1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Driver for SCM Microsystems (a.k.a. Shuttle) USB-ATAPI cable
4  *
5  * Current development and maintenance by:
6  *   (c) 2000, 2001 Robert Baruch (autophile@starband.net)
7  *   (c) 2004, 2005 Daniel Drake <dsd@gentoo.org>
8  *
9  * Developed with the assistance of:
10  *   (c) 2002 Alan Stern <stern@rowland.org>
11  *
12  * Flash support based on earlier work by:
13  *   (c) 2002 Thomas Kreiling <usbdev@sm04.de>
14  *
15  * Many originally ATAPI devices were slightly modified to meet the USB
16  * market by using some kind of translation from ATAPI to USB on the host,
17  * and the peripheral would translate from USB back to ATAPI.
18  *
19  * SCM Microsystems (www.scmmicro.com) makes a device, sold to OEM's only,
20  * which does the USB-to-ATAPI conversion.  By obtaining the data sheet on
21  * their device under nondisclosure agreement, I have been able to write
22  * this driver for Linux.
23  *
24  * The chip used in the device can also be used for EPP and ISA translation
25  * as well. This driver is only guaranteed to work with the ATAPI
26  * translation.
27  *
28  * See the Kconfig help text for a list of devices known to be supported by
29  * this driver.
30  */
31 
32 #include <linux/errno.h>
33 #include <linux/module.h>
34 #include <linux/slab.h>
35 #include <linux/cdrom.h>
36 
37 #include <scsi/scsi.h>
38 #include <scsi/scsi_cmnd.h>
39 
40 #include "usb.h"
41 #include "transport.h"
42 #include "protocol.h"
43 #include "debug.h"
44 #include "scsiglue.h"
45 
46 #define DRV_NAME "ums-usbat"
47 
48 MODULE_DESCRIPTION("Driver for SCM Microsystems (a.k.a. Shuttle) USB-ATAPI cable");
49 MODULE_AUTHOR("Daniel Drake <dsd@gentoo.org>, Robert Baruch <autophile@starband.net>");
50 MODULE_LICENSE("GPL");
51 MODULE_IMPORT_NS(USB_STORAGE);
52 
53 /* Supported device types */
54 #define USBAT_DEV_HP8200	0x01
55 #define USBAT_DEV_FLASH		0x02
56 
57 #define USBAT_EPP_PORT		0x10
58 #define USBAT_EPP_REGISTER	0x30
59 #define USBAT_ATA		0x40
60 #define USBAT_ISA		0x50
61 
62 /* Commands (need to be logically OR'd with an access type */
63 #define USBAT_CMD_READ_REG		0x00
64 #define USBAT_CMD_WRITE_REG		0x01
65 #define USBAT_CMD_READ_BLOCK	0x02
66 #define USBAT_CMD_WRITE_BLOCK	0x03
67 #define USBAT_CMD_COND_READ_BLOCK	0x04
68 #define USBAT_CMD_COND_WRITE_BLOCK	0x05
69 #define USBAT_CMD_WRITE_REGS	0x07
70 
71 /* Commands (these don't need an access type) */
72 #define USBAT_CMD_EXEC_CMD	0x80
73 #define USBAT_CMD_SET_FEAT	0x81
74 #define USBAT_CMD_UIO		0x82
75 
76 /* Methods of accessing UIO register */
77 #define USBAT_UIO_READ	1
78 #define USBAT_UIO_WRITE	0
79 
80 /* Qualifier bits */
81 #define USBAT_QUAL_FCQ	0x20	/* full compare */
82 #define USBAT_QUAL_ALQ	0x10	/* auto load subcount */
83 
84 /* USBAT Flash Media status types */
85 #define USBAT_FLASH_MEDIA_NONE	0
86 #define USBAT_FLASH_MEDIA_CF	1
87 
88 /* USBAT Flash Media change types */
89 #define USBAT_FLASH_MEDIA_SAME	0
90 #define USBAT_FLASH_MEDIA_CHANGED	1
91 
92 /* USBAT ATA registers */
93 #define USBAT_ATA_DATA      0x10  /* read/write data (R/W) */
94 #define USBAT_ATA_FEATURES  0x11  /* set features (W) */
95 #define USBAT_ATA_ERROR     0x11  /* error (R) */
96 #define USBAT_ATA_SECCNT    0x12  /* sector count (R/W) */
97 #define USBAT_ATA_SECNUM    0x13  /* sector number (R/W) */
98 #define USBAT_ATA_LBA_ME    0x14  /* cylinder low (R/W) */
99 #define USBAT_ATA_LBA_HI    0x15  /* cylinder high (R/W) */
100 #define USBAT_ATA_DEVICE    0x16  /* head/device selection (R/W) */
101 #define USBAT_ATA_STATUS    0x17  /* device status (R) */
102 #define USBAT_ATA_CMD       0x17  /* device command (W) */
103 #define USBAT_ATA_ALTSTATUS 0x0E  /* status (no clear IRQ) (R) */
104 
105 /* USBAT User I/O Data registers */
106 #define USBAT_UIO_EPAD		0x80 /* Enable Peripheral Control Signals */
107 #define USBAT_UIO_CDT		0x40 /* Card Detect (Read Only) */
108 				     /* CDT = ACKD & !UI1 & !UI0 */
109 #define USBAT_UIO_1		0x20 /* I/O 1 */
110 #define USBAT_UIO_0		0x10 /* I/O 0 */
111 #define USBAT_UIO_EPP_ATA	0x08 /* 1=EPP mode, 0=ATA mode */
112 #define USBAT_UIO_UI1		0x04 /* Input 1 */
113 #define USBAT_UIO_UI0		0x02 /* Input 0 */
114 #define USBAT_UIO_INTR_ACK	0x01 /* Interrupt (ATA/ISA)/Acknowledge (EPP) */
115 
116 /* USBAT User I/O Enable registers */
117 #define USBAT_UIO_DRVRST	0x80 /* Reset Peripheral */
118 #define USBAT_UIO_ACKD		0x40 /* Enable Card Detect */
119 #define USBAT_UIO_OE1		0x20 /* I/O 1 set=output/clr=input */
120 				     /* If ACKD=1, set OE1 to 1 also. */
121 #define USBAT_UIO_OE0		0x10 /* I/O 0 set=output/clr=input */
122 #define USBAT_UIO_ADPRST	0x01 /* Reset SCM chip */
123 
124 /* USBAT Features */
125 #define USBAT_FEAT_ETEN	0x80	/* External trigger enable */
126 #define USBAT_FEAT_U1	0x08
127 #define USBAT_FEAT_U0	0x04
128 #define USBAT_FEAT_ET1	0x02
129 #define USBAT_FEAT_ET2	0x01
130 
131 struct usbat_info {
132 	int devicetype;
133 
134 	/* Used for Flash readers only */
135 	unsigned long sectors;     /* total sector count */
136 	unsigned long ssize;       /* sector size in bytes */
137 
138 	unsigned char sense_key;
139 	unsigned long sense_asc;   /* additional sense code */
140 	unsigned long sense_ascq;  /* additional sense code qualifier */
141 };
142 
143 #define short_pack(LSB,MSB) ( ((u16)(LSB)) | ( ((u16)(MSB))<<8 ) )
144 #define LSB_of(s) ((s)&0xFF)
145 #define MSB_of(s) ((s)>>8)
146 
147 static int transferred = 0;
148 
149 static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us);
150 static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us);
151 
152 static int init_usbat_cd(struct us_data *us);
153 static int init_usbat_flash(struct us_data *us);
154 
155 
156 /*
157  * The table of devices
158  */
159 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
160 		    vendorName, productName, useProtocol, useTransport, \
161 		    initFunction, flags) \
162 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
163   .driver_info = (flags) }
164 
165 static struct usb_device_id usbat_usb_ids[] = {
166 #	include "unusual_usbat.h"
167 	{ }		/* Terminating entry */
168 };
169 MODULE_DEVICE_TABLE(usb, usbat_usb_ids);
170 
171 #undef UNUSUAL_DEV
172 
173 /*
174  * The flags table
175  */
176 #define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
177 		    vendor_name, product_name, use_protocol, use_transport, \
178 		    init_function, Flags) \
179 { \
180 	.vendorName = vendor_name,	\
181 	.productName = product_name,	\
182 	.useProtocol = use_protocol,	\
183 	.useTransport = use_transport,	\
184 	.initFunction = init_function,	\
185 }
186 
187 static struct us_unusual_dev usbat_unusual_dev_list[] = {
188 #	include "unusual_usbat.h"
189 	{ }		/* Terminating entry */
190 };
191 
192 #undef UNUSUAL_DEV
193 
194 /*
195  * Convenience function to produce an ATA read/write sectors command
196  * Use cmd=0x20 for read, cmd=0x30 for write
197  */
198 static void usbat_pack_ata_sector_cmd(unsigned char *buf,
199 					unsigned char thistime,
200 					u32 sector, unsigned char cmd)
201 {
202 	buf[0] = 0;
203 	buf[1] = thistime;
204 	buf[2] = sector & 0xFF;
205 	buf[3] = (sector >>  8) & 0xFF;
206 	buf[4] = (sector >> 16) & 0xFF;
207 	buf[5] = 0xE0 | ((sector >> 24) & 0x0F);
208 	buf[6] = cmd;
209 }
210 
211 /*
212  * Convenience function to get the device type (flash or hp8200)
213  */
214 static int usbat_get_device_type(struct us_data *us)
215 {
216 	return ((struct usbat_info*)us->extra)->devicetype;
217 }
218 
219 /*
220  * Read a register from the device
221  */
222 static int usbat_read(struct us_data *us,
223 		      unsigned char access,
224 		      unsigned char reg,
225 		      unsigned char *content)
226 {
227 	return usb_stor_ctrl_transfer(us,
228 		us->recv_ctrl_pipe,
229 		access | USBAT_CMD_READ_REG,
230 		0xC0,
231 		(u16)reg,
232 		0,
233 		content,
234 		1);
235 }
236 
237 /*
238  * Write to a register on the device
239  */
240 static int usbat_write(struct us_data *us,
241 		       unsigned char access,
242 		       unsigned char reg,
243 		       unsigned char content)
244 {
245 	return usb_stor_ctrl_transfer(us,
246 		us->send_ctrl_pipe,
247 		access | USBAT_CMD_WRITE_REG,
248 		0x40,
249 		short_pack(reg, content),
250 		0,
251 		NULL,
252 		0);
253 }
254 
255 /*
256  * Convenience function to perform a bulk read
257  */
258 static int usbat_bulk_read(struct us_data *us,
259 			   void* buf,
260 			   unsigned int len,
261 			   int use_sg)
262 {
263 	if (len == 0)
264 		return USB_STOR_XFER_GOOD;
265 
266 	usb_stor_dbg(us, "len = %d\n", len);
267 	return usb_stor_bulk_transfer_sg(us, us->recv_bulk_pipe, buf, len, use_sg, NULL);
268 }
269 
270 /*
271  * Convenience function to perform a bulk write
272  */
273 static int usbat_bulk_write(struct us_data *us,
274 			    void* buf,
275 			    unsigned int len,
276 			    int use_sg)
277 {
278 	if (len == 0)
279 		return USB_STOR_XFER_GOOD;
280 
281 	usb_stor_dbg(us, "len = %d\n", len);
282 	return usb_stor_bulk_transfer_sg(us, us->send_bulk_pipe, buf, len, use_sg, NULL);
283 }
284 
285 /*
286  * Some USBAT-specific commands can only be executed over a command transport
287  * This transport allows one (len=8) or two (len=16) vendor-specific commands
288  * to be executed.
289  */
290 static int usbat_execute_command(struct us_data *us,
291 								 unsigned char *commands,
292 								 unsigned int len)
293 {
294 	return usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
295 								  USBAT_CMD_EXEC_CMD, 0x40, 0, 0,
296 								  commands, len);
297 }
298 
299 /*
300  * Read the status register
301  */
302 static int usbat_get_status(struct us_data *us, unsigned char *status)
303 {
304 	int rc;
305 	rc = usbat_read(us, USBAT_ATA, USBAT_ATA_STATUS, status);
306 
307 	usb_stor_dbg(us, "0x%02X\n", *status);
308 	return rc;
309 }
310 
311 /*
312  * Check the device status
313  */
314 static int usbat_check_status(struct us_data *us)
315 {
316 	unsigned char *reply = us->iobuf;
317 	int rc;
318 
319 	rc = usbat_get_status(us, reply);
320 	if (rc != USB_STOR_XFER_GOOD)
321 		return USB_STOR_TRANSPORT_FAILED;
322 
323 	/* error/check condition (0x51 is ok) */
324 	if (*reply & 0x01 && *reply != 0x51)
325 		return USB_STOR_TRANSPORT_FAILED;
326 
327 	/* device fault */
328 	if (*reply & 0x20)
329 		return USB_STOR_TRANSPORT_FAILED;
330 
331 	return USB_STOR_TRANSPORT_GOOD;
332 }
333 
334 /*
335  * Stores critical information in internal registers in preparation for the execution
336  * of a conditional usbat_read_blocks or usbat_write_blocks call.
337  */
338 static int usbat_set_shuttle_features(struct us_data *us,
339 				      unsigned char external_trigger,
340 				      unsigned char epp_control,
341 				      unsigned char mask_byte,
342 				      unsigned char test_pattern,
343 				      unsigned char subcountH,
344 				      unsigned char subcountL)
345 {
346 	unsigned char *command = us->iobuf;
347 
348 	command[0] = 0x40;
349 	command[1] = USBAT_CMD_SET_FEAT;
350 
351 	/*
352 	 * The only bit relevant to ATA access is bit 6
353 	 * which defines 8 bit data access (set) or 16 bit (unset)
354 	 */
355 	command[2] = epp_control;
356 
357 	/*
358 	 * If FCQ is set in the qualifier (defined in R/W cmd), then bits U0, U1,
359 	 * ET1 and ET2 define an external event to be checked for on event of a
360 	 * _read_blocks or _write_blocks operation. The read/write will not take
361 	 * place unless the defined trigger signal is active.
362 	 */
363 	command[3] = external_trigger;
364 
365 	/*
366 	 * The resultant byte of the mask operation (see mask_byte) is compared for
367 	 * equivalence with this test pattern. If equal, the read/write will take
368 	 * place.
369 	 */
370 	command[4] = test_pattern;
371 
372 	/*
373 	 * This value is logically ANDed with the status register field specified
374 	 * in the read/write command.
375 	 */
376 	command[5] = mask_byte;
377 
378 	/*
379 	 * If ALQ is set in the qualifier, this field contains the address of the
380 	 * registers where the byte count should be read for transferring the data.
381 	 * If ALQ is not set, then this field contains the number of bytes to be
382 	 * transferred.
383 	 */
384 	command[6] = subcountL;
385 	command[7] = subcountH;
386 
387 	return usbat_execute_command(us, command, 8);
388 }
389 
390 /*
391  * Block, waiting for an ATA device to become not busy or to report
392  * an error condition.
393  */
394 static int usbat_wait_not_busy(struct us_data *us, int minutes)
395 {
396 	int i;
397 	int result;
398 	unsigned char *status = us->iobuf;
399 
400 	/*
401 	 * Synchronizing cache on a CDR could take a heck of a long time,
402 	 * but probably not more than 10 minutes or so. On the other hand,
403 	 * doing a full blank on a CDRW at speed 1 will take about 75
404 	 * minutes!
405 	 */
406 
407 	for (i=0; i<1200+minutes*60; i++) {
408 
409  		result = usbat_get_status(us, status);
410 
411 		if (result!=USB_STOR_XFER_GOOD)
412 			return USB_STOR_TRANSPORT_ERROR;
413 		if (*status & 0x01) { /* check condition */
414 			result = usbat_read(us, USBAT_ATA, 0x10, status);
415 			return USB_STOR_TRANSPORT_FAILED;
416 		}
417 		if (*status & 0x20) /* device fault */
418 			return USB_STOR_TRANSPORT_FAILED;
419 
420 		if ((*status & 0x80)==0x00) { /* not busy */
421 			usb_stor_dbg(us, "Waited not busy for %d steps\n", i);
422 			return USB_STOR_TRANSPORT_GOOD;
423 		}
424 
425 		if (i<500)
426 			msleep(10); /* 5 seconds */
427 		else if (i<700)
428 			msleep(50); /* 10 seconds */
429 		else if (i<1200)
430 			msleep(100); /* 50 seconds */
431 		else
432 			msleep(1000); /* X minutes */
433 	}
434 
435 	usb_stor_dbg(us, "Waited not busy for %d minutes, timing out\n",
436 		     minutes);
437 	return USB_STOR_TRANSPORT_FAILED;
438 }
439 
440 /*
441  * Read block data from the data register
442  */
443 static int usbat_read_block(struct us_data *us,
444 			    void* buf,
445 			    unsigned short len,
446 			    int use_sg)
447 {
448 	int result;
449 	unsigned char *command = us->iobuf;
450 
451 	if (!len)
452 		return USB_STOR_TRANSPORT_GOOD;
453 
454 	command[0] = 0xC0;
455 	command[1] = USBAT_ATA | USBAT_CMD_READ_BLOCK;
456 	command[2] = USBAT_ATA_DATA;
457 	command[3] = 0;
458 	command[4] = 0;
459 	command[5] = 0;
460 	command[6] = LSB_of(len);
461 	command[7] = MSB_of(len);
462 
463 	result = usbat_execute_command(us, command, 8);
464 	if (result != USB_STOR_XFER_GOOD)
465 		return USB_STOR_TRANSPORT_ERROR;
466 
467 	result = usbat_bulk_read(us, buf, len, use_sg);
468 	return (result == USB_STOR_XFER_GOOD ?
469 			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
470 }
471 
472 /*
473  * Write block data via the data register
474  */
475 static int usbat_write_block(struct us_data *us,
476 			     unsigned char access,
477 			     void* buf,
478 			     unsigned short len,
479 			     int minutes,
480 			     int use_sg)
481 {
482 	int result;
483 	unsigned char *command = us->iobuf;
484 
485 	if (!len)
486 		return USB_STOR_TRANSPORT_GOOD;
487 
488 	command[0] = 0x40;
489 	command[1] = access | USBAT_CMD_WRITE_BLOCK;
490 	command[2] = USBAT_ATA_DATA;
491 	command[3] = 0;
492 	command[4] = 0;
493 	command[5] = 0;
494 	command[6] = LSB_of(len);
495 	command[7] = MSB_of(len);
496 
497 	result = usbat_execute_command(us, command, 8);
498 
499 	if (result != USB_STOR_XFER_GOOD)
500 		return USB_STOR_TRANSPORT_ERROR;
501 
502 	result = usbat_bulk_write(us, buf, len, use_sg);
503 	if (result != USB_STOR_XFER_GOOD)
504 		return USB_STOR_TRANSPORT_ERROR;
505 
506 	return usbat_wait_not_busy(us, minutes);
507 }
508 
509 /*
510  * Process read and write requests
511  */
512 static int usbat_hp8200e_rw_block_test(struct us_data *us,
513 				       unsigned char access,
514 				       unsigned char *registers,
515 				       unsigned char *data_out,
516 				       unsigned short num_registers,
517 				       unsigned char data_reg,
518 				       unsigned char status_reg,
519 				       unsigned char timeout,
520 				       unsigned char qualifier,
521 				       int direction,
522 				       void *buf,
523 				       unsigned short len,
524 				       int use_sg,
525 				       int minutes)
526 {
527 	int result;
528 	unsigned int pipe = (direction == DMA_FROM_DEVICE) ?
529 			us->recv_bulk_pipe : us->send_bulk_pipe;
530 
531 	unsigned char *command = us->iobuf;
532 	int i, j;
533 	int cmdlen;
534 	unsigned char *data = us->iobuf;
535 	unsigned char *status = us->iobuf;
536 
537 	BUG_ON(num_registers > US_IOBUF_SIZE/2);
538 
539 	for (i=0; i<20; i++) {
540 
541 		/*
542 		 * The first time we send the full command, which consists
543 		 * of downloading the SCSI command followed by downloading
544 		 * the data via a write-and-test.  Any other time we only
545 		 * send the command to download the data -- the SCSI command
546 		 * is still 'active' in some sense in the device.
547 		 *
548 		 * We're only going to try sending the data 10 times. After
549 		 * that, we just return a failure.
550 		 */
551 
552 		if (i==0) {
553 			cmdlen = 16;
554 			/*
555 			 * Write to multiple registers
556 			 * Not really sure the 0x07, 0x17, 0xfc, 0xe7 is
557 			 * necessary here, but that's what came out of the
558 			 * trace every single time.
559 			 */
560 			command[0] = 0x40;
561 			command[1] = access | USBAT_CMD_WRITE_REGS;
562 			command[2] = 0x07;
563 			command[3] = 0x17;
564 			command[4] = 0xFC;
565 			command[5] = 0xE7;
566 			command[6] = LSB_of(num_registers*2);
567 			command[7] = MSB_of(num_registers*2);
568 		} else
569 			cmdlen = 8;
570 
571 		/* Conditionally read or write blocks */
572 		command[cmdlen-8] = (direction==DMA_TO_DEVICE ? 0x40 : 0xC0);
573 		command[cmdlen-7] = access |
574 				(direction==DMA_TO_DEVICE ?
575 				 USBAT_CMD_COND_WRITE_BLOCK : USBAT_CMD_COND_READ_BLOCK);
576 		command[cmdlen-6] = data_reg;
577 		command[cmdlen-5] = status_reg;
578 		command[cmdlen-4] = timeout;
579 		command[cmdlen-3] = qualifier;
580 		command[cmdlen-2] = LSB_of(len);
581 		command[cmdlen-1] = MSB_of(len);
582 
583 		result = usbat_execute_command(us, command, cmdlen);
584 
585 		if (result != USB_STOR_XFER_GOOD)
586 			return USB_STOR_TRANSPORT_ERROR;
587 
588 		if (i==0) {
589 
590 			for (j=0; j<num_registers; j++) {
591 				data[j<<1] = registers[j];
592 				data[1+(j<<1)] = data_out[j];
593 			}
594 
595 			result = usbat_bulk_write(us, data, num_registers*2, 0);
596 			if (result != USB_STOR_XFER_GOOD)
597 				return USB_STOR_TRANSPORT_ERROR;
598 
599 		}
600 
601 		result = usb_stor_bulk_transfer_sg(us,
602 			pipe, buf, len, use_sg, NULL);
603 
604 		/*
605 		 * If we get a stall on the bulk download, we'll retry
606 		 * the bulk download -- but not the SCSI command because
607 		 * in some sense the SCSI command is still 'active' and
608 		 * waiting for the data. Don't ask me why this should be;
609 		 * I'm only following what the Windoze driver did.
610 		 *
611 		 * Note that a stall for the test-and-read/write command means
612 		 * that the test failed. In this case we're testing to make
613 		 * sure that the device is error-free
614 		 * (i.e. bit 0 -- CHK -- of status is 0). The most likely
615 		 * hypothesis is that the USBAT chip somehow knows what
616 		 * the device will accept, but doesn't give the device any
617 		 * data until all data is received. Thus, the device would
618 		 * still be waiting for the first byte of data if a stall
619 		 * occurs, even if the stall implies that some data was
620 		 * transferred.
621 		 */
622 
623 		if (result == USB_STOR_XFER_SHORT ||
624 				result == USB_STOR_XFER_STALLED) {
625 
626 			/*
627 			 * If we're reading and we stalled, then clear
628 			 * the bulk output pipe only the first time.
629 			 */
630 
631 			if (direction==DMA_FROM_DEVICE && i==0) {
632 				if (usb_stor_clear_halt(us,
633 						us->send_bulk_pipe) < 0)
634 					return USB_STOR_TRANSPORT_ERROR;
635 			}
636 
637 			/*
638 			 * Read status: is the device angry, or just busy?
639 			 */
640 
641  			result = usbat_read(us, USBAT_ATA,
642 				direction==DMA_TO_DEVICE ?
643 					USBAT_ATA_STATUS : USBAT_ATA_ALTSTATUS,
644 				status);
645 
646 			if (result!=USB_STOR_XFER_GOOD)
647 				return USB_STOR_TRANSPORT_ERROR;
648 			if (*status & 0x01) /* check condition */
649 				return USB_STOR_TRANSPORT_FAILED;
650 			if (*status & 0x20) /* device fault */
651 				return USB_STOR_TRANSPORT_FAILED;
652 
653 			usb_stor_dbg(us, "Redoing %s\n",
654 				     direction == DMA_TO_DEVICE
655 				     ? "write" : "read");
656 
657 		} else if (result != USB_STOR_XFER_GOOD)
658 			return USB_STOR_TRANSPORT_ERROR;
659 		else
660 			return usbat_wait_not_busy(us, minutes);
661 
662 	}
663 
664 	usb_stor_dbg(us, "Bummer! %s bulk data 20 times failed\n",
665 		     direction == DMA_TO_DEVICE ? "Writing" : "Reading");
666 
667 	return USB_STOR_TRANSPORT_FAILED;
668 }
669 
670 /*
671  * Write to multiple registers:
672  * Allows us to write specific data to any registers. The data to be written
673  * gets packed in this sequence: reg0, data0, reg1, data1, ..., regN, dataN
674  * which gets sent through bulk out.
675  * Not designed for large transfers of data!
676  */
677 static int usbat_multiple_write(struct us_data *us,
678 				unsigned char *registers,
679 				unsigned char *data_out,
680 				unsigned short num_registers)
681 {
682 	int i, result;
683 	unsigned char *data = us->iobuf;
684 	unsigned char *command = us->iobuf;
685 
686 	BUG_ON(num_registers > US_IOBUF_SIZE/2);
687 
688 	/* Write to multiple registers, ATA access */
689 	command[0] = 0x40;
690 	command[1] = USBAT_ATA | USBAT_CMD_WRITE_REGS;
691 
692 	/* No relevance */
693 	command[2] = 0;
694 	command[3] = 0;
695 	command[4] = 0;
696 	command[5] = 0;
697 
698 	/* Number of bytes to be transferred (incl. addresses and data) */
699 	command[6] = LSB_of(num_registers*2);
700 	command[7] = MSB_of(num_registers*2);
701 
702 	/* The setup command */
703 	result = usbat_execute_command(us, command, 8);
704 	if (result != USB_STOR_XFER_GOOD)
705 		return USB_STOR_TRANSPORT_ERROR;
706 
707 	/* Create the reg/data, reg/data sequence */
708 	for (i=0; i<num_registers; i++) {
709 		data[i<<1] = registers[i];
710 		data[1+(i<<1)] = data_out[i];
711 	}
712 
713 	/* Send the data */
714 	result = usbat_bulk_write(us, data, num_registers*2, 0);
715 	if (result != USB_STOR_XFER_GOOD)
716 		return USB_STOR_TRANSPORT_ERROR;
717 
718 	if (usbat_get_device_type(us) == USBAT_DEV_HP8200)
719 		return usbat_wait_not_busy(us, 0);
720 	else
721 		return USB_STOR_TRANSPORT_GOOD;
722 }
723 
724 /*
725  * Conditionally read blocks from device:
726  * Allows us to read blocks from a specific data register, based upon the
727  * condition that a status register can be successfully masked with a status
728  * qualifier. If this condition is not initially met, the read will wait
729  * up until a maximum amount of time has elapsed, as specified by timeout.
730  * The read will start when the condition is met, otherwise the command aborts.
731  *
732  * The qualifier defined here is not the value that is masked, it defines
733  * conditions for the write to take place. The actual masked qualifier (and
734  * other related details) are defined beforehand with _set_shuttle_features().
735  */
736 static int usbat_read_blocks(struct us_data *us,
737 			     void* buffer,
738 			     int len,
739 			     int use_sg)
740 {
741 	int result;
742 	unsigned char *command = us->iobuf;
743 
744 	command[0] = 0xC0;
745 	command[1] = USBAT_ATA | USBAT_CMD_COND_READ_BLOCK;
746 	command[2] = USBAT_ATA_DATA;
747 	command[3] = USBAT_ATA_STATUS;
748 	command[4] = 0xFD; /* Timeout (ms); */
749 	command[5] = USBAT_QUAL_FCQ;
750 	command[6] = LSB_of(len);
751 	command[7] = MSB_of(len);
752 
753 	/* Multiple block read setup command */
754 	result = usbat_execute_command(us, command, 8);
755 	if (result != USB_STOR_XFER_GOOD)
756 		return USB_STOR_TRANSPORT_FAILED;
757 
758 	/* Read the blocks we just asked for */
759 	result = usbat_bulk_read(us, buffer, len, use_sg);
760 	if (result != USB_STOR_XFER_GOOD)
761 		return USB_STOR_TRANSPORT_FAILED;
762 
763 	return USB_STOR_TRANSPORT_GOOD;
764 }
765 
766 /*
767  * Conditionally write blocks to device:
768  * Allows us to write blocks to a specific data register, based upon the
769  * condition that a status register can be successfully masked with a status
770  * qualifier. If this condition is not initially met, the write will wait
771  * up until a maximum amount of time has elapsed, as specified by timeout.
772  * The read will start when the condition is met, otherwise the command aborts.
773  *
774  * The qualifier defined here is not the value that is masked, it defines
775  * conditions for the write to take place. The actual masked qualifier (and
776  * other related details) are defined beforehand with _set_shuttle_features().
777  */
778 static int usbat_write_blocks(struct us_data *us,
779 			      void* buffer,
780 			      int len,
781 			      int use_sg)
782 {
783 	int result;
784 	unsigned char *command = us->iobuf;
785 
786 	command[0] = 0x40;
787 	command[1] = USBAT_ATA | USBAT_CMD_COND_WRITE_BLOCK;
788 	command[2] = USBAT_ATA_DATA;
789 	command[3] = USBAT_ATA_STATUS;
790 	command[4] = 0xFD; /* Timeout (ms) */
791 	command[5] = USBAT_QUAL_FCQ;
792 	command[6] = LSB_of(len);
793 	command[7] = MSB_of(len);
794 
795 	/* Multiple block write setup command */
796 	result = usbat_execute_command(us, command, 8);
797 	if (result != USB_STOR_XFER_GOOD)
798 		return USB_STOR_TRANSPORT_FAILED;
799 
800 	/* Write the data */
801 	result = usbat_bulk_write(us, buffer, len, use_sg);
802 	if (result != USB_STOR_XFER_GOOD)
803 		return USB_STOR_TRANSPORT_FAILED;
804 
805 	return USB_STOR_TRANSPORT_GOOD;
806 }
807 
808 /*
809  * Read the User IO register
810  */
811 static int usbat_read_user_io(struct us_data *us, unsigned char *data_flags)
812 {
813 	int result;
814 
815 	result = usb_stor_ctrl_transfer(us,
816 		us->recv_ctrl_pipe,
817 		USBAT_CMD_UIO,
818 		0xC0,
819 		0,
820 		0,
821 		data_flags,
822 		USBAT_UIO_READ);
823 
824 	usb_stor_dbg(us, "UIO register reads %02X\n", *data_flags);
825 
826 	return result;
827 }
828 
829 /*
830  * Write to the User IO register
831  */
832 static int usbat_write_user_io(struct us_data *us,
833 			       unsigned char enable_flags,
834 			       unsigned char data_flags)
835 {
836 	return usb_stor_ctrl_transfer(us,
837 		us->send_ctrl_pipe,
838 		USBAT_CMD_UIO,
839 		0x40,
840 		short_pack(enable_flags, data_flags),
841 		0,
842 		NULL,
843 		USBAT_UIO_WRITE);
844 }
845 
846 /*
847  * Reset the device
848  * Often needed on media change.
849  */
850 static int usbat_device_reset(struct us_data *us)
851 {
852 	int rc;
853 
854 	/*
855 	 * Reset peripheral, enable peripheral control signals
856 	 * (bring reset signal up)
857 	 */
858 	rc = usbat_write_user_io(us,
859 							 USBAT_UIO_DRVRST | USBAT_UIO_OE1 | USBAT_UIO_OE0,
860 							 USBAT_UIO_EPAD | USBAT_UIO_1);
861 	if (rc != USB_STOR_XFER_GOOD)
862 		return USB_STOR_TRANSPORT_ERROR;
863 
864 	/*
865 	 * Enable peripheral control signals
866 	 * (bring reset signal down)
867 	 */
868 	rc = usbat_write_user_io(us,
869 							 USBAT_UIO_OE1  | USBAT_UIO_OE0,
870 							 USBAT_UIO_EPAD | USBAT_UIO_1);
871 	if (rc != USB_STOR_XFER_GOOD)
872 		return USB_STOR_TRANSPORT_ERROR;
873 
874 	return USB_STOR_TRANSPORT_GOOD;
875 }
876 
877 /*
878  * Enable card detect
879  */
880 static int usbat_device_enable_cdt(struct us_data *us)
881 {
882 	int rc;
883 
884 	/* Enable peripheral control signals and card detect */
885 	rc = usbat_write_user_io(us,
886 							 USBAT_UIO_ACKD | USBAT_UIO_OE1  | USBAT_UIO_OE0,
887 							 USBAT_UIO_EPAD | USBAT_UIO_1);
888 	if (rc != USB_STOR_XFER_GOOD)
889 		return USB_STOR_TRANSPORT_ERROR;
890 
891 	return USB_STOR_TRANSPORT_GOOD;
892 }
893 
894 /*
895  * Determine if media is present.
896  */
897 static int usbat_flash_check_media_present(struct us_data *us,
898 					   unsigned char *uio)
899 {
900 	if (*uio & USBAT_UIO_UI0) {
901 		usb_stor_dbg(us, "no media detected\n");
902 		return USBAT_FLASH_MEDIA_NONE;
903 	}
904 
905 	return USBAT_FLASH_MEDIA_CF;
906 }
907 
908 /*
909  * Determine if media has changed since last operation
910  */
911 static int usbat_flash_check_media_changed(struct us_data *us,
912 					   unsigned char *uio)
913 {
914 	if (*uio & USBAT_UIO_0) {
915 		usb_stor_dbg(us, "media change detected\n");
916 		return USBAT_FLASH_MEDIA_CHANGED;
917 	}
918 
919 	return USBAT_FLASH_MEDIA_SAME;
920 }
921 
922 /*
923  * Check for media change / no media and handle the situation appropriately
924  */
925 static int usbat_flash_check_media(struct us_data *us,
926 				   struct usbat_info *info)
927 {
928 	int rc;
929 	unsigned char *uio = us->iobuf;
930 
931 	rc = usbat_read_user_io(us, uio);
932 	if (rc != USB_STOR_XFER_GOOD)
933 		return USB_STOR_TRANSPORT_ERROR;
934 
935 	/* Check for media existence */
936 	rc = usbat_flash_check_media_present(us, uio);
937 	if (rc == USBAT_FLASH_MEDIA_NONE) {
938 		info->sense_key = 0x02;
939 		info->sense_asc = 0x3A;
940 		info->sense_ascq = 0x00;
941 		return USB_STOR_TRANSPORT_FAILED;
942 	}
943 
944 	/* Check for media change */
945 	rc = usbat_flash_check_media_changed(us, uio);
946 	if (rc == USBAT_FLASH_MEDIA_CHANGED) {
947 
948 		/* Reset and re-enable card detect */
949 		rc = usbat_device_reset(us);
950 		if (rc != USB_STOR_TRANSPORT_GOOD)
951 			return rc;
952 		rc = usbat_device_enable_cdt(us);
953 		if (rc != USB_STOR_TRANSPORT_GOOD)
954 			return rc;
955 
956 		msleep(50);
957 
958 		rc = usbat_read_user_io(us, uio);
959 		if (rc != USB_STOR_XFER_GOOD)
960 			return USB_STOR_TRANSPORT_ERROR;
961 
962 		info->sense_key = UNIT_ATTENTION;
963 		info->sense_asc = 0x28;
964 		info->sense_ascq = 0x00;
965 		return USB_STOR_TRANSPORT_FAILED;
966 	}
967 
968 	return USB_STOR_TRANSPORT_GOOD;
969 }
970 
971 /*
972  * Determine whether we are controlling a flash-based reader/writer,
973  * or a HP8200-based CD drive.
974  * Sets transport functions as appropriate.
975  */
976 static int usbat_identify_device(struct us_data *us,
977 				 struct usbat_info *info)
978 {
979 	int rc;
980 	unsigned char status;
981 
982 	if (!us || !info)
983 		return USB_STOR_TRANSPORT_ERROR;
984 
985 	rc = usbat_device_reset(us);
986 	if (rc != USB_STOR_TRANSPORT_GOOD)
987 		return rc;
988 	msleep(500);
989 
990 	/*
991 	 * In attempt to distinguish between HP CDRW's and Flash readers, we now
992 	 * execute the IDENTIFY PACKET DEVICE command. On ATA devices (i.e. flash
993 	 * readers), this command should fail with error. On ATAPI devices (i.e.
994 	 * CDROM drives), it should succeed.
995 	 */
996 	rc = usbat_write(us, USBAT_ATA, USBAT_ATA_CMD, 0xA1);
997  	if (rc != USB_STOR_XFER_GOOD)
998  		return USB_STOR_TRANSPORT_ERROR;
999 
1000 	rc = usbat_get_status(us, &status);
1001  	if (rc != USB_STOR_XFER_GOOD)
1002  		return USB_STOR_TRANSPORT_ERROR;
1003 
1004 	/* Check for error bit, or if the command 'fell through' */
1005 	if (status == 0xA1 || !(status & 0x01)) {
1006 		/* Device is HP 8200 */
1007 		usb_stor_dbg(us, "Detected HP8200 CDRW\n");
1008 		info->devicetype = USBAT_DEV_HP8200;
1009 	} else {
1010 		/* Device is a CompactFlash reader/writer */
1011 		usb_stor_dbg(us, "Detected Flash reader/writer\n");
1012 		info->devicetype = USBAT_DEV_FLASH;
1013 	}
1014 
1015 	return USB_STOR_TRANSPORT_GOOD;
1016 }
1017 
1018 /*
1019  * Set the transport function based on the device type
1020  */
1021 static int usbat_set_transport(struct us_data *us,
1022 			       struct usbat_info *info,
1023 			       int devicetype)
1024 {
1025 
1026 	if (!info->devicetype)
1027 		info->devicetype = devicetype;
1028 
1029 	if (!info->devicetype)
1030 		usbat_identify_device(us, info);
1031 
1032 	switch (info->devicetype) {
1033 	default:
1034 		return USB_STOR_TRANSPORT_ERROR;
1035 
1036 	case  USBAT_DEV_HP8200:
1037 		us->transport = usbat_hp8200e_transport;
1038 		break;
1039 
1040 	case USBAT_DEV_FLASH:
1041 		us->transport = usbat_flash_transport;
1042 		break;
1043 	}
1044 
1045 	return 0;
1046 }
1047 
1048 /*
1049  * Read the media capacity
1050  */
1051 static int usbat_flash_get_sector_count(struct us_data *us,
1052 					struct usbat_info *info)
1053 {
1054 	unsigned char registers[3] = {
1055 		USBAT_ATA_SECCNT,
1056 		USBAT_ATA_DEVICE,
1057 		USBAT_ATA_CMD,
1058 	};
1059 	unsigned char  command[3] = { 0x01, 0xA0, 0xEC };
1060 	unsigned char *reply;
1061 	unsigned char status;
1062 	int rc;
1063 
1064 	if (!us || !info)
1065 		return USB_STOR_TRANSPORT_ERROR;
1066 
1067 	reply = kmalloc(512, GFP_NOIO);
1068 	if (!reply)
1069 		return USB_STOR_TRANSPORT_ERROR;
1070 
1071 	/* ATA command : IDENTIFY DEVICE */
1072 	rc = usbat_multiple_write(us, registers, command, 3);
1073 	if (rc != USB_STOR_XFER_GOOD) {
1074 		usb_stor_dbg(us, "Gah! identify_device failed\n");
1075 		rc = USB_STOR_TRANSPORT_ERROR;
1076 		goto leave;
1077 	}
1078 
1079 	/* Read device status */
1080 	if (usbat_get_status(us, &status) != USB_STOR_XFER_GOOD) {
1081 		rc = USB_STOR_TRANSPORT_ERROR;
1082 		goto leave;
1083 	}
1084 
1085 	msleep(100);
1086 
1087 	/* Read the device identification data */
1088 	rc = usbat_read_block(us, reply, 512, 0);
1089 	if (rc != USB_STOR_TRANSPORT_GOOD)
1090 		goto leave;
1091 
1092 	info->sectors = ((u32)(reply[117]) << 24) |
1093 		((u32)(reply[116]) << 16) |
1094 		((u32)(reply[115]) <<  8) |
1095 		((u32)(reply[114])      );
1096 
1097 	rc = USB_STOR_TRANSPORT_GOOD;
1098 
1099  leave:
1100 	kfree(reply);
1101 	return rc;
1102 }
1103 
1104 /*
1105  * Read data from device
1106  */
1107 static int usbat_flash_read_data(struct us_data *us,
1108 								 struct usbat_info *info,
1109 								 u32 sector,
1110 								 u32 sectors)
1111 {
1112 	unsigned char registers[7] = {
1113 		USBAT_ATA_FEATURES,
1114 		USBAT_ATA_SECCNT,
1115 		USBAT_ATA_SECNUM,
1116 		USBAT_ATA_LBA_ME,
1117 		USBAT_ATA_LBA_HI,
1118 		USBAT_ATA_DEVICE,
1119 		USBAT_ATA_STATUS,
1120 	};
1121 	unsigned char command[7];
1122 	unsigned char *buffer;
1123 	unsigned char  thistime;
1124 	unsigned int totallen, alloclen;
1125 	int len, result;
1126 	unsigned int sg_offset = 0;
1127 	struct scatterlist *sg = NULL;
1128 
1129 	result = usbat_flash_check_media(us, info);
1130 	if (result != USB_STOR_TRANSPORT_GOOD)
1131 		return result;
1132 
1133 	/*
1134 	 * we're working in LBA mode.  according to the ATA spec,
1135 	 * we can support up to 28-bit addressing.  I don't know if Jumpshot
1136 	 * supports beyond 24-bit addressing.  It's kind of hard to test
1137 	 * since it requires > 8GB CF card.
1138 	 */
1139 
1140 	if (sector > 0x0FFFFFFF)
1141 		return USB_STOR_TRANSPORT_ERROR;
1142 
1143 	totallen = sectors * info->ssize;
1144 
1145 	/*
1146 	 * Since we don't read more than 64 KB at a time, we have to create
1147 	 * a bounce buffer and move the data a piece at a time between the
1148 	 * bounce buffer and the actual transfer buffer.
1149 	 */
1150 
1151 	alloclen = min(totallen, 65536u);
1152 	buffer = kmalloc(alloclen, GFP_NOIO);
1153 	if (buffer == NULL)
1154 		return USB_STOR_TRANSPORT_ERROR;
1155 
1156 	do {
1157 		/*
1158 		 * loop, never allocate or transfer more than 64k at once
1159 		 * (min(128k, 255*info->ssize) is the real limit)
1160 		 */
1161 		len = min(totallen, alloclen);
1162 		thistime = (len / info->ssize) & 0xff;
1163 
1164 		/* ATA command 0x20 (READ SECTORS) */
1165 		usbat_pack_ata_sector_cmd(command, thistime, sector, 0x20);
1166 
1167 		/* Write/execute ATA read command */
1168 		result = usbat_multiple_write(us, registers, command, 7);
1169 		if (result != USB_STOR_TRANSPORT_GOOD)
1170 			goto leave;
1171 
1172 		/* Read the data we just requested */
1173 		result = usbat_read_blocks(us, buffer, len, 0);
1174 		if (result != USB_STOR_TRANSPORT_GOOD)
1175 			goto leave;
1176 
1177 		usb_stor_dbg(us, "%d bytes\n", len);
1178 
1179 		/* Store the data in the transfer buffer */
1180 		usb_stor_access_xfer_buf(buffer, len, us->srb,
1181 					 &sg, &sg_offset, TO_XFER_BUF);
1182 
1183 		sector += thistime;
1184 		totallen -= len;
1185 	} while (totallen > 0);
1186 
1187 	kfree(buffer);
1188 	return USB_STOR_TRANSPORT_GOOD;
1189 
1190 leave:
1191 	kfree(buffer);
1192 	return USB_STOR_TRANSPORT_ERROR;
1193 }
1194 
1195 /*
1196  * Write data to device
1197  */
1198 static int usbat_flash_write_data(struct us_data *us,
1199 								  struct usbat_info *info,
1200 								  u32 sector,
1201 								  u32 sectors)
1202 {
1203 	unsigned char registers[7] = {
1204 		USBAT_ATA_FEATURES,
1205 		USBAT_ATA_SECCNT,
1206 		USBAT_ATA_SECNUM,
1207 		USBAT_ATA_LBA_ME,
1208 		USBAT_ATA_LBA_HI,
1209 		USBAT_ATA_DEVICE,
1210 		USBAT_ATA_STATUS,
1211 	};
1212 	unsigned char command[7];
1213 	unsigned char *buffer;
1214 	unsigned char  thistime;
1215 	unsigned int totallen, alloclen;
1216 	int len, result;
1217 	unsigned int sg_offset = 0;
1218 	struct scatterlist *sg = NULL;
1219 
1220 	result = usbat_flash_check_media(us, info);
1221 	if (result != USB_STOR_TRANSPORT_GOOD)
1222 		return result;
1223 
1224 	/*
1225 	 * we're working in LBA mode.  according to the ATA spec,
1226 	 * we can support up to 28-bit addressing.  I don't know if the device
1227 	 * supports beyond 24-bit addressing.  It's kind of hard to test
1228 	 * since it requires > 8GB media.
1229 	 */
1230 
1231 	if (sector > 0x0FFFFFFF)
1232 		return USB_STOR_TRANSPORT_ERROR;
1233 
1234 	totallen = sectors * info->ssize;
1235 
1236 	/*
1237 	 * Since we don't write more than 64 KB at a time, we have to create
1238 	 * a bounce buffer and move the data a piece at a time between the
1239 	 * bounce buffer and the actual transfer buffer.
1240 	 */
1241 
1242 	alloclen = min(totallen, 65536u);
1243 	buffer = kmalloc(alloclen, GFP_NOIO);
1244 	if (buffer == NULL)
1245 		return USB_STOR_TRANSPORT_ERROR;
1246 
1247 	do {
1248 		/*
1249 		 * loop, never allocate or transfer more than 64k at once
1250 		 * (min(128k, 255*info->ssize) is the real limit)
1251 		 */
1252 		len = min(totallen, alloclen);
1253 		thistime = (len / info->ssize) & 0xff;
1254 
1255 		/* Get the data from the transfer buffer */
1256 		usb_stor_access_xfer_buf(buffer, len, us->srb,
1257 					 &sg, &sg_offset, FROM_XFER_BUF);
1258 
1259 		/* ATA command 0x30 (WRITE SECTORS) */
1260 		usbat_pack_ata_sector_cmd(command, thistime, sector, 0x30);
1261 
1262 		/* Write/execute ATA write command */
1263 		result = usbat_multiple_write(us, registers, command, 7);
1264 		if (result != USB_STOR_TRANSPORT_GOOD)
1265 			goto leave;
1266 
1267 		/* Write the data */
1268 		result = usbat_write_blocks(us, buffer, len, 0);
1269 		if (result != USB_STOR_TRANSPORT_GOOD)
1270 			goto leave;
1271 
1272 		sector += thistime;
1273 		totallen -= len;
1274 	} while (totallen > 0);
1275 
1276 	kfree(buffer);
1277 	return result;
1278 
1279 leave:
1280 	kfree(buffer);
1281 	return USB_STOR_TRANSPORT_ERROR;
1282 }
1283 
1284 /*
1285  * Squeeze a potentially huge (> 65535 byte) read10 command into
1286  * a little ( <= 65535 byte) ATAPI pipe
1287  */
1288 static int usbat_hp8200e_handle_read10(struct us_data *us,
1289 				       unsigned char *registers,
1290 				       unsigned char *data,
1291 				       struct scsi_cmnd *srb)
1292 {
1293 	int result = USB_STOR_TRANSPORT_GOOD;
1294 	unsigned char *buffer;
1295 	unsigned int len;
1296 	unsigned int sector;
1297 	unsigned int sg_offset = 0;
1298 	struct scatterlist *sg = NULL;
1299 
1300 	usb_stor_dbg(us, "transfersize %d\n", srb->transfersize);
1301 
1302 	if (scsi_bufflen(srb) < 0x10000) {
1303 
1304 		result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1305 			registers, data, 19,
1306 			USBAT_ATA_DATA, USBAT_ATA_STATUS, 0xFD,
1307 			(USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1308 			DMA_FROM_DEVICE,
1309 			scsi_sglist(srb),
1310 			scsi_bufflen(srb), scsi_sg_count(srb), 1);
1311 
1312 		return result;
1313 	}
1314 
1315 	/*
1316 	 * Since we're requesting more data than we can handle in
1317 	 * a single read command (max is 64k-1), we will perform
1318 	 * multiple reads, but each read must be in multiples of
1319 	 * a sector.  Luckily the sector size is in srb->transfersize
1320 	 * (see linux/drivers/scsi/sr.c).
1321 	 */
1322 
1323 	if (data[7+0] == GPCMD_READ_CD) {
1324 		len = short_pack(data[7+9], data[7+8]);
1325 		len <<= 16;
1326 		len |= data[7+7];
1327 		usb_stor_dbg(us, "GPCMD_READ_CD: len %d\n", len);
1328 		srb->transfersize = scsi_bufflen(srb)/len;
1329 	}
1330 
1331 	if (!srb->transfersize)  {
1332 		srb->transfersize = 2048; /* A guess */
1333 		usb_stor_dbg(us, "transfersize 0, forcing %d\n",
1334 			     srb->transfersize);
1335 	}
1336 
1337 	/*
1338 	 * Since we only read in one block at a time, we have to create
1339 	 * a bounce buffer and move the data a piece at a time between the
1340 	 * bounce buffer and the actual transfer buffer.
1341 	 */
1342 
1343 	len = (65535/srb->transfersize) * srb->transfersize;
1344 	usb_stor_dbg(us, "Max read is %d bytes\n", len);
1345 	len = min(len, scsi_bufflen(srb));
1346 	buffer = kmalloc(len, GFP_NOIO);
1347 	if (buffer == NULL) /* bloody hell! */
1348 		return USB_STOR_TRANSPORT_FAILED;
1349 	sector = short_pack(data[7+3], data[7+2]);
1350 	sector <<= 16;
1351 	sector |= short_pack(data[7+5], data[7+4]);
1352 	transferred = 0;
1353 
1354 	while (transferred != scsi_bufflen(srb)) {
1355 
1356 		if (len > scsi_bufflen(srb) - transferred)
1357 			len = scsi_bufflen(srb) - transferred;
1358 
1359 		data[3] = len&0xFF; 	  /* (cylL) = expected length (L) */
1360 		data[4] = (len>>8)&0xFF;  /* (cylH) = expected length (H) */
1361 
1362 		/* Fix up the SCSI command sector and num sectors */
1363 
1364 		data[7+2] = MSB_of(sector>>16); /* SCSI command sector */
1365 		data[7+3] = LSB_of(sector>>16);
1366 		data[7+4] = MSB_of(sector&0xFFFF);
1367 		data[7+5] = LSB_of(sector&0xFFFF);
1368 		if (data[7+0] == GPCMD_READ_CD)
1369 			data[7+6] = 0;
1370 		data[7+7] = MSB_of(len / srb->transfersize); /* SCSI command */
1371 		data[7+8] = LSB_of(len / srb->transfersize); /* num sectors */
1372 
1373 		result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1374 			registers, data, 19,
1375 			USBAT_ATA_DATA, USBAT_ATA_STATUS, 0xFD,
1376 			(USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1377 			DMA_FROM_DEVICE,
1378 			buffer,
1379 			len, 0, 1);
1380 
1381 		if (result != USB_STOR_TRANSPORT_GOOD)
1382 			break;
1383 
1384 		/* Store the data in the transfer buffer */
1385 		usb_stor_access_xfer_buf(buffer, len, srb,
1386 				 &sg, &sg_offset, TO_XFER_BUF);
1387 
1388 		/* Update the amount transferred and the sector number */
1389 
1390 		transferred += len;
1391 		sector += len / srb->transfersize;
1392 
1393 	} /* while transferred != scsi_bufflen(srb) */
1394 
1395 	kfree(buffer);
1396 	return result;
1397 }
1398 
1399 static int usbat_select_and_test_registers(struct us_data *us)
1400 {
1401 	int selector;
1402 	unsigned char *status = us->iobuf;
1403 
1404 	/* try device = master, then device = slave. */
1405 	for (selector = 0xA0; selector <= 0xB0; selector += 0x10) {
1406 		if (usbat_write(us, USBAT_ATA, USBAT_ATA_DEVICE, selector) !=
1407 				USB_STOR_XFER_GOOD)
1408 			return USB_STOR_TRANSPORT_ERROR;
1409 
1410 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_STATUS, status) !=
1411 				USB_STOR_XFER_GOOD)
1412 			return USB_STOR_TRANSPORT_ERROR;
1413 
1414 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_DEVICE, status) !=
1415 				USB_STOR_XFER_GOOD)
1416 			return USB_STOR_TRANSPORT_ERROR;
1417 
1418 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, status) !=
1419 				USB_STOR_XFER_GOOD)
1420 			return USB_STOR_TRANSPORT_ERROR;
1421 
1422 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_HI, status) !=
1423 				USB_STOR_XFER_GOOD)
1424 			return USB_STOR_TRANSPORT_ERROR;
1425 
1426 		if (usbat_write(us, USBAT_ATA, USBAT_ATA_LBA_ME, 0x55) !=
1427 				USB_STOR_XFER_GOOD)
1428 			return USB_STOR_TRANSPORT_ERROR;
1429 
1430 		if (usbat_write(us, USBAT_ATA, USBAT_ATA_LBA_HI, 0xAA) !=
1431 				USB_STOR_XFER_GOOD)
1432 			return USB_STOR_TRANSPORT_ERROR;
1433 
1434 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, status) !=
1435 				USB_STOR_XFER_GOOD)
1436 			return USB_STOR_TRANSPORT_ERROR;
1437 
1438 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, status) !=
1439 				USB_STOR_XFER_GOOD)
1440 			return USB_STOR_TRANSPORT_ERROR;
1441 	}
1442 
1443 	return USB_STOR_TRANSPORT_GOOD;
1444 }
1445 
1446 /*
1447  * Initialize the USBAT processor and the storage device
1448  */
1449 static int init_usbat(struct us_data *us, int devicetype)
1450 {
1451 	int rc;
1452 	struct usbat_info *info;
1453 	unsigned char subcountH = USBAT_ATA_LBA_HI;
1454 	unsigned char subcountL = USBAT_ATA_LBA_ME;
1455 	unsigned char *status = us->iobuf;
1456 
1457 	us->extra = kzalloc(sizeof(struct usbat_info), GFP_NOIO);
1458 	if (!us->extra)
1459 		return -ENOMEM;
1460 
1461 	info = (struct usbat_info *) (us->extra);
1462 
1463 	/* Enable peripheral control signals */
1464 	rc = usbat_write_user_io(us,
1465 				 USBAT_UIO_OE1 | USBAT_UIO_OE0,
1466 				 USBAT_UIO_EPAD | USBAT_UIO_1);
1467 	if (rc != USB_STOR_XFER_GOOD)
1468 		return -EIO;
1469 
1470 	usb_stor_dbg(us, "INIT 1\n");
1471 
1472 	msleep(2000);
1473 
1474 	rc = usbat_read_user_io(us, status);
1475 	if (rc != USB_STOR_TRANSPORT_GOOD)
1476 		return -EIO;
1477 
1478 	usb_stor_dbg(us, "INIT 2\n");
1479 
1480 	rc = usbat_read_user_io(us, status);
1481 	if (rc != USB_STOR_XFER_GOOD)
1482 		return -EIO;
1483 
1484 	rc = usbat_read_user_io(us, status);
1485 	if (rc != USB_STOR_XFER_GOOD)
1486 		return -EIO;
1487 
1488 	usb_stor_dbg(us, "INIT 3\n");
1489 
1490 	rc = usbat_select_and_test_registers(us);
1491 	if (rc != USB_STOR_TRANSPORT_GOOD)
1492 		return -EIO;
1493 
1494 	usb_stor_dbg(us, "INIT 4\n");
1495 
1496 	rc = usbat_read_user_io(us, status);
1497 	if (rc != USB_STOR_XFER_GOOD)
1498 		return -EIO;
1499 
1500 	usb_stor_dbg(us, "INIT 5\n");
1501 
1502 	/* Enable peripheral control signals and card detect */
1503 	rc = usbat_device_enable_cdt(us);
1504 	if (rc != USB_STOR_TRANSPORT_GOOD)
1505 		return -EIO;
1506 
1507 	usb_stor_dbg(us, "INIT 6\n");
1508 
1509 	rc = usbat_read_user_io(us, status);
1510 	if (rc != USB_STOR_XFER_GOOD)
1511 		return -EIO;
1512 
1513 	usb_stor_dbg(us, "INIT 7\n");
1514 
1515 	msleep(1400);
1516 
1517 	rc = usbat_read_user_io(us, status);
1518 	if (rc != USB_STOR_XFER_GOOD)
1519 		return -EIO;
1520 
1521 	usb_stor_dbg(us, "INIT 8\n");
1522 
1523 	rc = usbat_select_and_test_registers(us);
1524 	if (rc != USB_STOR_TRANSPORT_GOOD)
1525 		return -EIO;
1526 
1527 	usb_stor_dbg(us, "INIT 9\n");
1528 
1529 	/* At this point, we need to detect which device we are using */
1530 	if (usbat_set_transport(us, info, devicetype))
1531 		return -EIO;
1532 
1533 	usb_stor_dbg(us, "INIT 10\n");
1534 
1535 	if (usbat_get_device_type(us) == USBAT_DEV_FLASH) {
1536 		subcountH = 0x02;
1537 		subcountL = 0x00;
1538 	}
1539 	rc = usbat_set_shuttle_features(us, (USBAT_FEAT_ETEN | USBAT_FEAT_ET2 | USBAT_FEAT_ET1),
1540 									0x00, 0x88, 0x08, subcountH, subcountL);
1541 	if (rc != USB_STOR_XFER_GOOD)
1542 		return -EIO;
1543 
1544 	usb_stor_dbg(us, "INIT 11\n");
1545 
1546 	return 0;
1547 }
1548 
1549 /*
1550  * Transport for the HP 8200e
1551  */
1552 static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
1553 {
1554 	int result;
1555 	unsigned char *status = us->iobuf;
1556 	unsigned char registers[32];
1557 	unsigned char data[32];
1558 	unsigned int len;
1559 	int i;
1560 
1561 	len = scsi_bufflen(srb);
1562 
1563 	/*
1564 	 * Send A0 (ATA PACKET COMMAND).
1565 	 * Note: I guess we're never going to get any of the ATA
1566 	 * commands... just ATA Packet Commands.
1567  	 */
1568 
1569 	registers[0] = USBAT_ATA_FEATURES;
1570 	registers[1] = USBAT_ATA_SECCNT;
1571 	registers[2] = USBAT_ATA_SECNUM;
1572 	registers[3] = USBAT_ATA_LBA_ME;
1573 	registers[4] = USBAT_ATA_LBA_HI;
1574 	registers[5] = USBAT_ATA_DEVICE;
1575 	registers[6] = USBAT_ATA_CMD;
1576 	data[0] = 0x00;
1577 	data[1] = 0x00;
1578 	data[2] = 0x00;
1579 	data[3] = len&0xFF; 		/* (cylL) = expected length (L) */
1580 	data[4] = (len>>8)&0xFF; 	/* (cylH) = expected length (H) */
1581 	data[5] = 0xB0; 		/* (device sel) = slave */
1582 	data[6] = 0xA0; 		/* (command) = ATA PACKET COMMAND */
1583 
1584 	for (i=7; i<19; i++) {
1585 		registers[i] = 0x10;
1586 		data[i] = (i-7 >= srb->cmd_len) ? 0 : srb->cmnd[i-7];
1587 	}
1588 
1589 	result = usbat_get_status(us, status);
1590 	usb_stor_dbg(us, "Status = %02X\n", *status);
1591 	if (result != USB_STOR_XFER_GOOD)
1592 		return USB_STOR_TRANSPORT_ERROR;
1593 	if (srb->cmnd[0] == TEST_UNIT_READY)
1594 		transferred = 0;
1595 
1596 	if (srb->sc_data_direction == DMA_TO_DEVICE) {
1597 
1598 		result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1599 			registers, data, 19,
1600 			USBAT_ATA_DATA, USBAT_ATA_STATUS, 0xFD,
1601 			(USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1602 			DMA_TO_DEVICE,
1603 			scsi_sglist(srb),
1604 			len, scsi_sg_count(srb), 10);
1605 
1606 		if (result == USB_STOR_TRANSPORT_GOOD) {
1607 			transferred += len;
1608 			usb_stor_dbg(us, "Wrote %08X bytes\n", transferred);
1609 		}
1610 
1611 		return result;
1612 
1613 	} else if (srb->cmnd[0] == READ_10 ||
1614 		   srb->cmnd[0] == GPCMD_READ_CD) {
1615 
1616 		return usbat_hp8200e_handle_read10(us, registers, data, srb);
1617 
1618 	}
1619 
1620 	if (len > 0xFFFF) {
1621 		usb_stor_dbg(us, "Error: len = %08X... what do I do now?\n",
1622 			     len);
1623 		return USB_STOR_TRANSPORT_ERROR;
1624 	}
1625 
1626 	result = usbat_multiple_write(us, registers, data, 7);
1627 
1628 	if (result != USB_STOR_TRANSPORT_GOOD)
1629 		return result;
1630 
1631 	/*
1632 	 * Write the 12-byte command header.
1633 	 *
1634 	 * If the command is BLANK then set the timer for 75 minutes.
1635 	 * Otherwise set it for 10 minutes.
1636 	 *
1637 	 * NOTE: THE 8200 DOCUMENTATION STATES THAT BLANKING A CDRW
1638 	 * AT SPEED 4 IS UNRELIABLE!!!
1639 	 */
1640 
1641 	result = usbat_write_block(us, USBAT_ATA, srb->cmnd, 12,
1642 				   srb->cmnd[0] == GPCMD_BLANK ? 75 : 10, 0);
1643 
1644 	if (result != USB_STOR_TRANSPORT_GOOD)
1645 		return result;
1646 
1647 	/* If there is response data to be read in then do it here. */
1648 
1649 	if (len != 0 && (srb->sc_data_direction == DMA_FROM_DEVICE)) {
1650 
1651 		/* How many bytes to read in? Check cylL register */
1652 
1653 		if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, status) !=
1654 		    	USB_STOR_XFER_GOOD) {
1655 			return USB_STOR_TRANSPORT_ERROR;
1656 		}
1657 
1658 		if (len > 0xFF) { /* need to read cylH also */
1659 			len = *status;
1660 			if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_HI, status) !=
1661 				    USB_STOR_XFER_GOOD) {
1662 				return USB_STOR_TRANSPORT_ERROR;
1663 			}
1664 			len += ((unsigned int) *status)<<8;
1665 		}
1666 		else
1667 			len = *status;
1668 
1669 
1670 		result = usbat_read_block(us, scsi_sglist(srb), len,
1671 			                                   scsi_sg_count(srb));
1672 	}
1673 
1674 	return result;
1675 }
1676 
1677 /*
1678  * Transport for USBAT02-based CompactFlash and similar storage devices
1679  */
1680 static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us)
1681 {
1682 	int rc;
1683 	struct usbat_info *info = (struct usbat_info *) (us->extra);
1684 	unsigned long block, blocks;
1685 	unsigned char *ptr = us->iobuf;
1686 	static unsigned char inquiry_response[36] = {
1687 		0x00, 0x80, 0x00, 0x01, 0x1F, 0x00, 0x00, 0x00
1688 	};
1689 
1690 	if (srb->cmnd[0] == INQUIRY) {
1691 		usb_stor_dbg(us, "INQUIRY - Returning bogus response\n");
1692 		memcpy(ptr, inquiry_response, sizeof(inquiry_response));
1693 		fill_inquiry_response(us, ptr, 36);
1694 		return USB_STOR_TRANSPORT_GOOD;
1695 	}
1696 
1697 	if (srb->cmnd[0] == READ_CAPACITY) {
1698 		rc = usbat_flash_check_media(us, info);
1699 		if (rc != USB_STOR_TRANSPORT_GOOD)
1700 			return rc;
1701 
1702 		rc = usbat_flash_get_sector_count(us, info);
1703 		if (rc != USB_STOR_TRANSPORT_GOOD)
1704 			return rc;
1705 
1706 		/* hard coded 512 byte sectors as per ATA spec */
1707 		info->ssize = 0x200;
1708 		usb_stor_dbg(us, "READ_CAPACITY: %ld sectors, %ld bytes per sector\n",
1709 			     info->sectors, info->ssize);
1710 
1711 		/*
1712 		 * build the reply
1713 		 * note: must return the sector number of the last sector,
1714 		 * *not* the total number of sectors
1715 		 */
1716 		((__be32 *) ptr)[0] = cpu_to_be32(info->sectors - 1);
1717 		((__be32 *) ptr)[1] = cpu_to_be32(info->ssize);
1718 		usb_stor_set_xfer_buf(ptr, 8, srb);
1719 
1720 		return USB_STOR_TRANSPORT_GOOD;
1721 	}
1722 
1723 	if (srb->cmnd[0] == MODE_SELECT_10) {
1724 		usb_stor_dbg(us, "Gah! MODE_SELECT_10\n");
1725 		return USB_STOR_TRANSPORT_ERROR;
1726 	}
1727 
1728 	if (srb->cmnd[0] == READ_10) {
1729 		block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1730 				((u32)(srb->cmnd[4]) <<  8) | ((u32)(srb->cmnd[5]));
1731 
1732 		blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
1733 
1734 		usb_stor_dbg(us, "READ_10: read block 0x%04lx  count %ld\n",
1735 			     block, blocks);
1736 		return usbat_flash_read_data(us, info, block, blocks);
1737 	}
1738 
1739 	if (srb->cmnd[0] == READ_12) {
1740 		/*
1741 		 * I don't think we'll ever see a READ_12 but support it anyway
1742 		 */
1743 		block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1744 		        ((u32)(srb->cmnd[4]) <<  8) | ((u32)(srb->cmnd[5]));
1745 
1746 		blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
1747 		         ((u32)(srb->cmnd[8]) <<  8) | ((u32)(srb->cmnd[9]));
1748 
1749 		usb_stor_dbg(us, "READ_12: read block 0x%04lx  count %ld\n",
1750 			     block, blocks);
1751 		return usbat_flash_read_data(us, info, block, blocks);
1752 	}
1753 
1754 	if (srb->cmnd[0] == WRITE_10) {
1755 		block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1756 		        ((u32)(srb->cmnd[4]) <<  8) | ((u32)(srb->cmnd[5]));
1757 
1758 		blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
1759 
1760 		usb_stor_dbg(us, "WRITE_10: write block 0x%04lx  count %ld\n",
1761 			     block, blocks);
1762 		return usbat_flash_write_data(us, info, block, blocks);
1763 	}
1764 
1765 	if (srb->cmnd[0] == WRITE_12) {
1766 		/*
1767 		 * I don't think we'll ever see a WRITE_12 but support it anyway
1768 		 */
1769 		block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1770 		        ((u32)(srb->cmnd[4]) <<  8) | ((u32)(srb->cmnd[5]));
1771 
1772 		blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
1773 		         ((u32)(srb->cmnd[8]) <<  8) | ((u32)(srb->cmnd[9]));
1774 
1775 		usb_stor_dbg(us, "WRITE_12: write block 0x%04lx  count %ld\n",
1776 			     block, blocks);
1777 		return usbat_flash_write_data(us, info, block, blocks);
1778 	}
1779 
1780 
1781 	if (srb->cmnd[0] == TEST_UNIT_READY) {
1782 		usb_stor_dbg(us, "TEST_UNIT_READY\n");
1783 
1784 		rc = usbat_flash_check_media(us, info);
1785 		if (rc != USB_STOR_TRANSPORT_GOOD)
1786 			return rc;
1787 
1788 		return usbat_check_status(us);
1789 	}
1790 
1791 	if (srb->cmnd[0] == REQUEST_SENSE) {
1792 		usb_stor_dbg(us, "REQUEST_SENSE\n");
1793 
1794 		memset(ptr, 0, 18);
1795 		ptr[0] = 0xF0;
1796 		ptr[2] = info->sense_key;
1797 		ptr[7] = 11;
1798 		ptr[12] = info->sense_asc;
1799 		ptr[13] = info->sense_ascq;
1800 		usb_stor_set_xfer_buf(ptr, 18, srb);
1801 
1802 		return USB_STOR_TRANSPORT_GOOD;
1803 	}
1804 
1805 	if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
1806 		/*
1807 		 * sure.  whatever.  not like we can stop the user from popping
1808 		 * the media out of the device (no locking doors, etc)
1809 		 */
1810 		return USB_STOR_TRANSPORT_GOOD;
1811 	}
1812 
1813 	usb_stor_dbg(us, "Gah! Unknown command: %d (0x%x)\n",
1814 		     srb->cmnd[0], srb->cmnd[0]);
1815 	info->sense_key = 0x05;
1816 	info->sense_asc = 0x20;
1817 	info->sense_ascq = 0x00;
1818 	return USB_STOR_TRANSPORT_FAILED;
1819 }
1820 
1821 static int init_usbat_cd(struct us_data *us)
1822 {
1823 	return init_usbat(us, USBAT_DEV_HP8200);
1824 }
1825 
1826 static int init_usbat_flash(struct us_data *us)
1827 {
1828 	return init_usbat(us, USBAT_DEV_FLASH);
1829 }
1830 
1831 static struct scsi_host_template usbat_host_template;
1832 
1833 static int usbat_probe(struct usb_interface *intf,
1834 			 const struct usb_device_id *id)
1835 {
1836 	struct us_data *us;
1837 	int result;
1838 
1839 	result = usb_stor_probe1(&us, intf, id,
1840 			(id - usbat_usb_ids) + usbat_unusual_dev_list,
1841 			&usbat_host_template);
1842 	if (result)
1843 		return result;
1844 
1845 	/*
1846 	 * The actual transport will be determined later by the
1847 	 * initialization routine; this is just a placeholder.
1848 	 */
1849 	us->transport_name = "Shuttle USBAT";
1850 	us->transport = usbat_flash_transport;
1851 	us->transport_reset = usb_stor_CB_reset;
1852 	us->max_lun = 0;
1853 
1854 	result = usb_stor_probe2(us);
1855 	return result;
1856 }
1857 
1858 static struct usb_driver usbat_driver = {
1859 	.name =		DRV_NAME,
1860 	.probe =	usbat_probe,
1861 	.disconnect =	usb_stor_disconnect,
1862 	.suspend =	usb_stor_suspend,
1863 	.resume =	usb_stor_resume,
1864 	.reset_resume =	usb_stor_reset_resume,
1865 	.pre_reset =	usb_stor_pre_reset,
1866 	.post_reset =	usb_stor_post_reset,
1867 	.id_table =	usbat_usb_ids,
1868 	.soft_unbind =	1,
1869 	.no_dynamic_id = 1,
1870 };
1871 
1872 module_usb_stor_driver(usbat_driver, usbat_host_template, DRV_NAME);
1873