sddr09.c 40.4 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2
/* Driver for SanDisk SDDR-09 SmartMedia reader
 *
Greg Kroah-Hartman's avatar
Greg Kroah-Hartman committed
3
 * $Id: sddr09.c,v 1.24 2002/04/22 03:39:43 mdharm Exp $
Linus Torvalds's avatar
Linus Torvalds committed
4
 *   (c) 2000, 2001 Robert Baruch (autophile@starband.net)
5
 *   (c) 2002 Andries Brouwer (aeb@cwi.nl)
Greg Kroah-Hartman's avatar
Greg Kroah-Hartman committed
6 7
 * Developed with the assistance of:
 *   (c) 2002 Alan Stern <stern@rowland.org>
Linus Torvalds's avatar
Linus Torvalds committed
8 9 10
 *
 * The SanDisk SDDR-09 SmartMedia reader uses the Shuttle EUSB-01 chip.
 * This chip is a programmable USB controller. In the SDDR-09, it has
11 12
 * been programmed to obey a certain limited set of SCSI commands.
 * This driver translates the "real" SCSI commands to the SDDR-09 SCSI
Linus Torvalds's avatar
Linus Torvalds committed
13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
 * commands.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2, or (at your option) any
 * later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 675 Mass Ave, Cambridge, MA 02139, USA.
 */

#include "transport.h"
#include "protocol.h"
#include "usb.h"
#include "debug.h"
#include "sddr09.h"

36
#include <linux/version.h>
Linus Torvalds's avatar
Linus Torvalds committed
37 38
#include <linux/sched.h>
#include <linux/errno.h>
Linus Torvalds's avatar
Linus Torvalds committed
39
#include <linux/slab.h>
Linus Torvalds's avatar
Linus Torvalds committed
40 41 42 43 44

#define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) )
#define LSB_of(s) ((s)&0xFF)
#define MSB_of(s) ((s)>>8)

45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
/* #define US_DEBUGP printk */

/*
 * First some stuff that does not belong here:
 * data on SmartMedia and other cards, completely
 * unrelated to this driver.
 * Similar stuff occurs in <linux/mtd/nand_ids.h>.
 */

struct nand_flash_dev {
	int model_id;
	int chipshift;		/* 1<<cs bytes total capacity */
	char pageshift;		/* 1<<ps bytes in a page */
	char blockshift;	/* 1<<bs pages in an erase block */
	char zoneshift;		/* 1<<zs blocks in a zone */
				/* # of logical blocks is 125/128 of this */
	char pageadrlen;	/* length of an address in bytes - 1 */
};

/*
 * NAND Flash Manufacturer ID Codes
 */
#define NAND_MFR_AMD		0x01
68
#define NAND_MFR_NATSEMI	0x8f
69 70 71 72 73 74 75
#define NAND_MFR_TOSHIBA	0x98
#define NAND_MFR_SAMSUNG	0xec

static inline char *nand_flash_manufacturer(int manuf_id) {
	switch(manuf_id) {
	case NAND_MFR_AMD:
		return "AMD";
76 77
	case NAND_MFR_NATSEMI:
		return "NATSEMI";
78 79 80 81 82 83 84 85 86 87 88 89
	case NAND_MFR_TOSHIBA:
		return "Toshiba";
	case NAND_MFR_SAMSUNG:
		return "Samsung";
	default:
		return "unknown";
	}
}

/*
 * It looks like it is unnecessary to attach manufacturer to the
 * remaining data: SSFDC prescribes manufacturer-independent id codes.
90 91
 *
 * 256 MB NAND flash has a 5-byte ID with 2nd byte 0xaa, 0xba, 0xca or 0xda.
92 93 94
 */

static struct nand_flash_dev nand_flash_ids[] = {
95
	/* NAND flash */
96 97 98 99 100 101 102 103 104 105 106 107 108 109
	{ 0x6e, 20, 8, 4, 8, 2},	/* 1 MB */
	{ 0xe8, 20, 8, 4, 8, 2},	/* 1 MB */
	{ 0xec, 20, 8, 4, 8, 2},	/* 1 MB */
	{ 0x64, 21, 8, 4, 9, 2}, 	/* 2 MB */
	{ 0xea, 21, 8, 4, 9, 2},	/* 2 MB */
	{ 0x6b, 22, 9, 4, 9, 2},	/* 4 MB */
	{ 0xe3, 22, 9, 4, 9, 2},	/* 4 MB */
	{ 0xe5, 22, 9, 4, 9, 2},	/* 4 MB */
	{ 0xe6, 23, 9, 4, 10, 2},	/* 8 MB */
	{ 0x73, 24, 9, 5, 10, 2},	/* 16 MB */
	{ 0x75, 25, 9, 5, 10, 2},	/* 32 MB */
	{ 0x76, 26, 9, 5, 10, 3},	/* 64 MB */
	{ 0x79, 27, 9, 5, 10, 3},	/* 128 MB */

110
	/* MASK ROM */
111 112 113
	{ 0x5d, 21, 9, 4, 8, 2},	/* 2 MB */
	{ 0xd5, 22, 9, 4, 9, 2},	/* 4 MB */
	{ 0xd6, 23, 9, 4, 10, 2},	/* 8 MB */
114 115
	{ 0x57, 24, 9, 4, 11, 2},	/* 16 MB */
	{ 0x58, 25, 9, 4, 12, 2},	/* 32 MB */
116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232
	{ 0,}
};

#define SIZE(a)	(sizeof(a)/sizeof((a)[0]))

static struct nand_flash_dev *
nand_find_id(unsigned char id) {
	int i;

	for (i = 0; i < SIZE(nand_flash_ids); i++)
		if (nand_flash_ids[i].model_id == id)
			return &(nand_flash_ids[i]);
	return NULL;
}

/*
 * ECC computation.
 */
static unsigned char parity[256];
static unsigned char ecc2[256];

static void nand_init_ecc(void) {
	int i, j, a;

	parity[0] = 0;
	for (i = 1; i < 256; i++)
		parity[i] = (parity[i&(i-1)] ^ 1);

	for (i = 0; i < 256; i++) {
		a = 0;
		for (j = 0; j < 8; j++) {
			if (i & (1<<j)) {
				if ((j & 1) == 0)
					a ^= 0x04;
				if ((j & 2) == 0)
					a ^= 0x10;
				if ((j & 4) == 0)
					a ^= 0x40;
			}
		}
		ecc2[i] = ~(a ^ (a<<1) ^ (parity[i] ? 0xa8 : 0));
	}
}

/* compute 3-byte ecc on 256 bytes */
static void nand_compute_ecc(unsigned char *data, unsigned char *ecc) {
	int i, j, a;
	unsigned char par, bit, bits[8];

	par = 0;
	for (j = 0; j < 8; j++)
		bits[j] = 0;

	/* collect 16 checksum bits */
	for (i = 0; i < 256; i++) {
		par ^= data[i];
		bit = parity[data[i]];
		for (j = 0; j < 8; j++)
			if ((i & (1<<j)) == 0)
				bits[j] ^= bit;
	}

	/* put 4+4+4 = 12 bits in the ecc */
	a = (bits[3] << 6) + (bits[2] << 4) + (bits[1] << 2) + bits[0];
	ecc[0] = ~(a ^ (a<<1) ^ (parity[par] ? 0xaa : 0));

	a = (bits[7] << 6) + (bits[6] << 4) + (bits[5] << 2) + bits[4];
	ecc[1] = ~(a ^ (a<<1) ^ (parity[par] ? 0xaa : 0));

	ecc[2] = ecc2[par];
}

static int nand_compare_ecc(unsigned char *data, unsigned char *ecc) {
	return (data[0] == ecc[0] && data[1] == ecc[1] && data[2] == ecc[2]);
}

static void nand_store_ecc(unsigned char *data, unsigned char *ecc) {
	memcpy(data, ecc, 3);
}

/*
 * The actual driver starts here.
 */

/*
 * On my 16MB card, control blocks have size 64 (16 real control bytes,
 * and 48 junk bytes). In reality of course the card uses 16 control bytes,
 * so the reader makes up the remaining 48. Don't know whether these numbers
 * depend on the card. For now a constant.
 */
#define CONTROL_SHIFT 6

/*
 * On my Combo CF/SM reader, the SM reader has LUN 1.
 * (and things fail with LUN 0).
 * It seems LUN is irrelevant for others.
 */
#define LUN	1
#define	LUNBITS	(LUN << 5)

/*
 * LBA and PBA are unsigned ints. Special values.
 */
#define UNDEF    0xffffffff
#define SPARE    0xfffffffe
#define UNUSABLE 0xfffffffd

static int erase_bad_lba_entries = 0;

/* send vendor interface command (0x41) */
/* called for requests 0, 1, 8 */
static int
sddr09_send_command(struct us_data *us,
		    unsigned char request,
		    unsigned char direction,
		    unsigned char *xfer_data,
		    unsigned int xfer_len) {
233
	unsigned int pipe;
234
	unsigned char requesttype = (0x41 | direction);
235
	int rc;
236 237 238 239

	// Get the receive or send control pipe number

	if (direction == USB_DIR_IN)
240
		pipe = us->recv_ctrl_pipe;
241
	else
242
		pipe = us->send_ctrl_pipe;
243

244
	rc = usb_stor_ctrl_transfer(us, pipe, request, requesttype,
245
				   0, 0, xfer_data, xfer_len);
246 247
	return (rc == USB_STOR_XFER_GOOD ? USB_STOR_TRANSPORT_GOOD :
			USB_STOR_TRANSPORT_ERROR);
248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263
}

static int
sddr09_send_scsi_command(struct us_data *us,
			 unsigned char *command,
			 unsigned int command_len) {
	return sddr09_send_command(us, 0, USB_DIR_OUT, command, command_len);
}

#if 0
/*
 * Test Unit Ready Command: 12 bytes.
 * byte 0: opcode: 00
 */
static int
sddr09_test_unit_ready(struct us_data *us) {
264
	unsigned char *command = us->iobuf;
265 266
	int result;

267 268 269 270
	memset(command, 0, 6);
	command[1] = LUNBITS;

	result = sddr09_send_scsi_command(us, command, 6);
271 272 273 274 275 276 277 278 279 280 281 282 283 284

	US_DEBUGP("sddr09_test_unit_ready returns %d\n", result);

	return result;
}
#endif

/*
 * Request Sense Command: 12 bytes.
 * byte 0: opcode: 03
 * byte 4: data length
 */
static int
sddr09_request_sense(struct us_data *us, unsigned char *sensebuf, int buflen) {
285
	unsigned char *command = us->iobuf;
286 287
	int result;

288 289 290 291 292 293
	memset(command, 0, 12);
	command[0] = 0x03;
	command[1] = LUNBITS;
	command[4] = buflen;

	result = sddr09_send_scsi_command(us, command, 12);
294 295 296 297 298
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("request sense failed\n");
		return result;
	}

299 300
	result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
			sensebuf, buflen, NULL);
301
	if (result != USB_STOR_XFER_GOOD) {
302
		US_DEBUGP("request sense bulk in failed\n");
303
		return USB_STOR_TRANSPORT_ERROR;
304
	} else {
305
		US_DEBUGP("request sense worked\n");
306 307
		return USB_STOR_TRANSPORT_GOOD;
	}
308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335
}

/*
 * Read Command: 12 bytes.
 * byte 0: opcode: E8
 * byte 1: last two bits: 00: read data, 01: read blockwise control,
 *			10: read both, 11: read pagewise control.
 *	 It turns out we need values 20, 21, 22, 23 here (LUN 1).
 * bytes 2-5: address (interpretation depends on byte 1, see below)
 * bytes 10-11: count (idem)
 *
 * A page has 512 data bytes and 64 control bytes (16 control and 48 junk).
 * A read data command gets data in 512-byte pages.
 * A read control command gets control in 64-byte chunks.
 * A read both command gets data+control in 576-byte chunks.
 *
 * Blocks are groups of 32 pages, and read blockwise control jumps to the
 * next block, while read pagewise control jumps to the next page after
 * reading a group of 64 control bytes.
 * [Here 512 = 1<<pageshift, 32 = 1<<blockshift, 64 is constant?]
 *
 * (1 MB and 2 MB cards are a bit different, but I have only a 16 MB card.)
 */

static int
sddr09_readX(struct us_data *us, int x, unsigned long fromaddress,
	     int nr_of_pages, int bulklen, unsigned char *buf,
	     int use_sg) {
Linus Torvalds's avatar
Linus Torvalds committed
336

337
	unsigned char *command = us->iobuf;
Linus Torvalds's avatar
Linus Torvalds committed
338
	int result;
339

340 341
	command[0] = 0xE8;
	command[1] = LUNBITS | x;
342 343 344 345
	command[2] = MSB_of(fromaddress>>16);
	command[3] = LSB_of(fromaddress>>16); 
	command[4] = MSB_of(fromaddress & 0xFFFF);
	command[5] = LSB_of(fromaddress & 0xFFFF); 
346 347 348 349
	command[6] = 0;
	command[7] = 0;
	command[8] = 0;
	command[9] = 0;
350 351 352
	command[10] = MSB_of(nr_of_pages);
	command[11] = LSB_of(nr_of_pages);

353
	result = sddr09_send_scsi_command(us, command, 12);
354 355 356 357 358 359 360

	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("Result for send_control in sddr09_read2%d %d\n",
			  x, result);
		return result;
	}

361 362
	result = usb_stor_bulk_transfer_sg(us, us->recv_bulk_pipe,
				       buf, bulklen, use_sg, NULL);
363

364
	if (result != USB_STOR_XFER_GOOD) {
365
		US_DEBUGP("Result for bulk_transfer in sddr09_read2%d %d\n",
366
			  x, result);
367 368 369
		return USB_STOR_TRANSPORT_ERROR;
	}
	return USB_STOR_TRANSPORT_GOOD;
370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466
}

/*
 * Read Data
 *
 * fromaddress counts data shorts:
 * increasing it by 256 shifts the bytestream by 512 bytes;
 * the last 8 bits are ignored.
 *
 * nr_of_pages counts pages of size (1 << pageshift).
 */
static int
sddr09_read20(struct us_data *us, unsigned long fromaddress,
	      int nr_of_pages, int pageshift, unsigned char *buf, int use_sg) {
	int bulklen = nr_of_pages << pageshift;

	/* The last 8 bits of fromaddress are ignored. */
	return sddr09_readX(us, 0, fromaddress, nr_of_pages, bulklen,
			    buf, use_sg);
}

/*
 * Read Blockwise Control
 *
 * fromaddress gives the starting position (as in read data;
 * the last 8 bits are ignored); increasing it by 32*256 shifts
 * the output stream by 64 bytes.
 *
 * count counts control groups of size (1 << controlshift).
 * For me, controlshift = 6. Is this constant?
 *
 * After getting one control group, jump to the next block
 * (fromaddress += 8192).
 */
static int
sddr09_read21(struct us_data *us, unsigned long fromaddress,
	      int count, int controlshift, unsigned char *buf, int use_sg) {

	int bulklen = (count << controlshift);
	return sddr09_readX(us, 1, fromaddress, count, bulklen,
			    buf, use_sg);
}

/*
 * Read both Data and Control
 *
 * fromaddress counts data shorts, ignoring control:
 * increasing it by 256 shifts the bytestream by 576 = 512+64 bytes;
 * the last 8 bits are ignored.
 *
 * nr_of_pages counts pages of size (1 << pageshift) + (1 << controlshift).
 */
static int
sddr09_read22(struct us_data *us, unsigned long fromaddress,
	      int nr_of_pages, int pageshift, unsigned char *buf, int use_sg) {

	int bulklen = (nr_of_pages << pageshift) + (nr_of_pages << CONTROL_SHIFT);
	US_DEBUGP("sddr09_read22: reading %d pages, %d bytes\n",
		  nr_of_pages, bulklen);
	return sddr09_readX(us, 2, fromaddress, nr_of_pages, bulklen,
			    buf, use_sg);
}

#if 0
/*
 * Read Pagewise Control
 *
 * fromaddress gives the starting position (as in read data;
 * the last 8 bits are ignored); increasing it by 256 shifts
 * the output stream by 64 bytes.
 *
 * count counts control groups of size (1 << controlshift).
 * For me, controlshift = 6. Is this constant?
 *
 * After getting one control group, jump to the next page
 * (fromaddress += 256).
 */
static int
sddr09_read23(struct us_data *us, unsigned long fromaddress,
	      int count, int controlshift, unsigned char *buf, int use_sg) {

	int bulklen = (count << controlshift);
	return sddr09_readX(us, 3, fromaddress, count, bulklen,
			    buf, use_sg);
}
#endif

/*
 * Erase Command: 12 bytes.
 * byte 0: opcode: EA
 * bytes 6-9: erase address (big-endian, counting shorts, sector aligned).
 * 
 * Always precisely one block is erased; bytes 2-5 and 10-11 are ignored.
 * The byte address being erased is 2*Eaddress.
 */
static int
sddr09_erase(struct us_data *us, unsigned long Eaddress) {
467
	unsigned char *command = us->iobuf;
468 469
	int result;

470 471
	US_DEBUGP("sddr09_erase: erase address %lu\n", Eaddress);

472 473 474
	memset(command, 0, 12);
	command[0] = 0xEA;
	command[1] = LUNBITS;
475 476 477 478 479
	command[6] = MSB_of(Eaddress>>16);
	command[7] = LSB_of(Eaddress>>16);
	command[8] = MSB_of(Eaddress & 0xFFFF);
	command[9] = LSB_of(Eaddress & 0xFFFF);

480
	result = sddr09_send_scsi_command(us, command, 12);
481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504

	if (result != USB_STOR_TRANSPORT_GOOD)
		US_DEBUGP("Result for send_control in sddr09_erase %d\n",
			  result);

	return result;
}

/*
 * Write Command: 12 bytes.
 * byte 0: opcode: E9
 * bytes 2-5: write address (big-endian, counting shorts, sector aligned).
 * bytes 6-9: erase address (big-endian, counting shorts, sector aligned).
 * bytes 10-11: sector count (big-endian, in 512-byte sectors).
 *
 * If write address equals erase address, the erase is done first,
 * otherwise the write is done first. When erase address equals zero
 * no erase is done?
 */
static int
sddr09_writeX(struct us_data *us,
	      unsigned long Waddress, unsigned long Eaddress,
	      int nr_of_pages, int bulklen, unsigned char *buf, int use_sg) {

505
	unsigned char *command = us->iobuf;
506 507
	int result;

508 509 510
	command[0] = 0xE9;
	command[1] = LUNBITS;

511 512 513 514 515 516 517 518 519 520 521 522 523
	command[2] = MSB_of(Waddress>>16);
	command[3] = LSB_of(Waddress>>16);
	command[4] = MSB_of(Waddress & 0xFFFF);
	command[5] = LSB_of(Waddress & 0xFFFF);

	command[6] = MSB_of(Eaddress>>16);
	command[7] = LSB_of(Eaddress>>16);
	command[8] = MSB_of(Eaddress & 0xFFFF);
	command[9] = LSB_of(Eaddress & 0xFFFF);

	command[10] = MSB_of(nr_of_pages);
	command[11] = LSB_of(nr_of_pages);

524
	result = sddr09_send_scsi_command(us, command, 12);
525 526 527 528 529 530 531

	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("Result for send_control in sddr09_writeX %d\n",
			  result);
		return result;
	}

532 533
	result = usb_stor_bulk_transfer_sg(us, us->send_bulk_pipe,
				       buf, bulklen, use_sg, NULL);
534

535
	if (result != USB_STOR_XFER_GOOD) {
536
		US_DEBUGP("Result for bulk_transfer in sddr09_writeX %d\n",
537
			  result);
538 539 540
		return USB_STOR_TRANSPORT_ERROR;
	}
	return USB_STOR_TRANSPORT_GOOD;
541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566
}

/* erase address, write same address */
static int
sddr09_write_inplace(struct us_data *us, unsigned long address,
		     int nr_of_pages, int pageshift, unsigned char *buf,
		     int use_sg) {
	int bulklen = (nr_of_pages << pageshift) + (nr_of_pages << CONTROL_SHIFT);
	return sddr09_writeX(us, address, address, nr_of_pages, bulklen,
			     buf, use_sg);
}

#if 0
/*
 * Read Scatter Gather Command: 3+4n bytes.
 * byte 0: opcode E7
 * byte 2: n
 * bytes 4i-1,4i,4i+1: page address
 * byte 4i+2: page count
 * (i=1..n)
 *
 * This reads several pages from the card to a single memory buffer.
 * The last two bits of byte 1 have the same meaning as for E8.
 */
static int
sddr09_read_sg_test_only(struct us_data *us) {
567
	unsigned char *command = us->iobuf;
568 569 570 571 572
	int result, bulklen, nsg, ct;
	unsigned char *buf;
	unsigned long address;

	nsg = bulklen = 0;
573 574 575
	command[0] = 0xE7;
	command[1] = LUNBITS;
	command[2] = 0;
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613
	address = 040000; ct = 1;
	nsg++;
	bulklen += (ct << 9);
	command[4*nsg+2] = ct;
	command[4*nsg+1] = ((address >> 9) & 0xFF);
	command[4*nsg+0] = ((address >> 17) & 0xFF);
	command[4*nsg-1] = ((address >> 25) & 0xFF);

	address = 0340000; ct = 1;
	nsg++;
	bulklen += (ct << 9);
	command[4*nsg+2] = ct;
	command[4*nsg+1] = ((address >> 9) & 0xFF);
	command[4*nsg+0] = ((address >> 17) & 0xFF);
	command[4*nsg-1] = ((address >> 25) & 0xFF);

	address = 01000000; ct = 2;
	nsg++;
	bulklen += (ct << 9);
	command[4*nsg+2] = ct;
	command[4*nsg+1] = ((address >> 9) & 0xFF);
	command[4*nsg+0] = ((address >> 17) & 0xFF);
	command[4*nsg-1] = ((address >> 25) & 0xFF);

	command[2] = nsg;

	result = sddr09_send_scsi_command(us, command, 4*nsg+3);

	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("Result for send_control in sddr09_read_sg %d\n",
			  result);
		return result;
	}

	buf = (unsigned char *) kmalloc(bulklen, GFP_NOIO);
	if (!buf)
		return USB_STOR_TRANSPORT_ERROR;

614 615
	result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
				       buf, bulklen, NULL);
616 617
	kfree(buf);
	if (result != USB_STOR_XFER_GOOD) {
618
		US_DEBUGP("Result for bulk_transfer in sddr09_read_sg %d\n",
619
			  result);
620 621
		return USB_STOR_TRANSPORT_ERROR;
	}
622

623
	return USB_STOR_TRANSPORT_GOOD;
624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640
}
#endif

/*
 * Read Status Command: 12 bytes.
 * byte 0: opcode: EC
 *
 * Returns 64 bytes, all zero except for the first.
 * bit 0: 1: Error
 * bit 5: 1: Suspended
 * bit 6: 1: Ready
 * bit 7: 1: Not write-protected
 */

static int
sddr09_read_status(struct us_data *us, unsigned char *status) {

641 642
	unsigned char *command = us->iobuf;
	unsigned char *data = us->iobuf;
643 644 645 646
	int result;

	US_DEBUGP("Reading status...\n");

647 648 649 650 651
	memset(command, 0, 12);
	command[0] = 0xEC;
	command[1] = LUNBITS;

	result = sddr09_send_scsi_command(us, command, 12);
652 653 654
	if (result != USB_STOR_TRANSPORT_GOOD)
		return result;

655
	result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
656
				       data, 64, NULL);
657
	*status = data[0];
658 659
	return (result == USB_STOR_XFER_GOOD ?
			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
660 661 662 663 664
}

static int
sddr09_read_data(struct us_data *us,
		 unsigned long address,
665
		 unsigned int sectors) {
666 667

	struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
668
	unsigned char *buffer;
669 670
	unsigned int lba, maxlba, pba;
	unsigned int page, pages;
671 672
	unsigned int len, index, offset;
	int result;
Linus Torvalds's avatar
Linus Torvalds committed
673

674
	// Since we only read in one block at a time, we have to create
675 676 677 678 679 680 681 682
	// a bounce buffer and move the data a piece at a time between the
	// bounce buffer and the actual transfer buffer.

	len = min(sectors, (unsigned int) info->blocksize) * info->pagesize;
	buffer = kmalloc(len, GFP_NOIO);
	if (buffer == NULL) {
		printk("sddr09_read_data: Out of memory\n");
		return USB_STOR_TRANSPORT_ERROR;
683
	}
Linus Torvalds's avatar
Linus Torvalds committed
684 685

	// Figure out the initial LBA and page
686 687 688
	lba = address >> info->blockshift;
	page = (address & info->blockmask);
	maxlba = info->capacity >> (info->pageshift + info->blockshift);
Linus Torvalds's avatar
Linus Torvalds committed
689 690 691 692

	// This could be made much more efficient by checking for
	// contiguous LBA's. Another exercise left to the student.

693
	result = USB_STOR_TRANSPORT_GOOD;
694
	index = offset = 0;
Linus Torvalds's avatar
Linus Torvalds committed
695

696
	while (sectors > 0) {
Linus Torvalds's avatar
Linus Torvalds committed
697

698
		/* Find number of pages we can read in this block */
699 700
		pages = min(sectors, info->blocksize - page);
		len = pages << info->pageshift;
Linus Torvalds's avatar
Linus Torvalds committed
701

702 703 704 705 706 707 708
		/* Not overflowing capacity? */
		if (lba >= maxlba) {
			US_DEBUGP("Error: Requested lba %u exceeds "
				  "maximum %u\n", lba, maxlba);
			result = USB_STOR_TRANSPORT_ERROR;
			break;
		}
Linus Torvalds's avatar
Linus Torvalds committed
709

710 711
		/* Find where this lba lives on disk */
		pba = info->lba_to_pba[lba];
Linus Torvalds's avatar
Linus Torvalds committed
712

713
		if (pba == UNDEF) {	/* this lba was never written */
Linus Torvalds's avatar
Linus Torvalds committed
714

715 716
			US_DEBUGP("Read %d zero pages (LBA %d) page %d\n",
				  pages, lba, page);
Linus Torvalds's avatar
Linus Torvalds committed
717

718 719 720 721
			/* This is not really an error. It just means
			   that the block has never been written.
			   Instead of returning USB_STOR_TRANSPORT_ERROR
			   it is better to return all zero data. */
Linus Torvalds's avatar
Linus Torvalds committed
722

723
			memset(buffer, 0, len);
Linus Torvalds's avatar
Linus Torvalds committed
724

725 726 727 728
		} else {
			US_DEBUGP("Read %d pages, from PBA %d"
				  " (LBA %d) page %d\n",
				  pages, pba, lba, page);
Linus Torvalds's avatar
Linus Torvalds committed
729

730 731
			address = ((pba << info->blockshift) + page) << 
				info->pageshift;
Linus Torvalds's avatar
Linus Torvalds committed
732

733
			result = sddr09_read20(us, address>>1,
734
					pages, info->pageshift, buffer, 0);
735 736
			if (result != USB_STOR_TRANSPORT_GOOD)
				break;
Linus Torvalds's avatar
Linus Torvalds committed
737
		}
738

739 740 741
		// Store the data in the transfer buffer
		usb_stor_access_xfer_buf(buffer, len, us->srb,
				&index, &offset, TO_XFER_BUF);
Linus Torvalds's avatar
Linus Torvalds committed
742 743 744 745 746 747

		page = 0;
		lba++;
		sectors -= pages;
	}

748
	kfree(buffer);
749 750
	return result;
}
Linus Torvalds's avatar
Linus Torvalds committed
751

752
static unsigned int
753
sddr09_find_unused_pba(struct sddr09_card_info *info, unsigned int lba) {
754
	static unsigned int lastpba = 1;
755 756 757 758 759 760 761
	int zonestart, end, i;

	zonestart = (lba/1000) << 10;
	end = info->capacity >> (info->blockshift + info->pageshift);
	end -= zonestart;
	if (end > 1024)
		end = 1024;
Linus Torvalds's avatar
Linus Torvalds committed
762

763 764
	for (i = lastpba+1; i < end; i++) {
		if (info->pba_to_lba[zonestart+i] == UNDEF) {
765
			lastpba = i;
766 767 768 769 770 771 772
			return zonestart+i;
		}
	}
	for (i = 0; i <= lastpba; i++) {
		if (info->pba_to_lba[zonestart+i] == UNDEF) {
			lastpba = i;
			return zonestart+i;
773 774 775 776
		}
	}
	return 0;
}
Linus Torvalds's avatar
Linus Torvalds committed
777

778 779 780
static int
sddr09_write_lba(struct us_data *us, unsigned int lba,
		 unsigned int page, unsigned int pages,
781
		 unsigned char *ptr, unsigned char *blockbuffer) {
782 783 784 785

	struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
	unsigned long address;
	unsigned int pba, lbap;
786 787
	unsigned int pagelen;
	unsigned char *bptr, *cptr, *xptr;
788
	unsigned char ecc[3];
789
	int i, result, isnew;
790

791
	lbap = ((lba % 1000) << 1) | 0x1000;
792 793 794
	if (parity[MSB_of(lbap) ^ LSB_of(lbap)])
		lbap ^= 1;
	pba = info->lba_to_pba[lba];
795
	isnew = 0;
796 797

	if (pba == UNDEF) {
798
		pba = sddr09_find_unused_pba(info, lba);
799 800 801 802 803 804
		if (!pba) {
			printk("sddr09_write_lba: Out of unused blocks\n");
			return USB_STOR_TRANSPORT_ERROR;
		}
		info->pba_to_lba[pba] = lba;
		info->lba_to_pba[lba] = pba;
805
		isnew = 1;
806
	}
Linus Torvalds's avatar
Linus Torvalds committed
807

808 809 810 811 812 813
	if (pba == 1) {
		/* Maybe it is impossible to write to PBA 1.
		   Fake success, but don't do anything. */
		printk("sddr09: avoid writing to pba 1\n");
		return USB_STOR_TRANSPORT_GOOD;
	}
Linus Torvalds's avatar
Linus Torvalds committed
814

815
	pagelen = (1 << info->pageshift) + (1 << CONTROL_SHIFT);
Linus Torvalds's avatar
Linus Torvalds committed
816

817 818 819 820
	/* read old contents */
	address = (pba << (info->pageshift + info->blockshift));
	result = sddr09_read22(us, address>>1, info->blocksize,
			       info->pageshift, blockbuffer, 0);
Linus Torvalds's avatar
Linus Torvalds committed
821
	if (result != USB_STOR_TRANSPORT_GOOD)
822
		return result;
823

824 825
	/* check old contents and fill lba */
	for (i = 0; i < info->blocksize; i++) {
826 827 828 829 830 831 832 833 834 835 836 837 838 839
		bptr = blockbuffer + i*pagelen;
		cptr = bptr + info->pagesize;
		nand_compute_ecc(bptr, ecc);
		if (!nand_compare_ecc(cptr+13, ecc)) {
			US_DEBUGP("Warning: bad ecc in page %d- of pba %d\n",
				  i, pba);
			nand_store_ecc(cptr+13, ecc);
		}
		nand_compute_ecc(bptr+(info->pagesize / 2), ecc);
		if (!nand_compare_ecc(cptr+8, ecc)) {
			US_DEBUGP("Warning: bad ecc in page %d+ of pba %d\n",
				  i, pba);
			nand_store_ecc(cptr+8, ecc);
		}
840 841
		cptr[6] = cptr[11] = MSB_of(lbap);
		cptr[7] = cptr[12] = LSB_of(lbap);
842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857
	}

	/* copy in new stuff and compute ECC */
	xptr = ptr;
	for (i = page; i < page+pages; i++) {
		bptr = blockbuffer + i*pagelen;
		cptr = bptr + info->pagesize;
		memcpy(bptr, xptr, info->pagesize);
		xptr += info->pagesize;
		nand_compute_ecc(bptr, ecc);
		nand_store_ecc(cptr+13, ecc);
		nand_compute_ecc(bptr+(info->pagesize / 2), ecc);
		nand_store_ecc(cptr+8, ecc);
	}

	US_DEBUGP("Rewrite PBA %d (LBA %d)\n", pba, lba);
Linus Torvalds's avatar
Linus Torvalds committed
858

859 860
	result = sddr09_write_inplace(us, address>>1, info->blocksize,
				      info->pageshift, blockbuffer, 0);
Linus Torvalds's avatar
Linus Torvalds committed
861

862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880
	US_DEBUGP("sddr09_write_inplace returns %d\n", result);

#if 0
	{
		unsigned char status = 0;
		int result2 = sddr09_read_status(us, &status);
		if (result2 != USB_STOR_TRANSPORT_GOOD)
			US_DEBUGP("sddr09_write_inplace: cannot read status\n");
		else if (status != 0xc0)
			US_DEBUGP("sddr09_write_inplace: status after write: 0x%x\n",
				  status);
	}
#endif

#if 0
	{
		int result2 = sddr09_test_unit_ready(us);
	}
#endif
Linus Torvalds's avatar
Linus Torvalds committed
881 882 883 884

	return result;
}

885 886 887
static int
sddr09_write_data(struct us_data *us,
		  unsigned long address,
888
		  unsigned int sectors) {
Linus Torvalds's avatar
Linus Torvalds committed
889

890 891
	struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
	unsigned int lba, page, pages;
892 893
	unsigned int pagelen, blocklen;
	unsigned char *blockbuffer;
894
	unsigned char *buffer;
895 896
	unsigned int len, index, offset;
	int result;
Linus Torvalds's avatar
Linus Torvalds committed
897

898 899
	// blockbuffer is used for reading in the old data, overwriting
	// with the new data, and performing ECC calculations
Linus Torvalds's avatar
Linus Torvalds committed
900

901 902 903 904 905 906 907 908
	/* TODO: instead of doing kmalloc/kfree for each write,
	   add a bufferpointer to the info structure */

	pagelen = (1 << info->pageshift) + (1 << CONTROL_SHIFT);
	blocklen = (pagelen << info->blockshift);
	blockbuffer = kmalloc(blocklen, GFP_NOIO);
	if (!blockbuffer) {
		printk("sddr09_write_data: Out of memory\n");
Andries E. Brouwer's avatar
Andries E. Brouwer committed
909
		return USB_STOR_TRANSPORT_ERROR;
910
	}
Linus Torvalds's avatar
Linus Torvalds committed
911

912
	// Since we don't write the user data directly to the device,
913 914 915 916 917 918 919 920 921
	// we have to create a bounce buffer and move the data a piece
	// at a time between the bounce buffer and the actual transfer buffer.

	len = min(sectors, (unsigned int) info->blocksize) * info->pagesize;
	buffer = kmalloc(len, GFP_NOIO);
	if (buffer == NULL) {
		printk("sddr09_write_data: Out of memory\n");
		kfree(blockbuffer);
		return USB_STOR_TRANSPORT_ERROR;
922
	}
Linus Torvalds's avatar
Linus Torvalds committed
923

924 925 926
	// Figure out the initial LBA and page
	lba = address >> info->blockshift;
	page = (address & info->blockmask);
Linus Torvalds's avatar
Linus Torvalds committed
927

928
	result = USB_STOR_TRANSPORT_GOOD;
929
	index = offset = 0;
Linus Torvalds's avatar
Linus Torvalds committed
930

931
	while (sectors > 0) {
Linus Torvalds's avatar
Linus Torvalds committed
932

933
		// Write as many sectors as possible in this block
Linus Torvalds's avatar
Linus Torvalds committed
934

935 936
		pages = min(sectors, info->blocksize - page);
		len = (pages << info->pageshift);
937

938 939 940
		// Get the data from the transfer buffer
		usb_stor_access_xfer_buf(buffer, len, us->srb,
				&index, &offset, FROM_XFER_BUF);
941

942 943
		result = sddr09_write_lba(us, lba, page, pages,
				buffer, blockbuffer);
944 945
		if (result != USB_STOR_TRANSPORT_GOOD)
			break;
946

947 948 949 950
		page = 0;
		lba++;
		sectors -= pages;
	}
Linus Torvalds's avatar
Linus Torvalds committed
951

952
	kfree(buffer);
953
	kfree(blockbuffer);
Linus Torvalds's avatar
Linus Torvalds committed
954 955 956 957

	return result;
}

958 959 960 961 962 963
static int
sddr09_read_control(struct us_data *us,
		unsigned long address,
		unsigned int blocks,
		unsigned char *content,
		int use_sg) {
Linus Torvalds's avatar
Linus Torvalds committed
964

965
	US_DEBUGP("Read control address %lu, blocks %d\n",
966
		address, blocks);
Linus Torvalds's avatar
Linus Torvalds committed
967

968 969
	return sddr09_read21(us, address, blocks,
			     CONTROL_SHIFT, content, use_sg);
970
}
Linus Torvalds's avatar
Linus Torvalds committed
971

972 973 974 975 976 977 978 979 980 981 982 983
/*
 * Read Device ID Command: 12 bytes.
 * byte 0: opcode: ED
 *
 * Returns 2 bytes: Manufacturer ID and Device ID.
 * On more recent cards 3 bytes: the third byte is an option code A5
 * signifying that the secret command to read an 128-bit ID is available.
 * On still more recent cards 4 bytes: the fourth byte C0 means that
 * a second read ID cmd is available.
 */
static int
sddr09_read_deviceID(struct us_data *us, unsigned char *deviceID) {
984 985
	unsigned char *command = us->iobuf;
	unsigned char *content = us->iobuf;
986
	int result, i;
Linus Torvalds's avatar
Linus Torvalds committed
987

988 989 990 991 992
	memset(command, 0, 12);
	command[0] = 0xED;
	command[1] = LUNBITS;

	result = sddr09_send_scsi_command(us, command, 12);
Linus Torvalds's avatar
Linus Torvalds committed
993
	if (result != USB_STOR_TRANSPORT_GOOD)
994
		return result;
Linus Torvalds's avatar
Linus Torvalds committed
995

996 997
	result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
			content, 64, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
998

999 1000
	for (i = 0; i < 4; i++)
		deviceID[i] = content[i];
Linus Torvalds's avatar
Linus Torvalds committed
1001

1002 1003
	return (result == USB_STOR_XFER_GOOD ?
			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
1004
}
Linus Torvalds's avatar
Linus Torvalds committed
1005

1006 1007 1008 1009
static int
sddr09_get_wp(struct us_data *us, struct sddr09_card_info *info) {
	int result;
	unsigned char status;
Linus Torvalds's avatar
Linus Torvalds committed
1010

1011 1012 1013 1014 1015
	result = sddr09_read_status(us, &status);
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("sddr09_get_wp: read_status fails\n");
		return result;
	}
1016
	US_DEBUGP("sddr09_get_wp: status 0x%02X", status);
1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029
	if ((status & 0x80) == 0) {
		info->flags |= SDDR09_WP;	/* write protected */
		US_DEBUGP(" WP");
	}
	if (status & 0x40)
		US_DEBUGP(" Ready");
	if (status & LUNBITS)
		US_DEBUGP(" Suspended");
	if (status & 0x1)
		US_DEBUGP(" Error");
	US_DEBUGP("\n");
	return USB_STOR_TRANSPORT_GOOD;
}
Linus Torvalds's avatar
Linus Torvalds committed
1030

1031 1032 1033 1034 1035 1036 1037
#if 0
/*
 * Reset Command: 12 bytes.
 * byte 0: opcode: EB
 */
static int
sddr09_reset(struct us_data *us) {
Linus Torvalds's avatar
Linus Torvalds committed
1038

1039 1040 1041 1042 1043
	unsigned char *command = us->iobuf;

	memset(command, 0, 12);
	command[0] = 0xEB;
	command[1] = LUNBITS;
Linus Torvalds's avatar
Linus Torvalds committed
1044

1045
	return sddr09_send_scsi_command(us, command, 12);
1046 1047
}
#endif
Linus Torvalds's avatar
Linus Torvalds committed
1048

1049 1050 1051 1052 1053 1054
static struct nand_flash_dev *
sddr09_get_cardinfo(struct us_data *us, unsigned char flags) {
	struct nand_flash_dev *cardinfo;
	unsigned char deviceID[4];
	char blurbtxt[256];
	int result;
Linus Torvalds's avatar
Linus Torvalds committed
1055

1056
	US_DEBUGP("Reading capacity...\n");
Linus Torvalds's avatar
Linus Torvalds committed
1057

1058
	result = sddr09_read_deviceID(us, deviceID);
Linus Torvalds's avatar
Linus Torvalds committed
1059

1060 1061 1062
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("Result of read_deviceID is %d\n", result);
		printk("sddr09: could not read card info\n");
Linus Torvalds's avatar
Linus Torvalds committed
1063
		return 0;
1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085
	}

	sprintf(blurbtxt, "sddr09: Found Flash card, ID = %02X %02X %02X %02X",
		deviceID[0], deviceID[1], deviceID[2], deviceID[3]);

	/* Byte 0 is the manufacturer */
	sprintf(blurbtxt + strlen(blurbtxt),
		": Manuf. %s",
		nand_flash_manufacturer(deviceID[0]));

	/* Byte 1 is the device type */
	cardinfo = nand_find_id(deviceID[1]);
	if (cardinfo) {
		/* MB or MiB? It is neither. A 16 MB card has
		   17301504 raw bytes, of which 16384000 are
		   usable for user data. */
		sprintf(blurbtxt + strlen(blurbtxt),
			", %d MB", 1<<(cardinfo->chipshift - 20));
	} else {
		sprintf(blurbtxt + strlen(blurbtxt),
			", type unrecognized");
	}
Linus Torvalds's avatar
Linus Torvalds committed
1086

1087 1088 1089 1090
	/* Byte 2 is code to signal availability of 128-bit ID */
	if (deviceID[2] == 0xa5) {
		sprintf(blurbtxt + strlen(blurbtxt),
			", 128-bit ID");
Linus Torvalds's avatar
Linus Torvalds committed
1091
	}
1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105

	/* Byte 3 announces the availability of another read ID command */
	if (deviceID[3] == 0xc0) {
		sprintf(blurbtxt + strlen(blurbtxt),
			", extra cmd");
	}

	if (flags & SDDR09_WP)
		sprintf(blurbtxt + strlen(blurbtxt),
			", WP");

	printk("%s\n", blurbtxt);

	return cardinfo;
Linus Torvalds's avatar
Linus Torvalds committed
1106 1107
}

1108 1109
static int
sddr09_read_map(struct us_data *us) {
Linus Torvalds's avatar
Linus Torvalds committed
1110

1111 1112 1113
	struct sddr09_card_info *info = (struct sddr09_card_info *) us->extra;
	int numblocks, alloc_len, alloc_blocks;
	int i, j, result;
1114
	unsigned char *buffer, *buffer_end, *ptr;
1115
	unsigned int lba, lbact;
Linus Torvalds's avatar
Linus Torvalds committed
1116 1117 1118 1119

	if (!info->capacity)
		return -1;

1120 1121
	// size of a block is 1 << (blockshift + pageshift) bytes
	// divide into the total capacity to get the number of blocks
Linus Torvalds's avatar
Linus Torvalds committed
1122

1123
	numblocks = info->capacity >> (info->blockshift + info->pageshift);
1124

1125 1126 1127 1128
	// read 64 bytes for every block (actually 1 << CONTROL_SHIFT)
	// but only use a 64 KB buffer
	// buffer size used must be a multiple of (1 << CONTROL_SHIFT)
#define SDDR09_READ_MAP_BUFSZ 65536
Linus Torvalds's avatar
Linus Torvalds committed
1129

1130 1131 1132
	alloc_blocks = min(numblocks, SDDR09_READ_MAP_BUFSZ >> CONTROL_SHIFT);
	alloc_len = (alloc_blocks << CONTROL_SHIFT);
	buffer = kmalloc(alloc_len, GFP_NOIO);
1133 1134 1135 1136 1137
	if (buffer == NULL) {
		printk("sddr09_read_map: out of memory\n");
		result = -1;
		goto done;
	}
1138
	buffer_end = buffer + alloc_len;
Linus Torvalds's avatar
Linus Torvalds committed
1139

1140
#undef SDDR09_READ_MAP_BUFSZ
Linus Torvalds's avatar
Linus Torvalds committed
1141

1142 1143
	kfree(info->lba_to_pba);
	kfree(info->pba_to_lba);
Linus Torvalds's avatar
Linus Torvalds committed
1144 1145
	info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
	info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
Linus Torvalds's avatar
Linus Torvalds committed
1146 1147

	if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
1148
		printk("sddr09_read_map: out of memory\n");
1149 1150
		result = -1;
		goto done;
Linus Torvalds's avatar
Linus Torvalds committed
1151 1152
	}

1153 1154 1155 1156 1157 1158
	for (i = 0; i < numblocks; i++)
		info->lba_to_pba[i] = info->pba_to_lba[i] = UNDEF;

	/*
	 * Define lba-pba translation table
	 */
Linus Torvalds's avatar
Linus Torvalds committed
1159

1160 1161 1162 1163
	ptr = buffer_end;
	for (i = 0; i < numblocks; i++) {
		ptr += (1 << CONTROL_SHIFT);
		if (ptr >= buffer_end) {
1164 1165 1166
			unsigned long address;

			address = i << (info->pageshift + info->blockshift);
1167
			result = sddr09_read_control(
1168
				us, address>>1,
1169 1170 1171 1172 1173 1174
				min(alloc_blocks, numblocks - i),
				buffer, 0);
			if (result != USB_STOR_TRANSPORT_GOOD) {
				result = -1;
				goto done;
			}
1175
			ptr = buffer;
1176
		}
1177 1178 1179

		if (i == 0 || i == 1) {
			info->pba_to_lba[i] = UNUSABLE;
Linus Torvalds's avatar
Linus Torvalds committed
1180
			continue;
Linus Torvalds's avatar
Linus Torvalds committed
1181
		}
1182 1183 1184 1185 1186 1187

		/* special PBAs have control field 0^16 */
		for (j = 0; j < 16; j++)
			if (ptr[j] != 0)
				goto nonz;
		info->pba_to_lba[i] = UNUSABLE;
1188
		printk("sddr09: PBA %d has no logical mapping\n", i);
1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200
		continue;

	nonz:
		/* unwritten PBAs have control field FF^16 */
		for (j = 0; j < 16; j++)
			if (ptr[j] != 0xff)
				goto nonff;
		continue;

	nonff:
		/* normal PBAs start with six FFs */
		if (j < 6) {
1201
			printk("sddr09: PBA %d has no logical mapping: "
1202 1203 1204 1205 1206
			       "reserved area = %02X%02X%02X%02X "
			       "data status %02X block status %02X\n",
			       i, ptr[0], ptr[1], ptr[2], ptr[3],
			       ptr[4], ptr[5]);
			info->pba_to_lba[i] = UNUSABLE;
Linus Torvalds's avatar
Linus Torvalds committed
1207
			continue;
Linus Torvalds's avatar
Linus Torvalds committed
1208
		}
Linus Torvalds's avatar
Linus Torvalds committed
1209

1210
		if ((ptr[6] >> 4) != 0x01) {
1211
			printk("sddr09: PBA %d has invalid address field "
1212 1213 1214
			       "%02X%02X/%02X%02X\n",
			       i, ptr[6], ptr[7], ptr[11], ptr[12]);
			info->pba_to_lba[i] = UNUSABLE;
Linus Torvalds's avatar
Linus Torvalds committed
1215 1216 1217
			continue;
		}

1218 1219
		/* check even parity */
		if (parity[ptr[6] ^ ptr[7]]) {
1220
			printk("sddr09: Bad parity in LBA for block %d"
1221 1222 1223 1224
			       " (%02X %02X)\n", i, ptr[6], ptr[7]);
			info->pba_to_lba[i] = UNUSABLE;
			continue;
		}
Linus Torvalds's avatar
Linus Torvalds committed
1225

1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238
		lba = short_pack(ptr[7], ptr[6]);
		lba = (lba & 0x07FF) >> 1;

		/*
		 * Every 1024 physical blocks ("zone"), the LBA numbers
		 * go back to zero, but are within a higher block of LBA's.
		 * Also, there is a maximum of 1000 LBA's per zone.
		 * In other words, in PBA 1024-2047 you will find LBA 0-999
		 * which are really LBA 1000-1999. This allows for 24 bad
		 * or special physical blocks per zone.
		 */

		if (lba >= 1000) {
1239
			printk("sddr09: Bad low LBA %d for block %d\n",
1240
			       lba, i);
1241
			goto possibly_erase;
Linus Torvalds's avatar
Linus Torvalds committed
1242 1243
		}

1244 1245
		lba += 1000*(i/0x400);

1246 1247 1248 1249 1250
		if (info->lba_to_pba[lba] != UNDEF) {
			printk("sddr09: LBA %d seen for PBA %d and %d\n",
			       lba, info->lba_to_pba[lba], i);
			goto possibly_erase;
		}
Linus Torvalds's avatar
Linus Torvalds committed
1251 1252 1253

		info->pba_to_lba[i] = lba;
		info->lba_to_pba[lba] = i;
1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264
		continue;

	possibly_erase:
		if (erase_bad_lba_entries) {
			unsigned long address;

			address = (i << (info->pageshift + info->blockshift));
			sddr09_erase(us, address>>1);
			info->pba_to_lba[i] = UNDEF;
		} else
			info->pba_to_lba[i] = UNUSABLE;
Linus Torvalds's avatar
Linus Torvalds committed
1265
	}
1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288

	/*
	 * Approximate capacity. This is not entirely correct yet,
	 * since a zone with less than 1000 usable pages leads to
	 * missing LBAs. Especially if it is the last zone, some
	 * LBAs can be past capacity.
	 */
	lbact = 0;
	for (i = 0; i < numblocks; i += 1024) {
		int ct = 0;

		for (j = 0; j < 1024 && i+j < numblocks; j++) {
			if (info->pba_to_lba[i+j] != UNUSABLE) {
				if (ct >= 1000)
					info->pba_to_lba[i+j] = SPARE;
				else
					ct++;
			}
		}
		lbact += ct;
	}
	info->lbact = lbact;
	US_DEBUGP("Found %d LBA's\n", lbact);
1289
	result = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1290

1291 1292 1293 1294 1295 1296 1297 1298 1299
 done:
	if (result != 0) {
		kfree(info->lba_to_pba);
		kfree(info->pba_to_lba);
		info->lba_to_pba = NULL;
		info->pba_to_lba = NULL;
	}
	kfree(buffer);
	return result;
Linus Torvalds's avatar
Linus Torvalds committed
1300 1301
}

1302 1303 1304
static void
sddr09_card_info_destructor(void *extra) {
	struct sddr09_card_info *info = (struct sddr09_card_info *)extra;
Linus Torvalds's avatar
Linus Torvalds committed
1305

1306 1307
	if (!info)
		return;
Linus Torvalds's avatar
Linus Torvalds committed
1308

1309 1310 1311
	kfree(info->lba_to_pba);
	kfree(info->pba_to_lba);
}
Linus Torvalds's avatar
Linus Torvalds committed
1312

1313 1314 1315 1316 1317 1318 1319 1320 1321 1322
static void
sddr09_init_card_info(struct us_data *us) {
	if (!us->extra) {
		us->extra = kmalloc(sizeof(struct sddr09_card_info), GFP_NOIO);
		if (us->extra) {
			memset(us->extra, 0, sizeof(struct sddr09_card_info));
			us->extra_destructor = sddr09_card_info_destructor;
		}
	}
}
Linus Torvalds's avatar
Linus Torvalds committed
1323

1324 1325 1326 1327 1328 1329 1330 1331
/*
 * This is needed at a very early stage. If this is not listed in the
 * unusual devices list but called from here then LUN 0 of the combo reader
 * is not recognized. But I do not know what precisely these calls do.
 */
int
sddr09_init(struct us_data *us) {
	int result;
1332
	unsigned char *data = us->iobuf;
Linus Torvalds's avatar
Linus Torvalds committed
1333

1334 1335 1336
	result = sddr09_send_command(us, 0x01, USB_DIR_IN, data, 2);
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("sddr09_init: send_command fails\n");
Linus Torvalds's avatar
Linus Torvalds committed
1337
		return result;
1338
	}
Linus Torvalds's avatar
Linus Torvalds committed
1339

1340 1341
	US_DEBUGP("SDDR09init: %02X %02X\n", data[0], data[1]);
	// get 07 02
Linus Torvalds's avatar
Linus Torvalds committed
1342

1343 1344 1345
	result = sddr09_send_command(us, 0x08, USB_DIR_IN, data, 2);
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("sddr09_init: 2nd send_command fails\n");
Linus Torvalds's avatar
Linus Torvalds committed
1346 1347 1348
		return result;
	}

1349 1350 1351
	US_DEBUGP("SDDR09init: %02X %02X\n", data[0], data[1]);
	// get 07 00

1352
	result = sddr09_request_sense(us, data, 18);
1353 1354
	if (result == USB_STOR_TRANSPORT_GOOD && data[2] != 0) {
		int j;
1355
		for (j=0; j<18; j++)
1356 1357 1358 1359 1360 1361 1362 1363 1364
			printk(" %02X", data[j]);
		printk("\n");
		// get 70 00 00 00 00 00 00 * 00 00 00 00 00 00
		// 70: current command
		// sense key 0, sense code 0, extd sense code 0
		// additional transfer length * = sizeof(data) - 7
		// Or: 70 00 06 00 00 00 00 0b 00 00 00 00 28 00 00 00 00 00
		// sense key 06, sense code 28: unit attention,
		// not ready to ready transition
Linus Torvalds's avatar
Linus Torvalds committed
1365 1366
	}

1367
	// test unit ready
Linus Torvalds's avatar
Linus Torvalds committed
1368

1369
	return USB_STOR_TRANSPORT_GOOD;		/* not result */
Linus Torvalds's avatar
Linus Torvalds committed
1370 1371 1372 1373 1374 1375 1376
}

/*
 * Transport for the Sandisk SDDR-09
 */
int sddr09_transport(Scsi_Cmnd *srb, struct us_data *us)
{
1377 1378 1379
	static unsigned char sensekey = 0, sensecode = 0;
	static unsigned char havefakesense = 0;
	int result, i;
1380
	unsigned char *ptr = us->iobuf;
1381 1382 1383 1384 1385
	unsigned long capacity;
	unsigned int page, pages;

	struct sddr09_card_info *info;

1386
	static unsigned char inquiry_response[8] = {
Linus Torvalds's avatar
Linus Torvalds committed
1387 1388
		0x00, 0x80, 0x00, 0x02, 0x1F, 0x00, 0x00, 0x00
	};
1389

1390 1391 1392
	/* note: no block descriptor support */
	static unsigned char mode_page_01[19] = {
		0x00, 0x0F, 0x00, 0x0, 0x0, 0x0, 0x00,
Linus Torvalds's avatar
Linus Torvalds committed
1393 1394
		0x01, 0x0A,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
Linus Torvalds's avatar
Linus Torvalds committed
1395 1396
	};

1397 1398 1399 1400 1401 1402
	info = (struct sddr09_card_info *)us->extra;
	if (!info) {
		nand_init_ecc();
		sddr09_init_card_info(us);
		info = (struct sddr09_card_info *)us->extra;
		if (!info)
Linus Torvalds's avatar
Linus Torvalds committed
1403 1404 1405
			return USB_STOR_TRANSPORT_ERROR;
	}

1406 1407
	if (srb->cmnd[0] == REQUEST_SENSE && havefakesense) {
		/* for a faked command, we have to follow with a faked sense */
1408 1409 1410 1411 1412 1413
		memset(ptr, 0, 18);
		ptr[0] = 0x70;
		ptr[2] = sensekey;
		ptr[7] = 11;
		ptr[12] = sensecode;
		usb_stor_set_xfer_buf(ptr, 18, srb);
1414 1415 1416 1417 1418 1419
		sensekey = sensecode = havefakesense = 0;
		return USB_STOR_TRANSPORT_GOOD;
	}

	havefakesense = 1;

Linus Torvalds's avatar
Linus Torvalds committed
1420 1421 1422 1423
	/* Dummy up a response for INQUIRY since SDDR09 doesn't
	   respond to INQUIRY commands */

	if (srb->cmnd[0] == INQUIRY) {
1424 1425
		memcpy(ptr, inquiry_response, 8);
		fill_inquiry_response(us, ptr, 36);
Linus Torvalds's avatar
Linus Torvalds committed
1426 1427 1428 1429
		return USB_STOR_TRANSPORT_GOOD;
	}

	if (srb->cmnd[0] == READ_CAPACITY) {
1430
		struct nand_flash_dev *cardinfo;
Linus Torvalds's avatar
Linus Torvalds committed
1431

1432
		sddr09_get_wp(us, info);	/* read WP bit */
Linus Torvalds's avatar
Linus Torvalds committed
1433

1434 1435 1436
		cardinfo = sddr09_get_cardinfo(us, info->flags);
		if (!cardinfo) {
			/* probably no media */
1437
		init_error:
1438 1439
			sensekey = 0x02;	/* not ready */
			sensecode = 0x3a;	/* medium not present */
Linus Torvalds's avatar
Linus Torvalds committed
1440
			return USB_STOR_TRANSPORT_FAILED;
1441 1442 1443 1444 1445 1446 1447 1448
		}

		info->capacity = (1 << cardinfo->chipshift);
		info->pageshift = cardinfo->pageshift;
		info->pagesize = (1 << info->pageshift);
		info->blockshift = cardinfo->blockshift;
		info->blocksize = (1 << info->blockshift);
		info->blockmask = info->blocksize - 1;
Linus Torvalds's avatar
Linus Torvalds committed
1449

1450
		// map initialization, must follow get_cardinfo()
1451 1452 1453 1454
		if (sddr09_read_map(us)) {
			/* probably out of memory */
			goto init_error;
		}
Linus Torvalds's avatar
Linus Torvalds committed
1455

1456
		// Report capacity
Linus Torvalds's avatar
Linus Torvalds committed
1457

1458
		capacity = (info->lbact << info->blockshift) - 1;
Linus Torvalds's avatar
Linus Torvalds committed
1459

1460
		((u32 *) ptr)[0] = cpu_to_be32(capacity);
Linus Torvalds's avatar
Linus Torvalds committed
1461

1462
		// Report page size
Linus Torvalds's avatar
Linus Torvalds committed
1463

1464 1465
		((u32 *) ptr)[1] = cpu_to_be32(info->pagesize);
		usb_stor_set_xfer_buf(ptr, 8, srb);
Linus Torvalds's avatar
Linus Torvalds committed
1466 1467 1468 1469

		return USB_STOR_TRANSPORT_GOOD;
	}

1470
	if (srb->cmnd[0] == MODE_SENSE_10) {
1471
		int modepage = (srb->cmnd[2] & 0x3F);
Linus Torvalds's avatar
Linus Torvalds committed
1472

1473
		/* They ask for the Read/Write error recovery page,
1474
		   or for all pages. */
1475
		/* %% We should check DBD %% */
1476 1477 1478
		if (modepage == 0x01 || modepage == 0x3F) {
			US_DEBUGP("SDDR09: Dummy up request for "
				  "mode page 0x%x\n", modepage);
Linus Torvalds's avatar
Linus Torvalds committed
1479

1480
			memcpy(ptr, mode_page_01, sizeof(mode_page_01));
1481 1482
			((u16*)ptr)[0] = sizeof(mode_page_01) - 2;
			ptr[3] = (info->flags & SDDR09_WP) ? 0x80 : 0;
1483
			usb_stor_set_xfer_buf(ptr, sizeof(mode_page_01), srb);
Linus Torvalds's avatar
Linus Torvalds committed
1484 1485 1486
			return USB_STOR_TRANSPORT_GOOD;
		}

1487 1488 1489
		sensekey = 0x05;	/* illegal request */
		sensecode = 0x24;	/* invalid field in CDB */
		return USB_STOR_TRANSPORT_FAILED;
Linus Torvalds's avatar
Linus Torvalds committed
1490 1491
	}

1492
	if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL)
Linus Torvalds's avatar
Linus Torvalds committed
1493 1494
		return USB_STOR_TRANSPORT_GOOD;

1495 1496
	havefakesense = 0;

Linus Torvalds's avatar
Linus Torvalds committed
1497 1498 1499 1500 1501 1502 1503
	if (srb->cmnd[0] == READ_10) {

		page = short_pack(srb->cmnd[3], srb->cmnd[2]);
		page <<= 16;
		page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
		pages = short_pack(srb->cmnd[8], srb->cmnd[7]);

1504 1505
		US_DEBUGP("READ_10: read page %d pagect %d\n",
			  page, pages);
Linus Torvalds's avatar
Linus Torvalds committed
1506

1507
		return sddr09_read_data(us, page, pages);
1508
	}
Linus Torvalds's avatar
Linus Torvalds committed
1509

1510
	if (srb->cmnd[0] == WRITE_10) {
Linus Torvalds's avatar
Linus Torvalds committed
1511

1512 1513 1514 1515
		page = short_pack(srb->cmnd[3], srb->cmnd[2]);
		page <<= 16;
		page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
		pages = short_pack(srb->cmnd[8], srb->cmnd[7]);
Linus Torvalds's avatar
Linus Torvalds committed
1516

1517 1518
		US_DEBUGP("WRITE_10: write page %d pagect %d\n",
			  page, pages);
Linus Torvalds's avatar
Linus Torvalds committed
1519

1520
		return sddr09_write_data(us, page, pages);
Linus Torvalds's avatar
Linus Torvalds committed
1521 1522
	}

1523 1524 1525
	/* catch-all for all other commands, except
	 * pass TEST_UNIT_READY and REQUEST_SENSE through
	 */
Linus Torvalds's avatar
Linus Torvalds committed
1526
	if (srb->cmnd[0] != TEST_UNIT_READY &&
1527
	    srb->cmnd[0] != REQUEST_SENSE) {
1528 1529
		sensekey = 0x05;	/* illegal request */
		sensecode = 0x20;	/* invalid command */
1530
		havefakesense = 1;
1531
		return USB_STOR_TRANSPORT_FAILED;
1532
	}
Linus Torvalds's avatar
Linus Torvalds committed
1533 1534 1535 1536

	for (; srb->cmd_len<12; srb->cmd_len++)
		srb->cmnd[srb->cmd_len] = 0;

1537
	srb->cmnd[1] = LUNBITS;
Linus Torvalds's avatar
Linus Torvalds committed
1538

1539
	ptr[0] = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1540
	for (i=0; i<12; i++)
1541
		sprintf(ptr+strlen(ptr), "%02X ", srb->cmnd[i]);
Linus Torvalds's avatar
Linus Torvalds committed
1542

1543
	US_DEBUGP("SDDR09: Send control for command %s\n", ptr);
Linus Torvalds's avatar
Linus Torvalds committed
1544

1545 1546 1547 1548 1549 1550
	result = sddr09_send_scsi_command(us, srb->cmnd, 12);
	if (result != USB_STOR_TRANSPORT_GOOD) {
		US_DEBUGP("sddr09_transport: sddr09_send_scsi_command "
			  "returns %d\n", result);
		return result;
	}
Linus Torvalds's avatar
Linus Torvalds committed
1551 1552 1553 1554 1555 1556

	if (srb->request_bufflen == 0)
		return USB_STOR_TRANSPORT_GOOD;

	if (srb->sc_data_direction == SCSI_DATA_WRITE ||
	    srb->sc_data_direction == SCSI_DATA_READ) {
1557 1558
		unsigned int pipe = (srb->sc_data_direction == SCSI_DATA_WRITE)
				? us->send_bulk_pipe : us->recv_bulk_pipe;
Linus Torvalds's avatar
Linus Torvalds committed
1559 1560

		US_DEBUGP("SDDR09: %s %d bytes\n",
1561
			  (srb->sc_data_direction == SCSI_DATA_WRITE) ?
Linus Torvalds's avatar
Linus Torvalds committed
1562
			  "sending" : "receiving",
1563
			  srb->request_bufflen);
Linus Torvalds's avatar
Linus Torvalds committed
1564

1565 1566 1567 1568
		result = usb_stor_bulk_transfer_sg(us, pipe,
					srb->request_buffer,
					srb->request_bufflen,
					srb->use_sg, &srb->resid);
Linus Torvalds's avatar
Linus Torvalds committed
1569

1570 1571
		return (result == USB_STOR_XFER_GOOD ?
			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
Linus Torvalds's avatar
Linus Torvalds committed
1572 1573 1574 1575 1576
	} 

	return USB_STOR_TRANSPORT_GOOD;
}