1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* Driver for SCM Microsystems (a.k.a. Shuttle) USB-ATAPI cable
4	*
5	* Current development and maintenance by:
6	* (c) 2000, 2001 Robert Baruch (autophile@starband.net)
7	* (c) 2004, 2005 Daniel Drake <dsd@gentoo.org>
8	*
9	* Developed with the assistance of:
10	* (c) 2002 Alan Stern <stern@rowland.org>
11	*
12	* Flash support based on earlier work by:
13	* (c) 2002 Thomas Kreiling <usbdev@sm04.de>
14	*
15	* Many originally ATAPI devices were slightly modified to meet the USB
16	* market by using some kind of translation from ATAPI to USB on the host,
17	* and the peripheral would translate from USB back to ATAPI.
18	*
19	* SCM Microsystems (www.scmmicro.com) makes a device, sold to OEM's only,
20	* which does the USB-to-ATAPI conversion. By obtaining the data sheet on
21	* their device under nondisclosure agreement, I have been able to write
22	* this driver for Linux.
23	*
24	* The chip used in the device can also be used for EPP and ISA translation
25	* as well. This driver is only guaranteed to work with the ATAPI
26	* translation.
27	*
28	* See the Kconfig help text for a list of devices known to be supported by
29	* this driver.
30	*/
31
32	#include <linux/errno.h>
33	#include <linux/module.h>
34	#include <linux/slab.h>
35	#include <linux/cdrom.h>
36
37	#include <scsi/scsi.h>
38	#include <scsi/scsi_cmnd.h>
39
40	#include "usb.h"
41	#include "transport.h"
42	#include "protocol.h"
43	#include "debug.h"
44	#include "scsiglue.h"
45
46	#define DRV_NAME "ums-usbat"
47
48	MODULE_DESCRIPTION("Driver for SCM Microsystems (a.k.a. Shuttle) USB-ATAPI cable");
49	MODULE_AUTHOR("Daniel Drake <dsd@gentoo.org>, Robert Baruch <autophile@starband.net>");
50	MODULE_LICENSE("GPL");
51	MODULE_IMPORT_NS(USB_STORAGE);
52
53	/* Supported device types */
54	#define USBAT_DEV_HP8200 0x01
55	#define USBAT_DEV_FLASH 0x02
56
57	#define USBAT_EPP_PORT 0x10
58	#define USBAT_EPP_REGISTER 0x30
59	#define USBAT_ATA 0x40
60	#define USBAT_ISA 0x50
61
62	/* Commands (need to be logically OR'd with an access type */
63	#define USBAT_CMD_READ_REG 0x00
64	#define USBAT_CMD_WRITE_REG 0x01
65	#define USBAT_CMD_READ_BLOCK 0x02
66	#define USBAT_CMD_WRITE_BLOCK 0x03
67	#define USBAT_CMD_COND_READ_BLOCK 0x04
68	#define USBAT_CMD_COND_WRITE_BLOCK 0x05
69	#define USBAT_CMD_WRITE_REGS 0x07
70
71	/* Commands (these don't need an access type) */
72	#define USBAT_CMD_EXEC_CMD 0x80
73	#define USBAT_CMD_SET_FEAT 0x81
74	#define USBAT_CMD_UIO 0x82
75
76	/* Methods of accessing UIO register */
77	#define USBAT_UIO_READ 1
78	#define USBAT_UIO_WRITE 0
79
80	/* Qualifier bits */
81	#define USBAT_QUAL_FCQ 0x20 /* full compare */
82	#define USBAT_QUAL_ALQ 0x10 /* auto load subcount */
83
84	/* USBAT Flash Media status types */
85	#define USBAT_FLASH_MEDIA_NONE 0
86	#define USBAT_FLASH_MEDIA_CF 1
87
88	/* USBAT Flash Media change types */
89	#define USBAT_FLASH_MEDIA_SAME 0
90	#define USBAT_FLASH_MEDIA_CHANGED 1
91
92	/* USBAT ATA registers */
93	#define USBAT_ATA_DATA 0x10 /* read/write data (R/W) */
94	#define USBAT_ATA_FEATURES 0x11 /* set features (W) */
95	#define USBAT_ATA_ERROR 0x11 /* error (R) */
96	#define USBAT_ATA_SECCNT 0x12 /* sector count (R/W) */
97	#define USBAT_ATA_SECNUM 0x13 /* sector number (R/W) */
98	#define USBAT_ATA_LBA_ME 0x14 /* cylinder low (R/W) */
99	#define USBAT_ATA_LBA_HI 0x15 /* cylinder high (R/W) */
100	#define USBAT_ATA_DEVICE 0x16 /* head/device selection (R/W) */
101	#define USBAT_ATA_STATUS 0x17 /* device status (R) */
102	#define USBAT_ATA_CMD 0x17 /* device command (W) */
103	#define USBAT_ATA_ALTSTATUS 0x0E /* status (no clear IRQ) (R) */
104
105	/* USBAT User I/O Data registers */
106	#define USBAT_UIO_EPAD 0x80 /* Enable Peripheral Control Signals */
107	#define USBAT_UIO_CDT 0x40 /* Card Detect (Read Only) */
108	/* CDT = ACKD & !UI1 & !UI0 */
109	#define USBAT_UIO_1 0x20 /* I/O 1 */
110	#define USBAT_UIO_0 0x10 /* I/O 0 */
111	#define USBAT_UIO_EPP_ATA 0x08 /* 1=EPP mode, 0=ATA mode */
112	#define USBAT_UIO_UI1 0x04 /* Input 1 */
113	#define USBAT_UIO_UI0 0x02 /* Input 0 */
114	#define USBAT_UIO_INTR_ACK 0x01 /* Interrupt (ATA/ISA)/Acknowledge (EPP) */
115
116	/* USBAT User I/O Enable registers */
117	#define USBAT_UIO_DRVRST 0x80 /* Reset Peripheral */
118	#define USBAT_UIO_ACKD 0x40 /* Enable Card Detect */
119	#define USBAT_UIO_OE1 0x20 /* I/O 1 set=output/clr=input */
120	/* If ACKD=1, set OE1 to 1 also. */
121	#define USBAT_UIO_OE0 0x10 /* I/O 0 set=output/clr=input */
122	#define USBAT_UIO_ADPRST 0x01 /* Reset SCM chip */
123
124	/* USBAT Features */
125	#define USBAT_FEAT_ETEN 0x80 /* External trigger enable */
126	#define USBAT_FEAT_U1 0x08
127	#define USBAT_FEAT_U0 0x04
128	#define USBAT_FEAT_ET1 0x02
129	#define USBAT_FEAT_ET2 0x01
130
131	struct usbat_info {
132	int devicetype;
133
134	/* Used for Flash readers only */
135	unsigned long sectors; /* total sector count */
136	unsigned long ssize; /* sector size in bytes */
137
138	unsigned char sense_key;
139	unsigned long sense_asc; /* additional sense code */
140	unsigned long sense_ascq; /* additional sense code qualifier */
141	};
142
143	#define short_pack(LSB,MSB) ( ((u16)(LSB)) | ( ((u16)(MSB))<<8 ) )
144	#define LSB_of(s) ((s)&0xFF)
145	#define MSB_of(s) ((s)>>8)
146
147	static int transferred = 0;
148
149	static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us);
150	static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us);
151
152	static int init_usbat_cd(struct us_data *us);
153	static int init_usbat_flash(struct us_data *us);
154
155
156	/*
157	* The table of devices
158	*/
159	#define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
160	vendorName, productName, useProtocol, useTransport, \
161	initFunction, flags) \
162	{ USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
163	.driver_info = (flags) }
164
165	static struct usb_device_id usbat_usb_ids[] = {
166	# include "unusual_usbat.h"
167	{ } /* Terminating entry */
168	};
169	MODULE_DEVICE_TABLE(usb, usbat_usb_ids);
170
171	#undef UNUSUAL_DEV
172
173	/*
174	* The flags table
175	*/
176	#define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
177	vendor_name, product_name, use_protocol, use_transport, \
178	init_function, Flags) \
179	{ \
180	.vendorName = vendor_name, \
181	.productName = product_name, \
182	.useProtocol = use_protocol, \
183	.useTransport = use_transport, \
184	.initFunction = init_function, \
185	}
186
187	static struct us_unusual_dev usbat_unusual_dev_list[] = {
188	# include "unusual_usbat.h"
189	{ } /* Terminating entry */
190	};
191
192	#undef UNUSUAL_DEV
193
194	/*
195	* Convenience function to produce an ATA read/write sectors command
196	* Use cmd=0x20 for read, cmd=0x30 for write
197	*/
198	static void usbat_pack_ata_sector_cmd(unsigned char *buf,
199	unsigned char thistime,
200	u32 sector, unsigned char cmd)
201	{
202	buf[0] = 0;
203	buf[1] = thistime;
204	buf[2] = sector & 0xFF;
205	buf[3] = (sector >> 8) & 0xFF;
206	buf[4] = (sector >> 16) & 0xFF;
207	buf[5] = 0xE0 | ((sector >> 24) & 0x0F);
208	buf[6] = cmd;
209	}
210
211	/*
212	* Convenience function to get the device type (flash or hp8200)
213	*/
214	static int usbat_get_device_type(struct us_data *us)
215	{
216	return ((struct usbat_info*)us->extra)->devicetype;
217	}
218
219	/*
220	* Read a register from the device
221	*/
222	static int usbat_read(struct us_data *us,
223	unsigned char access,
224	unsigned char reg,
225	unsigned char *content)
226	{
227	return usb_stor_ctrl_transfer(us,
228	pipe: us->recv_ctrl_pipe,
229	request: access | USBAT_CMD_READ_REG,
230	requesttype: 0xC0,
231	value: (u16)reg,
232	index: 0,
233	data: content,
234	size: 1);
235	}
236
237	/*
238	* Write to a register on the device
239	*/
240	static int usbat_write(struct us_data *us,
241	unsigned char access,
242	unsigned char reg,
243	unsigned char content)
244	{
245	return usb_stor_ctrl_transfer(us,
246	pipe: us->send_ctrl_pipe,
247	request: access | USBAT_CMD_WRITE_REG,
248	requesttype: 0x40,
249	short_pack(reg, content),
250	index: 0,
251	NULL,
252	size: 0);
253	}
254
255	/*
256	* Convenience function to perform a bulk read
257	*/
258	static int usbat_bulk_read(struct us_data *us,
259	void* buf,
260	unsigned int len,
261	int use_sg)
262	{
263	if (len == 0)
264	return USB_STOR_XFER_GOOD;
265
266	usb_stor_dbg(us, fmt: "len = %d\n", len);
267	return usb_stor_bulk_transfer_sg(us, pipe: us->recv_bulk_pipe, buf, length: len, use_sg, NULL);
268	}
269
270	/*
271	* Convenience function to perform a bulk write
272	*/
273	static int usbat_bulk_write(struct us_data *us,
274	void* buf,
275	unsigned int len,
276	int use_sg)
277	{
278	if (len == 0)
279	return USB_STOR_XFER_GOOD;
280
281	usb_stor_dbg(us, fmt: "len = %d\n", len);
282	return usb_stor_bulk_transfer_sg(us, pipe: us->send_bulk_pipe, buf, length: len, use_sg, NULL);
283	}
284
285	/*
286	* Some USBAT-specific commands can only be executed over a command transport
287	* This transport allows one (len=8) or two (len=16) vendor-specific commands
288	* to be executed.
289	*/
290	static int usbat_execute_command(struct us_data *us,
291	unsigned char *commands,
292	unsigned int len)
293	{
294	return usb_stor_ctrl_transfer(us, pipe: us->send_ctrl_pipe,
295	USBAT_CMD_EXEC_CMD, requesttype: 0x40, value: 0, index: 0,
296	data: commands, size: len);
297	}
298
299	/*
300	* Read the status register
301	*/
302	static int usbat_get_status(struct us_data *us, unsigned char *status)
303	{
304	int rc;
305	rc = usbat_read(us, USBAT_ATA, USBAT_ATA_STATUS, content: status);
306
307	usb_stor_dbg(us, fmt: "0x%02X\n", *status);
308	return rc;
309	}
310
311	/*
312	* Check the device status
313	*/
314	static int usbat_check_status(struct us_data *us)
315	{
316	unsigned char *reply = us->iobuf;
317	int rc;
318
319	rc = usbat_get_status(us, status: reply);
320	if (rc != USB_STOR_XFER_GOOD)
321	return USB_STOR_TRANSPORT_FAILED;
322
323	/* error/check condition (0x51 is ok) */
324	if (*reply & 0x01 && *reply != 0x51)
325	return USB_STOR_TRANSPORT_FAILED;
326
327	/* device fault */
328	if (*reply & 0x20)
329	return USB_STOR_TRANSPORT_FAILED;
330
331	return USB_STOR_TRANSPORT_GOOD;
332	}
333
334	/*
335	* Stores critical information in internal registers in preparation for the execution
336	* of a conditional usbat_read_blocks or usbat_write_blocks call.
337	*/
338	static int usbat_set_shuttle_features(struct us_data *us,
339	unsigned char external_trigger,
340	unsigned char epp_control,
341	unsigned char mask_byte,
342	unsigned char test_pattern,
343	unsigned char subcountH,
344	unsigned char subcountL)
345	{
346	unsigned char *command = us->iobuf;
347
348	command[0] = 0x40;
349	command[1] = USBAT_CMD_SET_FEAT;
350
351	/*
352	* The only bit relevant to ATA access is bit 6
353	* which defines 8 bit data access (set) or 16 bit (unset)
354	*/
355	command[2] = epp_control;
356
357	/*
358	* If FCQ is set in the qualifier (defined in R/W cmd), then bits U0, U1,
359	* ET1 and ET2 define an external event to be checked for on event of a
360	* _read_blocks or _write_blocks operation. The read/write will not take
361	* place unless the defined trigger signal is active.
362	*/
363	command[3] = external_trigger;
364
365	/*
366	* The resultant byte of the mask operation (see mask_byte) is compared for
367	* equivalence with this test pattern. If equal, the read/write will take
368	* place.
369	*/
370	command[4] = test_pattern;
371
372	/*
373	* This value is logically ANDed with the status register field specified
374	* in the read/write command.
375	*/
376	command[5] = mask_byte;
377
378	/*
379	* If ALQ is set in the qualifier, this field contains the address of the
380	* registers where the byte count should be read for transferring the data.
381	* If ALQ is not set, then this field contains the number of bytes to be
382	* transferred.
383	*/
384	command[6] = subcountL;
385	command[7] = subcountH;
386
387	return usbat_execute_command(us, commands: command, len: 8);
388	}
389
390	/*
391	* Block, waiting for an ATA device to become not busy or to report
392	* an error condition.
393	*/
394	static int usbat_wait_not_busy(struct us_data *us, int minutes)
395	{
396	int i;
397	int result;
398	unsigned char *status = us->iobuf;
399
400	/*
401	* Synchronizing cache on a CDR could take a heck of a long time,
402	* but probably not more than 10 minutes or so. On the other hand,
403	* doing a full blank on a CDRW at speed 1 will take about 75
404	* minutes!
405	*/
406
407	for (i=0; i<1200+minutes*60; i++) {
408
409	result = usbat_get_status(us, status);
410
411	if (result!=USB_STOR_XFER_GOOD)
412	return USB_STOR_TRANSPORT_ERROR;
413	if (*status & 0x01) { /* check condition */
414	result = usbat_read(us, USBAT_ATA, reg: 0x10, content: status);
415	return USB_STOR_TRANSPORT_FAILED;
416	}
417	if (*status & 0x20) /* device fault */
418	return USB_STOR_TRANSPORT_FAILED;
419
420	if ((*status & 0x80)==0x00) { /* not busy */
421	usb_stor_dbg(us, fmt: "Waited not busy for %d steps\n", i);
422	return USB_STOR_TRANSPORT_GOOD;
423	}
424
425	if (i<500)
426	msleep(msecs: 10); /* 5 seconds */
427	else if (i<700)
428	msleep(msecs: 50); /* 10 seconds */
429	else if (i<1200)
430	msleep(msecs: 100); /* 50 seconds */
431	else
432	msleep(msecs: 1000); /* X minutes */
433	}
434
435	usb_stor_dbg(us, fmt: "Waited not busy for %d minutes, timing out\n",
436	minutes);
437	return USB_STOR_TRANSPORT_FAILED;
438	}
439
440	/*
441	* Read block data from the data register
442	*/
443	static int usbat_read_block(struct us_data *us,
444	void* buf,
445	unsigned short len,
446	int use_sg)
447	{
448	int result;
449	unsigned char *command = us->iobuf;
450
451	if (!len)
452	return USB_STOR_TRANSPORT_GOOD;
453
454	command[0] = 0xC0;
455	command[1] = USBAT_ATA | USBAT_CMD_READ_BLOCK;
456	command[2] = USBAT_ATA_DATA;
457	command[3] = 0;
458	command[4] = 0;
459	command[5] = 0;
460	command[6] = LSB_of(len);
461	command[7] = MSB_of(len);
462
463	result = usbat_execute_command(us, commands: command, len: 8);
464	if (result != USB_STOR_XFER_GOOD)
465	return USB_STOR_TRANSPORT_ERROR;
466
467	result = usbat_bulk_read(us, buf, len, use_sg);
468	return (result == USB_STOR_XFER_GOOD ?
469	USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
470	}
471
472	/*
473	* Write block data via the data register
474	*/
475	static int usbat_write_block(struct us_data *us,
476	unsigned char access,
477	void* buf,
478	unsigned short len,
479	int minutes,
480	int use_sg)
481	{
482	int result;
483	unsigned char *command = us->iobuf;
484
485	if (!len)
486	return USB_STOR_TRANSPORT_GOOD;
487
488	command[0] = 0x40;
489	command[1] = access | USBAT_CMD_WRITE_BLOCK;
490	command[2] = USBAT_ATA_DATA;
491	command[3] = 0;
492	command[4] = 0;
493	command[5] = 0;
494	command[6] = LSB_of(len);
495	command[7] = MSB_of(len);
496
497	result = usbat_execute_command(us, commands: command, len: 8);
498
499	if (result != USB_STOR_XFER_GOOD)
500	return USB_STOR_TRANSPORT_ERROR;
501
502	result = usbat_bulk_write(us, buf, len, use_sg);
503	if (result != USB_STOR_XFER_GOOD)
504	return USB_STOR_TRANSPORT_ERROR;
505
506	return usbat_wait_not_busy(us, minutes);
507	}
508
509	/*
510	* Process read and write requests
511	*/
512	static int usbat_hp8200e_rw_block_test(struct us_data *us,
513	unsigned char access,
514	unsigned char *registers,
515	unsigned char *data_out,
516	unsigned short num_registers,
517	unsigned char data_reg,
518	unsigned char status_reg,
519	unsigned char timeout,
520	unsigned char qualifier,
521	int direction,
522	void *buf,
523	unsigned short len,
524	int use_sg,
525	int minutes)
526	{
527	int result;
528	unsigned int pipe = (direction == DMA_FROM_DEVICE) ?
529	us->recv_bulk_pipe : us->send_bulk_pipe;
530
531	unsigned char *command = us->iobuf;
532	int i, j;
533	int cmdlen;
534	unsigned char *data = us->iobuf;
535	unsigned char *status = us->iobuf;
536
537	BUG_ON(num_registers > US_IOBUF_SIZE/2);
538
539	for (i=0; i<20; i++) {
540
541	/*
542	* The first time we send the full command, which consists
543	* of downloading the SCSI command followed by downloading
544	* the data via a write-and-test. Any other time we only
545	* send the command to download the data -- the SCSI command
546	* is still 'active' in some sense in the device.
547	*
548	* We're only going to try sending the data 10 times. After
549	* that, we just return a failure.
550	*/
551
552	if (i==0) {
553	cmdlen = 16;
554	/*
555	* Write to multiple registers
556	* Not really sure the 0x07, 0x17, 0xfc, 0xe7 is
557	* necessary here, but that's what came out of the
558	* trace every single time.
559	*/
560	command[0] = 0x40;
561	command[1] = access | USBAT_CMD_WRITE_REGS;
562	command[2] = 0x07;
563	command[3] = 0x17;
564	command[4] = 0xFC;
565	command[5] = 0xE7;
566	command[6] = LSB_of(num_registers*2);
567	command[7] = MSB_of(num_registers*2);
568	} else
569	cmdlen = 8;
570
571	/* Conditionally read or write blocks */
572	command[cmdlen-8] = (direction==DMA_TO_DEVICE ? 0x40 : 0xC0);
573	command[cmdlen-7] = access |
574	(direction==DMA_TO_DEVICE ?
575	USBAT_CMD_COND_WRITE_BLOCK : USBAT_CMD_COND_READ_BLOCK);
576	command[cmdlen-6] = data_reg;
577	command[cmdlen-5] = status_reg;
578	command[cmdlen-4] = timeout;
579	command[cmdlen-3] = qualifier;
580	command[cmdlen-2] = LSB_of(len);
581	command[cmdlen-1] = MSB_of(len);
582
583	result = usbat_execute_command(us, commands: command, len: cmdlen);
584
585	if (result != USB_STOR_XFER_GOOD)
586	return USB_STOR_TRANSPORT_ERROR;
587
588	if (i==0) {
589
590	for (j=0; j<num_registers; j++) {
591	data[j<<1] = registers[j];
592	data[1+(j<<1)] = data_out[j];
593	}
594
595	result = usbat_bulk_write(us, buf: data, len: num_registers*2, use_sg: 0);
596	if (result != USB_STOR_XFER_GOOD)
597	return USB_STOR_TRANSPORT_ERROR;
598
599	}
600
601	result = usb_stor_bulk_transfer_sg(us,
602	pipe, buf, length: len, use_sg, NULL);
603
604	/*
605	* If we get a stall on the bulk download, we'll retry
606	* the bulk download -- but not the SCSI command because
607	* in some sense the SCSI command is still 'active' and
608	* waiting for the data. Don't ask me why this should be;
609	* I'm only following what the Windoze driver did.
610	*
611	* Note that a stall for the test-and-read/write command means
612	* that the test failed. In this case we're testing to make
613	* sure that the device is error-free
614	* (i.e. bit 0 -- CHK -- of status is 0). The most likely
615	* hypothesis is that the USBAT chip somehow knows what
616	* the device will accept, but doesn't give the device any
617	* data until all data is received. Thus, the device would
618	* still be waiting for the first byte of data if a stall
619	* occurs, even if the stall implies that some data was
620	* transferred.
621	*/
622
623	if (result == USB_STOR_XFER_SHORT ||
624	result == USB_STOR_XFER_STALLED) {
625
626	/*
627	* If we're reading and we stalled, then clear
628	* the bulk output pipe only the first time.
629	*/
630
631	if (direction==DMA_FROM_DEVICE && i==0) {
632	if (usb_stor_clear_halt(us,
633	pipe: us->send_bulk_pipe) < 0)
634	return USB_STOR_TRANSPORT_ERROR;
635	}
636
637	/*
638	* Read status: is the device angry, or just busy?
639	*/
640
641	result = usbat_read(us, USBAT_ATA,
642	reg: direction==DMA_TO_DEVICE ?
643	USBAT_ATA_STATUS : USBAT_ATA_ALTSTATUS,
644	content: status);
645
646	if (result!=USB_STOR_XFER_GOOD)
647	return USB_STOR_TRANSPORT_ERROR;
648	if (*status & 0x01) /* check condition */
649	return USB_STOR_TRANSPORT_FAILED;
650	if (*status & 0x20) /* device fault */
651	return USB_STOR_TRANSPORT_FAILED;
652
653	usb_stor_dbg(us, fmt: "Redoing %s\n",
654	direction == DMA_TO_DEVICE
655	? "write" : "read");
656
657	} else if (result != USB_STOR_XFER_GOOD)
658	return USB_STOR_TRANSPORT_ERROR;
659	else
660	return usbat_wait_not_busy(us, minutes);
661
662	}
663
664	usb_stor_dbg(us, fmt: "Bummer! %s bulk data 20 times failed\n",
665	direction == DMA_TO_DEVICE ? "Writing" : "Reading");
666
667	return USB_STOR_TRANSPORT_FAILED;
668	}
669
670	/*
671	* Write to multiple registers:
672	* Allows us to write specific data to any registers. The data to be written
673	* gets packed in this sequence: reg0, data0, reg1, data1, ..., regN, dataN
674	* which gets sent through bulk out.
675	* Not designed for large transfers of data!
676	*/
677	static int usbat_multiple_write(struct us_data *us,
678	unsigned char *registers,
679	unsigned char *data_out,
680	unsigned short num_registers)
681	{
682	int i, result;
683	unsigned char *data = us->iobuf;
684	unsigned char *command = us->iobuf;
685
686	BUG_ON(num_registers > US_IOBUF_SIZE/2);
687
688	/* Write to multiple registers, ATA access */
689	command[0] = 0x40;
690	command[1] = USBAT_ATA | USBAT_CMD_WRITE_REGS;
691
692	/* No relevance */
693	command[2] = 0;
694	command[3] = 0;
695	command[4] = 0;
696	command[5] = 0;
697
698	/* Number of bytes to be transferred (incl. addresses and data) */
699	command[6] = LSB_of(num_registers*2);
700	command[7] = MSB_of(num_registers*2);
701
702	/* The setup command */
703	result = usbat_execute_command(us, commands: command, len: 8);
704	if (result != USB_STOR_XFER_GOOD)
705	return USB_STOR_TRANSPORT_ERROR;
706
707	/* Create the reg/data, reg/data sequence */
708	for (i=0; i<num_registers; i++) {
709	data[i<<1] = registers[i];
710	data[1+(i<<1)] = data_out[i];
711	}
712
713	/* Send the data */
714	result = usbat_bulk_write(us, buf: data, len: num_registers*2, use_sg: 0);
715	if (result != USB_STOR_XFER_GOOD)
716	return USB_STOR_TRANSPORT_ERROR;
717
718	if (usbat_get_device_type(us) == USBAT_DEV_HP8200)
719	return usbat_wait_not_busy(us, minutes: 0);
720	else
721	return USB_STOR_TRANSPORT_GOOD;
722	}
723
724	/*
725	* Conditionally read blocks from device:
726	* Allows us to read blocks from a specific data register, based upon the
727	* condition that a status register can be successfully masked with a status
728	* qualifier. If this condition is not initially met, the read will wait
729	* up until a maximum amount of time has elapsed, as specified by timeout.
730	* The read will start when the condition is met, otherwise the command aborts.
731	*
732	* The qualifier defined here is not the value that is masked, it defines
733	* conditions for the write to take place. The actual masked qualifier (and
734	* other related details) are defined beforehand with _set_shuttle_features().
735	*/
736	static int usbat_read_blocks(struct us_data *us,
737	void* buffer,
738	int len,
739	int use_sg)
740	{
741	int result;
742	unsigned char *command = us->iobuf;
743
744	command[0] = 0xC0;
745	command[1] = USBAT_ATA | USBAT_CMD_COND_READ_BLOCK;
746	command[2] = USBAT_ATA_DATA;
747	command[3] = USBAT_ATA_STATUS;
748	command[4] = 0xFD; /* Timeout (ms); */
749	command[5] = USBAT_QUAL_FCQ;
750	command[6] = LSB_of(len);
751	command[7] = MSB_of(len);
752
753	/* Multiple block read setup command */
754	result = usbat_execute_command(us, commands: command, len: 8);
755	if (result != USB_STOR_XFER_GOOD)
756	return USB_STOR_TRANSPORT_FAILED;
757
758	/* Read the blocks we just asked for */
759	result = usbat_bulk_read(us, buf: buffer, len, use_sg);
760	if (result != USB_STOR_XFER_GOOD)
761	return USB_STOR_TRANSPORT_FAILED;
762
763	return USB_STOR_TRANSPORT_GOOD;
764	}
765
766	/*
767	* Conditionally write blocks to device:
768	* Allows us to write blocks to a specific data register, based upon the
769	* condition that a status register can be successfully masked with a status
770	* qualifier. If this condition is not initially met, the write will wait
771	* up until a maximum amount of time has elapsed, as specified by timeout.
772	* The read will start when the condition is met, otherwise the command aborts.
773	*
774	* The qualifier defined here is not the value that is masked, it defines
775	* conditions for the write to take place. The actual masked qualifier (and
776	* other related details) are defined beforehand with _set_shuttle_features().
777	*/
778	static int usbat_write_blocks(struct us_data *us,
779	void* buffer,
780	int len,
781	int use_sg)
782	{
783	int result;
784	unsigned char *command = us->iobuf;
785
786	command[0] = 0x40;
787	command[1] = USBAT_ATA | USBAT_CMD_COND_WRITE_BLOCK;
788	command[2] = USBAT_ATA_DATA;
789	command[3] = USBAT_ATA_STATUS;
790	command[4] = 0xFD; /* Timeout (ms) */
791	command[5] = USBAT_QUAL_FCQ;
792	command[6] = LSB_of(len);
793	command[7] = MSB_of(len);
794
795	/* Multiple block write setup command */
796	result = usbat_execute_command(us, commands: command, len: 8);
797	if (result != USB_STOR_XFER_GOOD)
798	return USB_STOR_TRANSPORT_FAILED;
799
800	/* Write the data */
801	result = usbat_bulk_write(us, buf: buffer, len, use_sg);
802	if (result != USB_STOR_XFER_GOOD)
803	return USB_STOR_TRANSPORT_FAILED;
804
805	return USB_STOR_TRANSPORT_GOOD;
806	}
807
808	/*
809	* Read the User IO register
810	*/
811	static int usbat_read_user_io(struct us_data *us, unsigned char *data_flags)
812	{
813	int result;
814
815	result = usb_stor_ctrl_transfer(us,
816	pipe: us->recv_ctrl_pipe,
817	USBAT_CMD_UIO,
818	requesttype: 0xC0,
819	value: 0,
820	index: 0,
821	data: data_flags,
822	USBAT_UIO_READ);
823
824	usb_stor_dbg(us, fmt: "UIO register reads %02X\n", *data_flags);
825
826	return result;
827	}
828
829	/*
830	* Write to the User IO register
831	*/
832	static int usbat_write_user_io(struct us_data *us,
833	unsigned char enable_flags,
834	unsigned char data_flags)
835	{
836	return usb_stor_ctrl_transfer(us,
837	pipe: us->send_ctrl_pipe,
838	USBAT_CMD_UIO,
839	requesttype: 0x40,
840	short_pack(enable_flags, data_flags),
841	index: 0,
842	NULL,
843	USBAT_UIO_WRITE);
844	}
845
846	/*
847	* Reset the device
848	* Often needed on media change.
849	*/
850	static int usbat_device_reset(struct us_data *us)
851	{
852	int rc;
853
854	/*
855	* Reset peripheral, enable peripheral control signals
856	* (bring reset signal up)
857	*/
858	rc = usbat_write_user_io(us,
859	USBAT_UIO_DRVRST | USBAT_UIO_OE1 | USBAT_UIO_OE0,
860	USBAT_UIO_EPAD | USBAT_UIO_1);
861	if (rc != USB_STOR_XFER_GOOD)
862	return USB_STOR_TRANSPORT_ERROR;
863
864	/*
865	* Enable peripheral control signals
866	* (bring reset signal down)
867	*/
868	rc = usbat_write_user_io(us,
869	USBAT_UIO_OE1 | USBAT_UIO_OE0,
870	USBAT_UIO_EPAD | USBAT_UIO_1);
871	if (rc != USB_STOR_XFER_GOOD)
872	return USB_STOR_TRANSPORT_ERROR;
873
874	return USB_STOR_TRANSPORT_GOOD;
875	}
876
877	/*
878	* Enable card detect
879	*/
880	static int usbat_device_enable_cdt(struct us_data *us)
881	{
882	int rc;
883
884	/* Enable peripheral control signals and card detect */
885	rc = usbat_write_user_io(us,
886	USBAT_UIO_ACKD | USBAT_UIO_OE1 | USBAT_UIO_OE0,
887	USBAT_UIO_EPAD | USBAT_UIO_1);
888	if (rc != USB_STOR_XFER_GOOD)
889	return USB_STOR_TRANSPORT_ERROR;
890
891	return USB_STOR_TRANSPORT_GOOD;
892	}
893
894	/*
895	* Determine if media is present.
896	*/
897	static int usbat_flash_check_media_present(struct us_data *us,
898	unsigned char *uio)
899	{
900	if (*uio & USBAT_UIO_UI0) {
901	usb_stor_dbg(us, fmt: "no media detected\n");
902	return USBAT_FLASH_MEDIA_NONE;
903	}
904
905	return USBAT_FLASH_MEDIA_CF;
906	}
907
908	/*
909	* Determine if media has changed since last operation
910	*/
911	static int usbat_flash_check_media_changed(struct us_data *us,
912	unsigned char *uio)
913	{
914	if (*uio & USBAT_UIO_0) {
915	usb_stor_dbg(us, fmt: "media change detected\n");
916	return USBAT_FLASH_MEDIA_CHANGED;
917	}
918
919	return USBAT_FLASH_MEDIA_SAME;
920	}
921
922	/*
923	* Check for media change / no media and handle the situation appropriately
924	*/
925	static int usbat_flash_check_media(struct us_data *us,
926	struct usbat_info *info)
927	{
928	int rc;
929	unsigned char *uio = us->iobuf;
930
931	rc = usbat_read_user_io(us, data_flags: uio);
932	if (rc != USB_STOR_XFER_GOOD)
933	return USB_STOR_TRANSPORT_ERROR;
934
935	/* Check for media existence */
936	rc = usbat_flash_check_media_present(us, uio);
937	if (rc == USBAT_FLASH_MEDIA_NONE) {
938	info->sense_key = 0x02;
939	info->sense_asc = 0x3A;
940	info->sense_ascq = 0x00;
941	return USB_STOR_TRANSPORT_FAILED;
942	}
943
944	/* Check for media change */
945	rc = usbat_flash_check_media_changed(us, uio);
946	if (rc == USBAT_FLASH_MEDIA_CHANGED) {
947
948	/* Reset and re-enable card detect */
949	rc = usbat_device_reset(us);
950	if (rc != USB_STOR_TRANSPORT_GOOD)
951	return rc;
952	rc = usbat_device_enable_cdt(us);
953	if (rc != USB_STOR_TRANSPORT_GOOD)
954	return rc;
955
956	msleep(msecs: 50);
957
958	rc = usbat_read_user_io(us, data_flags: uio);
959	if (rc != USB_STOR_XFER_GOOD)
960	return USB_STOR_TRANSPORT_ERROR;
961
962	info->sense_key = UNIT_ATTENTION;
963	info->sense_asc = 0x28;
964	info->sense_ascq = 0x00;
965	return USB_STOR_TRANSPORT_FAILED;
966	}
967
968	return USB_STOR_TRANSPORT_GOOD;
969	}
970
971	/*
972	* Determine whether we are controlling a flash-based reader/writer,
973	* or a HP8200-based CD drive.
974	* Sets transport functions as appropriate.
975	*/
976	static int usbat_identify_device(struct us_data *us,
977	struct usbat_info *info)
978	{
979	int rc;
980	unsigned char status;
981
982	if (!us || !info)
983	return USB_STOR_TRANSPORT_ERROR;
984
985	rc = usbat_device_reset(us);
986	if (rc != USB_STOR_TRANSPORT_GOOD)
987	return rc;
988	msleep(msecs: 500);
989
990	/*
991	* In attempt to distinguish between HP CDRW's and Flash readers, we now
992	* execute the IDENTIFY PACKET DEVICE command. On ATA devices (i.e. flash
993	* readers), this command should fail with error. On ATAPI devices (i.e.
994	* CDROM drives), it should succeed.
995	*/
996	rc = usbat_write(us, USBAT_ATA, USBAT_ATA_CMD, content: 0xA1);
997	if (rc != USB_STOR_XFER_GOOD)
998	return USB_STOR_TRANSPORT_ERROR;
999
1000	rc = usbat_get_status(us, status: &status);
1001	if (rc != USB_STOR_XFER_GOOD)
1002	return USB_STOR_TRANSPORT_ERROR;
1003
1004	/* Check for error bit, or if the command 'fell through' */
1005	if (status == 0xA1 || !(status & 0x01)) {
1006	/* Device is HP 8200 */
1007	usb_stor_dbg(us, fmt: "Detected HP8200 CDRW\n");
1008	info->devicetype = USBAT_DEV_HP8200;
1009	} else {
1010	/* Device is a CompactFlash reader/writer */
1011	usb_stor_dbg(us, fmt: "Detected Flash reader/writer\n");
1012	info->devicetype = USBAT_DEV_FLASH;
1013	}
1014
1015	return USB_STOR_TRANSPORT_GOOD;
1016	}
1017
1018	/*
1019	* Set the transport function based on the device type
1020	*/
1021	static int usbat_set_transport(struct us_data *us,
1022	struct usbat_info *info,
1023	int devicetype)
1024	{
1025
1026	if (!info->devicetype)
1027	info->devicetype = devicetype;
1028
1029	if (!info->devicetype)
1030	usbat_identify_device(us, info);
1031
1032	switch (info->devicetype) {
1033	default:
1034	return USB_STOR_TRANSPORT_ERROR;
1035
1036	case USBAT_DEV_HP8200:
1037	us->transport = usbat_hp8200e_transport;
1038	break;
1039
1040	case USBAT_DEV_FLASH:
1041	us->transport = usbat_flash_transport;
1042	break;
1043	}
1044
1045	return 0;
1046	}
1047
1048	/*
1049	* Read the media capacity
1050	*/
1051	static int usbat_flash_get_sector_count(struct us_data *us,
1052	struct usbat_info *info)
1053	{
1054	unsigned char registers[3] = {
1055	USBAT_ATA_SECCNT,
1056	USBAT_ATA_DEVICE,
1057	USBAT_ATA_CMD,
1058	};
1059	unsigned char command[3] = { 0x01, 0xA0, 0xEC };
1060	unsigned char *reply;
1061	unsigned char status;
1062	int rc;
1063
1064	if (!us || !info)
1065	return USB_STOR_TRANSPORT_ERROR;
1066
1067	reply = kmalloc(size: 512, GFP_NOIO);
1068	if (!reply)
1069	return USB_STOR_TRANSPORT_ERROR;
1070
1071	/* ATA command : IDENTIFY DEVICE */
1072	rc = usbat_multiple_write(us, registers, data_out: command, num_registers: 3);
1073	if (rc != USB_STOR_XFER_GOOD) {
1074	usb_stor_dbg(us, fmt: "Gah! identify_device failed\n");
1075	rc = USB_STOR_TRANSPORT_ERROR;
1076	goto leave;
1077	}
1078
1079	/* Read device status */
1080	if (usbat_get_status(us, status: &status) != USB_STOR_XFER_GOOD) {
1081	rc = USB_STOR_TRANSPORT_ERROR;
1082	goto leave;
1083	}
1084
1085	msleep(msecs: 100);
1086
1087	/* Read the device identification data */
1088	rc = usbat_read_block(us, buf: reply, len: 512, use_sg: 0);
1089	if (rc != USB_STOR_TRANSPORT_GOOD)
1090	goto leave;
1091
1092	info->sectors = ((u32)(reply[117]) << 24) |
1093	((u32)(reply[116]) << 16) |
1094	((u32)(reply[115]) << 8) |
1095	((u32)(reply[114]) );
1096
1097	rc = USB_STOR_TRANSPORT_GOOD;
1098
1099	leave:
1100	kfree(objp: reply);
1101	return rc;
1102	}
1103
1104	/*
1105	* Read data from device
1106	*/
1107	static int usbat_flash_read_data(struct us_data *us,
1108	struct usbat_info *info,
1109	u32 sector,
1110	u32 sectors)
1111	{
1112	unsigned char registers[7] = {
1113	USBAT_ATA_FEATURES,
1114	USBAT_ATA_SECCNT,
1115	USBAT_ATA_SECNUM,
1116	USBAT_ATA_LBA_ME,
1117	USBAT_ATA_LBA_HI,
1118	USBAT_ATA_DEVICE,
1119	USBAT_ATA_STATUS,
1120	};
1121	unsigned char command[7];
1122	unsigned char *buffer;
1123	unsigned char thistime;
1124	unsigned int totallen, alloclen;
1125	int len, result;
1126	unsigned int sg_offset = 0;
1127	struct scatterlist *sg = NULL;
1128
1129	result = usbat_flash_check_media(us, info);
1130	if (result != USB_STOR_TRANSPORT_GOOD)
1131	return result;
1132
1133	/*
1134	* we're working in LBA mode. according to the ATA spec,
1135	* we can support up to 28-bit addressing. I don't know if Jumpshot
1136	* supports beyond 24-bit addressing. It's kind of hard to test
1137	* since it requires > 8GB CF card.
1138	*/
1139
1140	if (sector > 0x0FFFFFFF)
1141	return USB_STOR_TRANSPORT_ERROR;
1142
1143	totallen = sectors * info->ssize;
1144
1145	/*
1146	* Since we don't read more than 64 KB at a time, we have to create
1147	* a bounce buffer and move the data a piece at a time between the
1148	* bounce buffer and the actual transfer buffer.
1149	*/
1150
1151	alloclen = min(totallen, 65536u);
1152	buffer = kmalloc(size: alloclen, GFP_NOIO);
1153	if (buffer == NULL)
1154	return USB_STOR_TRANSPORT_ERROR;
1155
1156	do {
1157	/*
1158	* loop, never allocate or transfer more than 64k at once
1159	* (min(128k, 255*info->ssize) is the real limit)
1160	*/
1161	len = min(totallen, alloclen);
1162	thistime = (len / info->ssize) & 0xff;
1163
1164	/* ATA command 0x20 (READ SECTORS) */
1165	usbat_pack_ata_sector_cmd(buf: command, thistime, sector, cmd: 0x20);
1166
1167	/* Write/execute ATA read command */
1168	result = usbat_multiple_write(us, registers, data_out: command, num_registers: 7);
1169	if (result != USB_STOR_TRANSPORT_GOOD)
1170	goto leave;
1171
1172	/* Read the data we just requested */
1173	result = usbat_read_blocks(us, buffer, len, use_sg: 0);
1174	if (result != USB_STOR_TRANSPORT_GOOD)
1175	goto leave;
1176
1177	usb_stor_dbg(us, fmt: "%d bytes\n", len);
1178
1179	/* Store the data in the transfer buffer */
1180	usb_stor_access_xfer_buf(buffer, buflen: len, srb: us->srb,
1181	&sg, offset: &sg_offset, dir: TO_XFER_BUF);
1182
1183	sector += thistime;
1184	totallen -= len;
1185	} while (totallen > 0);
1186
1187	kfree(objp: buffer);
1188	return USB_STOR_TRANSPORT_GOOD;
1189
1190	leave:
1191	kfree(objp: buffer);
1192	return USB_STOR_TRANSPORT_ERROR;
1193	}
1194
1195	/*
1196	* Write data to device
1197	*/
1198	static int usbat_flash_write_data(struct us_data *us,
1199	struct usbat_info *info,
1200	u32 sector,
1201	u32 sectors)
1202	{
1203	unsigned char registers[7] = {
1204	USBAT_ATA_FEATURES,
1205	USBAT_ATA_SECCNT,
1206	USBAT_ATA_SECNUM,
1207	USBAT_ATA_LBA_ME,
1208	USBAT_ATA_LBA_HI,
1209	USBAT_ATA_DEVICE,
1210	USBAT_ATA_STATUS,
1211	};
1212	unsigned char command[7];
1213	unsigned char *buffer;
1214	unsigned char thistime;
1215	unsigned int totallen, alloclen;
1216	int len, result;
1217	unsigned int sg_offset = 0;
1218	struct scatterlist *sg = NULL;
1219
1220	result = usbat_flash_check_media(us, info);
1221	if (result != USB_STOR_TRANSPORT_GOOD)
1222	return result;
1223
1224	/*
1225	* we're working in LBA mode. according to the ATA spec,
1226	* we can support up to 28-bit addressing. I don't know if the device
1227	* supports beyond 24-bit addressing. It's kind of hard to test
1228	* since it requires > 8GB media.
1229	*/
1230
1231	if (sector > 0x0FFFFFFF)
1232	return USB_STOR_TRANSPORT_ERROR;
1233
1234	totallen = sectors * info->ssize;
1235
1236	/*
1237	* Since we don't write more than 64 KB at a time, we have to create
1238	* a bounce buffer and move the data a piece at a time between the
1239	* bounce buffer and the actual transfer buffer.
1240	*/
1241
1242	alloclen = min(totallen, 65536u);
1243	buffer = kmalloc(size: alloclen, GFP_NOIO);
1244	if (buffer == NULL)
1245	return USB_STOR_TRANSPORT_ERROR;
1246
1247	do {
1248	/*
1249	* loop, never allocate or transfer more than 64k at once
1250	* (min(128k, 255*info->ssize) is the real limit)
1251	*/
1252	len = min(totallen, alloclen);
1253	thistime = (len / info->ssize) & 0xff;
1254
1255	/* Get the data from the transfer buffer */
1256	usb_stor_access_xfer_buf(buffer, buflen: len, srb: us->srb,
1257	&sg, offset: &sg_offset, dir: FROM_XFER_BUF);
1258
1259	/* ATA command 0x30 (WRITE SECTORS) */
1260	usbat_pack_ata_sector_cmd(buf: command, thistime, sector, cmd: 0x30);
1261
1262	/* Write/execute ATA write command */
1263	result = usbat_multiple_write(us, registers, data_out: command, num_registers: 7);
1264	if (result != USB_STOR_TRANSPORT_GOOD)
1265	goto leave;
1266
1267	/* Write the data */
1268	result = usbat_write_blocks(us, buffer, len, use_sg: 0);
1269	if (result != USB_STOR_TRANSPORT_GOOD)
1270	goto leave;
1271
1272	sector += thistime;
1273	totallen -= len;
1274	} while (totallen > 0);
1275
1276	kfree(objp: buffer);
1277	return result;
1278
1279	leave:
1280	kfree(objp: buffer);
1281	return USB_STOR_TRANSPORT_ERROR;
1282	}
1283
1284	/*
1285	* Squeeze a potentially huge (> 65535 byte) read10 command into
1286	* a little ( <= 65535 byte) ATAPI pipe
1287	*/
1288	static int usbat_hp8200e_handle_read10(struct us_data *us,
1289	unsigned char *registers,
1290	unsigned char *data,
1291	struct scsi_cmnd *srb)
1292	{
1293	int result = USB_STOR_TRANSPORT_GOOD;
1294	unsigned char *buffer;
1295	unsigned int len;
1296	unsigned int sector;
1297	unsigned int sg_offset = 0;
1298	struct scatterlist *sg = NULL;
1299
1300	usb_stor_dbg(us, fmt: "transfersize %d\n", srb->transfersize);
1301
1302	if (scsi_bufflen(cmd: srb) < 0x10000) {
1303
1304	result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1305	registers, data_out: data, num_registers: 19,
1306	USBAT_ATA_DATA, USBAT_ATA_STATUS, timeout: 0xFD,
1307	qualifier: (USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1308	direction: DMA_FROM_DEVICE,
1309	buf: scsi_sglist(cmd: srb),
1310	len: scsi_bufflen(cmd: srb), use_sg: scsi_sg_count(cmd: srb), minutes: 1);
1311
1312	return result;
1313	}
1314
1315	/*
1316	* Since we're requesting more data than we can handle in
1317	* a single read command (max is 64k-1), we will perform
1318	* multiple reads, but each read must be in multiples of
1319	* a sector. Luckily the sector size is in srb->transfersize
1320	* (see linux/drivers/scsi/sr.c).
1321	*/
1322
1323	if (data[7+0] == GPCMD_READ_CD) {
1324	len = short_pack(data[7+9], data[7+8]);
1325	len <<= 16;
1326	len |= data[7+7];
1327	usb_stor_dbg(us, fmt: "GPCMD_READ_CD: len %d\n", len);
1328	srb->transfersize = scsi_bufflen(cmd: srb)/len;
1329	}
1330
1331	if (!srb->transfersize) {
1332	srb->transfersize = 2048; /* A guess */
1333	usb_stor_dbg(us, fmt: "transfersize 0, forcing %d\n",
1334	srb->transfersize);
1335	}
1336
1337	/*
1338	* Since we only read in one block at a time, we have to create
1339	* a bounce buffer and move the data a piece at a time between the
1340	* bounce buffer and the actual transfer buffer.
1341	*/
1342
1343	len = (65535/srb->transfersize) * srb->transfersize;
1344	usb_stor_dbg(us, fmt: "Max read is %d bytes\n", len);
1345	len = min(len, scsi_bufflen(srb));
1346	buffer = kmalloc(size: len, GFP_NOIO);
1347	if (buffer == NULL) /* bloody hell! */
1348	return USB_STOR_TRANSPORT_FAILED;
1349	sector = short_pack(data[7+3], data[7+2]);
1350	sector <<= 16;
1351	sector |= short_pack(data[7+5], data[7+4]);
1352	transferred = 0;
1353
1354	while (transferred != scsi_bufflen(cmd: srb)) {
1355
1356	if (len > scsi_bufflen(cmd: srb) - transferred)
1357	len = scsi_bufflen(cmd: srb) - transferred;
1358
1359	data[3] = len&0xFF; /* (cylL) = expected length (L) */
1360	data[4] = (len>>8)&0xFF; /* (cylH) = expected length (H) */
1361
1362	/* Fix up the SCSI command sector and num sectors */
1363
1364	data[7+2] = MSB_of(sector>>16); /* SCSI command sector */
1365	data[7+3] = LSB_of(sector>>16);
1366	data[7+4] = MSB_of(sector&0xFFFF);
1367	data[7+5] = LSB_of(sector&0xFFFF);
1368	if (data[7+0] == GPCMD_READ_CD)
1369	data[7+6] = 0;
1370	data[7+7] = MSB_of(len / srb->transfersize); /* SCSI command */
1371	data[7+8] = LSB_of(len / srb->transfersize); /* num sectors */
1372
1373	result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1374	registers, data_out: data, num_registers: 19,
1375	USBAT_ATA_DATA, USBAT_ATA_STATUS, timeout: 0xFD,
1376	qualifier: (USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1377	direction: DMA_FROM_DEVICE,
1378	buf: buffer,
1379	len, use_sg: 0, minutes: 1);
1380
1381	if (result != USB_STOR_TRANSPORT_GOOD)
1382	break;
1383
1384	/* Store the data in the transfer buffer */
1385	usb_stor_access_xfer_buf(buffer, buflen: len, srb,
1386	&sg, offset: &sg_offset, dir: TO_XFER_BUF);
1387
1388	/* Update the amount transferred and the sector number */
1389
1390	transferred += len;
1391	sector += len / srb->transfersize;
1392
1393	} /* while transferred != scsi_bufflen(srb) */
1394
1395	kfree(objp: buffer);
1396	return result;
1397	}
1398
1399	static int usbat_select_and_test_registers(struct us_data *us)
1400	{
1401	int selector;
1402	unsigned char *status = us->iobuf;
1403
1404	/* try device = master, then device = slave. */
1405	for (selector = 0xA0; selector <= 0xB0; selector += 0x10) {
1406	if (usbat_write(us, USBAT_ATA, USBAT_ATA_DEVICE, content: selector) !=
1407	USB_STOR_XFER_GOOD)
1408	return USB_STOR_TRANSPORT_ERROR;
1409
1410	if (usbat_read(us, USBAT_ATA, USBAT_ATA_STATUS, content: status) !=
1411	USB_STOR_XFER_GOOD)
1412	return USB_STOR_TRANSPORT_ERROR;
1413
1414	if (usbat_read(us, USBAT_ATA, USBAT_ATA_DEVICE, content: status) !=
1415	USB_STOR_XFER_GOOD)
1416	return USB_STOR_TRANSPORT_ERROR;
1417
1418	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, content: status) !=
1419	USB_STOR_XFER_GOOD)
1420	return USB_STOR_TRANSPORT_ERROR;
1421
1422	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_HI, content: status) !=
1423	USB_STOR_XFER_GOOD)
1424	return USB_STOR_TRANSPORT_ERROR;
1425
1426	if (usbat_write(us, USBAT_ATA, USBAT_ATA_LBA_ME, content: 0x55) !=
1427	USB_STOR_XFER_GOOD)
1428	return USB_STOR_TRANSPORT_ERROR;
1429
1430	if (usbat_write(us, USBAT_ATA, USBAT_ATA_LBA_HI, content: 0xAA) !=
1431	USB_STOR_XFER_GOOD)
1432	return USB_STOR_TRANSPORT_ERROR;
1433
1434	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, content: status) !=
1435	USB_STOR_XFER_GOOD)
1436	return USB_STOR_TRANSPORT_ERROR;
1437
1438	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, content: status) !=
1439	USB_STOR_XFER_GOOD)
1440	return USB_STOR_TRANSPORT_ERROR;
1441	}
1442
1443	return USB_STOR_TRANSPORT_GOOD;
1444	}
1445
1446	/*
1447	* Initialize the USBAT processor and the storage device
1448	*/
1449	static int init_usbat(struct us_data *us, int devicetype)
1450	{
1451	int rc;
1452	struct usbat_info *info;
1453	unsigned char subcountH = USBAT_ATA_LBA_HI;
1454	unsigned char subcountL = USBAT_ATA_LBA_ME;
1455	unsigned char *status = us->iobuf;
1456
1457	us->extra = kzalloc(size: sizeof(struct usbat_info), GFP_NOIO);
1458	if (!us->extra)
1459	return -ENOMEM;
1460
1461	info = (struct usbat_info *) (us->extra);
1462
1463	/* Enable peripheral control signals */
1464	rc = usbat_write_user_io(us,
1465	USBAT_UIO_OE1 | USBAT_UIO_OE0,
1466	USBAT_UIO_EPAD | USBAT_UIO_1);
1467	if (rc != USB_STOR_XFER_GOOD)
1468	return -EIO;
1469
1470	usb_stor_dbg(us, fmt: "INIT 1\n");
1471
1472	msleep(msecs: 2000);
1473
1474	rc = usbat_read_user_io(us, data_flags: status);
1475	if (rc != USB_STOR_TRANSPORT_GOOD)
1476	return -EIO;
1477
1478	usb_stor_dbg(us, fmt: "INIT 2\n");
1479
1480	rc = usbat_read_user_io(us, data_flags: status);
1481	if (rc != USB_STOR_XFER_GOOD)
1482	return -EIO;
1483
1484	rc = usbat_read_user_io(us, data_flags: status);
1485	if (rc != USB_STOR_XFER_GOOD)
1486	return -EIO;
1487
1488	usb_stor_dbg(us, fmt: "INIT 3\n");
1489
1490	rc = usbat_select_and_test_registers(us);
1491	if (rc != USB_STOR_TRANSPORT_GOOD)
1492	return -EIO;
1493
1494	usb_stor_dbg(us, fmt: "INIT 4\n");
1495
1496	rc = usbat_read_user_io(us, data_flags: status);
1497	if (rc != USB_STOR_XFER_GOOD)
1498	return -EIO;
1499
1500	usb_stor_dbg(us, fmt: "INIT 5\n");
1501
1502	/* Enable peripheral control signals and card detect */
1503	rc = usbat_device_enable_cdt(us);
1504	if (rc != USB_STOR_TRANSPORT_GOOD)
1505	return -EIO;
1506
1507	usb_stor_dbg(us, fmt: "INIT 6\n");
1508
1509	rc = usbat_read_user_io(us, data_flags: status);
1510	if (rc != USB_STOR_XFER_GOOD)
1511	return -EIO;
1512
1513	usb_stor_dbg(us, fmt: "INIT 7\n");
1514
1515	msleep(msecs: 1400);
1516
1517	rc = usbat_read_user_io(us, data_flags: status);
1518	if (rc != USB_STOR_XFER_GOOD)
1519	return -EIO;
1520
1521	usb_stor_dbg(us, fmt: "INIT 8\n");
1522
1523	rc = usbat_select_and_test_registers(us);
1524	if (rc != USB_STOR_TRANSPORT_GOOD)
1525	return -EIO;
1526
1527	usb_stor_dbg(us, fmt: "INIT 9\n");
1528
1529	/* At this point, we need to detect which device we are using */
1530	if (usbat_set_transport(us, info, devicetype))
1531	return -EIO;
1532
1533	usb_stor_dbg(us, fmt: "INIT 10\n");
1534
1535	if (usbat_get_device_type(us) == USBAT_DEV_FLASH) {
1536	subcountH = 0x02;
1537	subcountL = 0x00;
1538	}
1539	rc = usbat_set_shuttle_features(us, external_trigger: (USBAT_FEAT_ETEN | USBAT_FEAT_ET2 | USBAT_FEAT_ET1),
1540	epp_control: 0x00, mask_byte: 0x88, test_pattern: 0x08, subcountH, subcountL);
1541	if (rc != USB_STOR_XFER_GOOD)
1542	return -EIO;
1543
1544	usb_stor_dbg(us, fmt: "INIT 11\n");
1545
1546	return 0;
1547	}
1548
1549	/*
1550	* Transport for the HP 8200e
1551	*/
1552	static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
1553	{
1554	int result;
1555	unsigned char *status = us->iobuf;
1556	unsigned char registers[32];
1557	unsigned char data[32];
1558	unsigned int len;
1559	int i;
1560
1561	len = scsi_bufflen(cmd: srb);
1562
1563	/*
1564	* Send A0 (ATA PACKET COMMAND).
1565	* Note: I guess we're never going to get any of the ATA
1566	* commands... just ATA Packet Commands.
1567	*/
1568
1569	registers[0] = USBAT_ATA_FEATURES;
1570	registers[1] = USBAT_ATA_SECCNT;
1571	registers[2] = USBAT_ATA_SECNUM;
1572	registers[3] = USBAT_ATA_LBA_ME;
1573	registers[4] = USBAT_ATA_LBA_HI;
1574	registers[5] = USBAT_ATA_DEVICE;
1575	registers[6] = USBAT_ATA_CMD;
1576	data[0] = 0x00;
1577	data[1] = 0x00;
1578	data[2] = 0x00;
1579	data[3] = len&0xFF; /* (cylL) = expected length (L) */
1580	data[4] = (len>>8)&0xFF; /* (cylH) = expected length (H) */
1581	data[5] = 0xB0; /* (device sel) = slave */
1582	data[6] = 0xA0; /* (command) = ATA PACKET COMMAND */
1583
1584	for (i=7; i<19; i++) {
1585	registers[i] = 0x10;
1586	data[i] = (i-7 >= srb->cmd_len) ? 0 : srb->cmnd[i-7];
1587	}
1588
1589	result = usbat_get_status(us, status);
1590	usb_stor_dbg(us, fmt: "Status = %02X\n", *status);
1591	if (result != USB_STOR_XFER_GOOD)
1592	return USB_STOR_TRANSPORT_ERROR;
1593	if (srb->cmnd[0] == TEST_UNIT_READY)
1594	transferred = 0;
1595
1596	if (srb->sc_data_direction == DMA_TO_DEVICE) {
1597
1598	result = usbat_hp8200e_rw_block_test(us, USBAT_ATA,
1599	registers, data_out: data, num_registers: 19,
1600	USBAT_ATA_DATA, USBAT_ATA_STATUS, timeout: 0xFD,
1601	qualifier: (USBAT_QUAL_FCQ | USBAT_QUAL_ALQ),
1602	direction: DMA_TO_DEVICE,
1603	buf: scsi_sglist(cmd: srb),
1604	len, use_sg: scsi_sg_count(cmd: srb), minutes: 10);
1605
1606	if (result == USB_STOR_TRANSPORT_GOOD) {
1607	transferred += len;
1608	usb_stor_dbg(us, fmt: "Wrote %08X bytes\n", transferred);
1609	}
1610
1611	return result;
1612
1613	} else if (srb->cmnd[0] == READ_10 ||
1614	srb->cmnd[0] == GPCMD_READ_CD) {
1615
1616	return usbat_hp8200e_handle_read10(us, registers, data, srb);
1617
1618	}
1619
1620	if (len > 0xFFFF) {
1621	usb_stor_dbg(us, fmt: "Error: len = %08X... what do I do now?\n",
1622	len);
1623	return USB_STOR_TRANSPORT_ERROR;
1624	}
1625
1626	result = usbat_multiple_write(us, registers, data_out: data, num_registers: 7);
1627
1628	if (result != USB_STOR_TRANSPORT_GOOD)
1629	return result;
1630
1631	/*
1632	* Write the 12-byte command header.
1633	*
1634	* If the command is BLANK then set the timer for 75 minutes.
1635	* Otherwise set it for 10 minutes.
1636	*
1637	* NOTE: THE 8200 DOCUMENTATION STATES THAT BLANKING A CDRW
1638	* AT SPEED 4 IS UNRELIABLE!!!
1639	*/
1640
1641	result = usbat_write_block(us, USBAT_ATA, buf: srb->cmnd, len: 12,
1642	minutes: srb->cmnd[0] == GPCMD_BLANK ? 75 : 10, use_sg: 0);
1643
1644	if (result != USB_STOR_TRANSPORT_GOOD)
1645	return result;
1646
1647	/* If there is response data to be read in then do it here. */
1648
1649	if (len != 0 && (srb->sc_data_direction == DMA_FROM_DEVICE)) {
1650
1651	/* How many bytes to read in? Check cylL register */
1652
1653	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_ME, content: status) !=
1654	USB_STOR_XFER_GOOD) {
1655	return USB_STOR_TRANSPORT_ERROR;
1656	}
1657
1658	if (len > 0xFF) { /* need to read cylH also */
1659	len = *status;
1660	if (usbat_read(us, USBAT_ATA, USBAT_ATA_LBA_HI, content: status) !=
1661	USB_STOR_XFER_GOOD) {
1662	return USB_STOR_TRANSPORT_ERROR;
1663	}
1664	len += ((unsigned int) *status)<<8;
1665	}
1666	else
1667	len = *status;
1668
1669
1670	result = usbat_read_block(us, buf: scsi_sglist(cmd: srb), len,
1671	use_sg: scsi_sg_count(cmd: srb));
1672	}
1673
1674	return result;
1675	}
1676
1677	/*
1678	* Transport for USBAT02-based CompactFlash and similar storage devices
1679	*/
1680	static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us)
1681	{
1682	int rc;
1683	struct usbat_info *info = (struct usbat_info *) (us->extra);
1684	unsigned long block, blocks;
1685	unsigned char *ptr = us->iobuf;
1686	static unsigned char inquiry_response[36] = {
1687	0x00, 0x80, 0x00, 0x01, 0x1F, 0x00, 0x00, 0x00
1688	};
1689
1690	if (srb->cmnd[0] == INQUIRY) {
1691	usb_stor_dbg(us, fmt: "INQUIRY - Returning bogus response\n");
1692	memcpy(ptr, inquiry_response, sizeof(inquiry_response));
1693	fill_inquiry_response(us, data: ptr, data_len: 36);
1694	return USB_STOR_TRANSPORT_GOOD;
1695	}
1696
1697	if (srb->cmnd[0] == READ_CAPACITY) {
1698	rc = usbat_flash_check_media(us, info);
1699	if (rc != USB_STOR_TRANSPORT_GOOD)
1700	return rc;
1701
1702	rc = usbat_flash_get_sector_count(us, info);
1703	if (rc != USB_STOR_TRANSPORT_GOOD)
1704	return rc;
1705
1706	/* hard coded 512 byte sectors as per ATA spec */
1707	info->ssize = 0x200;
1708	usb_stor_dbg(us, fmt: "READ_CAPACITY: %ld sectors, %ld bytes per sector\n",
1709	info->sectors, info->ssize);
1710
1711	/*
1712	* build the reply
1713	* note: must return the sector number of the last sector,
1714	* *not* the total number of sectors
1715	*/
1716	((__be32 *) ptr)[0] = cpu_to_be32(info->sectors - 1);
1717	((__be32 *) ptr)[1] = cpu_to_be32(info->ssize);
1718	usb_stor_set_xfer_buf(buffer: ptr, buflen: 8, srb);
1719
1720	return USB_STOR_TRANSPORT_GOOD;
1721	}
1722
1723	if (srb->cmnd[0] == MODE_SELECT_10) {
1724	usb_stor_dbg(us, fmt: "Gah! MODE_SELECT_10\n");
1725	return USB_STOR_TRANSPORT_ERROR;
1726	}
1727
1728	if (srb->cmnd[0] == READ_10) {
1729	block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1730	((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
1731
1732	blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
1733
1734	usb_stor_dbg(us, fmt: "READ_10: read block 0x%04lx count %ld\n",
1735	block, blocks);
1736	return usbat_flash_read_data(us, info, sector: block, sectors: blocks);
1737	}
1738
1739	if (srb->cmnd[0] == READ_12) {
1740	/*
1741	* I don't think we'll ever see a READ_12 but support it anyway
1742	*/
1743	block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1744	((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
1745
1746	blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
1747	((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
1748
1749	usb_stor_dbg(us, fmt: "READ_12: read block 0x%04lx count %ld\n",
1750	block, blocks);
1751	return usbat_flash_read_data(us, info, sector: block, sectors: blocks);
1752	}
1753
1754	if (srb->cmnd[0] == WRITE_10) {
1755	block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1756	((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
1757
1758	blocks = ((u32)(srb->cmnd[7]) << 8) | ((u32)(srb->cmnd[8]));
1759
1760	usb_stor_dbg(us, fmt: "WRITE_10: write block 0x%04lx count %ld\n",
1761	block, blocks);
1762	return usbat_flash_write_data(us, info, sector: block, sectors: blocks);
1763	}
1764
1765	if (srb->cmnd[0] == WRITE_12) {
1766	/*
1767	* I don't think we'll ever see a WRITE_12 but support it anyway
1768	*/
1769	block = ((u32)(srb->cmnd[2]) << 24) | ((u32)(srb->cmnd[3]) << 16) |
1770	((u32)(srb->cmnd[4]) << 8) | ((u32)(srb->cmnd[5]));
1771
1772	blocks = ((u32)(srb->cmnd[6]) << 24) | ((u32)(srb->cmnd[7]) << 16) |
1773	((u32)(srb->cmnd[8]) << 8) | ((u32)(srb->cmnd[9]));
1774
1775	usb_stor_dbg(us, fmt: "WRITE_12: write block 0x%04lx count %ld\n",
1776	block, blocks);
1777	return usbat_flash_write_data(us, info, sector: block, sectors: blocks);
1778	}
1779
1780
1781	if (srb->cmnd[0] == TEST_UNIT_READY) {
1782	usb_stor_dbg(us, fmt: "TEST_UNIT_READY\n");
1783
1784	rc = usbat_flash_check_media(us, info);
1785	if (rc != USB_STOR_TRANSPORT_GOOD)
1786	return rc;
1787
1788	return usbat_check_status(us);
1789	}
1790
1791	if (srb->cmnd[0] == REQUEST_SENSE) {
1792	usb_stor_dbg(us, fmt: "REQUEST_SENSE\n");
1793
1794	memset(ptr, 0, 18);
1795	ptr[0] = 0xF0;
1796	ptr[2] = info->sense_key;
1797	ptr[7] = 11;
1798	ptr[12] = info->sense_asc;
1799	ptr[13] = info->sense_ascq;
1800	usb_stor_set_xfer_buf(buffer: ptr, buflen: 18, srb);
1801
1802	return USB_STOR_TRANSPORT_GOOD;
1803	}
1804
1805	if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
1806	/*
1807	* sure. whatever. not like we can stop the user from popping
1808	* the media out of the device (no locking doors, etc)
1809	*/
1810	return USB_STOR_TRANSPORT_GOOD;
1811	}
1812
1813	usb_stor_dbg(us, fmt: "Gah! Unknown command: %d (0x%x)\n",
1814	srb->cmnd[0], srb->cmnd[0]);
1815	info->sense_key = 0x05;
1816	info->sense_asc = 0x20;
1817	info->sense_ascq = 0x00;
1818	return USB_STOR_TRANSPORT_FAILED;
1819	}
1820
1821	static int init_usbat_cd(struct us_data *us)
1822	{
1823	return init_usbat(us, USBAT_DEV_HP8200);
1824	}
1825
1826	static int init_usbat_flash(struct us_data *us)
1827	{
1828	return init_usbat(us, USBAT_DEV_FLASH);
1829	}
1830
1831	static struct scsi_host_template usbat_host_template;
1832
1833	static int usbat_probe(struct usb_interface *intf,
1834	const struct usb_device_id *id)
1835	{
1836	struct us_data *us;
1837	int result;
1838
1839	result = usb_stor_probe1(pus: &us, intf, id,
1840	unusual_dev: (id - usbat_usb_ids) + usbat_unusual_dev_list,
1841	sht: &usbat_host_template);
1842	if (result)
1843	return result;
1844
1845	/*
1846	* The actual transport will be determined later by the
1847	* initialization routine; this is just a placeholder.
1848	*/
1849	us->transport_name = "Shuttle USBAT";
1850	us->transport = usbat_flash_transport;
1851	us->transport_reset = usb_stor_CB_reset;
1852	us->max_lun = 0;
1853
1854	result = usb_stor_probe2(us);
1855	return result;
1856	}
1857
1858	static struct usb_driver usbat_driver = {
1859	.name = DRV_NAME,
1860	.probe = usbat_probe,
1861	.disconnect = usb_stor_disconnect,
1862	.suspend = usb_stor_suspend,
1863	.resume = usb_stor_resume,
1864	.reset_resume = usb_stor_reset_resume,
1865	.pre_reset = usb_stor_pre_reset,
1866	.post_reset = usb_stor_post_reset,
1867	.id_table = usbat_usb_ids,
1868	.soft_unbind = 1,
1869	.no_dynamic_id = 1,
1870	};
1871
1872	module_usb_stor_driver(usbat_driver, usbat_host_template, DRV_NAME);
1873