drivers/usb/storage/uas.c

   1 /*
   2  * USB Attached SCSI
   3  * Note that this is not the same as the USB Mass Storage driver
   4  *
   5  * Copyright Matthew Wilcox for Intel Corp, 2010
   6  * Copyright Sarah Sharp for Intel Corp, 2010
   7  *
   8  * Distributed under the terms of the GNU GPL, version two.
   9  */
  10
  11 #include <linux/blkdev.h>
  12 #include <linux/slab.h>
  13 #include <linux/types.h>
  14 #include <linux/module.h>
  15 #include <linux/usb.h>
  16 #include <linux/usb/hcd.h>
  17 #include <linux/usb/storage.h>
  18 #include <linux/usb/uas.h>
  19
  20 #include <scsi/scsi.h>
  21 #include <scsi/scsi_dbg.h>
  22 #include <scsi/scsi_cmnd.h>
  23 #include <scsi/scsi_device.h>
  24 #include <scsi/scsi_host.h>
  25 #include <scsi/scsi_tcq.h>
  26
  27 /*
  28  * The r00-r01c specs define this version of the SENSE IU data structure.
  29  * It's still in use by several different firmware releases.
  30  */
  31 struct sense_iu_old {
  32         __u8 iu_id;
  33         __u8 rsvd1;
  34         __be16 tag;
  35         __be16 len;
  36         __u8 status;
  37         __u8 service_response;
  38         __u8 sense[SCSI_SENSE_BUFFERSIZE];
  39 };
  40
  41 struct uas_dev_info {
  42         struct usb_interface *intf;
  43         struct usb_device *udev;
  44         struct usb_anchor cmd_urbs;
  45         struct usb_anchor sense_urbs;
  46         struct usb_anchor data_urbs;
  47         int qdepth, resetting;
  48         struct response_ui response;
  49         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
  50         unsigned use_streams:1;
  51         unsigned uas_sense_old:1;
  52         struct scsi_cmnd *cmnd;
  53         spinlock_t lock;
  54 };
  55
  56 enum {
  57         SUBMIT_STATUS_URB       = (1 << 1),
  58         ALLOC_DATA_IN_URB       = (1 << 2),
  59         SUBMIT_DATA_IN_URB      = (1 << 3),
  60         ALLOC_DATA_OUT_URB      = (1 << 4),
  61         SUBMIT_DATA_OUT_URB     = (1 << 5),
  62         ALLOC_CMD_URB           = (1 << 6),
  63         SUBMIT_CMD_URB          = (1 << 7),
  64         COMMAND_INFLIGHT        = (1 << 8),
  65         DATA_IN_URB_INFLIGHT    = (1 << 9),
  66         DATA_OUT_URB_INFLIGHT   = (1 << 10),
  67         COMMAND_COMPLETED       = (1 << 11),
  68         COMMAND_ABORTED         = (1 << 12),
  69         UNLINK_DATA_URBS        = (1 << 13),
  70         IS_IN_WORK_LIST         = (1 << 14),
  71 };
  72
  73 /* Overrides scsi_pointer */
  74 struct uas_cmd_info {
  75         unsigned int state;
  76         unsigned int stream;
  77         struct urb *cmd_urb;
  78         struct urb *data_in_urb;
  79         struct urb *data_out_urb;
  80         struct list_head list;
  81 };
  82
  83 /* I hate forward declarations, but I actually have a loop */
  84 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
  85                                 struct uas_dev_info *devinfo, gfp_t gfp);
  86 static void uas_do_work(struct work_struct *work);
  87
  88 static DECLARE_WORK(uas_work, uas_do_work);
  89 static DEFINE_SPINLOCK(uas_work_lock);
  90 static LIST_HEAD(uas_work_list);
  91
  92 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
  93                                  struct uas_cmd_info *cmdinfo)
  94 {
  95         unsigned long flags;
  96
  97         /*
  98          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
  99          * (called by urb completion) doesn't release cmdinfo
 100          * underneath us.
 101          */
 102         spin_lock_irqsave(&devinfo->lock, flags);
 103         cmdinfo->state |= UNLINK_DATA_URBS;
 104         spin_unlock_irqrestore(&devinfo->lock, flags);
 105
 106         if (cmdinfo->data_in_urb)
 107                 usb_unlink_urb(cmdinfo->data_in_urb);
 108         if (cmdinfo->data_out_urb)
 109                 usb_unlink_urb(cmdinfo->data_out_urb);
 110
 111         spin_lock_irqsave(&devinfo->lock, flags);
 112         cmdinfo->state &= ~UNLINK_DATA_URBS;
 113         spin_unlock_irqrestore(&devinfo->lock, flags);
 114 }
 115
 116 static void uas_do_work(struct work_struct *work)
 117 {
 118         struct uas_cmd_info *cmdinfo;
 119         struct uas_cmd_info *temp;
 120         struct list_head list;
 121         unsigned long flags;
 122         int err;
 123
 124         spin_lock_irq(&uas_work_lock);
 125         list_replace_init(&uas_work_list, &list);
 126         spin_unlock_irq(&uas_work_lock);
 127
 128         list_for_each_entry_safe(cmdinfo, temp, &list, list) {
 129                 struct scsi_pointer *scp = (void *)cmdinfo;
 130                 struct scsi_cmnd *cmnd = container_of(scp,
 131                                                         struct scsi_cmnd, SCp);
 132                 struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 133                 spin_lock_irqsave(&devinfo->lock, flags);
 134                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 135                 if (!err)
 136                         cmdinfo->state &= ~IS_IN_WORK_LIST;
 137                 spin_unlock_irqrestore(&devinfo->lock, flags);
 138                 if (err) {
 139                         list_del(&cmdinfo->list);
 140                         spin_lock_irq(&uas_work_lock);
 141                         list_add_tail(&cmdinfo->list, &uas_work_list);
 142                         spin_unlock_irq(&uas_work_lock);
 143                         schedule_work(&uas_work);
 144                 }
 145         }
 146 }
 147
 148 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
 149 {
 150         struct sense_iu *sense_iu = urb->transfer_buffer;
 151         struct scsi_device *sdev = cmnd->device;
 152
 153         if (urb->actual_length > 16) {
 154                 unsigned len = be16_to_cpup(&sense_iu->len);
 155                 if (len + 16 != urb->actual_length) {
 156                         int newlen = min(len + 16, urb->actual_length) - 16;
 157                         if (newlen < 0)
 158                                 newlen = 0;
 159                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 160                                 "disagrees with IU sense data length %d, "
 161                                 "using %d bytes of sense data\n", __func__,
 162                                         urb->actual_length, len, newlen);
 163                         len = newlen;
 164                 }
 165                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 166         }
 167
 168         cmnd->result = sense_iu->status;
 169 }
 170
 171 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
 172 {
 173         struct sense_iu_old *sense_iu = urb->transfer_buffer;
 174         struct scsi_device *sdev = cmnd->device;
 175
 176         if (urb->actual_length > 8) {
 177                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
 178                 if (len + 8 != urb->actual_length) {
 179                         int newlen = min(len + 8, urb->actual_length) - 8;
 180                         if (newlen < 0)
 181                                 newlen = 0;
 182                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
 183                                 "disagrees with IU sense data length %d, "
 184                                 "using %d bytes of sense data\n", __func__,
 185                                         urb->actual_length, len, newlen);
 186                         len = newlen;
 187                 }
 188                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
 189         }
 190
 191         cmnd->result = sense_iu->status;
 192 }
 193
 194 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
 195 {
 196         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
 197
 198         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
 199                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
 200                     caller, cmnd, cmnd->request->tag,
 201                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
 202                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
 203                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
 204                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
 205                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
 206                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
 207                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
 208                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
 209                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
 210                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
 211                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
 212                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
 213                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
 214                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
 215 }
 216
 217 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
 218 {
 219         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 220         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 221
 222         WARN_ON(!spin_is_locked(&devinfo->lock));
 223         if (cmdinfo->state & (COMMAND_INFLIGHT |
 224                               DATA_IN_URB_INFLIGHT |
 225                               DATA_OUT_URB_INFLIGHT |
 226                               UNLINK_DATA_URBS))
 227                 return -EBUSY;
 228         BUG_ON(cmdinfo->state & COMMAND_COMPLETED);
 229         cmdinfo->state |= COMMAND_COMPLETED;
 230         usb_free_urb(cmdinfo->data_in_urb);
 231         usb_free_urb(cmdinfo->data_out_urb);
 232         if (cmdinfo->state & COMMAND_ABORTED) {
 233                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
 234                 cmnd->result = DID_ABORT << 16;
 235         }
 236         cmnd->scsi_done(cmnd);
 237         return 0;
 238 }
 239
 240 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
 241                           unsigned direction)
 242 {
 243         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 244         int err;
 245
 246         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
 247         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
 248         if (err) {
 249                 spin_lock(&uas_work_lock);
 250                 list_add_tail(&cmdinfo->list, &uas_work_list);
 251                 cmdinfo->state |= IS_IN_WORK_LIST;
 252                 spin_unlock(&uas_work_lock);
 253                 schedule_work(&uas_work);
 254         }
 255 }
 256
 257 static void uas_stat_cmplt(struct urb *urb)
 258 {
 259         struct iu *iu = urb->transfer_buffer;
 260         struct Scsi_Host *shost = urb->context;
 261         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 262         struct scsi_cmnd *cmnd;
 263         struct uas_cmd_info *cmdinfo;
 264         unsigned long flags;
 265         u16 tag;
 266
 267         if (urb->status) {
 268                 dev_err(&urb->dev->dev, "URB BAD STATUS %d\n", urb->status);
 269                 usb_free_urb(urb);
 270                 return;
 271         }
 272
 273         if (devinfo->resetting) {
 274                 usb_free_urb(urb);
 275                 return;
 276         }
 277
 278         spin_lock_irqsave(&devinfo->lock, flags);
 279         tag = be16_to_cpup(&iu->tag) - 1;
 280         if (tag == 0)
 281                 cmnd = devinfo->cmnd;
 282         else
 283                 cmnd = scsi_host_find_tag(shost, tag - 1);
 284
 285         if (!cmnd) {
 286                 if (iu->iu_id == IU_ID_RESPONSE) {
 287                         /* store results for uas_eh_task_mgmt() */
 288                         memcpy(&devinfo->response, iu, sizeof(devinfo->response));
 289                 }
 290                 usb_free_urb(urb);
 291                 spin_unlock_irqrestore(&devinfo->lock, flags);
 292                 return;
 293         }
 294
 295         cmdinfo = (void *)&cmnd->SCp;
 296         switch (iu->iu_id) {
 297         case IU_ID_STATUS:
 298                 if (devinfo->cmnd == cmnd)
 299                         devinfo->cmnd = NULL;
 300
 301                 if (urb->actual_length < 16)
 302                         devinfo->uas_sense_old = 1;
 303                 if (devinfo->uas_sense_old)
 304                         uas_sense_old(urb, cmnd);
 305                 else
 306                         uas_sense(urb, cmnd);
 307                 if (cmnd->result != 0) {
 308                         /* cancel data transfers on error */
 309                         spin_unlock_irqrestore(&devinfo->lock, flags);
 310                         uas_unlink_data_urbs(devinfo, cmdinfo);
 311                         spin_lock_irqsave(&devinfo->lock, flags);
 312                 }
 313                 cmdinfo->state &= ~COMMAND_INFLIGHT;
 314                 uas_try_complete(cmnd, __func__);
 315                 break;
 316         case IU_ID_READ_READY:
 317                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
 318                 break;
 319         case IU_ID_WRITE_READY:
 320                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
 321                 break;
 322         default:
 323                 scmd_printk(KERN_ERR, cmnd,
 324                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
 325         }
 326         usb_free_urb(urb);
 327         spin_unlock_irqrestore(&devinfo->lock, flags);
 328 }
 329
 330 static void uas_data_cmplt(struct urb *urb)
 331 {
 332         struct scsi_cmnd *cmnd = urb->context;
 333         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 334         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 335         struct scsi_data_buffer *sdb = NULL;
 336         unsigned long flags;
 337
 338         spin_lock_irqsave(&devinfo->lock, flags);
 339         if (cmdinfo->data_in_urb == urb) {
 340                 sdb = scsi_in(cmnd);
 341                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
 342         } else if (cmdinfo->data_out_urb == urb) {
 343                 sdb = scsi_out(cmnd);
 344                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
 345         }
 346         BUG_ON(sdb == NULL);
 347         if (urb->status) {
 348                 /* error: no data transfered */
 349                 sdb->resid = sdb->length;
 350         } else {
 351                 sdb->resid = sdb->length - urb->actual_length;
 352         }
 353         uas_try_complete(cmnd, __func__);
 354         spin_unlock_irqrestore(&devinfo->lock, flags);
 355 }
 356
 357 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 358                                       unsigned int pipe, u16 stream_id,
 359                                       struct scsi_cmnd *cmnd,
 360                                       enum dma_data_direction dir)
 361 {
 362         struct usb_device *udev = devinfo->udev;
 363         struct urb *urb = usb_alloc_urb(0, gfp);
 364         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
 365                 ? scsi_in(cmnd) : scsi_out(cmnd);
 366
 367         if (!urb)
 368                 goto out;
 369         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
 370                           uas_data_cmplt, cmnd);
 371         if (devinfo->use_streams)
 372                 urb->stream_id = stream_id;
 373         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
 374         urb->sg = sdb->table.sgl;
 375  out:
 376         return urb;
 377 }
 378
 379 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 380                                        struct Scsi_Host *shost, u16 stream_id)
 381 {
 382         struct usb_device *udev = devinfo->udev;
 383         struct urb *urb = usb_alloc_urb(0, gfp);
 384         struct sense_iu *iu;
 385
 386         if (!urb)
 387                 goto out;
 388
 389         iu = kzalloc(sizeof(*iu), gfp);
 390         if (!iu)
 391                 goto free;
 392
 393         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
 394                                                 uas_stat_cmplt, shost);
 395         urb->stream_id = stream_id;
 396         urb->transfer_flags |= URB_FREE_BUFFER;
 397  out:
 398         return urb;
 399  free:
 400         usb_free_urb(urb);
 401         return NULL;
 402 }
 403
 404 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
 405                                         struct scsi_cmnd *cmnd, u16 stream_id)
 406 {
 407         struct usb_device *udev = devinfo->udev;
 408         struct scsi_device *sdev = cmnd->device;
 409         struct urb *urb = usb_alloc_urb(0, gfp);
 410         struct command_iu *iu;
 411         int len;
 412
 413         if (!urb)
 414                 goto out;
 415
 416         len = cmnd->cmd_len - 16;
 417         if (len < 0)
 418                 len = 0;
 419         len = ALIGN(len, 4);
 420         iu = kzalloc(sizeof(*iu) + len, gfp);
 421         if (!iu)
 422                 goto free;
 423
 424         iu->iu_id = IU_ID_COMMAND;
 425         if (blk_rq_tagged(cmnd->request))
 426                 iu->tag = cpu_to_be16(cmnd->request->tag + 2);
 427         else
 428                 iu->tag = cpu_to_be16(1);
 429         iu->prio_attr = UAS_SIMPLE_TAG;
 430         iu->len = len;
 431         int_to_scsilun(sdev->lun, &iu->lun);
 432         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
 433
 434         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
 435                                                         usb_free_urb, NULL);
 436         urb->transfer_flags |= URB_FREE_BUFFER;
 437  out:
 438         return urb;
 439  free:
 440         usb_free_urb(urb);
 441         return NULL;
 442 }
 443
 444 static int uas_submit_task_urb(struct scsi_cmnd *cmnd, gfp_t gfp,
 445                                u8 function, u16 stream_id)
 446 {
 447         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 448         struct usb_device *udev = devinfo->udev;
 449         struct urb *urb = usb_alloc_urb(0, gfp);
 450         struct task_mgmt_iu *iu;
 451         int err = -ENOMEM;
 452
 453         if (!urb)
 454                 goto err;
 455
 456         iu = kzalloc(sizeof(*iu), gfp);
 457         if (!iu)
 458                 goto err;
 459
 460         iu->iu_id = IU_ID_TASK_MGMT;
 461         iu->tag = cpu_to_be16(stream_id);
 462         int_to_scsilun(cmnd->device->lun, &iu->lun);
 463
 464         iu->function = function;
 465         switch (function) {
 466         case TMF_ABORT_TASK:
 467                 if (blk_rq_tagged(cmnd->request))
 468                         iu->task_tag = cpu_to_be16(cmnd->request->tag + 2);
 469                 else
 470                         iu->task_tag = cpu_to_be16(1);
 471                 break;
 472         }
 473
 474         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu),
 475                           usb_free_urb, NULL);
 476         urb->transfer_flags |= URB_FREE_BUFFER;
 477
 478         err = usb_submit_urb(urb, gfp);
 479         if (err)
 480                 goto err;
 481         usb_anchor_urb(urb, &devinfo->cmd_urbs);
 482
 483         return 0;
 484
 485 err:
 486         usb_free_urb(urb);
 487         return err;
 488 }
 489
 490 /*
 491  * Why should I request the Status IU before sending the Command IU?  Spec
 492  * says to, but also says the device may receive them in any order.  Seems
 493  * daft to me.
 494  */
 495
 496 static int uas_submit_sense_urb(struct Scsi_Host *shost,
 497                                 gfp_t gfp, unsigned int stream)
 498 {
 499         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 500         struct urb *urb;
 501
 502         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
 503         if (!urb)
 504                 return SCSI_MLQUEUE_DEVICE_BUSY;
 505         if (usb_submit_urb(urb, gfp)) {
 506                 shost_printk(KERN_INFO, shost,
 507                              "sense urb submission failure\n");
 508                 usb_free_urb(urb);
 509                 return SCSI_MLQUEUE_DEVICE_BUSY;
 510         }
 511         usb_anchor_urb(urb, &devinfo->sense_urbs);
 512         return 0;
 513 }
 514
 515 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
 516                            struct uas_dev_info *devinfo, gfp_t gfp)
 517 {
 518         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 519         int err;
 520
 521         WARN_ON(!spin_is_locked(&devinfo->lock));
 522         if (cmdinfo->state & SUBMIT_STATUS_URB) {
 523                 err = uas_submit_sense_urb(cmnd->device->host, gfp,
 524                                            cmdinfo->stream);
 525                 if (err) {
 526                         return err;
 527                 }
 528                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
 529         }
 530
 531         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
 532                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
 533                                         devinfo->data_in_pipe, cmdinfo->stream,
 534                                         cmnd, DMA_FROM_DEVICE);
 535                 if (!cmdinfo->data_in_urb)
 536                         return SCSI_MLQUEUE_DEVICE_BUSY;
 537                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
 538         }
 539
 540         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
 541                 if (usb_submit_urb(cmdinfo->data_in_urb, gfp)) {
 542                         scmd_printk(KERN_INFO, cmnd,
 543                                         "data in urb submission failure\n");
 544                         return SCSI_MLQUEUE_DEVICE_BUSY;
 545                 }
 546                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
 547                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
 548                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
 549         }
 550
 551         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
 552                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
 553                                         devinfo->data_out_pipe, cmdinfo->stream,
 554                                         cmnd, DMA_TO_DEVICE);
 555                 if (!cmdinfo->data_out_urb)
 556                         return SCSI_MLQUEUE_DEVICE_BUSY;
 557                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
 558         }
 559
 560         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
 561                 if (usb_submit_urb(cmdinfo->data_out_urb, gfp)) {
 562                         scmd_printk(KERN_INFO, cmnd,
 563                                         "data out urb submission failure\n");
 564                         return SCSI_MLQUEUE_DEVICE_BUSY;
 565                 }
 566                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
 567                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
 568                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
 569         }
 570
 571         if (cmdinfo->state & ALLOC_CMD_URB) {
 572                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd,
 573                                                      cmdinfo->stream);
 574                 if (!cmdinfo->cmd_urb)
 575                         return SCSI_MLQUEUE_DEVICE_BUSY;
 576                 cmdinfo->state &= ~ALLOC_CMD_URB;
 577         }
 578
 579         if (cmdinfo->state & SUBMIT_CMD_URB) {
 580                 usb_get_urb(cmdinfo->cmd_urb);
 581                 if (usb_submit_urb(cmdinfo->cmd_urb, gfp)) {
 582                         scmd_printk(KERN_INFO, cmnd,
 583                                         "cmd urb submission failure\n");
 584                         return SCSI_MLQUEUE_DEVICE_BUSY;
 585                 }
 586                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
 587                 usb_put_urb(cmdinfo->cmd_urb);
 588                 cmdinfo->cmd_urb = NULL;
 589                 cmdinfo->state &= ~SUBMIT_CMD_URB;
 590                 cmdinfo->state |= COMMAND_INFLIGHT;
 591         }
 592
 593         return 0;
 594 }
 595
 596 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 597                                         void (*done)(struct scsi_cmnd *))
 598 {
 599         struct scsi_device *sdev = cmnd->device;
 600         struct uas_dev_info *devinfo = sdev->hostdata;
 601         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 602         unsigned long flags;
 603         int err;
 604
 605         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
 606
 607         spin_lock_irqsave(&devinfo->lock, flags);
 608         if (devinfo->cmnd) {
 609                 spin_unlock_irqrestore(&devinfo->lock, flags);
 610                 return SCSI_MLQUEUE_DEVICE_BUSY;
 611         }
 612
 613         if (blk_rq_tagged(cmnd->request)) {
 614                 cmdinfo->stream = cmnd->request->tag + 2;
 615         } else {
 616                 devinfo->cmnd = cmnd;
 617                 cmdinfo->stream = 1;
 618         }
 619
 620         cmnd->scsi_done = done;
 621
 622         cmdinfo->state = SUBMIT_STATUS_URB |
 623                         ALLOC_CMD_URB | SUBMIT_CMD_URB;
 624
 625         switch (cmnd->sc_data_direction) {
 626         case DMA_FROM_DEVICE:
 627                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 628                 break;
 629         case DMA_BIDIRECTIONAL:
 630                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
 631         case DMA_TO_DEVICE:
 632                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
 633         case DMA_NONE:
 634                 break;
 635         }
 636
 637         if (!devinfo->use_streams) {
 638                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
 639                 cmdinfo->stream = 0;
 640         }
 641
 642         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
 643         if (err) {
 644                 /* If we did nothing, give up now */
 645                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
 646                         spin_unlock_irqrestore(&devinfo->lock, flags);
 647                         return SCSI_MLQUEUE_DEVICE_BUSY;
 648                 }
 649                 spin_lock(&uas_work_lock);
 650                 list_add_tail(&cmdinfo->list, &uas_work_list);
 651                 cmdinfo->state |= IS_IN_WORK_LIST;
 652                 spin_unlock(&uas_work_lock);
 653                 schedule_work(&uas_work);
 654         }
 655
 656         spin_unlock_irqrestore(&devinfo->lock, flags);
 657         return 0;
 658 }
 659
 660 static DEF_SCSI_QCMD(uas_queuecommand)
 661
 662 static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
 663                             const char *fname, u8 function)
 664 {
 665         struct Scsi_Host *shost = cmnd->device->host;
 666         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 667         u16 tag = devinfo->qdepth - 1;
 668         unsigned long flags;
 669
 670         spin_lock_irqsave(&devinfo->lock, flags);
 671         memset(&devinfo->response, 0, sizeof(devinfo->response));
 672         if (uas_submit_sense_urb(shost, GFP_ATOMIC, tag)) {
 673                 shost_printk(KERN_INFO, shost,
 674                              "%s: %s: submit sense urb failed\n",
 675                              __func__, fname);
 676                 spin_unlock_irqrestore(&devinfo->lock, flags);
 677                 return FAILED;
 678         }
 679         if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
 680                 shost_printk(KERN_INFO, shost,
 681                              "%s: %s: submit task mgmt urb failed\n",
 682                              __func__, fname);
 683                 spin_unlock_irqrestore(&devinfo->lock, flags);
 684                 return FAILED;
 685         }
 686         spin_unlock_irqrestore(&devinfo->lock, flags);
 687
 688         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 3000) == 0) {
 689                 shost_printk(KERN_INFO, shost,
 690                              "%s: %s timed out\n", __func__, fname);
 691                 return FAILED;
 692         }
 693         if (be16_to_cpu(devinfo->response.tag) != tag) {
 694                 shost_printk(KERN_INFO, shost,
 695                              "%s: %s failed (wrong tag %d/%d)\n", __func__,
 696                              fname, be16_to_cpu(devinfo->response.tag), tag);
 697                 return FAILED;
 698         }
 699         if (devinfo->response.response_code != RC_TMF_COMPLETE) {
 700                 shost_printk(KERN_INFO, shost,
 701                              "%s: %s failed (rc 0x%x)\n", __func__,
 702                              fname, devinfo->response.response_code);
 703                 return FAILED;
 704         }
 705         return SUCCESS;
 706 }
 707
 708 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
 709 {
 710         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
 711         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
 712         unsigned long flags;
 713         int ret;
 714
 715         uas_log_cmd_state(cmnd, __func__);
 716         spin_lock_irqsave(&devinfo->lock, flags);
 717         cmdinfo->state |= COMMAND_ABORTED;
 718         spin_unlock_irqrestore(&devinfo->lock, flags);
 719         ret = uas_eh_task_mgmt(cmnd, "ABORT TASK", TMF_ABORT_TASK);
 720         return ret;
 721 }
 722
 723 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
 724 {
 725         sdev_printk(KERN_INFO, cmnd->device, "%s\n", __func__);
 726         return uas_eh_task_mgmt(cmnd, "LOGICAL UNIT RESET",
 727                                 TMF_LOGICAL_UNIT_RESET);
 728 }
 729
 730 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
 731 {
 732         struct scsi_device *sdev = cmnd->device;
 733         struct uas_dev_info *devinfo = sdev->hostdata;
 734         struct usb_device *udev = devinfo->udev;
 735         int err;
 736
 737         devinfo->resetting = 1;
 738         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
 739         usb_kill_anchored_urbs(&devinfo->sense_urbs);
 740         usb_kill_anchored_urbs(&devinfo->data_urbs);
 741         err = usb_reset_device(udev);
 742         devinfo->resetting = 0;
 743
 744         if (err) {
 745                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
 746                 return FAILED;
 747         }
 748
 749         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
 750         return SUCCESS;
 751 }
 752
 753 static int uas_slave_alloc(struct scsi_device *sdev)
 754 {
 755         sdev->hostdata = (void *)sdev->host->hostdata[0];
 756         return 0;
 757 }
 758
 759 static int uas_slave_configure(struct scsi_device *sdev)
 760 {
 761         struct uas_dev_info *devinfo = sdev->hostdata;
 762         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
 763         scsi_activate_tcq(sdev, devinfo->qdepth - 3);
 764         return 0;
 765 }
 766
 767 static struct scsi_host_template uas_host_template = {
 768         .module = THIS_MODULE,
 769         .name = "uas",
 770         .queuecommand = uas_queuecommand,
 771         .slave_alloc = uas_slave_alloc,
 772         .slave_configure = uas_slave_configure,
 773         .eh_abort_handler = uas_eh_abort_handler,
 774         .eh_device_reset_handler = uas_eh_device_reset_handler,
 775         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
 776         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
 777         .this_id = -1,
 778         .sg_tablesize = SG_NONE,
 779         .cmd_per_lun = 1,       /* until we override it */
 780         .skip_settle_delay = 1,
 781         .ordered_tag = 1,
 782 };
 783
 784 static struct usb_device_id uas_usb_ids[] = {
 785         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
 786         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
 787         /* 0xaa is a prototype device I happen to have access to */
 788         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
 789         { }
 790 };
 791 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 792
 793 static int uas_is_interface(struct usb_host_interface *intf)
 794 {
 795         return (intf->desc.bInterfaceClass == USB_CLASS_MASS_STORAGE &&
 796                 intf->desc.bInterfaceSubClass == USB_SC_SCSI &&
 797                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 798 }
 799
 800 static int uas_isnt_supported(struct usb_device *udev)
 801 {
 802         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
 803
 804         dev_warn(&udev->dev, "The driver for the USB controller %s does not "
 805                         "support scatter-gather which is\n",
 806                         hcd->driver->description);
 807         dev_warn(&udev->dev, "required by the UAS driver. Please try an"
 808                         "alternative USB controller if you wish to use UAS.\n");
 809         return -ENODEV;
 810 }
 811
 812 static int uas_switch_interface(struct usb_device *udev,
 813                                                 struct usb_interface *intf)
 814 {
 815         int i;
 816         int sg_supported = udev->bus->sg_tablesize != 0;
 817
 818         for (i = 0; i < intf->num_altsetting; i++) {
 819                 struct usb_host_interface *alt = &intf->altsetting[i];
 820
 821                 if (uas_is_interface(alt)) {
 822                         if (!sg_supported)
 823                                 return uas_isnt_supported(udev);
 824                         return usb_set_interface(udev,
 825                                                 alt->desc.bInterfaceNumber,
 826                                                 alt->desc.bAlternateSetting);
 827                 }
 828         }
 829
 830         return -ENODEV;
 831 }
 832
 833 static void uas_configure_endpoints(struct uas_dev_info *devinfo)
 834 {
 835         struct usb_host_endpoint *eps[4] = { };
 836         struct usb_interface *intf = devinfo->intf;
 837         struct usb_device *udev = devinfo->udev;
 838         struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
 839         unsigned i, n_endpoints = intf->cur_altsetting->desc.bNumEndpoints;
 840
 841         devinfo->uas_sense_old = 0;
 842         devinfo->cmnd = NULL;
 843
 844         for (i = 0; i < n_endpoints; i++) {
 845                 unsigned char *extra = endpoint[i].extra;
 846                 int len = endpoint[i].extralen;
 847                 while (len > 1) {
 848                         if (extra[1] == USB_DT_PIPE_USAGE) {
 849                                 unsigned pipe_id = extra[2];
 850                                 if (pipe_id > 0 && pipe_id < 5)
 851                                         eps[pipe_id - 1] = &endpoint[i];
 852                                 break;
 853                         }
 854                         len -= extra[0];
 855                         extra += extra[0];
 856                 }
 857         }
 858
 859         /*
 860          * Assume that if we didn't find a control pipe descriptor, we're
 861          * using a device with old firmware that happens to be set up like
 862          * this.
 863          */
 864         if (!eps[0]) {
 865                 devinfo->cmd_pipe = usb_sndbulkpipe(udev, 1);
 866                 devinfo->status_pipe = usb_rcvbulkpipe(udev, 1);
 867                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev, 2);
 868                 devinfo->data_out_pipe = usb_sndbulkpipe(udev, 2);
 869
 870                 eps[1] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 871                 eps[2] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 872                 eps[3] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 873         } else {
 874                 devinfo->cmd_pipe = usb_sndbulkpipe(udev,
 875                                                 eps[0]->desc.bEndpointAddress);
 876                 devinfo->status_pipe = usb_rcvbulkpipe(udev,
 877                                                 eps[1]->desc.bEndpointAddress);
 878                 devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
 879                                                 eps[2]->desc.bEndpointAddress);
 880                 devinfo->data_out_pipe = usb_sndbulkpipe(udev,
 881                                                 eps[3]->desc.bEndpointAddress);
 882         }
 883
 884         devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1, 3, 256,
 885                                                                 GFP_KERNEL);
 886         if (devinfo->qdepth < 0) {
 887                 devinfo->qdepth = 256;
 888                 devinfo->use_streams = 0;
 889         } else {
 890                 devinfo->use_streams = 1;
 891         }
 892 }
 893
 894 static void uas_free_streams(struct uas_dev_info *devinfo)
 895 {
 896         struct usb_device *udev = devinfo->udev;
 897         struct usb_host_endpoint *eps[3];
 898
 899         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
 900         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
 901         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
 902         usb_free_streams(devinfo->intf, eps, 3, GFP_KERNEL);
 903 }
 904
 905 /*
 906  * XXX: What I'd like to do here is register a SCSI host for each USB host in
 907  * the system.  Follow usb-storage's design of registering a SCSI host for
 908  * each USB device for the moment.  Can implement this by walking up the
 909  * USB hierarchy until we find a USB host.
 910  */
 911 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
 912 {
 913         int result;
 914         struct Scsi_Host *shost;
 915         struct uas_dev_info *devinfo;
 916         struct usb_device *udev = interface_to_usbdev(intf);
 917
 918         if (uas_switch_interface(udev, intf))
 919                 return -ENODEV;
 920
 921         devinfo = kmalloc(sizeof(struct uas_dev_info), GFP_KERNEL);
 922         if (!devinfo)
 923                 return -ENOMEM;
 924
 925         result = -ENOMEM;
 926         shost = scsi_host_alloc(&uas_host_template, sizeof(void *));
 927         if (!shost)
 928                 goto free;
 929
 930         shost->max_cmd_len = 16 + 252;
 931         shost->max_id = 1;
 932         shost->sg_tablesize = udev->bus->sg_tablesize;
 933
 934         devinfo->intf = intf;
 935         devinfo->udev = udev;
 936         devinfo->resetting = 0;
 937         init_usb_anchor(&devinfo->cmd_urbs);
 938         init_usb_anchor(&devinfo->sense_urbs);
 939         init_usb_anchor(&devinfo->data_urbs);
 940         spin_lock_init(&devinfo->lock);
 941         uas_configure_endpoints(devinfo);
 942
 943         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 3);
 944         if (result)
 945                 goto free;
 946
 947         result = scsi_add_host(shost, &intf->dev);
 948         if (result)
 949                 goto deconfig_eps;
 950
 951         shost->hostdata[0] = (unsigned long)devinfo;
 952
 953         scsi_scan_host(shost);
 954         usb_set_intfdata(intf, shost);
 955         return result;
 956
 957 deconfig_eps:
 958         uas_free_streams(devinfo);
 959  free:
 960         kfree(devinfo);
 961         if (shost)
 962                 scsi_host_put(shost);
 963         return result;
 964 }
 965
 966 static int uas_pre_reset(struct usb_interface *intf)
 967 {
 968 /* XXX: Need to return 1 if it's not our device in error handling */
 969         return 0;
 970 }
 971
 972 static int uas_post_reset(struct usb_interface *intf)
 973 {
 974 /* XXX: Need to return 1 if it's not our device in error handling */
 975         return 0;
 976 }
 977
 978 static void uas_disconnect(struct usb_interface *intf)
 979 {
 980         struct Scsi_Host *shost = usb_get_intfdata(intf);
 981         struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
 982
 983         scsi_remove_host(shost);
 984         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
 985         usb_kill_anchored_urbs(&devinfo->sense_urbs);
 986         usb_kill_anchored_urbs(&devinfo->data_urbs);
 987         uas_free_streams(devinfo);
 988         kfree(devinfo);
 989 }
 990
 991 /*
 992  * XXX: Should this plug into libusual so we can auto-upgrade devices from
 993  * Bulk-Only to UAS?
 994  */
 995 static struct usb_driver uas_driver = {
 996         .name = "uas",
 997         .probe = uas_probe,
 998         .disconnect = uas_disconnect,
 999         .pre_reset = uas_pre_reset,
1000         .post_reset = uas_post_reset,
1001         .id_table = uas_usb_ids,
1002 };
1003
1004 module_usb_driver(uas_driver);
1005
1006 MODULE_LICENSE("GPL");
1007 MODULE_AUTHOR("Matthew Wilcox and Sarah Sharp");