1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* NAND flash simulator.
4	*
5	* Author: Artem B. Bityuckiy <dedekind@oktetlabs.ru>, <dedekind@infradead.org>
6	*
7	* Copyright (C) 2004 Nokia Corporation
8	*
9	* Note: NS means "NAND Simulator".
10	* Note: Input means input TO flash chip, output means output FROM chip.
11	*/
12
13	#define pr_fmt(fmt) "[nandsim]" fmt
14
15	#include <linux/init.h>
16	#include <linux/types.h>
17	#include <linux/module.h>
18	#include <linux/moduleparam.h>
19	#include <linux/vmalloc.h>
20	#include <linux/math64.h>
21	#include <linux/slab.h>
22	#include <linux/errno.h>
23	#include <linux/string.h>
24	#include <linux/mtd/mtd.h>
25	#include <linux/mtd/rawnand.h>
26	#include <linux/mtd/partitions.h>
27	#include <linux/delay.h>
28	#include <linux/list.h>
29	#include <linux/random.h>
30	#include <linux/sched.h>
31	#include <linux/sched/mm.h>
32	#include <linux/fs.h>
33	#include <linux/pagemap.h>
34	#include <linux/seq_file.h>
35	#include <linux/debugfs.h>
36
37	/* Default simulator parameters values */
38	#if !defined(CONFIG_NANDSIM_FIRST_ID_BYTE) || \
39	!defined(CONFIG_NANDSIM_SECOND_ID_BYTE) || \
40	!defined(CONFIG_NANDSIM_THIRD_ID_BYTE) || \
41	!defined(CONFIG_NANDSIM_FOURTH_ID_BYTE)
42	#define CONFIG_NANDSIM_FIRST_ID_BYTE 0x98
43	#define CONFIG_NANDSIM_SECOND_ID_BYTE 0x39
44	#define CONFIG_NANDSIM_THIRD_ID_BYTE 0xFF /* No byte */
45	#define CONFIG_NANDSIM_FOURTH_ID_BYTE 0xFF /* No byte */
46	#endif
47
48	#ifndef CONFIG_NANDSIM_ACCESS_DELAY
49	#define CONFIG_NANDSIM_ACCESS_DELAY 25
50	#endif
51	#ifndef CONFIG_NANDSIM_PROGRAMM_DELAY
52	#define CONFIG_NANDSIM_PROGRAMM_DELAY 200
53	#endif
54	#ifndef CONFIG_NANDSIM_ERASE_DELAY
55	#define CONFIG_NANDSIM_ERASE_DELAY 2
56	#endif
57	#ifndef CONFIG_NANDSIM_OUTPUT_CYCLE
58	#define CONFIG_NANDSIM_OUTPUT_CYCLE 40
59	#endif
60	#ifndef CONFIG_NANDSIM_INPUT_CYCLE
61	#define CONFIG_NANDSIM_INPUT_CYCLE 50
62	#endif
63	#ifndef CONFIG_NANDSIM_BUS_WIDTH
64	#define CONFIG_NANDSIM_BUS_WIDTH 8
65	#endif
66	#ifndef CONFIG_NANDSIM_DO_DELAYS
67	#define CONFIG_NANDSIM_DO_DELAYS 0
68	#endif
69	#ifndef CONFIG_NANDSIM_LOG
70	#define CONFIG_NANDSIM_LOG 0
71	#endif
72	#ifndef CONFIG_NANDSIM_DBG
73	#define CONFIG_NANDSIM_DBG 0
74	#endif
75	#ifndef CONFIG_NANDSIM_MAX_PARTS
76	#define CONFIG_NANDSIM_MAX_PARTS 32
77	#endif
78
79	static uint access_delay = CONFIG_NANDSIM_ACCESS_DELAY;
80	static uint programm_delay = CONFIG_NANDSIM_PROGRAMM_DELAY;
81	static uint erase_delay = CONFIG_NANDSIM_ERASE_DELAY;
82	static uint output_cycle = CONFIG_NANDSIM_OUTPUT_CYCLE;
83	static uint input_cycle = CONFIG_NANDSIM_INPUT_CYCLE;
84	static uint bus_width = CONFIG_NANDSIM_BUS_WIDTH;
85	static uint do_delays = CONFIG_NANDSIM_DO_DELAYS;
86	static uint log = CONFIG_NANDSIM_LOG;
87	static uint dbg = CONFIG_NANDSIM_DBG;
88	static unsigned long parts[CONFIG_NANDSIM_MAX_PARTS];
89	static unsigned int parts_num;
90	static char *badblocks = NULL;
91	static char *weakblocks = NULL;
92	static char *weakpages = NULL;
93	static unsigned int bitflips = 0;
94	static char *gravepages = NULL;
95	static unsigned int overridesize = 0;
96	static char *cache_file = NULL;
97	static unsigned int bbt;
98	static unsigned int bch;
99	static u_char id_bytes[8] = {
100	[0] = CONFIG_NANDSIM_FIRST_ID_BYTE,
101	[1] = CONFIG_NANDSIM_SECOND_ID_BYTE,
102	[2] = CONFIG_NANDSIM_THIRD_ID_BYTE,
103	[3] = CONFIG_NANDSIM_FOURTH_ID_BYTE,
104	[4 ... 7] = 0xFF,
105	};
106
107	module_param_array(id_bytes, byte, NULL, 0400);
108	module_param_named(first_id_byte, id_bytes[0], byte, 0400);
109	module_param_named(second_id_byte, id_bytes[1], byte, 0400);
110	module_param_named(third_id_byte, id_bytes[2], byte, 0400);
111	module_param_named(fourth_id_byte, id_bytes[3], byte, 0400);
112	module_param(access_delay, uint, 0400);
113	module_param(programm_delay, uint, 0400);
114	module_param(erase_delay, uint, 0400);
115	module_param(output_cycle, uint, 0400);
116	module_param(input_cycle, uint, 0400);
117	module_param(bus_width, uint, 0400);
118	module_param(do_delays, uint, 0400);
119	module_param(log, uint, 0400);
120	module_param(dbg, uint, 0400);
121	module_param_array(parts, ulong, &parts_num, 0400);
122	module_param(badblocks, charp, 0400);
123	module_param(weakblocks, charp, 0400);
124	module_param(weakpages, charp, 0400);
125	module_param(bitflips, uint, 0400);
126	module_param(gravepages, charp, 0400);
127	module_param(overridesize, uint, 0400);
128	module_param(cache_file, charp, 0400);
129	module_param(bbt, uint, 0400);
130	module_param(bch, uint, 0400);
131
132	MODULE_PARM_DESC(id_bytes, "The ID bytes returned by NAND Flash 'read ID' command");
133	MODULE_PARM_DESC(first_id_byte, "The first byte returned by NAND Flash 'read ID' command (manufacturer ID) (obsolete)");
134	MODULE_PARM_DESC(second_id_byte, "The second byte returned by NAND Flash 'read ID' command (chip ID) (obsolete)");
135	MODULE_PARM_DESC(third_id_byte, "The third byte returned by NAND Flash 'read ID' command (obsolete)");
136	MODULE_PARM_DESC(fourth_id_byte, "The fourth byte returned by NAND Flash 'read ID' command (obsolete)");
137	MODULE_PARM_DESC(access_delay, "Initial page access delay (microseconds)");
138	MODULE_PARM_DESC(programm_delay, "Page programm delay (microseconds");
139	MODULE_PARM_DESC(erase_delay, "Sector erase delay (milliseconds)");
140	MODULE_PARM_DESC(output_cycle, "Word output (from flash) time (nanoseconds)");
141	MODULE_PARM_DESC(input_cycle, "Word input (to flash) time (nanoseconds)");
142	MODULE_PARM_DESC(bus_width, "Chip's bus width (8- or 16-bit)");
143	MODULE_PARM_DESC(do_delays, "Simulate NAND delays using busy-waits if not zero");
144	MODULE_PARM_DESC(log, "Perform logging if not zero");
145	MODULE_PARM_DESC(dbg, "Output debug information if not zero");
146	MODULE_PARM_DESC(parts, "Partition sizes (in erase blocks) separated by commas");
147	/* Page and erase block positions for the following parameters are independent of any partitions */
148	MODULE_PARM_DESC(badblocks, "Erase blocks that are initially marked bad, separated by commas");
149	MODULE_PARM_DESC(weakblocks, "Weak erase blocks [: remaining erase cycles (defaults to 3)]"
150	" separated by commas e.g. 113:2 means eb 113"
151	" can be erased only twice before failing");
152	MODULE_PARM_DESC(weakpages, "Weak pages [: maximum writes (defaults to 3)]"
153	" separated by commas e.g. 1401:2 means page 1401"
154	" can be written only twice before failing");
155	MODULE_PARM_DESC(bitflips, "Maximum number of random bit flips per page (zero by default)");
156	MODULE_PARM_DESC(gravepages, "Pages that lose data [: maximum reads (defaults to 3)]"
157	" separated by commas e.g. 1401:2 means page 1401"
158	" can be read only twice before failing");
159	MODULE_PARM_DESC(overridesize, "Specifies the NAND Flash size overriding the ID bytes. "
160	"The size is specified in erase blocks and as the exponent of a power of two"
161	" e.g. 5 means a size of 32 erase blocks");
162	MODULE_PARM_DESC(cache_file, "File to use to cache nand pages instead of memory");
163	MODULE_PARM_DESC(bbt, "0 OOB, 1 BBT with marker in OOB, 2 BBT with marker in data area");
164	MODULE_PARM_DESC(bch, "Enable BCH ecc and set how many bits should "
165	"be correctable in 512-byte blocks");
166
167	/* The largest possible page size */
168	#define NS_LARGEST_PAGE_SIZE 4096
169
170	/* Simulator's output macros (logging, debugging, warning, error) */
171	#define NS_LOG(args...) \
172	do { if (log) pr_debug(" log: " args); } while(0)
173	#define NS_DBG(args...) \
174	do { if (dbg) pr_debug(" debug: " args); } while(0)
175	#define NS_WARN(args...) \
176	do { pr_warn(" warning: " args); } while(0)
177	#define NS_ERR(args...) \
178	do { pr_err(" error: " args); } while(0)
179	#define NS_INFO(args...) \
180	do { pr_info(" " args); } while(0)
181
182	/* Busy-wait delay macros (microseconds, milliseconds) */
183	#define NS_UDELAY(us) \
184	do { if (do_delays) udelay(us); } while(0)
185	#define NS_MDELAY(us) \
186	do { if (do_delays) mdelay(us); } while(0)
187
188	/* Is the nandsim structure initialized ? */
189	#define NS_IS_INITIALIZED(ns) ((ns)->geom.totsz != 0)
190
191	/* Good operation completion status */
192	#define NS_STATUS_OK(ns) (NAND_STATUS_READY | (NAND_STATUS_WP * ((ns)->lines.wp == 0)))
193
194	/* Operation failed completion status */
195	#define NS_STATUS_FAILED(ns) (NAND_STATUS_FAIL | NS_STATUS_OK(ns))
196
197	/* Calculate the page offset in flash RAM image by (row, column) address */
198	#define NS_RAW_OFFSET(ns) \
199	(((ns)->regs.row * (ns)->geom.pgszoob) + (ns)->regs.column)
200
201	/* Calculate the OOB offset in flash RAM image by (row, column) address */
202	#define NS_RAW_OFFSET_OOB(ns) (NS_RAW_OFFSET(ns) + ns->geom.pgsz)
203
204	/* Calculate the byte shift in the next page to access */
205	#define NS_PAGE_BYTE_SHIFT(ns) ((ns)->regs.column + (ns)->regs.off)
206
207	/* After a command is input, the simulator goes to one of the following states */
208	#define STATE_CMD_READ0 0x00000001 /* read data from the beginning of page */
209	#define STATE_CMD_READ1 0x00000002 /* read data from the second half of page */
210	#define STATE_CMD_READSTART 0x00000003 /* read data second command (large page devices) */
211	#define STATE_CMD_PAGEPROG 0x00000004 /* start page program */
212	#define STATE_CMD_READOOB 0x00000005 /* read OOB area */
213	#define STATE_CMD_ERASE1 0x00000006 /* sector erase first command */
214	#define STATE_CMD_STATUS 0x00000007 /* read status */
215	#define STATE_CMD_SEQIN 0x00000009 /* sequential data input */
216	#define STATE_CMD_READID 0x0000000A /* read ID */
217	#define STATE_CMD_ERASE2 0x0000000B /* sector erase second command */
218	#define STATE_CMD_RESET 0x0000000C /* reset */
219	#define STATE_CMD_RNDOUT 0x0000000D /* random output command */
220	#define STATE_CMD_RNDOUTSTART 0x0000000E /* random output start command */
221	#define STATE_CMD_MASK 0x0000000F /* command states mask */
222
223	/* After an address is input, the simulator goes to one of these states */
224	#define STATE_ADDR_PAGE 0x00000010 /* full (row, column) address is accepted */
225	#define STATE_ADDR_SEC 0x00000020 /* sector address was accepted */
226	#define STATE_ADDR_COLUMN 0x00000030 /* column address was accepted */
227	#define STATE_ADDR_ZERO 0x00000040 /* one byte zero address was accepted */
228	#define STATE_ADDR_MASK 0x00000070 /* address states mask */
229
230	/* During data input/output the simulator is in these states */
231	#define STATE_DATAIN 0x00000100 /* waiting for data input */
232	#define STATE_DATAIN_MASK 0x00000100 /* data input states mask */
233
234	#define STATE_DATAOUT 0x00001000 /* waiting for page data output */
235	#define STATE_DATAOUT_ID 0x00002000 /* waiting for ID bytes output */
236	#define STATE_DATAOUT_STATUS 0x00003000 /* waiting for status output */
237	#define STATE_DATAOUT_MASK 0x00007000 /* data output states mask */
238
239	/* Previous operation is done, ready to accept new requests */
240	#define STATE_READY 0x00000000
241
242	/* This state is used to mark that the next state isn't known yet */
243	#define STATE_UNKNOWN 0x10000000
244
245	/* Simulator's actions bit masks */
246	#define ACTION_CPY 0x00100000 /* copy page/OOB to the internal buffer */
247	#define ACTION_PRGPAGE 0x00200000 /* program the internal buffer to flash */
248	#define ACTION_SECERASE 0x00300000 /* erase sector */
249	#define ACTION_ZEROOFF 0x00400000 /* don't add any offset to address */
250	#define ACTION_HALFOFF 0x00500000 /* add to address half of page */
251	#define ACTION_OOBOFF 0x00600000 /* add to address OOB offset */
252	#define ACTION_MASK 0x00700000 /* action mask */
253
254	#define NS_OPER_NUM 13 /* Number of operations supported by the simulator */
255	#define NS_OPER_STATES 6 /* Maximum number of states in operation */
256
257	#define OPT_ANY 0xFFFFFFFF /* any chip supports this operation */
258	#define OPT_PAGE512 0x00000002 /* 512-byte page chips */
259	#define OPT_PAGE2048 0x00000008 /* 2048-byte page chips */
260	#define OPT_PAGE512_8BIT 0x00000040 /* 512-byte page chips with 8-bit bus width */
261	#define OPT_PAGE4096 0x00000080 /* 4096-byte page chips */
262	#define OPT_LARGEPAGE (OPT_PAGE2048 | OPT_PAGE4096) /* 2048 & 4096-byte page chips */
263	#define OPT_SMALLPAGE (OPT_PAGE512) /* 512-byte page chips */
264
265	/* Remove action bits from state */
266	#define NS_STATE(x) ((x) & ~ACTION_MASK)
267
268	/*
269	* Maximum previous states which need to be saved. Currently saving is
270	* only needed for page program operation with preceded read command
271	* (which is only valid for 512-byte pages).
272	*/
273	#define NS_MAX_PREVSTATES 1
274
275	/* Maximum page cache pages needed to read or write a NAND page to the cache_file */
276	#define NS_MAX_HELD_PAGES 16
277
278	/*
279	* A union to represent flash memory contents and flash buffer.
280	*/
281	union ns_mem {
282	u_char *byte; /* for byte access */
283	uint16_t *word; /* for 16-bit word access */
284	};
285
286	/*
287	* The structure which describes all the internal simulator data.
288	*/
289	struct nandsim {
290	struct nand_chip chip;
291	struct nand_controller base;
292	struct mtd_partition partitions[CONFIG_NANDSIM_MAX_PARTS];
293	unsigned int nbparts;
294
295	uint busw; /* flash chip bus width (8 or 16) */
296	u_char ids[8]; /* chip's ID bytes */
297	uint32_t options; /* chip's characteristic bits */
298	uint32_t state; /* current chip state */
299	uint32_t nxstate; /* next expected state */
300
301	uint32_t *op; /* current operation, NULL operations isn't known yet */
302	uint32_t pstates[NS_MAX_PREVSTATES]; /* previous states */
303	uint16_t npstates; /* number of previous states saved */
304	uint16_t stateidx; /* current state index */
305
306	/* The simulated NAND flash pages array */
307	union ns_mem *pages;
308
309	/* Slab allocator for nand pages */
310	struct kmem_cache *nand_pages_slab;
311
312	/* Internal buffer of page + OOB size bytes */
313	union ns_mem buf;
314
315	/* NAND flash "geometry" */
316	struct {
317	uint64_t totsz; /* total flash size, bytes */
318	uint32_t secsz; /* flash sector (erase block) size, bytes */
319	uint pgsz; /* NAND flash page size, bytes */
320	uint oobsz; /* page OOB area size, bytes */
321	uint64_t totszoob; /* total flash size including OOB, bytes */
322	uint pgszoob; /* page size including OOB , bytes*/
323	uint secszoob; /* sector size including OOB, bytes */
324	uint pgnum; /* total number of pages */
325	uint pgsec; /* number of pages per sector */
326	uint secshift; /* bits number in sector size */
327	uint pgshift; /* bits number in page size */
328	uint pgaddrbytes; /* bytes per page address */
329	uint secaddrbytes; /* bytes per sector address */
330	uint idbytes; /* the number ID bytes that this chip outputs */
331	} geom;
332
333	/* NAND flash internal registers */
334	struct {
335	unsigned command; /* the command register */
336	u_char status; /* the status register */
337	uint row; /* the page number */
338	uint column; /* the offset within page */
339	uint count; /* internal counter */
340	uint num; /* number of bytes which must be processed */
341	uint off; /* fixed page offset */
342	} regs;
343
344	/* NAND flash lines state */
345	struct {
346	int ce; /* chip Enable */
347	int cle; /* command Latch Enable */
348	int ale; /* address Latch Enable */
349	int wp; /* write Protect */
350	} lines;
351
352	/* Fields needed when using a cache file */
353	struct file *cfile; /* Open file */
354	unsigned long *pages_written; /* Which pages have been written */
355	void *file_buf;
356	struct page *held_pages[NS_MAX_HELD_PAGES];
357	int held_cnt;
358
359	/* debugfs entry */
360	struct dentry *dent;
361	};
362
363	/*
364	* Operations array. To perform any operation the simulator must pass
365	* through the correspondent states chain.
366	*/
367	static struct nandsim_operations {
368	uint32_t reqopts; /* options which are required to perform the operation */
369	uint32_t states[NS_OPER_STATES]; /* operation's states */
370	} ops[NS_OPER_NUM] = {
371	/* Read page + OOB from the beginning */
372	{OPT_SMALLPAGE, {STATE_CMD_READ0 | ACTION_ZEROOFF, STATE_ADDR_PAGE | ACTION_CPY,
373	STATE_DATAOUT, STATE_READY}},
374	/* Read page + OOB from the second half */
375	{OPT_PAGE512_8BIT, {STATE_CMD_READ1 | ACTION_HALFOFF, STATE_ADDR_PAGE | ACTION_CPY,
376	STATE_DATAOUT, STATE_READY}},
377	/* Read OOB */
378	{OPT_SMALLPAGE, {STATE_CMD_READOOB | ACTION_OOBOFF, STATE_ADDR_PAGE | ACTION_CPY,
379	STATE_DATAOUT, STATE_READY}},
380	/* Program page starting from the beginning */
381	{OPT_ANY, {STATE_CMD_SEQIN, STATE_ADDR_PAGE, STATE_DATAIN,
382	STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
383	/* Program page starting from the beginning */
384	{OPT_SMALLPAGE, {STATE_CMD_READ0, STATE_CMD_SEQIN | ACTION_ZEROOFF, STATE_ADDR_PAGE,
385	STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
386	/* Program page starting from the second half */
387	{OPT_PAGE512, {STATE_CMD_READ1, STATE_CMD_SEQIN | ACTION_HALFOFF, STATE_ADDR_PAGE,
388	STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
389	/* Program OOB */
390	{OPT_SMALLPAGE, {STATE_CMD_READOOB, STATE_CMD_SEQIN | ACTION_OOBOFF, STATE_ADDR_PAGE,
391	STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
392	/* Erase sector */
393	{OPT_ANY, {STATE_CMD_ERASE1, STATE_ADDR_SEC, STATE_CMD_ERASE2 | ACTION_SECERASE, STATE_READY}},
394	/* Read status */
395	{OPT_ANY, {STATE_CMD_STATUS, STATE_DATAOUT_STATUS, STATE_READY}},
396	/* Read ID */
397	{OPT_ANY, {STATE_CMD_READID, STATE_ADDR_ZERO, STATE_DATAOUT_ID, STATE_READY}},
398	/* Large page devices read page */
399	{OPT_LARGEPAGE, {STATE_CMD_READ0, STATE_ADDR_PAGE, STATE_CMD_READSTART | ACTION_CPY,
400	STATE_DATAOUT, STATE_READY}},
401	/* Large page devices random page read */
402	{OPT_LARGEPAGE, {STATE_CMD_RNDOUT, STATE_ADDR_COLUMN, STATE_CMD_RNDOUTSTART | ACTION_CPY,
403	STATE_DATAOUT, STATE_READY}},
404	};
405
406	struct weak_block {
407	struct list_head list;
408	unsigned int erase_block_no;
409	unsigned int max_erases;
410	unsigned int erases_done;
411	};
412
413	static LIST_HEAD(weak_blocks);
414
415	struct weak_page {
416	struct list_head list;
417	unsigned int page_no;
418	unsigned int max_writes;
419	unsigned int writes_done;
420	};
421
422	static LIST_HEAD(weak_pages);
423
424	struct grave_page {
425	struct list_head list;
426	unsigned int page_no;
427	unsigned int max_reads;
428	unsigned int reads_done;
429	};
430
431	static LIST_HEAD(grave_pages);
432
433	static unsigned long *erase_block_wear = NULL;
434	static unsigned int wear_eb_count = 0;
435	static unsigned long total_wear = 0;
436
437	/* MTD structure for NAND controller */
438	static struct mtd_info *nsmtd;
439
440	static int ns_show(struct seq_file *m, void *private)
441	{
442	unsigned long wmin = -1, wmax = 0, avg;
443	unsigned long deciles[10], decile_max[10], tot = 0;
444	unsigned int i;
445
446	/* Calc wear stats */
447	for (i = 0; i < wear_eb_count; ++i) {
448	unsigned long wear = erase_block_wear[i];
449	if (wear < wmin)
450	wmin = wear;
451	if (wear > wmax)
452	wmax = wear;
453	tot += wear;
454	}
455
456	for (i = 0; i < 9; ++i) {
457	deciles[i] = 0;
458	decile_max[i] = (wmax * (i + 1) + 5) / 10;
459	}
460	deciles[9] = 0;
461	decile_max[9] = wmax;
462	for (i = 0; i < wear_eb_count; ++i) {
463	int d;
464	unsigned long wear = erase_block_wear[i];
465	for (d = 0; d < 10; ++d)
466	if (wear <= decile_max[d]) {
467	deciles[d] += 1;
468	break;
469	}
470	}
471	avg = tot / wear_eb_count;
472
473	/* Output wear report */
474	seq_printf(m, fmt: "Total numbers of erases: %lu\n", tot);
475	seq_printf(m, fmt: "Number of erase blocks: %u\n", wear_eb_count);
476	seq_printf(m, fmt: "Average number of erases: %lu\n", avg);
477	seq_printf(m, fmt: "Maximum number of erases: %lu\n", wmax);
478	seq_printf(m, fmt: "Minimum number of erases: %lu\n", wmin);
479	for (i = 0; i < 10; ++i) {
480	unsigned long from = (i ? decile_max[i - 1] + 1 : 0);
481	if (from > decile_max[i])
482	continue;
483	seq_printf(m, fmt: "Number of ebs with erase counts from %lu to %lu : %lu\n",
484	from,
485	decile_max[i],
486	deciles[i]);
487	}
488
489	return 0;
490	}
491	DEFINE_SHOW_ATTRIBUTE(ns);
492
493	/**
494	* ns_debugfs_create - initialize debugfs
495	* @ns: nandsim device description object
496	*
497	* This function creates all debugfs files for UBI device @ubi. Returns zero in
498	* case of success and a negative error code in case of failure.
499	*/
500	static int ns_debugfs_create(struct nandsim *ns)
501	{
502	struct dentry *root = nsmtd->dbg.dfs_dir;
503
504	/*
505	* Just skip debugfs initialization when the debugfs directory is
506	* missing.
507	*/
508	if (IS_ERR_OR_NULL(ptr: root)) {
509	if (IS_ENABLED(CONFIG_DEBUG_FS) &&
510	!IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER))
511	NS_WARN("CONFIG_MTD_PARTITIONED_MASTER must be enabled to expose debugfs stuff\n");
512	return 0;
513	}
514
515	ns->dent = debugfs_create_file("nandsim_wear_report", 0400, root, ns,
516	&ns_fops);
517	if (IS_ERR_OR_NULL(ptr: ns->dent)) {
518	NS_ERR("cannot create \"nandsim_wear_report\" debugfs entry\n");
519	return -1;
520	}
521
522	return 0;
523	}
524
525	static void ns_debugfs_remove(struct nandsim *ns)
526	{
527	debugfs_remove_recursive(dentry: ns->dent);
528	}
529
530	/*
531	* Allocate array of page pointers, create slab allocation for an array
532	* and initialize the array by NULL pointers.
533	*
534	* RETURNS: 0 if success, -ENOMEM if memory alloc fails.
535	*/
536	static int __init ns_alloc_device(struct nandsim *ns)
537	{
538	struct file *cfile;
539	int i, err;
540
541	if (cache_file) {
542	cfile = filp_open(cache_file, O_CREAT | O_RDWR | O_LARGEFILE, 0600);
543	if (IS_ERR(ptr: cfile))
544	return PTR_ERR(ptr: cfile);
545	if (!(cfile->f_mode & FMODE_CAN_READ)) {
546	NS_ERR("alloc_device: cache file not readable\n");
547	err = -EINVAL;
548	goto err_close_filp;
549	}
550	if (!(cfile->f_mode & FMODE_CAN_WRITE)) {
551	NS_ERR("alloc_device: cache file not writeable\n");
552	err = -EINVAL;
553	goto err_close_filp;
554	}
555	ns->pages_written = vcalloc(BITS_TO_LONGS(ns->geom.pgnum),
556	sizeof(unsigned long));
557	if (!ns->pages_written) {
558	NS_ERR("alloc_device: unable to allocate pages written array\n");
559	err = -ENOMEM;
560	goto err_close_filp;
561	}
562	ns->file_buf = kmalloc(ns->geom.pgszoob, GFP_KERNEL);
563	if (!ns->file_buf) {
564	NS_ERR("alloc_device: unable to allocate file buf\n");
565	err = -ENOMEM;
566	goto err_free_pw;
567	}
568	ns->cfile = cfile;
569
570	return 0;
571
572	err_free_pw:
573	vfree(addr: ns->pages_written);
574	err_close_filp:
575	filp_close(cfile, NULL);
576
577	return err;
578	}
579
580	ns->pages = vmalloc_array(ns->geom.pgnum, sizeof(union ns_mem));
581	if (!ns->pages) {
582	NS_ERR("alloc_device: unable to allocate page array\n");
583	return -ENOMEM;
584	}
585	for (i = 0; i < ns->geom.pgnum; i++) {
586	ns->pages[i].byte = NULL;
587	}
588	ns->nand_pages_slab = kmem_cache_create("nandsim",
589	ns->geom.pgszoob, 0, 0, NULL);
590	if (!ns->nand_pages_slab) {
591	NS_ERR("cache_create: unable to create kmem_cache\n");
592	err = -ENOMEM;
593	goto err_free_pg;
594	}
595
596	return 0;
597
598	err_free_pg:
599	vfree(addr: ns->pages);
600
601	return err;
602	}
603
604	/*
605	* Free any allocated pages, and free the array of page pointers.
606	*/
607	static void ns_free_device(struct nandsim *ns)
608	{
609	int i;
610
611	if (ns->cfile) {
612	kfree(objp: ns->file_buf);
613	vfree(addr: ns->pages_written);
614	filp_close(ns->cfile, NULL);
615	return;
616	}
617
618	if (ns->pages) {
619	for (i = 0; i < ns->geom.pgnum; i++) {
620	if (ns->pages[i].byte)
621	kmem_cache_free(s: ns->nand_pages_slab,
622	objp: ns->pages[i].byte);
623	}
624	kmem_cache_destroy(s: ns->nand_pages_slab);
625	vfree(addr: ns->pages);
626	}
627	}
628
629	static char __init *ns_get_partition_name(int i)
630	{
631	return kasprintf(GFP_KERNEL, fmt: "NAND simulator partition %d", i);
632	}
633
634	/*
635	* Initialize the nandsim structure.
636	*
637	* RETURNS: 0 if success, -ERRNO if failure.
638	*/
639	static int __init ns_init(struct mtd_info *mtd)
640	{
641	struct nand_chip *chip = mtd_to_nand(mtd);
642	struct nandsim *ns = nand_get_controller_data(chip);
643	int i, ret = 0;
644	uint64_t remains;
645	uint64_t next_offset;
646
647	if (NS_IS_INITIALIZED(ns)) {
648	NS_ERR("init_nandsim: nandsim is already initialized\n");
649	return -EIO;
650	}
651
652	/* Initialize the NAND flash parameters */
653	ns->busw = chip->options & NAND_BUSWIDTH_16 ? 16 : 8;
654	ns->geom.totsz = mtd->size;
655	ns->geom.pgsz = mtd->writesize;
656	ns->geom.oobsz = mtd->oobsize;
657	ns->geom.secsz = mtd->erasesize;
658	ns->geom.pgszoob = ns->geom.pgsz + ns->geom.oobsz;
659	ns->geom.pgnum = div_u64(dividend: ns->geom.totsz, divisor: ns->geom.pgsz);
660	ns->geom.totszoob = ns->geom.totsz + (uint64_t)ns->geom.pgnum * ns->geom.oobsz;
661	ns->geom.secshift = ffs(ns->geom.secsz) - 1;
662	ns->geom.pgshift = chip->page_shift;
663	ns->geom.pgsec = ns->geom.secsz / ns->geom.pgsz;
664	ns->geom.secszoob = ns->geom.secsz + ns->geom.oobsz * ns->geom.pgsec;
665	ns->options = 0;
666
667	if (ns->geom.pgsz == 512) {
668	ns->options |= OPT_PAGE512;
669	if (ns->busw == 8)
670	ns->options |= OPT_PAGE512_8BIT;
671	} else if (ns->geom.pgsz == 2048) {
672	ns->options |= OPT_PAGE2048;
673	} else if (ns->geom.pgsz == 4096) {
674	ns->options |= OPT_PAGE4096;
675	} else {
676	NS_ERR("init_nandsim: unknown page size %u\n", ns->geom.pgsz);
677	return -EIO;
678	}
679
680	if (ns->options & OPT_SMALLPAGE) {
681	if (ns->geom.totsz <= (32 << 20)) {
682	ns->geom.pgaddrbytes = 3;
683	ns->geom.secaddrbytes = 2;
684	} else {
685	ns->geom.pgaddrbytes = 4;
686	ns->geom.secaddrbytes = 3;
687	}
688	} else {
689	if (ns->geom.totsz <= (128 << 20)) {
690	ns->geom.pgaddrbytes = 4;
691	ns->geom.secaddrbytes = 2;
692	} else {
693	ns->geom.pgaddrbytes = 5;
694	ns->geom.secaddrbytes = 3;
695	}
696	}
697
698	/* Fill the partition_info structure */
699	if (parts_num > ARRAY_SIZE(ns->partitions)) {
700	NS_ERR("too many partitions.\n");
701	return -EINVAL;
702	}
703	remains = ns->geom.totsz;
704	next_offset = 0;
705	for (i = 0; i < parts_num; ++i) {
706	uint64_t part_sz = (uint64_t)parts[i] * ns->geom.secsz;
707
708	if (!part_sz || part_sz > remains) {
709	NS_ERR("bad partition size.\n");
710	return -EINVAL;
711	}
712	ns->partitions[i].name = ns_get_partition_name(i);
713	if (!ns->partitions[i].name) {
714	NS_ERR("unable to allocate memory.\n");
715	return -ENOMEM;
716	}
717	ns->partitions[i].offset = next_offset;
718	ns->partitions[i].size = part_sz;
719	next_offset += ns->partitions[i].size;
720	remains -= ns->partitions[i].size;
721	}
722	ns->nbparts = parts_num;
723	if (remains) {
724	if (parts_num + 1 > ARRAY_SIZE(ns->partitions)) {
725	NS_ERR("too many partitions.\n");
726	ret = -EINVAL;
727	goto free_partition_names;
728	}
729	ns->partitions[i].name = ns_get_partition_name(i);
730	if (!ns->partitions[i].name) {
731	NS_ERR("unable to allocate memory.\n");
732	ret = -ENOMEM;
733	goto free_partition_names;
734	}
735	ns->partitions[i].offset = next_offset;
736	ns->partitions[i].size = remains;
737	ns->nbparts += 1;
738	}
739
740	if (ns->busw == 16)
741	NS_WARN("16-bit flashes support wasn't tested\n");
742
743	printk("flash size: %llu MiB\n",
744	(unsigned long long)ns->geom.totsz >> 20);
745	printk("page size: %u bytes\n", ns->geom.pgsz);
746	printk("OOB area size: %u bytes\n", ns->geom.oobsz);
747	printk("sector size: %u KiB\n", ns->geom.secsz >> 10);
748	printk("pages number: %u\n", ns->geom.pgnum);
749	printk("pages per sector: %u\n", ns->geom.pgsec);
750	printk("bus width: %u\n", ns->busw);
751	printk("bits in sector size: %u\n", ns->geom.secshift);
752	printk("bits in page size: %u\n", ns->geom.pgshift);
753	printk("bits in OOB size: %u\n", ffs(ns->geom.oobsz) - 1);
754	printk("flash size with OOB: %llu KiB\n",
755	(unsigned long long)ns->geom.totszoob >> 10);
756	printk("page address bytes: %u\n", ns->geom.pgaddrbytes);
757	printk("sector address bytes: %u\n", ns->geom.secaddrbytes);
758	printk("options: %#x\n", ns->options);
759
760	ret = ns_alloc_device(ns);
761	if (ret)
762	goto free_partition_names;
763
764	/* Allocate / initialize the internal buffer */
765	ns->buf.byte = kmalloc(ns->geom.pgszoob, GFP_KERNEL);
766	if (!ns->buf.byte) {
767	NS_ERR("init_nandsim: unable to allocate %u bytes for the internal buffer\n",
768	ns->geom.pgszoob);
769	ret = -ENOMEM;
770	goto free_device;
771	}
772	memset(ns->buf.byte, 0xFF, ns->geom.pgszoob);
773
774	return 0;
775
776	free_device:
777	ns_free_device(ns);
778	free_partition_names:
779	for (i = 0; i < ARRAY_SIZE(ns->partitions); ++i)
780	kfree(objp: ns->partitions[i].name);
781
782	return ret;
783	}
784
785	/*
786	* Free the nandsim structure.
787	*/
788	static void ns_free(struct nandsim *ns)
789	{
790	int i;
791
792	for (i = 0; i < ARRAY_SIZE(ns->partitions); ++i)
793	kfree(objp: ns->partitions[i].name);
794
795	kfree(objp: ns->buf.byte);
796	ns_free_device(ns);
797
798	return;
799	}
800
801	static int ns_parse_badblocks(struct nandsim *ns, struct mtd_info *mtd)
802	{
803	char *w;
804	int zero_ok;
805	unsigned int erase_block_no;
806	loff_t offset;
807
808	if (!badblocks)
809	return 0;
810	w = badblocks;
811	do {
812	zero_ok = (*w == '0' ? 1 : 0);
813	erase_block_no = simple_strtoul(w, &w, 0);
814	if (!zero_ok && !erase_block_no) {
815	NS_ERR("invalid badblocks.\n");
816	return -EINVAL;
817	}
818	offset = (loff_t)erase_block_no * ns->geom.secsz;
819	if (mtd_block_markbad(mtd, ofs: offset)) {
820	NS_ERR("invalid badblocks.\n");
821	return -EINVAL;
822	}
823	if (*w == ',')
824	w += 1;
825	} while (*w);
826	return 0;
827	}
828
829	static int ns_parse_weakblocks(void)
830	{
831	char *w;
832	int zero_ok;
833	unsigned int erase_block_no;
834	unsigned int max_erases;
835	struct weak_block *wb;
836
837	if (!weakblocks)
838	return 0;
839	w = weakblocks;
840	do {
841	zero_ok = (*w == '0' ? 1 : 0);
842	erase_block_no = simple_strtoul(w, &w, 0);
843	if (!zero_ok && !erase_block_no) {
844	NS_ERR("invalid weakblocks.\n");
845	return -EINVAL;
846	}
847	max_erases = 3;
848	if (*w == ':') {
849	w += 1;
850	max_erases = simple_strtoul(w, &w, 0);
851	}
852	if (*w == ',')
853	w += 1;
854	wb = kzalloc(sizeof(*wb), GFP_KERNEL);
855	if (!wb) {
856	NS_ERR("unable to allocate memory.\n");
857	return -ENOMEM;
858	}
859	wb->erase_block_no = erase_block_no;
860	wb->max_erases = max_erases;
861	list_add(new: &wb->list, head: &weak_blocks);
862	} while (*w);
863	return 0;
864	}
865
866	static int ns_erase_error(unsigned int erase_block_no)
867	{
868	struct weak_block *wb;
869
870	list_for_each_entry(wb, &weak_blocks, list)
871	if (wb->erase_block_no == erase_block_no) {
872	if (wb->erases_done >= wb->max_erases)
873	return 1;
874	wb->erases_done += 1;
875	return 0;
876	}
877	return 0;
878	}
879
880	static int ns_parse_weakpages(void)
881	{
882	char *w;
883	int zero_ok;
884	unsigned int page_no;
885	unsigned int max_writes;
886	struct weak_page *wp;
887
888	if (!weakpages)
889	return 0;
890	w = weakpages;
891	do {
892	zero_ok = (*w == '0' ? 1 : 0);
893	page_no = simple_strtoul(w, &w, 0);
894	if (!zero_ok && !page_no) {
895	NS_ERR("invalid weakpages.\n");
896	return -EINVAL;
897	}
898	max_writes = 3;
899	if (*w == ':') {
900	w += 1;
901	max_writes = simple_strtoul(w, &w, 0);
902	}
903	if (*w == ',')
904	w += 1;
905	wp = kzalloc(sizeof(*wp), GFP_KERNEL);
906	if (!wp) {
907	NS_ERR("unable to allocate memory.\n");
908	return -ENOMEM;
909	}
910	wp->page_no = page_no;
911	wp->max_writes = max_writes;
912	list_add(new: &wp->list, head: &weak_pages);
913	} while (*w);
914	return 0;
915	}
916
917	static int ns_write_error(unsigned int page_no)
918	{
919	struct weak_page *wp;
920
921	list_for_each_entry(wp, &weak_pages, list)
922	if (wp->page_no == page_no) {
923	if (wp->writes_done >= wp->max_writes)
924	return 1;
925	wp->writes_done += 1;
926	return 0;
927	}
928	return 0;
929	}
930
931	static int ns_parse_gravepages(void)
932	{
933	char *g;
934	int zero_ok;
935	unsigned int page_no;
936	unsigned int max_reads;
937	struct grave_page *gp;
938
939	if (!gravepages)
940	return 0;
941	g = gravepages;
942	do {
943	zero_ok = (*g == '0' ? 1 : 0);
944	page_no = simple_strtoul(g, &g, 0);
945	if (!zero_ok && !page_no) {
946	NS_ERR("invalid gravepagess.\n");
947	return -EINVAL;
948	}
949	max_reads = 3;
950	if (*g == ':') {
951	g += 1;
952	max_reads = simple_strtoul(g, &g, 0);
953	}
954	if (*g == ',')
955	g += 1;
956	gp = kzalloc(sizeof(*gp), GFP_KERNEL);
957	if (!gp) {
958	NS_ERR("unable to allocate memory.\n");
959	return -ENOMEM;
960	}
961	gp->page_no = page_no;
962	gp->max_reads = max_reads;
963	list_add(new: &gp->list, head: &grave_pages);
964	} while (*g);
965	return 0;
966	}
967
968	static int ns_read_error(unsigned int page_no)
969	{
970	struct grave_page *gp;
971
972	list_for_each_entry(gp, &grave_pages, list)
973	if (gp->page_no == page_no) {
974	if (gp->reads_done >= gp->max_reads)
975	return 1;
976	gp->reads_done += 1;
977	return 0;
978	}
979	return 0;
980	}
981
982	static int ns_setup_wear_reporting(struct mtd_info *mtd)
983	{
984	wear_eb_count = div_u64(dividend: mtd->size, divisor: mtd->erasesize);
985	erase_block_wear = kcalloc(wear_eb_count, sizeof(unsigned long), GFP_KERNEL);
986	if (!erase_block_wear) {
987	NS_ERR("Too many erase blocks for wear reporting\n");
988	return -ENOMEM;
989	}
990	return 0;
991	}
992
993	static void ns_update_wear(unsigned int erase_block_no)
994	{
995	if (!erase_block_wear)
996	return;
997	total_wear += 1;
998	/*
999	* TODO: Notify this through a debugfs entry,
1000	* instead of showing an error message.
1001	*/
1002	if (total_wear == 0)
1003	NS_ERR("Erase counter total overflow\n");
1004	erase_block_wear[erase_block_no] += 1;
1005	if (erase_block_wear[erase_block_no] == 0)
1006	NS_ERR("Erase counter overflow for erase block %u\n", erase_block_no);
1007	}
1008
1009	/*
1010	* Returns the string representation of 'state' state.
1011	*/
1012	static char *ns_get_state_name(uint32_t state)
1013	{
1014	switch (NS_STATE(state)) {
1015	case STATE_CMD_READ0:
1016	return "STATE_CMD_READ0";
1017	case STATE_CMD_READ1:
1018	return "STATE_CMD_READ1";
1019	case STATE_CMD_PAGEPROG:
1020	return "STATE_CMD_PAGEPROG";
1021	case STATE_CMD_READOOB:
1022	return "STATE_CMD_READOOB";
1023	case STATE_CMD_READSTART:
1024	return "STATE_CMD_READSTART";
1025	case STATE_CMD_ERASE1:
1026	return "STATE_CMD_ERASE1";
1027	case STATE_CMD_STATUS:
1028	return "STATE_CMD_STATUS";
1029	case STATE_CMD_SEQIN:
1030	return "STATE_CMD_SEQIN";
1031	case STATE_CMD_READID:
1032	return "STATE_CMD_READID";
1033	case STATE_CMD_ERASE2:
1034	return "STATE_CMD_ERASE2";
1035	case STATE_CMD_RESET:
1036	return "STATE_CMD_RESET";
1037	case STATE_CMD_RNDOUT:
1038	return "STATE_CMD_RNDOUT";
1039	case STATE_CMD_RNDOUTSTART:
1040	return "STATE_CMD_RNDOUTSTART";
1041	case STATE_ADDR_PAGE:
1042	return "STATE_ADDR_PAGE";
1043	case STATE_ADDR_SEC:
1044	return "STATE_ADDR_SEC";
1045	case STATE_ADDR_ZERO:
1046	return "STATE_ADDR_ZERO";
1047	case STATE_ADDR_COLUMN:
1048	return "STATE_ADDR_COLUMN";
1049	case STATE_DATAIN:
1050	return "STATE_DATAIN";
1051	case STATE_DATAOUT:
1052	return "STATE_DATAOUT";
1053	case STATE_DATAOUT_ID:
1054	return "STATE_DATAOUT_ID";
1055	case STATE_DATAOUT_STATUS:
1056	return "STATE_DATAOUT_STATUS";
1057	case STATE_READY:
1058	return "STATE_READY";
1059	case STATE_UNKNOWN:
1060	return "STATE_UNKNOWN";
1061	}
1062
1063	NS_ERR("get_state_name: unknown state, BUG\n");
1064	return NULL;
1065	}
1066
1067	/*
1068	* Check if command is valid.
1069	*
1070	* RETURNS: 1 if wrong command, 0 if right.
1071	*/
1072	static int ns_check_command(int cmd)
1073	{
1074	switch (cmd) {
1075
1076	case NAND_CMD_READ0:
1077	case NAND_CMD_READ1:
1078	case NAND_CMD_READSTART:
1079	case NAND_CMD_PAGEPROG:
1080	case NAND_CMD_READOOB:
1081	case NAND_CMD_ERASE1:
1082	case NAND_CMD_STATUS:
1083	case NAND_CMD_SEQIN:
1084	case NAND_CMD_READID:
1085	case NAND_CMD_ERASE2:
1086	case NAND_CMD_RESET:
1087	case NAND_CMD_RNDOUT:
1088	case NAND_CMD_RNDOUTSTART:
1089	return 0;
1090
1091	default:
1092	return 1;
1093	}
1094	}
1095
1096	/*
1097	* Returns state after command is accepted by command number.
1098	*/
1099	static uint32_t ns_get_state_by_command(unsigned command)
1100	{
1101	switch (command) {
1102	case NAND_CMD_READ0:
1103	return STATE_CMD_READ0;
1104	case NAND_CMD_READ1:
1105	return STATE_CMD_READ1;
1106	case NAND_CMD_PAGEPROG:
1107	return STATE_CMD_PAGEPROG;
1108	case NAND_CMD_READSTART:
1109	return STATE_CMD_READSTART;
1110	case NAND_CMD_READOOB:
1111	return STATE_CMD_READOOB;
1112	case NAND_CMD_ERASE1:
1113	return STATE_CMD_ERASE1;
1114	case NAND_CMD_STATUS:
1115	return STATE_CMD_STATUS;
1116	case NAND_CMD_SEQIN:
1117	return STATE_CMD_SEQIN;
1118	case NAND_CMD_READID:
1119	return STATE_CMD_READID;
1120	case NAND_CMD_ERASE2:
1121	return STATE_CMD_ERASE2;
1122	case NAND_CMD_RESET:
1123	return STATE_CMD_RESET;
1124	case NAND_CMD_RNDOUT:
1125	return STATE_CMD_RNDOUT;
1126	case NAND_CMD_RNDOUTSTART:
1127	return STATE_CMD_RNDOUTSTART;
1128	}
1129
1130	NS_ERR("get_state_by_command: unknown command, BUG\n");
1131	return 0;
1132	}
1133
1134	/*
1135	* Move an address byte to the correspondent internal register.
1136	*/
1137	static inline void ns_accept_addr_byte(struct nandsim *ns, u_char bt)
1138	{
1139	uint byte = (uint)bt;
1140
1141	if (ns->regs.count < (ns->geom.pgaddrbytes - ns->geom.secaddrbytes))
1142	ns->regs.column |= (byte << 8 * ns->regs.count);
1143	else {
1144	ns->regs.row |= (byte << 8 * (ns->regs.count -
1145	ns->geom.pgaddrbytes +
1146	ns->geom.secaddrbytes));
1147	}
1148
1149	return;
1150	}
1151
1152	/*
1153	* Switch to STATE_READY state.
1154	*/
1155	static inline void ns_switch_to_ready_state(struct nandsim *ns, u_char status)
1156	{
1157	NS_DBG("switch_to_ready_state: switch to %s state\n",
1158	ns_get_state_name(STATE_READY));
1159
1160	ns->state = STATE_READY;
1161	ns->nxstate = STATE_UNKNOWN;
1162	ns->op = NULL;
1163	ns->npstates = 0;
1164	ns->stateidx = 0;
1165	ns->regs.num = 0;
1166	ns->regs.count = 0;
1167	ns->regs.off = 0;
1168	ns->regs.row = 0;
1169	ns->regs.column = 0;
1170	ns->regs.status = status;
1171	}
1172
1173	/*
1174	* If the operation isn't known yet, try to find it in the global array
1175	* of supported operations.
1176	*
1177	* Operation can be unknown because of the following.
1178	* 1. New command was accepted and this is the first call to find the
1179	* correspondent states chain. In this case ns->npstates = 0;
1180	* 2. There are several operations which begin with the same command(s)
1181	* (for example program from the second half and read from the
1182	* second half operations both begin with the READ1 command). In this
1183	* case the ns->pstates[] array contains previous states.
1184	*
1185	* Thus, the function tries to find operation containing the following
1186	* states (if the 'flag' parameter is 0):
1187	* ns->pstates[0], ... ns->pstates[ns->npstates], ns->state
1188	*
1189	* If (one and only one) matching operation is found, it is accepted (
1190	* ns->ops, ns->state, ns->nxstate are initialized, ns->npstate is
1191	* zeroed).
1192	*
1193	* If there are several matches, the current state is pushed to the
1194	* ns->pstates.
1195	*
1196	* The operation can be unknown only while commands are input to the chip.
1197	* As soon as address command is accepted, the operation must be known.
1198	* In such situation the function is called with 'flag' != 0, and the
1199	* operation is searched using the following pattern:
1200	* ns->pstates[0], ... ns->pstates[ns->npstates], <address input>
1201	*
1202	* It is supposed that this pattern must either match one operation or
1203	* none. There can't be ambiguity in that case.
1204	*
1205	* If no matches found, the function does the following:
1206	* 1. if there are saved states present, try to ignore them and search
1207	* again only using the last command. If nothing was found, switch
1208	* to the STATE_READY state.
1209	* 2. if there are no saved states, switch to the STATE_READY state.
1210	*
1211	* RETURNS: -2 - no matched operations found.
1212	* -1 - several matches.
1213	* 0 - operation is found.
1214	*/
1215	static int ns_find_operation(struct nandsim *ns, uint32_t flag)
1216	{
1217	int opsfound = 0;
1218	int i, j, idx = 0;
1219
1220	for (i = 0; i < NS_OPER_NUM; i++) {
1221
1222	int found = 1;
1223
1224	if (!(ns->options & ops[i].reqopts))
1225	/* Ignore operations we can't perform */
1226	continue;
1227
1228	if (flag) {
1229	if (!(ops[i].states[ns->npstates] & STATE_ADDR_MASK))
1230	continue;
1231	} else {
1232	if (NS_STATE(ns->state) != NS_STATE(ops[i].states[ns->npstates]))
1233	continue;
1234	}
1235
1236	for (j = 0; j < ns->npstates; j++)
1237	if (NS_STATE(ops[i].states[j]) != NS_STATE(ns->pstates[j])
1238	&& (ns->options & ops[idx].reqopts)) {
1239	found = 0;
1240	break;
1241	}
1242
1243	if (found) {
1244	idx = i;
1245	opsfound += 1;
1246	}
1247	}
1248
1249	if (opsfound == 1) {
1250	/* Exact match */
1251	ns->op = &ops[idx].states[0];
1252	if (flag) {
1253	/*
1254	* In this case the find_operation function was
1255	* called when address has just began input. But it isn't
1256	* yet fully input and the current state must
1257	* not be one of STATE_ADDR_*, but the STATE_ADDR_*
1258	* state must be the next state (ns->nxstate).
1259	*/
1260	ns->stateidx = ns->npstates - 1;
1261	} else {
1262	ns->stateidx = ns->npstates;
1263	}
1264	ns->npstates = 0;
1265	ns->state = ns->op[ns->stateidx];
1266	ns->nxstate = ns->op[ns->stateidx + 1];
1267	NS_DBG("find_operation: operation found, index: %d, state: %s, nxstate %s\n",
1268	idx, ns_get_state_name(ns->state),
1269	ns_get_state_name(ns->nxstate));
1270	return 0;
1271	}
1272
1273	if (opsfound == 0) {
1274	/* Nothing was found. Try to ignore previous commands (if any) and search again */
1275	if (ns->npstates != 0) {
1276	NS_DBG("find_operation: no operation found, try again with state %s\n",
1277	ns_get_state_name(ns->state));
1278	ns->npstates = 0;
1279	return ns_find_operation(ns, flag: 0);
1280
1281	}
1282	NS_DBG("find_operation: no operations found\n");
1283	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1284	return -2;
1285	}
1286
1287	if (flag) {
1288	/* This shouldn't happen */
1289	NS_DBG("find_operation: BUG, operation must be known if address is input\n");
1290	return -2;
1291	}
1292
1293	NS_DBG("find_operation: there is still ambiguity\n");
1294
1295	ns->pstates[ns->npstates++] = ns->state;
1296
1297	return -1;
1298	}
1299
1300	static void ns_put_pages(struct nandsim *ns)
1301	{
1302	int i;
1303
1304	for (i = 0; i < ns->held_cnt; i++)
1305	put_page(page: ns->held_pages[i]);
1306	}
1307
1308	/* Get page cache pages in advance to provide NOFS memory allocation */
1309	static int ns_get_pages(struct nandsim *ns, struct file *file, size_t count,
1310	loff_t pos)
1311	{
1312	pgoff_t index, start_index, end_index;
1313	struct page *page;
1314	struct address_space *mapping = file->f_mapping;
1315
1316	start_index = pos >> PAGE_SHIFT;
1317	end_index = (pos + count - 1) >> PAGE_SHIFT;
1318	if (end_index - start_index + 1 > NS_MAX_HELD_PAGES)
1319	return -EINVAL;
1320	ns->held_cnt = 0;
1321	for (index = start_index; index <= end_index; index++) {
1322	page = find_get_page(mapping, offset: index);
1323	if (page == NULL) {
1324	page = find_or_create_page(mapping, index, GFP_NOFS);
1325	if (page == NULL) {
1326	write_inode_now(mapping->host, sync: 1);
1327	page = find_or_create_page(mapping, index, GFP_NOFS);
1328	}
1329	if (page == NULL) {
1330	ns_put_pages(ns);
1331	return -ENOMEM;
1332	}
1333	unlock_page(page);
1334	}
1335	ns->held_pages[ns->held_cnt++] = page;
1336	}
1337	return 0;
1338	}
1339
1340	static ssize_t ns_read_file(struct nandsim *ns, struct file *file, void *buf,
1341	size_t count, loff_t pos)
1342	{
1343	ssize_t tx;
1344	int err;
1345	unsigned int noreclaim_flag;
1346
1347	err = ns_get_pages(ns, file, count, pos);
1348	if (err)
1349	return err;
1350	noreclaim_flag = memalloc_noreclaim_save();
1351	tx = kernel_read(file, buf, count, &pos);
1352	memalloc_noreclaim_restore(flags: noreclaim_flag);
1353	ns_put_pages(ns);
1354	return tx;
1355	}
1356
1357	static ssize_t ns_write_file(struct nandsim *ns, struct file *file, void *buf,
1358	size_t count, loff_t pos)
1359	{
1360	ssize_t tx;
1361	int err;
1362	unsigned int noreclaim_flag;
1363
1364	err = ns_get_pages(ns, file, count, pos);
1365	if (err)
1366	return err;
1367	noreclaim_flag = memalloc_noreclaim_save();
1368	tx = kernel_write(file, buf, count, &pos);
1369	memalloc_noreclaim_restore(flags: noreclaim_flag);
1370	ns_put_pages(ns);
1371	return tx;
1372	}
1373
1374	/*
1375	* Returns a pointer to the current page.
1376	*/
1377	static inline union ns_mem *NS_GET_PAGE(struct nandsim *ns)
1378	{
1379	return &(ns->pages[ns->regs.row]);
1380	}
1381
1382	/*
1383	* Returns a pointer to the current byte, within the current page.
1384	*/
1385	static inline u_char *NS_PAGE_BYTE_OFF(struct nandsim *ns)
1386	{
1387	return NS_GET_PAGE(ns)->byte + NS_PAGE_BYTE_SHIFT(ns);
1388	}
1389
1390	static int ns_do_read_error(struct nandsim *ns, int num)
1391	{
1392	unsigned int page_no = ns->regs.row;
1393
1394	if (ns_read_error(page_no)) {
1395	get_random_bytes(buf: ns->buf.byte, len: num);
1396	NS_WARN("simulating read error in page %u\n", page_no);
1397	return 1;
1398	}
1399	return 0;
1400	}
1401
1402	static void ns_do_bit_flips(struct nandsim *ns, int num)
1403	{
1404	if (bitflips && get_random_u16() < (1 << 6)) {
1405	int flips = 1;
1406	if (bitflips > 1)
1407	flips = get_random_u32_inclusive(floor: 1, ceil: bitflips);
1408	while (flips--) {
1409	int pos = get_random_u32_below(ceil: num * 8);
1410	ns->buf.byte[pos / 8] ^= (1 << (pos % 8));
1411	NS_WARN("read_page: flipping bit %d in page %d "
1412	"reading from %d ecc: corrected=%u failed=%u\n",
1413	pos, ns->regs.row, NS_PAGE_BYTE_SHIFT(ns),
1414	nsmtd->ecc_stats.corrected, nsmtd->ecc_stats.failed);
1415	}
1416	}
1417	}
1418
1419	/*
1420	* Fill the NAND buffer with data read from the specified page.
1421	*/
1422	static void ns_read_page(struct nandsim *ns, int num)
1423	{
1424	union ns_mem *mypage;
1425
1426	if (ns->cfile) {
1427	if (!test_bit(ns->regs.row, ns->pages_written)) {
1428	NS_DBG("read_page: page %d not written\n", ns->regs.row);
1429	memset(ns->buf.byte, 0xFF, num);
1430	} else {
1431	loff_t pos;
1432	ssize_t tx;
1433
1434	NS_DBG("read_page: page %d written, reading from %d\n",
1435	ns->regs.row, NS_PAGE_BYTE_SHIFT(ns));
1436	if (ns_do_read_error(ns, num))
1437	return;
1438	pos = (loff_t)NS_RAW_OFFSET(ns) + ns->regs.off;
1439	tx = ns_read_file(ns, file: ns->cfile, buf: ns->buf.byte, count: num,
1440	pos);
1441	if (tx != num) {
1442	NS_ERR("read_page: read error for page %d ret %ld\n", ns->regs.row, (long)tx);
1443	return;
1444	}
1445	ns_do_bit_flips(ns, num);
1446	}
1447	return;
1448	}
1449
1450	mypage = NS_GET_PAGE(ns);
1451	if (mypage->byte == NULL) {
1452	NS_DBG("read_page: page %d not allocated\n", ns->regs.row);
1453	memset(ns->buf.byte, 0xFF, num);
1454	} else {
1455	NS_DBG("read_page: page %d allocated, reading from %d\n",
1456	ns->regs.row, NS_PAGE_BYTE_SHIFT(ns));
1457	if (ns_do_read_error(ns, num))
1458	return;
1459	memcpy(ns->buf.byte, NS_PAGE_BYTE_OFF(ns), num);
1460	ns_do_bit_flips(ns, num);
1461	}
1462	}
1463
1464	/*
1465	* Erase all pages in the specified sector.
1466	*/
1467	static void ns_erase_sector(struct nandsim *ns)
1468	{
1469	union ns_mem *mypage;
1470	int i;
1471
1472	if (ns->cfile) {
1473	for (i = 0; i < ns->geom.pgsec; i++)
1474	if (__test_and_clear_bit(ns->regs.row + i,
1475	ns->pages_written)) {
1476	NS_DBG("erase_sector: freeing page %d\n", ns->regs.row + i);
1477	}
1478	return;
1479	}
1480
1481	mypage = NS_GET_PAGE(ns);
1482	for (i = 0; i < ns->geom.pgsec; i++) {
1483	if (mypage->byte != NULL) {
1484	NS_DBG("erase_sector: freeing page %d\n", ns->regs.row+i);
1485	kmem_cache_free(s: ns->nand_pages_slab, objp: mypage->byte);
1486	mypage->byte = NULL;
1487	}
1488	mypage++;
1489	}
1490	}
1491
1492	/*
1493	* Program the specified page with the contents from the NAND buffer.
1494	*/
1495	static int ns_prog_page(struct nandsim *ns, int num)
1496	{
1497	int i;
1498	union ns_mem *mypage;
1499	u_char *pg_off;
1500
1501	if (ns->cfile) {
1502	loff_t off;
1503	ssize_t tx;
1504	int all;
1505
1506	NS_DBG("prog_page: writing page %d\n", ns->regs.row);
1507	pg_off = ns->file_buf + NS_PAGE_BYTE_SHIFT(ns);
1508	off = (loff_t)NS_RAW_OFFSET(ns) + ns->regs.off;
1509	if (!test_bit(ns->regs.row, ns->pages_written)) {
1510	all = 1;
1511	memset(ns->file_buf, 0xff, ns->geom.pgszoob);
1512	} else {
1513	all = 0;
1514	tx = ns_read_file(ns, file: ns->cfile, buf: pg_off, count: num, pos: off);
1515	if (tx != num) {
1516	NS_ERR("prog_page: read error for page %d ret %ld\n", ns->regs.row, (long)tx);
1517	return -1;
1518	}
1519	}
1520	for (i = 0; i < num; i++)
1521	pg_off[i] &= ns->buf.byte[i];
1522	if (all) {
1523	loff_t pos = (loff_t)ns->regs.row * ns->geom.pgszoob;
1524	tx = ns_write_file(ns, file: ns->cfile, buf: ns->file_buf,
1525	count: ns->geom.pgszoob, pos);
1526	if (tx != ns->geom.pgszoob) {
1527	NS_ERR("prog_page: write error for page %d ret %ld\n", ns->regs.row, (long)tx);
1528	return -1;
1529	}
1530	__set_bit(ns->regs.row, ns->pages_written);
1531	} else {
1532	tx = ns_write_file(ns, file: ns->cfile, buf: pg_off, count: num, pos: off);
1533	if (tx != num) {
1534	NS_ERR("prog_page: write error for page %d ret %ld\n", ns->regs.row, (long)tx);
1535	return -1;
1536	}
1537	}
1538	return 0;
1539	}
1540
1541	mypage = NS_GET_PAGE(ns);
1542	if (mypage->byte == NULL) {
1543	NS_DBG("prog_page: allocating page %d\n", ns->regs.row);
1544	/*
1545	* We allocate memory with GFP_NOFS because a flash FS may
1546	* utilize this. If it is holding an FS lock, then gets here,
1547	* then kernel memory alloc runs writeback which goes to the FS
1548	* again and deadlocks. This was seen in practice.
1549	*/
1550	mypage->byte = kmem_cache_alloc(ns->nand_pages_slab, GFP_NOFS);
1551	if (mypage->byte == NULL) {
1552	NS_ERR("prog_page: error allocating memory for page %d\n", ns->regs.row);
1553	return -1;
1554	}
1555	memset(mypage->byte, 0xFF, ns->geom.pgszoob);
1556	}
1557
1558	pg_off = NS_PAGE_BYTE_OFF(ns);
1559	for (i = 0; i < num; i++)
1560	pg_off[i] &= ns->buf.byte[i];
1561
1562	return 0;
1563	}
1564
1565	/*
1566	* If state has any action bit, perform this action.
1567	*
1568	* RETURNS: 0 if success, -1 if error.
1569	*/
1570	static int ns_do_state_action(struct nandsim *ns, uint32_t action)
1571	{
1572	int num;
1573	int busdiv = ns->busw == 8 ? 1 : 2;
1574	unsigned int erase_block_no, page_no;
1575
1576	action &= ACTION_MASK;
1577
1578	/* Check that page address input is correct */
1579	if (action != ACTION_SECERASE && ns->regs.row >= ns->geom.pgnum) {
1580	NS_WARN("do_state_action: wrong page number (%#x)\n", ns->regs.row);
1581	return -1;
1582	}
1583
1584	switch (action) {
1585
1586	case ACTION_CPY:
1587	/*
1588	* Copy page data to the internal buffer.
1589	*/
1590
1591	/* Column shouldn't be very large */
1592	if (ns->regs.column >= (ns->geom.pgszoob - ns->regs.off)) {
1593	NS_ERR("do_state_action: column number is too large\n");
1594	break;
1595	}
1596	num = ns->geom.pgszoob - NS_PAGE_BYTE_SHIFT(ns);
1597	ns_read_page(ns, num);
1598
1599	NS_DBG("do_state_action: (ACTION_CPY:) copy %d bytes to int buf, raw offset %d\n",
1600	num, NS_RAW_OFFSET(ns) + ns->regs.off);
1601
1602	if (ns->regs.off == 0)
1603	NS_LOG("read page %d\n", ns->regs.row);
1604	else if (ns->regs.off < ns->geom.pgsz)
1605	NS_LOG("read page %d (second half)\n", ns->regs.row);
1606	else
1607	NS_LOG("read OOB of page %d\n", ns->regs.row);
1608
1609	NS_UDELAY(access_delay);
1610	NS_UDELAY(input_cycle * ns->geom.pgsz / 1000 / busdiv);
1611
1612	break;
1613
1614	case ACTION_SECERASE:
1615	/*
1616	* Erase sector.
1617	*/
1618
1619	if (ns->lines.wp) {
1620	NS_ERR("do_state_action: device is write-protected, ignore sector erase\n");
1621	return -1;
1622	}
1623
1624	if (ns->regs.row >= ns->geom.pgnum - ns->geom.pgsec
1625	|| (ns->regs.row & ~(ns->geom.secsz - 1))) {
1626	NS_ERR("do_state_action: wrong sector address (%#x)\n", ns->regs.row);
1627	return -1;
1628	}
1629
1630	ns->regs.row = (ns->regs.row <<
1631	8 * (ns->geom.pgaddrbytes - ns->geom.secaddrbytes)) | ns->regs.column;
1632	ns->regs.column = 0;
1633
1634	erase_block_no = ns->regs.row >> (ns->geom.secshift - ns->geom.pgshift);
1635
1636	NS_DBG("do_state_action: erase sector at address %#x, off = %d\n",
1637	ns->regs.row, NS_RAW_OFFSET(ns));
1638	NS_LOG("erase sector %u\n", erase_block_no);
1639
1640	ns_erase_sector(ns);
1641
1642	NS_MDELAY(erase_delay);
1643
1644	if (erase_block_wear)
1645	ns_update_wear(erase_block_no);
1646
1647	if (ns_erase_error(erase_block_no)) {
1648	NS_WARN("simulating erase failure in erase block %u\n", erase_block_no);
1649	return -1;
1650	}
1651
1652	break;
1653
1654	case ACTION_PRGPAGE:
1655	/*
1656	* Program page - move internal buffer data to the page.
1657	*/
1658
1659	if (ns->lines.wp) {
1660	NS_WARN("do_state_action: device is write-protected, programm\n");
1661	return -1;
1662	}
1663
1664	num = ns->geom.pgszoob - NS_PAGE_BYTE_SHIFT(ns);
1665	if (num != ns->regs.count) {
1666	NS_ERR("do_state_action: too few bytes were input (%d instead of %d)\n",
1667	ns->regs.count, num);
1668	return -1;
1669	}
1670
1671	if (ns_prog_page(ns, num) == -1)
1672	return -1;
1673
1674	page_no = ns->regs.row;
1675
1676	NS_DBG("do_state_action: copy %d bytes from int buf to (%#x, %#x), raw off = %d\n",
1677	num, ns->regs.row, ns->regs.column, NS_RAW_OFFSET(ns) + ns->regs.off);
1678	NS_LOG("programm page %d\n", ns->regs.row);
1679
1680	NS_UDELAY(programm_delay);
1681	NS_UDELAY(output_cycle * ns->geom.pgsz / 1000 / busdiv);
1682
1683	if (ns_write_error(page_no)) {
1684	NS_WARN("simulating write failure in page %u\n", page_no);
1685	return -1;
1686	}
1687
1688	break;
1689
1690	case ACTION_ZEROOFF:
1691	NS_DBG("do_state_action: set internal offset to 0\n");
1692	ns->regs.off = 0;
1693	break;
1694
1695	case ACTION_HALFOFF:
1696	if (!(ns->options & OPT_PAGE512_8BIT)) {
1697	NS_ERR("do_state_action: BUG! can't skip half of page for non-512"
1698	"byte page size 8x chips\n");
1699	return -1;
1700	}
1701	NS_DBG("do_state_action: set internal offset to %d\n", ns->geom.pgsz/2);
1702	ns->regs.off = ns->geom.pgsz/2;
1703	break;
1704
1705	case ACTION_OOBOFF:
1706	NS_DBG("do_state_action: set internal offset to %d\n", ns->geom.pgsz);
1707	ns->regs.off = ns->geom.pgsz;
1708	break;
1709
1710	default:
1711	NS_DBG("do_state_action: BUG! unknown action\n");
1712	}
1713
1714	return 0;
1715	}
1716
1717	/*
1718	* Switch simulator's state.
1719	*/
1720	static void ns_switch_state(struct nandsim *ns)
1721	{
1722	if (ns->op) {
1723	/*
1724	* The current operation have already been identified.
1725	* Just follow the states chain.
1726	*/
1727
1728	ns->stateidx += 1;
1729	ns->state = ns->nxstate;
1730	ns->nxstate = ns->op[ns->stateidx + 1];
1731
1732	NS_DBG("switch_state: operation is known, switch to the next state, "
1733	"state: %s, nxstate: %s\n",
1734	ns_get_state_name(ns->state),
1735	ns_get_state_name(ns->nxstate));
1736	} else {
1737	/*
1738	* We don't yet know which operation we perform.
1739	* Try to identify it.
1740	*/
1741
1742	/*
1743	* The only event causing the switch_state function to
1744	* be called with yet unknown operation is new command.
1745	*/
1746	ns->state = ns_get_state_by_command(command: ns->regs.command);
1747
1748	NS_DBG("switch_state: operation is unknown, try to find it\n");
1749
1750	if (ns_find_operation(ns, flag: 0))
1751	return;
1752	}
1753
1754	/* See, whether we need to do some action */
1755	if ((ns->state & ACTION_MASK) &&
1756	ns_do_state_action(ns, action: ns->state) < 0) {
1757	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1758	return;
1759	}
1760
1761	/* For 16x devices column means the page offset in words */
1762	if ((ns->nxstate & STATE_ADDR_MASK) && ns->busw == 16) {
1763	NS_DBG("switch_state: double the column number for 16x device\n");
1764	ns->regs.column <<= 1;
1765	}
1766
1767	if (NS_STATE(ns->nxstate) == STATE_READY) {
1768	/*
1769	* The current state is the last. Return to STATE_READY
1770	*/
1771
1772	u_char status = NS_STATUS_OK(ns);
1773
1774	/* In case of data states, see if all bytes were input/output */
1775	if ((ns->state & (STATE_DATAIN_MASK | STATE_DATAOUT_MASK))
1776	&& ns->regs.count != ns->regs.num) {
1777	NS_WARN("switch_state: not all bytes were processed, %d left\n",
1778	ns->regs.num - ns->regs.count);
1779	status = NS_STATUS_FAILED(ns);
1780	}
1781
1782	NS_DBG("switch_state: operation complete, switch to STATE_READY state\n");
1783
1784	ns_switch_to_ready_state(ns, status);
1785
1786	return;
1787	} else if (ns->nxstate & (STATE_DATAIN_MASK | STATE_DATAOUT_MASK)) {
1788	/*
1789	* If the next state is data input/output, switch to it now
1790	*/
1791
1792	ns->state = ns->nxstate;
1793	ns->nxstate = ns->op[++ns->stateidx + 1];
1794	ns->regs.num = ns->regs.count = 0;
1795
1796	NS_DBG("switch_state: the next state is data I/O, switch, "
1797	"state: %s, nxstate: %s\n",
1798	ns_get_state_name(ns->state),
1799	ns_get_state_name(ns->nxstate));
1800
1801	/*
1802	* Set the internal register to the count of bytes which
1803	* are expected to be input or output
1804	*/
1805	switch (NS_STATE(ns->state)) {
1806	case STATE_DATAIN:
1807	case STATE_DATAOUT:
1808	ns->regs.num = ns->geom.pgszoob - NS_PAGE_BYTE_SHIFT(ns);
1809	break;
1810
1811	case STATE_DATAOUT_ID:
1812	ns->regs.num = ns->geom.idbytes;
1813	break;
1814
1815	case STATE_DATAOUT_STATUS:
1816	ns->regs.count = ns->regs.num = 0;
1817	break;
1818
1819	default:
1820	NS_ERR("switch_state: BUG! unknown data state\n");
1821	}
1822
1823	} else if (ns->nxstate & STATE_ADDR_MASK) {
1824	/*
1825	* If the next state is address input, set the internal
1826	* register to the number of expected address bytes
1827	*/
1828
1829	ns->regs.count = 0;
1830
1831	switch (NS_STATE(ns->nxstate)) {
1832	case STATE_ADDR_PAGE:
1833	ns->regs.num = ns->geom.pgaddrbytes;
1834
1835	break;
1836	case STATE_ADDR_SEC:
1837	ns->regs.num = ns->geom.secaddrbytes;
1838	break;
1839
1840	case STATE_ADDR_ZERO:
1841	ns->regs.num = 1;
1842	break;
1843
1844	case STATE_ADDR_COLUMN:
1845	/* Column address is always 2 bytes */
1846	ns->regs.num = ns->geom.pgaddrbytes - ns->geom.secaddrbytes;
1847	break;
1848
1849	default:
1850	NS_ERR("switch_state: BUG! unknown address state\n");
1851	}
1852	} else {
1853	/*
1854	* Just reset internal counters.
1855	*/
1856
1857	ns->regs.num = 0;
1858	ns->regs.count = 0;
1859	}
1860	}
1861
1862	static u_char ns_nand_read_byte(struct nand_chip *chip)
1863	{
1864	struct nandsim *ns = nand_get_controller_data(chip);
1865	u_char outb = 0x00;
1866
1867	/* Sanity and correctness checks */
1868	if (!ns->lines.ce) {
1869	NS_ERR("read_byte: chip is disabled, return %#x\n", (uint)outb);
1870	return outb;
1871	}
1872	if (ns->lines.ale || ns->lines.cle) {
1873	NS_ERR("read_byte: ALE or CLE pin is high, return %#x\n", (uint)outb);
1874	return outb;
1875	}
1876	if (!(ns->state & STATE_DATAOUT_MASK)) {
1877	NS_WARN("read_byte: unexpected data output cycle, state is %s return %#x\n",
1878	ns_get_state_name(ns->state), (uint)outb);
1879	return outb;
1880	}
1881
1882	/* Status register may be read as many times as it is wanted */
1883	if (NS_STATE(ns->state) == STATE_DATAOUT_STATUS) {
1884	NS_DBG("read_byte: return %#x status\n", ns->regs.status);
1885	return ns->regs.status;
1886	}
1887
1888	/* Check if there is any data in the internal buffer which may be read */
1889	if (ns->regs.count == ns->regs.num) {
1890	NS_WARN("read_byte: no more data to output, return %#x\n", (uint)outb);
1891	return outb;
1892	}
1893
1894	switch (NS_STATE(ns->state)) {
1895	case STATE_DATAOUT:
1896	if (ns->busw == 8) {
1897	outb = ns->buf.byte[ns->regs.count];
1898	ns->regs.count += 1;
1899	} else {
1900	outb = (u_char)cpu_to_le16(ns->buf.word[ns->regs.count >> 1]);
1901	ns->regs.count += 2;
1902	}
1903	break;
1904	case STATE_DATAOUT_ID:
1905	NS_DBG("read_byte: read ID byte %d, total = %d\n", ns->regs.count, ns->regs.num);
1906	outb = ns->ids[ns->regs.count];
1907	ns->regs.count += 1;
1908	break;
1909	default:
1910	BUG();
1911	}
1912
1913	if (ns->regs.count == ns->regs.num) {
1914	NS_DBG("read_byte: all bytes were read\n");
1915
1916	if (NS_STATE(ns->nxstate) == STATE_READY)
1917	ns_switch_state(ns);
1918	}
1919
1920	return outb;
1921	}
1922
1923	static void ns_nand_write_byte(struct nand_chip *chip, u_char byte)
1924	{
1925	struct nandsim *ns = nand_get_controller_data(chip);
1926
1927	/* Sanity and correctness checks */
1928	if (!ns->lines.ce) {
1929	NS_ERR("write_byte: chip is disabled, ignore write\n");
1930	return;
1931	}
1932	if (ns->lines.ale && ns->lines.cle) {
1933	NS_ERR("write_byte: ALE and CLE pins are high simultaneously, ignore write\n");
1934	return;
1935	}
1936
1937	if (ns->lines.cle == 1) {
1938	/*
1939	* The byte written is a command.
1940	*/
1941
1942	if (byte == NAND_CMD_RESET) {
1943	NS_LOG("reset chip\n");
1944	ns_switch_to_ready_state(ns, NS_STATUS_OK(ns));
1945	return;
1946	}
1947
1948	/* Check that the command byte is correct */
1949	if (ns_check_command(cmd: byte)) {
1950	NS_ERR("write_byte: unknown command %#x\n", (uint)byte);
1951	return;
1952	}
1953
1954	if (NS_STATE(ns->state) == STATE_DATAOUT_STATUS
1955	|| NS_STATE(ns->state) == STATE_DATAOUT) {
1956	int row = ns->regs.row;
1957
1958	ns_switch_state(ns);
1959	if (byte == NAND_CMD_RNDOUT)
1960	ns->regs.row = row;
1961	}
1962
1963	/* Check if chip is expecting command */
1964	if (NS_STATE(ns->nxstate) != STATE_UNKNOWN && !(ns->nxstate & STATE_CMD_MASK)) {
1965	/* Do not warn if only 2 id bytes are read */
1966	if (!(ns->regs.command == NAND_CMD_READID &&
1967	NS_STATE(ns->state) == STATE_DATAOUT_ID && ns->regs.count == 2)) {
1968	/*
1969	* We are in situation when something else (not command)
1970	* was expected but command was input. In this case ignore
1971	* previous command(s)/state(s) and accept the last one.
1972	*/
1973	NS_WARN("write_byte: command (%#x) wasn't expected, expected state is %s, ignore previous states\n",
1974	(uint)byte,
1975	ns_get_state_name(ns->nxstate));
1976	}
1977	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1978	}
1979
1980	NS_DBG("command byte corresponding to %s state accepted\n",
1981	ns_get_state_name(ns_get_state_by_command(byte)));
1982	ns->regs.command = byte;
1983	ns_switch_state(ns);
1984
1985	} else if (ns->lines.ale == 1) {
1986	/*
1987	* The byte written is an address.
1988	*/
1989
1990	if (NS_STATE(ns->nxstate) == STATE_UNKNOWN) {
1991
1992	NS_DBG("write_byte: operation isn't known yet, identify it\n");
1993
1994	if (ns_find_operation(ns, flag: 1) < 0)
1995	return;
1996
1997	if ((ns->state & ACTION_MASK) &&
1998	ns_do_state_action(ns, action: ns->state) < 0) {
1999	ns_switch_to_ready_state(ns,
2000	NS_STATUS_FAILED(ns));
2001	return;
2002	}
2003
2004	ns->regs.count = 0;
2005	switch (NS_STATE(ns->nxstate)) {
2006	case STATE_ADDR_PAGE:
2007	ns->regs.num = ns->geom.pgaddrbytes;
2008	break;
2009	case STATE_ADDR_SEC:
2010	ns->regs.num = ns->geom.secaddrbytes;
2011	break;
2012	case STATE_ADDR_ZERO:
2013	ns->regs.num = 1;
2014	break;
2015	default:
2016	BUG();
2017	}
2018	}
2019
2020	/* Check that chip is expecting address */
2021	if (!(ns->nxstate & STATE_ADDR_MASK)) {
2022	NS_ERR("write_byte: address (%#x) isn't expected, expected state is %s, switch to STATE_READY\n",
2023	(uint)byte, ns_get_state_name(ns->nxstate));
2024	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2025	return;
2026	}
2027
2028	/* Check if this is expected byte */
2029	if (ns->regs.count == ns->regs.num) {
2030	NS_ERR("write_byte: no more address bytes expected\n");
2031	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2032	return;
2033	}
2034
2035	ns_accept_addr_byte(ns, bt: byte);
2036
2037	ns->regs.count += 1;
2038
2039	NS_DBG("write_byte: address byte %#x was accepted (%d bytes input, %d expected)\n",
2040	(uint)byte, ns->regs.count, ns->regs.num);
2041
2042	if (ns->regs.count == ns->regs.num) {
2043	NS_DBG("address (%#x, %#x) is accepted\n", ns->regs.row, ns->regs.column);
2044	ns_switch_state(ns);
2045	}
2046
2047	} else {
2048	/*
2049	* The byte written is an input data.
2050	*/
2051
2052	/* Check that chip is expecting data input */
2053	if (!(ns->state & STATE_DATAIN_MASK)) {
2054	NS_ERR("write_byte: data input (%#x) isn't expected, state is %s, switch to %s\n",
2055	(uint)byte, ns_get_state_name(ns->state),
2056	ns_get_state_name(STATE_READY));
2057	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2058	return;
2059	}
2060
2061	/* Check if this is expected byte */
2062	if (ns->regs.count == ns->regs.num) {
2063	NS_WARN("write_byte: %u input bytes has already been accepted, ignore write\n",
2064	ns->regs.num);
2065	return;
2066	}
2067
2068	if (ns->busw == 8) {
2069	ns->buf.byte[ns->regs.count] = byte;
2070	ns->regs.count += 1;
2071	} else {
2072	ns->buf.word[ns->regs.count >> 1] = cpu_to_le16((uint16_t)byte);
2073	ns->regs.count += 2;
2074	}
2075	}
2076
2077	return;
2078	}
2079
2080	static void ns_nand_write_buf(struct nand_chip *chip, const u_char *buf,
2081	int len)
2082	{
2083	struct nandsim *ns = nand_get_controller_data(chip);
2084
2085	/* Check that chip is expecting data input */
2086	if (!(ns->state & STATE_DATAIN_MASK)) {
2087	NS_ERR("write_buf: data input isn't expected, state is %s, switch to STATE_READY\n",
2088	ns_get_state_name(ns->state));
2089	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2090	return;
2091	}
2092
2093	/* Check if these are expected bytes */
2094	if (ns->regs.count + len > ns->regs.num) {
2095	NS_ERR("write_buf: too many input bytes\n");
2096	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2097	return;
2098	}
2099
2100	memcpy(ns->buf.byte + ns->regs.count, buf, len);
2101	ns->regs.count += len;
2102
2103	if (ns->regs.count == ns->regs.num) {
2104	NS_DBG("write_buf: %d bytes were written\n", ns->regs.count);
2105	}
2106	}
2107
2108	static void ns_nand_read_buf(struct nand_chip *chip, u_char *buf, int len)
2109	{
2110	struct nandsim *ns = nand_get_controller_data(chip);
2111
2112	/* Sanity and correctness checks */
2113	if (!ns->lines.ce) {
2114	NS_ERR("read_buf: chip is disabled\n");
2115	return;
2116	}
2117	if (ns->lines.ale || ns->lines.cle) {
2118	NS_ERR("read_buf: ALE or CLE pin is high\n");
2119	return;
2120	}
2121	if (!(ns->state & STATE_DATAOUT_MASK)) {
2122	NS_WARN("read_buf: unexpected data output cycle, current state is %s\n",
2123	ns_get_state_name(ns->state));
2124	return;
2125	}
2126
2127	if (NS_STATE(ns->state) != STATE_DATAOUT) {
2128	int i;
2129
2130	for (i = 0; i < len; i++)
2131	buf[i] = ns_nand_read_byte(chip);
2132
2133	return;
2134	}
2135
2136	/* Check if these are expected bytes */
2137	if (ns->regs.count + len > ns->regs.num) {
2138	NS_ERR("read_buf: too many bytes to read\n");
2139	ns_switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2140	return;
2141	}
2142
2143	memcpy(buf, ns->buf.byte + ns->regs.count, len);
2144	ns->regs.count += len;
2145
2146	if (ns->regs.count == ns->regs.num) {
2147	if (NS_STATE(ns->nxstate) == STATE_READY)
2148	ns_switch_state(ns);
2149	}
2150
2151	return;
2152	}
2153
2154	static int ns_exec_op(struct nand_chip *chip, const struct nand_operation *op,
2155	bool check_only)
2156	{
2157	int i;
2158	unsigned int op_id;
2159	const struct nand_op_instr *instr = NULL;
2160	struct nandsim *ns = nand_get_controller_data(chip);
2161
2162	if (check_only) {
2163	/* The current implementation of nandsim needs to know the
2164	* ongoing operation when performing the address cycles. This
2165	* means it cannot make the difference between a regular read
2166	* and a continuous read. Hence, this hack to manually refuse
2167	* supporting sequential cached operations.
2168	*/
2169	for (op_id = 0; op_id < op->ninstrs; op_id++) {
2170	instr = &op->instrs[op_id];
2171	if (instr->type == NAND_OP_CMD_INSTR &&
2172	(instr->ctx.cmd.opcode == NAND_CMD_READCACHEEND ||
2173	instr->ctx.cmd.opcode == NAND_CMD_READCACHESEQ))
2174	return -EOPNOTSUPP;
2175	}
2176
2177	return 0;
2178	}
2179
2180	ns->lines.ce = 1;
2181
2182	for (op_id = 0; op_id < op->ninstrs; op_id++) {
2183	instr = &op->instrs[op_id];
2184	ns->lines.cle = 0;
2185	ns->lines.ale = 0;
2186
2187	switch (instr->type) {
2188	case NAND_OP_CMD_INSTR:
2189	ns->lines.cle = 1;
2190	ns_nand_write_byte(chip, byte: instr->ctx.cmd.opcode);
2191	break;
2192	case NAND_OP_ADDR_INSTR:
2193	ns->lines.ale = 1;
2194	for (i = 0; i < instr->ctx.addr.naddrs; i++)
2195	ns_nand_write_byte(chip, byte: instr->ctx.addr.addrs[i]);
2196	break;
2197	case NAND_OP_DATA_IN_INSTR:
2198	ns_nand_read_buf(chip, buf: instr->ctx.data.buf.in, len: instr->ctx.data.len);
2199	break;
2200	case NAND_OP_DATA_OUT_INSTR:
2201	ns_nand_write_buf(chip, buf: instr->ctx.data.buf.out, len: instr->ctx.data.len);
2202	break;
2203	case NAND_OP_WAITRDY_INSTR:
2204	/* we are always ready */
2205	break;
2206	}
2207	}
2208
2209	return 0;
2210	}
2211
2212	static int ns_attach_chip(struct nand_chip *chip)
2213	{
2214	unsigned int eccsteps, eccbytes;
2215
2216	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
2217	chip->ecc.algo = bch ? NAND_ECC_ALGO_BCH : NAND_ECC_ALGO_HAMMING;
2218
2219	if (!bch)
2220	return 0;
2221
2222	if (!IS_ENABLED(CONFIG_MTD_NAND_ECC_SW_BCH)) {
2223	NS_ERR("BCH ECC support is disabled\n");
2224	return -EINVAL;
2225	}
2226
2227	/* Use 512-byte ecc blocks */
2228	eccsteps = nsmtd->writesize / 512;
2229	eccbytes = ((bch * 13) + 7) / 8;
2230
2231	/* Do not bother supporting small page devices */
2232	if (nsmtd->oobsize < 64 || !eccsteps) {
2233	NS_ERR("BCH not available on small page devices\n");
2234	return -EINVAL;
2235	}
2236
2237	if (((eccbytes * eccsteps) + 2) > nsmtd->oobsize) {
2238	NS_ERR("Invalid BCH value %u\n", bch);
2239	return -EINVAL;
2240	}
2241
2242	chip->ecc.size = 512;
2243	chip->ecc.strength = bch;
2244	chip->ecc.bytes = eccbytes;
2245
2246	NS_INFO("Using %u-bit/%u bytes BCH ECC\n", bch, chip->ecc.size);
2247
2248	return 0;
2249	}
2250
2251	static const struct nand_controller_ops ns_controller_ops = {
2252	.attach_chip = ns_attach_chip,
2253	.exec_op = ns_exec_op,
2254	};
2255
2256	/*
2257	* Module initialization function
2258	*/
2259	static int __init ns_init_module(void)
2260	{
2261	struct list_head *pos, *n;
2262	struct nand_chip *chip;
2263	struct nandsim *ns;
2264	int ret;
2265
2266	if (bus_width != 8 && bus_width != 16) {
2267	NS_ERR("wrong bus width (%d), use only 8 or 16\n", bus_width);
2268	return -EINVAL;
2269	}
2270
2271	ns = kzalloc(sizeof(struct nandsim), GFP_KERNEL);
2272	if (!ns) {
2273	NS_ERR("unable to allocate core structures.\n");
2274	return -ENOMEM;
2275	}
2276	chip = &ns->chip;
2277	nsmtd = nand_to_mtd(chip);
2278	nand_set_controller_data(chip, priv: (void *)ns);
2279
2280	/* The NAND_SKIP_BBTSCAN option is necessary for 'overridesize' */
2281	/* and 'badblocks' parameters to work */
2282	chip->options |= NAND_SKIP_BBTSCAN;
2283
2284	switch (bbt) {
2285	case 2:
2286	chip->bbt_options |= NAND_BBT_NO_OOB;
2287	fallthrough;
2288	case 1:
2289	chip->bbt_options |= NAND_BBT_USE_FLASH;
2290	fallthrough;
2291	case 0:
2292	break;
2293	default:
2294	NS_ERR("bbt has to be 0..2\n");
2295	ret = -EINVAL;
2296	goto free_ns_struct;
2297	}
2298	/*
2299	* Perform minimum nandsim structure initialization to handle
2300	* the initial ID read command correctly
2301	*/
2302	if (id_bytes[6] != 0xFF || id_bytes[7] != 0xFF)
2303	ns->geom.idbytes = 8;
2304	else if (id_bytes[4] != 0xFF || id_bytes[5] != 0xFF)
2305	ns->geom.idbytes = 6;
2306	else if (id_bytes[2] != 0xFF || id_bytes[3] != 0xFF)
2307	ns->geom.idbytes = 4;
2308	else
2309	ns->geom.idbytes = 2;
2310	ns->regs.status = NS_STATUS_OK(ns);
2311	ns->nxstate = STATE_UNKNOWN;
2312	ns->options |= OPT_PAGE512; /* temporary value */
2313	memcpy(ns->ids, id_bytes, sizeof(ns->ids));
2314	if (bus_width == 16) {
2315	ns->busw = 16;
2316	chip->options |= NAND_BUSWIDTH_16;
2317	}
2318
2319	nsmtd->owner = THIS_MODULE;
2320
2321	ret = ns_parse_weakblocks();
2322	if (ret)
2323	goto free_ns_struct;
2324
2325	ret = ns_parse_weakpages();
2326	if (ret)
2327	goto free_wb_list;
2328
2329	ret = ns_parse_gravepages();
2330	if (ret)
2331	goto free_wp_list;
2332
2333	nand_controller_init(nfc: &ns->base);
2334	ns->base.ops = &ns_controller_ops;
2335	chip->controller = &ns->base;
2336
2337	ret = nand_scan(chip, max_chips: 1);
2338	if (ret) {
2339	NS_ERR("Could not scan NAND Simulator device\n");
2340	goto free_gp_list;
2341	}
2342
2343	if (overridesize) {
2344	uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
2345	struct nand_memory_organization *memorg;
2346	u64 targetsize;
2347
2348	memorg = nanddev_get_memorg(nand: &chip->base);
2349
2350	if (new_size >> overridesize != nsmtd->erasesize) {
2351	NS_ERR("overridesize is too big\n");
2352	ret = -EINVAL;
2353	goto cleanup_nand;
2354	}
2355
2356	/* N.B. This relies on nand_scan not doing anything with the size before we change it */
2357	nsmtd->size = new_size;
2358	memorg->eraseblocks_per_lun = 1 << overridesize;
2359	targetsize = nanddev_target_size(nand: &chip->base);
2360	chip->chip_shift = ffs(nsmtd->erasesize) + overridesize - 1;
2361	chip->pagemask = (targetsize >> chip->page_shift) - 1;
2362	}
2363
2364	ret = ns_setup_wear_reporting(mtd: nsmtd);
2365	if (ret)
2366	goto cleanup_nand;
2367
2368	ret = ns_init(mtd: nsmtd);
2369	if (ret)
2370	goto free_ebw;
2371
2372	ret = nand_create_bbt(chip);
2373	if (ret)
2374	goto free_ns_object;
2375
2376	ret = ns_parse_badblocks(ns, mtd: nsmtd);
2377	if (ret)
2378	goto free_ns_object;
2379
2380	/* Register NAND partitions */
2381	ret = mtd_device_register(nsmtd, &ns->partitions[0], ns->nbparts);
2382	if (ret)
2383	goto free_ns_object;
2384
2385	ret = ns_debugfs_create(ns);
2386	if (ret)
2387	goto unregister_mtd;
2388
2389	return 0;
2390
2391	unregister_mtd:
2392	WARN_ON(mtd_device_unregister(nsmtd));
2393	free_ns_object:
2394	ns_free(ns);
2395	free_ebw:
2396	kfree(objp: erase_block_wear);
2397	cleanup_nand:
2398	nand_cleanup(chip);
2399	free_gp_list:
2400	list_for_each_safe(pos, n, &grave_pages) {
2401	list_del(entry: pos);
2402	kfree(list_entry(pos, struct grave_page, list));
2403	}
2404	free_wp_list:
2405	list_for_each_safe(pos, n, &weak_pages) {
2406	list_del(entry: pos);
2407	kfree(list_entry(pos, struct weak_page, list));
2408	}
2409	free_wb_list:
2410	list_for_each_safe(pos, n, &weak_blocks) {
2411	list_del(entry: pos);
2412	kfree(list_entry(pos, struct weak_block, list));
2413	}
2414	free_ns_struct:
2415	kfree(objp: ns);
2416
2417	return ret;
2418	}
2419
2420	module_init(ns_init_module);
2421
2422	/*
2423	* Module clean-up function
2424	*/
2425	static void __exit ns_cleanup_module(void)
2426	{
2427	struct nand_chip *chip = mtd_to_nand(mtd: nsmtd);
2428	struct nandsim *ns = nand_get_controller_data(chip);
2429	struct list_head *pos, *n;
2430
2431	ns_debugfs_remove(ns);
2432	WARN_ON(mtd_device_unregister(nsmtd));
2433	ns_free(ns);
2434	kfree(objp: erase_block_wear);
2435	nand_cleanup(chip);
2436
2437	list_for_each_safe(pos, n, &grave_pages) {
2438	list_del(entry: pos);
2439	kfree(list_entry(pos, struct grave_page, list));
2440	}
2441
2442	list_for_each_safe(pos, n, &weak_pages) {
2443	list_del(entry: pos);
2444	kfree(list_entry(pos, struct weak_page, list));
2445	}
2446
2447	list_for_each_safe(pos, n, &weak_blocks) {
2448	list_del(entry: pos);
2449	kfree(list_entry(pos, struct weak_block, list));
2450	}
2451
2452	kfree(objp: ns);
2453	}
2454
2455	module_exit(ns_cleanup_module);
2456
2457	MODULE_LICENSE ("GPL");
2458	MODULE_AUTHOR ("Artem B. Bityuckiy");
2459	MODULE_DESCRIPTION ("The NAND flash simulator");
2460