uas: Add the posibilty to blacklist uas devices from using the uas driver
[cascardo/linux.git] / drivers / usb / storage / uas.c
1 /*
2  * USB Attached SCSI
3  * Note that this is not the same as the USB Mass Storage driver
4  *
5  * Copyright Matthew Wilcox for Intel Corp, 2010
6  * Copyright Sarah Sharp for Intel Corp, 2010
7  *
8  * Distributed under the terms of the GNU GPL, version two.
9  */
10
11 #include <linux/blkdev.h>
12 #include <linux/slab.h>
13 #include <linux/types.h>
14 #include <linux/module.h>
15 #include <linux/usb.h>
16 #include <linux/usb_usual.h>
17 #include <linux/usb/hcd.h>
18 #include <linux/usb/storage.h>
19 #include <linux/usb/uas.h>
20
21 #include <scsi/scsi.h>
22 #include <scsi/scsi_eh.h>
23 #include <scsi/scsi_dbg.h>
24 #include <scsi/scsi_cmnd.h>
25 #include <scsi/scsi_device.h>
26 #include <scsi/scsi_host.h>
27 #include <scsi/scsi_tcq.h>
28
29 #include "uas-detect.h"
30
31 /*
32  * The r00-r01c specs define this version of the SENSE IU data structure.
33  * It's still in use by several different firmware releases.
34  */
35 struct sense_iu_old {
36         __u8 iu_id;
37         __u8 rsvd1;
38         __be16 tag;
39         __be16 len;
40         __u8 status;
41         __u8 service_response;
42         __u8 sense[SCSI_SENSE_BUFFERSIZE];
43 };
44
45 struct uas_dev_info {
46         struct usb_interface *intf;
47         struct usb_device *udev;
48         struct usb_anchor cmd_urbs;
49         struct usb_anchor sense_urbs;
50         struct usb_anchor data_urbs;
51         int qdepth, resetting;
52         struct response_iu response;
53         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
54         unsigned use_streams:1;
55         unsigned uas_sense_old:1;
56         struct scsi_cmnd *cmnd;
57         spinlock_t lock;
58         struct work_struct work;
59         struct list_head work_list;
60         struct list_head dead_list;
61 };
62
63 enum {
64         SUBMIT_STATUS_URB       = (1 << 1),
65         ALLOC_DATA_IN_URB       = (1 << 2),
66         SUBMIT_DATA_IN_URB      = (1 << 3),
67         ALLOC_DATA_OUT_URB      = (1 << 4),
68         SUBMIT_DATA_OUT_URB     = (1 << 5),
69         ALLOC_CMD_URB           = (1 << 6),
70         SUBMIT_CMD_URB          = (1 << 7),
71         COMMAND_INFLIGHT        = (1 << 8),
72         DATA_IN_URB_INFLIGHT    = (1 << 9),
73         DATA_OUT_URB_INFLIGHT   = (1 << 10),
74         COMMAND_COMPLETED       = (1 << 11),
75         COMMAND_ABORTED         = (1 << 12),
76         UNLINK_DATA_URBS        = (1 << 13),
77         IS_IN_WORK_LIST         = (1 << 14),
78 };
79
80 /* Overrides scsi_pointer */
81 struct uas_cmd_info {
82         unsigned int state;
83         unsigned int stream;
84         struct urb *cmd_urb;
85         struct urb *data_in_urb;
86         struct urb *data_out_urb;
87         struct list_head work;
88         struct list_head dead;
89 };
90
91 /* I hate forward declarations, but I actually have a loop */
92 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
93                                 struct uas_dev_info *devinfo, gfp_t gfp);
94 static void uas_do_work(struct work_struct *work);
95 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
96 static void uas_configure_endpoints(struct uas_dev_info *devinfo);
97 static void uas_free_streams(struct uas_dev_info *devinfo);
98 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller);
99
100 /* Must be called with devinfo->lock held, will temporary unlock the lock */
101 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
102                                  struct uas_cmd_info *cmdinfo,
103                                  unsigned long *lock_flags)
104 {
105         /*
106          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
107          * (called by urb completion) doesn't release cmdinfo
108          * underneath us.
109          */
110         cmdinfo->state |= UNLINK_DATA_URBS;
111         spin_unlock_irqrestore(&devinfo->lock, *lock_flags);
112
113         if (cmdinfo->data_in_urb)
114                 usb_unlink_urb(cmdinfo->data_in_urb);
115         if (cmdinfo->data_out_urb)
116                 usb_unlink_urb(cmdinfo->data_out_urb);
117
118         spin_lock_irqsave(&devinfo->lock, *lock_flags);
119         cmdinfo->state &= ~UNLINK_DATA_URBS;
120 }
121
122 static void uas_do_work(struct work_struct *work)
123 {
124         struct uas_dev_info *devinfo =
125                 container_of(work, struct uas_dev_info, work);
126         struct uas_cmd_info *cmdinfo;
127         struct uas_cmd_info *temp;
128         unsigned long flags;
129         int err;
130
131         spin_lock_irqsave(&devinfo->lock, flags);
132         list_for_each_entry_safe(cmdinfo, temp, &devinfo->work_list, work) {
133                 struct scsi_pointer *scp = (void *)cmdinfo;
134                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
135                                                       SCp);
136                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
137                 if (!err) {
138                         cmdinfo->state &= ~IS_IN_WORK_LIST;
139                         list_del(&cmdinfo->work);
140                 } else {
141                         schedule_work(&devinfo->work);
142                 }
143         }
144         spin_unlock_irqrestore(&devinfo->lock, flags);
145 }
146
147 static void uas_abort_work(struct uas_dev_info *devinfo)
148 {
149         struct uas_cmd_info *cmdinfo;
150         struct uas_cmd_info *temp;
151         unsigned long flags;
152
153         spin_lock_irqsave(&devinfo->lock, flags);
154         list_for_each_entry_safe(cmdinfo, temp, &devinfo->work_list, work) {
155                 struct scsi_pointer *scp = (void *)cmdinfo;
156                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
157                                                       SCp);
158                 uas_log_cmd_state(cmnd, __func__);
159                 WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
160                 cmdinfo->state |= COMMAND_ABORTED;
161                 cmdinfo->state &= ~IS_IN_WORK_LIST;
162                 list_del(&cmdinfo->work);
163                 list_add_tail(&cmdinfo->dead, &devinfo->dead_list);
164         }
165         spin_unlock_irqrestore(&devinfo->lock, flags);
166 }
167
168 static void uas_add_work(struct uas_cmd_info *cmdinfo)
169 {
170         struct scsi_pointer *scp = (void *)cmdinfo;
171         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
172         struct uas_dev_info *devinfo = cmnd->device->hostdata;
173
174         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
175         list_add_tail(&cmdinfo->work, &devinfo->work_list);
176         cmdinfo->state |= IS_IN_WORK_LIST;
177         schedule_work(&devinfo->work);
178 }
179
180 static void uas_zap_dead(struct uas_dev_info *devinfo)
181 {
182         struct uas_cmd_info *cmdinfo;
183         struct uas_cmd_info *temp;
184         unsigned long flags;
185
186         spin_lock_irqsave(&devinfo->lock, flags);
187         list_for_each_entry_safe(cmdinfo, temp, &devinfo->dead_list, dead) {
188                 struct scsi_pointer *scp = (void *)cmdinfo;
189                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
190                                                       SCp);
191                 uas_log_cmd_state(cmnd, __func__);
192                 WARN_ON_ONCE(!(cmdinfo->state & COMMAND_ABORTED));
193                 /* all urbs are killed, clear inflight bits */
194                 cmdinfo->state &= ~(COMMAND_INFLIGHT |
195                                     DATA_IN_URB_INFLIGHT |
196                                     DATA_OUT_URB_INFLIGHT);
197                 uas_try_complete(cmnd, __func__);
198         }
199         spin_unlock_irqrestore(&devinfo->lock, flags);
200 }
201
202 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
203 {
204         struct sense_iu *sense_iu = urb->transfer_buffer;
205         struct scsi_device *sdev = cmnd->device;
206
207         if (urb->actual_length > 16) {
208                 unsigned len = be16_to_cpup(&sense_iu->len);
209                 if (len + 16 != urb->actual_length) {
210                         int newlen = min(len + 16, urb->actual_length) - 16;
211                         if (newlen < 0)
212                                 newlen = 0;
213                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
214                                 "disagrees with IU sense data length %d, "
215                                 "using %d bytes of sense data\n", __func__,
216                                         urb->actual_length, len, newlen);
217                         len = newlen;
218                 }
219                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
220         }
221
222         cmnd->result = sense_iu->status;
223 }
224
225 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
226 {
227         struct sense_iu_old *sense_iu = urb->transfer_buffer;
228         struct scsi_device *sdev = cmnd->device;
229
230         if (urb->actual_length > 8) {
231                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
232                 if (len + 8 != urb->actual_length) {
233                         int newlen = min(len + 8, urb->actual_length) - 8;
234                         if (newlen < 0)
235                                 newlen = 0;
236                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
237                                 "disagrees with IU sense data length %d, "
238                                 "using %d bytes of sense data\n", __func__,
239                                         urb->actual_length, len, newlen);
240                         len = newlen;
241                 }
242                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
243         }
244
245         cmnd->result = sense_iu->status;
246 }
247
248 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
249 {
250         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
251
252         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
253                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
254                     caller, cmnd, cmnd->request->tag,
255                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
256                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
257                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
258                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
259                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
260                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
261                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
262                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
263                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
264                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
265                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
266                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
267                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
268                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
269 }
270
271 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
272 {
273         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
274         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
275
276         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
277         if (cmdinfo->state & (COMMAND_INFLIGHT |
278                               DATA_IN_URB_INFLIGHT |
279                               DATA_OUT_URB_INFLIGHT |
280                               UNLINK_DATA_URBS))
281                 return -EBUSY;
282         WARN_ON_ONCE(cmdinfo->state & COMMAND_COMPLETED);
283         cmdinfo->state |= COMMAND_COMPLETED;
284         usb_free_urb(cmdinfo->data_in_urb);
285         usb_free_urb(cmdinfo->data_out_urb);
286         if (cmdinfo->state & COMMAND_ABORTED) {
287                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
288                 cmnd->result = DID_ABORT << 16;
289                 list_del(&cmdinfo->dead);
290         }
291         cmnd->scsi_done(cmnd);
292         return 0;
293 }
294
295 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
296                           unsigned direction)
297 {
298         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
299         int err;
300
301         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
302         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
303         if (err) {
304                 uas_add_work(cmdinfo);
305         }
306 }
307
308 static void uas_stat_cmplt(struct urb *urb)
309 {
310         struct iu *iu = urb->transfer_buffer;
311         struct Scsi_Host *shost = urb->context;
312         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
313         struct scsi_cmnd *cmnd;
314         struct uas_cmd_info *cmdinfo;
315         unsigned long flags;
316         u16 tag;
317
318         if (urb->status) {
319                 if (urb->status == -ENOENT) {
320                         dev_err(&urb->dev->dev, "stat urb: killed, stream %d\n",
321                                 urb->stream_id);
322                 } else {
323                         dev_err(&urb->dev->dev, "stat urb: status %d\n",
324                                 urb->status);
325                 }
326                 usb_free_urb(urb);
327                 return;
328         }
329
330         if (devinfo->resetting) {
331                 usb_free_urb(urb);
332                 return;
333         }
334
335         spin_lock_irqsave(&devinfo->lock, flags);
336         tag = be16_to_cpup(&iu->tag) - 1;
337         if (tag == 0)
338                 cmnd = devinfo->cmnd;
339         else
340                 cmnd = scsi_host_find_tag(shost, tag - 1);
341
342         if (!cmnd) {
343                 if (iu->iu_id == IU_ID_RESPONSE) {
344                         /* store results for uas_eh_task_mgmt() */
345                         memcpy(&devinfo->response, iu, sizeof(devinfo->response));
346                 }
347                 usb_free_urb(urb);
348                 spin_unlock_irqrestore(&devinfo->lock, flags);
349                 return;
350         }
351
352         cmdinfo = (void *)&cmnd->SCp;
353         switch (iu->iu_id) {
354         case IU_ID_STATUS:
355                 if (devinfo->cmnd == cmnd)
356                         devinfo->cmnd = NULL;
357
358                 if (urb->actual_length < 16)
359                         devinfo->uas_sense_old = 1;
360                 if (devinfo->uas_sense_old)
361                         uas_sense_old(urb, cmnd);
362                 else
363                         uas_sense(urb, cmnd);
364                 if (cmnd->result != 0) {
365                         /* cancel data transfers on error */
366                         uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
367                 }
368                 cmdinfo->state &= ~COMMAND_INFLIGHT;
369                 uas_try_complete(cmnd, __func__);
370                 break;
371         case IU_ID_READ_READY:
372                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
373                 break;
374         case IU_ID_WRITE_READY:
375                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
376                 break;
377         default:
378                 scmd_printk(KERN_ERR, cmnd,
379                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
380         }
381         usb_free_urb(urb);
382         spin_unlock_irqrestore(&devinfo->lock, flags);
383 }
384
385 static void uas_data_cmplt(struct urb *urb)
386 {
387         struct scsi_cmnd *cmnd = urb->context;
388         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
389         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
390         struct scsi_data_buffer *sdb = NULL;
391         unsigned long flags;
392
393         spin_lock_irqsave(&devinfo->lock, flags);
394         if (cmdinfo->data_in_urb == urb) {
395                 sdb = scsi_in(cmnd);
396                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
397         } else if (cmdinfo->data_out_urb == urb) {
398                 sdb = scsi_out(cmnd);
399                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
400         }
401         if (sdb == NULL) {
402                 WARN_ON_ONCE(1);
403         } else if (urb->status) {
404                 /* error: no data transfered */
405                 sdb->resid = sdb->length;
406         } else {
407                 sdb->resid = sdb->length - urb->actual_length;
408         }
409         uas_try_complete(cmnd, __func__);
410         spin_unlock_irqrestore(&devinfo->lock, flags);
411 }
412
413 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
414                                       unsigned int pipe, u16 stream_id,
415                                       struct scsi_cmnd *cmnd,
416                                       enum dma_data_direction dir)
417 {
418         struct usb_device *udev = devinfo->udev;
419         struct urb *urb = usb_alloc_urb(0, gfp);
420         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
421                 ? scsi_in(cmnd) : scsi_out(cmnd);
422
423         if (!urb)
424                 goto out;
425         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
426                           uas_data_cmplt, cmnd);
427         if (devinfo->use_streams)
428                 urb->stream_id = stream_id;
429         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
430         urb->sg = sdb->table.sgl;
431  out:
432         return urb;
433 }
434
435 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
436                                        struct Scsi_Host *shost, u16 stream_id)
437 {
438         struct usb_device *udev = devinfo->udev;
439         struct urb *urb = usb_alloc_urb(0, gfp);
440         struct sense_iu *iu;
441
442         if (!urb)
443                 goto out;
444
445         iu = kzalloc(sizeof(*iu), gfp);
446         if (!iu)
447                 goto free;
448
449         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
450                                                 uas_stat_cmplt, shost);
451         urb->stream_id = stream_id;
452         urb->transfer_flags |= URB_FREE_BUFFER;
453  out:
454         return urb;
455  free:
456         usb_free_urb(urb);
457         return NULL;
458 }
459
460 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
461                                         struct scsi_cmnd *cmnd)
462 {
463         struct usb_device *udev = devinfo->udev;
464         struct scsi_device *sdev = cmnd->device;
465         struct urb *urb = usb_alloc_urb(0, gfp);
466         struct command_iu *iu;
467         int len;
468
469         if (!urb)
470                 goto out;
471
472         len = cmnd->cmd_len - 16;
473         if (len < 0)
474                 len = 0;
475         len = ALIGN(len, 4);
476         iu = kzalloc(sizeof(*iu) + len, gfp);
477         if (!iu)
478                 goto free;
479
480         iu->iu_id = IU_ID_COMMAND;
481         if (blk_rq_tagged(cmnd->request))
482                 iu->tag = cpu_to_be16(cmnd->request->tag + 2);
483         else
484                 iu->tag = cpu_to_be16(1);
485         iu->prio_attr = UAS_SIMPLE_TAG;
486         iu->len = len;
487         int_to_scsilun(sdev->lun, &iu->lun);
488         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
489
490         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
491                                                         usb_free_urb, NULL);
492         urb->transfer_flags |= URB_FREE_BUFFER;
493  out:
494         return urb;
495  free:
496         usb_free_urb(urb);
497         return NULL;
498 }
499
500 static int uas_submit_task_urb(struct scsi_cmnd *cmnd, gfp_t gfp,
501                                u8 function, u16 stream_id)
502 {
503         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
504         struct usb_device *udev = devinfo->udev;
505         struct urb *urb = usb_alloc_urb(0, gfp);
506         struct task_mgmt_iu *iu;
507         int err = -ENOMEM;
508
509         if (!urb)
510                 goto err;
511
512         iu = kzalloc(sizeof(*iu), gfp);
513         if (!iu)
514                 goto err;
515
516         iu->iu_id = IU_ID_TASK_MGMT;
517         iu->tag = cpu_to_be16(stream_id);
518         int_to_scsilun(cmnd->device->lun, &iu->lun);
519
520         iu->function = function;
521         switch (function) {
522         case TMF_ABORT_TASK:
523                 if (blk_rq_tagged(cmnd->request))
524                         iu->task_tag = cpu_to_be16(cmnd->request->tag + 2);
525                 else
526                         iu->task_tag = cpu_to_be16(1);
527                 break;
528         }
529
530         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu),
531                           usb_free_urb, NULL);
532         urb->transfer_flags |= URB_FREE_BUFFER;
533
534         usb_anchor_urb(urb, &devinfo->cmd_urbs);
535         err = usb_submit_urb(urb, gfp);
536         if (err) {
537                 usb_unanchor_urb(urb);
538                 goto err;
539         }
540
541         return 0;
542
543 err:
544         usb_free_urb(urb);
545         return err;
546 }
547
548 /*
549  * Why should I request the Status IU before sending the Command IU?  Spec
550  * says to, but also says the device may receive them in any order.  Seems
551  * daft to me.
552  */
553
554 static int uas_submit_sense_urb(struct Scsi_Host *shost,
555                                 gfp_t gfp, unsigned int stream)
556 {
557         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
558         struct urb *urb;
559
560         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
561         if (!urb)
562                 return SCSI_MLQUEUE_DEVICE_BUSY;
563         usb_anchor_urb(urb, &devinfo->sense_urbs);
564         if (usb_submit_urb(urb, gfp)) {
565                 usb_unanchor_urb(urb);
566                 shost_printk(KERN_INFO, shost,
567                              "sense urb submission failure\n");
568                 usb_free_urb(urb);
569                 return SCSI_MLQUEUE_DEVICE_BUSY;
570         }
571         return 0;
572 }
573
574 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
575                            struct uas_dev_info *devinfo, gfp_t gfp)
576 {
577         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
578         int err;
579
580         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
581         if (cmdinfo->state & SUBMIT_STATUS_URB) {
582                 err = uas_submit_sense_urb(cmnd->device->host, gfp,
583                                            cmdinfo->stream);
584                 if (err) {
585                         return err;
586                 }
587                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
588         }
589
590         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
591                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
592                                         devinfo->data_in_pipe, cmdinfo->stream,
593                                         cmnd, DMA_FROM_DEVICE);
594                 if (!cmdinfo->data_in_urb)
595                         return SCSI_MLQUEUE_DEVICE_BUSY;
596                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
597         }
598
599         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
600                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
601                 if (usb_submit_urb(cmdinfo->data_in_urb, gfp)) {
602                         usb_unanchor_urb(cmdinfo->data_in_urb);
603                         scmd_printk(KERN_INFO, cmnd,
604                                         "data in urb submission failure\n");
605                         return SCSI_MLQUEUE_DEVICE_BUSY;
606                 }
607                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
608                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
609         }
610
611         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
612                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
613                                         devinfo->data_out_pipe, cmdinfo->stream,
614                                         cmnd, DMA_TO_DEVICE);
615                 if (!cmdinfo->data_out_urb)
616                         return SCSI_MLQUEUE_DEVICE_BUSY;
617                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
618         }
619
620         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
621                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
622                 if (usb_submit_urb(cmdinfo->data_out_urb, gfp)) {
623                         usb_unanchor_urb(cmdinfo->data_out_urb);
624                         scmd_printk(KERN_INFO, cmnd,
625                                         "data out urb submission failure\n");
626                         return SCSI_MLQUEUE_DEVICE_BUSY;
627                 }
628                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
629                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
630         }
631
632         if (cmdinfo->state & ALLOC_CMD_URB) {
633                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd);
634                 if (!cmdinfo->cmd_urb)
635                         return SCSI_MLQUEUE_DEVICE_BUSY;
636                 cmdinfo->state &= ~ALLOC_CMD_URB;
637         }
638
639         if (cmdinfo->state & SUBMIT_CMD_URB) {
640                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
641                 if (usb_submit_urb(cmdinfo->cmd_urb, gfp)) {
642                         usb_unanchor_urb(cmdinfo->cmd_urb);
643                         scmd_printk(KERN_INFO, cmnd,
644                                         "cmd urb submission failure\n");
645                         return SCSI_MLQUEUE_DEVICE_BUSY;
646                 }
647                 cmdinfo->cmd_urb = NULL;
648                 cmdinfo->state &= ~SUBMIT_CMD_URB;
649                 cmdinfo->state |= COMMAND_INFLIGHT;
650         }
651
652         return 0;
653 }
654
655 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
656                                         void (*done)(struct scsi_cmnd *))
657 {
658         struct scsi_device *sdev = cmnd->device;
659         struct uas_dev_info *devinfo = sdev->hostdata;
660         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
661         unsigned long flags;
662         int err;
663
664         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
665
666         if (devinfo->resetting) {
667                 cmnd->result = DID_ERROR << 16;
668                 cmnd->scsi_done(cmnd);
669                 return 0;
670         }
671
672         spin_lock_irqsave(&devinfo->lock, flags);
673         if (devinfo->cmnd) {
674                 spin_unlock_irqrestore(&devinfo->lock, flags);
675                 return SCSI_MLQUEUE_DEVICE_BUSY;
676         }
677
678         if (blk_rq_tagged(cmnd->request)) {
679                 cmdinfo->stream = cmnd->request->tag + 2;
680         } else {
681                 devinfo->cmnd = cmnd;
682                 cmdinfo->stream = 1;
683         }
684
685         cmnd->scsi_done = done;
686
687         cmdinfo->state = SUBMIT_STATUS_URB |
688                         ALLOC_CMD_URB | SUBMIT_CMD_URB;
689
690         switch (cmnd->sc_data_direction) {
691         case DMA_FROM_DEVICE:
692                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
693                 break;
694         case DMA_BIDIRECTIONAL:
695                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
696         case DMA_TO_DEVICE:
697                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
698         case DMA_NONE:
699                 break;
700         }
701
702         if (!devinfo->use_streams) {
703                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
704                 cmdinfo->stream = 0;
705         }
706
707         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
708         if (err) {
709                 /* If we did nothing, give up now */
710                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
711                         spin_unlock_irqrestore(&devinfo->lock, flags);
712                         return SCSI_MLQUEUE_DEVICE_BUSY;
713                 }
714                 uas_add_work(cmdinfo);
715         }
716
717         spin_unlock_irqrestore(&devinfo->lock, flags);
718         return 0;
719 }
720
721 static DEF_SCSI_QCMD(uas_queuecommand)
722
723 static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
724                             const char *fname, u8 function)
725 {
726         struct Scsi_Host *shost = cmnd->device->host;
727         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
728         u16 tag = devinfo->qdepth;
729         unsigned long flags;
730
731         spin_lock_irqsave(&devinfo->lock, flags);
732         memset(&devinfo->response, 0, sizeof(devinfo->response));
733         if (uas_submit_sense_urb(shost, GFP_ATOMIC, tag)) {
734                 shost_printk(KERN_INFO, shost,
735                              "%s: %s: submit sense urb failed\n",
736                              __func__, fname);
737                 spin_unlock_irqrestore(&devinfo->lock, flags);
738                 return FAILED;
739         }
740         if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
741                 shost_printk(KERN_INFO, shost,
742                              "%s: %s: submit task mgmt urb failed\n",
743                              __func__, fname);
744                 spin_unlock_irqrestore(&devinfo->lock, flags);
745                 return FAILED;
746         }
747         spin_unlock_irqrestore(&devinfo->lock, flags);
748
749         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 3000) == 0) {
750                 shost_printk(KERN_INFO, shost,
751                              "%s: %s timed out\n", __func__, fname);
752                 return FAILED;
753         }
754         if (be16_to_cpu(devinfo->response.tag) != tag) {
755                 shost_printk(KERN_INFO, shost,
756                              "%s: %s failed (wrong tag %d/%d)\n", __func__,
757                              fname, be16_to_cpu(devinfo->response.tag), tag);
758                 return FAILED;
759         }
760         if (devinfo->response.response_code != RC_TMF_COMPLETE) {
761                 shost_printk(KERN_INFO, shost,
762                              "%s: %s failed (rc 0x%x)\n", __func__,
763                              fname, devinfo->response.response_code);
764                 return FAILED;
765         }
766         return SUCCESS;
767 }
768
769 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
770 {
771         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
772         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
773         unsigned long flags;
774         int ret;
775
776         uas_log_cmd_state(cmnd, __func__);
777         spin_lock_irqsave(&devinfo->lock, flags);
778         WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
779         cmdinfo->state |= COMMAND_ABORTED;
780         list_add_tail(&cmdinfo->dead, &devinfo->dead_list);
781         if (cmdinfo->state & IS_IN_WORK_LIST) {
782                 list_del(&cmdinfo->work);
783                 cmdinfo->state &= ~IS_IN_WORK_LIST;
784         }
785         if (cmdinfo->state & COMMAND_INFLIGHT) {
786                 spin_unlock_irqrestore(&devinfo->lock, flags);
787                 ret = uas_eh_task_mgmt(cmnd, "ABORT TASK", TMF_ABORT_TASK);
788         } else {
789                 uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
790                 uas_try_complete(cmnd, __func__);
791                 spin_unlock_irqrestore(&devinfo->lock, flags);
792                 ret = SUCCESS;
793         }
794         return ret;
795 }
796
797 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
798 {
799         sdev_printk(KERN_INFO, cmnd->device, "%s\n", __func__);
800         return uas_eh_task_mgmt(cmnd, "LOGICAL UNIT RESET",
801                                 TMF_LOGICAL_UNIT_RESET);
802 }
803
804 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
805 {
806         struct scsi_device *sdev = cmnd->device;
807         struct uas_dev_info *devinfo = sdev->hostdata;
808         struct usb_device *udev = devinfo->udev;
809         int err;
810
811         err = usb_lock_device_for_reset(udev, devinfo->intf);
812         if (err) {
813                 shost_printk(KERN_ERR, sdev->host,
814                              "%s FAILED to get lock err %d\n", __func__, err);
815                 return FAILED;
816         }
817
818         shost_printk(KERN_INFO, sdev->host, "%s start\n", __func__);
819         devinfo->resetting = 1;
820         uas_abort_work(devinfo);
821         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
822         usb_kill_anchored_urbs(&devinfo->sense_urbs);
823         usb_kill_anchored_urbs(&devinfo->data_urbs);
824         uas_zap_dead(devinfo);
825         err = usb_reset_device(udev);
826         devinfo->resetting = 0;
827
828         usb_unlock_device(udev);
829
830         if (err) {
831                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
832                 return FAILED;
833         }
834
835         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
836         return SUCCESS;
837 }
838
839 static int uas_slave_alloc(struct scsi_device *sdev)
840 {
841         sdev->hostdata = (void *)sdev->host->hostdata[0];
842         return 0;
843 }
844
845 static int uas_slave_configure(struct scsi_device *sdev)
846 {
847         struct uas_dev_info *devinfo = sdev->hostdata;
848         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
849         scsi_activate_tcq(sdev, devinfo->qdepth - 2);
850         return 0;
851 }
852
853 static struct scsi_host_template uas_host_template = {
854         .module = THIS_MODULE,
855         .name = "uas",
856         .queuecommand = uas_queuecommand,
857         .slave_alloc = uas_slave_alloc,
858         .slave_configure = uas_slave_configure,
859         .eh_abort_handler = uas_eh_abort_handler,
860         .eh_device_reset_handler = uas_eh_device_reset_handler,
861         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
862         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
863         .this_id = -1,
864         .sg_tablesize = SG_NONE,
865         .cmd_per_lun = 1,       /* until we override it */
866         .skip_settle_delay = 1,
867         .ordered_tag = 1,
868 };
869
870 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
871                     vendorName, productName, useProtocol, useTransport, \
872                     initFunction, flags) \
873 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
874         .driver_info = (flags) }
875
876 static struct usb_device_id uas_usb_ids[] = {
877 #       include "unusual_uas.h"
878         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
879         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
880         /* 0xaa is a prototype device I happen to have access to */
881         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
882         { }
883 };
884 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
885
886 #undef UNUSUAL_DEV
887
888 static int uas_switch_interface(struct usb_device *udev,
889                                 struct usb_interface *intf)
890 {
891         int alt;
892
893         alt = uas_find_uas_alt_setting(intf);
894         if (alt < 0)
895                 return alt;
896
897         return usb_set_interface(udev,
898                         intf->altsetting[0].desc.bInterfaceNumber, alt);
899 }
900
901 static void uas_configure_endpoints(struct uas_dev_info *devinfo)
902 {
903         struct usb_host_endpoint *eps[4] = { };
904         struct usb_interface *intf = devinfo->intf;
905         struct usb_device *udev = devinfo->udev;
906         struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
907         unsigned i, n_endpoints = intf->cur_altsetting->desc.bNumEndpoints;
908
909         devinfo->uas_sense_old = 0;
910         devinfo->cmnd = NULL;
911
912         for (i = 0; i < n_endpoints; i++) {
913                 unsigned char *extra = endpoint[i].extra;
914                 int len = endpoint[i].extralen;
915                 while (len > 1) {
916                         if (extra[1] == USB_DT_PIPE_USAGE) {
917                                 unsigned pipe_id = extra[2];
918                                 if (pipe_id > 0 && pipe_id < 5)
919                                         eps[pipe_id - 1] = &endpoint[i];
920                                 break;
921                         }
922                         len -= extra[0];
923                         extra += extra[0];
924                 }
925         }
926
927         /*
928          * Assume that if we didn't find a control pipe descriptor, we're
929          * using a device with old firmware that happens to be set up like
930          * this.
931          */
932         if (!eps[0]) {
933                 devinfo->cmd_pipe = usb_sndbulkpipe(udev, 1);
934                 devinfo->status_pipe = usb_rcvbulkpipe(udev, 1);
935                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev, 2);
936                 devinfo->data_out_pipe = usb_sndbulkpipe(udev, 2);
937
938                 eps[1] = usb_pipe_endpoint(udev, devinfo->status_pipe);
939                 eps[2] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
940                 eps[3] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
941         } else {
942                 devinfo->cmd_pipe = usb_sndbulkpipe(udev,
943                                              usb_endpoint_num(&eps[0]->desc));
944                 devinfo->status_pipe = usb_rcvbulkpipe(udev,
945                                              usb_endpoint_num(&eps[1]->desc));
946                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
947                                              usb_endpoint_num(&eps[2]->desc));
948                 devinfo->data_out_pipe = usb_sndbulkpipe(udev,
949                                              usb_endpoint_num(&eps[3]->desc));
950         }
951
952         devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1, 3, 256,
953                                                                 GFP_KERNEL);
954         if (devinfo->qdepth < 0) {
955                 devinfo->qdepth = 256;
956                 devinfo->use_streams = 0;
957         } else {
958                 devinfo->use_streams = 1;
959         }
960 }
961
962 static void uas_free_streams(struct uas_dev_info *devinfo)
963 {
964         struct usb_device *udev = devinfo->udev;
965         struct usb_host_endpoint *eps[3];
966
967         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
968         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
969         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
970         usb_free_streams(devinfo->intf, eps, 3, GFP_KERNEL);
971 }
972
973 /*
974  * XXX: What I'd like to do here is register a SCSI host for each USB host in
975  * the system.  Follow usb-storage's design of registering a SCSI host for
976  * each USB device for the moment.  Can implement this by walking up the
977  * USB hierarchy until we find a USB host.
978  */
979 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
980 {
981         int result = -ENOMEM;
982         struct Scsi_Host *shost = NULL;
983         struct uas_dev_info *devinfo;
984         struct usb_device *udev = interface_to_usbdev(intf);
985
986         if (!uas_use_uas_driver(intf, id))
987                 return -ENODEV;
988
989         if (uas_switch_interface(udev, intf))
990                 return -ENODEV;
991
992         devinfo = kmalloc(sizeof(struct uas_dev_info), GFP_KERNEL);
993         if (!devinfo)
994                 goto set_alt0;
995
996         shost = scsi_host_alloc(&uas_host_template, sizeof(void *));
997         if (!shost)
998                 goto set_alt0;
999
1000         shost->max_cmd_len = 16 + 252;
1001         shost->max_id = 1;
1002         shost->max_lun = 256;
1003         shost->max_channel = 0;
1004         shost->sg_tablesize = udev->bus->sg_tablesize;
1005
1006         devinfo->intf = intf;
1007         devinfo->udev = udev;
1008         devinfo->resetting = 0;
1009         init_usb_anchor(&devinfo->cmd_urbs);
1010         init_usb_anchor(&devinfo->sense_urbs);
1011         init_usb_anchor(&devinfo->data_urbs);
1012         spin_lock_init(&devinfo->lock);
1013         INIT_WORK(&devinfo->work, uas_do_work);
1014         INIT_LIST_HEAD(&devinfo->work_list);
1015         INIT_LIST_HEAD(&devinfo->dead_list);
1016         uas_configure_endpoints(devinfo);
1017
1018         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 2);
1019         if (result)
1020                 goto free_streams;
1021
1022         result = scsi_add_host(shost, &intf->dev);
1023         if (result)
1024                 goto free_streams;
1025
1026         shost->hostdata[0] = (unsigned long)devinfo;
1027
1028         scsi_scan_host(shost);
1029         usb_set_intfdata(intf, shost);
1030         return result;
1031
1032 free_streams:
1033         uas_free_streams(devinfo);
1034 set_alt0:
1035         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1036         kfree(devinfo);
1037         if (shost)
1038                 scsi_host_put(shost);
1039         return result;
1040 }
1041
1042 static int uas_pre_reset(struct usb_interface *intf)
1043 {
1044         struct Scsi_Host *shost = usb_get_intfdata(intf);
1045         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
1046         unsigned long flags;
1047
1048         /* Block new requests */
1049         spin_lock_irqsave(shost->host_lock, flags);
1050         scsi_block_requests(shost);
1051         spin_unlock_irqrestore(shost->host_lock, flags);
1052
1053         /* Wait for any pending requests to complete */
1054         flush_work(&devinfo->work);
1055         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1056                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1057                 return 1;
1058         }
1059
1060         uas_free_streams(devinfo);
1061
1062         return 0;
1063 }
1064
1065 static int uas_post_reset(struct usb_interface *intf)
1066 {
1067         struct Scsi_Host *shost = usb_get_intfdata(intf);
1068         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
1069         unsigned long flags;
1070
1071         uas_configure_endpoints(devinfo);
1072
1073         spin_lock_irqsave(shost->host_lock, flags);
1074         scsi_report_bus_reset(shost, 0);
1075         spin_unlock_irqrestore(shost->host_lock, flags);
1076
1077         scsi_unblock_requests(shost);
1078
1079         return 0;
1080 }
1081
1082 static void uas_disconnect(struct usb_interface *intf)
1083 {
1084         struct Scsi_Host *shost = usb_get_intfdata(intf);
1085         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
1086
1087         devinfo->resetting = 1;
1088         cancel_work_sync(&devinfo->work);
1089         uas_abort_work(devinfo);
1090         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1091         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1092         usb_kill_anchored_urbs(&devinfo->data_urbs);
1093         uas_zap_dead(devinfo);
1094         scsi_remove_host(shost);
1095         uas_free_streams(devinfo);
1096         kfree(devinfo);
1097 }
1098
1099 static struct usb_driver uas_driver = {
1100         .name = "uas",
1101         .probe = uas_probe,
1102         .disconnect = uas_disconnect,
1103         .pre_reset = uas_pre_reset,
1104         .post_reset = uas_post_reset,
1105         .id_table = uas_usb_ids,
1106 };
1107
1108 module_usb_driver(uas_driver);
1109
1110 MODULE_LICENSE("GPL");
1111 MODULE_AUTHOR("Matthew Wilcox and Sarah Sharp");