linux/drivers/mtd/nand/nandsim.c
<<
>>
Prefs
   1/*
   2 * NAND flash simulator.
   3 *
   4 * Author: Artem B. Bityuckiy <dedekind@oktetlabs.ru>, <dedekind@infradead.org>
   5 *
   6 * Copyright (C) 2004 Nokia Corporation
   7 *
   8 * Note: NS means "NAND Simulator".
   9 * Note: Input means input TO flash chip, output means output FROM chip.
  10 *
  11 * This program is free software; you can redistribute it and/or modify it
  12 * under the terms of the GNU General Public License as published by the
  13 * Free Software Foundation; either version 2, or (at your option) any later
  14 * version.
  15 *
  16 * This program is distributed in the hope that it will be useful, but
  17 * WITHOUT ANY WARRANTY; without even the implied warranty of
  18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
  19 * Public License for more details.
  20 *
  21 * You should have received a copy of the GNU General Public License
  22 * along with this program; if not, write to the Free Software
  23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA
  24 */
  25
  26#include <linux/init.h>
  27#include <linux/types.h>
  28#include <linux/module.h>
  29#include <linux/moduleparam.h>
  30#include <linux/vmalloc.h>
  31#include <asm/div64.h>
  32#include <linux/slab.h>
  33#include <linux/errno.h>
  34#include <linux/string.h>
  35#include <linux/mtd/mtd.h>
  36#include <linux/mtd/nand.h>
  37#include <linux/mtd/partitions.h>
  38#include <linux/delay.h>
  39#include <linux/list.h>
  40#include <linux/random.h>
  41#include <linux/sched.h>
  42#include <linux/fs.h>
  43#include <linux/pagemap.h>
  44
  45/* Default simulator parameters values */
  46#if !defined(CONFIG_NANDSIM_FIRST_ID_BYTE)  || \
  47    !defined(CONFIG_NANDSIM_SECOND_ID_BYTE) || \
  48    !defined(CONFIG_NANDSIM_THIRD_ID_BYTE)  || \
  49    !defined(CONFIG_NANDSIM_FOURTH_ID_BYTE)
  50#define CONFIG_NANDSIM_FIRST_ID_BYTE  0x98
  51#define CONFIG_NANDSIM_SECOND_ID_BYTE 0x39
  52#define CONFIG_NANDSIM_THIRD_ID_BYTE  0xFF /* No byte */
  53#define CONFIG_NANDSIM_FOURTH_ID_BYTE 0xFF /* No byte */
  54#endif
  55
  56#ifndef CONFIG_NANDSIM_ACCESS_DELAY
  57#define CONFIG_NANDSIM_ACCESS_DELAY 25
  58#endif
  59#ifndef CONFIG_NANDSIM_PROGRAMM_DELAY
  60#define CONFIG_NANDSIM_PROGRAMM_DELAY 200
  61#endif
  62#ifndef CONFIG_NANDSIM_ERASE_DELAY
  63#define CONFIG_NANDSIM_ERASE_DELAY 2
  64#endif
  65#ifndef CONFIG_NANDSIM_OUTPUT_CYCLE
  66#define CONFIG_NANDSIM_OUTPUT_CYCLE 40
  67#endif
  68#ifndef CONFIG_NANDSIM_INPUT_CYCLE
  69#define CONFIG_NANDSIM_INPUT_CYCLE  50
  70#endif
  71#ifndef CONFIG_NANDSIM_BUS_WIDTH
  72#define CONFIG_NANDSIM_BUS_WIDTH  8
  73#endif
  74#ifndef CONFIG_NANDSIM_DO_DELAYS
  75#define CONFIG_NANDSIM_DO_DELAYS  0
  76#endif
  77#ifndef CONFIG_NANDSIM_LOG
  78#define CONFIG_NANDSIM_LOG        0
  79#endif
  80#ifndef CONFIG_NANDSIM_DBG
  81#define CONFIG_NANDSIM_DBG        0
  82#endif
  83#ifndef CONFIG_NANDSIM_MAX_PARTS
  84#define CONFIG_NANDSIM_MAX_PARTS  32
  85#endif
  86
  87static uint first_id_byte  = CONFIG_NANDSIM_FIRST_ID_BYTE;
  88static uint second_id_byte = CONFIG_NANDSIM_SECOND_ID_BYTE;
  89static uint third_id_byte  = CONFIG_NANDSIM_THIRD_ID_BYTE;
  90static uint fourth_id_byte = CONFIG_NANDSIM_FOURTH_ID_BYTE;
  91static uint access_delay   = CONFIG_NANDSIM_ACCESS_DELAY;
  92static uint programm_delay = CONFIG_NANDSIM_PROGRAMM_DELAY;
  93static uint erase_delay    = CONFIG_NANDSIM_ERASE_DELAY;
  94static uint output_cycle   = CONFIG_NANDSIM_OUTPUT_CYCLE;
  95static uint input_cycle    = CONFIG_NANDSIM_INPUT_CYCLE;
  96static uint bus_width      = CONFIG_NANDSIM_BUS_WIDTH;
  97static uint do_delays      = CONFIG_NANDSIM_DO_DELAYS;
  98static uint log            = CONFIG_NANDSIM_LOG;
  99static uint dbg            = CONFIG_NANDSIM_DBG;
 100static unsigned long parts[CONFIG_NANDSIM_MAX_PARTS];
 101static unsigned int parts_num;
 102static char *badblocks = NULL;
 103static char *weakblocks = NULL;
 104static char *weakpages = NULL;
 105static unsigned int bitflips = 0;
 106static char *gravepages = NULL;
 107static unsigned int rptwear = 0;
 108static unsigned int overridesize = 0;
 109static char *cache_file = NULL;
 110
 111module_param(first_id_byte,  uint, 0400);
 112module_param(second_id_byte, uint, 0400);
 113module_param(third_id_byte,  uint, 0400);
 114module_param(fourth_id_byte, uint, 0400);
 115module_param(access_delay,   uint, 0400);
 116module_param(programm_delay, uint, 0400);
 117module_param(erase_delay,    uint, 0400);
 118module_param(output_cycle,   uint, 0400);
 119module_param(input_cycle,    uint, 0400);
 120module_param(bus_width,      uint, 0400);
 121module_param(do_delays,      uint, 0400);
 122module_param(log,            uint, 0400);
 123module_param(dbg,            uint, 0400);
 124module_param_array(parts, ulong, &parts_num, 0400);
 125module_param(badblocks,      charp, 0400);
 126module_param(weakblocks,     charp, 0400);
 127module_param(weakpages,      charp, 0400);
 128module_param(bitflips,       uint, 0400);
 129module_param(gravepages,     charp, 0400);
 130module_param(rptwear,        uint, 0400);
 131module_param(overridesize,   uint, 0400);
 132module_param(cache_file,     charp, 0400);
 133
 134MODULE_PARM_DESC(first_id_byte,  "The first byte returned by NAND Flash 'read ID' command (manufacturer ID)");
 135MODULE_PARM_DESC(second_id_byte, "The second byte returned by NAND Flash 'read ID' command (chip ID)");
 136MODULE_PARM_DESC(third_id_byte,  "The third byte returned by NAND Flash 'read ID' command");
 137MODULE_PARM_DESC(fourth_id_byte, "The fourth byte returned by NAND Flash 'read ID' command");
 138MODULE_PARM_DESC(access_delay,   "Initial page access delay (microseconds)");
 139MODULE_PARM_DESC(programm_delay, "Page programm delay (microseconds");
 140MODULE_PARM_DESC(erase_delay,    "Sector erase delay (milliseconds)");
 141MODULE_PARM_DESC(output_cycle,   "Word output (from flash) time (nanoseconds)");
 142MODULE_PARM_DESC(input_cycle,    "Word input (to flash) time (nanoseconds)");
 143MODULE_PARM_DESC(bus_width,      "Chip's bus width (8- or 16-bit)");
 144MODULE_PARM_DESC(do_delays,      "Simulate NAND delays using busy-waits if not zero");
 145MODULE_PARM_DESC(log,            "Perform logging if not zero");
 146MODULE_PARM_DESC(dbg,            "Output debug information if not zero");
 147MODULE_PARM_DESC(parts,          "Partition sizes (in erase blocks) separated by commas");
 148/* Page and erase block positions for the following parameters are independent of any partitions */
 149MODULE_PARM_DESC(badblocks,      "Erase blocks that are initially marked bad, separated by commas");
 150MODULE_PARM_DESC(weakblocks,     "Weak erase blocks [: remaining erase cycles (defaults to 3)]"
 151                                 " separated by commas e.g. 113:2 means eb 113"
 152                                 " can be erased only twice before failing");
 153MODULE_PARM_DESC(weakpages,      "Weak pages [: maximum writes (defaults to 3)]"
 154                                 " separated by commas e.g. 1401:2 means page 1401"
 155                                 " can be written only twice before failing");
 156MODULE_PARM_DESC(bitflips,       "Maximum number of random bit flips per page (zero by default)");
 157MODULE_PARM_DESC(gravepages,     "Pages that lose data [: maximum reads (defaults to 3)]"
 158                                 " separated by commas e.g. 1401:2 means page 1401"
 159                                 " can be read only twice before failing");
 160MODULE_PARM_DESC(rptwear,        "Number of erases inbetween reporting wear, if not zero");
 161MODULE_PARM_DESC(overridesize,   "Specifies the NAND Flash size overriding the ID bytes. "
 162                                 "The size is specified in erase blocks and as the exponent of a power of two"
 163                                 " e.g. 5 means a size of 32 erase blocks");
 164MODULE_PARM_DESC(cache_file,     "File to use to cache nand pages instead of memory");
 165
 166/* The largest possible page size */
 167#define NS_LARGEST_PAGE_SIZE    4096
 168
 169/* The prefix for simulator output */
 170#define NS_OUTPUT_PREFIX "[nandsim]"
 171
 172/* Simulator's output macros (logging, debugging, warning, error) */
 173#define NS_LOG(args...) \
 174        do { if (log) printk(KERN_DEBUG NS_OUTPUT_PREFIX " log: " args); } while(0)
 175#define NS_DBG(args...) \
 176        do { if (dbg) printk(KERN_DEBUG NS_OUTPUT_PREFIX " debug: " args); } while(0)
 177#define NS_WARN(args...) \
 178        do { printk(KERN_WARNING NS_OUTPUT_PREFIX " warning: " args); } while(0)
 179#define NS_ERR(args...) \
 180        do { printk(KERN_ERR NS_OUTPUT_PREFIX " error: " args); } while(0)
 181#define NS_INFO(args...) \
 182        do { printk(KERN_INFO NS_OUTPUT_PREFIX " " args); } while(0)
 183
 184/* Busy-wait delay macros (microseconds, milliseconds) */
 185#define NS_UDELAY(us) \
 186        do { if (do_delays) udelay(us); } while(0)
 187#define NS_MDELAY(us) \
 188        do { if (do_delays) mdelay(us); } while(0)
 189
 190/* Is the nandsim structure initialized ? */
 191#define NS_IS_INITIALIZED(ns) ((ns)->geom.totsz != 0)
 192
 193/* Good operation completion status */
 194#define NS_STATUS_OK(ns) (NAND_STATUS_READY | (NAND_STATUS_WP * ((ns)->lines.wp == 0)))
 195
 196/* Operation failed completion status */
 197#define NS_STATUS_FAILED(ns) (NAND_STATUS_FAIL | NS_STATUS_OK(ns))
 198
 199/* Calculate the page offset in flash RAM image by (row, column) address */
 200#define NS_RAW_OFFSET(ns) \
 201        (((ns)->regs.row << (ns)->geom.pgshift) + ((ns)->regs.row * (ns)->geom.oobsz) + (ns)->regs.column)
 202
 203/* Calculate the OOB offset in flash RAM image by (row, column) address */
 204#define NS_RAW_OFFSET_OOB(ns) (NS_RAW_OFFSET(ns) + ns->geom.pgsz)
 205
 206/* After a command is input, the simulator goes to one of the following states */
 207#define STATE_CMD_READ0        0x00000001 /* read data from the beginning of page */
 208#define STATE_CMD_READ1        0x00000002 /* read data from the second half of page */
 209#define STATE_CMD_READSTART    0x00000003 /* read data second command (large page devices) */
 210#define STATE_CMD_PAGEPROG     0x00000004 /* start page programm */
 211#define STATE_CMD_READOOB      0x00000005 /* read OOB area */
 212#define STATE_CMD_ERASE1       0x00000006 /* sector erase first command */
 213#define STATE_CMD_STATUS       0x00000007 /* read status */
 214#define STATE_CMD_STATUS_M     0x00000008 /* read multi-plane status (isn't implemented) */
 215#define STATE_CMD_SEQIN        0x00000009 /* sequential data imput */
 216#define STATE_CMD_READID       0x0000000A /* read ID */
 217#define STATE_CMD_ERASE2       0x0000000B /* sector erase second command */
 218#define STATE_CMD_RESET        0x0000000C /* reset */
 219#define STATE_CMD_RNDOUT       0x0000000D /* random output command */
 220#define STATE_CMD_RNDOUTSTART  0x0000000E /* random output start command */
 221#define STATE_CMD_MASK         0x0000000F /* command states mask */
 222
 223/* After an address is input, the simulator goes to one of these states */
 224#define STATE_ADDR_PAGE        0x00000010 /* full (row, column) address is accepted */
 225#define STATE_ADDR_SEC         0x00000020 /* sector address was accepted */
 226#define STATE_ADDR_COLUMN      0x00000030 /* column address was accepted */
 227#define STATE_ADDR_ZERO        0x00000040 /* one byte zero address was accepted */
 228#define STATE_ADDR_MASK        0x00000070 /* address states mask */
 229
 230/* Durind data input/output the simulator is in these states */
 231#define STATE_DATAIN           0x00000100 /* waiting for data input */
 232#define STATE_DATAIN_MASK      0x00000100 /* data input states mask */
 233
 234#define STATE_DATAOUT          0x00001000 /* waiting for page data output */
 235#define STATE_DATAOUT_ID       0x00002000 /* waiting for ID bytes output */
 236#define STATE_DATAOUT_STATUS   0x00003000 /* waiting for status output */
 237#define STATE_DATAOUT_STATUS_M 0x00004000 /* waiting for multi-plane status output */
 238#define STATE_DATAOUT_MASK     0x00007000 /* data output states mask */
 239
 240/* Previous operation is done, ready to accept new requests */
 241#define STATE_READY            0x00000000
 242
 243/* This state is used to mark that the next state isn't known yet */
 244#define STATE_UNKNOWN          0x10000000
 245
 246/* Simulator's actions bit masks */
 247#define ACTION_CPY       0x00100000 /* copy page/OOB to the internal buffer */
 248#define ACTION_PRGPAGE   0x00200000 /* programm the internal buffer to flash */
 249#define ACTION_SECERASE  0x00300000 /* erase sector */
 250#define ACTION_ZEROOFF   0x00400000 /* don't add any offset to address */
 251#define ACTION_HALFOFF   0x00500000 /* add to address half of page */
 252#define ACTION_OOBOFF    0x00600000 /* add to address OOB offset */
 253#define ACTION_MASK      0x00700000 /* action mask */
 254
 255#define NS_OPER_NUM      13 /* Number of operations supported by the simulator */
 256#define NS_OPER_STATES   6  /* Maximum number of states in operation */
 257
 258#define OPT_ANY          0xFFFFFFFF /* any chip supports this operation */
 259#define OPT_PAGE256      0x00000001 /* 256-byte  page chips */
 260#define OPT_PAGE512      0x00000002 /* 512-byte  page chips */
 261#define OPT_PAGE2048     0x00000008 /* 2048-byte page chips */
 262#define OPT_SMARTMEDIA   0x00000010 /* SmartMedia technology chips */
 263#define OPT_AUTOINCR     0x00000020 /* page number auto inctimentation is possible */
 264#define OPT_PAGE512_8BIT 0x00000040 /* 512-byte page chips with 8-bit bus width */
 265#define OPT_PAGE4096     0x00000080 /* 4096-byte page chips */
 266#define OPT_LARGEPAGE    (OPT_PAGE2048 | OPT_PAGE4096) /* 2048 & 4096-byte page chips */
 267#define OPT_SMALLPAGE    (OPT_PAGE256  | OPT_PAGE512)  /* 256 and 512-byte page chips */
 268
 269/* Remove action bits ftom state */
 270#define NS_STATE(x) ((x) & ~ACTION_MASK)
 271
 272/*
 273 * Maximum previous states which need to be saved. Currently saving is
 274 * only needed for page programm operation with preceeded read command
 275 * (which is only valid for 512-byte pages).
 276 */
 277#define NS_MAX_PREVSTATES 1
 278
 279/* Maximum page cache pages needed to read or write a NAND page to the cache_file */
 280#define NS_MAX_HELD_PAGES 16
 281
 282/*
 283 * A union to represent flash memory contents and flash buffer.
 284 */
 285union ns_mem {
 286        u_char *byte;    /* for byte access */
 287        uint16_t *word;  /* for 16-bit word access */
 288};
 289
 290/*
 291 * The structure which describes all the internal simulator data.
 292 */
 293struct nandsim {
 294        struct mtd_partition partitions[CONFIG_NANDSIM_MAX_PARTS];
 295        unsigned int nbparts;
 296
 297        uint busw;              /* flash chip bus width (8 or 16) */
 298        u_char ids[4];          /* chip's ID bytes */
 299        uint32_t options;       /* chip's characteristic bits */
 300        uint32_t state;         /* current chip state */
 301        uint32_t nxstate;       /* next expected state */
 302
 303        uint32_t *op;           /* current operation, NULL operations isn't known yet  */
 304        uint32_t pstates[NS_MAX_PREVSTATES]; /* previous states */
 305        uint16_t npstates;      /* number of previous states saved */
 306        uint16_t stateidx;      /* current state index */
 307
 308        /* The simulated NAND flash pages array */
 309        union ns_mem *pages;
 310
 311        /* Slab allocator for nand pages */
 312        struct kmem_cache *nand_pages_slab;
 313
 314        /* Internal buffer of page + OOB size bytes */
 315        union ns_mem buf;
 316
 317        /* NAND flash "geometry" */
 318        struct {
 319                uint64_t totsz;     /* total flash size, bytes */
 320                uint32_t secsz;     /* flash sector (erase block) size, bytes */
 321                uint pgsz;          /* NAND flash page size, bytes */
 322                uint oobsz;         /* page OOB area size, bytes */
 323                uint64_t totszoob;  /* total flash size including OOB, bytes */
 324                uint pgszoob;       /* page size including OOB , bytes*/
 325                uint secszoob;      /* sector size including OOB, bytes */
 326                uint pgnum;         /* total number of pages */
 327                uint pgsec;         /* number of pages per sector */
 328                uint secshift;      /* bits number in sector size */
 329                uint pgshift;       /* bits number in page size */
 330                uint oobshift;      /* bits number in OOB size */
 331                uint pgaddrbytes;   /* bytes per page address */
 332                uint secaddrbytes;  /* bytes per sector address */
 333                uint idbytes;       /* the number ID bytes that this chip outputs */
 334        } geom;
 335
 336        /* NAND flash internal registers */
 337        struct {
 338                unsigned command; /* the command register */
 339                u_char   status;  /* the status register */
 340                uint     row;     /* the page number */
 341                uint     column;  /* the offset within page */
 342                uint     count;   /* internal counter */
 343                uint     num;     /* number of bytes which must be processed */
 344                uint     off;     /* fixed page offset */
 345        } regs;
 346
 347        /* NAND flash lines state */
 348        struct {
 349                int ce;  /* chip Enable */
 350                int cle; /* command Latch Enable */
 351                int ale; /* address Latch Enable */
 352                int wp;  /* write Protect */
 353        } lines;
 354
 355        /* Fields needed when using a cache file */
 356        struct file *cfile; /* Open file */
 357        unsigned char *pages_written; /* Which pages have been written */
 358        void *file_buf;
 359        struct page *held_pages[NS_MAX_HELD_PAGES];
 360        int held_cnt;
 361};
 362
 363/*
 364 * Operations array. To perform any operation the simulator must pass
 365 * through the correspondent states chain.
 366 */
 367static struct nandsim_operations {
 368        uint32_t reqopts;  /* options which are required to perform the operation */
 369        uint32_t states[NS_OPER_STATES]; /* operation's states */
 370} ops[NS_OPER_NUM] = {
 371        /* Read page + OOB from the beginning */
 372        {OPT_SMALLPAGE, {STATE_CMD_READ0 | ACTION_ZEROOFF, STATE_ADDR_PAGE | ACTION_CPY,
 373                        STATE_DATAOUT, STATE_READY}},
 374        /* Read page + OOB from the second half */
 375        {OPT_PAGE512_8BIT, {STATE_CMD_READ1 | ACTION_HALFOFF, STATE_ADDR_PAGE | ACTION_CPY,
 376                        STATE_DATAOUT, STATE_READY}},
 377        /* Read OOB */
 378        {OPT_SMALLPAGE, {STATE_CMD_READOOB | ACTION_OOBOFF, STATE_ADDR_PAGE | ACTION_CPY,
 379                        STATE_DATAOUT, STATE_READY}},
 380        /* Programm page starting from the beginning */
 381        {OPT_ANY, {STATE_CMD_SEQIN, STATE_ADDR_PAGE, STATE_DATAIN,
 382                        STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
 383        /* Programm page starting from the beginning */
 384        {OPT_SMALLPAGE, {STATE_CMD_READ0, STATE_CMD_SEQIN | ACTION_ZEROOFF, STATE_ADDR_PAGE,
 385                              STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
 386        /* Programm page starting from the second half */
 387        {OPT_PAGE512, {STATE_CMD_READ1, STATE_CMD_SEQIN | ACTION_HALFOFF, STATE_ADDR_PAGE,
 388                              STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
 389        /* Programm OOB */
 390        {OPT_SMALLPAGE, {STATE_CMD_READOOB, STATE_CMD_SEQIN | ACTION_OOBOFF, STATE_ADDR_PAGE,
 391                              STATE_DATAIN, STATE_CMD_PAGEPROG | ACTION_PRGPAGE, STATE_READY}},
 392        /* Erase sector */
 393        {OPT_ANY, {STATE_CMD_ERASE1, STATE_ADDR_SEC, STATE_CMD_ERASE2 | ACTION_SECERASE, STATE_READY}},
 394        /* Read status */
 395        {OPT_ANY, {STATE_CMD_STATUS, STATE_DATAOUT_STATUS, STATE_READY}},
 396        /* Read multi-plane status */
 397        {OPT_SMARTMEDIA, {STATE_CMD_STATUS_M, STATE_DATAOUT_STATUS_M, STATE_READY}},
 398        /* Read ID */
 399        {OPT_ANY, {STATE_CMD_READID, STATE_ADDR_ZERO, STATE_DATAOUT_ID, STATE_READY}},
 400        /* Large page devices read page */
 401        {OPT_LARGEPAGE, {STATE_CMD_READ0, STATE_ADDR_PAGE, STATE_CMD_READSTART | ACTION_CPY,
 402                               STATE_DATAOUT, STATE_READY}},
 403        /* Large page devices random page read */
 404        {OPT_LARGEPAGE, {STATE_CMD_RNDOUT, STATE_ADDR_COLUMN, STATE_CMD_RNDOUTSTART | ACTION_CPY,
 405                               STATE_DATAOUT, STATE_READY}},
 406};
 407
 408struct weak_block {
 409        struct list_head list;
 410        unsigned int erase_block_no;
 411        unsigned int max_erases;
 412        unsigned int erases_done;
 413};
 414
 415static LIST_HEAD(weak_blocks);
 416
 417struct weak_page {
 418        struct list_head list;
 419        unsigned int page_no;
 420        unsigned int max_writes;
 421        unsigned int writes_done;
 422};
 423
 424static LIST_HEAD(weak_pages);
 425
 426struct grave_page {
 427        struct list_head list;
 428        unsigned int page_no;
 429        unsigned int max_reads;
 430        unsigned int reads_done;
 431};
 432
 433static LIST_HEAD(grave_pages);
 434
 435static unsigned long *erase_block_wear = NULL;
 436static unsigned int wear_eb_count = 0;
 437static unsigned long total_wear = 0;
 438static unsigned int rptwear_cnt = 0;
 439
 440/* MTD structure for NAND controller */
 441static struct mtd_info *nsmtd;
 442
 443static u_char ns_verify_buf[NS_LARGEST_PAGE_SIZE];
 444
 445/*
 446 * Allocate array of page pointers, create slab allocation for an array
 447 * and initialize the array by NULL pointers.
 448 *
 449 * RETURNS: 0 if success, -ENOMEM if memory alloc fails.
 450 */
 451static int alloc_device(struct nandsim *ns)
 452{
 453        struct file *cfile;
 454        int i, err;
 455
 456        if (cache_file) {
 457                cfile = filp_open(cache_file, O_CREAT | O_RDWR | O_LARGEFILE, 0600);
 458                if (IS_ERR(cfile))
 459                        return PTR_ERR(cfile);
 460                if (!cfile->f_op || (!cfile->f_op->read && !cfile->f_op->aio_read)) {
 461                        NS_ERR("alloc_device: cache file not readable\n");
 462                        err = -EINVAL;
 463                        goto err_close;
 464                }
 465                if (!cfile->f_op->write && !cfile->f_op->aio_write) {
 466                        NS_ERR("alloc_device: cache file not writeable\n");
 467                        err = -EINVAL;
 468                        goto err_close;
 469                }
 470                ns->pages_written = vmalloc(ns->geom.pgnum);
 471                if (!ns->pages_written) {
 472                        NS_ERR("alloc_device: unable to allocate pages written array\n");
 473                        err = -ENOMEM;
 474                        goto err_close;
 475                }
 476                ns->file_buf = kmalloc(ns->geom.pgszoob, GFP_KERNEL);
 477                if (!ns->file_buf) {
 478                        NS_ERR("alloc_device: unable to allocate file buf\n");
 479                        err = -ENOMEM;
 480                        goto err_free;
 481                }
 482                ns->cfile = cfile;
 483                memset(ns->pages_written, 0, ns->geom.pgnum);
 484                return 0;
 485        }
 486
 487        ns->pages = vmalloc(ns->geom.pgnum * sizeof(union ns_mem));
 488        if (!ns->pages) {
 489                NS_ERR("alloc_device: unable to allocate page array\n");
 490                return -ENOMEM;
 491        }
 492        for (i = 0; i < ns->geom.pgnum; i++) {
 493                ns->pages[i].byte = NULL;
 494        }
 495        ns->nand_pages_slab = kmem_cache_create("nandsim",
 496                                                ns->geom.pgszoob, 0, 0, NULL);
 497        if (!ns->nand_pages_slab) {
 498                NS_ERR("cache_create: unable to create kmem_cache\n");
 499                return -ENOMEM;
 500        }
 501
 502        return 0;
 503
 504err_free:
 505        vfree(ns->pages_written);
 506err_close:
 507        filp_close(cfile, NULL);
 508        return err;
 509}
 510
 511/*
 512 * Free any allocated pages, and free the array of page pointers.
 513 */
 514static void free_device(struct nandsim *ns)
 515{
 516        int i;
 517
 518        if (ns->cfile) {
 519                kfree(ns->file_buf);
 520                vfree(ns->pages_written);
 521                filp_close(ns->cfile, NULL);
 522                return;
 523        }
 524
 525        if (ns->pages) {
 526                for (i = 0; i < ns->geom.pgnum; i++) {
 527                        if (ns->pages[i].byte)
 528                                kmem_cache_free(ns->nand_pages_slab,
 529                                                ns->pages[i].byte);
 530                }
 531                kmem_cache_destroy(ns->nand_pages_slab);
 532                vfree(ns->pages);
 533        }
 534}
 535
 536static char *get_partition_name(int i)
 537{
 538        char buf[64];
 539        sprintf(buf, "NAND simulator partition %d", i);
 540        return kstrdup(buf, GFP_KERNEL);
 541}
 542
 543static uint64_t divide(uint64_t n, uint32_t d)
 544{
 545        do_div(n, d);
 546        return n;
 547}
 548
 549/*
 550 * Initialize the nandsim structure.
 551 *
 552 * RETURNS: 0 if success, -ERRNO if failure.
 553 */
 554static int init_nandsim(struct mtd_info *mtd)
 555{
 556        struct nand_chip *chip = (struct nand_chip *)mtd->priv;
 557        struct nandsim   *ns   = (struct nandsim *)(chip->priv);
 558        int i, ret = 0;
 559        uint64_t remains;
 560        uint64_t next_offset;
 561
 562        if (NS_IS_INITIALIZED(ns)) {
 563                NS_ERR("init_nandsim: nandsim is already initialized\n");
 564                return -EIO;
 565        }
 566
 567        /* Force mtd to not do delays */
 568        chip->chip_delay = 0;
 569
 570        /* Initialize the NAND flash parameters */
 571        ns->busw = chip->options & NAND_BUSWIDTH_16 ? 16 : 8;
 572        ns->geom.totsz    = mtd->size;
 573        ns->geom.pgsz     = mtd->writesize;
 574        ns->geom.oobsz    = mtd->oobsize;
 575        ns->geom.secsz    = mtd->erasesize;
 576        ns->geom.pgszoob  = ns->geom.pgsz + ns->geom.oobsz;
 577        ns->geom.pgnum    = divide(ns->geom.totsz, ns->geom.pgsz);
 578        ns->geom.totszoob = ns->geom.totsz + (uint64_t)ns->geom.pgnum * ns->geom.oobsz;
 579        ns->geom.secshift = ffs(ns->geom.secsz) - 1;
 580        ns->geom.pgshift  = chip->page_shift;
 581        ns->geom.oobshift = ffs(ns->geom.oobsz) - 1;
 582        ns->geom.pgsec    = ns->geom.secsz / ns->geom.pgsz;
 583        ns->geom.secszoob = ns->geom.secsz + ns->geom.oobsz * ns->geom.pgsec;
 584        ns->options = 0;
 585
 586        if (ns->geom.pgsz == 256) {
 587                ns->options |= OPT_PAGE256;
 588        }
 589        else if (ns->geom.pgsz == 512) {
 590                ns->options |= (OPT_PAGE512 | OPT_AUTOINCR);
 591                if (ns->busw == 8)
 592                        ns->options |= OPT_PAGE512_8BIT;
 593        } else if (ns->geom.pgsz == 2048) {
 594                ns->options |= OPT_PAGE2048;
 595        } else if (ns->geom.pgsz == 4096) {
 596                ns->options |= OPT_PAGE4096;
 597        } else {
 598                NS_ERR("init_nandsim: unknown page size %u\n", ns->geom.pgsz);
 599                return -EIO;
 600        }
 601
 602        if (ns->options & OPT_SMALLPAGE) {
 603                if (ns->geom.totsz <= (32 << 20)) {
 604                        ns->geom.pgaddrbytes  = 3;
 605                        ns->geom.secaddrbytes = 2;
 606                } else {
 607                        ns->geom.pgaddrbytes  = 4;
 608                        ns->geom.secaddrbytes = 3;
 609                }
 610        } else {
 611                if (ns->geom.totsz <= (128 << 20)) {
 612                        ns->geom.pgaddrbytes  = 4;
 613                        ns->geom.secaddrbytes = 2;
 614                } else {
 615                        ns->geom.pgaddrbytes  = 5;
 616                        ns->geom.secaddrbytes = 3;
 617                }
 618        }
 619
 620        /* Fill the partition_info structure */
 621        if (parts_num > ARRAY_SIZE(ns->partitions)) {
 622                NS_ERR("too many partitions.\n");
 623                ret = -EINVAL;
 624                goto error;
 625        }
 626        remains = ns->geom.totsz;
 627        next_offset = 0;
 628        for (i = 0; i < parts_num; ++i) {
 629                uint64_t part_sz = (uint64_t)parts[i] * ns->geom.secsz;
 630
 631                if (!part_sz || part_sz > remains) {
 632                        NS_ERR("bad partition size.\n");
 633                        ret = -EINVAL;
 634                        goto error;
 635                }
 636                ns->partitions[i].name   = get_partition_name(i);
 637                ns->partitions[i].offset = next_offset;
 638                ns->partitions[i].size   = part_sz;
 639                next_offset += ns->partitions[i].size;
 640                remains -= ns->partitions[i].size;
 641        }
 642        ns->nbparts = parts_num;
 643        if (remains) {
 644                if (parts_num + 1 > ARRAY_SIZE(ns->partitions)) {
 645                        NS_ERR("too many partitions.\n");
 646                        ret = -EINVAL;
 647                        goto error;
 648                }
 649                ns->partitions[i].name   = get_partition_name(i);
 650                ns->partitions[i].offset = next_offset;
 651                ns->partitions[i].size   = remains;
 652                ns->nbparts += 1;
 653        }
 654
 655        /* Detect how many ID bytes the NAND chip outputs */
 656        for (i = 0; nand_flash_ids[i].name != NULL; i++) {
 657                if (second_id_byte != nand_flash_ids[i].id)
 658                        continue;
 659                if (!(nand_flash_ids[i].options & NAND_NO_AUTOINCR))
 660                        ns->options |= OPT_AUTOINCR;
 661        }
 662
 663        if (ns->busw == 16)
 664                NS_WARN("16-bit flashes support wasn't tested\n");
 665
 666        printk("flash size: %llu MiB\n",
 667                        (unsigned long long)ns->geom.totsz >> 20);
 668        printk("page size: %u bytes\n",         ns->geom.pgsz);
 669        printk("OOB area size: %u bytes\n",     ns->geom.oobsz);
 670        printk("sector size: %u KiB\n",         ns->geom.secsz >> 10);
 671        printk("pages number: %u\n",            ns->geom.pgnum);
 672        printk("pages per sector: %u\n",        ns->geom.pgsec);
 673        printk("bus width: %u\n",               ns->busw);
 674        printk("bits in sector size: %u\n",     ns->geom.secshift);
 675        printk("bits in page size: %u\n",       ns->geom.pgshift);
 676        printk("bits in OOB size: %u\n",        ns->geom.oobshift);
 677        printk("flash size with OOB: %llu KiB\n",
 678                        (unsigned long long)ns->geom.totszoob >> 10);
 679        printk("page address bytes: %u\n",      ns->geom.pgaddrbytes);
 680        printk("sector address bytes: %u\n",    ns->geom.secaddrbytes);
 681        printk("options: %#x\n",                ns->options);
 682
 683        if ((ret = alloc_device(ns)) != 0)
 684                goto error;
 685
 686        /* Allocate / initialize the internal buffer */
 687        ns->buf.byte = kmalloc(ns->geom.pgszoob, GFP_KERNEL);
 688        if (!ns->buf.byte) {
 689                NS_ERR("init_nandsim: unable to allocate %u bytes for the internal buffer\n",
 690                        ns->geom.pgszoob);
 691                ret = -ENOMEM;
 692                goto error;
 693        }
 694        memset(ns->buf.byte, 0xFF, ns->geom.pgszoob);
 695
 696        return 0;
 697
 698error:
 699        free_device(ns);
 700
 701        return ret;
 702}
 703
 704/*
 705 * Free the nandsim structure.
 706 */
 707static void free_nandsim(struct nandsim *ns)
 708{
 709        kfree(ns->buf.byte);
 710        free_device(ns);
 711
 712        return;
 713}
 714
 715static int parse_badblocks(struct nandsim *ns, struct mtd_info *mtd)
 716{
 717        char *w;
 718        int zero_ok;
 719        unsigned int erase_block_no;
 720        loff_t offset;
 721
 722        if (!badblocks)
 723                return 0;
 724        w = badblocks;
 725        do {
 726                zero_ok = (*w == '0' ? 1 : 0);
 727                erase_block_no = simple_strtoul(w, &w, 0);
 728                if (!zero_ok && !erase_block_no) {
 729                        NS_ERR("invalid badblocks.\n");
 730                        return -EINVAL;
 731                }
 732                offset = erase_block_no * ns->geom.secsz;
 733                if (mtd->block_markbad(mtd, offset)) {
 734                        NS_ERR("invalid badblocks.\n");
 735                        return -EINVAL;
 736                }
 737                if (*w == ',')
 738                        w += 1;
 739        } while (*w);
 740        return 0;
 741}
 742
 743static int parse_weakblocks(void)
 744{
 745        char *w;
 746        int zero_ok;
 747        unsigned int erase_block_no;
 748        unsigned int max_erases;
 749        struct weak_block *wb;
 750
 751        if (!weakblocks)
 752                return 0;
 753        w = weakblocks;
 754        do {
 755                zero_ok = (*w == '0' ? 1 : 0);
 756                erase_block_no = simple_strtoul(w, &w, 0);
 757                if (!zero_ok && !erase_block_no) {
 758                        NS_ERR("invalid weakblocks.\n");
 759                        return -EINVAL;
 760                }
 761                max_erases = 3;
 762                if (*w == ':') {
 763                        w += 1;
 764                        max_erases = simple_strtoul(w, &w, 0);
 765                }
 766                if (*w == ',')
 767                        w += 1;
 768                wb = kzalloc(sizeof(*wb), GFP_KERNEL);
 769                if (!wb) {
 770                        NS_ERR("unable to allocate memory.\n");
 771                        return -ENOMEM;
 772                }
 773                wb->erase_block_no = erase_block_no;
 774                wb->max_erases = max_erases;
 775                list_add(&wb->list, &weak_blocks);
 776        } while (*w);
 777        return 0;
 778}
 779
 780static int erase_error(unsigned int erase_block_no)
 781{
 782        struct weak_block *wb;
 783
 784        list_for_each_entry(wb, &weak_blocks, list)
 785                if (wb->erase_block_no == erase_block_no) {
 786                        if (wb->erases_done >= wb->max_erases)
 787                                return 1;
 788                        wb->erases_done += 1;
 789                        return 0;
 790                }
 791        return 0;
 792}
 793
 794static int parse_weakpages(void)
 795{
 796        char *w;
 797        int zero_ok;
 798        unsigned int page_no;
 799        unsigned int max_writes;
 800        struct weak_page *wp;
 801
 802        if (!weakpages)
 803                return 0;
 804        w = weakpages;
 805        do {
 806                zero_ok = (*w == '0' ? 1 : 0);
 807                page_no = simple_strtoul(w, &w, 0);
 808                if (!zero_ok && !page_no) {
 809                        NS_ERR("invalid weakpagess.\n");
 810                        return -EINVAL;
 811                }
 812                max_writes = 3;
 813                if (*w == ':') {
 814                        w += 1;
 815                        max_writes = simple_strtoul(w, &w, 0);
 816                }
 817                if (*w == ',')
 818                        w += 1;
 819                wp = kzalloc(sizeof(*wp), GFP_KERNEL);
 820                if (!wp) {
 821                        NS_ERR("unable to allocate memory.\n");
 822                        return -ENOMEM;
 823                }
 824                wp->page_no = page_no;
 825                wp->max_writes = max_writes;
 826                list_add(&wp->list, &weak_pages);
 827        } while (*w);
 828        return 0;
 829}
 830
 831static int write_error(unsigned int page_no)
 832{
 833        struct weak_page *wp;
 834
 835        list_for_each_entry(wp, &weak_pages, list)
 836                if (wp->page_no == page_no) {
 837                        if (wp->writes_done >= wp->max_writes)
 838                                return 1;
 839                        wp->writes_done += 1;
 840                        return 0;
 841                }
 842        return 0;
 843}
 844
 845static int parse_gravepages(void)
 846{
 847        char *g;
 848        int zero_ok;
 849        unsigned int page_no;
 850        unsigned int max_reads;
 851        struct grave_page *gp;
 852
 853        if (!gravepages)
 854                return 0;
 855        g = gravepages;
 856        do {
 857                zero_ok = (*g == '0' ? 1 : 0);
 858                page_no = simple_strtoul(g, &g, 0);
 859                if (!zero_ok && !page_no) {
 860                        NS_ERR("invalid gravepagess.\n");
 861                        return -EINVAL;
 862                }
 863                max_reads = 3;
 864                if (*g == ':') {
 865                        g += 1;
 866                        max_reads = simple_strtoul(g, &g, 0);
 867                }
 868                if (*g == ',')
 869                        g += 1;
 870                gp = kzalloc(sizeof(*gp), GFP_KERNEL);
 871                if (!gp) {
 872                        NS_ERR("unable to allocate memory.\n");
 873                        return -ENOMEM;
 874                }
 875                gp->page_no = page_no;
 876                gp->max_reads = max_reads;
 877                list_add(&gp->list, &grave_pages);
 878        } while (*g);
 879        return 0;
 880}
 881
 882static int read_error(unsigned int page_no)
 883{
 884        struct grave_page *gp;
 885
 886        list_for_each_entry(gp, &grave_pages, list)
 887                if (gp->page_no == page_no) {
 888                        if (gp->reads_done >= gp->max_reads)
 889                                return 1;
 890                        gp->reads_done += 1;
 891                        return 0;
 892                }
 893        return 0;
 894}
 895
 896static void free_lists(void)
 897{
 898        struct list_head *pos, *n;
 899        list_for_each_safe(pos, n, &weak_blocks) {
 900                list_del(pos);
 901                kfree(list_entry(pos, struct weak_block, list));
 902        }
 903        list_for_each_safe(pos, n, &weak_pages) {
 904                list_del(pos);
 905                kfree(list_entry(pos, struct weak_page, list));
 906        }
 907        list_for_each_safe(pos, n, &grave_pages) {
 908                list_del(pos);
 909                kfree(list_entry(pos, struct grave_page, list));
 910        }
 911        kfree(erase_block_wear);
 912}
 913
 914static int setup_wear_reporting(struct mtd_info *mtd)
 915{
 916        size_t mem;
 917
 918        if (!rptwear)
 919                return 0;
 920        wear_eb_count = divide(mtd->size, mtd->erasesize);
 921        mem = wear_eb_count * sizeof(unsigned long);
 922        if (mem / sizeof(unsigned long) != wear_eb_count) {
 923                NS_ERR("Too many erase blocks for wear reporting\n");
 924                return -ENOMEM;
 925        }
 926        erase_block_wear = kzalloc(mem, GFP_KERNEL);
 927        if (!erase_block_wear) {
 928                NS_ERR("Too many erase blocks for wear reporting\n");
 929                return -ENOMEM;
 930        }
 931        return 0;
 932}
 933
 934static void update_wear(unsigned int erase_block_no)
 935{
 936        unsigned long wmin = -1, wmax = 0, avg;
 937        unsigned long deciles[10], decile_max[10], tot = 0;
 938        unsigned int i;
 939
 940        if (!erase_block_wear)
 941                return;
 942        total_wear += 1;
 943        if (total_wear == 0)
 944                NS_ERR("Erase counter total overflow\n");
 945        erase_block_wear[erase_block_no] += 1;
 946        if (erase_block_wear[erase_block_no] == 0)
 947                NS_ERR("Erase counter overflow for erase block %u\n", erase_block_no);
 948        rptwear_cnt += 1;
 949        if (rptwear_cnt < rptwear)
 950                return;
 951        rptwear_cnt = 0;
 952        /* Calc wear stats */
 953        for (i = 0; i < wear_eb_count; ++i) {
 954                unsigned long wear = erase_block_wear[i];
 955                if (wear < wmin)
 956                        wmin = wear;
 957                if (wear > wmax)
 958                        wmax = wear;
 959                tot += wear;
 960        }
 961        for (i = 0; i < 9; ++i) {
 962                deciles[i] = 0;
 963                decile_max[i] = (wmax * (i + 1) + 5) / 10;
 964        }
 965        deciles[9] = 0;
 966        decile_max[9] = wmax;
 967        for (i = 0; i < wear_eb_count; ++i) {
 968                int d;
 969                unsigned long wear = erase_block_wear[i];
 970                for (d = 0; d < 10; ++d)
 971                        if (wear <= decile_max[d]) {
 972                                deciles[d] += 1;
 973                                break;
 974                        }
 975        }
 976        avg = tot / wear_eb_count;
 977        /* Output wear report */
 978        NS_INFO("*** Wear Report ***\n");
 979        NS_INFO("Total numbers of erases:  %lu\n", tot);
 980        NS_INFO("Number of erase blocks:   %u\n", wear_eb_count);
 981        NS_INFO("Average number of erases: %lu\n", avg);
 982        NS_INFO("Maximum number of erases: %lu\n", wmax);
 983        NS_INFO("Minimum number of erases: %lu\n", wmin);
 984        for (i = 0; i < 10; ++i) {
 985                unsigned long from = (i ? decile_max[i - 1] + 1 : 0);
 986                if (from > decile_max[i])
 987                        continue;
 988                NS_INFO("Number of ebs with erase counts from %lu to %lu : %lu\n",
 989                        from,
 990                        decile_max[i],
 991                        deciles[i]);
 992        }
 993        NS_INFO("*** End of Wear Report ***\n");
 994}
 995
 996/*
 997 * Returns the string representation of 'state' state.
 998 */
 999static char *get_state_name(uint32_t state)
1000{
1001        switch (NS_STATE(state)) {
1002                case STATE_CMD_READ0:
1003                        return "STATE_CMD_READ0";
1004                case STATE_CMD_READ1:
1005                        return "STATE_CMD_READ1";
1006                case STATE_CMD_PAGEPROG:
1007                        return "STATE_CMD_PAGEPROG";
1008                case STATE_CMD_READOOB:
1009                        return "STATE_CMD_READOOB";
1010                case STATE_CMD_READSTART:
1011                        return "STATE_CMD_READSTART";
1012                case STATE_CMD_ERASE1:
1013                        return "STATE_CMD_ERASE1";
1014                case STATE_CMD_STATUS:
1015                        return "STATE_CMD_STATUS";
1016                case STATE_CMD_STATUS_M:
1017                        return "STATE_CMD_STATUS_M";
1018                case STATE_CMD_SEQIN:
1019                        return "STATE_CMD_SEQIN";
1020                case STATE_CMD_READID:
1021                        return "STATE_CMD_READID";
1022                case STATE_CMD_ERASE2:
1023                        return "STATE_CMD_ERASE2";
1024                case STATE_CMD_RESET:
1025                        return "STATE_CMD_RESET";
1026                case STATE_CMD_RNDOUT:
1027                        return "STATE_CMD_RNDOUT";
1028                case STATE_CMD_RNDOUTSTART:
1029                        return "STATE_CMD_RNDOUTSTART";
1030                case STATE_ADDR_PAGE:
1031                        return "STATE_ADDR_PAGE";
1032                case STATE_ADDR_SEC:
1033                        return "STATE_ADDR_SEC";
1034                case STATE_ADDR_ZERO:
1035                        return "STATE_ADDR_ZERO";
1036                case STATE_ADDR_COLUMN:
1037                        return "STATE_ADDR_COLUMN";
1038                case STATE_DATAIN:
1039                        return "STATE_DATAIN";
1040                case STATE_DATAOUT:
1041                        return "STATE_DATAOUT";
1042                case STATE_DATAOUT_ID:
1043                        return "STATE_DATAOUT_ID";
1044                case STATE_DATAOUT_STATUS:
1045                        return "STATE_DATAOUT_STATUS";
1046                case STATE_DATAOUT_STATUS_M:
1047                        return "STATE_DATAOUT_STATUS_M";
1048                case STATE_READY:
1049                        return "STATE_READY";
1050                case STATE_UNKNOWN:
1051                        return "STATE_UNKNOWN";
1052        }
1053
1054        NS_ERR("get_state_name: unknown state, BUG\n");
1055        return NULL;
1056}
1057
1058/*
1059 * Check if command is valid.
1060 *
1061 * RETURNS: 1 if wrong command, 0 if right.
1062 */
1063static int check_command(int cmd)
1064{
1065        switch (cmd) {
1066
1067        case NAND_CMD_READ0:
1068        case NAND_CMD_READ1:
1069        case NAND_CMD_READSTART:
1070        case NAND_CMD_PAGEPROG:
1071        case NAND_CMD_READOOB:
1072        case NAND_CMD_ERASE1:
1073        case NAND_CMD_STATUS:
1074        case NAND_CMD_SEQIN:
1075        case NAND_CMD_READID:
1076        case NAND_CMD_ERASE2:
1077        case NAND_CMD_RESET:
1078        case NAND_CMD_RNDOUT:
1079        case NAND_CMD_RNDOUTSTART:
1080                return 0;
1081
1082        case NAND_CMD_STATUS_MULTI:
1083        default:
1084                return 1;
1085        }
1086}
1087
1088/*
1089 * Returns state after command is accepted by command number.
1090 */
1091static uint32_t get_state_by_command(unsigned command)
1092{
1093        switch (command) {
1094                case NAND_CMD_READ0:
1095                        return STATE_CMD_READ0;
1096                case NAND_CMD_READ1:
1097                        return STATE_CMD_READ1;
1098                case NAND_CMD_PAGEPROG:
1099                        return STATE_CMD_PAGEPROG;
1100                case NAND_CMD_READSTART:
1101                        return STATE_CMD_READSTART;
1102                case NAND_CMD_READOOB:
1103                        return STATE_CMD_READOOB;
1104                case NAND_CMD_ERASE1:
1105                        return STATE_CMD_ERASE1;
1106                case NAND_CMD_STATUS:
1107                        return STATE_CMD_STATUS;
1108                case NAND_CMD_STATUS_MULTI:
1109                        return STATE_CMD_STATUS_M;
1110                case NAND_CMD_SEQIN:
1111                        return STATE_CMD_SEQIN;
1112                case NAND_CMD_READID:
1113                        return STATE_CMD_READID;
1114                case NAND_CMD_ERASE2:
1115                        return STATE_CMD_ERASE2;
1116                case NAND_CMD_RESET:
1117                        return STATE_CMD_RESET;
1118                case NAND_CMD_RNDOUT:
1119                        return STATE_CMD_RNDOUT;
1120                case NAND_CMD_RNDOUTSTART:
1121                        return STATE_CMD_RNDOUTSTART;
1122        }
1123
1124        NS_ERR("get_state_by_command: unknown command, BUG\n");
1125        return 0;
1126}
1127
1128/*
1129 * Move an address byte to the correspondent internal register.
1130 */
1131static inline void accept_addr_byte(struct nandsim *ns, u_char bt)
1132{
1133        uint byte = (uint)bt;
1134
1135        if (ns->regs.count < (ns->geom.pgaddrbytes - ns->geom.secaddrbytes))
1136                ns->regs.column |= (byte << 8 * ns->regs.count);
1137        else {
1138                ns->regs.row |= (byte << 8 * (ns->regs.count -
1139                                                ns->geom.pgaddrbytes +
1140                                                ns->geom.secaddrbytes));
1141        }
1142
1143        return;
1144}
1145
1146/*
1147 * Switch to STATE_READY state.
1148 */
1149static inline void switch_to_ready_state(struct nandsim *ns, u_char status)
1150{
1151        NS_DBG("switch_to_ready_state: switch to %s state\n", get_state_name(STATE_READY));
1152
1153        ns->state       = STATE_READY;
1154        ns->nxstate     = STATE_UNKNOWN;
1155        ns->op          = NULL;
1156        ns->npstates    = 0;
1157        ns->stateidx    = 0;
1158        ns->regs.num    = 0;
1159        ns->regs.count  = 0;
1160        ns->regs.off    = 0;
1161        ns->regs.row    = 0;
1162        ns->regs.column = 0;
1163        ns->regs.status = status;
1164}
1165
1166/*
1167 * If the operation isn't known yet, try to find it in the global array
1168 * of supported operations.
1169 *
1170 * Operation can be unknown because of the following.
1171 *   1. New command was accepted and this is the firs call to find the
1172 *      correspondent states chain. In this case ns->npstates = 0;
1173 *   2. There is several operations which begin with the same command(s)
1174 *      (for example program from the second half and read from the
1175 *      second half operations both begin with the READ1 command). In this
1176 *      case the ns->pstates[] array contains previous states.
1177 *
1178 * Thus, the function tries to find operation containing the following
1179 * states (if the 'flag' parameter is 0):
1180 *    ns->pstates[0], ... ns->pstates[ns->npstates], ns->state
1181 *
1182 * If (one and only one) matching operation is found, it is accepted (
1183 * ns->ops, ns->state, ns->nxstate are initialized, ns->npstate is
1184 * zeroed).
1185 *
1186 * If there are several maches, the current state is pushed to the
1187 * ns->pstates.
1188 *
1189 * The operation can be unknown only while commands are input to the chip.
1190 * As soon as address command is accepted, the operation must be known.
1191 * In such situation the function is called with 'flag' != 0, and the
1192 * operation is searched using the following pattern:
1193 *     ns->pstates[0], ... ns->pstates[ns->npstates], <address input>
1194 *
1195 * It is supposed that this pattern must either match one operation on
1196 * none. There can't be ambiguity in that case.
1197 *
1198 * If no matches found, the functions does the following:
1199 *   1. if there are saved states present, try to ignore them and search
1200 *      again only using the last command. If nothing was found, switch
1201 *      to the STATE_READY state.
1202 *   2. if there are no saved states, switch to the STATE_READY state.
1203 *
1204 * RETURNS: -2 - no matched operations found.
1205 *          -1 - several matches.
1206 *           0 - operation is found.
1207 */
1208static int find_operation(struct nandsim *ns, uint32_t flag)
1209{
1210        int opsfound = 0;
1211        int i, j, idx = 0;
1212
1213        for (i = 0; i < NS_OPER_NUM; i++) {
1214
1215                int found = 1;
1216
1217                if (!(ns->options & ops[i].reqopts))
1218                        /* Ignore operations we can't perform */
1219                        continue;
1220
1221                if (flag) {
1222                        if (!(ops[i].states[ns->npstates] & STATE_ADDR_MASK))
1223                                continue;
1224                } else {
1225                        if (NS_STATE(ns->state) != NS_STATE(ops[i].states[ns->npstates]))
1226                                continue;
1227                }
1228
1229                for (j = 0; j < ns->npstates; j++)
1230                        if (NS_STATE(ops[i].states[j]) != NS_STATE(ns->pstates[j])
1231                                && (ns->options & ops[idx].reqopts)) {
1232                                found = 0;
1233                                break;
1234                        }
1235
1236                if (found) {
1237                        idx = i;
1238                        opsfound += 1;
1239                }
1240        }
1241
1242        if (opsfound == 1) {
1243                /* Exact match */
1244                ns->op = &ops[idx].states[0];
1245                if (flag) {
1246                        /*
1247                         * In this case the find_operation function was
1248                         * called when address has just began input. But it isn't
1249                         * yet fully input and the current state must
1250                         * not be one of STATE_ADDR_*, but the STATE_ADDR_*
1251                         * state must be the next state (ns->nxstate).
1252                         */
1253                        ns->stateidx = ns->npstates - 1;
1254                } else {
1255                        ns->stateidx = ns->npstates;
1256                }
1257                ns->npstates = 0;
1258                ns->state = ns->op[ns->stateidx];
1259                ns->nxstate = ns->op[ns->stateidx + 1];
1260                NS_DBG("find_operation: operation found, index: %d, state: %s, nxstate %s\n",
1261                                idx, get_state_name(ns->state), get_state_name(ns->nxstate));
1262                return 0;
1263        }
1264
1265        if (opsfound == 0) {
1266                /* Nothing was found. Try to ignore previous commands (if any) and search again */
1267                if (ns->npstates != 0) {
1268                        NS_DBG("find_operation: no operation found, try again with state %s\n",
1269                                        get_state_name(ns->state));
1270                        ns->npstates = 0;
1271                        return find_operation(ns, 0);
1272
1273                }
1274                NS_DBG("find_operation: no operations found\n");
1275                switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1276                return -2;
1277        }
1278
1279        if (flag) {
1280                /* This shouldn't happen */
1281                NS_DBG("find_operation: BUG, operation must be known if address is input\n");
1282                return -2;
1283        }
1284
1285        NS_DBG("find_operation: there is still ambiguity\n");
1286
1287        ns->pstates[ns->npstates++] = ns->state;
1288
1289        return -1;
1290}
1291
1292static void put_pages(struct nandsim *ns)
1293{
1294        int i;
1295
1296        for (i = 0; i < ns->held_cnt; i++)
1297                page_cache_release(ns->held_pages[i]);
1298}
1299
1300/* Get page cache pages in advance to provide NOFS memory allocation */
1301static int get_pages(struct nandsim *ns, struct file *file, size_t count, loff_t pos)
1302{
1303        pgoff_t index, start_index, end_index;
1304        struct page *page;
1305        struct address_space *mapping = file->f_mapping;
1306
1307        start_index = pos >> PAGE_CACHE_SHIFT;
1308        end_index = (pos + count - 1) >> PAGE_CACHE_SHIFT;
1309        if (end_index - start_index + 1 > NS_MAX_HELD_PAGES)
1310                return -EINVAL;
1311        ns->held_cnt = 0;
1312        for (index = start_index; index <= end_index; index++) {
1313                page = find_get_page(mapping, index);
1314                if (page == NULL) {
1315                        page = find_or_create_page(mapping, index, GFP_NOFS);
1316                        if (page == NULL) {
1317                                write_inode_now(mapping->host, 1);
1318                                page = find_or_create_page(mapping, index, GFP_NOFS);
1319                        }
1320                        if (page == NULL) {
1321                                put_pages(ns);
1322                                return -ENOMEM;
1323                        }
1324                        unlock_page(page);
1325                }
1326                ns->held_pages[ns->held_cnt++] = page;
1327        }
1328        return 0;
1329}
1330
1331static int set_memalloc(void)
1332{
1333        if (current->flags & PF_MEMALLOC)
1334                return 0;
1335        current->flags |= PF_MEMALLOC;
1336        return 1;
1337}
1338
1339static void clear_memalloc(int memalloc)
1340{
1341        if (memalloc)
1342                current->flags &= ~PF_MEMALLOC;
1343}
1344
1345static ssize_t read_file(struct nandsim *ns, struct file *file, void *buf, size_t count, loff_t *pos)
1346{
1347        mm_segment_t old_fs;
1348        ssize_t tx;
1349        int err, memalloc;
1350
1351        err = get_pages(ns, file, count, *pos);
1352        if (err)
1353                return err;
1354        old_fs = get_fs();
1355        set_fs(get_ds());
1356        memalloc = set_memalloc();
1357        tx = vfs_read(file, (char __user *)buf, count, pos);
1358        clear_memalloc(memalloc);
1359        set_fs(old_fs);
1360        put_pages(ns);
1361        return tx;
1362}
1363
1364static ssize_t write_file(struct nandsim *ns, struct file *file, void *buf, size_t count, loff_t *pos)
1365{
1366        mm_segment_t old_fs;
1367        ssize_t tx;
1368        int err, memalloc;
1369
1370        err = get_pages(ns, file, count, *pos);
1371        if (err)
1372                return err;
1373        old_fs = get_fs();
1374        set_fs(get_ds());
1375        memalloc = set_memalloc();
1376        tx = vfs_write(file, (char __user *)buf, count, pos);
1377        clear_memalloc(memalloc);
1378        set_fs(old_fs);
1379        put_pages(ns);
1380        return tx;
1381}
1382
1383/*
1384 * Returns a pointer to the current page.
1385 */
1386static inline union ns_mem *NS_GET_PAGE(struct nandsim *ns)
1387{
1388        return &(ns->pages[ns->regs.row]);
1389}
1390
1391/*
1392 * Retuns a pointer to the current byte, within the current page.
1393 */
1394static inline u_char *NS_PAGE_BYTE_OFF(struct nandsim *ns)
1395{
1396        return NS_GET_PAGE(ns)->byte + ns->regs.column + ns->regs.off;
1397}
1398
1399int do_read_error(struct nandsim *ns, int num)
1400{
1401        unsigned int page_no = ns->regs.row;
1402
1403        if (read_error(page_no)) {
1404                int i;
1405                memset(ns->buf.byte, 0xFF, num);
1406                for (i = 0; i < num; ++i)
1407                        ns->buf.byte[i] = random32();
1408                NS_WARN("simulating read error in page %u\n", page_no);
1409                return 1;
1410        }
1411        return 0;
1412}
1413
1414void do_bit_flips(struct nandsim *ns, int num)
1415{
1416        if (bitflips && random32() < (1 << 22)) {
1417                int flips = 1;
1418                if (bitflips > 1)
1419                        flips = (random32() % (int) bitflips) + 1;
1420                while (flips--) {
1421                        int pos = random32() % (num * 8);
1422                        ns->buf.byte[pos / 8] ^= (1 << (pos % 8));
1423                        NS_WARN("read_page: flipping bit %d in page %d "
1424                                "reading from %d ecc: corrected=%u failed=%u\n",
1425                                pos, ns->regs.row, ns->regs.column + ns->regs.off,
1426                                nsmtd->ecc_stats.corrected, nsmtd->ecc_stats.failed);
1427                }
1428        }
1429}
1430
1431/*
1432 * Fill the NAND buffer with data read from the specified page.
1433 */
1434static void read_page(struct nandsim *ns, int num)
1435{
1436        union ns_mem *mypage;
1437
1438        if (ns->cfile) {
1439                if (!ns->pages_written[ns->regs.row]) {
1440                        NS_DBG("read_page: page %d not written\n", ns->regs.row);
1441                        memset(ns->buf.byte, 0xFF, num);
1442                } else {
1443                        loff_t pos;
1444                        ssize_t tx;
1445
1446                        NS_DBG("read_page: page %d written, reading from %d\n",
1447                                ns->regs.row, ns->regs.column + ns->regs.off);
1448                        if (do_read_error(ns, num))
1449                                return;
1450                        pos = (loff_t)ns->regs.row * ns->geom.pgszoob + ns->regs.column + ns->regs.off;
1451                        tx = read_file(ns, ns->cfile, ns->buf.byte, num, &pos);
1452                        if (tx != num) {
1453                                NS_ERR("read_page: read error for page %d ret %ld\n", ns->regs.row, (long)tx);
1454                                return;
1455                        }
1456                        do_bit_flips(ns, num);
1457                }
1458                return;
1459        }
1460
1461        mypage = NS_GET_PAGE(ns);
1462        if (mypage->byte == NULL) {
1463                NS_DBG("read_page: page %d not allocated\n", ns->regs.row);
1464                memset(ns->buf.byte, 0xFF, num);
1465        } else {
1466                NS_DBG("read_page: page %d allocated, reading from %d\n",
1467                        ns->regs.row, ns->regs.column + ns->regs.off);
1468                if (do_read_error(ns, num))
1469                        return;
1470                memcpy(ns->buf.byte, NS_PAGE_BYTE_OFF(ns), num);
1471                do_bit_flips(ns, num);
1472        }
1473}
1474
1475/*
1476 * Erase all pages in the specified sector.
1477 */
1478static void erase_sector(struct nandsim *ns)
1479{
1480        union ns_mem *mypage;
1481        int i;
1482
1483        if (ns->cfile) {
1484                for (i = 0; i < ns->geom.pgsec; i++)
1485                        if (ns->pages_written[ns->regs.row + i]) {
1486                                NS_DBG("erase_sector: freeing page %d\n", ns->regs.row + i);
1487                                ns->pages_written[ns->regs.row + i] = 0;
1488                        }
1489                return;
1490        }
1491
1492        mypage = NS_GET_PAGE(ns);
1493        for (i = 0; i < ns->geom.pgsec; i++) {
1494                if (mypage->byte != NULL) {
1495                        NS_DBG("erase_sector: freeing page %d\n", ns->regs.row+i);
1496                        kmem_cache_free(ns->nand_pages_slab, mypage->byte);
1497                        mypage->byte = NULL;
1498                }
1499                mypage++;
1500        }
1501}
1502
1503/*
1504 * Program the specified page with the contents from the NAND buffer.
1505 */
1506static int prog_page(struct nandsim *ns, int num)
1507{
1508        int i;
1509        union ns_mem *mypage;
1510        u_char *pg_off;
1511
1512        if (ns->cfile) {
1513                loff_t off, pos;
1514                ssize_t tx;
1515                int all;
1516
1517                NS_DBG("prog_page: writing page %d\n", ns->regs.row);
1518                pg_off = ns->file_buf + ns->regs.column + ns->regs.off;
1519                off = (loff_t)ns->regs.row * ns->geom.pgszoob + ns->regs.column + ns->regs.off;
1520                if (!ns->pages_written[ns->regs.row]) {
1521                        all = 1;
1522                        memset(ns->file_buf, 0xff, ns->geom.pgszoob);
1523                } else {
1524                        all = 0;
1525                        pos = off;
1526                        tx = read_file(ns, ns->cfile, pg_off, num, &pos);
1527                        if (tx != num) {
1528                                NS_ERR("prog_page: read error for page %d ret %ld\n", ns->regs.row, (long)tx);
1529                                return -1;
1530                        }
1531                }
1532                for (i = 0; i < num; i++)
1533                        pg_off[i] &= ns->buf.byte[i];
1534                if (all) {
1535                        pos = (loff_t)ns->regs.row * ns->geom.pgszoob;
1536                        tx = write_file(ns, ns->cfile, ns->file_buf, ns->geom.pgszoob, &pos);
1537                        if (tx != ns->geom.pgszoob) {
1538                                NS_ERR("prog_page: write error for page %d ret %ld\n", ns->regs.row, (long)tx);
1539                                return -1;
1540                        }
1541                        ns->pages_written[ns->regs.row] = 1;
1542                } else {
1543                        pos = off;
1544                        tx = write_file(ns, ns->cfile, pg_off, num, &pos);
1545                        if (tx != num) {
1546                                NS_ERR("prog_page: write error for page %d ret %ld\n", ns->regs.row, (long)tx);
1547                                return -1;
1548                        }
1549                }
1550                return 0;
1551        }
1552
1553        mypage = NS_GET_PAGE(ns);
1554        if (mypage->byte == NULL) {
1555                NS_DBG("prog_page: allocating page %d\n", ns->regs.row);
1556                /*
1557                 * We allocate memory with GFP_NOFS because a flash FS may
1558                 * utilize this. If it is holding an FS lock, then gets here,
1559                 * then kernel memory alloc runs writeback which goes to the FS
1560                 * again and deadlocks. This was seen in practice.
1561                 */
1562                mypage->byte = kmem_cache_alloc(ns->nand_pages_slab, GFP_NOFS);
1563                if (mypage->byte == NULL) {
1564                        NS_ERR("prog_page: error allocating memory for page %d\n", ns->regs.row);
1565                        return -1;
1566                }
1567                memset(mypage->byte, 0xFF, ns->geom.pgszoob);
1568        }
1569
1570        pg_off = NS_PAGE_BYTE_OFF(ns);
1571        for (i = 0; i < num; i++)
1572                pg_off[i] &= ns->buf.byte[i];
1573
1574        return 0;
1575}
1576
1577/*
1578 * If state has any action bit, perform this action.
1579 *
1580 * RETURNS: 0 if success, -1 if error.
1581 */
1582static int do_state_action(struct nandsim *ns, uint32_t action)
1583{
1584        int num;
1585        int busdiv = ns->busw == 8 ? 1 : 2;
1586        unsigned int erase_block_no, page_no;
1587
1588        action &= ACTION_MASK;
1589
1590        /* Check that page address input is correct */
1591        if (action != ACTION_SECERASE && ns->regs.row >= ns->geom.pgnum) {
1592                NS_WARN("do_state_action: wrong page number (%#x)\n", ns->regs.row);
1593                return -1;
1594        }
1595
1596        switch (action) {
1597
1598        case ACTION_CPY:
1599                /*
1600                 * Copy page data to the internal buffer.
1601                 */
1602
1603                /* Column shouldn't be very large */
1604                if (ns->regs.column >= (ns->geom.pgszoob - ns->regs.off)) {
1605                        NS_ERR("do_state_action: column number is too large\n");
1606                        break;
1607                }
1608                num = ns->geom.pgszoob - ns->regs.off - ns->regs.column;
1609                read_page(ns, num);
1610
1611                NS_DBG("do_state_action: (ACTION_CPY:) copy %d bytes to int buf, raw offset %d\n",
1612                        num, NS_RAW_OFFSET(ns) + ns->regs.off);
1613
1614                if (ns->regs.off == 0)
1615                        NS_LOG("read page %d\n", ns->regs.row);
1616                else if (ns->regs.off < ns->geom.pgsz)
1617                        NS_LOG("read page %d (second half)\n", ns->regs.row);
1618                else
1619                        NS_LOG("read OOB of page %d\n", ns->regs.row);
1620
1621                NS_UDELAY(access_delay);
1622                NS_UDELAY(input_cycle * ns->geom.pgsz / 1000 / busdiv);
1623
1624                break;
1625
1626        case ACTION_SECERASE:
1627                /*
1628                 * Erase sector.
1629                 */
1630
1631                if (ns->lines.wp) {
1632                        NS_ERR("do_state_action: device is write-protected, ignore sector erase\n");
1633                        return -1;
1634                }
1635
1636                if (ns->regs.row >= ns->geom.pgnum - ns->geom.pgsec
1637                        || (ns->regs.row & ~(ns->geom.secsz - 1))) {
1638                        NS_ERR("do_state_action: wrong sector address (%#x)\n", ns->regs.row);
1639                        return -1;
1640                }
1641
1642                ns->regs.row = (ns->regs.row <<
1643                                8 * (ns->geom.pgaddrbytes - ns->geom.secaddrbytes)) | ns->regs.column;
1644                ns->regs.column = 0;
1645
1646                erase_block_no = ns->regs.row >> (ns->geom.secshift - ns->geom.pgshift);
1647
1648                NS_DBG("do_state_action: erase sector at address %#x, off = %d\n",
1649                                ns->regs.row, NS_RAW_OFFSET(ns));
1650                NS_LOG("erase sector %u\n", erase_block_no);
1651
1652                erase_sector(ns);
1653
1654                NS_MDELAY(erase_delay);
1655
1656                if (erase_block_wear)
1657                        update_wear(erase_block_no);
1658
1659                if (erase_error(erase_block_no)) {
1660                        NS_WARN("simulating erase failure in erase block %u\n", erase_block_no);
1661                        return -1;
1662                }
1663
1664                break;
1665
1666        case ACTION_PRGPAGE:
1667                /*
1668                 * Programm page - move internal buffer data to the page.
1669                 */
1670
1671                if (ns->lines.wp) {
1672                        NS_WARN("do_state_action: device is write-protected, programm\n");
1673                        return -1;
1674                }
1675
1676                num = ns->geom.pgszoob - ns->regs.off - ns->regs.column;
1677                if (num != ns->regs.count) {
1678                        NS_ERR("do_state_action: too few bytes were input (%d instead of %d)\n",
1679                                        ns->regs.count, num);
1680                        return -1;
1681                }
1682
1683                if (prog_page(ns, num) == -1)
1684                        return -1;
1685
1686                page_no = ns->regs.row;
1687
1688                NS_DBG("do_state_action: copy %d bytes from int buf to (%#x, %#x), raw off = %d\n",
1689                        num, ns->regs.row, ns->regs.column, NS_RAW_OFFSET(ns) + ns->regs.off);
1690                NS_LOG("programm page %d\n", ns->regs.row);
1691
1692                NS_UDELAY(programm_delay);
1693                NS_UDELAY(output_cycle * ns->geom.pgsz / 1000 / busdiv);
1694
1695                if (write_error(page_no)) {
1696                        NS_WARN("simulating write failure in page %u\n", page_no);
1697                        return -1;
1698                }
1699
1700                break;
1701
1702        case ACTION_ZEROOFF:
1703                NS_DBG("do_state_action: set internal offset to 0\n");
1704                ns->regs.off = 0;
1705                break;
1706
1707        case ACTION_HALFOFF:
1708                if (!(ns->options & OPT_PAGE512_8BIT)) {
1709                        NS_ERR("do_state_action: BUG! can't skip half of page for non-512"
1710                                "byte page size 8x chips\n");
1711                        return -1;
1712                }
1713                NS_DBG("do_state_action: set internal offset to %d\n", ns->geom.pgsz/2);
1714                ns->regs.off = ns->geom.pgsz/2;
1715                break;
1716
1717        case ACTION_OOBOFF:
1718                NS_DBG("do_state_action: set internal offset to %d\n", ns->geom.pgsz);
1719                ns->regs.off = ns->geom.pgsz;
1720                break;
1721
1722        default:
1723                NS_DBG("do_state_action: BUG! unknown action\n");
1724        }
1725
1726        return 0;
1727}
1728
1729/*
1730 * Switch simulator's state.
1731 */
1732static void switch_state(struct nandsim *ns)
1733{
1734        if (ns->op) {
1735                /*
1736                 * The current operation have already been identified.
1737                 * Just follow the states chain.
1738                 */
1739
1740                ns->stateidx += 1;
1741                ns->state = ns->nxstate;
1742                ns->nxstate = ns->op[ns->stateidx + 1];
1743
1744                NS_DBG("switch_state: operation is known, switch to the next state, "
1745                        "state: %s, nxstate: %s\n",
1746                        get_state_name(ns->state), get_state_name(ns->nxstate));
1747
1748                /* See, whether we need to do some action */
1749                if ((ns->state & ACTION_MASK) && do_state_action(ns, ns->state) < 0) {
1750                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1751                        return;
1752                }
1753
1754        } else {
1755                /*
1756                 * We don't yet know which operation we perform.
1757                 * Try to identify it.
1758                 */
1759
1760                /*
1761                 *  The only event causing the switch_state function to
1762                 *  be called with yet unknown operation is new command.
1763                 */
1764                ns->state = get_state_by_command(ns->regs.command);
1765
1766                NS_DBG("switch_state: operation is unknown, try to find it\n");
1767
1768                if (find_operation(ns, 0) != 0)
1769                        return;
1770
1771                if ((ns->state & ACTION_MASK) && do_state_action(ns, ns->state) < 0) {
1772                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
1773                        return;
1774                }
1775        }
1776
1777        /* For 16x devices column means the page offset in words */
1778        if ((ns->nxstate & STATE_ADDR_MASK) && ns->busw == 16) {
1779                NS_DBG("switch_state: double the column number for 16x device\n");
1780                ns->regs.column <<= 1;
1781        }
1782
1783        if (NS_STATE(ns->nxstate) == STATE_READY) {
1784                /*
1785                 * The current state is the last. Return to STATE_READY
1786                 */
1787
1788                u_char status = NS_STATUS_OK(ns);
1789
1790                /* In case of data states, see if all bytes were input/output */
1791                if ((ns->state & (STATE_DATAIN_MASK | STATE_DATAOUT_MASK))
1792                        && ns->regs.count != ns->regs.num) {
1793                        NS_WARN("switch_state: not all bytes were processed, %d left\n",
1794                                        ns->regs.num - ns->regs.count);
1795                        status = NS_STATUS_FAILED(ns);
1796                }
1797
1798                NS_DBG("switch_state: operation complete, switch to STATE_READY state\n");
1799
1800                switch_to_ready_state(ns, status);
1801
1802                return;
1803        } else if (ns->nxstate & (STATE_DATAIN_MASK | STATE_DATAOUT_MASK)) {
1804                /*
1805                 * If the next state is data input/output, switch to it now
1806                 */
1807
1808                ns->state      = ns->nxstate;
1809                ns->nxstate    = ns->op[++ns->stateidx + 1];
1810                ns->regs.num   = ns->regs.count = 0;
1811
1812                NS_DBG("switch_state: the next state is data I/O, switch, "
1813                        "state: %s, nxstate: %s\n",
1814                        get_state_name(ns->state), get_state_name(ns->nxstate));
1815
1816                /*
1817                 * Set the internal register to the count of bytes which
1818                 * are expected to be input or output
1819                 */
1820                switch (NS_STATE(ns->state)) {
1821                        case STATE_DATAIN:
1822                        case STATE_DATAOUT:
1823                                ns->regs.num = ns->geom.pgszoob - ns->regs.off - ns->regs.column;
1824                                break;
1825
1826                        case STATE_DATAOUT_ID:
1827                                ns->regs.num = ns->geom.idbytes;
1828                                break;
1829
1830                        case STATE_DATAOUT_STATUS:
1831                        case STATE_DATAOUT_STATUS_M:
1832                                ns->regs.count = ns->regs.num = 0;
1833                                break;
1834
1835                        default:
1836                                NS_ERR("switch_state: BUG! unknown data state\n");
1837                }
1838
1839        } else if (ns->nxstate & STATE_ADDR_MASK) {
1840                /*
1841                 * If the next state is address input, set the internal
1842                 * register to the number of expected address bytes
1843                 */
1844
1845                ns->regs.count = 0;
1846
1847                switch (NS_STATE(ns->nxstate)) {
1848                        case STATE_ADDR_PAGE:
1849                                ns->regs.num = ns->geom.pgaddrbytes;
1850
1851                                break;
1852                        case STATE_ADDR_SEC:
1853                                ns->regs.num = ns->geom.secaddrbytes;
1854                                break;
1855
1856                        case STATE_ADDR_ZERO:
1857                                ns->regs.num = 1;
1858                                break;
1859
1860                        case STATE_ADDR_COLUMN:
1861                                /* Column address is always 2 bytes */
1862                                ns->regs.num = ns->geom.pgaddrbytes - ns->geom.secaddrbytes;
1863                                break;
1864
1865                        default:
1866                                NS_ERR("switch_state: BUG! unknown address state\n");
1867                }
1868        } else {
1869                /*
1870                 * Just reset internal counters.
1871                 */
1872
1873                ns->regs.num = 0;
1874                ns->regs.count = 0;
1875        }
1876}
1877
1878static u_char ns_nand_read_byte(struct mtd_info *mtd)
1879{
1880        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
1881        u_char outb = 0x00;
1882
1883        /* Sanity and correctness checks */
1884        if (!ns->lines.ce) {
1885                NS_ERR("read_byte: chip is disabled, return %#x\n", (uint)outb);
1886                return outb;
1887        }
1888        if (ns->lines.ale || ns->lines.cle) {
1889                NS_ERR("read_byte: ALE or CLE pin is high, return %#x\n", (uint)outb);
1890                return outb;
1891        }
1892        if (!(ns->state & STATE_DATAOUT_MASK)) {
1893                NS_WARN("read_byte: unexpected data output cycle, state is %s "
1894                        "return %#x\n", get_state_name(ns->state), (uint)outb);
1895                return outb;
1896        }
1897
1898        /* Status register may be read as many times as it is wanted */
1899        if (NS_STATE(ns->state) == STATE_DATAOUT_STATUS) {
1900                NS_DBG("read_byte: return %#x status\n", ns->regs.status);
1901                return ns->regs.status;
1902        }
1903
1904        /* Check if there is any data in the internal buffer which may be read */
1905        if (ns->regs.count == ns->regs.num) {
1906                NS_WARN("read_byte: no more data to output, return %#x\n", (uint)outb);
1907                return outb;
1908        }
1909
1910        switch (NS_STATE(ns->state)) {
1911                case STATE_DATAOUT:
1912                        if (ns->busw == 8) {
1913                                outb = ns->buf.byte[ns->regs.count];
1914                                ns->regs.count += 1;
1915                        } else {
1916                                outb = (u_char)cpu_to_le16(ns->buf.word[ns->regs.count >> 1]);
1917                                ns->regs.count += 2;
1918                        }
1919                        break;
1920                case STATE_DATAOUT_ID:
1921                        NS_DBG("read_byte: read ID byte %d, total = %d\n", ns->regs.count, ns->regs.num);
1922                        outb = ns->ids[ns->regs.count];
1923                        ns->regs.count += 1;
1924                        break;
1925                default:
1926                        BUG();
1927        }
1928
1929        if (ns->regs.count == ns->regs.num) {
1930                NS_DBG("read_byte: all bytes were read\n");
1931
1932                /*
1933                 * The OPT_AUTOINCR allows to read next conseqitive pages without
1934                 * new read operation cycle.
1935                 */
1936                if ((ns->options & OPT_AUTOINCR) && NS_STATE(ns->state) == STATE_DATAOUT) {
1937                        ns->regs.count = 0;
1938                        if (ns->regs.row + 1 < ns->geom.pgnum)
1939                                ns->regs.row += 1;
1940                        NS_DBG("read_byte: switch to the next page (%#x)\n", ns->regs.row);
1941                        do_state_action(ns, ACTION_CPY);
1942                }
1943                else if (NS_STATE(ns->nxstate) == STATE_READY)
1944                        switch_state(ns);
1945
1946        }
1947
1948        return outb;
1949}
1950
1951static void ns_nand_write_byte(struct mtd_info *mtd, u_char byte)
1952{
1953        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
1954
1955        /* Sanity and correctness checks */
1956        if (!ns->lines.ce) {
1957                NS_ERR("write_byte: chip is disabled, ignore write\n");
1958                return;
1959        }
1960        if (ns->lines.ale && ns->lines.cle) {
1961                NS_ERR("write_byte: ALE and CLE pins are high simultaneously, ignore write\n");
1962                return;
1963        }
1964
1965        if (ns->lines.cle == 1) {
1966                /*
1967                 * The byte written is a command.
1968                 */
1969
1970                if (byte == NAND_CMD_RESET) {
1971                        NS_LOG("reset chip\n");
1972                        switch_to_ready_state(ns, NS_STATUS_OK(ns));
1973                        return;
1974                }
1975
1976                /* Check that the command byte is correct */
1977                if (check_command(byte)) {
1978                        NS_ERR("write_byte: unknown command %#x\n", (uint)byte);
1979                        return;
1980                }
1981
1982                if (NS_STATE(ns->state) == STATE_DATAOUT_STATUS
1983                        || NS_STATE(ns->state) == STATE_DATAOUT_STATUS_M
1984                        || NS_STATE(ns->state) == STATE_DATAOUT) {
1985                        int row = ns->regs.row;
1986
1987                        switch_state(ns);
1988                        if (byte == NAND_CMD_RNDOUT)
1989                                ns->regs.row = row;
1990                }
1991
1992                /* Check if chip is expecting command */
1993                if (NS_STATE(ns->nxstate) != STATE_UNKNOWN && !(ns->nxstate & STATE_CMD_MASK)) {
1994                        /* Do not warn if only 2 id bytes are read */
1995                        if (!(ns->regs.command == NAND_CMD_READID &&
1996                            NS_STATE(ns->state) == STATE_DATAOUT_ID && ns->regs.count == 2)) {
1997                                /*
1998                                 * We are in situation when something else (not command)
1999                                 * was expected but command was input. In this case ignore
2000                                 * previous command(s)/state(s) and accept the last one.
2001                                 */
2002                                NS_WARN("write_byte: command (%#x) wasn't expected, expected state is %s, "
2003                                        "ignore previous states\n", (uint)byte, get_state_name(ns->nxstate));
2004                        }
2005                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2006                }
2007
2008                NS_DBG("command byte corresponding to %s state accepted\n",
2009                        get_state_name(get_state_by_command(byte)));
2010                ns->regs.command = byte;
2011                switch_state(ns);
2012
2013        } else if (ns->lines.ale == 1) {
2014                /*
2015                 * The byte written is an address.
2016                 */
2017
2018                if (NS_STATE(ns->nxstate) == STATE_UNKNOWN) {
2019
2020                        NS_DBG("write_byte: operation isn't known yet, identify it\n");
2021
2022                        if (find_operation(ns, 1) < 0)
2023                                return;
2024
2025                        if ((ns->state & ACTION_MASK) && do_state_action(ns, ns->state) < 0) {
2026                                switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2027                                return;
2028                        }
2029
2030                        ns->regs.count = 0;
2031                        switch (NS_STATE(ns->nxstate)) {
2032                                case STATE_ADDR_PAGE:
2033                                        ns->regs.num = ns->geom.pgaddrbytes;
2034                                        break;
2035                                case STATE_ADDR_SEC:
2036                                        ns->regs.num = ns->geom.secaddrbytes;
2037                                        break;
2038                                case STATE_ADDR_ZERO:
2039                                        ns->regs.num = 1;
2040                                        break;
2041                                default:
2042                                        BUG();
2043                        }
2044                }
2045
2046                /* Check that chip is expecting address */
2047                if (!(ns->nxstate & STATE_ADDR_MASK)) {
2048                        NS_ERR("write_byte: address (%#x) isn't expected, expected state is %s, "
2049                                "switch to STATE_READY\n", (uint)byte, get_state_name(ns->nxstate));
2050                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2051                        return;
2052                }
2053
2054                /* Check if this is expected byte */
2055                if (ns->regs.count == ns->regs.num) {
2056                        NS_ERR("write_byte: no more address bytes expected\n");
2057                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2058                        return;
2059                }
2060
2061                accept_addr_byte(ns, byte);
2062
2063                ns->regs.count += 1;
2064
2065                NS_DBG("write_byte: address byte %#x was accepted (%d bytes input, %d expected)\n",
2066                                (uint)byte, ns->regs.count, ns->regs.num);
2067
2068                if (ns->regs.count == ns->regs.num) {
2069                        NS_DBG("address (%#x, %#x) is accepted\n", ns->regs.row, ns->regs.column);
2070                        switch_state(ns);
2071                }
2072
2073        } else {
2074                /*
2075                 * The byte written is an input data.
2076                 */
2077
2078                /* Check that chip is expecting data input */
2079                if (!(ns->state & STATE_DATAIN_MASK)) {
2080                        NS_ERR("write_byte: data input (%#x) isn't expected, state is %s, "
2081                                "switch to %s\n", (uint)byte,
2082                                get_state_name(ns->state), get_state_name(STATE_READY));
2083                        switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2084                        return;
2085                }
2086
2087                /* Check if this is expected byte */
2088                if (ns->regs.count == ns->regs.num) {
2089                        NS_WARN("write_byte: %u input bytes has already been accepted, ignore write\n",
2090                                        ns->regs.num);
2091                        return;
2092                }
2093
2094                if (ns->busw == 8) {
2095                        ns->buf.byte[ns->regs.count] = byte;
2096                        ns->regs.count += 1;
2097                } else {
2098                        ns->buf.word[ns->regs.count >> 1] = cpu_to_le16((uint16_t)byte);
2099                        ns->regs.count += 2;
2100                }
2101        }
2102
2103        return;
2104}
2105
2106static void ns_hwcontrol(struct mtd_info *mtd, int cmd, unsigned int bitmask)
2107{
2108        struct nandsim *ns = ((struct nand_chip *)mtd->priv)->priv;
2109
2110        ns->lines.cle = bitmask & NAND_CLE ? 1 : 0;
2111        ns->lines.ale = bitmask & NAND_ALE ? 1 : 0;
2112        ns->lines.ce = bitmask & NAND_NCE ? 1 : 0;
2113
2114        if (cmd != NAND_CMD_NONE)
2115                ns_nand_write_byte(mtd, cmd);
2116}
2117
2118static int ns_device_ready(struct mtd_info *mtd)
2119{
2120        NS_DBG("device_ready\n");
2121        return 1;
2122}
2123
2124static uint16_t ns_nand_read_word(struct mtd_info *mtd)
2125{
2126        struct nand_chip *chip = (struct nand_chip *)mtd->priv;
2127
2128        NS_DBG("read_word\n");
2129
2130        return chip->read_byte(mtd) | (chip->read_byte(mtd) << 8);
2131}
2132
2133static void ns_nand_write_buf(struct mtd_info *mtd, const u_char *buf, int len)
2134{
2135        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
2136
2137        /* Check that chip is expecting data input */
2138        if (!(ns->state & STATE_DATAIN_MASK)) {
2139                NS_ERR("write_buf: data input isn't expected, state is %s, "
2140                        "switch to STATE_READY\n", get_state_name(ns->state));
2141                switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2142                return;
2143        }
2144
2145        /* Check if these are expected bytes */
2146        if (ns->regs.count + len > ns->regs.num) {
2147                NS_ERR("write_buf: too many input bytes\n");
2148                switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2149                return;
2150        }
2151
2152        memcpy(ns->buf.byte + ns->regs.count, buf, len);
2153        ns->regs.count += len;
2154
2155        if (ns->regs.count == ns->regs.num) {
2156                NS_DBG("write_buf: %d bytes were written\n", ns->regs.count);
2157        }
2158}
2159
2160static void ns_nand_read_buf(struct mtd_info *mtd, u_char *buf, int len)
2161{
2162        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
2163
2164        /* Sanity and correctness checks */
2165        if (!ns->lines.ce) {
2166                NS_ERR("read_buf: chip is disabled\n");
2167                return;
2168        }
2169        if (ns->lines.ale || ns->lines.cle) {
2170                NS_ERR("read_buf: ALE or CLE pin is high\n");
2171                return;
2172        }
2173        if (!(ns->state & STATE_DATAOUT_MASK)) {
2174                NS_WARN("read_buf: unexpected data output cycle, current state is %s\n",
2175                        get_state_name(ns->state));
2176                return;
2177        }
2178
2179        if (NS_STATE(ns->state) != STATE_DATAOUT) {
2180                int i;
2181
2182                for (i = 0; i < len; i++)
2183                        buf[i] = ((struct nand_chip *)mtd->priv)->read_byte(mtd);
2184
2185                return;
2186        }
2187
2188        /* Check if these are expected bytes */
2189        if (ns->regs.count + len > ns->regs.num) {
2190                NS_ERR("read_buf: too many bytes to read\n");
2191                switch_to_ready_state(ns, NS_STATUS_FAILED(ns));
2192                return;
2193        }
2194
2195        memcpy(buf, ns->buf.byte + ns->regs.count, len);
2196        ns->regs.count += len;
2197
2198        if (ns->regs.count == ns->regs.num) {
2199                if ((ns->options & OPT_AUTOINCR) && NS_STATE(ns->state) == STATE_DATAOUT) {
2200                        ns->regs.count = 0;
2201                        if (ns->regs.row + 1 < ns->geom.pgnum)
2202                                ns->regs.row += 1;
2203                        NS_DBG("read_buf: switch to the next page (%#x)\n", ns->regs.row);
2204                        do_state_action(ns, ACTION_CPY);
2205                }
2206                else if (NS_STATE(ns->nxstate) == STATE_READY)
2207                        switch_state(ns);
2208        }
2209
2210        return;
2211}
2212
2213static int ns_nand_verify_buf(struct mtd_info *mtd, const u_char *buf, int len)
2214{
2215        ns_nand_read_buf(mtd, (u_char *)&ns_verify_buf[0], len);
2216
2217        if (!memcmp(buf, &ns_verify_buf[0], len)) {
2218                NS_DBG("verify_buf: the buffer is OK\n");
2219                return 0;
2220        } else {
2221                NS_DBG("verify_buf: the buffer is wrong\n");
2222                return -EFAULT;
2223        }
2224}
2225
2226/*
2227 * Module initialization function
2228 */
2229static int __init ns_init_module(void)
2230{
2231        struct nand_chip *chip;
2232        struct nandsim *nand;
2233        int retval = -ENOMEM, i;
2234
2235        if (bus_width != 8 && bus_width != 16) {
2236                NS_ERR("wrong bus width (%d), use only 8 or 16\n", bus_width);
2237                return -EINVAL;
2238        }
2239
2240        /* Allocate and initialize mtd_info, nand_chip and nandsim structures */
2241        nsmtd = kzalloc(sizeof(struct mtd_info) + sizeof(struct nand_chip)
2242                                + sizeof(struct nandsim), GFP_KERNEL);
2243        if (!nsmtd) {
2244                NS_ERR("unable to allocate core structures.\n");
2245                return -ENOMEM;
2246        }
2247        chip        = (struct nand_chip *)(nsmtd + 1);
2248        nsmtd->priv = (void *)chip;
2249        nand        = (struct nandsim *)(chip + 1);
2250        chip->priv  = (void *)nand;
2251
2252        /*
2253         * Register simulator's callbacks.
2254         */
2255        chip->cmd_ctrl   = ns_hwcontrol;
2256        chip->read_byte  = ns_nand_read_byte;
2257        chip->dev_ready  = ns_device_ready;
2258        chip->write_buf  = ns_nand_write_buf;
2259        chip->read_buf   = ns_nand_read_buf;
2260        chip->verify_buf = ns_nand_verify_buf;
2261        chip->read_word  = ns_nand_read_word;
2262        chip->ecc.mode   = NAND_ECC_SOFT;
2263        /* The NAND_SKIP_BBTSCAN option is necessary for 'overridesize' */
2264        /* and 'badblocks' parameters to work */
2265        chip->options   |= NAND_SKIP_BBTSCAN;
2266
2267        /*
2268         * Perform minimum nandsim structure initialization to handle
2269         * the initial ID read command correctly
2270         */
2271        if (third_id_byte != 0xFF || fourth_id_byte != 0xFF)
2272                nand->geom.idbytes = 4;
2273        else
2274                nand->geom.idbytes = 2;
2275        nand->regs.status = NS_STATUS_OK(nand);
2276        nand->nxstate = STATE_UNKNOWN;
2277        nand->options |= OPT_PAGE256; /* temporary value */
2278        nand->ids[0] = first_id_byte;
2279        nand->ids[1] = second_id_byte;
2280        nand->ids[2] = third_id_byte;
2281        nand->ids[3] = fourth_id_byte;
2282        if (bus_width == 16) {
2283                nand->busw = 16;
2284                chip->options |= NAND_BUSWIDTH_16;
2285        }
2286
2287        nsmtd->owner = THIS_MODULE;
2288
2289        if ((retval = parse_weakblocks()) != 0)
2290                goto error;
2291
2292        if ((retval = parse_weakpages()) != 0)
2293                goto error;
2294
2295        if ((retval = parse_gravepages()) != 0)
2296                goto error;
2297
2298        if ((retval = nand_scan(nsmtd, 1)) != 0) {
2299                NS_ERR("can't register NAND Simulator\n");
2300                if (retval > 0)
2301                        retval = -ENXIO;
2302                goto error;
2303        }
2304
2305        if (overridesize) {
2306                uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
2307                if (new_size >> overridesize != nsmtd->erasesize) {
2308                        NS_ERR("overridesize is too big\n");
2309                        goto err_exit;
2310                }
2311                /* N.B. This relies on nand_scan not doing anything with the size before we change it */
2312                nsmtd->size = new_size;
2313                chip->chipsize = new_size;
2314                chip->chip_shift = ffs(nsmtd->erasesize) + overridesize - 1;
2315                chip->pagemask = (chip->chipsize >> chip->page_shift) - 1;
2316        }
2317
2318        if ((retval = setup_wear_reporting(nsmtd)) != 0)
2319                goto err_exit;
2320
2321        if ((retval = init_nandsim(nsmtd)) != 0)
2322                goto err_exit;
2323
2324        if ((retval = parse_badblocks(nand, nsmtd)) != 0)
2325                goto err_exit;
2326
2327        if ((retval = nand_default_bbt(nsmtd)) != 0)
2328                goto err_exit;
2329
2330        /* Register NAND partitions */
2331        if ((retval = add_mtd_partitions(nsmtd, &nand->partitions[0], nand->nbparts)) != 0)
2332                goto err_exit;
2333
2334        return 0;
2335
2336err_exit:
2337        free_nandsim(nand);
2338        nand_release(nsmtd);
2339        for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i)
2340                kfree(nand->partitions[i].name);
2341error:
2342        kfree(nsmtd);
2343        free_lists();
2344
2345        return retval;
2346}
2347
2348module_init(ns_init_module);
2349
2350/*
2351 * Module clean-up function
2352 */
2353static void __exit ns_cleanup_module(void)
2354{
2355        struct nandsim *ns = (struct nandsim *)(((struct nand_chip *)nsmtd->priv)->priv);
2356        int i;
2357
2358        free_nandsim(ns);    /* Free nandsim private resources */
2359        nand_release(nsmtd); /* Unregister driver */
2360        for (i = 0;i < ARRAY_SIZE(ns->partitions); ++i)
2361                kfree(ns->partitions[i].name);
2362        kfree(nsmtd);        /* Free other structures */
2363        free_lists();
2364}
2365
2366module_exit(ns_cleanup_module);
2367
2368MODULE_LICENSE ("GPL");
2369MODULE_AUTHOR ("Artem B. Bityuckiy");
2370MODULE_DESCRIPTION ("The NAND flash simulator");
2371
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.