1 // SPDX-License-Identifier: GPL-2.0+
3 * Driver for Lexar "Jumpshot" Compact Flash reader
5 * jumpshot driver v0.1:
9 * Current development and maintenance by:
12 * Many thanks to Robert Baruch for the SanDisk SmartMedia reader driver
13 * which I used as a template for this driver.
15 * Some bugfixes and scatter-gather code by Gregory P. Smith
20 * Developed with the assistance of:
26 * This driver attempts to support the Lexar Jumpshot USB CompactFlash
27 * reader. Like many other USB CompactFlash readers, the Jumpshot contains
30 * This driver supports reading and writing. If you're truly paranoid,
31 * however, you can force the driver into a write-protected state by setting
32 * the WP enable bits in jumpshot_handle_mode_sense. See the comments
36 #include <linux/errno.h>
37 #include <linux/module.h>
38 #include <linux/slab.h>
40 #include <scsi/scsi.h>
41 #include <scsi/scsi_cmnd.h>
44 #include "transport.h"
49 #define DRV_NAME "ums-jumpshot"
51 MODULE_DESCRIPTION("Driver for Lexar \"Jumpshot\" Compact Flash reader");
53 MODULE_LICENSE("GPL");
56 * The table of devices
58 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
59 vendorName, productName, useProtocol, useTransport, \
60 initFunction, flags) \
61 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
62 .driver_info = (flags) }
64 static struct usb_device_id jumpshot_usb_ids[] = {
65 # include "unusual_jumpshot.h"
66 { } /* Terminating entry */
68 MODULE_DEVICE_TABLE(usb, jumpshot_usb_ids);
75 #define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
76 vendor_name, product_name, use_protocol, use_transport, \
77 init_function, Flags) \
79 .vendorName = vendor_name, \
80 .productName = product_name, \
81 .useProtocol = use_protocol, \
82 .useTransport = use_transport, \
83 .initFunction = init_function, \
86 static struct us_unusual_dev jumpshot_unusual_dev_list[] = {
87 # include "unusual_jumpshot.h"
88 { } /* Terminating entry */
94 struct jumpshot_info {
95 unsigned long sectors; /* total sector count */
96 unsigned long ssize; /* sector size in bytes */
98 /* the following aren't used yet */
99 unsigned char sense_key;
100 unsigned long sense_asc; /* additional sense code */
101 unsigned long sense_ascq; /* additional sense code qualifier */
104 static inline int jumpshot_bulk_read(struct us_data *us,
109 return USB_STOR_XFER_GOOD;
111 usb_stor_dbg(us, "len = %d\n", len);
112 return usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
117 static inline int jumpshot_bulk_write(struct us_data *us,
122 return USB_STOR_XFER_GOOD;
124 usb_stor_dbg(us, "len = %d\n", len);
125 return usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe,
130 static int jumpshot_get_status(struct us_data *us)
135 return USB_STOR_TRANSPORT_ERROR;
138 rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
139 0, 0xA0, 0, 7, us->iobuf, 1);
141 if (rc != USB_STOR_XFER_GOOD)
142 return USB_STOR_TRANSPORT_ERROR;
144 if (us->iobuf[0] != 0x50) {
145 usb_stor_dbg(us, "0x%2x\n", us->iobuf[0]);
146 return USB_STOR_TRANSPORT_ERROR;
149 return USB_STOR_TRANSPORT_GOOD;
152 static int jumpshot_read_data(struct us_data *us,
153 struct jumpshot_info *info,
157 unsigned char *command = us->iobuf;
158 unsigned char *buffer;
159 unsigned char thistime;
160 unsigned int totallen, alloclen;
162 unsigned int sg_offset = 0;
163 struct scatterlist *sg = NULL;
165 // we're working in LBA mode. according to the ATA spec,
166 // we can support up to 28-bit addressing. I don't know if Jumpshot
167 // supports beyond 24-bit addressing. It's kind of hard to test
168 // since it requires > 8GB CF card.
170 if (sector > 0x0FFFFFFF)
171 return USB_STOR_TRANSPORT_ERROR;
173 totallen = sectors * info->ssize;
175 // Since we don't read more than 64 KB at a time, we have to create
176 // a bounce buffer and move the data a piece at a time between the
177 // bounce buffer and the actual transfer buffer.
179 alloclen = min(totallen, 65536u);
180 buffer = kmalloc(alloclen, GFP_NOIO);
182 return USB_STOR_TRANSPORT_ERROR;
185 // loop, never allocate or transfer more than 64k at once
186 // (min(128k, 255*info->ssize) is the real limit)
187 len = min(totallen, alloclen);
188 thistime = (len / info->ssize) & 0xff;
191 command[1] = thistime;
192 command[2] = sector & 0xFF;
193 command[3] = (sector >> 8) & 0xFF;
194 command[4] = (sector >> 16) & 0xFF;
196 command[5] = 0xE0 | ((sector >> 24) & 0x0F);
199 // send the setup + command
200 result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
201 0, 0x20, 0, 1, command, 7);
202 if (result != USB_STOR_XFER_GOOD)
206 result = jumpshot_bulk_read(us, buffer, len);
207 if (result != USB_STOR_XFER_GOOD)
210 usb_stor_dbg(us, "%d bytes\n", len);
212 // Store the data in the transfer buffer
213 usb_stor_access_xfer_buf(buffer, len, us->srb,
214 &sg, &sg_offset, TO_XFER_BUF);
218 } while (totallen > 0);
221 return USB_STOR_TRANSPORT_GOOD;
225 return USB_STOR_TRANSPORT_ERROR;
229 static int jumpshot_write_data(struct us_data *us,
230 struct jumpshot_info *info,
234 unsigned char *command = us->iobuf;
235 unsigned char *buffer;
236 unsigned char thistime;
237 unsigned int totallen, alloclen;
238 int len, result, waitcount;
239 unsigned int sg_offset = 0;
240 struct scatterlist *sg = NULL;
242 // we're working in LBA mode. according to the ATA spec,
243 // we can support up to 28-bit addressing. I don't know if Jumpshot
244 // supports beyond 24-bit addressing. It's kind of hard to test
245 // since it requires > 8GB CF card.
247 if (sector > 0x0FFFFFFF)
248 return USB_STOR_TRANSPORT_ERROR;
250 totallen = sectors * info->ssize;
252 // Since we don't write more than 64 KB at a time, we have to create
253 // a bounce buffer and move the data a piece at a time between the
254 // bounce buffer and the actual transfer buffer.
256 alloclen = min(totallen, 65536u);
257 buffer = kmalloc(alloclen, GFP_NOIO);
259 return USB_STOR_TRANSPORT_ERROR;
262 // loop, never allocate or transfer more than 64k at once
263 // (min(128k, 255*info->ssize) is the real limit)
265 len = min(totallen, alloclen);
266 thistime = (len / info->ssize) & 0xff;
268 // Get the data from the transfer buffer
269 usb_stor_access_xfer_buf(buffer, len, us->srb,
270 &sg, &sg_offset, FROM_XFER_BUF);
273 command[1] = thistime;
274 command[2] = sector & 0xFF;
275 command[3] = (sector >> 8) & 0xFF;
276 command[4] = (sector >> 16) & 0xFF;
278 command[5] = 0xE0 | ((sector >> 24) & 0x0F);
281 // send the setup + command
282 result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
283 0, 0x20, 0, 1, command, 7);
284 if (result != USB_STOR_XFER_GOOD)
288 result = jumpshot_bulk_write(us, buffer, len);
289 if (result != USB_STOR_XFER_GOOD)
292 // read the result. apparently the bulk write can complete
293 // before the jumpshot drive is finished writing. so we loop
294 // here until we get a good return code
297 result = jumpshot_get_status(us);
298 if (result != USB_STOR_TRANSPORT_GOOD) {
299 // I have not experimented to find the smallest value.
303 } while ((result != USB_STOR_TRANSPORT_GOOD) && (waitcount < 10));
305 if (result != USB_STOR_TRANSPORT_GOOD)
306 usb_stor_dbg(us, "Gah! Waitcount = 10. Bad write!?\n");
310 } while (totallen > 0);
317 return USB_STOR_TRANSPORT_ERROR;
320 static int jumpshot_id_device(struct us_data *us,
321 struct jumpshot_info *info)
323 unsigned char *command = us->iobuf;
324 unsigned char *reply;
328 return USB_STOR_TRANSPORT_ERROR;
332 reply = kmalloc(512, GFP_NOIO);
334 return USB_STOR_TRANSPORT_ERROR;
337 rc = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
338 0, 0x20, 0, 6, command, 2);
340 if (rc != USB_STOR_XFER_GOOD) {
341 usb_stor_dbg(us, "Gah! send_control for read_capacity failed\n");
342 rc = USB_STOR_TRANSPORT_ERROR;
347 rc = jumpshot_bulk_read(us, reply, 512);
348 if (rc != USB_STOR_XFER_GOOD) {
349 rc = USB_STOR_TRANSPORT_ERROR;
353 info->sectors = ((u32)(reply[117]) << 24) |
354 ((u32)(reply[116]) << 16) |
355 ((u32)(reply[115]) << 8) |
356 ((u32)(reply[114]) );
358 rc = USB_STOR_TRANSPORT_GOOD;
365 static int jumpshot_handle_mode_sense(struct us_data *us,
366 struct scsi_cmnd * srb,
369 static unsigned char rw_err_page[12] = {
370 0x1, 0xA, 0x21, 1, 0, 0, 0, 0, 1, 0, 0, 0
372 static unsigned char cache_page[12] = {
373 0x8, 0xA, 0x1, 0, 0, 0, 0, 0, 0, 0, 0, 0
375 static unsigned char rbac_page[12] = {
376 0x1B, 0xA, 0, 0x81, 0, 0, 0, 0, 0, 0, 0, 0
378 static unsigned char timer_page[8] = {
379 0x1C, 0x6, 0, 0, 0, 0
381 unsigned char pc, page_code;
383 struct jumpshot_info *info = (struct jumpshot_info *) (us->extra);
384 unsigned char *ptr = us->iobuf;
386 pc = srb->cmnd[2] >> 6;
387 page_code = srb->cmnd[2] & 0x3F;
391 usb_stor_dbg(us, "Current values\n");
394 usb_stor_dbg(us, "Changeable values\n");
397 usb_stor_dbg(us, "Default values\n");
400 usb_stor_dbg(us, "Saves values\n");
406 ptr[2] = 0x00; // WP enable: 0x80
409 ptr[3] = 0x00; // WP enable: 0x80
415 // vendor-specific mode
416 info->sense_key = 0x05;
417 info->sense_asc = 0x24;
418 info->sense_ascq = 0x00;
419 return USB_STOR_TRANSPORT_FAILED;
422 memcpy(ptr + i, rw_err_page, sizeof(rw_err_page));
423 i += sizeof(rw_err_page);
427 memcpy(ptr + i, cache_page, sizeof(cache_page));
428 i += sizeof(cache_page);
432 memcpy(ptr + i, rbac_page, sizeof(rbac_page));
433 i += sizeof(rbac_page);
437 memcpy(ptr + i, timer_page, sizeof(timer_page));
438 i += sizeof(timer_page);
442 memcpy(ptr + i, timer_page, sizeof(timer_page));
443 i += sizeof(timer_page);
444 memcpy(ptr + i, rbac_page, sizeof(rbac_page));
445 i += sizeof(rbac_page);
446 memcpy(ptr + i, cache_page, sizeof(cache_page));
447 i += sizeof(cache_page);
448 memcpy(ptr + i, rw_err_page, sizeof(rw_err_page));
449 i += sizeof(rw_err_page);
456 ((__be16 *) ptr)[0] = cpu_to_be16(i - 2);
457 usb_stor_set_xfer_buf(ptr, i, srb);
459 return USB_STOR_TRANSPORT_GOOD;
463 static void jumpshot_info_destructor(void *extra)
465 // this routine is a placeholder...
466 // currently, we don't allocate any extra blocks so we're okay
471 // Transport for the Lexar 'Jumpshot'
473 static int jumpshot_transport(struct scsi_cmnd *srb, struct us_data *us)
475 struct jumpshot_info *info;
477 unsigned long block, blocks;
478 unsigned char *ptr = us->iobuf;
479 static unsigned char inquiry_response[8] = {
480 0x00, 0x80, 0x00, 0x01, 0x1F, 0x00, 0x00, 0x00
484 us->extra = kzalloc(sizeof(struct jumpshot_info), GFP_NOIO);
486 return USB_STOR_TRANSPORT_ERROR;
488 us->extra_destructor = jumpshot_info_destructor;
491 info = (struct jumpshot_info *) (us->extra);
493 if (srb->cmnd[0] == INQUIRY) {
494 usb_stor_dbg(us, "INQUIRY - Returning bogus response\n");
495 memcpy(ptr, inquiry_response, sizeof(inquiry_response));
496 fill_inquiry_response(us, ptr, 36);
497 return USB_STOR_TRANSPORT_GOOD;
500 if (srb->cmnd[0] == READ_CAPACITY) {
501 info->ssize = 0x200; // hard coded 512 byte sectors as per ATA spec
503 rc = jumpshot_get_status(us);
504 if (rc != USB_STOR_TRANSPORT_GOOD)
507 rc = jumpshot_id_device(us, info);
508 if (rc != USB_STOR_TRANSPORT_GOOD)
511 usb_stor_dbg(us, "READ_CAPACITY: %ld sectors, %ld bytes per sector\n",
512 info->sectors, info->ssize);
516 ((__be32 *) ptr)[0] = cpu_to_be32(info->sectors - 1);
517 ((__be32 *) ptr)[1] = cpu_to_be32(info->ssize);
518 usb_stor_set_xfer_buf(ptr, 8, srb);
520 return USB_STOR_TRANSPORT_GOOD;
523 if (srb->cmnd[0] == MODE_SELECT_10) {
524 usb_stor_dbg(us, "Gah! MODE_SELECT_10\n");
525 return USB_STOR_TRANSPORT_ERROR;
528 if (srb->cmnd[0] == READ_10) {
529 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
530 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
532 blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
534 usb_stor_dbg(us, "READ_10: read block 0x%04lx count %ld\n",
536 return jumpshot_read_data(us, info, block, blocks);
539 if (srb->cmnd[0] == READ_12) {
540 // I don't think we'll ever see a READ_12 but support it anyway...
542 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
543 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
545 blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
546 ((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
548 usb_stor_dbg(us, "READ_12: read block 0x%04lx count %ld\n",
550 return jumpshot_read_data(us, info, block, blocks);
553 if (srb->cmnd[0] == WRITE_10) {
554 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
555 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
557 blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
559 usb_stor_dbg(us, "WRITE_10: write block 0x%04lx count %ld\n",
561 return jumpshot_write_data(us, info, block, blocks);
564 if (srb->cmnd[0] == WRITE_12) {
565 // I don't think we'll ever see a WRITE_12 but support it anyway...
567 block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
568 ((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
570 blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
571 ((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
573 usb_stor_dbg(us, "WRITE_12: write block 0x%04lx count %ld\n",
575 return jumpshot_write_data(us, info, block, blocks);
579 if (srb->cmnd[0] == TEST_UNIT_READY) {
580 usb_stor_dbg(us, "TEST_UNIT_READY\n");
581 return jumpshot_get_status(us);
584 if (srb->cmnd[0] == REQUEST_SENSE) {
585 usb_stor_dbg(us, "REQUEST_SENSE\n");
589 ptr[2] = info->sense_key;
591 ptr[12] = info->sense_asc;
592 ptr[13] = info->sense_ascq;
593 usb_stor_set_xfer_buf(ptr, 18, srb);
595 return USB_STOR_TRANSPORT_GOOD;
598 if (srb->cmnd[0] == MODE_SENSE) {
599 usb_stor_dbg(us, "MODE_SENSE_6 detected\n");
600 return jumpshot_handle_mode_sense(us, srb, 1);
603 if (srb->cmnd[0] == MODE_SENSE_10) {
604 usb_stor_dbg(us, "MODE_SENSE_10 detected\n");
605 return jumpshot_handle_mode_sense(us, srb, 0);
608 if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
610 * sure. whatever. not like we can stop the user from popping
611 * the media out of the device (no locking doors, etc)
613 return USB_STOR_TRANSPORT_GOOD;
616 if (srb->cmnd[0] == START_STOP) {
618 * this is used by sd.c'check_scsidisk_media_change to detect
621 usb_stor_dbg(us, "START_STOP\n");
623 * the first jumpshot_id_device after a media change returns
624 * an error (determined experimentally)
626 rc = jumpshot_id_device(us, info);
627 if (rc == USB_STOR_TRANSPORT_GOOD) {
628 info->sense_key = NO_SENSE;
629 srb->result = SUCCESS;
631 info->sense_key = UNIT_ATTENTION;
632 srb->result = SAM_STAT_CHECK_CONDITION;
637 usb_stor_dbg(us, "Gah! Unknown command: %d (0x%x)\n",
638 srb->cmnd[0], srb->cmnd[0]);
639 info->sense_key = 0x05;
640 info->sense_asc = 0x20;
641 info->sense_ascq = 0x00;
642 return USB_STOR_TRANSPORT_FAILED;
645 static struct scsi_host_template jumpshot_host_template;
647 static int jumpshot_probe(struct usb_interface *intf,
648 const struct usb_device_id *id)
653 result = usb_stor_probe1(&us, intf, id,
654 (id - jumpshot_usb_ids) + jumpshot_unusual_dev_list,
655 &jumpshot_host_template);
659 us->transport_name = "Lexar Jumpshot Control/Bulk";
660 us->transport = jumpshot_transport;
661 us->transport_reset = usb_stor_Bulk_reset;
664 result = usb_stor_probe2(us);
668 static struct usb_driver jumpshot_driver = {
670 .probe = jumpshot_probe,
671 .disconnect = usb_stor_disconnect,
672 .suspend = usb_stor_suspend,
673 .resume = usb_stor_resume,
674 .reset_resume = usb_stor_reset_resume,
675 .pre_reset = usb_stor_pre_reset,
676 .post_reset = usb_stor_post_reset,
677 .id_table = jumpshot_usb_ids,
682 module_usb_stor_driver(jumpshot_driver, jumpshot_host_template, DRV_NAME);