blob: 5031aa98f6a977d13760cc9cde790e0e79751018 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* Driver for Lexar "Jumpshot" Compact Flash reader
2 *
3 * $Id: jumpshot.c,v 1.7 2002/02/25 00:40:13 mdharm Exp $
4 *
5 * jumpshot driver v0.1:
6 *
7 * First release
8 *
9 * Current development and maintenance by:
10 * (c) 2000 Jimmie Mayfield (mayfield+usb@sackheads.org)
11 *
12 * Many thanks to Robert Baruch for the SanDisk SmartMedia reader driver
13 * which I used as a template for this driver.
14 *
15 * Some bugfixes and scatter-gather code by Gregory P. Smith
16 * (greg-usb@electricrain.com)
17 *
18 * Fix for media change by Joerg Schneider (js@joergschneider.com)
19 *
20 * Developed with the assistance of:
21 *
22 * (C) 2002 Alan Stern <stern@rowland.org>
23 *
24 * This program is free software; you can redistribute it and/or modify it
25 * under the terms of the GNU General Public License as published by the
26 * Free Software Foundation; either version 2, or (at your option) any
27 * later version.
28 *
29 * This program is distributed in the hope that it will be useful, but
30 * WITHOUT ANY WARRANTY; without even the implied warranty of
31 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
32 * General Public License for more details.
33 *
34 * You should have received a copy of the GNU General Public License along
35 * with this program; if not, write to the Free Software Foundation, Inc.,
36 * 675 Mass Ave, Cambridge, MA 02139, USA.
37 */
38
39 /*
40 * This driver attempts to support the Lexar Jumpshot USB CompactFlash
41 * reader. Like many other USB CompactFlash readers, the Jumpshot contains
42 * a USB-to-ATA chip.
43 *
44 * This driver supports reading and writing. If you're truly paranoid,
45 * however, you can force the driver into a write-protected state by setting
46 * the WP enable bits in jumpshot_handle_mode_sense. See the comments
47 * in that routine.
48 */
49
50#include <linux/sched.h>
51#include <linux/errno.h>
52#include <linux/slab.h>
53
54#include <scsi/scsi.h>
55#include <scsi/scsi_cmnd.h>
56
57#include "usb.h"
58#include "transport.h"
59#include "protocol.h"
60#include "debug.h"
61#include "jumpshot.h"
62
63
64static inline int jumpshot_bulk_read(struct us_data *us,
65 unsigned char *data,
66 unsigned int len)
67{
68 if (len == 0)
69 return USB_STOR_XFER_GOOD;
70
71 US_DEBUGP("jumpshot_bulk_read: len = %d\n", len);
72 return usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
73 data, len, NULL);
74}
75
76
77static inline int jumpshot_bulk_write(struct us_data *us,
78 unsigned char *data,
79 unsigned int len)
80{
81 if (len == 0)
82 return USB_STOR_XFER_GOOD;
83
84 US_DEBUGP("jumpshot_bulk_write: len = %d\n", len);
85 return usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe,
86 data, len, NULL);
87}
88
89
90static int jumpshot_get_status(struct us_data *us)
91{
92 int rc;
93
94 if (!us)
95 return USB_STOR_TRANSPORT_ERROR;
96
97 // send the setup
98 rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
99 0, 0xA0, 0, 7, us->iobuf, 1);
100
101 if (rc != USB_STOR_XFER_GOOD)
102 return USB_STOR_TRANSPORT_ERROR;
103
104 if (us->iobuf[0] != 0x50) {
105 US_DEBUGP("jumpshot_get_status: 0x%2x\n",
106 us->iobuf[0]);
107 return USB_STOR_TRANSPORT_ERROR;
108 }
109
110 return USB_STOR_TRANSPORT_GOOD;
111}
112
113static int jumpshot_read_data(struct us_data *us,
114 struct jumpshot_info *info,
115 u32 sector,
116 u32 sectors)
117{
118 unsigned char *command = us->iobuf;
119 unsigned char *buffer;
120 unsigned char thistime;
121 unsigned int totallen, alloclen;
122 int len, result;
123 unsigned int sg_idx = 0, sg_offset = 0;
124
125 // we're working in LBA mode. according to the ATA spec,
126 // we can support up to 28-bit addressing. I don't know if Jumpshot
127 // supports beyond 24-bit addressing. It's kind of hard to test
128 // since it requires > 8GB CF card.
129
130 if (sector > 0x0FFFFFFF)
131 return USB_STOR_TRANSPORT_ERROR;
132
133 totallen = sectors * info->ssize;
134
135 // Since we don't read more than 64 KB at a time, we have to create
136 // a bounce buffer and move the data a piece at a time between the
137 // bounce buffer and the actual transfer buffer.
138
139 alloclen = min(totallen, 65536u);
140 buffer = kmalloc(alloclen, GFP_NOIO);
141 if (buffer == NULL)
142 return USB_STOR_TRANSPORT_ERROR;
143
144 do {
145 // loop, never allocate or transfer more than 64k at once
146 // (min(128k, 255*info->ssize) is the real limit)
147 len = min(totallen, alloclen);
148 thistime = (len / info->ssize) & 0xff;
149
150 command[0] = 0;
151 command[1] = thistime;
152 command[2] = sector & 0xFF;
153 command[3] = (sector >> 8) & 0xFF;
154 command[4] = (sector >> 16) & 0xFF;
155
156 command[5] = 0xE0 | ((sector >> 24) & 0x0F);
157 command[6] = 0x20;
158
159 // send the setup + command
160 result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
161 0, 0x20, 0, 1, command, 7);
162 if (result != USB_STOR_XFER_GOOD)
163 goto leave;
164
165 // read the result
166 result = jumpshot_bulk_read(us, buffer, len);
167 if (result != USB_STOR_XFER_GOOD)
168 goto leave;
169
170 US_DEBUGP("jumpshot_read_data: %d bytes\n", len);
171
172 // Store the data in the transfer buffer
173 usb_stor_access_xfer_buf(buffer, len, us->srb,
174 &sg_idx, &sg_offset, TO_XFER_BUF);
175
176 sector += thistime;
177 totallen -= len;
178 } while (totallen > 0);
179
180 kfree(buffer);
181 return USB_STOR_TRANSPORT_GOOD;
182
183 leave:
184 kfree(buffer);
185 return USB_STOR_TRANSPORT_ERROR;
186}
187
188
189static int jumpshot_write_data(struct us_data *us,
190 struct jumpshot_info *info,
191 u32 sector,
192 u32 sectors)
193{
194 unsigned char *command = us->iobuf;
195 unsigned char *buffer;
196 unsigned char thistime;
197 unsigned int totallen, alloclen;
198 int len, result, waitcount;
199 unsigned int sg_idx = 0, sg_offset = 0;
200
201 // we're working in LBA mode. according to the ATA spec,
202 // we can support up to 28-bit addressing. I don't know if Jumpshot
203 // supports beyond 24-bit addressing. It's kind of hard to test
204 // since it requires > 8GB CF card.
205 //
206 if (sector > 0x0FFFFFFF)
207 return USB_STOR_TRANSPORT_ERROR;
208
209 totallen = sectors * info->ssize;
210
211 // Since we don't write more than 64 KB at a time, we have to create
212 // a bounce buffer and move the data a piece at a time between the
213 // bounce buffer and the actual transfer buffer.
214
215 alloclen = min(totallen, 65536u);
216 buffer = kmalloc(alloclen, GFP_NOIO);
217 if (buffer == NULL)
218 return USB_STOR_TRANSPORT_ERROR;
219
220 do {
221 // loop, never allocate or transfer more than 64k at once
222 // (min(128k, 255*info->ssize) is the real limit)
223
224 len = min(totallen, alloclen);
225 thistime = (len / info->ssize) & 0xff;
226
227 // Get the data from the transfer buffer
228 usb_stor_access_xfer_buf(buffer, len, us->srb,
229 &sg_idx, &sg_offset, FROM_XFER_BUF);
230
231 command[0] = 0;
232 command[1] = thistime;
233 command[2] = sector & 0xFF;
234 command[3] = (sector >> 8) & 0xFF;
235 command[4] = (sector >> 16) & 0xFF;
236
237 command[5] = 0xE0 | ((sector >> 24) & 0x0F);
238 command[6] = 0x30;
239
240 // send the setup + command
241 result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
242 0, 0x20, 0, 1, command, 7);
243 if (result != USB_STOR_XFER_GOOD)
244 goto leave;
245
246 // send the data
247 result = jumpshot_bulk_write(us, buffer, len);
248 if (result != USB_STOR_XFER_GOOD)
249 goto leave;
250
251 // read the result. apparently the bulk write can complete
252 // before the jumpshot drive is finished writing. so we loop
253 // here until we get a good return code
254 waitcount = 0;
255 do {
256 result = jumpshot_get_status(us);
257 if (result != USB_STOR_TRANSPORT_GOOD) {
258 // I have not experimented to find the smallest value.
259 //
260 msleep(50);
261 }
262 } while ((result != USB_STOR_TRANSPORT_GOOD) && (waitcount < 10));
263
264 if (result != USB_STOR_TRANSPORT_GOOD)
265 US_DEBUGP("jumpshot_write_data: Gah! Waitcount = 10. Bad write!?\n");
266
267 sector += thistime;
268 totallen -= len;
269 } while (totallen > 0);
270
271 kfree(buffer);
272 return result;
273
274 leave:
275 kfree(buffer);
276 return USB_STOR_TRANSPORT_ERROR;
277}
278
279static int jumpshot_id_device(struct us_data *us,
280 struct jumpshot_info *info)
281{
282 unsigned char *command = us->iobuf;
283 unsigned char *reply;
284 int rc;
285
286 if (!us || !info)
287 return USB_STOR_TRANSPORT_ERROR;
288
289 command[0] = 0xE0;
290 command[1] = 0xEC;
291 reply = kmalloc(512, GFP_NOIO);
292 if (!reply)
293 return USB_STOR_TRANSPORT_ERROR;
294
295 // send the setup
296 rc = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
297 0, 0x20, 0, 6, command, 2);
298
299 if (rc != USB_STOR_XFER_GOOD) {
300 US_DEBUGP("jumpshot_id_device: Gah! "
301 "send_control for read_capacity failed\n");
302 rc = USB_STOR_TRANSPORT_ERROR;
303 goto leave;
304 }
305
306 // read the reply
307 rc = jumpshot_bulk_read(us, reply, 512);
308 if (rc != USB_STOR_XFER_GOOD) {
309 rc = USB_STOR_TRANSPORT_ERROR;
310 goto leave;
311 }
312
313 info->sectors = ((u32)(reply[117]) << 24) |
314 ((u32)(reply[116]) << 16) |
315 ((u32)(reply[115]) << 8) |
316 ((u32)(reply[114]) );
317
318 rc = USB_STOR_TRANSPORT_GOOD;
319
320 leave:
321 kfree(reply);
322 return rc;
323}
324
325static int jumpshot_handle_mode_sense(struct us_data *us,
326 struct scsi_cmnd * srb,
327 int sense_6)
328{
329 static unsigned char rw_err_page[12] = {
330 0x1, 0xA, 0x21, 1, 0, 0, 0, 0, 1, 0, 0, 0
331 };
332 static unsigned char cache_page[12] = {
333 0x8, 0xA, 0x1, 0, 0, 0, 0, 0, 0, 0, 0, 0
334 };
335 static unsigned char rbac_page[12] = {
336 0x1B, 0xA, 0, 0x81, 0, 0, 0, 0, 0, 0, 0, 0
337 };
338 static unsigned char timer_page[8] = {
339 0x1C, 0x6, 0, 0, 0, 0
340 };
341 unsigned char pc, page_code;
342 unsigned int i = 0;
343 struct jumpshot_info *info = (struct jumpshot_info *) (us->extra);
344 unsigned char *ptr = us->iobuf;
345
346 pc = srb->cmnd[2] >> 6;
347 page_code = srb->cmnd[2] & 0x3F;
348
349 switch (pc) {
350 case 0x0:
351 US_DEBUGP("jumpshot_handle_mode_sense: Current values\n");
352 break;
353 case 0x1:
354 US_DEBUGP("jumpshot_handle_mode_sense: Changeable values\n");
355 break;
356 case 0x2:
357 US_DEBUGP("jumpshot_handle_mode_sense: Default values\n");
358 break;
359 case 0x3:
360 US_DEBUGP("jumpshot_handle_mode_sense: Saves values\n");
361 break;
362 }
363
364 memset(ptr, 0, 8);
365 if (sense_6) {
366 ptr[2] = 0x00; // WP enable: 0x80
367 i = 4;
368 } else {
369 ptr[3] = 0x00; // WP enable: 0x80
370 i = 8;
371 }
372
373 switch (page_code) {
374 case 0x0:
375 // vendor-specific mode
376 info->sense_key = 0x05;
377 info->sense_asc = 0x24;
378 info->sense_ascq = 0x00;
379 return USB_STOR_TRANSPORT_FAILED;
380
381 case 0x1:
382 memcpy(ptr + i, rw_err_page, sizeof(rw_err_page));
383 i += sizeof(rw_err_page);
384 break;
385
386 case 0x8:
387 memcpy(ptr + i, cache_page, sizeof(cache_page));
388 i += sizeof(cache_page);
389 break;
390
391 case 0x1B:
392 memcpy(ptr + i, rbac_page, sizeof(rbac_page));
393 i += sizeof(rbac_page);
394 break;
395
396 case 0x1C:
397 memcpy(ptr + i, timer_page, sizeof(timer_page));
398 i += sizeof(timer_page);
399 break;
400
401 case 0x3F:
402 memcpy(ptr + i, timer_page, sizeof(timer_page));
403 i += sizeof(timer_page);
404 memcpy(ptr + i, rbac_page, sizeof(rbac_page));
405 i += sizeof(rbac_page);
406 memcpy(ptr + i, cache_page, sizeof(cache_page));
407 i += sizeof(cache_page);
408 memcpy(ptr + i, rw_err_page, sizeof(rw_err_page));
409 i += sizeof(rw_err_page);
410 break;
411 }
412
413 if (sense_6)
414 ptr[0] = i - 1;
415 else
416 ((__be16 *) ptr)[0] = cpu_to_be16(i - 2);
417 usb_stor_set_xfer_buf(ptr, i, srb);
418
419 return USB_STOR_TRANSPORT_GOOD;
420}
421
422
423static void jumpshot_info_destructor(void *extra)
424{
425 // this routine is a placeholder...
426 // currently, we don't allocate any extra blocks so we're okay
427}
428
429
430
431// Transport for the Lexar 'Jumpshot'
432//
433int jumpshot_transport(struct scsi_cmnd * srb, struct us_data *us)
434{
435 struct jumpshot_info *info;
436 int rc;
437 unsigned long block, blocks;
438 unsigned char *ptr = us->iobuf;
439 static unsigned char inquiry_response[8] = {
440 0x00, 0x80, 0x00, 0x01, 0x1F, 0x00, 0x00, 0x00
441 };
442
443 if (!us->extra) {
Oliver Neukum887c2562006-01-08 12:33:45 +0100444 us->extra = kzalloc(sizeof(struct jumpshot_info), GFP_NOIO);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700445 if (!us->extra) {
446 US_DEBUGP("jumpshot_transport: Gah! Can't allocate storage for jumpshot info struct!\n");
447 return USB_STOR_TRANSPORT_ERROR;
448 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449 us->extra_destructor = jumpshot_info_destructor;
450 }
451
452 info = (struct jumpshot_info *) (us->extra);
453
454 if (srb->cmnd[0] == INQUIRY) {
455 US_DEBUGP("jumpshot_transport: INQUIRY. Returning bogus response.\n");
456 memcpy(ptr, inquiry_response, sizeof(inquiry_response));
457 fill_inquiry_response(us, ptr, 36);
458 return USB_STOR_TRANSPORT_GOOD;
459 }
460
461 if (srb->cmnd[0] == READ_CAPACITY) {
462 info->ssize = 0x200; // hard coded 512 byte sectors as per ATA spec
463
464 rc = jumpshot_get_status(us);
465 if (rc != USB_STOR_TRANSPORT_GOOD)
466 return rc;
467
468 rc = jumpshot_id_device(us, info);
469 if (rc != USB_STOR_TRANSPORT_GOOD)
470 return rc;
471
472 US_DEBUGP("jumpshot_transport: READ_CAPACITY: %ld sectors, %ld bytes per sector\n",
473 info->sectors, info->ssize);
474
475 // build the reply
476 //
477 ((__be32 *) ptr)[0] = cpu_to_be32(info->sectors - 1);
478 ((__be32 *) ptr)[1] = cpu_to_be32(info->ssize);
479 usb_stor_set_xfer_buf(ptr, 8, srb);
480
481 return USB_STOR_TRANSPORT_GOOD;
482 }
483
484 if (srb->cmnd[0] == MODE_SELECT_10) {
485 US_DEBUGP("jumpshot_transport: Gah! MODE_SELECT_10.\n");
486 return USB_STOR_TRANSPORT_ERROR;
487 }
488
489 if (srb->cmnd[0] == READ_10) {
490 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
491 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
492
493 blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
494
495 US_DEBUGP("jumpshot_transport: READ_10: read block 0x%04lx count %ld\n", block, blocks);
496 return jumpshot_read_data(us, info, block, blocks);
497 }
498
499 if (srb->cmnd[0] == READ_12) {
500 // I don't think we'll ever see a READ_12 but support it anyway...
501 //
502 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
503 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
504
505 blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
506 ((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
507
508 US_DEBUGP("jumpshot_transport: READ_12: read block 0x%04lx count %ld\n", block, blocks);
509 return jumpshot_read_data(us, info, block, blocks);
510 }
511
512 if (srb->cmnd[0] == WRITE_10) {
513 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
514 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
515
516 blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
517
518 US_DEBUGP("jumpshot_transport: WRITE_10: write block 0x%04lx count %ld\n", block, blocks);
519 return jumpshot_write_data(us, info, block, blocks);
520 }
521
522 if (srb->cmnd[0] == WRITE_12) {
523 // I don't think we'll ever see a WRITE_12 but support it anyway...
524 //
525 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
526 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
527
528 blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
529 ((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
530
531 US_DEBUGP("jumpshot_transport: WRITE_12: write block 0x%04lx count %ld\n", block, blocks);
532 return jumpshot_write_data(us, info, block, blocks);
533 }
534
535
536 if (srb->cmnd[0] == TEST_UNIT_READY) {
537 US_DEBUGP("jumpshot_transport: TEST_UNIT_READY.\n");
538 return jumpshot_get_status(us);
539 }
540
541 if (srb->cmnd[0] == REQUEST_SENSE) {
542 US_DEBUGP("jumpshot_transport: REQUEST_SENSE.\n");
543
544 memset(ptr, 0, 18);
545 ptr[0] = 0xF0;
546 ptr[2] = info->sense_key;
547 ptr[7] = 11;
548 ptr[12] = info->sense_asc;
549 ptr[13] = info->sense_ascq;
550 usb_stor_set_xfer_buf(ptr, 18, srb);
551
552 return USB_STOR_TRANSPORT_GOOD;
553 }
554
555 if (srb->cmnd[0] == MODE_SENSE) {
556 US_DEBUGP("jumpshot_transport: MODE_SENSE_6 detected\n");
557 return jumpshot_handle_mode_sense(us, srb, 1);
558 }
559
560 if (srb->cmnd[0] == MODE_SENSE_10) {
561 US_DEBUGP("jumpshot_transport: MODE_SENSE_10 detected\n");
562 return jumpshot_handle_mode_sense(us, srb, 0);
563 }
564
565 if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
566 // sure. whatever. not like we can stop the user from popping
567 // the media out of the device (no locking doors, etc)
568 //
569 return USB_STOR_TRANSPORT_GOOD;
570 }
571
572 if (srb->cmnd[0] == START_STOP) {
573 /* this is used by sd.c'check_scsidisk_media_change to detect
574 media change */
575 US_DEBUGP("jumpshot_transport: START_STOP.\n");
576 /* the first jumpshot_id_device after a media change returns
577 an error (determined experimentally) */
578 rc = jumpshot_id_device(us, info);
579 if (rc == USB_STOR_TRANSPORT_GOOD) {
580 info->sense_key = NO_SENSE;
581 srb->result = SUCCESS;
582 } else {
583 info->sense_key = UNIT_ATTENTION;
584 srb->result = SAM_STAT_CHECK_CONDITION;
585 }
586 return rc;
587 }
588
589 US_DEBUGP("jumpshot_transport: Gah! Unknown command: %d (0x%x)\n",
590 srb->cmnd[0], srb->cmnd[0]);
591 info->sense_key = 0x05;
592 info->sense_asc = 0x20;
593 info->sense_ascq = 0x00;
594 return USB_STOR_TRANSPORT_FAILED;
595}