drivers/usb/storage/uas.c

   1 /*
   2  * USB Attached SCSI
   3  * Note that this is not the same as the USB Mass Storage driver
   4  *
   5  * Copyright Matthew Wilcox for Intel Corp, 2010
   6  * Copyright Sarah Sharp for Intel Corp, 2010
   7  *
   8  * Distributed under the terms of the GNU GPL, version two.
   9  */
  10
  11 #include <linux/blkdev.h>
  12 #include <linux/slab.h>
  13 #include <linux/types.h>
  14 #include <linux/module.h>
  15 #include <linux/usb.h>
  16 #include <linux/usb/hcd.h>
  17 #include <linux/usb/storage.h>
  18 #include <linux/usb/uas.h>
  19
  20 #include <scsi/scsi.h>
  21 #include <scsi/scsi_dbg.h>
  22 #include <scsi/scsi_cmnd.h>
  23 #include <scsi/scsi_device.h>
  24 #include <scsi/scsi_host.h>
  25 #include <scsi/scsi_tcq.h>
  26
  27 /*
  28  * The r00-r01c specs define this version of the SENSE IU data structure.
  29  * It's still in use by several different firmware releases.
  30  */
  31 struct sense_iu_old {
  32         __u8 iu_id;
  33         __u8 rsvd1;
  34         __be16 tag;
  35         __be16 len;
  36         __u8 status;
  37         __u8 service_response;
  38         __u8 sense[SCSI_SENSE_BUFFERSIZE];
  39 };
  40
  41 struct uas_dev_info {
  42         struct usb_interface *intf;
  43         struct usb_device *udev;
  44         struct usb_anchor cmd_urbs;
  45         struct usb_anchor sense_urbs;
  46         struct usb_anchor data_urbs;
  47         int qdepth, resetting;
  48         struct response_ui response;
  49         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
  50         unsigned use_streams:1;
  51         unsigned uas_sense_old:1;
  52         struct scsi_cmnd *cmnd;
  53         spinlock_t lock;
  54         struct work_struct work;
  55         struct list_head work_list;
  56         struct list_head dead_list;
  57 };
  58
  59 enum {
  60         SUBMIT_STATUS_URB       = (1 << 1),
  61         ALLOC_DATA_IN_URB       = (1 << 2),
  62         SUBMIT_DATA_IN_URB      = (1 << 3),
  63         ALLOC_DATA_OUT_URB      = (1 << 4),
  64         SUBMIT_DATA_OUT_URB     = (1 << 5),
  65         ALLOC_CMD_URB           = (1 << 6),
  66         SUBMIT_CMD_URB          = (1 << 7),
  67         COMMAND_INFLIGHT        = (1 << 8),
  68         DATA_IN_URB_INFLIGHT    = (1 << 9),
  69         DATA_OUT_URB_INFLIGHT   = (1 << 10),
  70         COMMAND_COMPLETED       = (1 << 11),
  71         COMMAND_ABORTED         = (1 << 12),
  72         UNLINK_DATA_URBS        = (1 << 13),
  73         IS_IN_WORK_LIST         = (1 << 14),
  74 };
  75
  76 /* Overrides scsi_pointer */
  77 struct uas_cmd_info {
  78         unsigned int state;
  79         unsigned int stream;
  80         struct urb *cmd_urb;
  81         struct urb *data_in_urb;
  82         struct urb *data_out_urb;
  83         struct list_head work;
  84         struct list_head dead;
  85 };
  86
  87 /* I hate forward declarations, but I actually have a loop */
  88 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
  89                                 struct uas_dev_info *devinfo, gfp_t gfp);
  90 static void uas_do_work(struct work_struct *work);
  91 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
  92 static void uas_configure_endpoints(struct uas_dev_info *devinfo);
  93 static void uas_free_streams(struct uas_dev_info *devinfo);
  94 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller);
  95
  96 /* Must be called with devinfo->lock held, will temporary unlock the lock */
  97 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
  98                                  struct uas_cmd_info *cmdinfo,
  99                                  unsigned long *lock_flags)
 100 {
 101         /*
 102          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
 103          * (called by urb completion) doesn't release cmdinfo
 104          * underneath us.
 105          */
 106         cmdinfo->state |= UNLINK_DATA_URBS;
 107         spin_unlock_irqrestore(&devinfo->lock, *lock_flags);
 108
 109         if (cmdinfo->data_in_urb)
 110                 usb_unlink_urb(cmdinfo->data_in_urb);
 111         if (cmdinfo->data_out_urb)
 112                 usb_unlink_urb(cmdinfo->data_out_urb);
 113
 114         spin_lock_irqsave(&devinfo->lock, *lock_flags);
 115         cmdinfo->state &= ~UNLINK_DATA_URBS;
 116 }
 117
 118 static void uas_do_work(struct work_struct *work)
 119 {
 120         struct uas_dev_info *devinfo =
 121                 container_of(work, struct uas_dev_info, work);
 122         struct uas_cmd_info *cmdinfo;
 123         struct uas_cmd_info *temp;
 124         unsigned long flags;
 125         int err;
 126
 127         spin_lock_irqsave(&devinfo->lock, flags);
 128         list_for_each_entry_safe(cmdinfo, temp, &devinfo->work_list, work) {
 129                 struct scsi_pointer *scp = (void *)cmdinfo;
 130                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
 131                                                       SCp);
 132                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 133                 if (!err) {
 134                         cmdinfo->state &= ~IS_IN_WORK_LIST;
 135                         list_del(&cmdinfo->work);
 136                 } else {
 137                         schedule_work(&devinfo->work);
 138                 }
 139         }
 140         spin_unlock_irqrestore(&devinfo->lock, flags);
 141 }
 142
 143 static void uas_abort_work(struct uas_dev_info *devinfo)
 144 {
 145         struct uas_cmd_info *cmdinfo;
 146         struct uas_cmd_info *temp;
 147         unsigned long flags;
 148
 149         spin_lock_irqsave(&devinfo->lock, flags);
 150         list_for_each_entry_safe(cmdinfo, temp, &devinfo->work_list, work) {
 151                 struct scsi_pointer *scp = (void *)cmdinfo;
 152                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
 153                                                       SCp);
 154                 uas_log_cmd_state(cmnd, __func__);
 155                 WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
 156                 cmdinfo->state |= COMMAND_ABORTED;
 157                 cmdinfo->state &= ~IS_IN_WORK_LIST;
 158                 list_del(&cmdinfo->work);
 159                 list_add_tail(&cmdinfo->dead, &devinfo->dead_list);
 160         }
 161         spin_unlock_irqrestore(&devinfo->lock, flags);
 162 }
 163
 164 static void uas_add_work(struct uas_cmd_info *cmdinfo)
 165 {
 166         struct scsi_pointer *scp = (void *)cmdinfo;
 167         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
 168         struct uas_dev_info *devinfo = cmnd->device->hostdata;
 169
 170         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
 171         list_add_tail(&cmdinfo->work, &devinfo->work_list);
 172         cmdinfo->state |= IS_IN_WORK_LIST;
 173         schedule_work(&devinfo->work);
 174 }
 175
 176 static void uas_zap_dead(struct uas_dev_info *devinfo)
 177 {
 178         struct uas_cmd_info *cmdinfo;
 179         struct uas_cmd_info *temp;
 180         unsigned long flags;
 181
 182         spin_lock_irqsave(&devinfo->lock, flags);
 183         list_for_each_entry_safe(cmdinfo, temp, &devinfo->dead_list, dead) {
 184                 struct scsi_pointer *scp = (void *)cmdinfo;
 185                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
 186                                                       SCp);
 187                 uas_log_cmd_state(cmnd, __func__);
 188                 WARN_ON_ONCE(!(cmdinfo->state & COMMAND_ABORTED));
 189                 /* all urbs are killed, clear inflight bits */
 190                 cmdinfo->state &= ~(COMMAND_INFLIGHT |
 191                                     DATA_IN_URB_INFLIGHT |
 192                                     DATA_OUT_URB_INFLIGHT);
 193                 uas_try_complete(cmnd, __func__);
 194         }
 195         spin_unlock_irqrestore(&devinfo->lock, flags);
 196 }
 197
 198 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
 199 {
 200         struct sense_iu *sense_iu = urb->transfer_buffer;
 201         struct scsi_device *sdev = cmnd->device;
 202
 203         if (urb->actual_length > 16) {
 204                 unsigned len = be16_to_cpup(&sense_iu->len);
 205                 if (len + 16 != urb->actual_length) {
 206                         int newlen = min(len + 16, urb->actual_length) - 16;
 207                         if (newlen < 0)
 208                                 newlen = 0;
 209                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 210                                 "disagrees with IU sense data length %d, "
 211                                 "using %d bytes of sense data\n", __func__,
 212                                         urb->actual_length, len, newlen);
 213                         len = newlen;
 214                 }
 215                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 216         }
 217
 218         cmnd->result = sense_iu->status;
 219 }
 220
 221 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
 222 {
 223         struct sense_iu_old *sense_iu = urb->transfer_buffer;
 224         struct scsi_device *sdev = cmnd->device;
 225
 226         if (urb->actual_length > 8) {
 227                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
 228                 if (len + 8 != urb->actual_length) {
 229                         int newlen = min(len + 8, urb->actual_length) - 8;
 230                         if (newlen < 0)
 231                                 newlen = 0;
 232                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 233                                 "disagrees with IU sense data length %d, "
 234                                 "using %d bytes of sense data\n", __func__,
 235                                         urb->actual_length, len, newlen);
 236                         len = newlen;
 237                 }
 238                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 239         }
 240
 241         cmnd->result = sense_iu->status;
 242 }
 243
 244 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
 245 {
 246         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
 247
 248         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
 249                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
 250                     caller, cmnd, cmnd->request->tag,
 251                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
 252                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
 253                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
 254                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
 255                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
 256                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
 257                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
 258                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
 259                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
 260                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
 261                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
 262                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
 263                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
 264                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
 265 }
 266
 267 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
 268 {
 269         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 270         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 271
 272         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
 273         if (cmdinfo->state & (COMMAND_INFLIGHT |
 274                               DATA_IN_URB_INFLIGHT |
 275                               DATA_OUT_URB_INFLIGHT |
 276                               UNLINK_DATA_URBS))
 277                 return -EBUSY;
 278         WARN_ON_ONCE(cmdinfo->state & COMMAND_COMPLETED);
 279         cmdinfo->state |= COMMAND_COMPLETED;
 280         usb_free_urb(cmdinfo->data_in_urb);
 281         usb_free_urb(cmdinfo->data_out_urb);
 282         if (cmdinfo->state & COMMAND_ABORTED) {
 283                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
 284                 cmnd->result = DID_ABORT << 16;
 285                 list_del(&cmdinfo->dead);
 286         }
 287         cmnd->scsi_done(cmnd);
 288         return 0;
 289 }
 290
 291 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
 292                           unsigned direction)
 293 {
 294         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 295         int err;
 296
 297         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
 298         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 299         if (err) {
 300                 uas_add_work(cmdinfo);
 301         }
 302 }
 303
 304 static void uas_stat_cmplt(struct urb *urb)
 305 {
 306         struct iu *iu = urb->transfer_buffer;
 307         struct Scsi_Host *shost = urb->context;
 308         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 309         struct scsi_cmnd *cmnd;
 310         struct uas_cmd_info *cmdinfo;
 311         unsigned long flags;
 312         u16 tag;
 313
 314         if (urb->status) {
 315                 if (urb->status == -ENOENT) {
 316                         dev_err(&urb->dev->dev, "stat urb: killed, stream %d\n",
 317                                 urb->stream_id);
 318                 } else {
 319                         dev_err(&urb->dev->dev, "stat urb: status %d\n",
 320                                 urb->status);
 321                 }
 322                 usb_free_urb(urb);
 323                 return;
 324         }
 325
 326         if (devinfo->resetting) {
 327                 usb_free_urb(urb);
 328                 return;
 329         }
 330
 331         spin_lock_irqsave(&devinfo->lock, flags);
 332         tag = be16_to_cpup(&iu->tag) - 1;
 333         if (tag == 0)
 334                 cmnd = devinfo->cmnd;
 335         else
 336                 cmnd = scsi_host_find_tag(shost, tag - 1);
 337
 338         if (!cmnd) {
 339                 if (iu->iu_id == IU_ID_RESPONSE) {
 340                         /* store results for uas_eh_task_mgmt() */
 341                         memcpy(&devinfo->response, iu, sizeof(devinfo->response));
 342                 }
 343                 usb_free_urb(urb);
 344                 spin_unlock_irqrestore(&devinfo->lock, flags);
 345                 return;
 346         }
 347
 348         cmdinfo = (void *)&cmnd->SCp;
 349         switch (iu->iu_id) {
 350         case IU_ID_STATUS:
 351                 if (devinfo->cmnd == cmnd)
 352                         devinfo->cmnd = NULL;
 353
 354                 if (urb->actual_length < 16)
 355                         devinfo->uas_sense_old = 1;
 356                 if (devinfo->uas_sense_old)
 357                         uas_sense_old(urb, cmnd);
 358                 else
 359                         uas_sense(urb, cmnd);
 360                 if (cmnd->result != 0) {
 361                         /* cancel data transfers on error */
 362                         uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
 363                 }
 364                 cmdinfo->state &= ~COMMAND_INFLIGHT;
 365                 uas_try_complete(cmnd, __func__);
 366                 break;
 367         case IU_ID_READ_READY:
 368                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
 369                 break;
 370         case IU_ID_WRITE_READY:
 371                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
 372                 break;
 373         default:
 374                 scmd_printk(KERN_ERR, cmnd,
 375                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
 376         }
 377         usb_free_urb(urb);
 378         spin_unlock_irqrestore(&devinfo->lock, flags);
 379 }
 380
 381 static void uas_data_cmplt(struct urb *urb)
 382 {
 383         struct scsi_cmnd *cmnd = urb->context;
 384         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 385         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 386         struct scsi_data_buffer *sdb = NULL;
 387         unsigned long flags;
 388
 389         spin_lock_irqsave(&devinfo->lock, flags);
 390         if (cmdinfo->data_in_urb == urb) {
 391                 sdb = scsi_in(cmnd);
 392                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
 393         } else if (cmdinfo->data_out_urb == urb) {
 394                 sdb = scsi_out(cmnd);
 395                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
 396         }
 397         if (sdb == NULL) {
 398                 WARN_ON_ONCE(1);
 399         } else if (urb->status) {
 400                 /* error: no data transfered */
 401                 sdb->resid = sdb->length;
 402         } else {
 403                 sdb->resid = sdb->length - urb->actual_length;
 404         }
 405         uas_try_complete(cmnd, __func__);
 406         spin_unlock_irqrestore(&devinfo->lock, flags);
 407 }
 408
 409 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 410                                       unsigned int pipe, u16 stream_id,
 411                                       struct scsi_cmnd *cmnd,
 412                                       enum dma_data_direction dir)
 413 {
 414         struct usb_device *udev = devinfo->udev;
 415         struct urb *urb = usb_alloc_urb(0, gfp);
 416         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
 417                 ? scsi_in(cmnd) : scsi_out(cmnd);
 418
 419         if (!urb)
 420                 goto out;
 421         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
 422                           uas_data_cmplt, cmnd);
 423         if (devinfo->use_streams)
 424                 urb->stream_id = stream_id;
 425         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
 426         urb->sg = sdb->table.sgl;
 427  out:
 428         return urb;
 429 }
 430
 431 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 432                                        struct Scsi_Host *shost, u16 stream_id)
 433 {
 434         struct usb_device *udev = devinfo->udev;
 435         struct urb *urb = usb_alloc_urb(0, gfp);
 436         struct sense_iu *iu;
 437
 438         if (!urb)
 439                 goto out;
 440
 441         iu = kzalloc(sizeof(*iu), gfp);
 442         if (!iu)
 443                 goto free;
 444
 445         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
 446                                                 uas_stat_cmplt, shost);
 447         urb->stream_id = stream_id;
 448         urb->transfer_flags |= URB_FREE_BUFFER;
 449  out:
 450         return urb;
 451  free:
 452         usb_free_urb(urb);
 453         return NULL;
 454 }
 455
 456 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 457                                         struct scsi_cmnd *cmnd)
 458 {
 459         struct usb_device *udev = devinfo->udev;
 460         struct scsi_device *sdev = cmnd->device;
 461         struct urb *urb = usb_alloc_urb(0, gfp);
 462         struct command_iu *iu;
 463         int len;
 464
 465         if (!urb)
 466                 goto out;
 467
 468         len = cmnd->cmd_len - 16;
 469         if (len < 0)
 470                 len = 0;
 471         len = ALIGN(len, 4);
 472         iu = kzalloc(sizeof(*iu) + len, gfp);
 473         if (!iu)
 474                 goto free;
 475
 476         iu->iu_id = IU_ID_COMMAND;
 477         if (blk_rq_tagged(cmnd->request))
 478                 iu->tag = cpu_to_be16(cmnd->request->tag + 2);
 479         else
 480                 iu->tag = cpu_to_be16(1);
 481         iu->prio_attr = UAS_SIMPLE_TAG;
 482         iu->len = len;
 483         int_to_scsilun(sdev->lun, &iu->lun);
 484         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
 485
 486         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
 487                                                         usb_free_urb, NULL);
 488         urb->transfer_flags |= URB_FREE_BUFFER;
 489  out:
 490         return urb;
 491  free:
 492         usb_free_urb(urb);
 493         return NULL;
 494 }
 495
 496 static int uas_submit_task_urb(struct scsi_cmnd *cmnd, gfp_t gfp,
 497                                u8 function, u16 stream_id)
 498 {
 499         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 500         struct usb_device *udev = devinfo->udev;
 501         struct urb *urb = usb_alloc_urb(0, gfp);
 502         struct task_mgmt_iu *iu;
 503         int err = -ENOMEM;
 504
 505         if (!urb)
 506                 goto err;
 507
 508         iu = kzalloc(sizeof(*iu), gfp);
 509         if (!iu)
 510                 goto err;
 511
 512         iu->iu_id = IU_ID_TASK_MGMT;
 513         iu->tag = cpu_to_be16(stream_id);
 514         int_to_scsilun(cmnd->device->lun, &iu->lun);
 515
 516         iu->function = function;
 517         switch (function) {
 518         case TMF_ABORT_TASK:
 519                 if (blk_rq_tagged(cmnd->request))
 520                         iu->task_tag = cpu_to_be16(cmnd->request->tag + 2);
 521                 else
 522                         iu->task_tag = cpu_to_be16(1);
 523                 break;
 524         }
 525
 526         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu),
 527                           usb_free_urb, NULL);
 528         urb->transfer_flags |= URB_FREE_BUFFER;
 529
 530         usb_anchor_urb(urb, &devinfo->cmd_urbs);
 531         err = usb_submit_urb(urb, gfp);
 532         if (err) {
 533                 usb_unanchor_urb(urb);
 534                 goto err;
 535         }
 536
 537         return 0;
 538
 539 err:
 540         usb_free_urb(urb);
 541         return err;
 542 }
 543
 544 /*
 545  * Why should I request the Status IU before sending the Command IU?  Spec
 546  * says to, but also says the device may receive them in any order.  Seems
 547  * daft to me.
 548  */
 549
 550 static int uas_submit_sense_urb(struct Scsi_Host *shost,
 551                                 gfp_t gfp, unsigned int stream)
 552 {
 553         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 554         struct urb *urb;
 555
 556         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
 557         if (!urb)
 558                 return SCSI_MLQUEUE_DEVICE_BUSY;
 559         usb_anchor_urb(urb, &devinfo->sense_urbs);
 560         if (usb_submit_urb(urb, gfp)) {
 561                 usb_unanchor_urb(urb);
 562                 shost_printk(KERN_INFO, shost,
 563                              "sense urb submission failure\n");
 564                 usb_free_urb(urb);
 565                 return SCSI_MLQUEUE_DEVICE_BUSY;
 566         }
 567         return 0;
 568 }
 569
 570 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
 571                            struct uas_dev_info *devinfo, gfp_t gfp)
 572 {
 573         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 574         int err;
 575
 576         WARN_ON_ONCE(!spin_is_locked(&devinfo->lock));
 577         if (cmdinfo->state & SUBMIT_STATUS_URB) {
 578                 err = uas_submit_sense_urb(cmnd->device->host, gfp,
 579                                            cmdinfo->stream);
 580                 if (err) {
 581                         return err;
 582                 }
 583                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
 584         }
 585
 586         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
 587                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
 588                                         devinfo->data_in_pipe, cmdinfo->stream,
 589                                         cmnd, DMA_FROM_DEVICE);
 590                 if (!cmdinfo->data_in_urb)
 591                         return SCSI_MLQUEUE_DEVICE_BUSY;
 592                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
 593         }
 594
 595         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
 596                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
 597                 if (usb_submit_urb(cmdinfo->data_in_urb, gfp)) {
 598                         usb_unanchor_urb(cmdinfo->data_in_urb);
 599                         scmd_printk(KERN_INFO, cmnd,
 600                                         "data in urb submission failure\n");
 601                         return SCSI_MLQUEUE_DEVICE_BUSY;
 602                 }
 603                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
 604                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
 605         }
 606
 607         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
 608                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
 609                                         devinfo->data_out_pipe, cmdinfo->stream,
 610                                         cmnd, DMA_TO_DEVICE);
 611                 if (!cmdinfo->data_out_urb)
 612                         return SCSI_MLQUEUE_DEVICE_BUSY;
 613                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
 614         }
 615
 616         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
 617                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
 618                 if (usb_submit_urb(cmdinfo->data_out_urb, gfp)) {
 619                         usb_unanchor_urb(cmdinfo->data_out_urb);
 620                         scmd_printk(KERN_INFO, cmnd,
 621                                         "data out urb submission failure\n");
 622                         return SCSI_MLQUEUE_DEVICE_BUSY;
 623                 }
 624                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
 625                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
 626         }
 627
 628         if (cmdinfo->state & ALLOC_CMD_URB) {
 629                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd);
 630                 if (!cmdinfo->cmd_urb)
 631                         return SCSI_MLQUEUE_DEVICE_BUSY;
 632                 cmdinfo->state &= ~ALLOC_CMD_URB;
 633         }
 634
 635         if (cmdinfo->state & SUBMIT_CMD_URB) {
 636                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
 637                 if (usb_submit_urb(cmdinfo->cmd_urb, gfp)) {
 638                         usb_unanchor_urb(cmdinfo->cmd_urb);
 639                         scmd_printk(KERN_INFO, cmnd,
 640                                         "cmd urb submission failure\n");
 641                         return SCSI_MLQUEUE_DEVICE_BUSY;
 642                 }
 643                 cmdinfo->cmd_urb = NULL;
 644                 cmdinfo->state &= ~SUBMIT_CMD_URB;
 645                 cmdinfo->state |= COMMAND_INFLIGHT;
 646         }
 647
 648         return 0;
 649 }
 650
 651 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 652                                         void (*done)(struct scsi_cmnd *))
 653 {
 654         struct scsi_device *sdev = cmnd->device;
 655         struct uas_dev_info *devinfo = sdev->hostdata;
 656         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 657         unsigned long flags;
 658         int err;
 659
 660         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
 661
 662         if (devinfo->resetting) {
 663                 cmnd->result = DID_ERROR << 16;
 664                 cmnd->scsi_done(cmnd);
 665                 return 0;
 666         }
 667
 668         spin_lock_irqsave(&devinfo->lock, flags);
 669         if (devinfo->cmnd) {
 670                 spin_unlock_irqrestore(&devinfo->lock, flags);
 671                 return SCSI_MLQUEUE_DEVICE_BUSY;
 672         }
 673
 674         if (blk_rq_tagged(cmnd->request)) {
 675                 cmdinfo->stream = cmnd->request->tag + 2;
 676         } else {
 677                 devinfo->cmnd = cmnd;
 678                 cmdinfo->stream = 1;
 679         }
 680
 681         cmnd->scsi_done = done;
 682
 683         cmdinfo->state = SUBMIT_STATUS_URB |
 684                         ALLOC_CMD_URB | SUBMIT_CMD_URB;
 685
 686         switch (cmnd->sc_data_direction) {
 687         case DMA_FROM_DEVICE:
 688                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 689                 break;
 690         case DMA_BIDIRECTIONAL:
 691                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 692         case DMA_TO_DEVICE:
 693                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
 694         case DMA_NONE:
 695                 break;
 696         }
 697
 698         if (!devinfo->use_streams) {
 699                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
 700                 cmdinfo->stream = 0;
 701         }
 702
 703         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
 704         if (err) {
 705                 /* If we did nothing, give up now */
 706                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
 707                         spin_unlock_irqrestore(&devinfo->lock, flags);
 708                         return SCSI_MLQUEUE_DEVICE_BUSY;
 709                 }
 710                 uas_add_work(cmdinfo);
 711         }
 712
 713         spin_unlock_irqrestore(&devinfo->lock, flags);
 714         return 0;
 715 }
 716
 717 static DEF_SCSI_QCMD(uas_queuecommand)
 718
 719 static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
 720                             const char *fname, u8 function)
 721 {
 722         struct Scsi_Host *shost = cmnd->device->host;
 723         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 724         u16 tag = devinfo->qdepth - 1;
 725         unsigned long flags;
 726
 727         spin_lock_irqsave(&devinfo->lock, flags);
 728         memset(&devinfo->response, 0, sizeof(devinfo->response));
 729         if (uas_submit_sense_urb(shost, GFP_ATOMIC, tag)) {
 730                 shost_printk(KERN_INFO, shost,
 731                              "%s: %s: submit sense urb failed\n",
 732                              __func__, fname);
 733                 spin_unlock_irqrestore(&devinfo->lock, flags);
 734                 return FAILED;
 735         }
 736         if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
 737                 shost_printk(KERN_INFO, shost,
 738                              "%s: %s: submit task mgmt urb failed\n",
 739                              __func__, fname);
 740                 spin_unlock_irqrestore(&devinfo->lock, flags);
 741                 return FAILED;
 742         }
 743         spin_unlock_irqrestore(&devinfo->lock, flags);
 744
 745         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 3000) == 0) {
 746                 shost_printk(KERN_INFO, shost,
 747                              "%s: %s timed out\n", __func__, fname);
 748                 return FAILED;
 749         }
 750         if (be16_to_cpu(devinfo->response.tag) != tag) {
 751                 shost_printk(KERN_INFO, shost,
 752                              "%s: %s failed (wrong tag %d/%d)\n", __func__,
 753                              fname, be16_to_cpu(devinfo->response.tag), tag);
 754                 return FAILED;
 755         }
 756         if (devinfo->response.response_code != RC_TMF_COMPLETE) {
 757                 shost_printk(KERN_INFO, shost,
 758                              "%s: %s failed (rc 0x%x)\n", __func__,
 759                              fname, devinfo->response.response_code);
 760                 return FAILED;
 761         }
 762         return SUCCESS;
 763 }
 764
 765 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
 766 {
 767         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 768         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 769         unsigned long flags;
 770         int ret;
 771
 772         uas_log_cmd_state(cmnd, __func__);
 773         spin_lock_irqsave(&devinfo->lock, flags);
 774         WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
 775         cmdinfo->state |= COMMAND_ABORTED;
 776         list_add_tail(&cmdinfo->dead, &devinfo->dead_list);
 777         if (cmdinfo->state & IS_IN_WORK_LIST) {
 778                 list_del(&cmdinfo->work);
 779                 cmdinfo->state &= ~IS_IN_WORK_LIST;
 780         }
 781         if (cmdinfo->state & COMMAND_INFLIGHT) {
 782                 spin_unlock_irqrestore(&devinfo->lock, flags);
 783                 ret = uas_eh_task_mgmt(cmnd, "ABORT TASK", TMF_ABORT_TASK);
 784         } else {
 785                 uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
 786                 uas_try_complete(cmnd, __func__);
 787                 spin_unlock_irqrestore(&devinfo->lock, flags);
 788                 ret = SUCCESS;
 789         }
 790         return ret;
 791 }
 792
 793 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
 794 {
 795         sdev_printk(KERN_INFO, cmnd->device, "%s\n", __func__);
 796         return uas_eh_task_mgmt(cmnd, "LOGICAL UNIT RESET",
 797                                 TMF_LOGICAL_UNIT_RESET);
 798 }
 799
 800 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
 801 {
 802         struct scsi_device *sdev = cmnd->device;
 803         struct uas_dev_info *devinfo = sdev->hostdata;
 804         struct usb_device *udev = devinfo->udev;
 805         int err;
 806
 807         err = usb_lock_device_for_reset(udev, devinfo->intf);
 808         if (err) {
 809                 shost_printk(KERN_ERR, sdev->host,
 810                              "%s FAILED to get lock err %d\n", __func__, err);
 811                 return FAILED;
 812         }
 813
 814         shost_printk(KERN_INFO, sdev->host, "%s start\n", __func__);
 815         devinfo->resetting = 1;
 816         uas_abort_work(devinfo);
 817         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
 818         usb_kill_anchored_urbs(&devinfo->sense_urbs);
 819         usb_kill_anchored_urbs(&devinfo->data_urbs);
 820         uas_zap_dead(devinfo);
 821         uas_free_streams(devinfo);
 822         err = usb_reset_device(udev);
 823         if (!err)
 824                 uas_configure_endpoints(devinfo);
 825         devinfo->resetting = 0;
 826
 827         usb_unlock_device(udev);
 828
 829         if (err) {
 830                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
 831                 return FAILED;
 832         }
 833
 834         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
 835         return SUCCESS;
 836 }
 837
 838 static int uas_slave_alloc(struct scsi_device *sdev)
 839 {
 840         sdev->hostdata = (void *)sdev->host->hostdata[0];
 841         return 0;
 842 }
 843
 844 static int uas_slave_configure(struct scsi_device *sdev)
 845 {
 846         struct uas_dev_info *devinfo = sdev->hostdata;
 847         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
 848         scsi_activate_tcq(sdev, devinfo->qdepth - 3);
 849         return 0;
 850 }
 851
 852 static struct scsi_host_template uas_host_template = {
 853         .module = THIS_MODULE,
 854         .name = "uas",
 855         .queuecommand = uas_queuecommand,
 856         .slave_alloc = uas_slave_alloc,
 857         .slave_configure = uas_slave_configure,
 858         .eh_abort_handler = uas_eh_abort_handler,
 859         .eh_device_reset_handler = uas_eh_device_reset_handler,
 860         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
 861         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
 862         .this_id = -1,
 863         .sg_tablesize = SG_NONE,
 864         .cmd_per_lun = 1,       /* until we override it */
 865         .skip_settle_delay = 1,
 866         .ordered_tag = 1,
 867 };
 868
 869 static struct usb_device_id uas_usb_ids[] = {
 870         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
 871         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
 872         /* 0xaa is a prototype device I happen to have access to */
 873         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
 874         { }
 875 };
 876 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 877
 878 static int uas_is_interface(struct usb_host_interface *intf)
 879 {
 880         return (intf->desc.bInterfaceClass == USB_CLASS_MASS_STORAGE &&
 881                 intf->desc.bInterfaceSubClass == USB_SC_SCSI &&
 882                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 883 }
 884
 885 static int uas_isnt_supported(struct usb_device *udev)
 886 {
 887         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
 888
 889         dev_warn(&udev->dev, "The driver for the USB controller %s does not "
 890                         "support scatter-gather which is\n",
 891                         hcd->driver->description);
 892         dev_warn(&udev->dev, "required by the UAS driver. Please try an"
 893                         "alternative USB controller if you wish to use UAS.\n");
 894         return -ENODEV;
 895 }
 896
 897 static int uas_switch_interface(struct usb_device *udev,
 898                                                 struct usb_interface *intf)
 899 {
 900         int i;
 901         int sg_supported = udev->bus->sg_tablesize != 0;
 902
 903         for (i = 0; i < intf->num_altsetting; i++) {
 904                 struct usb_host_interface *alt = &intf->altsetting[i];
 905
 906                 if (uas_is_interface(alt)) {
 907                         if (!sg_supported)
 908                                 return uas_isnt_supported(udev);
 909                         return usb_set_interface(udev,
 910                                                 alt->desc.bInterfaceNumber,
 911                                                 alt->desc.bAlternateSetting);
 912                 }
 913         }
 914
 915         return -ENODEV;
 916 }
 917
 918 static void uas_configure_endpoints(struct uas_dev_info *devinfo)
 919 {
 920         struct usb_host_endpoint *eps[4] = { };
 921         struct usb_interface *intf = devinfo->intf;
 922         struct usb_device *udev = devinfo->udev;
 923         struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
 924         unsigned i, n_endpoints = intf->cur_altsetting->desc.bNumEndpoints;
 925
 926         devinfo->uas_sense_old = 0;
 927         devinfo->cmnd = NULL;
 928
 929         for (i = 0; i < n_endpoints; i++) {
 930                 unsigned char *extra = endpoint[i].extra;
 931                 int len = endpoint[i].extralen;
 932                 while (len > 1) {
 933                         if (extra[1] == USB_DT_PIPE_USAGE) {
 934                                 unsigned pipe_id = extra[2];
 935                                 if (pipe_id > 0 && pipe_id < 5)
 936                                         eps[pipe_id - 1] = &endpoint[i];
 937                                 break;
 938                         }
 939                         len -= extra[0];
 940                         extra += extra[0];
 941                 }
 942         }
 943
 944         /*
 945          * Assume that if we didn't find a control pipe descriptor, we're
 946          * using a device with old firmware that happens to be set up like
 947          * this.
 948          */
 949         if (!eps[0]) {
 950                 devinfo->cmd_pipe = usb_sndbulkpipe(udev, 1);
 951                 devinfo->status_pipe = usb_rcvbulkpipe(udev, 1);
 952                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev, 2);
 953                 devinfo->data_out_pipe = usb_sndbulkpipe(udev, 2);
 954
 955                 eps[1] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 956                 eps[2] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 957                 eps[3] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 958         } else {
 959                 devinfo->cmd_pipe = usb_sndbulkpipe(udev,
 960                                              usb_endpoint_num(&eps[0]->desc));
 961                 devinfo->status_pipe = usb_rcvbulkpipe(udev,
 962                                              usb_endpoint_num(&eps[1]->desc));
 963                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
 964                                              usb_endpoint_num(&eps[2]->desc));
 965                 devinfo->data_out_pipe = usb_sndbulkpipe(udev,
 966                                              usb_endpoint_num(&eps[3]->desc));
 967         }
 968
 969         devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1, 3, 256,
 970                                                                 GFP_KERNEL);
 971         if (devinfo->qdepth < 0) {
 972                 devinfo->qdepth = 256;
 973                 devinfo->use_streams = 0;
 974         } else {
 975                 devinfo->use_streams = 1;
 976         }
 977 }
 978
 979 static void uas_free_streams(struct uas_dev_info *devinfo)
 980 {
 981         struct usb_device *udev = devinfo->udev;
 982         struct usb_host_endpoint *eps[3];
 983
 984         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 985         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 986         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 987         usb_free_streams(devinfo->intf, eps, 3, GFP_KERNEL);
 988 }
 989
 990 /*
 991  * XXX: What I'd like to do here is register a SCSI host for each USB host in
 992  * the system.  Follow usb-storage's design of registering a SCSI host for
 993  * each USB device for the moment.  Can implement this by walking up the
 994  * USB hierarchy until we find a USB host.
 995  */
 996 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
 997 {
 998         int result = -ENOMEM;
 999         struct Scsi_Host *shost = NULL;
1000         struct uas_dev_info *devinfo;
1001         struct usb_device *udev = interface_to_usbdev(intf);
1002
1003         if (uas_switch_interface(udev, intf))
1004                 return -ENODEV;
1005
1006         devinfo = kmalloc(sizeof(struct uas_dev_info), GFP_KERNEL);
1007         if (!devinfo)
1008                 goto set_alt0;
1009
1010         shost = scsi_host_alloc(&uas_host_template, sizeof(void *));
1011         if (!shost)
1012                 goto set_alt0;
1013
1014         shost->max_cmd_len = 16 + 252;
1015         shost->max_id = 1;
1016         shost->max_lun = 256;
1017         shost->max_channel = 0;
1018         shost->sg_tablesize = udev->bus->sg_tablesize;
1019
1020         devinfo->intf = intf;
1021         devinfo->udev = udev;
1022         devinfo->resetting = 0;
1023         init_usb_anchor(&devinfo->cmd_urbs);
1024         init_usb_anchor(&devinfo->sense_urbs);
1025         init_usb_anchor(&devinfo->data_urbs);
1026         spin_lock_init(&devinfo->lock);
1027         INIT_WORK(&devinfo->work, uas_do_work);
1028         INIT_LIST_HEAD(&devinfo->work_list);
1029         INIT_LIST_HEAD(&devinfo->dead_list);
1030         uas_configure_endpoints(devinfo);
1031
1032         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 3);
1033         if (result)
1034                 goto free_streams;
1035
1036         result = scsi_add_host(shost, &intf->dev);
1037         if (result)
1038                 goto free_streams;
1039
1040         shost->hostdata[0] = (unsigned long)devinfo;
1041
1042         scsi_scan_host(shost);
1043         usb_set_intfdata(intf, shost);
1044         return result;
1045
1046 free_streams:
1047         uas_free_streams(devinfo);
1048 set_alt0:
1049         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1050         kfree(devinfo);
1051         if (shost)
1052                 scsi_host_put(shost);
1053         return result;
1054 }
1055
1056 static int uas_pre_reset(struct usb_interface *intf)
1057 {
1058 /* XXX: Need to return 1 if it's not our device in error handling */
1059         return 0;
1060 }
1061
1062 static int uas_post_reset(struct usb_interface *intf)
1063 {
1064 /* XXX: Need to return 1 if it's not our device in error handling */
1065         return 0;
1066 }
1067
1068 static void uas_disconnect(struct usb_interface *intf)
1069 {
1070         struct Scsi_Host *shost = usb_get_intfdata(intf);
1071         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
1072
1073         devinfo->resetting = 1;
1074         cancel_work_sync(&devinfo->work);
1075         uas_abort_work(devinfo);
1076         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1077         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1078         usb_kill_anchored_urbs(&devinfo->data_urbs);
1079         uas_zap_dead(devinfo);
1080         scsi_remove_host(shost);
1081         uas_free_streams(devinfo);
1082         kfree(devinfo);
1083 }
1084
1085 /*
1086  * XXX: Should this plug into libusual so we can auto-upgrade devices from
1087  * Bulk-Only to UAS?
1088  */
1089 static struct usb_driver uas_driver = {
1090         .name = "uas",
1091         .probe = uas_probe,
1092         .disconnect = uas_disconnect,
1093         .pre_reset = uas_pre_reset,
1094         .post_reset = uas_post_reset,
1095         .id_table = uas_usb_ids,
1096 };
1097
1098 module_usb_driver(uas_driver);
1099
1100 MODULE_LICENSE("GPL");
1101 MODULE_AUTHOR("Matthew Wilcox and Sarah Sharp");