drivers/usb/storage/uas.c

   1 /*
   2  * USB Attached SCSI
   3  * Note that this is not the same as the USB Mass Storage driver
   4  *
   5  * Copyright Matthew Wilcox for Intel Corp, 2010
   6  * Copyright Sarah Sharp for Intel Corp, 2010
   7  *
   8  * Distributed under the terms of the GNU GPL, version two.
   9  */
  10
  11 #include <linux/blkdev.h>
  12 #include <linux/slab.h>
  13 #include <linux/types.h>
  14 #include <linux/module.h>
  15 #include <linux/usb.h>
  16 #include <linux/usb/hcd.h>
  17 #include <linux/usb/storage.h>
  18 #include <linux/usb/uas.h>
  19
  20 #include <scsi/scsi.h>
  21 #include <scsi/scsi_dbg.h>
  22 #include <scsi/scsi_cmnd.h>
  23 #include <scsi/scsi_device.h>
  24 #include <scsi/scsi_host.h>
  25 #include <scsi/scsi_tcq.h>
  26
  27 /*
  28  * The r00-r01c specs define this version of the SENSE IU data structure.
  29  * It's still in use by several different firmware releases.
  30  */
  31 struct sense_iu_old {
  32         __u8 iu_id;
  33         __u8 rsvd1;
  34         __be16 tag;
  35         __be16 len;
  36         __u8 status;
  37         __u8 service_response;
  38         __u8 sense[SCSI_SENSE_BUFFERSIZE];
  39 };
  40
  41 struct uas_dev_info {
  42         struct usb_interface *intf;
  43         struct usb_device *udev;
  44         struct usb_anchor cmd_urbs;
  45         struct usb_anchor sense_urbs;
  46         struct usb_anchor data_urbs;
  47         int qdepth, resetting;
  48         struct response_ui response;
  49         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
  50         unsigned use_streams:1;
  51         unsigned uas_sense_old:1;
  52         struct scsi_cmnd *cmnd;
  53         spinlock_t lock;
  54 };
  55
  56 enum {
  57         SUBMIT_STATUS_URB       = (1 << 1),
  58         ALLOC_DATA_IN_URB       = (1 << 2),
  59         SUBMIT_DATA_IN_URB      = (1 << 3),
  60         ALLOC_DATA_OUT_URB      = (1 << 4),
  61         SUBMIT_DATA_OUT_URB     = (1 << 5),
  62         ALLOC_CMD_URB           = (1 << 6),
  63         SUBMIT_CMD_URB          = (1 << 7),
  64         COMMAND_INFLIGHT        = (1 << 8),
  65         DATA_IN_URB_INFLIGHT    = (1 << 9),
  66         DATA_OUT_URB_INFLIGHT   = (1 << 10),
  67         COMMAND_COMPLETED       = (1 << 11),
  68         COMMAND_ABORTED         = (1 << 12),
  69         UNLINK_DATA_URBS        = (1 << 13),
  70         IS_IN_WORK_LIST         = (1 << 14),
  71 };
  72
  73 /* Overrides scsi_pointer */
  74 struct uas_cmd_info {
  75         unsigned int state;
  76         unsigned int stream;
  77         struct urb *cmd_urb;
  78         struct urb *data_in_urb;
  79         struct urb *data_out_urb;
  80         struct list_head list;
  81 };
  82
  83 /* I hate forward declarations, but I actually have a loop */
  84 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
  85                                 struct uas_dev_info *devinfo, gfp_t gfp);
  86 static void uas_do_work(struct work_struct *work);
  87 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
  88
  89 static DECLARE_WORK(uas_work, uas_do_work);
  90 static DEFINE_SPINLOCK(uas_work_lock);
  91 static LIST_HEAD(uas_work_list);
  92
  93 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
  94                                  struct uas_cmd_info *cmdinfo)
  95 {
  96         unsigned long flags;
  97
  98         /*
  99          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
 100          * (called by urb completion) doesn't release cmdinfo
 101          * underneath us.
 102          */
 103         spin_lock_irqsave(&devinfo->lock, flags);
 104         cmdinfo->state |= UNLINK_DATA_URBS;
 105         spin_unlock_irqrestore(&devinfo->lock, flags);
 106
 107         if (cmdinfo->data_in_urb)
 108                 usb_unlink_urb(cmdinfo->data_in_urb);
 109         if (cmdinfo->data_out_urb)
 110                 usb_unlink_urb(cmdinfo->data_out_urb);
 111
 112         spin_lock_irqsave(&devinfo->lock, flags);
 113         cmdinfo->state &= ~UNLINK_DATA_URBS;
 114         spin_unlock_irqrestore(&devinfo->lock, flags);
 115 }
 116
 117 static void uas_do_work(struct work_struct *work)
 118 {
 119         struct uas_cmd_info *cmdinfo;
 120         struct uas_cmd_info *temp;
 121         struct list_head list;
 122         unsigned long flags;
 123         int err;
 124
 125         spin_lock_irq(&uas_work_lock);
 126         list_replace_init(&uas_work_list, &list);
 127         spin_unlock_irq(&uas_work_lock);
 128
 129         list_for_each_entry_safe(cmdinfo, temp, &list, list) {
 130                 struct scsi_pointer *scp = (void *)cmdinfo;
 131                 struct scsi_cmnd *cmnd = container_of(scp,
 132                                                         struct scsi_cmnd, SCp);
 133                 struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 134                 spin_lock_irqsave(&devinfo->lock, flags);
 135                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 136                 if (!err)
 137                         cmdinfo->state &= ~IS_IN_WORK_LIST;
 138                 spin_unlock_irqrestore(&devinfo->lock, flags);
 139                 if (err) {
 140                         list_del(&cmdinfo->list);
 141                         spin_lock_irq(&uas_work_lock);
 142                         list_add_tail(&cmdinfo->list, &uas_work_list);
 143                         spin_unlock_irq(&uas_work_lock);
 144                         schedule_work(&uas_work);
 145                 }
 146         }
 147 }
 148
 149 static void uas_abort_work(struct uas_dev_info *devinfo)
 150 {
 151         struct uas_cmd_info *cmdinfo;
 152         struct uas_cmd_info *temp;
 153         struct list_head list;
 154         unsigned long flags;
 155
 156         spin_lock_irq(&uas_work_lock);
 157         list_replace_init(&uas_work_list, &list);
 158         spin_unlock_irq(&uas_work_lock);
 159
 160         spin_lock_irqsave(&devinfo->lock, flags);
 161         list_for_each_entry_safe(cmdinfo, temp, &list, list) {
 162                 struct scsi_pointer *scp = (void *)cmdinfo;
 163                 struct scsi_cmnd *cmnd = container_of(scp,
 164                                                         struct scsi_cmnd, SCp);
 165                 struct uas_dev_info *di = (void *)cmnd->device->hostdata;
 166
 167                 if (di == devinfo) {
 168                         cmdinfo->state |= COMMAND_ABORTED;
 169                         cmdinfo->state &= ~IS_IN_WORK_LIST;
 170                         if (devinfo->resetting) {
 171                                 /* uas_stat_cmplt() will not do that
 172                                  * when a device reset is in
 173                                  * progress */
 174                                 cmdinfo->state &= ~COMMAND_INFLIGHT;
 175                         }
 176                         uas_try_complete(cmnd, __func__);
 177                 } else {
 178                         /* not our uas device, relink into list */
 179                         list_del(&cmdinfo->list);
 180                         spin_lock_irq(&uas_work_lock);
 181                         list_add_tail(&cmdinfo->list, &uas_work_list);
 182                         spin_unlock_irq(&uas_work_lock);
 183                 }
 184         }
 185         spin_unlock_irqrestore(&devinfo->lock, flags);
 186 }
 187
 188 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
 189 {
 190         struct sense_iu *sense_iu = urb->transfer_buffer;
 191         struct scsi_device *sdev = cmnd->device;
 192
 193         if (urb->actual_length > 16) {
 194                 unsigned len = be16_to_cpup(&sense_iu->len);
 195                 if (len + 16 != urb->actual_length) {
 196                         int newlen = min(len + 16, urb->actual_length) - 16;
 197                         if (newlen < 0)
 198                                 newlen = 0;
 199                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 200                                 "disagrees with IU sense data length %d, "
 201                                 "using %d bytes of sense data\n", __func__,
 202                                         urb->actual_length, len, newlen);
 203                         len = newlen;
 204                 }
 205                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 206         }
 207
 208         cmnd->result = sense_iu->status;
 209 }
 210
 211 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
 212 {
 213         struct sense_iu_old *sense_iu = urb->transfer_buffer;
 214         struct scsi_device *sdev = cmnd->device;
 215
 216         if (urb->actual_length > 8) {
 217                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
 218                 if (len + 8 != urb->actual_length) {
 219                         int newlen = min(len + 8, urb->actual_length) - 8;
 220                         if (newlen < 0)
 221                                 newlen = 0;
 222                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 223                                 "disagrees with IU sense data length %d, "
 224                                 "using %d bytes of sense data\n", __func__,
 225                                         urb->actual_length, len, newlen);
 226                         len = newlen;
 227                 }
 228                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 229         }
 230
 231         cmnd->result = sense_iu->status;
 232 }
 233
 234 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
 235 {
 236         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
 237
 238         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
 239                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
 240                     caller, cmnd, cmnd->request->tag,
 241                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
 242                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
 243                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
 244                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
 245                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
 246                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
 247                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
 248                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
 249                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
 250                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
 251                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
 252                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
 253                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
 254                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
 255 }
 256
 257 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
 258 {
 259         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 260         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 261
 262         WARN_ON(!spin_is_locked(&devinfo->lock));
 263         if (cmdinfo->state & (COMMAND_INFLIGHT |
 264                               DATA_IN_URB_INFLIGHT |
 265                               DATA_OUT_URB_INFLIGHT |
 266                               UNLINK_DATA_URBS))
 267                 return -EBUSY;
 268         BUG_ON(cmdinfo->state & COMMAND_COMPLETED);
 269         cmdinfo->state |= COMMAND_COMPLETED;
 270         usb_free_urb(cmdinfo->data_in_urb);
 271         usb_free_urb(cmdinfo->data_out_urb);
 272         if (cmdinfo->state & COMMAND_ABORTED) {
 273                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
 274                 cmnd->result = DID_ABORT << 16;
 275         }
 276         cmnd->scsi_done(cmnd);
 277         return 0;
 278 }
 279
 280 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
 281                           unsigned direction)
 282 {
 283         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 284         int err;
 285
 286         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
 287         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 288         if (err) {
 289                 spin_lock(&uas_work_lock);
 290                 list_add_tail(&cmdinfo->list, &uas_work_list);
 291                 cmdinfo->state |= IS_IN_WORK_LIST;
 292                 spin_unlock(&uas_work_lock);
 293                 schedule_work(&uas_work);
 294         }
 295 }
 296
 297 static void uas_stat_cmplt(struct urb *urb)
 298 {
 299         struct iu *iu = urb->transfer_buffer;
 300         struct Scsi_Host *shost = urb->context;
 301         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 302         struct scsi_cmnd *cmnd;
 303         struct uas_cmd_info *cmdinfo;
 304         unsigned long flags;
 305         u16 tag;
 306
 307         if (urb->status) {
 308                 dev_err(&urb->dev->dev, "URB BAD STATUS %d\n", urb->status);
 309                 usb_free_urb(urb);
 310                 return;
 311         }
 312
 313         if (devinfo->resetting) {
 314                 usb_free_urb(urb);
 315                 return;
 316         }
 317
 318         spin_lock_irqsave(&devinfo->lock, flags);
 319         tag = be16_to_cpup(&iu->tag) - 1;
 320         if (tag == 0)
 321                 cmnd = devinfo->cmnd;
 322         else
 323                 cmnd = scsi_host_find_tag(shost, tag - 1);
 324
 325         if (!cmnd) {
 326                 if (iu->iu_id == IU_ID_RESPONSE) {
 327                         /* store results for uas_eh_task_mgmt() */
 328                         memcpy(&devinfo->response, iu, sizeof(devinfo->response));
 329                 }
 330                 usb_free_urb(urb);
 331                 spin_unlock_irqrestore(&devinfo->lock, flags);
 332                 return;
 333         }
 334
 335         cmdinfo = (void *)&cmnd->SCp;
 336         switch (iu->iu_id) {
 337         case IU_ID_STATUS:
 338                 if (devinfo->cmnd == cmnd)
 339                         devinfo->cmnd = NULL;
 340
 341                 if (urb->actual_length < 16)
 342                         devinfo->uas_sense_old = 1;
 343                 if (devinfo->uas_sense_old)
 344                         uas_sense_old(urb, cmnd);
 345                 else
 346                         uas_sense(urb, cmnd);
 347                 if (cmnd->result != 0) {
 348                         /* cancel data transfers on error */
 349                         spin_unlock_irqrestore(&devinfo->lock, flags);
 350                         uas_unlink_data_urbs(devinfo, cmdinfo);
 351                         spin_lock_irqsave(&devinfo->lock, flags);
 352                 }
 353                 cmdinfo->state &= ~COMMAND_INFLIGHT;
 354                 uas_try_complete(cmnd, __func__);
 355                 break;
 356         case IU_ID_READ_READY:
 357                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
 358                 break;
 359         case IU_ID_WRITE_READY:
 360                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
 361                 break;
 362         default:
 363                 scmd_printk(KERN_ERR, cmnd,
 364                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
 365         }
 366         usb_free_urb(urb);
 367         spin_unlock_irqrestore(&devinfo->lock, flags);
 368 }
 369
 370 static void uas_data_cmplt(struct urb *urb)
 371 {
 372         struct scsi_cmnd *cmnd = urb->context;
 373         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 374         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 375         struct scsi_data_buffer *sdb = NULL;
 376         unsigned long flags;
 377
 378         spin_lock_irqsave(&devinfo->lock, flags);
 379         if (cmdinfo->data_in_urb == urb) {
 380                 sdb = scsi_in(cmnd);
 381                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
 382         } else if (cmdinfo->data_out_urb == urb) {
 383                 sdb = scsi_out(cmnd);
 384                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
 385         }
 386         BUG_ON(sdb == NULL);
 387         if (urb->status) {
 388                 /* error: no data transfered */
 389                 sdb->resid = sdb->length;
 390         } else {
 391                 sdb->resid = sdb->length - urb->actual_length;
 392         }
 393         uas_try_complete(cmnd, __func__);
 394         spin_unlock_irqrestore(&devinfo->lock, flags);
 395 }
 396
 397 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 398                                       unsigned int pipe, u16 stream_id,
 399                                       struct scsi_cmnd *cmnd,
 400                                       enum dma_data_direction dir)
 401 {
 402         struct usb_device *udev = devinfo->udev;
 403         struct urb *urb = usb_alloc_urb(0, gfp);
 404         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
 405                 ? scsi_in(cmnd) : scsi_out(cmnd);
 406
 407         if (!urb)
 408                 goto out;
 409         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
 410                           uas_data_cmplt, cmnd);
 411         if (devinfo->use_streams)
 412                 urb->stream_id = stream_id;
 413         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
 414         urb->sg = sdb->table.sgl;
 415  out:
 416         return urb;
 417 }
 418
 419 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 420                                        struct Scsi_Host *shost, u16 stream_id)
 421 {
 422         struct usb_device *udev = devinfo->udev;
 423         struct urb *urb = usb_alloc_urb(0, gfp);
 424         struct sense_iu *iu;
 425
 426         if (!urb)
 427                 goto out;
 428
 429         iu = kzalloc(sizeof(*iu), gfp);
 430         if (!iu)
 431                 goto free;
 432
 433         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
 434                                                 uas_stat_cmplt, shost);
 435         urb->stream_id = stream_id;
 436         urb->transfer_flags |= URB_FREE_BUFFER;
 437  out:
 438         return urb;
 439  free:
 440         usb_free_urb(urb);
 441         return NULL;
 442 }
 443
 444 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 445                                         struct scsi_cmnd *cmnd, u16 stream_id)
 446 {
 447         struct usb_device *udev = devinfo->udev;
 448         struct scsi_device *sdev = cmnd->device;
 449         struct urb *urb = usb_alloc_urb(0, gfp);
 450         struct command_iu *iu;
 451         int len;
 452
 453         if (!urb)
 454                 goto out;
 455
 456         len = cmnd->cmd_len - 16;
 457         if (len < 0)
 458                 len = 0;
 459         len = ALIGN(len, 4);
 460         iu = kzalloc(sizeof(*iu) + len, gfp);
 461         if (!iu)
 462                 goto free;
 463
 464         iu->iu_id = IU_ID_COMMAND;
 465         if (blk_rq_tagged(cmnd->request))
 466                 iu->tag = cpu_to_be16(cmnd->request->tag + 2);
 467         else
 468                 iu->tag = cpu_to_be16(1);
 469         iu->prio_attr = UAS_SIMPLE_TAG;
 470         iu->len = len;
 471         int_to_scsilun(sdev->lun, &iu->lun);
 472         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
 473
 474         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
 475                                                         usb_free_urb, NULL);
 476         urb->transfer_flags |= URB_FREE_BUFFER;
 477  out:
 478         return urb;
 479  free:
 480         usb_free_urb(urb);
 481         return NULL;
 482 }
 483
 484 static int uas_submit_task_urb(struct scsi_cmnd *cmnd, gfp_t gfp,
 485                                u8 function, u16 stream_id)
 486 {
 487         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 488         struct usb_device *udev = devinfo->udev;
 489         struct urb *urb = usb_alloc_urb(0, gfp);
 490         struct task_mgmt_iu *iu;
 491         int err = -ENOMEM;
 492
 493         if (!urb)
 494                 goto err;
 495
 496         iu = kzalloc(sizeof(*iu), gfp);
 497         if (!iu)
 498                 goto err;
 499
 500         iu->iu_id = IU_ID_TASK_MGMT;
 501         iu->tag = cpu_to_be16(stream_id);
 502         int_to_scsilun(cmnd->device->lun, &iu->lun);
 503
 504         iu->function = function;
 505         switch (function) {
 506         case TMF_ABORT_TASK:
 507                 if (blk_rq_tagged(cmnd->request))
 508                         iu->task_tag = cpu_to_be16(cmnd->request->tag + 2);
 509                 else
 510                         iu->task_tag = cpu_to_be16(1);
 511                 break;
 512         }
 513
 514         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu),
 515                           usb_free_urb, NULL);
 516         urb->transfer_flags |= URB_FREE_BUFFER;
 517
 518         err = usb_submit_urb(urb, gfp);
 519         if (err)
 520                 goto err;
 521         usb_anchor_urb(urb, &devinfo->cmd_urbs);
 522
 523         return 0;
 524
 525 err:
 526         usb_free_urb(urb);
 527         return err;
 528 }
 529
 530 /*
 531  * Why should I request the Status IU before sending the Command IU?  Spec
 532  * says to, but also says the device may receive them in any order.  Seems
 533  * daft to me.
 534  */
 535
 536 static int uas_submit_sense_urb(struct Scsi_Host *shost,
 537                                 gfp_t gfp, unsigned int stream)
 538 {
 539         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 540         struct urb *urb;
 541
 542         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
 543         if (!urb)
 544                 return SCSI_MLQUEUE_DEVICE_BUSY;
 545         if (usb_submit_urb(urb, gfp)) {
 546                 shost_printk(KERN_INFO, shost,
 547                              "sense urb submission failure\n");
 548                 usb_free_urb(urb);
 549                 return SCSI_MLQUEUE_DEVICE_BUSY;
 550         }
 551         usb_anchor_urb(urb, &devinfo->sense_urbs);
 552         return 0;
 553 }
 554
 555 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
 556                            struct uas_dev_info *devinfo, gfp_t gfp)
 557 {
 558         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 559         int err;
 560
 561         WARN_ON(!spin_is_locked(&devinfo->lock));
 562         if (cmdinfo->state & SUBMIT_STATUS_URB) {
 563                 err = uas_submit_sense_urb(cmnd->device->host, gfp,
 564                                            cmdinfo->stream);
 565                 if (err) {
 566                         return err;
 567                 }
 568                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
 569         }
 570
 571         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
 572                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
 573                                         devinfo->data_in_pipe, cmdinfo->stream,
 574                                         cmnd, DMA_FROM_DEVICE);
 575                 if (!cmdinfo->data_in_urb)
 576                         return SCSI_MLQUEUE_DEVICE_BUSY;
 577                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
 578         }
 579
 580         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
 581                 if (usb_submit_urb(cmdinfo->data_in_urb, gfp)) {
 582                         scmd_printk(KERN_INFO, cmnd,
 583                                         "data in urb submission failure\n");
 584                         return SCSI_MLQUEUE_DEVICE_BUSY;
 585                 }
 586                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
 587                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
 588                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
 589         }
 590
 591         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
 592                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
 593                                         devinfo->data_out_pipe, cmdinfo->stream,
 594                                         cmnd, DMA_TO_DEVICE);
 595                 if (!cmdinfo->data_out_urb)
 596                         return SCSI_MLQUEUE_DEVICE_BUSY;
 597                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
 598         }
 599
 600         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
 601                 if (usb_submit_urb(cmdinfo->data_out_urb, gfp)) {
 602                         scmd_printk(KERN_INFO, cmnd,
 603                                         "data out urb submission failure\n");
 604                         return SCSI_MLQUEUE_DEVICE_BUSY;
 605                 }
 606                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
 607                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
 608                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
 609         }
 610
 611         if (cmdinfo->state & ALLOC_CMD_URB) {
 612                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd,
 613                                                      cmdinfo->stream);
 614                 if (!cmdinfo->cmd_urb)
 615                         return SCSI_MLQUEUE_DEVICE_BUSY;
 616                 cmdinfo->state &= ~ALLOC_CMD_URB;
 617         }
 618
 619         if (cmdinfo->state & SUBMIT_CMD_URB) {
 620                 usb_get_urb(cmdinfo->cmd_urb);
 621                 if (usb_submit_urb(cmdinfo->cmd_urb, gfp)) {
 622                         scmd_printk(KERN_INFO, cmnd,
 623                                         "cmd urb submission failure\n");
 624                         return SCSI_MLQUEUE_DEVICE_BUSY;
 625                 }
 626                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
 627                 usb_put_urb(cmdinfo->cmd_urb);
 628                 cmdinfo->cmd_urb = NULL;
 629                 cmdinfo->state &= ~SUBMIT_CMD_URB;
 630                 cmdinfo->state |= COMMAND_INFLIGHT;
 631         }
 632
 633         return 0;
 634 }
 635
 636 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 637                                         void (*done)(struct scsi_cmnd *))
 638 {
 639         struct scsi_device *sdev = cmnd->device;
 640         struct uas_dev_info *devinfo = sdev->hostdata;
 641         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 642         unsigned long flags;
 643         int err;
 644
 645         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
 646
 647         if (devinfo->resetting) {
 648                 cmnd->result = DID_ERROR << 16;
 649                 cmnd->scsi_done(cmnd);
 650                 return 0;
 651         }
 652
 653         spin_lock_irqsave(&devinfo->lock, flags);
 654         if (devinfo->cmnd) {
 655                 spin_unlock_irqrestore(&devinfo->lock, flags);
 656                 return SCSI_MLQUEUE_DEVICE_BUSY;
 657         }
 658
 659         if (blk_rq_tagged(cmnd->request)) {
 660                 cmdinfo->stream = cmnd->request->tag + 2;
 661         } else {
 662                 devinfo->cmnd = cmnd;
 663                 cmdinfo->stream = 1;
 664         }
 665
 666         cmnd->scsi_done = done;
 667
 668         cmdinfo->state = SUBMIT_STATUS_URB |
 669                         ALLOC_CMD_URB | SUBMIT_CMD_URB;
 670
 671         switch (cmnd->sc_data_direction) {
 672         case DMA_FROM_DEVICE:
 673                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 674                 break;
 675         case DMA_BIDIRECTIONAL:
 676                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 677         case DMA_TO_DEVICE:
 678                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
 679         case DMA_NONE:
 680                 break;
 681         }
 682
 683         if (!devinfo->use_streams) {
 684                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
 685                 cmdinfo->stream = 0;
 686         }
 687
 688         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
 689         if (err) {
 690                 /* If we did nothing, give up now */
 691                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
 692                         spin_unlock_irqrestore(&devinfo->lock, flags);
 693                         return SCSI_MLQUEUE_DEVICE_BUSY;
 694                 }
 695                 spin_lock(&uas_work_lock);
 696                 list_add_tail(&cmdinfo->list, &uas_work_list);
 697                 cmdinfo->state |= IS_IN_WORK_LIST;
 698                 spin_unlock(&uas_work_lock);
 699                 schedule_work(&uas_work);
 700         }
 701
 702         spin_unlock_irqrestore(&devinfo->lock, flags);
 703         return 0;
 704 }
 705
 706 static DEF_SCSI_QCMD(uas_queuecommand)
 707
 708 static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
 709                             const char *fname, u8 function)
 710 {
 711         struct Scsi_Host *shost = cmnd->device->host;
 712         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 713         u16 tag = devinfo->qdepth - 1;
 714         unsigned long flags;
 715
 716         spin_lock_irqsave(&devinfo->lock, flags);
 717         memset(&devinfo->response, 0, sizeof(devinfo->response));
 718         if (uas_submit_sense_urb(shost, GFP_ATOMIC, tag)) {
 719                 shost_printk(KERN_INFO, shost,
 720                              "%s: %s: submit sense urb failed\n",
 721                              __func__, fname);
 722                 spin_unlock_irqrestore(&devinfo->lock, flags);
 723                 return FAILED;
 724         }
 725         if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
 726                 shost_printk(KERN_INFO, shost,
 727                              "%s: %s: submit task mgmt urb failed\n",
 728                              __func__, fname);
 729                 spin_unlock_irqrestore(&devinfo->lock, flags);
 730                 return FAILED;
 731         }
 732         spin_unlock_irqrestore(&devinfo->lock, flags);
 733
 734         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 3000) == 0) {
 735                 shost_printk(KERN_INFO, shost,
 736                              "%s: %s timed out\n", __func__, fname);
 737                 return FAILED;
 738         }
 739         if (be16_to_cpu(devinfo->response.tag) != tag) {
 740                 shost_printk(KERN_INFO, shost,
 741                              "%s: %s failed (wrong tag %d/%d)\n", __func__,
 742                              fname, be16_to_cpu(devinfo->response.tag), tag);
 743                 return FAILED;
 744         }
 745         if (devinfo->response.response_code != RC_TMF_COMPLETE) {
 746                 shost_printk(KERN_INFO, shost,
 747                              "%s: %s failed (rc 0x%x)\n", __func__,
 748                              fname, devinfo->response.response_code);
 749                 return FAILED;
 750         }
 751         return SUCCESS;
 752 }
 753
 754 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
 755 {
 756         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 757         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 758         unsigned long flags;
 759         int ret;
 760
 761         uas_log_cmd_state(cmnd, __func__);
 762         spin_lock_irqsave(&devinfo->lock, flags);
 763         cmdinfo->state |= COMMAND_ABORTED;
 764         if (cmdinfo->state & IS_IN_WORK_LIST) {
 765                 spin_lock(&uas_work_lock);
 766                 list_del(&cmdinfo->list);
 767                 cmdinfo->state &= ~IS_IN_WORK_LIST;
 768                 spin_unlock(&uas_work_lock);
 769         }
 770         if (cmdinfo->state & COMMAND_INFLIGHT) {
 771                 spin_unlock_irqrestore(&devinfo->lock, flags);
 772                 ret = uas_eh_task_mgmt(cmnd, "ABORT TASK", TMF_ABORT_TASK);
 773         } else {
 774                 spin_unlock_irqrestore(&devinfo->lock, flags);
 775                 uas_unlink_data_urbs(devinfo, cmdinfo);
 776                 spin_lock_irqsave(&devinfo->lock, flags);
 777                 uas_try_complete(cmnd, __func__);
 778                 spin_unlock_irqrestore(&devinfo->lock, flags);
 779                 ret = SUCCESS;
 780         }
 781         return ret;
 782 }
 783
 784 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
 785 {
 786         sdev_printk(KERN_INFO, cmnd->device, "%s\n", __func__);
 787         return uas_eh_task_mgmt(cmnd, "LOGICAL UNIT RESET",
 788                                 TMF_LOGICAL_UNIT_RESET);
 789 }
 790
 791 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
 792 {
 793         struct scsi_device *sdev = cmnd->device;
 794         struct uas_dev_info *devinfo = sdev->hostdata;
 795         struct usb_device *udev = devinfo->udev;
 796         int err;
 797
 798         devinfo->resetting = 1;
 799         uas_abort_work(devinfo);
 800         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
 801         usb_kill_anchored_urbs(&devinfo->sense_urbs);
 802         usb_kill_anchored_urbs(&devinfo->data_urbs);
 803         err = usb_reset_device(udev);
 804         devinfo->resetting = 0;
 805
 806         if (err) {
 807                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
 808                 return FAILED;
 809         }
 810
 811         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
 812         return SUCCESS;
 813 }
 814
 815 static int uas_slave_alloc(struct scsi_device *sdev)
 816 {
 817         sdev->hostdata = (void *)sdev->host->hostdata[0];
 818         return 0;
 819 }
 820
 821 static int uas_slave_configure(struct scsi_device *sdev)
 822 {
 823         struct uas_dev_info *devinfo = sdev->hostdata;
 824         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
 825         scsi_activate_tcq(sdev, devinfo->qdepth - 3);
 826         return 0;
 827 }
 828
 829 static struct scsi_host_template uas_host_template = {
 830         .module = THIS_MODULE,
 831         .name = "uas",
 832         .queuecommand = uas_queuecommand,
 833         .slave_alloc = uas_slave_alloc,
 834         .slave_configure = uas_slave_configure,
 835         .eh_abort_handler = uas_eh_abort_handler,
 836         .eh_device_reset_handler = uas_eh_device_reset_handler,
 837         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
 838         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
 839         .this_id = -1,
 840         .sg_tablesize = SG_NONE,
 841         .cmd_per_lun = 1,       /* until we override it */
 842         .skip_settle_delay = 1,
 843         .ordered_tag = 1,
 844 };
 845
 846 static struct usb_device_id uas_usb_ids[] = {
 847         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
 848         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
 849         /* 0xaa is a prototype device I happen to have access to */
 850         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
 851         { }
 852 };
 853 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 854
 855 static int uas_is_interface(struct usb_host_interface *intf)
 856 {
 857         return (intf->desc.bInterfaceClass == USB_CLASS_MASS_STORAGE &&
 858                 intf->desc.bInterfaceSubClass == USB_SC_SCSI &&
 859                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 860 }
 861
 862 static int uas_isnt_supported(struct usb_device *udev)
 863 {
 864         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
 865
 866         dev_warn(&udev->dev, "The driver for the USB controller %s does not "
 867                         "support scatter-gather which is\n",
 868                         hcd->driver->description);
 869         dev_warn(&udev->dev, "required by the UAS driver. Please try an"
 870                         "alternative USB controller if you wish to use UAS.\n");
 871         return -ENODEV;
 872 }
 873
 874 static int uas_switch_interface(struct usb_device *udev,
 875                                                 struct usb_interface *intf)
 876 {
 877         int i;
 878         int sg_supported = udev->bus->sg_tablesize != 0;
 879
 880         for (i = 0; i < intf->num_altsetting; i++) {
 881                 struct usb_host_interface *alt = &intf->altsetting[i];
 882
 883                 if (uas_is_interface(alt)) {
 884                         if (!sg_supported)
 885                                 return uas_isnt_supported(udev);
 886                         return usb_set_interface(udev,
 887                                                 alt->desc.bInterfaceNumber,
 888                                                 alt->desc.bAlternateSetting);
 889                 }
 890         }
 891
 892         return -ENODEV;
 893 }
 894
 895 static void uas_configure_endpoints(struct uas_dev_info *devinfo)
 896 {
 897         struct usb_host_endpoint *eps[4] = { };
 898         struct usb_interface *intf = devinfo->intf;
 899         struct usb_device *udev = devinfo->udev;
 900         struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
 901         unsigned i, n_endpoints = intf->cur_altsetting->desc.bNumEndpoints;
 902
 903         devinfo->uas_sense_old = 0;
 904         devinfo->cmnd = NULL;
 905
 906         for (i = 0; i < n_endpoints; i++) {
 907                 unsigned char *extra = endpoint[i].extra;
 908                 int len = endpoint[i].extralen;
 909                 while (len > 1) {
 910                         if (extra[1] == USB_DT_PIPE_USAGE) {
 911                                 unsigned pipe_id = extra[2];
 912                                 if (pipe_id > 0 && pipe_id < 5)
 913                                         eps[pipe_id - 1] = &endpoint[i];
 914                                 break;
 915                         }
 916                         len -= extra[0];
 917                         extra += extra[0];
 918                 }
 919         }
 920
 921         /*
 922          * Assume that if we didn't find a control pipe descriptor, we're
 923          * using a device with old firmware that happens to be set up like
 924          * this.
 925          */
 926         if (!eps[0]) {
 927                 devinfo->cmd_pipe = usb_sndbulkpipe(udev, 1);
 928                 devinfo->status_pipe = usb_rcvbulkpipe(udev, 1);
 929                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev, 2);
 930                 devinfo->data_out_pipe = usb_sndbulkpipe(udev, 2);
 931
 932                 eps[1] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 933                 eps[2] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 934                 eps[3] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 935         } else {
 936                 devinfo->cmd_pipe = usb_sndbulkpipe(udev,
 937                                                 eps[0]->desc.bEndpointAddress);
 938                 devinfo->status_pipe = usb_rcvbulkpipe(udev,
 939                                                 eps[1]->desc.bEndpointAddress);
 940                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
 941                                                 eps[2]->desc.bEndpointAddress);
 942                 devinfo->data_out_pipe = usb_sndbulkpipe(udev,
 943                                                 eps[3]->desc.bEndpointAddress);
 944         }
 945
 946         devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1, 3, 256,
 947                                                                 GFP_KERNEL);
 948         if (devinfo->qdepth < 0) {
 949                 devinfo->qdepth = 256;
 950                 devinfo->use_streams = 0;
 951         } else {
 952                 devinfo->use_streams = 1;
 953         }
 954 }
 955
 956 static void uas_free_streams(struct uas_dev_info *devinfo)
 957 {
 958         struct usb_device *udev = devinfo->udev;
 959         struct usb_host_endpoint *eps[3];
 960
 961         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 962         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 963         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 964         usb_free_streams(devinfo->intf, eps, 3, GFP_KERNEL);
 965 }
 966
 967 /*
 968  * XXX: What I'd like to do here is register a SCSI host for each USB host in
 969  * the system.  Follow usb-storage's design of registering a SCSI host for
 970  * each USB device for the moment.  Can implement this by walking up the
 971  * USB hierarchy until we find a USB host.
 972  */
 973 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
 974 {
 975         int result;
 976         struct Scsi_Host *shost;
 977         struct uas_dev_info *devinfo;
 978         struct usb_device *udev = interface_to_usbdev(intf);
 979
 980         if (uas_switch_interface(udev, intf))
 981                 return -ENODEV;
 982
 983         devinfo = kmalloc(sizeof(struct uas_dev_info), GFP_KERNEL);
 984         if (!devinfo)
 985                 return -ENOMEM;
 986
 987         result = -ENOMEM;
 988         shost = scsi_host_alloc(&uas_host_template, sizeof(void *));
 989         if (!shost)
 990                 goto free;
 991
 992         shost->max_cmd_len = 16 + 252;
 993         shost->max_id = 1;
 994         shost->max_lun = 256;
 995         shost->max_channel = 0;
 996         shost->sg_tablesize = udev->bus->sg_tablesize;
 997
 998         devinfo->intf = intf;
 999         devinfo->udev = udev;
1000         devinfo->resetting = 0;
1001         init_usb_anchor(&devinfo->cmd_urbs);
1002         init_usb_anchor(&devinfo->sense_urbs);
1003         init_usb_anchor(&devinfo->data_urbs);
1004         spin_lock_init(&devinfo->lock);
1005         uas_configure_endpoints(devinfo);
1006
1007         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 3);
1008         if (result)
1009                 goto free;
1010
1011         result = scsi_add_host(shost, &intf->dev);
1012         if (result)
1013                 goto deconfig_eps;
1014
1015         shost->hostdata[0] = (unsigned long)devinfo;
1016
1017         scsi_scan_host(shost);
1018         usb_set_intfdata(intf, shost);
1019         return result;
1020
1021 deconfig_eps:
1022         uas_free_streams(devinfo);
1023  free:
1024         kfree(devinfo);
1025         if (shost)
1026                 scsi_host_put(shost);
1027         return result;
1028 }
1029
1030 static int uas_pre_reset(struct usb_interface *intf)
1031 {
1032 /* XXX: Need to return 1 if it's not our device in error handling */
1033         return 0;
1034 }
1035
1036 static int uas_post_reset(struct usb_interface *intf)
1037 {
1038 /* XXX: Need to return 1 if it's not our device in error handling */
1039         return 0;
1040 }
1041
1042 static void uas_disconnect(struct usb_interface *intf)
1043 {
1044         struct Scsi_Host *shost = usb_get_intfdata(intf);
1045         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
1046
1047         devinfo->resetting = 1;
1048         uas_abort_work(devinfo);
1049         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1050         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1051         usb_kill_anchored_urbs(&devinfo->data_urbs);
1052         scsi_remove_host(shost);
1053         uas_free_streams(devinfo);
1054         kfree(devinfo);
1055 }
1056
1057 /*
1058  * XXX: Should this plug into libusual so we can auto-upgrade devices from
1059  * Bulk-Only to UAS?
1060  */
1061 static struct usb_driver uas_driver = {
1062         .name = "uas",
1063         .probe = uas_probe,
1064         .disconnect = uas_disconnect,
1065         .pre_reset = uas_pre_reset,
1066         .post_reset = uas_post_reset,
1067         .id_table = uas_usb_ids,
1068 };
1069
1070 module_usb_driver(uas_driver);
1071
1072 MODULE_LICENSE("GPL");
1073 MODULE_AUTHOR("Matthew Wilcox and Sarah Sharp");