drivers/usb/storage/uas.c

   1 /*
   2  * USB Attached SCSI
   3  * Note that this is not the same as the USB Mass Storage driver
   4  *
   5  * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016
   6  * Copyright Matthew Wilcox for Intel Corp, 2010
   7  * Copyright Sarah Sharp for Intel Corp, 2010
   8  *
   9  * Distributed under the terms of the GNU GPL, version two.
  10  */
  11
  12 #include <linux/blkdev.h>
  13 #include <linux/slab.h>
  14 #include <linux/types.h>
  15 #include <linux/module.h>
  16 #include <linux/usb.h>
  17 #include <linux/usb_usual.h>
  18 #include <linux/usb/hcd.h>
  19 #include <linux/usb/storage.h>
  20 #include <linux/usb/uas.h>
  21
  22 #include <scsi/scsi.h>
  23 #include <scsi/scsi_eh.h>
  24 #include <scsi/scsi_dbg.h>
  25 #include <scsi/scsi_cmnd.h>
  26 #include <scsi/scsi_device.h>
  27 #include <scsi/scsi_host.h>
  28 #include <scsi/scsi_tcq.h>
  29
  30 #include "uas-detect.h"
  31 #include "scsiglue.h"
  32
  33 #define MAX_CMNDS 256
  34
  35 /*
  36  * The r00-r01c specs define this version of the SENSE IU data structure.
  37  * It's still in use by several different firmware releases.
  38  */
  39 struct sense_iu_old {
  40         __u8 iu_id;
  41         __u8 rsvd1;
  42         __be16 tag;
  43         __be16 len;
  44         __u8 status;
  45         __u8 service_response;
  46         __u8 sense[SCSI_SENSE_BUFFERSIZE];
  47 };
  48
  49 struct uas_dev_info {
  50         struct usb_interface *intf;
  51         struct usb_device *udev;
  52         struct usb_anchor cmd_urbs;
  53         struct usb_anchor sense_urbs;
  54         struct usb_anchor data_urbs;
  55         unsigned long flags;
  56         int qdepth, resetting;
  57         struct response_iu response;
  58         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
  59         unsigned use_streams:1;
  60         unsigned uas_sense_old:1;
  61         unsigned running_task:1;
  62         unsigned shutdown:1;
  63         struct scsi_cmnd *cmnd;
  64         spinlock_t lock;
  65         struct work_struct work;
  66         struct list_head inflight_list;
  67         struct list_head dead_list;
  68 };
  69
  70 enum {
  71         SUBMIT_STATUS_URB       = (1 << 1),
  72         ALLOC_DATA_IN_URB       = (1 << 2),
  73         SUBMIT_DATA_IN_URB      = (1 << 3),
  74         ALLOC_DATA_OUT_URB      = (1 << 4),
  75         SUBMIT_DATA_OUT_URB     = (1 << 5),
  76         ALLOC_CMD_URB           = (1 << 6),
  77         SUBMIT_CMD_URB          = (1 << 7),
  78         COMMAND_INFLIGHT        = (1 << 8),
  79         DATA_IN_URB_INFLIGHT    = (1 << 9),
  80         DATA_OUT_URB_INFLIGHT   = (1 << 10),
  81         COMMAND_COMPLETED       = (1 << 11),
  82         COMMAND_ABORTED         = (1 << 12),
  83         UNLINK_DATA_URBS        = (1 << 13),
  84         IS_IN_WORK_LIST         = (1 << 14),
  85 };
  86
  87 /* Overrides scsi_pointer */
  88 struct uas_cmd_info {
  89         unsigned int state;
  90         unsigned int stream;
  91         struct urb *cmd_urb;
  92         struct urb *data_in_urb;
  93         struct urb *data_out_urb;
  94         struct list_head list;
  95 };
  96
  97 /* I hate forward declarations, but I actually have a loop */
  98 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
  99                                 struct uas_dev_info *devinfo, gfp_t gfp);
 100 static void uas_do_work(struct work_struct *work);
 101 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
 102 static void uas_free_streams(struct uas_dev_info *devinfo);
 103 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller);
 104
 105 /* Must be called with devinfo->lock held, will temporary unlock the lock */
 106 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
 107                                  struct uas_cmd_info *cmdinfo,
 108                                  unsigned long *lock_flags)
 109 {
 110         /*
 111          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
 112          * (called by urb completion) doesn't release cmdinfo
 113          * underneath us.
 114          */
 115         cmdinfo->state |= UNLINK_DATA_URBS;
 116         spin_unlock_irqrestore(&devinfo->lock, *lock_flags);
 117
 118         if (cmdinfo->data_in_urb)
 119                 usb_unlink_urb(cmdinfo->data_in_urb);
 120         if (cmdinfo->data_out_urb)
 121                 usb_unlink_urb(cmdinfo->data_out_urb);
 122
 123         spin_lock_irqsave(&devinfo->lock, *lock_flags);
 124         cmdinfo->state &= ~UNLINK_DATA_URBS;
 125 }
 126
 127 static void uas_do_work(struct work_struct *work)
 128 {
 129         struct uas_dev_info *devinfo =
 130                 container_of(work, struct uas_dev_info, work);
 131         struct uas_cmd_info *cmdinfo;
 132         unsigned long flags;
 133         int err;
 134
 135         spin_lock_irqsave(&devinfo->lock, flags);
 136         list_for_each_entry(cmdinfo, &devinfo->inflight_list, list) {
 137                 struct scsi_pointer *scp = (void *)cmdinfo;
 138                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
 139                                                       SCp);
 140
 141                 if (!(cmdinfo->state & IS_IN_WORK_LIST))
 142                         continue;
 143
 144                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 145                 if (!err)
 146                         cmdinfo->state &= ~IS_IN_WORK_LIST;
 147                 else
 148                         schedule_work(&devinfo->work);
 149         }
 150         spin_unlock_irqrestore(&devinfo->lock, flags);
 151 }
 152
 153 static void uas_mark_cmd_dead(struct uas_dev_info *devinfo,
 154                               struct uas_cmd_info *cmdinfo,
 155                               int result, const char *caller)
 156 {
 157         struct scsi_pointer *scp = (void *)cmdinfo;
 158         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
 159
 160         uas_log_cmd_state(cmnd, caller);
 161         lockdep_assert_held(&devinfo->lock);
 162         WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
 163         cmdinfo->state |= COMMAND_ABORTED;
 164         cmdinfo->state &= ~IS_IN_WORK_LIST;
 165         cmnd->result = result << 16;
 166         list_move_tail(&cmdinfo->list, &devinfo->dead_list);
 167 }
 168
 169 static void uas_abort_inflight(struct uas_dev_info *devinfo, int result,
 170                                const char *caller)
 171 {
 172         struct uas_cmd_info *cmdinfo;
 173         struct uas_cmd_info *temp;
 174         unsigned long flags;
 175
 176         spin_lock_irqsave(&devinfo->lock, flags);
 177         list_for_each_entry_safe(cmdinfo, temp, &devinfo->inflight_list, list)
 178                 uas_mark_cmd_dead(devinfo, cmdinfo, result, caller);
 179         spin_unlock_irqrestore(&devinfo->lock, flags);
 180 }
 181
 182 static void uas_add_work(struct uas_cmd_info *cmdinfo)
 183 {
 184         struct scsi_pointer *scp = (void *)cmdinfo;
 185         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
 186         struct uas_dev_info *devinfo = cmnd->device->hostdata;
 187
 188         lockdep_assert_held(&devinfo->lock);
 189         cmdinfo->state |= IS_IN_WORK_LIST;
 190         schedule_work(&devinfo->work);
 191 }
 192
 193 static void uas_zap_dead(struct uas_dev_info *devinfo)
 194 {
 195         struct uas_cmd_info *cmdinfo;
 196         struct uas_cmd_info *temp;
 197         unsigned long flags;
 198
 199         spin_lock_irqsave(&devinfo->lock, flags);
 200         list_for_each_entry_safe(cmdinfo, temp, &devinfo->dead_list, list) {
 201                 struct scsi_pointer *scp = (void *)cmdinfo;
 202                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
 203                                                       SCp);
 204                 uas_log_cmd_state(cmnd, __func__);
 205                 WARN_ON_ONCE(!(cmdinfo->state & COMMAND_ABORTED));
 206                 /* all urbs are killed, clear inflight bits */
 207                 cmdinfo->state &= ~(COMMAND_INFLIGHT |
 208                                     DATA_IN_URB_INFLIGHT |
 209                                     DATA_OUT_URB_INFLIGHT);
 210                 uas_try_complete(cmnd, __func__);
 211         }
 212         devinfo->running_task = 0;
 213         spin_unlock_irqrestore(&devinfo->lock, flags);
 214 }
 215
 216 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
 217 {
 218         struct sense_iu *sense_iu = urb->transfer_buffer;
 219         struct scsi_device *sdev = cmnd->device;
 220
 221         if (urb->actual_length > 16) {
 222                 unsigned len = be16_to_cpup(&sense_iu->len);
 223                 if (len + 16 != urb->actual_length) {
 224                         int newlen = min(len + 16, urb->actual_length) - 16;
 225                         if (newlen < 0)
 226                                 newlen = 0;
 227                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 228                                 "disagrees with IU sense data length %d, "
 229                                 "using %d bytes of sense data\n", __func__,
 230                                         urb->actual_length, len, newlen);
 231                         len = newlen;
 232                 }
 233                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 234         }
 235
 236         cmnd->result = sense_iu->status;
 237 }
 238
 239 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
 240 {
 241         struct sense_iu_old *sense_iu = urb->transfer_buffer;
 242         struct scsi_device *sdev = cmnd->device;
 243
 244         if (urb->actual_length > 8) {
 245                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
 246                 if (len + 8 != urb->actual_length) {
 247                         int newlen = min(len + 8, urb->actual_length) - 8;
 248                         if (newlen < 0)
 249                                 newlen = 0;
 250                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 251                                 "disagrees with IU sense data length %d, "
 252                                 "using %d bytes of sense data\n", __func__,
 253                                         urb->actual_length, len, newlen);
 254                         len = newlen;
 255                 }
 256                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 257         }
 258
 259         cmnd->result = sense_iu->status;
 260 }
 261
 262 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
 263 {
 264         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
 265
 266         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
 267                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
 268                     caller, cmnd, cmnd->request->tag,
 269                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
 270                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
 271                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
 272                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
 273                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
 274                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
 275                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
 276                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
 277                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
 278                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
 279                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
 280                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
 281                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
 282                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
 283 }
 284
 285 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
 286 {
 287         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 288         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 289
 290         lockdep_assert_held(&devinfo->lock);
 291         if (cmdinfo->state & (COMMAND_INFLIGHT |
 292                               DATA_IN_URB_INFLIGHT |
 293                               DATA_OUT_URB_INFLIGHT |
 294                               UNLINK_DATA_URBS))
 295                 return -EBUSY;
 296         WARN_ON_ONCE(cmdinfo->state & COMMAND_COMPLETED);
 297         cmdinfo->state |= COMMAND_COMPLETED;
 298         usb_free_urb(cmdinfo->data_in_urb);
 299         usb_free_urb(cmdinfo->data_out_urb);
 300         if (cmdinfo->state & COMMAND_ABORTED)
 301                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
 302         list_del(&cmdinfo->list);
 303         cmnd->scsi_done(cmnd);
 304         return 0;
 305 }
 306
 307 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
 308                           unsigned direction)
 309 {
 310         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 311         int err;
 312
 313         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
 314         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 315         if (err) {
 316                 uas_add_work(cmdinfo);
 317         }
 318 }
 319
 320 static void uas_stat_cmplt(struct urb *urb)
 321 {
 322         struct iu *iu = urb->transfer_buffer;
 323         struct Scsi_Host *shost = urb->context;
 324         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
 325         struct scsi_cmnd *cmnd;
 326         struct uas_cmd_info *cmdinfo;
 327         unsigned long flags;
 328         u16 tag;
 329
 330         if (urb->status) {
 331                 if (urb->status == -ENOENT) {
 332                         dev_err(&urb->dev->dev, "stat urb: killed, stream %d\n",
 333                                 urb->stream_id);
 334                 } else {
 335                         dev_err(&urb->dev->dev, "stat urb: status %d\n",
 336                                 urb->status);
 337                 }
 338                 usb_free_urb(urb);
 339                 return;
 340         }
 341
 342         if (devinfo->resetting) {
 343                 usb_free_urb(urb);
 344                 return;
 345         }
 346
 347         spin_lock_irqsave(&devinfo->lock, flags);
 348         tag = be16_to_cpup(&iu->tag) - 1;
 349         if (tag == 0)
 350                 cmnd = devinfo->cmnd;
 351         else
 352                 cmnd = scsi_host_find_tag(shost, tag - 1);
 353
 354         if (!cmnd) {
 355                 if (iu->iu_id == IU_ID_RESPONSE) {
 356                         if (!devinfo->running_task)
 357                                 dev_warn(&urb->dev->dev,
 358                                     "stat urb: recv unexpected response iu\n");
 359                         /* store results for uas_eh_task_mgmt() */
 360                         memcpy(&devinfo->response, iu, sizeof(devinfo->response));
 361                 }
 362                 usb_free_urb(urb);
 363                 spin_unlock_irqrestore(&devinfo->lock, flags);
 364                 return;
 365         }
 366
 367         cmdinfo = (void *)&cmnd->SCp;
 368         switch (iu->iu_id) {
 369         case IU_ID_STATUS:
 370                 if (devinfo->cmnd == cmnd)
 371                         devinfo->cmnd = NULL;
 372
 373                 if (urb->actual_length < 16)
 374                         devinfo->uas_sense_old = 1;
 375                 if (devinfo->uas_sense_old)
 376                         uas_sense_old(urb, cmnd);
 377                 else
 378                         uas_sense(urb, cmnd);
 379                 if (cmnd->result != 0) {
 380                         /* cancel data transfers on error */
 381                         uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
 382                 }
 383                 cmdinfo->state &= ~COMMAND_INFLIGHT;
 384                 uas_try_complete(cmnd, __func__);
 385                 break;
 386         case IU_ID_READ_READY:
 387                 if (!cmdinfo->data_in_urb ||
 388                                 (cmdinfo->state & DATA_IN_URB_INFLIGHT)) {
 389                         scmd_printk(KERN_ERR, cmnd, "unexpected read rdy\n");
 390                         break;
 391                 }
 392                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
 393                 break;
 394         case IU_ID_WRITE_READY:
 395                 if (!cmdinfo->data_out_urb ||
 396                                 (cmdinfo->state & DATA_OUT_URB_INFLIGHT)) {
 397                         scmd_printk(KERN_ERR, cmnd, "unexpected write rdy\n");
 398                         break;
 399                 }
 400                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
 401                 break;
 402         default:
 403                 scmd_printk(KERN_ERR, cmnd,
 404                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
 405         }
 406         usb_free_urb(urb);
 407         spin_unlock_irqrestore(&devinfo->lock, flags);
 408 }
 409
 410 static void uas_data_cmplt(struct urb *urb)
 411 {
 412         struct scsi_cmnd *cmnd = urb->context;
 413         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 414         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 415         struct scsi_data_buffer *sdb = NULL;
 416         unsigned long flags;
 417
 418         spin_lock_irqsave(&devinfo->lock, flags);
 419         if (cmdinfo->data_in_urb == urb) {
 420                 sdb = scsi_in(cmnd);
 421                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
 422         } else if (cmdinfo->data_out_urb == urb) {
 423                 sdb = scsi_out(cmnd);
 424                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
 425         }
 426         if (sdb == NULL) {
 427                 WARN_ON_ONCE(1);
 428         } else if (urb->status) {
 429                 if (urb->status != -ECONNRESET) {
 430                         uas_log_cmd_state(cmnd, __func__);
 431                         scmd_printk(KERN_ERR, cmnd,
 432                                 "data cmplt err %d stream %d\n",
 433                                 urb->status, urb->stream_id);
 434                 }
 435                 /* error: no data transfered */
 436                 sdb->resid = sdb->length;
 437         } else {
 438                 sdb->resid = sdb->length - urb->actual_length;
 439         }
 440         uas_try_complete(cmnd, __func__);
 441         spin_unlock_irqrestore(&devinfo->lock, flags);
 442 }
 443
 444 static void uas_cmd_cmplt(struct urb *urb)
 445 {
 446         struct scsi_cmnd *cmnd = urb->context;
 447
 448         if (urb->status) {
 449                 uas_log_cmd_state(cmnd, __func__);
 450                 scmd_printk(KERN_ERR, cmnd, "cmd cmplt err %d\n", urb->status);
 451         }
 452         usb_free_urb(urb);
 453 }
 454
 455 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 456                                       unsigned int pipe, u16 stream_id,
 457                                       struct scsi_cmnd *cmnd,
 458                                       enum dma_data_direction dir)
 459 {
 460         struct usb_device *udev = devinfo->udev;
 461         struct urb *urb = usb_alloc_urb(0, gfp);
 462         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
 463                 ? scsi_in(cmnd) : scsi_out(cmnd);
 464
 465         if (!urb)
 466                 goto out;
 467         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
 468                           uas_data_cmplt, cmnd);
 469         urb->stream_id = stream_id;
 470         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
 471         urb->sg = sdb->table.sgl;
 472  out:
 473         return urb;
 474 }
 475
 476 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 477                                        struct Scsi_Host *shost, u16 stream_id)
 478 {
 479         struct usb_device *udev = devinfo->udev;
 480         struct urb *urb = usb_alloc_urb(0, gfp);
 481         struct sense_iu *iu;
 482
 483         if (!urb)
 484                 goto out;
 485
 486         iu = kzalloc(sizeof(*iu), gfp);
 487         if (!iu)
 488                 goto free;
 489
 490         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
 491                                                 uas_stat_cmplt, shost);
 492         urb->stream_id = stream_id;
 493         urb->transfer_flags |= URB_FREE_BUFFER;
 494  out:
 495         return urb;
 496  free:
 497         usb_free_urb(urb);
 498         return NULL;
 499 }
 500
 501 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 502                                         struct scsi_cmnd *cmnd)
 503 {
 504         struct usb_device *udev = devinfo->udev;
 505         struct scsi_device *sdev = cmnd->device;
 506         struct urb *urb = usb_alloc_urb(0, gfp);
 507         struct command_iu *iu;
 508         int len;
 509
 510         if (!urb)
 511                 goto out;
 512
 513         len = cmnd->cmd_len - 16;
 514         if (len < 0)
 515                 len = 0;
 516         len = ALIGN(len, 4);
 517         iu = kzalloc(sizeof(*iu) + len, gfp);
 518         if (!iu)
 519                 goto free;
 520
 521         iu->iu_id = IU_ID_COMMAND;
 522         if (blk_rq_tagged(cmnd->request))
 523                 iu->tag = cpu_to_be16(cmnd->request->tag + 2);
 524         else
 525                 iu->tag = cpu_to_be16(1);
 526         iu->prio_attr = UAS_SIMPLE_TAG;
 527         iu->len = len;
 528         int_to_scsilun(sdev->lun, &iu->lun);
 529         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
 530
 531         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
 532                                                         uas_cmd_cmplt, cmnd);
 533         urb->transfer_flags |= URB_FREE_BUFFER;
 534  out:
 535         return urb;
 536  free:
 537         usb_free_urb(urb);
 538         return NULL;
 539 }
 540
 541 static int uas_submit_task_urb(struct scsi_cmnd *cmnd, gfp_t gfp,
 542                                u8 function, u16 stream_id)
 543 {
 544         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 545         struct usb_device *udev = devinfo->udev;
 546         struct urb *urb = usb_alloc_urb(0, gfp);
 547         struct task_mgmt_iu *iu;
 548         int err = -ENOMEM;
 549
 550         if (!urb)
 551                 goto err;
 552
 553         iu = kzalloc(sizeof(*iu), gfp);
 554         if (!iu)
 555                 goto err;
 556
 557         iu->iu_id = IU_ID_TASK_MGMT;
 558         iu->tag = cpu_to_be16(stream_id);
 559         int_to_scsilun(cmnd->device->lun, &iu->lun);
 560
 561         iu->function = function;
 562         switch (function) {
 563         case TMF_ABORT_TASK:
 564                 if (blk_rq_tagged(cmnd->request))
 565                         iu->task_tag = cpu_to_be16(cmnd->request->tag + 2);
 566                 else
 567                         iu->task_tag = cpu_to_be16(1);
 568                 break;
 569         }
 570
 571         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu),
 572                           uas_cmd_cmplt, cmnd);
 573         urb->transfer_flags |= URB_FREE_BUFFER;
 574
 575         usb_anchor_urb(urb, &devinfo->cmd_urbs);
 576         err = usb_submit_urb(urb, gfp);
 577         if (err) {
 578                 usb_unanchor_urb(urb);
 579                 uas_log_cmd_state(cmnd, __func__);
 580                 scmd_printk(KERN_ERR, cmnd, "task submission err %d\n", err);
 581                 goto err;
 582         }
 583
 584         return 0;
 585
 586 err:
 587         usb_free_urb(urb);
 588         return err;
 589 }
 590
 591 /*
 592  * Why should I request the Status IU before sending the Command IU?  Spec
 593  * says to, but also says the device may receive them in any order.  Seems
 594  * daft to me.
 595  */
 596
 597 static struct urb *uas_submit_sense_urb(struct scsi_cmnd *cmnd,
 598                                         gfp_t gfp, unsigned int stream)
 599 {
 600         struct Scsi_Host *shost = cmnd->device->host;
 601         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
 602         struct urb *urb;
 603         int err;
 604
 605         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
 606         if (!urb)
 607                 return NULL;
 608         usb_anchor_urb(urb, &devinfo->sense_urbs);
 609         err = usb_submit_urb(urb, gfp);
 610         if (err) {
 611                 usb_unanchor_urb(urb);
 612                 uas_log_cmd_state(cmnd, __func__);
 613                 shost_printk(KERN_INFO, shost,
 614                              "sense urb submission error %d stream %d\n",
 615                              err, stream);
 616                 usb_free_urb(urb);
 617                 return NULL;
 618         }
 619         return urb;
 620 }
 621
 622 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
 623                            struct uas_dev_info *devinfo, gfp_t gfp)
 624 {
 625         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 626         struct urb *urb;
 627         int err;
 628
 629         lockdep_assert_held(&devinfo->lock);
 630         if (cmdinfo->state & SUBMIT_STATUS_URB) {
 631                 urb = uas_submit_sense_urb(cmnd, gfp, cmdinfo->stream);
 632                 if (!urb)
 633                         return SCSI_MLQUEUE_DEVICE_BUSY;
 634                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
 635         }
 636
 637         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
 638                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
 639                                         devinfo->data_in_pipe, cmdinfo->stream,
 640                                         cmnd, DMA_FROM_DEVICE);
 641                 if (!cmdinfo->data_in_urb)
 642                         return SCSI_MLQUEUE_DEVICE_BUSY;
 643                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
 644         }
 645
 646         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
 647                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
 648                 err = usb_submit_urb(cmdinfo->data_in_urb, gfp);
 649                 if (err) {
 650                         usb_unanchor_urb(cmdinfo->data_in_urb);
 651                         uas_log_cmd_state(cmnd, __func__);
 652                         scmd_printk(KERN_INFO, cmnd,
 653                                 "data in urb submission error %d stream %d\n",
 654                                 err, cmdinfo->data_in_urb->stream_id);
 655                         return SCSI_MLQUEUE_DEVICE_BUSY;
 656                 }
 657                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
 658                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
 659         }
 660
 661         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
 662                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
 663                                         devinfo->data_out_pipe, cmdinfo->stream,
 664                                         cmnd, DMA_TO_DEVICE);
 665                 if (!cmdinfo->data_out_urb)
 666                         return SCSI_MLQUEUE_DEVICE_BUSY;
 667                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
 668         }
 669
 670         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
 671                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
 672                 err = usb_submit_urb(cmdinfo->data_out_urb, gfp);
 673                 if (err) {
 674                         usb_unanchor_urb(cmdinfo->data_out_urb);
 675                         uas_log_cmd_state(cmnd, __func__);
 676                         scmd_printk(KERN_INFO, cmnd,
 677                                 "data out urb submission error %d stream %d\n",
 678                                 err, cmdinfo->data_out_urb->stream_id);
 679                         return SCSI_MLQUEUE_DEVICE_BUSY;
 680                 }
 681                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
 682                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
 683         }
 684
 685         if (cmdinfo->state & ALLOC_CMD_URB) {
 686                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd);
 687                 if (!cmdinfo->cmd_urb)
 688                         return SCSI_MLQUEUE_DEVICE_BUSY;
 689                 cmdinfo->state &= ~ALLOC_CMD_URB;
 690         }
 691
 692         if (cmdinfo->state & SUBMIT_CMD_URB) {
 693                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
 694                 err = usb_submit_urb(cmdinfo->cmd_urb, gfp);
 695                 if (err) {
 696                         usb_unanchor_urb(cmdinfo->cmd_urb);
 697                         uas_log_cmd_state(cmnd, __func__);
 698                         scmd_printk(KERN_INFO, cmnd,
 699                                     "cmd urb submission error %d\n", err);
 700                         return SCSI_MLQUEUE_DEVICE_BUSY;
 701                 }
 702                 cmdinfo->cmd_urb = NULL;
 703                 cmdinfo->state &= ~SUBMIT_CMD_URB;
 704                 cmdinfo->state |= COMMAND_INFLIGHT;
 705         }
 706
 707         return 0;
 708 }
 709
 710 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 711                                         void (*done)(struct scsi_cmnd *))
 712 {
 713         struct scsi_device *sdev = cmnd->device;
 714         struct uas_dev_info *devinfo = sdev->hostdata;
 715         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 716         unsigned long flags;
 717         int err;
 718
 719         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
 720
 721         if ((devinfo->flags & US_FL_NO_ATA_1X) &&
 722                         (cmnd->cmnd[0] == ATA_12 || cmnd->cmnd[0] == ATA_16)) {
 723                 memcpy(cmnd->sense_buffer, usb_stor_sense_invalidCDB,
 724                        sizeof(usb_stor_sense_invalidCDB));
 725                 cmnd->result = SAM_STAT_CHECK_CONDITION;
 726                 cmnd->scsi_done(cmnd);
 727                 return 0;
 728         }
 729
 730         spin_lock_irqsave(&devinfo->lock, flags);
 731
 732         if (devinfo->resetting) {
 733                 cmnd->result = DID_ERROR << 16;
 734                 cmnd->scsi_done(cmnd);
 735                 spin_unlock_irqrestore(&devinfo->lock, flags);
 736                 return 0;
 737         }
 738
 739         if (devinfo->cmnd) {
 740                 spin_unlock_irqrestore(&devinfo->lock, flags);
 741                 return SCSI_MLQUEUE_DEVICE_BUSY;
 742         }
 743
 744         memset(cmdinfo, 0, sizeof(*cmdinfo));
 745
 746         if (blk_rq_tagged(cmnd->request)) {
 747                 cmdinfo->stream = cmnd->request->tag + 2;
 748         } else {
 749                 devinfo->cmnd = cmnd;
 750                 cmdinfo->stream = 1;
 751         }
 752
 753         cmnd->scsi_done = done;
 754
 755         cmdinfo->state = SUBMIT_STATUS_URB |
 756                         ALLOC_CMD_URB | SUBMIT_CMD_URB;
 757
 758         switch (cmnd->sc_data_direction) {
 759         case DMA_FROM_DEVICE:
 760                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 761                 break;
 762         case DMA_BIDIRECTIONAL:
 763                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 764         case DMA_TO_DEVICE:
 765                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
 766         case DMA_NONE:
 767                 break;
 768         }
 769
 770         if (!devinfo->use_streams) {
 771                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
 772                 cmdinfo->stream = 0;
 773         }
 774
 775         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
 776         if (err) {
 777                 /* If we did nothing, give up now */
 778                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
 779                         spin_unlock_irqrestore(&devinfo->lock, flags);
 780                         return SCSI_MLQUEUE_DEVICE_BUSY;
 781                 }
 782                 uas_add_work(cmdinfo);
 783         }
 784
 785         list_add_tail(&cmdinfo->list, &devinfo->inflight_list);
 786         spin_unlock_irqrestore(&devinfo->lock, flags);
 787         return 0;
 788 }
 789
 790 static DEF_SCSI_QCMD(uas_queuecommand)
 791
 792 static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
 793                             const char *fname, u8 function)
 794 {
 795         struct Scsi_Host *shost = cmnd->device->host;
 796         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
 797         u16 tag = devinfo->qdepth;
 798         unsigned long flags;
 799         struct urb *sense_urb;
 800         int result = SUCCESS;
 801
 802         spin_lock_irqsave(&devinfo->lock, flags);
 803
 804         if (devinfo->resetting) {
 805                 spin_unlock_irqrestore(&devinfo->lock, flags);
 806                 return FAILED;
 807         }
 808
 809         if (devinfo->running_task) {
 810                 shost_printk(KERN_INFO, shost,
 811                              "%s: %s: error already running a task\n",
 812                              __func__, fname);
 813                 spin_unlock_irqrestore(&devinfo->lock, flags);
 814                 return FAILED;
 815         }
 816
 817         devinfo->running_task = 1;
 818         memset(&devinfo->response, 0, sizeof(devinfo->response));
 819         sense_urb = uas_submit_sense_urb(cmnd, GFP_ATOMIC,
 820                                          devinfo->use_streams ? tag : 0);
 821         if (!sense_urb) {
 822                 shost_printk(KERN_INFO, shost,
 823                              "%s: %s: submit sense urb failed\n",
 824                              __func__, fname);
 825                 devinfo->running_task = 0;
 826                 spin_unlock_irqrestore(&devinfo->lock, flags);
 827                 return FAILED;
 828         }
 829         if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
 830                 shost_printk(KERN_INFO, shost,
 831                              "%s: %s: submit task mgmt urb failed\n",
 832                              __func__, fname);
 833                 devinfo->running_task = 0;
 834                 spin_unlock_irqrestore(&devinfo->lock, flags);
 835                 usb_kill_urb(sense_urb);
 836                 return FAILED;
 837         }
 838         spin_unlock_irqrestore(&devinfo->lock, flags);
 839
 840         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 3000) == 0) {
 841                 /*
 842                  * Note we deliberately do not clear running_task here. If we
 843                  * allow new tasks to be submitted, there is no way to figure
 844                  * out if a received response_iu is for the failed task or for
 845                  * the new one. A bus-reset will eventually clear running_task.
 846                  */
 847                 shost_printk(KERN_INFO, shost,
 848                              "%s: %s timed out\n", __func__, fname);
 849                 return FAILED;
 850         }
 851
 852         spin_lock_irqsave(&devinfo->lock, flags);
 853         devinfo->running_task = 0;
 854         if (be16_to_cpu(devinfo->response.tag) != tag) {
 855                 shost_printk(KERN_INFO, shost,
 856                              "%s: %s failed (wrong tag %d/%d)\n", __func__,
 857                              fname, be16_to_cpu(devinfo->response.tag), tag);
 858                 result = FAILED;
 859         } else if (devinfo->response.response_code != RC_TMF_COMPLETE) {
 860                 shost_printk(KERN_INFO, shost,
 861                              "%s: %s failed (rc 0x%x)\n", __func__,
 862                              fname, devinfo->response.response_code);
 863                 result = FAILED;
 864         }
 865         spin_unlock_irqrestore(&devinfo->lock, flags);
 866
 867         return result;
 868 }
 869
 870 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
 871 {
 872         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 873         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 874         unsigned long flags;
 875         int ret;
 876
 877         spin_lock_irqsave(&devinfo->lock, flags);
 878
 879         if (devinfo->resetting) {
 880                 spin_unlock_irqrestore(&devinfo->lock, flags);
 881                 return FAILED;
 882         }
 883
 884         uas_mark_cmd_dead(devinfo, cmdinfo, DID_ABORT, __func__);
 885         if (cmdinfo->state & COMMAND_INFLIGHT) {
 886                 spin_unlock_irqrestore(&devinfo->lock, flags);
 887                 ret = uas_eh_task_mgmt(cmnd, "ABORT TASK", TMF_ABORT_TASK);
 888         } else {
 889                 uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
 890                 uas_try_complete(cmnd, __func__);
 891                 spin_unlock_irqrestore(&devinfo->lock, flags);
 892                 ret = SUCCESS;
 893         }
 894         return ret;
 895 }
 896
 897 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
 898 {
 899         sdev_printk(KERN_INFO, cmnd->device, "%s\n", __func__);
 900         return uas_eh_task_mgmt(cmnd, "LOGICAL UNIT RESET",
 901                                 TMF_LOGICAL_UNIT_RESET);
 902 }
 903
 904 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
 905 {
 906         struct scsi_device *sdev = cmnd->device;
 907         struct uas_dev_info *devinfo = sdev->hostdata;
 908         struct usb_device *udev = devinfo->udev;
 909         int err;
 910
 911         err = usb_lock_device_for_reset(udev, devinfo->intf);
 912         if (err) {
 913                 shost_printk(KERN_ERR, sdev->host,
 914                              "%s FAILED to get lock err %d\n", __func__, err);
 915                 return FAILED;
 916         }
 917
 918         shost_printk(KERN_INFO, sdev->host, "%s start\n", __func__);
 919         devinfo->resetting = 1;
 920         uas_abort_inflight(devinfo, DID_RESET, __func__);
 921         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
 922         usb_kill_anchored_urbs(&devinfo->sense_urbs);
 923         usb_kill_anchored_urbs(&devinfo->data_urbs);
 924         uas_zap_dead(devinfo);
 925         err = usb_reset_device(udev);
 926         devinfo->resetting = 0;
 927
 928         usb_unlock_device(udev);
 929
 930         if (err) {
 931                 shost_printk(KERN_INFO, sdev->host, "%s FAILED err %d\n",
 932                              __func__, err);
 933                 return FAILED;
 934         }
 935
 936         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
 937         return SUCCESS;
 938 }
 939
 940 static int uas_target_alloc(struct scsi_target *starget)
 941 {
 942         struct uas_dev_info *devinfo = (struct uas_dev_info *)
 943                         dev_to_shost(starget->dev.parent)->hostdata;
 944
 945         if (devinfo->flags & US_FL_NO_REPORT_LUNS)
 946                 starget->no_report_luns = 1;
 947
 948         return 0;
 949 }
 950
 951 static int uas_slave_alloc(struct scsi_device *sdev)
 952 {
 953         struct uas_dev_info *devinfo =
 954                 (struct uas_dev_info *)sdev->host->hostdata;
 955
 956         sdev->hostdata = devinfo;
 957
 958         /* USB has unusual DMA-alignment requirements: Although the
 959          * starting address of each scatter-gather element doesn't matter,
 960          * the length of each element except the last must be divisible
 961          * by the Bulk maxpacket value.  There's currently no way to
 962          * express this by block-layer constraints, so we'll cop out
 963          * and simply require addresses to be aligned at 512-byte
 964          * boundaries.  This is okay since most block I/O involves
 965          * hardware sectors that are multiples of 512 bytes in length,
 966          * and since host controllers up through USB 2.0 have maxpacket
 967          * values no larger than 512.
 968          *
 969          * But it doesn't suffice for Wireless USB, where Bulk maxpacket
 970          * values can be as large as 2048.  To make that work properly
 971          * will require changes to the block layer.
 972          */
 973         blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
 974
 975         if (devinfo->flags & US_FL_MAX_SECTORS_64)
 976                 blk_queue_max_hw_sectors(sdev->request_queue, 64);
 977         else if (devinfo->flags & US_FL_MAX_SECTORS_240)
 978                 blk_queue_max_hw_sectors(sdev->request_queue, 240);
 979
 980         return 0;
 981 }
 982
 983 static int uas_slave_configure(struct scsi_device *sdev)
 984 {
 985         struct uas_dev_info *devinfo = sdev->hostdata;
 986
 987         if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
 988                 sdev->no_report_opcodes = 1;
 989
 990         /* A few buggy USB-ATA bridges don't understand FUA */
 991         if (devinfo->flags & US_FL_BROKEN_FUA)
 992                 sdev->broken_fua = 1;
 993
 994         /* Some disks cannot handle READ_CAPACITY_16 */
 995         if (devinfo->flags & US_FL_NO_READ_CAPACITY_16)
 996                 sdev->no_read_capacity_16 = 1;
 997
 998         /*
 999          * Some disks return the total number of blocks in response
1000          * to READ CAPACITY rather than the highest block number.
1001          * If this device makes that mistake, tell the sd driver.
1002          */
1003         if (devinfo->flags & US_FL_FIX_CAPACITY)
1004                 sdev->fix_capacity = 1;
1005
1006         /*
1007          * in some cases we have to guess
1008          */
1009         if (devinfo->flags & US_FL_CAPACITY_HEURISTICS)
1010                 sdev->guess_capacity = 1;
1011
1012         /*
1013          * Some devices don't like MODE SENSE with page=0x3f,
1014          * which is the command used for checking if a device
1015          * is write-protected.  Now that we tell the sd driver
1016          * to do a 192-byte transfer with this command the
1017          * majority of devices work fine, but a few still can't
1018          * handle it.  The sd driver will simply assume those
1019          * devices are write-enabled.
1020          */
1021         if (devinfo->flags & US_FL_NO_WP_DETECT)
1022                 sdev->skip_ms_page_3f = 1;
1023
1024         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
1025         scsi_activate_tcq(sdev, devinfo->qdepth - 2);
1026         return 0;
1027 }
1028
1029 static struct scsi_host_template uas_host_template = {
1030         .module = THIS_MODULE,
1031         .name = "uas",
1032         .queuecommand = uas_queuecommand,
1033         .target_alloc = uas_target_alloc,
1034         .slave_alloc = uas_slave_alloc,
1035         .slave_configure = uas_slave_configure,
1036         .eh_abort_handler = uas_eh_abort_handler,
1037         .eh_device_reset_handler = uas_eh_device_reset_handler,
1038         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
1039         .can_queue = MAX_CMNDS,
1040         .this_id = -1,
1041         .sg_tablesize = SG_NONE,
1042         .cmd_per_lun = 1,       /* until we override it */
1043         .skip_settle_delay = 1,
1044         .ordered_tag = 1,
1045 };
1046
1047 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
1048                     vendorName, productName, useProtocol, useTransport, \
1049                     initFunction, flags) \
1050 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
1051         .driver_info = (flags) }
1052
1053 static struct usb_device_id uas_usb_ids[] = {
1054 #       include "unusual_uas.h"
1055         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
1056         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
1057         /* 0xaa is a prototype device I happen to have access to */
1058         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
1059         { }
1060 };
1061 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
1062
1063 #undef UNUSUAL_DEV
1064
1065 static int uas_switch_interface(struct usb_device *udev,
1066                                 struct usb_interface *intf)
1067 {
1068         struct usb_host_interface *alt;
1069
1070         alt = uas_find_uas_alt_setting(intf);
1071         if (!alt)
1072                 return -ENODEV;
1073
1074         return usb_set_interface(udev, alt->desc.bInterfaceNumber,
1075                         alt->desc.bAlternateSetting);
1076 }
1077
1078 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
1079 {
1080         struct usb_host_endpoint *eps[4] = { };
1081         struct usb_device *udev = devinfo->udev;
1082         int r;
1083
1084         devinfo->uas_sense_old = 0;
1085         devinfo->cmnd = NULL;
1086
1087         r = uas_find_endpoints(devinfo->intf->cur_altsetting, eps);
1088         if (r)
1089                 return r;
1090
1091         devinfo->cmd_pipe = usb_sndbulkpipe(udev,
1092                                             usb_endpoint_num(&eps[0]->desc));
1093         devinfo->status_pipe = usb_rcvbulkpipe(udev,
1094                                             usb_endpoint_num(&eps[1]->desc));
1095         devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
1096                                             usb_endpoint_num(&eps[2]->desc));
1097         devinfo->data_out_pipe = usb_sndbulkpipe(udev,
1098                                             usb_endpoint_num(&eps[3]->desc));
1099
1100         if (udev->speed != USB_SPEED_SUPER) {
1101                 devinfo->qdepth = 32;
1102                 devinfo->use_streams = 0;
1103         } else {
1104                 devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1,
1105                                                     3, MAX_CMNDS, GFP_NOIO);
1106                 if (devinfo->qdepth < 0)
1107                         return devinfo->qdepth;
1108                 devinfo->use_streams = 1;
1109         }
1110
1111         return 0;
1112 }
1113
1114 static void uas_free_streams(struct uas_dev_info *devinfo)
1115 {
1116         struct usb_device *udev = devinfo->udev;
1117         struct usb_host_endpoint *eps[3];
1118
1119         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
1120         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
1121         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
1122         usb_free_streams(devinfo->intf, eps, 3, GFP_NOIO);
1123 }
1124
1125 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
1126 {
1127         int result = -ENOMEM;
1128         struct Scsi_Host *shost = NULL;
1129         struct uas_dev_info *devinfo;
1130         struct usb_device *udev = interface_to_usbdev(intf);
1131         unsigned long dev_flags;
1132
1133         if (!uas_use_uas_driver(intf, id, &dev_flags))
1134                 return -ENODEV;
1135
1136         if (uas_switch_interface(udev, intf))
1137                 return -ENODEV;
1138
1139         shost = scsi_host_alloc(&uas_host_template,
1140                                 sizeof(struct uas_dev_info));
1141         if (!shost)
1142                 goto set_alt0;
1143
1144         shost->max_cmd_len = 16 + 252;
1145         shost->max_id = 1;
1146         shost->max_lun = 256;
1147         shost->max_channel = 0;
1148         shost->sg_tablesize = udev->bus->sg_tablesize;
1149
1150         devinfo = (struct uas_dev_info *)shost->hostdata;
1151         devinfo->intf = intf;
1152         devinfo->udev = udev;
1153         devinfo->resetting = 0;
1154         devinfo->running_task = 0;
1155         devinfo->shutdown = 0;
1156         devinfo->flags = dev_flags;
1157         init_usb_anchor(&devinfo->cmd_urbs);
1158         init_usb_anchor(&devinfo->sense_urbs);
1159         init_usb_anchor(&devinfo->data_urbs);
1160         spin_lock_init(&devinfo->lock);
1161         INIT_WORK(&devinfo->work, uas_do_work);
1162         INIT_LIST_HEAD(&devinfo->inflight_list);
1163         INIT_LIST_HEAD(&devinfo->dead_list);
1164
1165         result = uas_configure_endpoints(devinfo);
1166         if (result)
1167                 goto set_alt0;
1168
1169         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 2);
1170         if (result)
1171                 goto free_streams;
1172
1173         usb_set_intfdata(intf, shost);
1174         result = scsi_add_host(shost, &intf->dev);
1175         if (result)
1176                 goto free_streams;
1177
1178         scsi_scan_host(shost);
1179         return result;
1180
1181 free_streams:
1182         uas_free_streams(devinfo);
1183         usb_set_intfdata(intf, NULL);
1184 set_alt0:
1185         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1186         if (shost)
1187                 scsi_host_put(shost);
1188         return result;
1189 }
1190
1191 static int uas_pre_reset(struct usb_interface *intf)
1192 {
1193         struct Scsi_Host *shost = usb_get_intfdata(intf);
1194         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1195         unsigned long flags;
1196
1197         if (devinfo->shutdown)
1198                 return 0;
1199
1200         /* Block new requests */
1201         spin_lock_irqsave(shost->host_lock, flags);
1202         scsi_block_requests(shost);
1203         spin_unlock_irqrestore(shost->host_lock, flags);
1204
1205         /* Wait for any pending requests to complete */
1206         flush_work(&devinfo->work);
1207         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1208                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1209                 return 1;
1210         }
1211
1212         uas_free_streams(devinfo);
1213
1214         return 0;
1215 }
1216
1217 static int uas_post_reset(struct usb_interface *intf)
1218 {
1219         struct Scsi_Host *shost = usb_get_intfdata(intf);
1220         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1221         unsigned long flags;
1222         int err;
1223
1224         if (devinfo->shutdown)
1225                 return 0;
1226
1227         err = uas_configure_endpoints(devinfo);
1228         if (err && err != -ENODEV)
1229                 shost_printk(KERN_ERR, shost,
1230                              "%s: alloc streams error %d after reset",
1231                              __func__, err);
1232
1233         /* we must unblock the host in every case lest we deadlock */
1234         spin_lock_irqsave(shost->host_lock, flags);
1235         scsi_report_bus_reset(shost, 0);
1236         spin_unlock_irqrestore(shost->host_lock, flags);
1237
1238         scsi_unblock_requests(shost);
1239
1240         return err ? 1 : 0;
1241 }
1242
1243 static int uas_suspend(struct usb_interface *intf, pm_message_t message)
1244 {
1245         struct Scsi_Host *shost = usb_get_intfdata(intf);
1246         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1247
1248         /* Wait for any pending requests to complete */
1249         flush_work(&devinfo->work);
1250         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1251                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1252                 return -ETIME;
1253         }
1254
1255         return 0;
1256 }
1257
1258 static int uas_resume(struct usb_interface *intf)
1259 {
1260         return 0;
1261 }
1262
1263 static int uas_reset_resume(struct usb_interface *intf)
1264 {
1265         struct Scsi_Host *shost = usb_get_intfdata(intf);
1266         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1267         unsigned long flags;
1268         int err;
1269
1270         err = uas_configure_endpoints(devinfo);
1271         if (err) {
1272                 shost_printk(KERN_ERR, shost,
1273                              "%s: alloc streams error %d after reset",
1274                              __func__, err);
1275                 return -EIO;
1276         }
1277
1278         spin_lock_irqsave(shost->host_lock, flags);
1279         scsi_report_bus_reset(shost, 0);
1280         spin_unlock_irqrestore(shost->host_lock, flags);
1281
1282         return 0;
1283 }
1284
1285 static void uas_disconnect(struct usb_interface *intf)
1286 {
1287         struct Scsi_Host *shost = usb_get_intfdata(intf);
1288         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1289
1290         devinfo->resetting = 1;
1291         cancel_work_sync(&devinfo->work);
1292         uas_abort_inflight(devinfo, DID_NO_CONNECT, __func__);
1293         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1294         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1295         usb_kill_anchored_urbs(&devinfo->data_urbs);
1296         uas_zap_dead(devinfo);
1297         scsi_remove_host(shost);
1298         uas_free_streams(devinfo);
1299         scsi_host_put(shost);
1300 }
1301
1302 /*
1303  * Put the device back in usb-storage mode on shutdown, as some BIOS-es
1304  * hang on reboot when the device is still in uas mode. Note the reset is
1305  * necessary as some devices won't revert to usb-storage mode without it.
1306  */
1307 static void uas_shutdown(struct device *dev)
1308 {
1309         struct usb_interface *intf = to_usb_interface(dev);
1310         struct usb_device *udev = interface_to_usbdev(intf);
1311         struct Scsi_Host *shost = usb_get_intfdata(intf);
1312         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1313
1314         if (system_state != SYSTEM_RESTART)
1315                 return;
1316
1317         devinfo->shutdown = 1;
1318         uas_free_streams(devinfo);
1319         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1320         usb_reset_device(udev);
1321 }
1322
1323 static struct usb_driver uas_driver = {
1324         .name = "uas",
1325         .probe = uas_probe,
1326         .disconnect = uas_disconnect,
1327         .pre_reset = uas_pre_reset,
1328         .post_reset = uas_post_reset,
1329         .suspend = uas_suspend,
1330         .resume = uas_resume,
1331         .reset_resume = uas_reset_resume,
1332         .drvwrap.driver.shutdown = uas_shutdown,
1333         .id_table = uas_usb_ids,
1334 };
1335
1336 module_usb_driver(uas_driver);
1337
1338 MODULE_LICENSE("GPL");
1339 MODULE_AUTHOR(
1340         "Hans de Goede <hdegoede@redhat.com>, Matthew Wilcox and Sarah Sharp");