1 /* Driver for SanDisk SDDR-09 SmartMedia reader
3 * $Id: sddr09.c,v 1.24 2002/04/22 03:39:43 mdharm Exp $
4 * (c) 2000, 2001 Robert Baruch (autophile@starband.net)
5 * (c) 2002 Andries Brouwer (aeb@cwi.nl)
6 * Developed with the assistance of:
7 * (c) 2002 Alan Stern <stern@rowland.org>
9 * The SanDisk SDDR-09 SmartMedia reader uses the Shuttle EUSB-01 chip.
10 * This chip is a programmable USB controller. In the SDDR-09, it has
11 * been programmed to obey a certain limited set of SCSI commands.
12 * This driver translates the "real" SCSI commands to the SDDR-09 SCSI
15 * This program is free software; you can redistribute it and/or modify it
16 * under the terms of the GNU General Public License as published by the
17 * Free Software Foundation; either version 2, or (at your option) any
20 * This program is distributed in the hope that it will be useful, but
21 * WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 * General Public License for more details.
25 * You should have received a copy of the GNU General Public License along
26 * with this program; if not, write to the Free Software Foundation, Inc.,
27 * 675 Mass Ave, Cambridge, MA 02139, USA.
31 * Known vendor commands: 12 bytes, first byte is opcode
33 * E7: read scatter gather
41 * EF: compute checksum (?)
44 #include <linux/sched.h>
45 #include <linux/errno.h>
46 #include <linux/slab.h>
48 #include <scsi/scsi.h>
49 #include <scsi/scsi_cmnd.h>
52 #include "transport.h"
58 #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) )
59 #define LSB_of(s) ((s)&0xFF)
60 #define MSB_of(s) ((s)>>8)
62 /* #define US_DEBUGP printk */
65 * First some stuff that does not belong here:
66 * data on SmartMedia and other cards, completely
67 * unrelated to this driver.
68 * Similar stuff occurs in <linux/mtd/nand_ids.h>.
71 struct nand_flash_dev {
73 int chipshift; /* 1<<cs bytes total capacity */
74 char pageshift; /* 1<<ps bytes in a page */
75 char blockshift; /* 1<<bs pages in an erase block */
76 char zoneshift; /* 1<<zs blocks in a zone */
77 /* # of logical blocks is 125/128 of this */
78 char pageadrlen; /* length of an address in bytes - 1 */
82 * NAND Flash Manufacturer ID Codes
84 #define NAND_MFR_AMD 0x01
85 #define NAND_MFR_NATSEMI 0x8f
86 #define NAND_MFR_TOSHIBA 0x98
87 #define NAND_MFR_SAMSUNG 0xec
89 static inline char *nand_flash_manufacturer(int manuf_id) {
93 case NAND_MFR_NATSEMI:
95 case NAND_MFR_TOSHIBA:
97 case NAND_MFR_SAMSUNG:
105 * It looks like it is unnecessary to attach manufacturer to the
106 * remaining data: SSFDC prescribes manufacturer-independent id codes.
108 * 256 MB NAND flash has a 5-byte ID with 2nd byte 0xaa, 0xba, 0xca or 0xda.
111 static struct nand_flash_dev nand_flash_ids[] = {
113 { 0x6e, 20, 8, 4, 8, 2}, /* 1 MB */
114 { 0xe8, 20, 8, 4, 8, 2}, /* 1 MB */
115 { 0xec, 20, 8, 4, 8, 2}, /* 1 MB */
116 { 0x64, 21, 8, 4, 9, 2}, /* 2 MB */
117 { 0xea, 21, 8, 4, 9, 2}, /* 2 MB */
118 { 0x6b, 22, 9, 4, 9, 2}, /* 4 MB */
119 { 0xe3, 22, 9, 4, 9, 2}, /* 4 MB */
120 { 0xe5, 22, 9, 4, 9, 2}, /* 4 MB */
121 { 0xe6, 23, 9, 4, 10, 2}, /* 8 MB */
122 { 0x73, 24, 9, 5, 10, 2}, /* 16 MB */
123 { 0x75, 25, 9, 5, 10, 2}, /* 32 MB */
124 { 0x76, 26, 9, 5, 10, 3}, /* 64 MB */
125 { 0x79, 27, 9, 5, 10, 3}, /* 128 MB */
128 { 0x5d, 21, 9, 4, 8, 2}, /* 2 MB */
129 { 0xd5, 22, 9, 4, 9, 2}, /* 4 MB */
130 { 0xd6, 23, 9, 4, 10, 2}, /* 8 MB */
131 { 0x57, 24, 9, 4, 11, 2}, /* 16 MB */
132 { 0x58, 25, 9, 4, 12, 2}, /* 32 MB */
136 #define SIZE(a) (sizeof(a)/sizeof((a)[0]))
138 static struct nand_flash_dev *
139 nand_find_id(unsigned char id) {
142 for (i = 0; i < SIZE(nand_flash_ids); i++)
143 if (nand_flash_ids[i].model_id == id)
144 return &(nand_flash_ids[i]);
151 static unsigned char parity[256];
152 static unsigned char ecc2[256];
154 static void nand_init_ecc(void) {
158 for (i = 1; i < 256; i++)
159 parity[i] = (parity[i&(i-1)] ^ 1);
161 for (i = 0; i < 256; i++) {
163 for (j = 0; j < 8; j++) {
173 ecc2[i] = ~(a ^ (a<<1) ^ (parity[i] ? 0xa8 : 0));
177 /* compute 3-byte ecc on 256 bytes */
178 static void nand_compute_ecc(unsigned char *data, unsigned char *ecc) {
180 unsigned char par, bit, bits[8];
183 for (j = 0; j < 8; j++)
186 /* collect 16 checksum bits */
187 for (i = 0; i < 256; i++) {
189 bit = parity[data[i]];
190 for (j = 0; j < 8; j++)
191 if ((i & (1<<j)) == 0)
195 /* put 4+4+4 = 12 bits in the ecc */
196 a = (bits[3] << 6) + (bits[2] << 4) + (bits[1] << 2) + bits[0];
197 ecc[0] = ~(a ^ (a<<1) ^ (parity[par] ? 0xaa : 0));
199 a = (bits[7] << 6) + (bits[6] << 4) + (bits[5] << 2) + bits[4];
200 ecc[1] = ~(a ^ (a<<1) ^ (parity[par] ? 0xaa : 0));
205 static int nand_compare_ecc(unsigned char *data, unsigned char *ecc) {
206 return (data[0] == ecc[0] && data[1] == ecc[1] && data[2] == ecc[2]);
209 static void nand_store_ecc(unsigned char *data, unsigned char *ecc) {
210 memcpy(data, ecc, 3);
214 * The actual driver starts here.
217 struct sddr09_card_info {
218 unsigned long capacity; /* Size of card in bytes */
219 int pagesize; /* Size of page in bytes */
220 int pageshift; /* log2 of pagesize */
221 int blocksize; /* Size of block in pages */
222 int blockshift; /* log2 of blocksize */
223 int blockmask; /* 2^blockshift - 1 */
224 int *lba_to_pba; /* logical to physical map */
225 int *pba_to_lba; /* physical to logical map */
226 int lbact; /* number of available pages */
228 #define SDDR09_WP 1 /* write protected */
232 * On my 16MB card, control blocks have size 64 (16 real control bytes,
233 * and 48 junk bytes). In reality of course the card uses 16 control bytes,
234 * so the reader makes up the remaining 48. Don't know whether these numbers
235 * depend on the card. For now a constant.
237 #define CONTROL_SHIFT 6
240 * On my Combo CF/SM reader, the SM reader has LUN 1.
241 * (and things fail with LUN 0).
242 * It seems LUN is irrelevant for others.
245 #define LUNBITS (LUN << 5)
248 * LBA and PBA are unsigned ints. Special values.
250 #define UNDEF 0xffffffff
251 #define SPARE 0xfffffffe
252 #define UNUSABLE 0xfffffffd
254 static const int erase_bad_lba_entries = 0;
256 /* send vendor interface command (0x41) */
257 /* called for requests 0, 1, 8 */
259 sddr09_send_command(struct us_data *us,
260 unsigned char request,
261 unsigned char direction,
262 unsigned char *xfer_data,
263 unsigned int xfer_len) {
265 unsigned char requesttype = (0x41 | direction);
268 // Get the receive or send control pipe number
270 if (direction == USB_DIR_IN)
271 pipe = us->recv_ctrl_pipe;
273 pipe = us->send_ctrl_pipe;
275 rc = usb_stor_ctrl_transfer(us, pipe, request, requesttype,
276 0, 0, xfer_data, xfer_len);
278 case USB_STOR_XFER_GOOD: return 0;
279 case USB_STOR_XFER_STALLED: return -EPIPE;
280 default: return -EIO;
285 sddr09_send_scsi_command(struct us_data *us,
286 unsigned char *command,
287 unsigned int command_len) {
288 return sddr09_send_command(us, 0, USB_DIR_OUT, command, command_len);
293 * Test Unit Ready Command: 12 bytes.
297 sddr09_test_unit_ready(struct us_data *us) {
298 unsigned char *command = us->iobuf;
301 memset(command, 0, 6);
302 command[1] = LUNBITS;
304 result = sddr09_send_scsi_command(us, command, 6);
306 US_DEBUGP("sddr09_test_unit_ready returns %d\n", result);
313 * Request Sense Command: 12 bytes.
315 * byte 4: data length
318 sddr09_request_sense(struct us_data *us, unsigned char *sensebuf, int buflen) {
319 unsigned char *command = us->iobuf;
322 memset(command, 0, 12);
324 command[1] = LUNBITS;
327 result = sddr09_send_scsi_command(us, command, 12);
331 result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
332 sensebuf, buflen, NULL);
333 return (result == USB_STOR_XFER_GOOD ? 0 : -EIO);
337 * Read Command: 12 bytes.
339 * byte 1: last two bits: 00: read data, 01: read blockwise control,
340 * 10: read both, 11: read pagewise control.
341 * It turns out we need values 20, 21, 22, 23 here (LUN 1).
342 * bytes 2-5: address (interpretation depends on byte 1, see below)
343 * bytes 10-11: count (idem)
345 * A page has 512 data bytes and 64 control bytes (16 control and 48 junk).
346 * A read data command gets data in 512-byte pages.
347 * A read control command gets control in 64-byte chunks.
348 * A read both command gets data+control in 576-byte chunks.
350 * Blocks are groups of 32 pages, and read blockwise control jumps to the
351 * next block, while read pagewise control jumps to the next page after
352 * reading a group of 64 control bytes.
353 * [Here 512 = 1<<pageshift, 32 = 1<<blockshift, 64 is constant?]
355 * (1 MB and 2 MB cards are a bit different, but I have only a 16 MB card.)
359 sddr09_readX(struct us_data *us, int x, unsigned long fromaddress,
360 int nr_of_pages, int bulklen, unsigned char *buf,
363 unsigned char *command = us->iobuf;
367 command[1] = LUNBITS | x;
368 command[2] = MSB_of(fromaddress>>16);
369 command[3] = LSB_of(fromaddress>>16);
370 command[4] = MSB_of(fromaddress & 0xFFFF);
371 command[5] = LSB_of(fromaddress & 0xFFFF);
376 command[10] = MSB_of(nr_of_pages);
377 command[11] = LSB_of(nr_of_pages);
379 result = sddr09_send_scsi_command(us, command, 12);
382 US_DEBUGP("Result for send_control in sddr09_read2%d %d\n",
387 result = usb_stor_bulk_transfer_sg(us, us->recv_bulk_pipe,
388 buf, bulklen, use_sg, NULL);
390 if (result != USB_STOR_XFER_GOOD) {
391 US_DEBUGP("Result for bulk_transfer in sddr09_read2%d %d\n",
401 * fromaddress counts data shorts:
402 * increasing it by 256 shifts the bytestream by 512 bytes;
403 * the last 8 bits are ignored.
405 * nr_of_pages counts pages of size (1 << pageshift).
408 sddr09_read20(struct us_data *us, unsigned long fromaddress,
409 int nr_of_pages, int pageshift, unsigned char *buf, int use_sg) {
410 int bulklen = nr_of_pages << pageshift;
412 /* The last 8 bits of fromaddress are ignored. */
413 return sddr09_readX(us, 0, fromaddress, nr_of_pages, bulklen,
418 * Read Blockwise Control
420 * fromaddress gives the starting position (as in read data;
421 * the last 8 bits are ignored); increasing it by 32*256 shifts
422 * the output stream by 64 bytes.
424 * count counts control groups of size (1 << controlshift).
425 * For me, controlshift = 6. Is this constant?
427 * After getting one control group, jump to the next block
428 * (fromaddress += 8192).
431 sddr09_read21(struct us_data *us, unsigned long fromaddress,
432 int count, int controlshift, unsigned char *buf, int use_sg) {
434 int bulklen = (count << controlshift);
435 return sddr09_readX(us, 1, fromaddress, count, bulklen,
440 * Read both Data and Control
442 * fromaddress counts data shorts, ignoring control:
443 * increasing it by 256 shifts the bytestream by 576 = 512+64 bytes;
444 * the last 8 bits are ignored.
446 * nr_of_pages counts pages of size (1 << pageshift) + (1 << controlshift).
449 sddr09_read22(struct us_data *us, unsigned long fromaddress,
450 int nr_of_pages, int pageshift, unsigned char *buf, int use_sg) {
452 int bulklen = (nr_of_pages << pageshift) + (nr_of_pages << CONTROL_SHIFT);
453 US_DEBUGP("sddr09_read22: reading %d pages, %d bytes\n",
454 nr_of_pages, bulklen);
455 return sddr09_readX(us, 2, fromaddress, nr_of_pages, bulklen,
461 * Read Pagewise Control
463 * fromaddress gives the starting position (as in read data;
464 * the last 8 bits are ignored); increasing it by 256 shifts
465 * the output stream by 64 bytes.
467 * count counts control groups of size (1 << controlshift).
468 * For me, controlshift = 6. Is this constant?
470 * After getting one control group, jump to the next page
471 * (fromaddress += 256).
474 sddr09_read23(struct us_data *us, unsigned long fromaddress,
475 int count, int controlshift, unsigned char *buf, int use_sg) {
477 int bulklen = (count << controlshift);
478 return sddr09_readX(us, 3, fromaddress, count, bulklen,
484 * Erase Command: 12 bytes.
486 * bytes 6-9: erase address (big-endian, counting shorts, sector aligned).
488 * Always precisely one block is erased; bytes 2-5 and 10-11 are ignored.
489 * The byte address being erased is 2*Eaddress.
490 * The CIS cannot be erased.
493 sddr09_erase(struct us_data *us, unsigned long Eaddress) {
494 unsigned char *command = us->iobuf;
497 US_DEBUGP("sddr09_erase: erase address %lu\n", Eaddress);
499 memset(command, 0, 12);
501 command[1] = LUNBITS;
502 command[6] = MSB_of(Eaddress>>16);
503 command[7] = LSB_of(Eaddress>>16);
504 command[8] = MSB_of(Eaddress & 0xFFFF);
505 command[9] = LSB_of(Eaddress & 0xFFFF);
507 result = sddr09_send_scsi_command(us, command, 12);
510 US_DEBUGP("Result for send_control in sddr09_erase %d\n",
517 * Write CIS Command: 12 bytes.
519 * bytes 2-5: write address in shorts
520 * bytes 10-11: sector count
522 * This writes at the indicated address. Don't know how it differs
523 * from E9. Maybe it does not erase? However, it will also write to
526 * When two such commands on the same page follow each other directly,
527 * the second one is not done.
531 * Write Command: 12 bytes.
533 * bytes 2-5: write address (big-endian, counting shorts, sector aligned).
534 * bytes 6-9: erase address (big-endian, counting shorts, sector aligned).
535 * bytes 10-11: sector count (big-endian, in 512-byte sectors).
537 * If write address equals erase address, the erase is done first,
538 * otherwise the write is done first. When erase address equals zero
542 sddr09_writeX(struct us_data *us,
543 unsigned long Waddress, unsigned long Eaddress,
544 int nr_of_pages, int bulklen, unsigned char *buf, int use_sg) {
546 unsigned char *command = us->iobuf;
550 command[1] = LUNBITS;
552 command[2] = MSB_of(Waddress>>16);
553 command[3] = LSB_of(Waddress>>16);
554 command[4] = MSB_of(Waddress & 0xFFFF);
555 command[5] = LSB_of(Waddress & 0xFFFF);
557 command[6] = MSB_of(Eaddress>>16);
558 command[7] = LSB_of(Eaddress>>16);
559 command[8] = MSB_of(Eaddress & 0xFFFF);
560 command[9] = LSB_of(Eaddress & 0xFFFF);
562 command[10] = MSB_of(nr_of_pages);
563 command[11] = LSB_of(nr_of_pages);
565 result = sddr09_send_scsi_command(us, command, 12);
568 US_DEBUGP("Result for send_control in sddr09_writeX %d\n",
573 result = usb_stor_bulk_transfer_sg(us, us->send_bulk_pipe,
574 buf, bulklen, use_sg, NULL);
576 if (result != USB_STOR_XFER_GOOD) {
577 US_DEBUGP("Result for bulk_transfer in sddr09_writeX %d\n",
584 /* erase address, write same address */
586 sddr09_write_inplace(struct us_data *us, unsigned long address,
587 int nr_of_pages, int pageshift, unsigned char *buf,
589 int bulklen = (nr_of_pages << pageshift) + (nr_of_pages << CONTROL_SHIFT);
590 return sddr09_writeX(us, address, address, nr_of_pages, bulklen,
596 * Read Scatter Gather Command: 3+4n bytes.
599 * bytes 4i-1,4i,4i+1: page address
600 * byte 4i+2: page count
603 * This reads several pages from the card to a single memory buffer.
604 * The last two bits of byte 1 have the same meaning as for E8.
607 sddr09_read_sg_test_only(struct us_data *us) {
608 unsigned char *command = us->iobuf;
609 int result, bulklen, nsg, ct;
611 unsigned long address;
615 command[1] = LUNBITS;
617 address = 040000; ct = 1;
619 bulklen += (ct << 9);
620 command[4*nsg+2] = ct;
621 command[4*nsg+1] = ((address >> 9) & 0xFF);
622 command[4*nsg+0] = ((address >> 17) & 0xFF);
623 command[4*nsg-1] = ((address >> 25) & 0xFF);
625 address = 0340000; ct = 1;
627 bulklen += (ct << 9);
628 command[4*nsg+2] = ct;
629 command[4*nsg+1] = ((address >> 9) & 0xFF);
630 command[4*nsg+0] = ((address >> 17) & 0xFF);
631 command[4*nsg-1] = ((address >> 25) & 0xFF);
633 address = 01000000; ct = 2;
635 bulklen += (ct << 9);
636 command[4*nsg+2] = ct;
637 command[4*nsg+1] = ((address >> 9) & 0xFF);
638 command[4*nsg+0] = ((address >> 17) & 0xFF);
639 command[4*nsg-1] = ((address >> 25) & 0xFF);
643 result = sddr09_send_scsi_command(us, command, 4*nsg+3);
646 US_DEBUGP("Result for send_control in sddr09_read_sg %d\n",
651 buf = (unsigned char *) kmalloc(bulklen, GFP_NOIO);
655 result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
658 if (result != USB_STOR_XFER_GOOD) {
659 US_DEBUGP("Result for bulk_transfer in sddr09_read_sg %d\n",
669 * Read Status Command: 12 bytes.
672 * Returns 64 bytes, all zero except for the first.
674 * bit 5: 1: Suspended
676 * bit 7: 1: Not write-protected
680 sddr09_read_status(struct us_data *us, unsigned char *status) {
682 unsigned char *command = us->iobuf;
683 unsigned char *data = us->iobuf;
686 US_DEBUGP("Reading status...\n");
688 memset(command, 0, 12);
690 command[1] = LUNBITS;
692 result = sddr09_send_scsi_command(us, command, 12);
696 result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
699 return (result == USB_STOR_XFER_GOOD ? 0 : -EIO);
703 sddr09_read_data(struct us_data *us,
704 unsigned long address,
705 unsigned int sectors) {
707 struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
708 unsigned char *buffer;
709 unsigned int lba, maxlba, pba;
710 unsigned int page, pages;
711 unsigned int len, index, offset;
714 // Figure out the initial LBA and page
715 lba = address >> info->blockshift;
716 page = (address & info->blockmask);
717 maxlba = info->capacity >> (info->pageshift + info->blockshift);
721 // Since we only read in one block at a time, we have to create
722 // a bounce buffer and move the data a piece at a time between the
723 // bounce buffer and the actual transfer buffer.
725 len = min(sectors, (unsigned int) info->blocksize) * info->pagesize;
726 buffer = kmalloc(len, GFP_NOIO);
727 if (buffer == NULL) {
728 printk("sddr09_read_data: Out of memory\n");
732 // This could be made much more efficient by checking for
733 // contiguous LBA's. Another exercise left to the student.
738 while (sectors > 0) {
740 /* Find number of pages we can read in this block */
741 pages = min(sectors, info->blocksize - page);
742 len = pages << info->pageshift;
744 /* Not overflowing capacity? */
746 US_DEBUGP("Error: Requested lba %u exceeds "
747 "maximum %u\n", lba, maxlba);
752 /* Find where this lba lives on disk */
753 pba = info->lba_to_pba[lba];
755 if (pba == UNDEF) { /* this lba was never written */
757 US_DEBUGP("Read %d zero pages (LBA %d) page %d\n",
760 /* This is not really an error. It just means
761 that the block has never been written.
762 Instead of returning an error
763 it is better to return all zero data. */
765 memset(buffer, 0, len);
768 US_DEBUGP("Read %d pages, from PBA %d"
769 " (LBA %d) page %d\n",
770 pages, pba, lba, page);
772 address = ((pba << info->blockshift) + page) <<
775 result = sddr09_read20(us, address>>1,
776 pages, info->pageshift, buffer, 0);
781 // Store the data in the transfer buffer
782 usb_stor_access_xfer_buf(buffer, len, us->srb,
783 &index, &offset, TO_XFER_BUF);
795 sddr09_find_unused_pba(struct sddr09_card_info *info, unsigned int lba) {
796 static unsigned int lastpba = 1;
797 int zonestart, end, i;
799 zonestart = (lba/1000) << 10;
800 end = info->capacity >> (info->blockshift + info->pageshift);
805 for (i = lastpba+1; i < end; i++) {
806 if (info->pba_to_lba[zonestart+i] == UNDEF) {
811 for (i = 0; i <= lastpba; i++) {
812 if (info->pba_to_lba[zonestart+i] == UNDEF) {
821 sddr09_write_lba(struct us_data *us, unsigned int lba,
822 unsigned int page, unsigned int pages,
823 unsigned char *ptr, unsigned char *blockbuffer) {
825 struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
826 unsigned long address;
827 unsigned int pba, lbap;
828 unsigned int pagelen;
829 unsigned char *bptr, *cptr, *xptr;
830 unsigned char ecc[3];
831 int i, result, isnew;
833 lbap = ((lba % 1000) << 1) | 0x1000;
834 if (parity[MSB_of(lbap) ^ LSB_of(lbap)])
836 pba = info->lba_to_pba[lba];
840 pba = sddr09_find_unused_pba(info, lba);
842 printk("sddr09_write_lba: Out of unused blocks\n");
845 info->pba_to_lba[pba] = lba;
846 info->lba_to_pba[lba] = pba;
851 /* Maybe it is impossible to write to PBA 1.
852 Fake success, but don't do anything. */
853 printk("sddr09: avoid writing to pba 1\n");
857 pagelen = (1 << info->pageshift) + (1 << CONTROL_SHIFT);
859 /* read old contents */
860 address = (pba << (info->pageshift + info->blockshift));
861 result = sddr09_read22(us, address>>1, info->blocksize,
862 info->pageshift, blockbuffer, 0);
866 /* check old contents and fill lba */
867 for (i = 0; i < info->blocksize; i++) {
868 bptr = blockbuffer + i*pagelen;
869 cptr = bptr + info->pagesize;
870 nand_compute_ecc(bptr, ecc);
871 if (!nand_compare_ecc(cptr+13, ecc)) {
872 US_DEBUGP("Warning: bad ecc in page %d- of pba %d\n",
874 nand_store_ecc(cptr+13, ecc);
876 nand_compute_ecc(bptr+(info->pagesize / 2), ecc);
877 if (!nand_compare_ecc(cptr+8, ecc)) {
878 US_DEBUGP("Warning: bad ecc in page %d+ of pba %d\n",
880 nand_store_ecc(cptr+8, ecc);
882 cptr[6] = cptr[11] = MSB_of(lbap);
883 cptr[7] = cptr[12] = LSB_of(lbap);
886 /* copy in new stuff and compute ECC */
888 for (i = page; i < page+pages; i++) {
889 bptr = blockbuffer + i*pagelen;
890 cptr = bptr + info->pagesize;
891 memcpy(bptr, xptr, info->pagesize);
892 xptr += info->pagesize;
893 nand_compute_ecc(bptr, ecc);
894 nand_store_ecc(cptr+13, ecc);
895 nand_compute_ecc(bptr+(info->pagesize / 2), ecc);
896 nand_store_ecc(cptr+8, ecc);
899 US_DEBUGP("Rewrite PBA %d (LBA %d)\n", pba, lba);
901 result = sddr09_write_inplace(us, address>>1, info->blocksize,
902 info->pageshift, blockbuffer, 0);
904 US_DEBUGP("sddr09_write_inplace returns %d\n", result);
908 unsigned char status = 0;
909 int result2 = sddr09_read_status(us, &status);
911 US_DEBUGP("sddr09_write_inplace: cannot read status\n");
912 else if (status != 0xc0)
913 US_DEBUGP("sddr09_write_inplace: status after write: 0x%x\n",
920 int result2 = sddr09_test_unit_ready(us);
928 sddr09_write_data(struct us_data *us,
929 unsigned long address,
930 unsigned int sectors) {
932 struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
933 unsigned int lba, maxlba, page, pages;
934 unsigned int pagelen, blocklen;
935 unsigned char *blockbuffer;
936 unsigned char *buffer;
937 unsigned int len, index, offset;
940 // Figure out the initial LBA and page
941 lba = address >> info->blockshift;
942 page = (address & info->blockmask);
943 maxlba = info->capacity >> (info->pageshift + info->blockshift);
947 // blockbuffer is used for reading in the old data, overwriting
948 // with the new data, and performing ECC calculations
950 /* TODO: instead of doing kmalloc/kfree for each write,
951 add a bufferpointer to the info structure */
953 pagelen = (1 << info->pageshift) + (1 << CONTROL_SHIFT);
954 blocklen = (pagelen << info->blockshift);
955 blockbuffer = kmalloc(blocklen, GFP_NOIO);
957 printk("sddr09_write_data: Out of memory\n");
961 // Since we don't write the user data directly to the device,
962 // we have to create a bounce buffer and move the data a piece
963 // at a time between the bounce buffer and the actual transfer buffer.
965 len = min(sectors, (unsigned int) info->blocksize) * info->pagesize;
966 buffer = kmalloc(len, GFP_NOIO);
967 if (buffer == NULL) {
968 printk("sddr09_write_data: Out of memory\n");
976 while (sectors > 0) {
978 // Write as many sectors as possible in this block
980 pages = min(sectors, info->blocksize - page);
981 len = (pages << info->pageshift);
983 /* Not overflowing capacity? */
985 US_DEBUGP("Error: Requested lba %u exceeds "
986 "maximum %u\n", lba, maxlba);
991 // Get the data from the transfer buffer
992 usb_stor_access_xfer_buf(buffer, len, us->srb,
993 &index, &offset, FROM_XFER_BUF);
995 result = sddr09_write_lba(us, lba, page, pages,
996 buffer, blockbuffer);
1012 sddr09_read_control(struct us_data *us,
1013 unsigned long address,
1014 unsigned int blocks,
1015 unsigned char *content,
1018 US_DEBUGP("Read control address %lu, blocks %d\n",
1021 return sddr09_read21(us, address, blocks,
1022 CONTROL_SHIFT, content, use_sg);
1026 * Read Device ID Command: 12 bytes.
1027 * byte 0: opcode: ED
1029 * Returns 2 bytes: Manufacturer ID and Device ID.
1030 * On more recent cards 3 bytes: the third byte is an option code A5
1031 * signifying that the secret command to read an 128-bit ID is available.
1032 * On still more recent cards 4 bytes: the fourth byte C0 means that
1033 * a second read ID cmd is available.
1036 sddr09_read_deviceID(struct us_data *us, unsigned char *deviceID) {
1037 unsigned char *command = us->iobuf;
1038 unsigned char *content = us->iobuf;
1041 memset(command, 0, 12);
1043 command[1] = LUNBITS;
1045 result = sddr09_send_scsi_command(us, command, 12);
1049 result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
1052 for (i = 0; i < 4; i++)
1053 deviceID[i] = content[i];
1055 return (result == USB_STOR_XFER_GOOD ? 0 : -EIO);
1059 sddr09_get_wp(struct us_data *us, struct sddr09_card_info *info) {
1061 unsigned char status;
1063 result = sddr09_read_status(us, &status);
1065 US_DEBUGP("sddr09_get_wp: read_status fails\n");
1068 US_DEBUGP("sddr09_get_wp: status 0x%02X", status);
1069 if ((status & 0x80) == 0) {
1070 info->flags |= SDDR09_WP; /* write protected */
1074 US_DEBUGP(" Ready");
1075 if (status & LUNBITS)
1076 US_DEBUGP(" Suspended");
1078 US_DEBUGP(" Error");
1085 * Reset Command: 12 bytes.
1086 * byte 0: opcode: EB
1089 sddr09_reset(struct us_data *us) {
1091 unsigned char *command = us->iobuf;
1093 memset(command, 0, 12);
1095 command[1] = LUNBITS;
1097 return sddr09_send_scsi_command(us, command, 12);
1101 static struct nand_flash_dev *
1102 sddr09_get_cardinfo(struct us_data *us, unsigned char flags) {
1103 struct nand_flash_dev *cardinfo;
1104 unsigned char deviceID[4];
1108 US_DEBUGP("Reading capacity...\n");
1110 result = sddr09_read_deviceID(us, deviceID);
1113 US_DEBUGP("Result of read_deviceID is %d\n", result);
1114 printk("sddr09: could not read card info\n");
1118 sprintf(blurbtxt, "sddr09: Found Flash card, ID = %02X %02X %02X %02X",
1119 deviceID[0], deviceID[1], deviceID[2], deviceID[3]);
1121 /* Byte 0 is the manufacturer */
1122 sprintf(blurbtxt + strlen(blurbtxt),
1124 nand_flash_manufacturer(deviceID[0]));
1126 /* Byte 1 is the device type */
1127 cardinfo = nand_find_id(deviceID[1]);
1129 /* MB or MiB? It is neither. A 16 MB card has
1130 17301504 raw bytes, of which 16384000 are
1131 usable for user data. */
1132 sprintf(blurbtxt + strlen(blurbtxt),
1133 ", %d MB", 1<<(cardinfo->chipshift - 20));
1135 sprintf(blurbtxt + strlen(blurbtxt),
1136 ", type unrecognized");
1139 /* Byte 2 is code to signal availability of 128-bit ID */
1140 if (deviceID[2] == 0xa5) {
1141 sprintf(blurbtxt + strlen(blurbtxt),
1145 /* Byte 3 announces the availability of another read ID command */
1146 if (deviceID[3] == 0xc0) {
1147 sprintf(blurbtxt + strlen(blurbtxt),
1151 if (flags & SDDR09_WP)
1152 sprintf(blurbtxt + strlen(blurbtxt),
1155 printk("%s\n", blurbtxt);
1161 sddr09_read_map(struct us_data *us) {
1163 struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
1164 int numblocks, alloc_len, alloc_blocks;
1166 unsigned char *buffer, *buffer_end, *ptr;
1167 unsigned int lba, lbact;
1169 if (!info->capacity)
1172 // size of a block is 1 << (blockshift + pageshift) bytes
1173 // divide into the total capacity to get the number of blocks
1175 numblocks = info->capacity >> (info->blockshift + info->pageshift);
1177 // read 64 bytes for every block (actually 1 << CONTROL_SHIFT)
1178 // but only use a 64 KB buffer
1179 // buffer size used must be a multiple of (1 << CONTROL_SHIFT)
1180 #define SDDR09_READ_MAP_BUFSZ 65536
1182 alloc_blocks = min(numblocks, SDDR09_READ_MAP_BUFSZ >> CONTROL_SHIFT);
1183 alloc_len = (alloc_blocks << CONTROL_SHIFT);
1184 buffer = kmalloc(alloc_len, GFP_NOIO);
1185 if (buffer == NULL) {
1186 printk("sddr09_read_map: out of memory\n");
1190 buffer_end = buffer + alloc_len;
1192 #undef SDDR09_READ_MAP_BUFSZ
1194 kfree(info->lba_to_pba);
1195 kfree(info->pba_to_lba);
1196 info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
1197 info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
1199 if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
1200 printk("sddr09_read_map: out of memory\n");
1205 for (i = 0; i < numblocks; i++)
1206 info->lba_to_pba[i] = info->pba_to_lba[i] = UNDEF;
1209 * Define lba-pba translation table
1213 for (i = 0; i < numblocks; i++) {
1214 ptr += (1 << CONTROL_SHIFT);
1215 if (ptr >= buffer_end) {
1216 unsigned long address;
1218 address = i << (info->pageshift + info->blockshift);
1219 result = sddr09_read_control(
1221 min(alloc_blocks, numblocks - i),
1230 if (i == 0 || i == 1) {
1231 info->pba_to_lba[i] = UNUSABLE;
1235 /* special PBAs have control field 0^16 */
1236 for (j = 0; j < 16; j++)
1239 info->pba_to_lba[i] = UNUSABLE;
1240 printk("sddr09: PBA %d has no logical mapping\n", i);
1244 /* unwritten PBAs have control field FF^16 */
1245 for (j = 0; j < 16; j++)
1251 /* normal PBAs start with six FFs */
1253 printk("sddr09: PBA %d has no logical mapping: "
1254 "reserved area = %02X%02X%02X%02X "
1255 "data status %02X block status %02X\n",
1256 i, ptr[0], ptr[1], ptr[2], ptr[3],
1258 info->pba_to_lba[i] = UNUSABLE;
1262 if ((ptr[6] >> 4) != 0x01) {
1263 printk("sddr09: PBA %d has invalid address field "
1264 "%02X%02X/%02X%02X\n",
1265 i, ptr[6], ptr[7], ptr[11], ptr[12]);
1266 info->pba_to_lba[i] = UNUSABLE;
1270 /* check even parity */
1271 if (parity[ptr[6] ^ ptr[7]]) {
1272 printk("sddr09: Bad parity in LBA for block %d"
1273 " (%02X %02X)\n", i, ptr[6], ptr[7]);
1274 info->pba_to_lba[i] = UNUSABLE;
1278 lba = short_pack(ptr[7], ptr[6]);
1279 lba = (lba & 0x07FF) >> 1;
1282 * Every 1024 physical blocks ("zone"), the LBA numbers
1283 * go back to zero, but are within a higher block of LBA's.
1284 * Also, there is a maximum of 1000 LBA's per zone.
1285 * In other words, in PBA 1024-2047 you will find LBA 0-999
1286 * which are really LBA 1000-1999. This allows for 24 bad
1287 * or special physical blocks per zone.
1291 printk("sddr09: Bad low LBA %d for block %d\n",
1293 goto possibly_erase;
1296 lba += 1000*(i/0x400);
1298 if (info->lba_to_pba[lba] != UNDEF) {
1299 printk("sddr09: LBA %d seen for PBA %d and %d\n",
1300 lba, info->lba_to_pba[lba], i);
1301 goto possibly_erase;
1304 info->pba_to_lba[i] = lba;
1305 info->lba_to_pba[lba] = i;
1309 if (erase_bad_lba_entries) {
1310 unsigned long address;
1312 address = (i << (info->pageshift + info->blockshift));
1313 sddr09_erase(us, address>>1);
1314 info->pba_to_lba[i] = UNDEF;
1316 info->pba_to_lba[i] = UNUSABLE;
1320 * Approximate capacity. This is not entirely correct yet,
1321 * since a zone with less than 1000 usable pages leads to
1322 * missing LBAs. Especially if it is the last zone, some
1323 * LBAs can be past capacity.
1326 for (i = 0; i < numblocks; i += 1024) {
1329 for (j = 0; j < 1024 && i+j < numblocks; j++) {
1330 if (info->pba_to_lba[i+j] != UNUSABLE) {
1332 info->pba_to_lba[i+j] = SPARE;
1339 info->lbact = lbact;
1340 US_DEBUGP("Found %d LBA's\n", lbact);
1345 kfree(info->lba_to_pba);
1346 kfree(info->pba_to_lba);
1347 info->lba_to_pba = NULL;
1348 info->pba_to_lba = NULL;
1355 sddr09_card_info_destructor(void *extra) {
1356 struct sddr09_card_info *info = (struct sddr09_card_info *)extra;
1361 kfree(info->lba_to_pba);
1362 kfree(info->pba_to_lba);
1366 sddr09_common_init(struct us_data *us) {
1369 /* set the configuration -- STALL is an acceptable response here */
1370 if (us->pusb_dev->actconfig->desc.bConfigurationValue != 1) {
1371 US_DEBUGP("active config #%d != 1 ??\n", us->pusb_dev
1372 ->actconfig->desc.bConfigurationValue);
1376 result = usb_reset_configuration(us->pusb_dev);
1377 US_DEBUGP("Result of usb_reset_configuration is %d\n", result);
1378 if (result == -EPIPE) {
1379 US_DEBUGP("-- stall on control interface\n");
1380 } else if (result != 0) {
1381 /* it's not a stall, but another error -- time to bail */
1382 US_DEBUGP("-- Unknown error. Rejecting device\n");
1386 us->extra = kzalloc(sizeof(struct sddr09_card_info), GFP_NOIO);
1389 us->extra_destructor = sddr09_card_info_destructor;
1397 * This is needed at a very early stage. If this is not listed in the
1398 * unusual devices list but called from here then LUN 0 of the combo reader
1399 * is not recognized. But I do not know what precisely these calls do.
1402 usb_stor_sddr09_dpcm_init(struct us_data *us) {
1404 unsigned char *data = us->iobuf;
1406 result = sddr09_common_init(us);
1410 result = sddr09_send_command(us, 0x01, USB_DIR_IN, data, 2);
1412 US_DEBUGP("sddr09_init: send_command fails\n");
1416 US_DEBUGP("SDDR09init: %02X %02X\n", data[0], data[1]);
1419 result = sddr09_send_command(us, 0x08, USB_DIR_IN, data, 2);
1421 US_DEBUGP("sddr09_init: 2nd send_command fails\n");
1425 US_DEBUGP("SDDR09init: %02X %02X\n", data[0], data[1]);
1428 result = sddr09_request_sense(us, data, 18);
1429 if (result == 0 && data[2] != 0) {
1431 for (j=0; j<18; j++)
1432 printk(" %02X", data[j]);
1434 // get 70 00 00 00 00 00 00 * 00 00 00 00 00 00
1435 // 70: current command
1436 // sense key 0, sense code 0, extd sense code 0
1437 // additional transfer length * = sizeof(data) - 7
1438 // Or: 70 00 06 00 00 00 00 0b 00 00 00 00 28 00 00 00 00 00
1439 // sense key 06, sense code 28: unit attention,
1440 // not ready to ready transition
1445 return 0; /* not result */
1449 * Transport for the Sandisk SDDR-09
1451 int sddr09_transport(struct scsi_cmnd *srb, struct us_data *us)
1453 static unsigned char sensekey = 0, sensecode = 0;
1454 static unsigned char havefakesense = 0;
1456 unsigned char *ptr = us->iobuf;
1457 unsigned long capacity;
1458 unsigned int page, pages;
1460 struct sddr09_card_info *info;
1462 static unsigned char inquiry_response[8] = {
1463 0x00, 0x80, 0x00, 0x02, 0x1F, 0x00, 0x00, 0x00
1466 /* note: no block descriptor support */
1467 static unsigned char mode_page_01[19] = {
1468 0x00, 0x0F, 0x00, 0x0, 0x0, 0x0, 0x00,
1470 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1473 info = (struct sddr09_card_info *)us->extra;
1475 if (srb->cmnd[0] == REQUEST_SENSE && havefakesense) {
1476 /* for a faked command, we have to follow with a faked sense */
1481 ptr[12] = sensecode;
1482 usb_stor_set_xfer_buf(ptr, 18, srb);
1483 sensekey = sensecode = havefakesense = 0;
1484 return USB_STOR_TRANSPORT_GOOD;
1489 /* Dummy up a response for INQUIRY since SDDR09 doesn't
1490 respond to INQUIRY commands */
1492 if (srb->cmnd[0] == INQUIRY) {
1493 memcpy(ptr, inquiry_response, 8);
1494 fill_inquiry_response(us, ptr, 36);
1495 return USB_STOR_TRANSPORT_GOOD;
1498 if (srb->cmnd[0] == READ_CAPACITY) {
1499 struct nand_flash_dev *cardinfo;
1501 sddr09_get_wp(us, info); /* read WP bit */
1503 cardinfo = sddr09_get_cardinfo(us, info->flags);
1505 /* probably no media */
1507 sensekey = 0x02; /* not ready */
1508 sensecode = 0x3a; /* medium not present */
1509 return USB_STOR_TRANSPORT_FAILED;
1512 info->capacity = (1 << cardinfo->chipshift);
1513 info->pageshift = cardinfo->pageshift;
1514 info->pagesize = (1 << info->pageshift);
1515 info->blockshift = cardinfo->blockshift;
1516 info->blocksize = (1 << info->blockshift);
1517 info->blockmask = info->blocksize - 1;
1519 // map initialization, must follow get_cardinfo()
1520 if (sddr09_read_map(us)) {
1521 /* probably out of memory */
1527 capacity = (info->lbact << info->blockshift) - 1;
1529 ((__be32 *) ptr)[0] = cpu_to_be32(capacity);
1533 ((__be32 *) ptr)[1] = cpu_to_be32(info->pagesize);
1534 usb_stor_set_xfer_buf(ptr, 8, srb);
1536 return USB_STOR_TRANSPORT_GOOD;
1539 if (srb->cmnd[0] == MODE_SENSE_10) {
1540 int modepage = (srb->cmnd[2] & 0x3F);
1542 /* They ask for the Read/Write error recovery page,
1543 or for all pages. */
1544 /* %% We should check DBD %% */
1545 if (modepage == 0x01 || modepage == 0x3F) {
1546 US_DEBUGP("SDDR09: Dummy up request for "
1547 "mode page 0x%x\n", modepage);
1549 memcpy(ptr, mode_page_01, sizeof(mode_page_01));
1550 ((__be16*)ptr)[0] = cpu_to_be16(sizeof(mode_page_01) - 2);
1551 ptr[3] = (info->flags & SDDR09_WP) ? 0x80 : 0;
1552 usb_stor_set_xfer_buf(ptr, sizeof(mode_page_01), srb);
1553 return USB_STOR_TRANSPORT_GOOD;
1556 sensekey = 0x05; /* illegal request */
1557 sensecode = 0x24; /* invalid field in CDB */
1558 return USB_STOR_TRANSPORT_FAILED;
1561 if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL)
1562 return USB_STOR_TRANSPORT_GOOD;
1566 if (srb->cmnd[0] == READ_10) {
1568 page = short_pack(srb->cmnd[3], srb->cmnd[2]);
1570 page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
1571 pages = short_pack(srb->cmnd[8], srb->cmnd[7]);
1573 US_DEBUGP("READ_10: read page %d pagect %d\n",
1576 result = sddr09_read_data(us, page, pages);
1577 return (result == 0 ? USB_STOR_TRANSPORT_GOOD :
1578 USB_STOR_TRANSPORT_ERROR);
1581 if (srb->cmnd[0] == WRITE_10) {
1583 page = short_pack(srb->cmnd[3], srb->cmnd[2]);
1585 page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
1586 pages = short_pack(srb->cmnd[8], srb->cmnd[7]);
1588 US_DEBUGP("WRITE_10: write page %d pagect %d\n",
1591 result = sddr09_write_data(us, page, pages);
1592 return (result == 0 ? USB_STOR_TRANSPORT_GOOD :
1593 USB_STOR_TRANSPORT_ERROR);
1596 /* catch-all for all other commands, except
1597 * pass TEST_UNIT_READY and REQUEST_SENSE through
1599 if (srb->cmnd[0] != TEST_UNIT_READY &&
1600 srb->cmnd[0] != REQUEST_SENSE) {
1601 sensekey = 0x05; /* illegal request */
1602 sensecode = 0x20; /* invalid command */
1604 return USB_STOR_TRANSPORT_FAILED;
1607 for (; srb->cmd_len<12; srb->cmd_len++)
1608 srb->cmnd[srb->cmd_len] = 0;
1610 srb->cmnd[1] = LUNBITS;
1613 for (i=0; i<12; i++)
1614 sprintf(ptr+strlen(ptr), "%02X ", srb->cmnd[i]);
1616 US_DEBUGP("SDDR09: Send control for command %s\n", ptr);
1618 result = sddr09_send_scsi_command(us, srb->cmnd, 12);
1620 US_DEBUGP("sddr09_transport: sddr09_send_scsi_command "
1621 "returns %d\n", result);
1622 return USB_STOR_TRANSPORT_ERROR;
1625 if (srb->request_bufflen == 0)
1626 return USB_STOR_TRANSPORT_GOOD;
1628 if (srb->sc_data_direction == DMA_TO_DEVICE ||
1629 srb->sc_data_direction == DMA_FROM_DEVICE) {
1630 unsigned int pipe = (srb->sc_data_direction == DMA_TO_DEVICE)
1631 ? us->send_bulk_pipe : us->recv_bulk_pipe;
1633 US_DEBUGP("SDDR09: %s %d bytes\n",
1634 (srb->sc_data_direction == DMA_TO_DEVICE) ?
1635 "sending" : "receiving",
1636 srb->request_bufflen);
1638 result = usb_stor_bulk_transfer_sg(us, pipe,
1639 srb->request_buffer,
1640 srb->request_bufflen,
1641 srb->use_sg, &srb->resid);
1643 return (result == USB_STOR_XFER_GOOD ?
1644 USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
1647 return USB_STOR_TRANSPORT_GOOD;
1651 * Initialization routine for the sddr09 subdriver
1654 usb_stor_sddr09_init(struct us_data *us) {
1655 return sddr09_common_init(us);