xref: /linux/drivers/usb/storage/sddr55.c (revision 7fc2cd2e4b398c57c9cf961cfea05eadbf34c05c)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Driver for SanDisk SDDR-55 SmartMedia reader
4  *
5  * SDDR55 driver v0.1:
6  *
7  * First release
8  *
9  * Current development and maintenance by:
10  *   (c) 2002 Simon Munton
11  */
12 
13 #include <linux/jiffies.h>
14 #include <linux/errno.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 
18 #include <scsi/scsi.h>
19 #include <scsi/scsi_cmnd.h>
20 
21 #include "usb.h"
22 #include "transport.h"
23 #include "protocol.h"
24 #include "debug.h"
25 #include "scsiglue.h"
26 
27 #define DRV_NAME "ums-sddr55"
28 
29 MODULE_DESCRIPTION("Driver for SanDisk SDDR-55 SmartMedia reader");
30 MODULE_AUTHOR("Simon Munton");
31 MODULE_LICENSE("GPL");
32 MODULE_IMPORT_NS("USB_STORAGE");
33 
34 /*
35  * The table of devices
36  */
37 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
38 		    vendorName, productName, useProtocol, useTransport, \
39 		    initFunction, flags) \
40 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
41   .driver_info = (flags) }
42 
43 static const struct usb_device_id sddr55_usb_ids[] = {
44 #	include "unusual_sddr55.h"
45 	{ }		/* Terminating entry */
46 };
47 MODULE_DEVICE_TABLE(usb, sddr55_usb_ids);
48 
49 #undef UNUSUAL_DEV
50 
51 /*
52  * The flags table
53  */
54 #define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
55 		    vendor_name, product_name, use_protocol, use_transport, \
56 		    init_function, Flags) \
57 { \
58 	.vendorName = vendor_name,	\
59 	.productName = product_name,	\
60 	.useProtocol = use_protocol,	\
61 	.useTransport = use_transport,	\
62 	.initFunction = init_function,	\
63 }
64 
65 static const struct us_unusual_dev sddr55_unusual_dev_list[] = {
66 #	include "unusual_sddr55.h"
67 	{ }		/* Terminating entry */
68 };
69 
70 #undef UNUSUAL_DEV
71 
72 
73 #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) )
74 #define LSB_of(s) ((s)&0xFF)
75 #define MSB_of(s) ((s)>>8)
76 #define PAGESIZE  512
77 
78 #define set_sense_info(sk, asc, ascq)	\
79     do {				\
80 	info->sense_data[2] = sk;	\
81 	info->sense_data[12] = asc;	\
82 	info->sense_data[13] = ascq;	\
83 	} while (0)
84 
85 
86 struct sddr55_card_info {
87 	unsigned long	capacity;	/* Size of card in bytes */
88 	int		max_log_blks;	/* maximum number of logical blocks */
89 	int		pageshift;	/* log2 of pagesize */
90 	int		smallpageshift;	/* 1 if pagesize == 256 */
91 	int		blocksize;	/* Size of block in pages */
92 	int		blockshift;	/* log2 of blocksize */
93 	int		blockmask;	/* 2^blockshift - 1 */
94 	int		read_only;	/* non zero if card is write protected */
95 	int		force_read_only;	/* non zero if we find a map error*/
96 	int		*lba_to_pba;	/* logical to physical map */
97 	int		*pba_to_lba;	/* physical to logical map */
98 	int		fatal_error;	/* set if we detect something nasty */
99 	unsigned long 	last_access;	/* number of jiffies since we last talked to device */
100 	unsigned char   sense_data[18];
101 };
102 
103 
104 #define NOT_ALLOCATED		0xffffffff
105 #define BAD_BLOCK		0xffff
106 #define CIS_BLOCK		0x400
107 #define UNUSED_BLOCK		0x3ff
108 
109 static int
110 sddr55_bulk_transport(struct us_data *us, int direction,
111 		      unsigned char *data, unsigned int len) {
112 	struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
113 	unsigned int pipe = (direction == DMA_FROM_DEVICE) ?
114 			us->recv_bulk_pipe : us->send_bulk_pipe;
115 
116 	if (!len)
117 		return USB_STOR_XFER_GOOD;
118 	info->last_access = jiffies;
119 	return usb_stor_bulk_transfer_buf(us, pipe, data, len, NULL);
120 }
121 
122 /*
123  * check if card inserted, if there is, update read_only status
124  * return non zero if no card
125  */
126 
127 static int sddr55_status(struct us_data *us)
128 {
129 	int result;
130 	unsigned char *command = us->iobuf;
131 	unsigned char *status = us->iobuf;
132 	struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
133 
134 	/* send command */
135 	memset(command, 0, 8);
136 	command[5] = 0xB0;
137 	command[7] = 0x80;
138 	result = sddr55_bulk_transport(us,
139 		DMA_TO_DEVICE, command, 8);
140 
141 	usb_stor_dbg(us, "Result for send_command in status %d\n", result);
142 
143 	if (result != USB_STOR_XFER_GOOD) {
144 		set_sense_info (4, 0, 0);	/* hardware error */
145 		return USB_STOR_TRANSPORT_ERROR;
146 	}
147 
148 	result = sddr55_bulk_transport(us,
149 		DMA_FROM_DEVICE, status,	4);
150 
151 	/* expect to get short transfer if no card fitted */
152 	if (result == USB_STOR_XFER_SHORT || result == USB_STOR_XFER_STALLED) {
153 		/* had a short transfer, no card inserted, free map memory */
154 		kfree(info->lba_to_pba);
155 		kfree(info->pba_to_lba);
156 		info->lba_to_pba = NULL;
157 		info->pba_to_lba = NULL;
158 
159 		info->fatal_error = 0;
160 		info->force_read_only = 0;
161 
162 		set_sense_info (2, 0x3a, 0);	/* not ready, medium not present */
163 		return USB_STOR_TRANSPORT_FAILED;
164 	}
165 
166 	if (result != USB_STOR_XFER_GOOD) {
167 		set_sense_info (4, 0, 0);	/* hardware error */
168 		return USB_STOR_TRANSPORT_FAILED;
169 	}
170 
171 	/* check write protect status */
172 	info->read_only = (status[0] & 0x20);
173 
174 	/* now read status */
175 	result = sddr55_bulk_transport(us,
176 		DMA_FROM_DEVICE, status,	2);
177 
178 	if (result != USB_STOR_XFER_GOOD) {
179 		set_sense_info (4, 0, 0);	/* hardware error */
180 	}
181 
182 	return (result == USB_STOR_XFER_GOOD ?
183 			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_FAILED);
184 }
185 
186 
187 static int sddr55_read_data(struct us_data *us,
188 		unsigned int lba,
189 		unsigned int page,
190 		unsigned short sectors) {
191 
192 	int result = USB_STOR_TRANSPORT_GOOD;
193 	unsigned char *command = us->iobuf;
194 	unsigned char *status = us->iobuf;
195 	struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
196 	unsigned char *buffer;
197 
198 	unsigned int pba;
199 	unsigned int address;
200 
201 	unsigned short pages;
202 	unsigned int len, offset;
203 	struct scatterlist *sg;
204 
205 	// Since we only read in one block at a time, we have to create
206 	// a bounce buffer and move the data a piece at a time between the
207 	// bounce buffer and the actual transfer buffer.
208 
209 	len = min_t(unsigned int, sectors, info->blocksize >>
210 			info->smallpageshift) * PAGESIZE;
211 	buffer = kmalloc(len, GFP_NOIO);
212 	if (buffer == NULL)
213 		return USB_STOR_TRANSPORT_ERROR; /* out of memory */
214 	offset = 0;
215 	sg = NULL;
216 
217 	while (sectors>0) {
218 
219 		/* have we got to end? */
220 		if (lba >= info->max_log_blks)
221 			break;
222 
223 		pba = info->lba_to_pba[lba];
224 
225 		// Read as many sectors as possible in this block
226 
227 		pages = min_t(unsigned int, sectors << info->smallpageshift,
228 				info->blocksize - page);
229 		len = pages << info->pageshift;
230 
231 		usb_stor_dbg(us, "Read %02X pages, from PBA %04X (LBA %04X) page %02X\n",
232 			     pages, pba, lba, page);
233 
234 		if (pba == NOT_ALLOCATED) {
235 			/* no pba for this lba, fill with zeroes */
236 			memset (buffer, 0, len);
237 		} else {
238 
239 			address = (pba << info->blockshift) + page;
240 
241 			command[0] = 0;
242 			command[1] = LSB_of(address>>16);
243 			command[2] = LSB_of(address>>8);
244 			command[3] = LSB_of(address);
245 
246 			command[4] = 0;
247 			command[5] = 0xB0;
248 			command[6] = LSB_of(pages << (1 - info->smallpageshift));
249 			command[7] = 0x85;
250 
251 			/* send command */
252 			result = sddr55_bulk_transport(us,
253 				DMA_TO_DEVICE, command, 8);
254 
255 			usb_stor_dbg(us, "Result for send_command in read_data %d\n",
256 				     result);
257 
258 			if (result != USB_STOR_XFER_GOOD) {
259 				result = USB_STOR_TRANSPORT_ERROR;
260 				goto leave;
261 			}
262 
263 			/* read data */
264 			result = sddr55_bulk_transport(us,
265 				DMA_FROM_DEVICE, buffer, len);
266 
267 			if (result != USB_STOR_XFER_GOOD) {
268 				result = USB_STOR_TRANSPORT_ERROR;
269 				goto leave;
270 			}
271 
272 			/* now read status */
273 			result = sddr55_bulk_transport(us,
274 				DMA_FROM_DEVICE, status, 2);
275 
276 			if (result != USB_STOR_XFER_GOOD) {
277 				result = USB_STOR_TRANSPORT_ERROR;
278 				goto leave;
279 			}
280 
281 			/* check status for error */
282 			if (status[0] == 0xff && status[1] == 0x4) {
283 				set_sense_info (3, 0x11, 0);
284 				result = USB_STOR_TRANSPORT_FAILED;
285 				goto leave;
286 			}
287 		}
288 
289 		// Store the data in the transfer buffer
290 		usb_stor_access_xfer_buf(buffer, len, us->srb,
291 				&sg, &offset, TO_XFER_BUF);
292 
293 		page = 0;
294 		lba++;
295 		sectors -= pages >> info->smallpageshift;
296 	}
297 
298 	result = USB_STOR_TRANSPORT_GOOD;
299 
300 leave:
301 	kfree(buffer);
302 
303 	return result;
304 }
305 
306 static int sddr55_write_data(struct us_data *us,
307 		unsigned int lba,
308 		unsigned int page,
309 		unsigned short sectors) {
310 
311 	int result = USB_STOR_TRANSPORT_GOOD;
312 	unsigned char *command = us->iobuf;
313 	unsigned char *status = us->iobuf;
314 	struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
315 	unsigned char *buffer;
316 
317 	unsigned int pba;
318 	unsigned int new_pba;
319 	unsigned int address;
320 
321 	unsigned short pages;
322 	int i;
323 	unsigned int len, offset;
324 	struct scatterlist *sg;
325 
326 	/* check if we are allowed to write */
327 	if (info->read_only || info->force_read_only) {
328 		set_sense_info (7, 0x27, 0);	/* read only */
329 		return USB_STOR_TRANSPORT_FAILED;
330 	}
331 
332 	// Since we only write one block at a time, we have to create
333 	// a bounce buffer and move the data a piece at a time between the
334 	// bounce buffer and the actual transfer buffer.
335 
336 	len = min_t(unsigned int, sectors, info->blocksize >>
337 			info->smallpageshift) * PAGESIZE;
338 	buffer = kmalloc(len, GFP_NOIO);
339 	if (buffer == NULL)
340 		return USB_STOR_TRANSPORT_ERROR;
341 	offset = 0;
342 	sg = NULL;
343 
344 	while (sectors > 0) {
345 
346 		/* have we got to end? */
347 		if (lba >= info->max_log_blks)
348 			break;
349 
350 		pba = info->lba_to_pba[lba];
351 
352 		// Write as many sectors as possible in this block
353 
354 		pages = min_t(unsigned int, sectors << info->smallpageshift,
355 				info->blocksize - page);
356 		len = pages << info->pageshift;
357 
358 		// Get the data from the transfer buffer
359 		usb_stor_access_xfer_buf(buffer, len, us->srb,
360 				&sg, &offset, FROM_XFER_BUF);
361 
362 		usb_stor_dbg(us, "Write %02X pages, to PBA %04X (LBA %04X) page %02X\n",
363 			     pages, pba, lba, page);
364 
365 		command[4] = 0;
366 
367 		if (pba == NOT_ALLOCATED) {
368 			/* no pba allocated for this lba, find a free pba to use */
369 
370 			int max_pba = (info->max_log_blks / 250 ) * 256;
371 			int found_count = 0;
372 			int found_pba = -1;
373 
374 			/* set pba to first block in zone lba is in */
375 			pba = (lba / 1000) * 1024;
376 
377 			usb_stor_dbg(us, "No PBA for LBA %04X\n", lba);
378 
379 			if (max_pba > 1024)
380 				max_pba = 1024;
381 
382 			/*
383 			 * Scan through the map looking for an unused block
384 			 * leave 16 unused blocks at start (or as many as
385 			 * possible) since the sddr55 seems to reuse a used
386 			 * block when it shouldn't if we don't leave space.
387 			 */
388 			for (i = 0; i < max_pba; i++, pba++) {
389 				if (info->pba_to_lba[pba] == UNUSED_BLOCK) {
390 					found_pba = pba;
391 					if (found_count++ > 16)
392 						break;
393 				}
394 			}
395 
396 			pba = found_pba;
397 
398 			if (pba == -1) {
399 				/* oh dear */
400 				usb_stor_dbg(us, "Couldn't find unallocated block\n");
401 
402 				set_sense_info (3, 0x31, 0);	/* medium error */
403 				result = USB_STOR_TRANSPORT_FAILED;
404 				goto leave;
405 			}
406 
407 			usb_stor_dbg(us, "Allocating PBA %04X for LBA %04X\n",
408 				     pba, lba);
409 
410 			/* set writing to unallocated block flag */
411 			command[4] = 0x40;
412 		}
413 
414 		address = (pba << info->blockshift) + page;
415 
416 		command[1] = LSB_of(address>>16);
417 		command[2] = LSB_of(address>>8);
418 		command[3] = LSB_of(address);
419 
420 		/* set the lba into the command, modulo 1000 */
421 		command[0] = LSB_of(lba % 1000);
422 		command[6] = MSB_of(lba % 1000);
423 
424 		command[4] |= LSB_of(pages >> info->smallpageshift);
425 		command[5] = 0xB0;
426 		command[7] = 0x86;
427 
428 		/* send command */
429 		result = sddr55_bulk_transport(us,
430 			DMA_TO_DEVICE, command, 8);
431 
432 		if (result != USB_STOR_XFER_GOOD) {
433 			usb_stor_dbg(us, "Result for send_command in write_data %d\n",
434 				     result);
435 
436 			/* set_sense_info is superfluous here? */
437 			set_sense_info (3, 0x3, 0);/* peripheral write error */
438 			result = USB_STOR_TRANSPORT_FAILED;
439 			goto leave;
440 		}
441 
442 		/* send the data */
443 		result = sddr55_bulk_transport(us,
444 			DMA_TO_DEVICE, buffer, len);
445 
446 		if (result != USB_STOR_XFER_GOOD) {
447 			usb_stor_dbg(us, "Result for send_data in write_data %d\n",
448 				     result);
449 
450 			/* set_sense_info is superfluous here? */
451 			set_sense_info (3, 0x3, 0);/* peripheral write error */
452 			result = USB_STOR_TRANSPORT_FAILED;
453 			goto leave;
454 		}
455 
456 		/* now read status */
457 		result = sddr55_bulk_transport(us, DMA_FROM_DEVICE, status, 6);
458 
459 		if (result != USB_STOR_XFER_GOOD) {
460 			usb_stor_dbg(us, "Result for get_status in write_data %d\n",
461 				     result);
462 
463 			/* set_sense_info is superfluous here? */
464 			set_sense_info (3, 0x3, 0);/* peripheral write error */
465 			result = USB_STOR_TRANSPORT_FAILED;
466 			goto leave;
467 		}
468 
469 		new_pba = (status[3] + (status[4] << 8) + (status[5] << 16))
470 						  >> info->blockshift;
471 
472 		/* check if device-reported new_pba is out of range */
473 		if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) {
474 			result = USB_STOR_TRANSPORT_FAILED;
475 			goto leave;
476 		}
477 
478 		/* check status for error */
479 		if (status[0] == 0xff && status[1] == 0x4) {
480 			info->pba_to_lba[new_pba] = BAD_BLOCK;
481 
482 			set_sense_info (3, 0x0c, 0);
483 			result = USB_STOR_TRANSPORT_FAILED;
484 			goto leave;
485 		}
486 
487 		usb_stor_dbg(us, "Updating maps for LBA %04X: old PBA %04X, new PBA %04X\n",
488 			     lba, pba, new_pba);
489 
490 		/* update the lba<->pba maps, note new_pba might be the same as pba */
491 		info->lba_to_pba[lba] = new_pba;
492 		info->pba_to_lba[pba] = UNUSED_BLOCK;
493 
494 		/* check that new_pba wasn't already being used */
495 		if (info->pba_to_lba[new_pba] != UNUSED_BLOCK) {
496 			printk(KERN_ERR "sddr55 error: new PBA %04X already in use for LBA %04X\n",
497 				new_pba, info->pba_to_lba[new_pba]);
498 			info->fatal_error = 1;
499 			set_sense_info (3, 0x31, 0);
500 			result = USB_STOR_TRANSPORT_FAILED;
501 			goto leave;
502 		}
503 
504 		/* update the pba<->lba maps for new_pba */
505 		info->pba_to_lba[new_pba] = lba % 1000;
506 
507 		page = 0;
508 		lba++;
509 		sectors -= pages >> info->smallpageshift;
510 	}
511 	result = USB_STOR_TRANSPORT_GOOD;
512 
513  leave:
514 	kfree(buffer);
515 	return result;
516 }
517 
518 static int sddr55_read_deviceID(struct us_data *us,
519 		unsigned char *manufacturerID,
520 		unsigned char *deviceID) {
521 
522 	int result;
523 	unsigned char *command = us->iobuf;
524 	unsigned char *content = us->iobuf;
525 
526 	memset(command, 0, 8);
527 	command[5] = 0xB0;
528 	command[7] = 0x84;
529 	result = sddr55_bulk_transport(us, DMA_TO_DEVICE, command, 8);
530 
531 	usb_stor_dbg(us, "Result of send_control for device ID is %d\n",
532 		     result);
533 
534 	if (result != USB_STOR_XFER_GOOD)
535 		return USB_STOR_TRANSPORT_ERROR;
536 
537 	result = sddr55_bulk_transport(us,
538 		DMA_FROM_DEVICE, content, 4);
539 
540 	if (result != USB_STOR_XFER_GOOD)
541 		return USB_STOR_TRANSPORT_ERROR;
542 
543 	*manufacturerID = content[0];
544 	*deviceID = content[1];
545 
546 	if (content[0] != 0xff)	{
547     		result = sddr55_bulk_transport(us,
548 			DMA_FROM_DEVICE, content, 2);
549 	}
550 
551 	return USB_STOR_TRANSPORT_GOOD;
552 }
553 
554 
555 static int sddr55_reset(struct us_data *us)
556 {
557 	return 0;
558 }
559 
560 
561 static unsigned long sddr55_get_capacity(struct us_data *us) {
562 
563 	unsigned char manufacturerID;
564 	unsigned char deviceID;
565 	int result;
566 	struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
567 
568 	usb_stor_dbg(us, "Reading capacity...\n");
569 
570 	result = sddr55_read_deviceID(us,
571 		&manufacturerID,
572 		&deviceID);
573 
574 	usb_stor_dbg(us, "Result of read_deviceID is %d\n", result);
575 
576 	if (result != USB_STOR_XFER_GOOD)
577 		return 0;
578 
579 	usb_stor_dbg(us, "Device ID = %02X\n", deviceID);
580 	usb_stor_dbg(us, "Manuf  ID = %02X\n", manufacturerID);
581 
582 	info->pageshift = 9;
583 	info->smallpageshift = 0;
584 	info->blocksize = 16;
585 	info->blockshift = 4;
586 	info->blockmask = 15;
587 
588 	switch (deviceID) {
589 
590 	case 0x6e: // 1MB
591 	case 0xe8:
592 	case 0xec:
593 		info->pageshift = 8;
594 		info->smallpageshift = 1;
595 		return 0x00100000;
596 
597 	case 0xea: // 2MB
598 	case 0x64:
599 		info->pageshift = 8;
600 		info->smallpageshift = 1;
601 		fallthrough;
602 	case 0x5d: // 5d is a ROM card with pagesize 512.
603 		return 0x00200000;
604 
605 	case 0xe3: // 4MB
606 	case 0xe5:
607 	case 0x6b:
608 	case 0xd5:
609 		return 0x00400000;
610 
611 	case 0xe6: // 8MB
612 	case 0xd6:
613 		return 0x00800000;
614 
615 	case 0x73: // 16MB
616 		info->blocksize = 32;
617 		info->blockshift = 5;
618 		info->blockmask = 31;
619 		return 0x01000000;
620 
621 	case 0x75: // 32MB
622 		info->blocksize = 32;
623 		info->blockshift = 5;
624 		info->blockmask = 31;
625 		return 0x02000000;
626 
627 	case 0x76: // 64MB
628 		info->blocksize = 32;
629 		info->blockshift = 5;
630 		info->blockmask = 31;
631 		return 0x04000000;
632 
633 	case 0x79: // 128MB
634 		info->blocksize = 32;
635 		info->blockshift = 5;
636 		info->blockmask = 31;
637 		return 0x08000000;
638 
639 	default: // unknown
640 		return 0;
641 
642 	}
643 }
644 
645 static int sddr55_read_map(struct us_data *us) {
646 
647 	struct sddr55_card_info *info = (struct sddr55_card_info *)(us->extra);
648 	int numblocks;
649 	unsigned char *buffer;
650 	unsigned char *command = us->iobuf;
651 	int i;
652 	unsigned short lba;
653 	unsigned short max_lba;
654 	int result;
655 
656 	if (!info->capacity)
657 		return -1;
658 
659 	numblocks = info->capacity >> (info->blockshift + info->pageshift);
660 
661 	buffer = kmalloc_array(numblocks, 2, GFP_NOIO );
662 
663 	if (!buffer)
664 		return -1;
665 
666 	memset(command, 0, 8);
667 	command[5] = 0xB0;
668 	command[6] = numblocks * 2 / 256;
669 	command[7] = 0x8A;
670 
671 	result = sddr55_bulk_transport(us, DMA_TO_DEVICE, command, 8);
672 
673 	if ( result != USB_STOR_XFER_GOOD) {
674 		kfree (buffer);
675 		return -1;
676 	}
677 
678 	result = sddr55_bulk_transport(us, DMA_FROM_DEVICE, buffer, numblocks * 2);
679 
680 	if ( result != USB_STOR_XFER_GOOD) {
681 		kfree (buffer);
682 		return -1;
683 	}
684 
685 	result = sddr55_bulk_transport(us, DMA_FROM_DEVICE, command, 2);
686 
687 	if ( result != USB_STOR_XFER_GOOD) {
688 		kfree (buffer);
689 		return -1;
690 	}
691 
692 	kfree(info->lba_to_pba);
693 	kfree(info->pba_to_lba);
694 	info->lba_to_pba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
695 	info->pba_to_lba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
696 
697 	if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
698 		kfree(info->lba_to_pba);
699 		kfree(info->pba_to_lba);
700 		info->lba_to_pba = NULL;
701 		info->pba_to_lba = NULL;
702 		kfree(buffer);
703 		return -1;
704 	}
705 
706 	memset(info->lba_to_pba, 0xff, numblocks*sizeof(int));
707 	memset(info->pba_to_lba, 0xff, numblocks*sizeof(int));
708 
709 	/* set maximum lba */
710 	max_lba = info->max_log_blks;
711 	if (max_lba > 1000)
712 		max_lba = 1000;
713 
714 	/*
715 	 * Each block is 64 bytes of control data, so block i is located in
716 	 * scatterlist block i*64/128k = i*(2^6)*(2^-17) = i*(2^-11)
717 	 */
718 
719 	for (i=0; i<numblocks; i++) {
720 		int zone = i / 1024;
721 
722 		lba = short_pack(buffer[i * 2], buffer[i * 2 + 1]);
723 
724 			/*
725 			 * Every 1024 physical blocks ("zone"), the LBA numbers
726 			 * go back to zero, but are within a higher
727 			 * block of LBA's. Also, there is a maximum of
728 			 * 1000 LBA's per zone. In other words, in PBA
729 			 * 1024-2047 you will find LBA 0-999 which are
730 			 * really LBA 1000-1999. Yes, this wastes 24
731 			 * physical blocks per zone. Go figure.
732 			 * These devices can have blocks go bad, so there
733 			 * are 24 spare blocks to use when blocks do go bad.
734 			 */
735 
736 			/*
737 			 * SDDR55 returns 0xffff for a bad block, and 0x400 for the
738 			 * CIS block. (Is this true for cards 8MB or less??)
739 			 * Record these in the physical to logical map
740 			 */
741 
742 		info->pba_to_lba[i] = lba;
743 
744 		if (lba >= max_lba) {
745 			continue;
746 		}
747 
748 		if (info->lba_to_pba[lba + zone * 1000] != NOT_ALLOCATED &&
749 		    !info->force_read_only) {
750 			printk(KERN_WARNING
751 			       "sddr55: map inconsistency at LBA %04X\n",
752 			       lba + zone * 1000);
753 			info->force_read_only = 1;
754 		}
755 
756 		if (lba<0x10 || (lba>=0x3E0 && lba<0x3EF))
757 			usb_stor_dbg(us, "LBA %04X <-> PBA %04X\n", lba, i);
758 
759 		info->lba_to_pba[lba + zone * 1000] = i;
760 	}
761 
762 	kfree(buffer);
763 	return 0;
764 }
765 
766 
767 static void sddr55_card_info_destructor(void *extra) {
768 	struct sddr55_card_info *info = (struct sddr55_card_info *)extra;
769 
770 	if (!extra)
771 		return;
772 
773 	kfree(info->lba_to_pba);
774 	kfree(info->pba_to_lba);
775 }
776 
777 
778 /*
779  * Transport for the Sandisk SDDR-55
780  */
781 static int sddr55_transport(struct scsi_cmnd *srb, struct us_data *us)
782 {
783 	int result;
784 	static const unsigned char inquiry_response[8] = {
785 		0x00, 0x80, 0x00, 0x02, 0x1F, 0x00, 0x00, 0x00
786 	};
787  	// write-protected for now, no block descriptor support
788 	static const unsigned char mode_page_01[20] = {
789 		0x0, 0x12, 0x00, 0x80, 0x0, 0x0, 0x0, 0x0,
790 		0x01, 0x0A,
791 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
792 	};
793 	unsigned char *ptr = us->iobuf;
794 	unsigned long capacity;
795 	unsigned int lba;
796 	unsigned int pba;
797 	unsigned int page;
798 	unsigned short pages;
799 	struct sddr55_card_info *info;
800 
801 	if (!us->extra) {
802 		us->extra = kzalloc(
803 			sizeof(struct sddr55_card_info), GFP_NOIO);
804 		if (!us->extra)
805 			return USB_STOR_TRANSPORT_ERROR;
806 		us->extra_destructor = sddr55_card_info_destructor;
807 	}
808 
809 	info = (struct sddr55_card_info *)(us->extra);
810 
811 	if (srb->cmnd[0] == REQUEST_SENSE) {
812 		usb_stor_dbg(us, "request sense %02x/%02x/%02x\n",
813 			     info->sense_data[2],
814 			     info->sense_data[12],
815 			     info->sense_data[13]);
816 
817 		memcpy (ptr, info->sense_data, sizeof info->sense_data);
818 		ptr[0] = 0x70;
819 		ptr[7] = 11;
820 		usb_stor_set_xfer_buf (ptr, sizeof info->sense_data, srb);
821 		memset (info->sense_data, 0, sizeof info->sense_data);
822 
823 		return USB_STOR_TRANSPORT_GOOD;
824 	}
825 
826 	memset (info->sense_data, 0, sizeof info->sense_data);
827 
828 	/*
829 	 * Dummy up a response for INQUIRY since SDDR55 doesn't
830 	 * respond to INQUIRY commands
831 	 */
832 
833 	if (srb->cmnd[0] == INQUIRY) {
834 		memcpy(ptr, inquiry_response, 8);
835 		fill_inquiry_response(us, ptr, 36);
836 		return USB_STOR_TRANSPORT_GOOD;
837 	}
838 
839 	/*
840 	 * only check card status if the map isn't allocated, ie no card seen yet
841 	 * or if it's been over half a second since we last accessed it
842 	 */
843 	if (info->lba_to_pba == NULL || time_after(jiffies, info->last_access + HZ/2)) {
844 
845 		/* check to see if a card is fitted */
846 		result = sddr55_status (us);
847 		if (result) {
848 			result = sddr55_status (us);
849 			if (!result) {
850 			set_sense_info (6, 0x28, 0);	/* new media, set unit attention, not ready to ready */
851 			}
852 			return USB_STOR_TRANSPORT_FAILED;
853 		}
854 	}
855 
856 	/*
857 	 * if we detected a problem with the map when writing,
858 	 * don't allow any more access
859 	 */
860 	if (info->fatal_error) {
861 
862 		set_sense_info (3, 0x31, 0);
863 		return USB_STOR_TRANSPORT_FAILED;
864 	}
865 
866 	if (srb->cmnd[0] == READ_CAPACITY) {
867 
868 		capacity = sddr55_get_capacity(us);
869 
870 		if (!capacity) {
871 			set_sense_info (3, 0x30, 0); /* incompatible medium */
872 			return USB_STOR_TRANSPORT_FAILED;
873 		}
874 
875 		info->capacity = capacity;
876 
877 		/*
878 		 * figure out the maximum logical block number, allowing for
879 		 * the fact that only 250 out of every 256 are used
880 		 */
881 		info->max_log_blks = ((info->capacity >> (info->pageshift + info->blockshift)) / 256) * 250;
882 
883 		/*
884 		 * Last page in the card, adjust as we only use 250 out of
885 		 * every 256 pages
886 		 */
887 		capacity = (capacity / 256) * 250;
888 
889 		capacity /= PAGESIZE;
890 		capacity--;
891 
892 		((__be32 *) ptr)[0] = cpu_to_be32(capacity);
893 		((__be32 *) ptr)[1] = cpu_to_be32(PAGESIZE);
894 		usb_stor_set_xfer_buf(ptr, 8, srb);
895 
896 		sddr55_read_map(us);
897 
898 		return USB_STOR_TRANSPORT_GOOD;
899 	}
900 
901 	if (srb->cmnd[0] == MODE_SENSE_10) {
902 
903 		memcpy(ptr, mode_page_01, sizeof mode_page_01);
904 		ptr[3] = (info->read_only || info->force_read_only) ? 0x80 : 0;
905 		usb_stor_set_xfer_buf(ptr, sizeof(mode_page_01), srb);
906 
907 		if ( (srb->cmnd[2] & 0x3F) == 0x01 ) {
908 			usb_stor_dbg(us, "Dummy up request for mode page 1\n");
909 			return USB_STOR_TRANSPORT_GOOD;
910 
911 		} else if ( (srb->cmnd[2] & 0x3F) == 0x3F ) {
912 			usb_stor_dbg(us, "Dummy up request for all mode pages\n");
913 			return USB_STOR_TRANSPORT_GOOD;
914 		}
915 
916 		set_sense_info (5, 0x24, 0);	/* invalid field in command */
917 		return USB_STOR_TRANSPORT_FAILED;
918 	}
919 
920 	if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
921 
922 		usb_stor_dbg(us, "%s medium removal. Not that I can do anything about it...\n",
923 			     (srb->cmnd[4]&0x03) ? "Prevent" : "Allow");
924 
925 		return USB_STOR_TRANSPORT_GOOD;
926 
927 	}
928 
929 	if (srb->cmnd[0] == READ_10 || srb->cmnd[0] == WRITE_10) {
930 
931 		page = short_pack(srb->cmnd[3], srb->cmnd[2]);
932 		page <<= 16;
933 		page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
934 		pages = short_pack(srb->cmnd[8], srb->cmnd[7]);
935 
936 		page <<= info->smallpageshift;
937 
938 		// convert page to block and page-within-block
939 
940 		lba = page >> info->blockshift;
941 		page = page & info->blockmask;
942 
943 		// locate physical block corresponding to logical block
944 
945 		if (lba >= info->max_log_blks) {
946 
947 			usb_stor_dbg(us, "Error: Requested LBA %04X exceeds maximum block %04X\n",
948 				     lba, info->max_log_blks - 1);
949 
950 			set_sense_info (5, 0x24, 0);	/* invalid field in command */
951 
952 			return USB_STOR_TRANSPORT_FAILED;
953 		}
954 
955 		pba = info->lba_to_pba[lba];
956 
957 		if (srb->cmnd[0] == WRITE_10) {
958 			usb_stor_dbg(us, "WRITE_10: write block %04X (LBA %04X) page %01X pages %d\n",
959 				     pba, lba, page, pages);
960 
961 			return sddr55_write_data(us, lba, page, pages);
962 		} else {
963 			usb_stor_dbg(us, "READ_10: read block %04X (LBA %04X) page %01X pages %d\n",
964 				     pba, lba, page, pages);
965 
966 			return sddr55_read_data(us, lba, page, pages);
967 		}
968 	}
969 
970 
971 	if (srb->cmnd[0] == TEST_UNIT_READY) {
972 		return USB_STOR_TRANSPORT_GOOD;
973 	}
974 
975 	if (srb->cmnd[0] == START_STOP) {
976 		return USB_STOR_TRANSPORT_GOOD;
977 	}
978 
979 	set_sense_info (5, 0x20, 0);	/* illegal command */
980 
981 	return USB_STOR_TRANSPORT_FAILED; // FIXME: sense buffer?
982 }
983 
984 static struct scsi_host_template sddr55_host_template;
985 
986 static int sddr55_probe(struct usb_interface *intf,
987 			 const struct usb_device_id *id)
988 {
989 	struct us_data *us;
990 	int result;
991 
992 	result = usb_stor_probe1(&us, intf, id,
993 			(id - sddr55_usb_ids) + sddr55_unusual_dev_list,
994 			&sddr55_host_template);
995 	if (result)
996 		return result;
997 
998 	us->transport_name = "SDDR55";
999 	us->transport = sddr55_transport;
1000 	us->transport_reset = sddr55_reset;
1001 	us->max_lun = 0;
1002 
1003 	result = usb_stor_probe2(us);
1004 	return result;
1005 }
1006 
1007 static struct usb_driver sddr55_driver = {
1008 	.name =		DRV_NAME,
1009 	.probe =	sddr55_probe,
1010 	.disconnect =	usb_stor_disconnect,
1011 	.suspend =	usb_stor_suspend,
1012 	.resume =	usb_stor_resume,
1013 	.reset_resume =	usb_stor_reset_resume,
1014 	.pre_reset =	usb_stor_pre_reset,
1015 	.post_reset =	usb_stor_post_reset,
1016 	.id_table =	sddr55_usb_ids,
1017 	.soft_unbind =	1,
1018 	.no_dynamic_id = 1,
1019 };
1020 
1021 module_usb_stor_driver(sddr55_driver, sddr55_host_template, DRV_NAME);
1022