uas: Fix memleak of non-submitted urbs
[firefly-linux-kernel-4.4.55.git] / drivers / usb / storage / uas.c
1 /*
2  * USB Attached SCSI
3  * Note that this is not the same as the USB Mass Storage driver
4  *
5  * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014
6  * Copyright Matthew Wilcox for Intel Corp, 2010
7  * Copyright Sarah Sharp for Intel Corp, 2010
8  *
9  * Distributed under the terms of the GNU GPL, version two.
10  */
11
12 #include <linux/blkdev.h>
13 #include <linux/slab.h>
14 #include <linux/types.h>
15 #include <linux/module.h>
16 #include <linux/usb.h>
17 #include <linux/usb_usual.h>
18 #include <linux/usb/hcd.h>
19 #include <linux/usb/storage.h>
20 #include <linux/usb/uas.h>
21
22 #include <scsi/scsi.h>
23 #include <scsi/scsi_eh.h>
24 #include <scsi/scsi_dbg.h>
25 #include <scsi/scsi_cmnd.h>
26 #include <scsi/scsi_device.h>
27 #include <scsi/scsi_host.h>
28 #include <scsi/scsi_tcq.h>
29
30 #include "uas-detect.h"
31 #include "scsiglue.h"
32
33 #define MAX_CMNDS 256
34
35 /*
36  * The r00-r01c specs define this version of the SENSE IU data structure.
37  * It's still in use by several different firmware releases.
38  */
39 struct sense_iu_old {
40         __u8 iu_id;
41         __u8 rsvd1;
42         __be16 tag;
43         __be16 len;
44         __u8 status;
45         __u8 service_response;
46         __u8 sense[SCSI_SENSE_BUFFERSIZE];
47 };
48
49 struct uas_dev_info {
50         struct usb_interface *intf;
51         struct usb_device *udev;
52         struct usb_anchor cmd_urbs;
53         struct usb_anchor sense_urbs;
54         struct usb_anchor data_urbs;
55         unsigned long flags;
56         int qdepth, resetting;
57         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
58         unsigned use_streams:1;
59         unsigned uas_sense_old:1;
60         unsigned shutdown:1;
61         struct scsi_cmnd *cmnd[MAX_CMNDS];
62         spinlock_t lock;
63         struct work_struct work;
64 };
65
66 enum {
67         SUBMIT_STATUS_URB       = (1 << 1),
68         ALLOC_DATA_IN_URB       = (1 << 2),
69         SUBMIT_DATA_IN_URB      = (1 << 3),
70         ALLOC_DATA_OUT_URB      = (1 << 4),
71         SUBMIT_DATA_OUT_URB     = (1 << 5),
72         ALLOC_CMD_URB           = (1 << 6),
73         SUBMIT_CMD_URB          = (1 << 7),
74         COMMAND_INFLIGHT        = (1 << 8),
75         DATA_IN_URB_INFLIGHT    = (1 << 9),
76         DATA_OUT_URB_INFLIGHT   = (1 << 10),
77         COMMAND_COMPLETED       = (1 << 11),
78         COMMAND_ABORTED         = (1 << 12),
79         IS_IN_WORK_LIST         = (1 << 13),
80 };
81
82 /* Overrides scsi_pointer */
83 struct uas_cmd_info {
84         unsigned int state;
85         unsigned int stream;
86         struct urb *cmd_urb;
87         struct urb *data_in_urb;
88         struct urb *data_out_urb;
89 };
90
91 /* I hate forward declarations, but I actually have a loop */
92 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
93                                 struct uas_dev_info *devinfo, gfp_t gfp);
94 static void uas_do_work(struct work_struct *work);
95 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
96 static void uas_free_streams(struct uas_dev_info *devinfo);
97 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller);
98
99 static void uas_do_work(struct work_struct *work)
100 {
101         struct uas_dev_info *devinfo =
102                 container_of(work, struct uas_dev_info, work);
103         struct uas_cmd_info *cmdinfo;
104         struct scsi_cmnd *cmnd;
105         unsigned long flags;
106         int i, err;
107
108         spin_lock_irqsave(&devinfo->lock, flags);
109
110         if (devinfo->resetting)
111                 goto out;
112
113         for (i = 0; i < devinfo->qdepth; i++) {
114                 if (!devinfo->cmnd[i])
115                         continue;
116
117                 cmnd = devinfo->cmnd[i];
118                 cmdinfo = (void *)&cmnd->SCp;
119
120                 if (!(cmdinfo->state & IS_IN_WORK_LIST))
121                         continue;
122
123                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
124                 if (!err)
125                         cmdinfo->state &= ~IS_IN_WORK_LIST;
126                 else
127                         schedule_work(&devinfo->work);
128         }
129 out:
130         spin_unlock_irqrestore(&devinfo->lock, flags);
131 }
132
133 static void uas_add_work(struct uas_cmd_info *cmdinfo)
134 {
135         struct scsi_pointer *scp = (void *)cmdinfo;
136         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
137         struct uas_dev_info *devinfo = cmnd->device->hostdata;
138
139         lockdep_assert_held(&devinfo->lock);
140         cmdinfo->state |= IS_IN_WORK_LIST;
141         schedule_work(&devinfo->work);
142 }
143
144 static void uas_zap_pending(struct uas_dev_info *devinfo, int result)
145 {
146         struct uas_cmd_info *cmdinfo;
147         struct scsi_cmnd *cmnd;
148         unsigned long flags;
149         int i, err;
150
151         spin_lock_irqsave(&devinfo->lock, flags);
152         for (i = 0; i < devinfo->qdepth; i++) {
153                 if (!devinfo->cmnd[i])
154                         continue;
155
156                 cmnd = devinfo->cmnd[i];
157                 cmdinfo = (void *)&cmnd->SCp;
158                 uas_log_cmd_state(cmnd, __func__);
159                 /* Sense urbs were killed, clear COMMAND_INFLIGHT manually */
160                 cmdinfo->state &= ~COMMAND_INFLIGHT;
161                 cmnd->result = result << 16;
162                 err = uas_try_complete(cmnd, __func__);
163                 WARN_ON(err != 0);
164         }
165         spin_unlock_irqrestore(&devinfo->lock, flags);
166 }
167
168 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
169 {
170         struct sense_iu *sense_iu = urb->transfer_buffer;
171         struct scsi_device *sdev = cmnd->device;
172
173         if (urb->actual_length > 16) {
174                 unsigned len = be16_to_cpup(&sense_iu->len);
175                 if (len + 16 != urb->actual_length) {
176                         int newlen = min(len + 16, urb->actual_length) - 16;
177                         if (newlen < 0)
178                                 newlen = 0;
179                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
180                                 "disagrees with IU sense data length %d, "
181                                 "using %d bytes of sense data\n", __func__,
182                                         urb->actual_length, len, newlen);
183                         len = newlen;
184                 }
185                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
186         }
187
188         cmnd->result = sense_iu->status;
189 }
190
191 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
192 {
193         struct sense_iu_old *sense_iu = urb->transfer_buffer;
194         struct scsi_device *sdev = cmnd->device;
195
196         if (urb->actual_length > 8) {
197                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
198                 if (len + 8 != urb->actual_length) {
199                         int newlen = min(len + 8, urb->actual_length) - 8;
200                         if (newlen < 0)
201                                 newlen = 0;
202                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
203                                 "disagrees with IU sense data length %d, "
204                                 "using %d bytes of sense data\n", __func__,
205                                         urb->actual_length, len, newlen);
206                         len = newlen;
207                 }
208                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
209         }
210
211         cmnd->result = sense_iu->status;
212 }
213
214 /*
215  * scsi-tags go from 0 - (nr_tags - 1), uas tags need to match stream-ids,
216  * which go from 1 - nr_streams. And we use 1 for untagged commands.
217  */
218 static int uas_get_tag(struct scsi_cmnd *cmnd)
219 {
220         int tag;
221
222         if (blk_rq_tagged(cmnd->request))
223                 tag = cmnd->request->tag + 2;
224         else
225                 tag = 1;
226
227         return tag;
228 }
229
230 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
231 {
232         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
233
234         scmd_printk(KERN_INFO, cmnd,
235                     "%s %p tag %d, inflight:%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
236                     caller, cmnd, uas_get_tag(cmnd),
237                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
238                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
239                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
240                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
241                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
242                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
243                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
244                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
245                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
246                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
247                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
248                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
249                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
250 }
251
252 static void uas_free_unsubmitted_urbs(struct scsi_cmnd *cmnd)
253 {
254         struct uas_cmd_info *cmdinfo;
255
256         if (!cmnd)
257                 return;
258
259         cmdinfo = (void *)&cmnd->SCp;
260
261         if (cmdinfo->state & SUBMIT_CMD_URB)
262                 usb_free_urb(cmdinfo->cmd_urb);
263
264         /* data urbs may have never gotten their submit flag set */
265         if (!(cmdinfo->state & DATA_IN_URB_INFLIGHT))
266                 usb_free_urb(cmdinfo->data_in_urb);
267         if (!(cmdinfo->state & DATA_OUT_URB_INFLIGHT))
268                 usb_free_urb(cmdinfo->data_out_urb);
269 }
270
271 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
272 {
273         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
274         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
275
276         lockdep_assert_held(&devinfo->lock);
277         if (cmdinfo->state & (COMMAND_INFLIGHT |
278                               DATA_IN_URB_INFLIGHT |
279                               DATA_OUT_URB_INFLIGHT |
280                               COMMAND_ABORTED))
281                 return -EBUSY;
282         WARN_ON_ONCE(cmdinfo->state & COMMAND_COMPLETED);
283         cmdinfo->state |= COMMAND_COMPLETED;
284         devinfo->cmnd[uas_get_tag(cmnd) - 1] = NULL;
285         uas_free_unsubmitted_urbs(cmnd);
286         cmnd->scsi_done(cmnd);
287         return 0;
288 }
289
290 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
291                           unsigned direction)
292 {
293         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
294         int err;
295
296         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
297         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
298         if (err) {
299                 uas_add_work(cmdinfo);
300         }
301 }
302
303 static void uas_stat_cmplt(struct urb *urb)
304 {
305         struct iu *iu = urb->transfer_buffer;
306         struct Scsi_Host *shost = urb->context;
307         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
308         struct urb *data_in_urb = NULL;
309         struct urb *data_out_urb = NULL;
310         struct scsi_cmnd *cmnd;
311         struct uas_cmd_info *cmdinfo;
312         unsigned long flags;
313         unsigned int idx;
314
315         spin_lock_irqsave(&devinfo->lock, flags);
316
317         if (devinfo->resetting)
318                 goto out;
319
320         if (urb->status) {
321                 if (urb->status == -ENOENT) {
322                         dev_err(&urb->dev->dev, "stat urb: killed, stream %d\n",
323                                 urb->stream_id);
324                 } else {
325                         dev_err(&urb->dev->dev, "stat urb: status %d\n",
326                                 urb->status);
327                 }
328                 goto out;
329         }
330
331         idx = be16_to_cpup(&iu->tag) - 1;
332         if (idx >= MAX_CMNDS || !devinfo->cmnd[idx]) {
333                 dev_err(&urb->dev->dev,
334                         "stat urb: no pending cmd for tag %d\n", idx + 1);
335                 goto out;
336         }
337
338         cmnd = devinfo->cmnd[idx];
339         cmdinfo = (void *)&cmnd->SCp;
340
341         if (!(cmdinfo->state & COMMAND_INFLIGHT)) {
342                 scmd_printk(KERN_ERR, cmnd, "unexpected status cmplt\n");
343                 goto out;
344         }
345
346         switch (iu->iu_id) {
347         case IU_ID_STATUS:
348                 if (urb->actual_length < 16)
349                         devinfo->uas_sense_old = 1;
350                 if (devinfo->uas_sense_old)
351                         uas_sense_old(urb, cmnd);
352                 else
353                         uas_sense(urb, cmnd);
354                 if (cmnd->result != 0) {
355                         /* cancel data transfers on error */
356                         data_in_urb = usb_get_urb(cmdinfo->data_in_urb);
357                         data_out_urb = usb_get_urb(cmdinfo->data_out_urb);
358                 }
359                 cmdinfo->state &= ~COMMAND_INFLIGHT;
360                 uas_try_complete(cmnd, __func__);
361                 break;
362         case IU_ID_READ_READY:
363                 if (!cmdinfo->data_in_urb ||
364                                 (cmdinfo->state & DATA_IN_URB_INFLIGHT)) {
365                         scmd_printk(KERN_ERR, cmnd, "unexpected read rdy\n");
366                         break;
367                 }
368                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
369                 break;
370         case IU_ID_WRITE_READY:
371                 if (!cmdinfo->data_out_urb ||
372                                 (cmdinfo->state & DATA_OUT_URB_INFLIGHT)) {
373                         scmd_printk(KERN_ERR, cmnd, "unexpected write rdy\n");
374                         break;
375                 }
376                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
377                 break;
378         default:
379                 scmd_printk(KERN_ERR, cmnd,
380                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
381         }
382 out:
383         usb_free_urb(urb);
384         spin_unlock_irqrestore(&devinfo->lock, flags);
385
386         /* Unlinking of data urbs must be done without holding the lock */
387         if (data_in_urb) {
388                 usb_unlink_urb(data_in_urb);
389                 usb_put_urb(data_in_urb);
390         }
391         if (data_out_urb) {
392                 usb_unlink_urb(data_out_urb);
393                 usb_put_urb(data_out_urb);
394         }
395 }
396
397 static void uas_data_cmplt(struct urb *urb)
398 {
399         struct scsi_cmnd *cmnd = urb->context;
400         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
401         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
402         struct scsi_data_buffer *sdb = NULL;
403         unsigned long flags;
404
405         spin_lock_irqsave(&devinfo->lock, flags);
406
407         if (cmdinfo->data_in_urb == urb) {
408                 sdb = scsi_in(cmnd);
409                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
410                 cmdinfo->data_in_urb = NULL;
411         } else if (cmdinfo->data_out_urb == urb) {
412                 sdb = scsi_out(cmnd);
413                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
414                 cmdinfo->data_out_urb = NULL;
415         }
416         if (sdb == NULL) {
417                 WARN_ON_ONCE(1);
418                 goto out;
419         }
420
421         if (devinfo->resetting)
422                 goto out;
423
424         /* Data urbs should not complete before the cmd urb is submitted */
425         if (cmdinfo->state & SUBMIT_CMD_URB) {
426                 scmd_printk(KERN_ERR, cmnd, "unexpected data cmplt\n");
427                 goto out;
428         }
429
430         if (urb->status) {
431                 if (urb->status != -ECONNRESET) {
432                         uas_log_cmd_state(cmnd, __func__);
433                         scmd_printk(KERN_ERR, cmnd,
434                                 "data cmplt err %d stream %d\n",
435                                 urb->status, urb->stream_id);
436                 }
437                 /* error: no data transfered */
438                 sdb->resid = sdb->length;
439         } else {
440                 sdb->resid = sdb->length - urb->actual_length;
441         }
442         uas_try_complete(cmnd, __func__);
443 out:
444         usb_free_urb(urb);
445         spin_unlock_irqrestore(&devinfo->lock, flags);
446 }
447
448 static void uas_cmd_cmplt(struct urb *urb)
449 {
450         if (urb->status)
451                 dev_err(&urb->dev->dev, "cmd cmplt err %d\n", urb->status);
452
453         usb_free_urb(urb);
454 }
455
456 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
457                                       unsigned int pipe, u16 stream_id,
458                                       struct scsi_cmnd *cmnd,
459                                       enum dma_data_direction dir)
460 {
461         struct usb_device *udev = devinfo->udev;
462         struct urb *urb = usb_alloc_urb(0, gfp);
463         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
464                 ? scsi_in(cmnd) : scsi_out(cmnd);
465
466         if (!urb)
467                 goto out;
468         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
469                           uas_data_cmplt, cmnd);
470         urb->stream_id = stream_id;
471         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
472         urb->sg = sdb->table.sgl;
473  out:
474         return urb;
475 }
476
477 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
478                                        struct Scsi_Host *shost, u16 stream_id)
479 {
480         struct usb_device *udev = devinfo->udev;
481         struct urb *urb = usb_alloc_urb(0, gfp);
482         struct sense_iu *iu;
483
484         if (!urb)
485                 goto out;
486
487         iu = kzalloc(sizeof(*iu), gfp);
488         if (!iu)
489                 goto free;
490
491         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
492                                                 uas_stat_cmplt, shost);
493         urb->stream_id = stream_id;
494         urb->transfer_flags |= URB_FREE_BUFFER;
495  out:
496         return urb;
497  free:
498         usb_free_urb(urb);
499         return NULL;
500 }
501
502 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
503                                         struct scsi_cmnd *cmnd)
504 {
505         struct usb_device *udev = devinfo->udev;
506         struct scsi_device *sdev = cmnd->device;
507         struct urb *urb = usb_alloc_urb(0, gfp);
508         struct command_iu *iu;
509         int len;
510
511         if (!urb)
512                 goto out;
513
514         len = cmnd->cmd_len - 16;
515         if (len < 0)
516                 len = 0;
517         len = ALIGN(len, 4);
518         iu = kzalloc(sizeof(*iu) + len, gfp);
519         if (!iu)
520                 goto free;
521
522         iu->iu_id = IU_ID_COMMAND;
523         iu->tag = cpu_to_be16(uas_get_tag(cmnd));
524         iu->prio_attr = UAS_SIMPLE_TAG;
525         iu->len = len;
526         int_to_scsilun(sdev->lun, &iu->lun);
527         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
528
529         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
530                                                         uas_cmd_cmplt, NULL);
531         urb->transfer_flags |= URB_FREE_BUFFER;
532  out:
533         return urb;
534  free:
535         usb_free_urb(urb);
536         return NULL;
537 }
538
539 /*
540  * Why should I request the Status IU before sending the Command IU?  Spec
541  * says to, but also says the device may receive them in any order.  Seems
542  * daft to me.
543  */
544
545 static struct urb *uas_submit_sense_urb(struct scsi_cmnd *cmnd,
546                                         gfp_t gfp, unsigned int stream)
547 {
548         struct Scsi_Host *shost = cmnd->device->host;
549         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
550         struct urb *urb;
551         int err;
552
553         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
554         if (!urb)
555                 return NULL;
556         usb_anchor_urb(urb, &devinfo->sense_urbs);
557         err = usb_submit_urb(urb, gfp);
558         if (err) {
559                 usb_unanchor_urb(urb);
560                 uas_log_cmd_state(cmnd, __func__);
561                 shost_printk(KERN_INFO, shost,
562                              "sense urb submission error %d stream %d\n",
563                              err, stream);
564                 usb_free_urb(urb);
565                 return NULL;
566         }
567         return urb;
568 }
569
570 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
571                            struct uas_dev_info *devinfo, gfp_t gfp)
572 {
573         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
574         struct urb *urb;
575         int err;
576
577         lockdep_assert_held(&devinfo->lock);
578         if (cmdinfo->state & SUBMIT_STATUS_URB) {
579                 urb = uas_submit_sense_urb(cmnd, gfp, cmdinfo->stream);
580                 if (!urb)
581                         return SCSI_MLQUEUE_DEVICE_BUSY;
582                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
583         }
584
585         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
586                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
587                                         devinfo->data_in_pipe, cmdinfo->stream,
588                                         cmnd, DMA_FROM_DEVICE);
589                 if (!cmdinfo->data_in_urb)
590                         return SCSI_MLQUEUE_DEVICE_BUSY;
591                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
592         }
593
594         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
595                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
596                 err = usb_submit_urb(cmdinfo->data_in_urb, gfp);
597                 if (err) {
598                         usb_unanchor_urb(cmdinfo->data_in_urb);
599                         uas_log_cmd_state(cmnd, __func__);
600                         scmd_printk(KERN_INFO, cmnd,
601                                 "data in urb submission error %d stream %d\n",
602                                 err, cmdinfo->data_in_urb->stream_id);
603                         return SCSI_MLQUEUE_DEVICE_BUSY;
604                 }
605                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
606                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
607         }
608
609         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
610                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
611                                         devinfo->data_out_pipe, cmdinfo->stream,
612                                         cmnd, DMA_TO_DEVICE);
613                 if (!cmdinfo->data_out_urb)
614                         return SCSI_MLQUEUE_DEVICE_BUSY;
615                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
616         }
617
618         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
619                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
620                 err = usb_submit_urb(cmdinfo->data_out_urb, gfp);
621                 if (err) {
622                         usb_unanchor_urb(cmdinfo->data_out_urb);
623                         uas_log_cmd_state(cmnd, __func__);
624                         scmd_printk(KERN_INFO, cmnd,
625                                 "data out urb submission error %d stream %d\n",
626                                 err, cmdinfo->data_out_urb->stream_id);
627                         return SCSI_MLQUEUE_DEVICE_BUSY;
628                 }
629                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
630                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
631         }
632
633         if (cmdinfo->state & ALLOC_CMD_URB) {
634                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd);
635                 if (!cmdinfo->cmd_urb)
636                         return SCSI_MLQUEUE_DEVICE_BUSY;
637                 cmdinfo->state &= ~ALLOC_CMD_URB;
638         }
639
640         if (cmdinfo->state & SUBMIT_CMD_URB) {
641                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
642                 err = usb_submit_urb(cmdinfo->cmd_urb, gfp);
643                 if (err) {
644                         usb_unanchor_urb(cmdinfo->cmd_urb);
645                         uas_log_cmd_state(cmnd, __func__);
646                         scmd_printk(KERN_INFO, cmnd,
647                                     "cmd urb submission error %d\n", err);
648                         return SCSI_MLQUEUE_DEVICE_BUSY;
649                 }
650                 cmdinfo->cmd_urb = NULL;
651                 cmdinfo->state &= ~SUBMIT_CMD_URB;
652                 cmdinfo->state |= COMMAND_INFLIGHT;
653         }
654
655         return 0;
656 }
657
658 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
659                                         void (*done)(struct scsi_cmnd *))
660 {
661         struct scsi_device *sdev = cmnd->device;
662         struct uas_dev_info *devinfo = sdev->hostdata;
663         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
664         unsigned long flags;
665         unsigned int stream;
666         int err;
667
668         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
669
670         if ((devinfo->flags & US_FL_NO_ATA_1X) &&
671                         (cmnd->cmnd[0] == ATA_12 || cmnd->cmnd[0] == ATA_16)) {
672                 memcpy(cmnd->sense_buffer, usb_stor_sense_invalidCDB,
673                        sizeof(usb_stor_sense_invalidCDB));
674                 cmnd->result = SAM_STAT_CHECK_CONDITION;
675                 cmnd->scsi_done(cmnd);
676                 return 0;
677         }
678
679         spin_lock_irqsave(&devinfo->lock, flags);
680
681         if (devinfo->resetting) {
682                 cmnd->result = DID_ERROR << 16;
683                 cmnd->scsi_done(cmnd);
684                 spin_unlock_irqrestore(&devinfo->lock, flags);
685                 return 0;
686         }
687
688         stream = uas_get_tag(cmnd);
689         if (devinfo->cmnd[stream - 1]) {
690                 spin_unlock_irqrestore(&devinfo->lock, flags);
691                 return SCSI_MLQUEUE_DEVICE_BUSY;
692         }
693
694         cmnd->scsi_done = done;
695
696         memset(cmdinfo, 0, sizeof(*cmdinfo));
697         cmdinfo->stream = stream;
698         cmdinfo->state = SUBMIT_STATUS_URB | ALLOC_CMD_URB | SUBMIT_CMD_URB;
699
700         switch (cmnd->sc_data_direction) {
701         case DMA_FROM_DEVICE:
702                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
703                 break;
704         case DMA_BIDIRECTIONAL:
705                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
706         case DMA_TO_DEVICE:
707                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
708         case DMA_NONE:
709                 break;
710         }
711
712         if (!devinfo->use_streams) {
713                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
714                 cmdinfo->stream = 0;
715         }
716
717         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
718         if (err) {
719                 /* If we did nothing, give up now */
720                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
721                         spin_unlock_irqrestore(&devinfo->lock, flags);
722                         return SCSI_MLQUEUE_DEVICE_BUSY;
723                 }
724                 uas_add_work(cmdinfo);
725         }
726
727         devinfo->cmnd[stream - 1] = cmnd;
728         spin_unlock_irqrestore(&devinfo->lock, flags);
729         return 0;
730 }
731
732 static DEF_SCSI_QCMD(uas_queuecommand)
733
734 /*
735  * For now we do not support actually sending an abort to the device, so
736  * this eh always fails. Still we must define it to make sure that we've
737  * dropped all references to the cmnd in question once this function exits.
738  */
739 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
740 {
741         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
742         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
743         struct urb *data_in_urb = NULL;
744         struct urb *data_out_urb = NULL;
745         unsigned long flags;
746
747         spin_lock_irqsave(&devinfo->lock, flags);
748
749         uas_log_cmd_state(cmnd, __func__);
750
751         /* Ensure that try_complete does not call scsi_done */
752         cmdinfo->state |= COMMAND_ABORTED;
753
754         /* Drop all refs to this cmnd, kill data urbs to break their ref */
755         devinfo->cmnd[uas_get_tag(cmnd) - 1] = NULL;
756         if (cmdinfo->state & DATA_IN_URB_INFLIGHT)
757                 data_in_urb = usb_get_urb(cmdinfo->data_in_urb);
758         if (cmdinfo->state & DATA_OUT_URB_INFLIGHT)
759                 data_out_urb = usb_get_urb(cmdinfo->data_out_urb);
760
761         uas_free_unsubmitted_urbs(cmnd);
762
763         spin_unlock_irqrestore(&devinfo->lock, flags);
764
765         if (data_in_urb) {
766                 usb_kill_urb(data_in_urb);
767                 usb_put_urb(data_in_urb);
768         }
769         if (data_out_urb) {
770                 usb_kill_urb(data_out_urb);
771                 usb_put_urb(data_out_urb);
772         }
773
774         return FAILED;
775 }
776
777 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
778 {
779         struct scsi_device *sdev = cmnd->device;
780         struct uas_dev_info *devinfo = sdev->hostdata;
781         struct usb_device *udev = devinfo->udev;
782         unsigned long flags;
783         int err;
784
785         err = usb_lock_device_for_reset(udev, devinfo->intf);
786         if (err) {
787                 shost_printk(KERN_ERR, sdev->host,
788                              "%s FAILED to get lock err %d\n", __func__, err);
789                 return FAILED;
790         }
791
792         shost_printk(KERN_INFO, sdev->host, "%s start\n", __func__);
793
794         spin_lock_irqsave(&devinfo->lock, flags);
795         devinfo->resetting = 1;
796         spin_unlock_irqrestore(&devinfo->lock, flags);
797
798         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
799         usb_kill_anchored_urbs(&devinfo->sense_urbs);
800         usb_kill_anchored_urbs(&devinfo->data_urbs);
801         uas_zap_pending(devinfo, DID_RESET);
802
803         err = usb_reset_device(udev);
804
805         spin_lock_irqsave(&devinfo->lock, flags);
806         devinfo->resetting = 0;
807         spin_unlock_irqrestore(&devinfo->lock, flags);
808
809         usb_unlock_device(udev);
810
811         if (err) {
812                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
813                 return FAILED;
814         }
815
816         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
817         return SUCCESS;
818 }
819
820 static int uas_slave_alloc(struct scsi_device *sdev)
821 {
822         sdev->hostdata = (void *)sdev->host->hostdata;
823
824         /* USB has unusual DMA-alignment requirements: Although the
825          * starting address of each scatter-gather element doesn't matter,
826          * the length of each element except the last must be divisible
827          * by the Bulk maxpacket value.  There's currently no way to
828          * express this by block-layer constraints, so we'll cop out
829          * and simply require addresses to be aligned at 512-byte
830          * boundaries.  This is okay since most block I/O involves
831          * hardware sectors that are multiples of 512 bytes in length,
832          * and since host controllers up through USB 2.0 have maxpacket
833          * values no larger than 512.
834          *
835          * But it doesn't suffice for Wireless USB, where Bulk maxpacket
836          * values can be as large as 2048.  To make that work properly
837          * will require changes to the block layer.
838          */
839         blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
840
841         return 0;
842 }
843
844 static int uas_slave_configure(struct scsi_device *sdev)
845 {
846         struct uas_dev_info *devinfo = sdev->hostdata;
847
848         if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
849                 sdev->no_report_opcodes = 1;
850
851         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
852         scsi_activate_tcq(sdev, devinfo->qdepth - 2);
853         return 0;
854 }
855
856 static struct scsi_host_template uas_host_template = {
857         .module = THIS_MODULE,
858         .name = "uas",
859         .queuecommand = uas_queuecommand,
860         .slave_alloc = uas_slave_alloc,
861         .slave_configure = uas_slave_configure,
862         .eh_abort_handler = uas_eh_abort_handler,
863         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
864         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
865         .this_id = -1,
866         .sg_tablesize = SG_NONE,
867         .cmd_per_lun = 1,       /* until we override it */
868         .skip_settle_delay = 1,
869         .ordered_tag = 1,
870 };
871
872 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
873                     vendorName, productName, useProtocol, useTransport, \
874                     initFunction, flags) \
875 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
876         .driver_info = (flags) }
877
878 static struct usb_device_id uas_usb_ids[] = {
879 #       include "unusual_uas.h"
880         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
881         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
882         /* 0xaa is a prototype device I happen to have access to */
883         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
884         { }
885 };
886 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
887
888 #undef UNUSUAL_DEV
889
890 static int uas_switch_interface(struct usb_device *udev,
891                                 struct usb_interface *intf)
892 {
893         int alt;
894
895         alt = uas_find_uas_alt_setting(intf);
896         if (alt < 0)
897                 return alt;
898
899         return usb_set_interface(udev,
900                         intf->altsetting[0].desc.bInterfaceNumber, alt);
901 }
902
903 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
904 {
905         struct usb_host_endpoint *eps[4] = { };
906         struct usb_device *udev = devinfo->udev;
907         int r;
908
909         devinfo->uas_sense_old = 0;
910
911         r = uas_find_endpoints(devinfo->intf->cur_altsetting, eps);
912         if (r)
913                 return r;
914
915         devinfo->cmd_pipe = usb_sndbulkpipe(udev,
916                                             usb_endpoint_num(&eps[0]->desc));
917         devinfo->status_pipe = usb_rcvbulkpipe(udev,
918                                             usb_endpoint_num(&eps[1]->desc));
919         devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
920                                             usb_endpoint_num(&eps[2]->desc));
921         devinfo->data_out_pipe = usb_sndbulkpipe(udev,
922                                             usb_endpoint_num(&eps[3]->desc));
923
924         if (udev->speed != USB_SPEED_SUPER) {
925                 devinfo->qdepth = 32;
926                 devinfo->use_streams = 0;
927         } else {
928                 devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1,
929                                                     3, MAX_CMNDS, GFP_NOIO);
930                 if (devinfo->qdepth < 0)
931                         return devinfo->qdepth;
932                 devinfo->use_streams = 1;
933         }
934
935         return 0;
936 }
937
938 static void uas_free_streams(struct uas_dev_info *devinfo)
939 {
940         struct usb_device *udev = devinfo->udev;
941         struct usb_host_endpoint *eps[3];
942
943         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
944         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
945         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
946         usb_free_streams(devinfo->intf, eps, 3, GFP_NOIO);
947 }
948
949 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
950 {
951         int result = -ENOMEM;
952         struct Scsi_Host *shost = NULL;
953         struct uas_dev_info *devinfo;
954         struct usb_device *udev = interface_to_usbdev(intf);
955
956         if (!uas_use_uas_driver(intf, id))
957                 return -ENODEV;
958
959         if (uas_switch_interface(udev, intf))
960                 return -ENODEV;
961
962         shost = scsi_host_alloc(&uas_host_template,
963                                 sizeof(struct uas_dev_info));
964         if (!shost)
965                 goto set_alt0;
966
967         shost->max_cmd_len = 16 + 252;
968         shost->max_id = 1;
969         shost->max_lun = 256;
970         shost->max_channel = 0;
971         shost->sg_tablesize = udev->bus->sg_tablesize;
972
973         devinfo = (struct uas_dev_info *)shost->hostdata;
974         devinfo->intf = intf;
975         devinfo->udev = udev;
976         devinfo->resetting = 0;
977         devinfo->shutdown = 0;
978         devinfo->flags = id->driver_info;
979         usb_stor_adjust_quirks(udev, &devinfo->flags);
980         init_usb_anchor(&devinfo->cmd_urbs);
981         init_usb_anchor(&devinfo->sense_urbs);
982         init_usb_anchor(&devinfo->data_urbs);
983         spin_lock_init(&devinfo->lock);
984         INIT_WORK(&devinfo->work, uas_do_work);
985
986         result = uas_configure_endpoints(devinfo);
987         if (result)
988                 goto set_alt0;
989
990         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 2);
991         if (result)
992                 goto free_streams;
993
994         usb_set_intfdata(intf, shost);
995         result = scsi_add_host(shost, &intf->dev);
996         if (result)
997                 goto free_streams;
998
999         scsi_scan_host(shost);
1000         return result;
1001
1002 free_streams:
1003         uas_free_streams(devinfo);
1004         usb_set_intfdata(intf, NULL);
1005 set_alt0:
1006         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1007         if (shost)
1008                 scsi_host_put(shost);
1009         return result;
1010 }
1011
1012 static int uas_pre_reset(struct usb_interface *intf)
1013 {
1014         struct Scsi_Host *shost = usb_get_intfdata(intf);
1015         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1016         unsigned long flags;
1017
1018         if (devinfo->shutdown)
1019                 return 0;
1020
1021         /* Block new requests */
1022         spin_lock_irqsave(shost->host_lock, flags);
1023         scsi_block_requests(shost);
1024         spin_unlock_irqrestore(shost->host_lock, flags);
1025
1026         /* Wait for any pending requests to complete */
1027         flush_work(&devinfo->work);
1028         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1029                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1030                 return 1;
1031         }
1032
1033         uas_free_streams(devinfo);
1034
1035         return 0;
1036 }
1037
1038 static int uas_post_reset(struct usb_interface *intf)
1039 {
1040         struct Scsi_Host *shost = usb_get_intfdata(intf);
1041         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1042         unsigned long flags;
1043
1044         if (devinfo->shutdown)
1045                 return 0;
1046
1047         if (uas_configure_endpoints(devinfo) != 0) {
1048                 shost_printk(KERN_ERR, shost,
1049                              "%s: alloc streams error after reset", __func__);
1050                 return 1;
1051         }
1052
1053         spin_lock_irqsave(shost->host_lock, flags);
1054         scsi_report_bus_reset(shost, 0);
1055         spin_unlock_irqrestore(shost->host_lock, flags);
1056
1057         scsi_unblock_requests(shost);
1058
1059         return 0;
1060 }
1061
1062 static int uas_suspend(struct usb_interface *intf, pm_message_t message)
1063 {
1064         struct Scsi_Host *shost = usb_get_intfdata(intf);
1065         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1066
1067         /* Wait for any pending requests to complete */
1068         flush_work(&devinfo->work);
1069         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1070                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1071                 return -ETIME;
1072         }
1073
1074         return 0;
1075 }
1076
1077 static int uas_resume(struct usb_interface *intf)
1078 {
1079         return 0;
1080 }
1081
1082 static int uas_reset_resume(struct usb_interface *intf)
1083 {
1084         struct Scsi_Host *shost = usb_get_intfdata(intf);
1085         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1086         unsigned long flags;
1087
1088         if (uas_configure_endpoints(devinfo) != 0) {
1089                 shost_printk(KERN_ERR, shost,
1090                              "%s: alloc streams error after reset", __func__);
1091                 return -EIO;
1092         }
1093
1094         spin_lock_irqsave(shost->host_lock, flags);
1095         scsi_report_bus_reset(shost, 0);
1096         spin_unlock_irqrestore(shost->host_lock, flags);
1097
1098         return 0;
1099 }
1100
1101 static void uas_disconnect(struct usb_interface *intf)
1102 {
1103         struct Scsi_Host *shost = usb_get_intfdata(intf);
1104         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1105         unsigned long flags;
1106
1107         spin_lock_irqsave(&devinfo->lock, flags);
1108         devinfo->resetting = 1;
1109         spin_unlock_irqrestore(&devinfo->lock, flags);
1110
1111         cancel_work_sync(&devinfo->work);
1112         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1113         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1114         usb_kill_anchored_urbs(&devinfo->data_urbs);
1115         uas_zap_pending(devinfo, DID_NO_CONNECT);
1116
1117         scsi_remove_host(shost);
1118         uas_free_streams(devinfo);
1119         scsi_host_put(shost);
1120 }
1121
1122 /*
1123  * Put the device back in usb-storage mode on shutdown, as some BIOS-es
1124  * hang on reboot when the device is still in uas mode. Note the reset is
1125  * necessary as some devices won't revert to usb-storage mode without it.
1126  */
1127 static void uas_shutdown(struct device *dev)
1128 {
1129         struct usb_interface *intf = to_usb_interface(dev);
1130         struct usb_device *udev = interface_to_usbdev(intf);
1131         struct Scsi_Host *shost = usb_get_intfdata(intf);
1132         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1133
1134         if (system_state != SYSTEM_RESTART)
1135                 return;
1136
1137         devinfo->shutdown = 1;
1138         uas_free_streams(devinfo);
1139         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1140         usb_reset_device(udev);
1141 }
1142
1143 static struct usb_driver uas_driver = {
1144         .name = "uas",
1145         .probe = uas_probe,
1146         .disconnect = uas_disconnect,
1147         .pre_reset = uas_pre_reset,
1148         .post_reset = uas_post_reset,
1149         .suspend = uas_suspend,
1150         .resume = uas_resume,
1151         .reset_resume = uas_reset_resume,
1152         .drvwrap.driver.shutdown = uas_shutdown,
1153         .id_table = uas_usb_ids,
1154 };
1155
1156 module_usb_driver(uas_driver);
1157
1158 MODULE_LICENSE("GPL");
1159 MODULE_AUTHOR(
1160         "Hans de Goede <hdegoede@redhat.com>, Matthew Wilcox and Sarah Sharp");