAND_FLASH_CHIP_SELECT, DM_EN);
 +	/* enable ADM or BAM DMA */
@@ -1111,12 +1109,9 @@ index 76a0ffc..9d941e3 100644
 +		nand_ctrl = nandc_read(nandc, NAND_CTRL);
 +		nandc_write(nandc, NAND_CTRL, nand_ctrl | BAM_MODE_EN);
 +	}
-
-	/* save the original values of these registers */
-	nandc->cmd1 = nandc_read(nandc, NAND_DEV_CMD1);
-diff --git a/include/linux/dma/qcom_bam_dma.h b/include/linux/dma/qcom_bam_dma.h
-new file mode 100644
-index 0000000..7e87a85
+ 
+ 	/* save the original values of these registers */
+ 	nandc->cmd1 = nandc_read(nandc, NAND_DEV_CMD1);
 --- /dev/null
 +++ b/include/linux/dma/qcom_bam_dma.h
 @@ -0,0 +1,149 @@
@@ -1269,5 +1264,3 @@ index 0000000..7e87a85
 +	bam_ce->mask = 0xFFFFFFFF;
 +}
 +#endif
---
-2.7.2
diff --git a/target/linux/ipq806x/patches-4.9/862-dmaengine-qcom-bam_dma-Add-custom-data-mapping.patch b/target/linux/ipq806x/patches-4.9/862-dmaengine-qcom-bam_dma-Add-custom-data-mapping.patch
index 3b26120947..796938f2d0 100644
--- a/target/linux/ipq806x/patches-4.9/862-dmaengine-qcom-bam_dma-Add-custom-data-mapping.patch
+++ b/target/linux/ipq806x/patches-4.9/862-dmaengine-qcom-bam_dma-Add-custom-data-mapping.patch
@@ -14,8 +14,6 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  include/linux/dmaengine.h        | 14 ++++++
  3 files changed, 119 insertions(+), 6 deletions(-)
 
-diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
-index 03c4eb3..bde8d70 100644
 --- a/drivers/dma/qcom/bam_dma.c
 +++ b/drivers/dma/qcom/bam_dma.c
 @@ -49,6 +49,7 @@
@@ -23,24 +21,24 @@ index 03c4eb3..bde8d70 100644
  #include <linux/dmaengine.h>
  #include <linux/pm_runtime.h>
 +#include <linux/dma/qcom_bam_dma.h>
-
+ 
  #include "../dmaengine.h"
  #include "../virt-dma.h"
 @@ -61,11 +62,6 @@ struct bam_desc_hw {
-
+ 
  #define BAM_DMA_AUTOSUSPEND_DELAY 100
-
+ 
 -#define DESC_FLAG_INT BIT(15)
 -#define DESC_FLAG_EOT BIT(14)
 -#define DESC_FLAG_EOB BIT(13)
 -#define DESC_FLAG_NWD BIT(12)
 -
  struct bam_async_desc {
-	struct virt_dma_desc vd;
-
-@@ -670,6 +666,93 @@ static struct dma_async_tx_descriptor *bam_prep_slave_sg(struct dma_chan *chan,
+ 	struct virt_dma_desc vd;
+ 
+@@ -670,6 +666,93 @@ err_out:
  }
-
+ 
  /**
 + * bam_prep_dma_custom_mapping - Prep DMA descriptor from custom data
 + *
@@ -132,31 +130,29 @@ index 03c4eb3..bde8d70 100644
   * bam_dma_terminate_all - terminate all transactions on a channel
   * @bchan: bam dma channel
   *
-@@ -960,7 +1043,7 @@ static void bam_start_dma(struct bam_chan *bchan)
-
-	/* set any special flags on the last descriptor */
-	if (async_desc->num_desc == async_desc->xfer_len)
+@@ -960,7 +1043,7 @@ static void bam_start_dma(struct bam_cha
+ 
+ 	/* set any special flags on the last descriptor */
+ 	if (async_desc->num_desc == async_desc->xfer_len)
 -		desc[async_desc->xfer_len - 1].flags =
 +		desc[async_desc->xfer_len - 1].flags |=
-					cpu_to_le16(async_desc->flags);
-	else
-		desc[async_desc->xfer_len - 1].flags |=
-@@ -1237,6 +1320,8 @@ static int bam_dma_probe(struct platform_device *pdev)
-	bdev->common.device_alloc_chan_resources = bam_alloc_chan;
-	bdev->common.device_free_chan_resources = bam_free_chan;
-	bdev->common.device_prep_slave_sg = bam_prep_slave_sg;
+ 					cpu_to_le16(async_desc->flags);
+ 	else
+ 		desc[async_desc->xfer_len - 1].flags |=
+@@ -1237,6 +1320,8 @@ static int bam_dma_probe(struct platform
+ 	bdev->common.device_alloc_chan_resources = bam_alloc_chan;
+ 	bdev->common.device_free_chan_resources = bam_free_chan;
+ 	bdev->common.device_prep_slave_sg = bam_prep_slave_sg;
 +	bdev->common.device_prep_dma_custom_mapping =
 +		bam_prep_dma_custom_mapping;
-	bdev->common.device_config = bam_slave_config;
-	bdev->common.device_pause = bam_pause;
-	bdev->common.device_resume = bam_resume;
-diff --git a/include/linux/dma/qcom_bam_dma.h b/include/linux/dma/qcom_bam_dma.h
-index 7e87a85..7113c77 100644
+ 	bdev->common.device_config = bam_slave_config;
+ 	bdev->common.device_pause = bam_pause;
+ 	bdev->common.device_resume = bam_resume;
 --- a/include/linux/dma/qcom_bam_dma.h
 +++ b/include/linux/dma/qcom_bam_dma.h
 @@ -65,6 +65,19 @@ enum bam_command_type {
  };
-
+ 
  /*
 + * QCOM BAM DMA custom data
 + *
@@ -174,8 +170,6 @@ index 7e87a85..7113c77 100644
   * qcom_bam_sg_init_table - Init QCOM BAM SGL
   * @bam_sgl: bam sgl
   * @nents: number of entries in bam sgl
-diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
-index cc535a4..627c125 100644
 --- a/include/linux/dmaengine.h
 +++ b/include/linux/dmaengine.h
 @@ -692,6 +692,8 @@ struct dma_filter {
@@ -188,19 +182,19 @@ index cc535a4..627c125 100644
   *	code
   * @device_pause: Pauses any transfer happening on a channel. Returns
 @@ -783,6 +785,9 @@ struct dma_device {
-	struct dma_async_tx_descriptor *(*device_prep_dma_imm_data)(
-		struct dma_chan *chan, dma_addr_t dst, u64 data,
-		unsigned long flags);
+ 	struct dma_async_tx_descriptor *(*device_prep_dma_imm_data)(
+ 		struct dma_chan *chan, dma_addr_t dst, u64 data,
+ 		unsigned long flags);
 +	struct dma_async_tx_descriptor *(*device_prep_dma_custom_mapping)(
 +		struct dma_chan *chan, void *data,
 +		unsigned long flags);
-
-	int (*device_config)(struct dma_chan *chan,
-			     struct dma_slave_config *config);
-@@ -899,6 +904,15 @@ static inline struct dma_async_tx_descriptor *dmaengine_prep_dma_sg(
-			src_sg, src_nents, flags);
+ 
+ 	int (*device_config)(struct dma_chan *chan,
+ 			     struct dma_slave_config *config);
+@@ -899,6 +904,15 @@ static inline struct dma_async_tx_descri
+ 			src_sg, src_nents, flags);
  }
-
+ 
 +static inline struct dma_async_tx_descriptor *dmaengine_prep_dma_custom_mapping(
 +		struct dma_chan *chan,
 +		void *data,
@@ -213,5 +207,3 @@ index cc535a4..627c125 100644
  /**
   * dmaengine_terminate_all() - Terminate all active DMA transfers
   * @chan: The channel for which to terminate the transfers
---
-2.7.2
diff --git a/target/linux/ipq806x/patches-4.9/863-dts-ipq4019-add-nand-and-qpic-bam-dma-node.patch b/target/linux/ipq806x/patches-4.9/863-dts-ipq4019-add-nand-and-qpic-bam-dma-node.patch
index 44e162bac8..62153b3cde 100644
--- a/target/linux/ipq806x/patches-4.9/863-dts-ipq4019-add-nand-and-qpic-bam-dma-node.patch
+++ b/target/linux/ipq806x/patches-4.9/863-dts-ipq4019-add-nand-and-qpic-bam-dma-node.patch
@@ -13,14 +13,12 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  arch/arm/boot/dts/qcom-ipq4019.dtsi           | 38 ++++++++++++++
  2 files changed, 113 insertions(+)
 
-diff --git a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
-index 09fb047..e94954e 100644
 --- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
 +++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
-@@ -101,6 +101,86 @@
-					bias-bus-hold;
-				};
-			};
+@@ -88,6 +88,86 @@
+ 					bias-disable;
+ 				};
+ 			};
 +
 +			nand_pins: nand_pins {
 +
@@ -101,13 +99,13 @@ index 09fb047..e94954e 100644
 +					bias-pull-down;
 +				};
 +			};
-		};
-
-		blsp_dma: dma@7884000 {
-@@ -204,5 +269,15 @@
-		wifi@a800000 {
-			status = "ok";
-		};
+ 		};
+ 
+ 		blsp_dma: dma@7884000 {
+@@ -159,5 +239,15 @@
+ 		watchdog@b017000 {
+ 			status = "ok";
+ 		};
 +
 +		qpic_bam: dma@7984000 {
 +			status = "ok";
@@ -118,16 +116,14 @@ index 09fb047..e94954e 100644
 +			pinctrl-names = "default";
 +			status = "ok";
 +		};
-	};
+ 	};
  };
-diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
-index 52a64e7..740808b 100644
 --- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
 +++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
-@@ -593,5 +593,43 @@
-					  "legacy";
-			status = "disabled";
-		};
+@@ -586,5 +586,43 @@
+ 					  "legacy";
+ 			status = "disabled";
+ 		};
 +
 +		qpic_bam: dma@7984000 {
 +			compatible = "qcom,bam-v1.7.0";
@@ -166,7 +162,5 @@ index 52a64e7..740808b 100644
 +				nand-bus-width = <8>;
 +			};
 +		};
-	};
+ 	};
  };
---
-2.7.2