uas: Check against unexpected completions
[firefly-linux-kernel-4.4.55.git] / drivers / usb / storage / uas.c
1 /*
2  * USB Attached SCSI
3  * Note that this is not the same as the USB Mass Storage driver
4  *
5  * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014
6  * Copyright Matthew Wilcox for Intel Corp, 2010
7  * Copyright Sarah Sharp for Intel Corp, 2010
8  *
9  * Distributed under the terms of the GNU GPL, version two.
10  */
11
12 #include <linux/blkdev.h>
13 #include <linux/slab.h>
14 #include <linux/types.h>
15 #include <linux/module.h>
16 #include <linux/usb.h>
17 #include <linux/usb_usual.h>
18 #include <linux/usb/hcd.h>
19 #include <linux/usb/storage.h>
20 #include <linux/usb/uas.h>
21
22 #include <scsi/scsi.h>
23 #include <scsi/scsi_eh.h>
24 #include <scsi/scsi_dbg.h>
25 #include <scsi/scsi_cmnd.h>
26 #include <scsi/scsi_device.h>
27 #include <scsi/scsi_host.h>
28 #include <scsi/scsi_tcq.h>
29
30 #include "uas-detect.h"
31 #include "scsiglue.h"
32
33 #define MAX_CMNDS 256
34
35 /*
36  * The r00-r01c specs define this version of the SENSE IU data structure.
37  * It's still in use by several different firmware releases.
38  */
39 struct sense_iu_old {
40         __u8 iu_id;
41         __u8 rsvd1;
42         __be16 tag;
43         __be16 len;
44         __u8 status;
45         __u8 service_response;
46         __u8 sense[SCSI_SENSE_BUFFERSIZE];
47 };
48
49 struct uas_dev_info {
50         struct usb_interface *intf;
51         struct usb_device *udev;
52         struct usb_anchor cmd_urbs;
53         struct usb_anchor sense_urbs;
54         struct usb_anchor data_urbs;
55         unsigned long flags;
56         int qdepth, resetting;
57         unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
58         unsigned use_streams:1;
59         unsigned uas_sense_old:1;
60         unsigned shutdown:1;
61         struct scsi_cmnd *cmnd[MAX_CMNDS];
62         spinlock_t lock;
63         struct work_struct work;
64         struct list_head inflight_list;
65         struct list_head dead_list;
66 };
67
68 enum {
69         SUBMIT_STATUS_URB       = (1 << 1),
70         ALLOC_DATA_IN_URB       = (1 << 2),
71         SUBMIT_DATA_IN_URB      = (1 << 3),
72         ALLOC_DATA_OUT_URB      = (1 << 4),
73         SUBMIT_DATA_OUT_URB     = (1 << 5),
74         ALLOC_CMD_URB           = (1 << 6),
75         SUBMIT_CMD_URB          = (1 << 7),
76         COMMAND_INFLIGHT        = (1 << 8),
77         DATA_IN_URB_INFLIGHT    = (1 << 9),
78         DATA_OUT_URB_INFLIGHT   = (1 << 10),
79         COMMAND_COMPLETED       = (1 << 11),
80         COMMAND_ABORTED         = (1 << 12),
81         UNLINK_DATA_URBS        = (1 << 13),
82         IS_IN_WORK_LIST         = (1 << 14),
83 };
84
85 /* Overrides scsi_pointer */
86 struct uas_cmd_info {
87         unsigned int state;
88         unsigned int stream;
89         struct urb *cmd_urb;
90         struct urb *data_in_urb;
91         struct urb *data_out_urb;
92         struct list_head list;
93 };
94
95 /* I hate forward declarations, but I actually have a loop */
96 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
97                                 struct uas_dev_info *devinfo, gfp_t gfp);
98 static void uas_do_work(struct work_struct *work);
99 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller);
100 static void uas_free_streams(struct uas_dev_info *devinfo);
101 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller);
102
103 /* Must be called with devinfo->lock held, will temporary unlock the lock */
104 static void uas_unlink_data_urbs(struct uas_dev_info *devinfo,
105                                  struct uas_cmd_info *cmdinfo,
106                                  unsigned long *lock_flags)
107 {
108         /*
109          * The UNLINK_DATA_URBS flag makes sure uas_try_complete
110          * (called by urb completion) doesn't release cmdinfo
111          * underneath us.
112          */
113         cmdinfo->state |= UNLINK_DATA_URBS;
114         spin_unlock_irqrestore(&devinfo->lock, *lock_flags);
115
116         if (cmdinfo->data_in_urb)
117                 usb_unlink_urb(cmdinfo->data_in_urb);
118         if (cmdinfo->data_out_urb)
119                 usb_unlink_urb(cmdinfo->data_out_urb);
120
121         spin_lock_irqsave(&devinfo->lock, *lock_flags);
122         cmdinfo->state &= ~UNLINK_DATA_URBS;
123 }
124
125 static void uas_do_work(struct work_struct *work)
126 {
127         struct uas_dev_info *devinfo =
128                 container_of(work, struct uas_dev_info, work);
129         struct uas_cmd_info *cmdinfo;
130         unsigned long flags;
131         int err;
132
133         spin_lock_irqsave(&devinfo->lock, flags);
134
135         if (devinfo->resetting)
136                 goto out;
137
138         list_for_each_entry(cmdinfo, &devinfo->inflight_list, list) {
139                 struct scsi_pointer *scp = (void *)cmdinfo;
140                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
141                                                       SCp);
142
143                 if (!(cmdinfo->state & IS_IN_WORK_LIST))
144                         continue;
145
146                 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
147                 if (!err)
148                         cmdinfo->state &= ~IS_IN_WORK_LIST;
149                 else
150                         schedule_work(&devinfo->work);
151         }
152 out:
153         spin_unlock_irqrestore(&devinfo->lock, flags);
154 }
155
156 static void uas_mark_cmd_dead(struct uas_dev_info *devinfo,
157                               struct uas_cmd_info *cmdinfo,
158                               int result, const char *caller)
159 {
160         struct scsi_pointer *scp = (void *)cmdinfo;
161         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
162
163         uas_log_cmd_state(cmnd, caller);
164         lockdep_assert_held(&devinfo->lock);
165         WARN_ON_ONCE(cmdinfo->state & COMMAND_ABORTED);
166         cmdinfo->state |= COMMAND_ABORTED;
167         cmdinfo->state &= ~IS_IN_WORK_LIST;
168         cmnd->result = result << 16;
169         list_move_tail(&cmdinfo->list, &devinfo->dead_list);
170 }
171
172 static void uas_abort_inflight(struct uas_dev_info *devinfo, int result,
173                                const char *caller)
174 {
175         struct uas_cmd_info *cmdinfo;
176         struct uas_cmd_info *temp;
177         unsigned long flags;
178
179         spin_lock_irqsave(&devinfo->lock, flags);
180         list_for_each_entry_safe(cmdinfo, temp, &devinfo->inflight_list, list)
181                 uas_mark_cmd_dead(devinfo, cmdinfo, result, caller);
182         spin_unlock_irqrestore(&devinfo->lock, flags);
183 }
184
185 static void uas_add_work(struct uas_cmd_info *cmdinfo)
186 {
187         struct scsi_pointer *scp = (void *)cmdinfo;
188         struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd, SCp);
189         struct uas_dev_info *devinfo = cmnd->device->hostdata;
190
191         lockdep_assert_held(&devinfo->lock);
192         cmdinfo->state |= IS_IN_WORK_LIST;
193         schedule_work(&devinfo->work);
194 }
195
196 static void uas_zap_dead(struct uas_dev_info *devinfo)
197 {
198         struct uas_cmd_info *cmdinfo;
199         struct uas_cmd_info *temp;
200         unsigned long flags;
201
202         spin_lock_irqsave(&devinfo->lock, flags);
203         list_for_each_entry_safe(cmdinfo, temp, &devinfo->dead_list, list) {
204                 struct scsi_pointer *scp = (void *)cmdinfo;
205                 struct scsi_cmnd *cmnd = container_of(scp, struct scsi_cmnd,
206                                                       SCp);
207                 uas_log_cmd_state(cmnd, __func__);
208                 WARN_ON_ONCE(!(cmdinfo->state & COMMAND_ABORTED));
209                 /* all urbs are killed, clear inflight bits */
210                 cmdinfo->state &= ~(COMMAND_INFLIGHT |
211                                     DATA_IN_URB_INFLIGHT |
212                                     DATA_OUT_URB_INFLIGHT);
213                 uas_try_complete(cmnd, __func__);
214         }
215         spin_unlock_irqrestore(&devinfo->lock, flags);
216 }
217
218 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
219 {
220         struct sense_iu *sense_iu = urb->transfer_buffer;
221         struct scsi_device *sdev = cmnd->device;
222
223         if (urb->actual_length > 16) {
224                 unsigned len = be16_to_cpup(&sense_iu->len);
225                 if (len + 16 != urb->actual_length) {
226                         int newlen = min(len + 16, urb->actual_length) - 16;
227                         if (newlen < 0)
228                                 newlen = 0;
229                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
230                                 "disagrees with IU sense data length %d, "
231                                 "using %d bytes of sense data\n", __func__,
232                                         urb->actual_length, len, newlen);
233                         len = newlen;
234                 }
235                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
236         }
237
238         cmnd->result = sense_iu->status;
239 }
240
241 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
242 {
243         struct sense_iu_old *sense_iu = urb->transfer_buffer;
244         struct scsi_device *sdev = cmnd->device;
245
246         if (urb->actual_length > 8) {
247                 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
248                 if (len + 8 != urb->actual_length) {
249                         int newlen = min(len + 8, urb->actual_length) - 8;
250                         if (newlen < 0)
251                                 newlen = 0;
252                         sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
253                                 "disagrees with IU sense data length %d, "
254                                 "using %d bytes of sense data\n", __func__,
255                                         urb->actual_length, len, newlen);
256                         len = newlen;
257                 }
258                 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
259         }
260
261         cmnd->result = sense_iu->status;
262 }
263
264 /*
265  * scsi-tags go from 0 - (nr_tags - 1), uas tags need to match stream-ids,
266  * which go from 1 - nr_streams. And we use 1 for untagged commands.
267  */
268 static int uas_get_tag(struct scsi_cmnd *cmnd)
269 {
270         int tag;
271
272         if (blk_rq_tagged(cmnd->request))
273                 tag = cmnd->request->tag + 2;
274         else
275                 tag = 1;
276
277         return tag;
278 }
279
280 static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller)
281 {
282         struct uas_cmd_info *ci = (void *)&cmnd->SCp;
283
284         scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:"
285                     "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n",
286                     caller, cmnd, uas_get_tag(cmnd),
287                     (ci->state & SUBMIT_STATUS_URB)     ? " s-st"  : "",
288                     (ci->state & ALLOC_DATA_IN_URB)     ? " a-in"  : "",
289                     (ci->state & SUBMIT_DATA_IN_URB)    ? " s-in"  : "",
290                     (ci->state & ALLOC_DATA_OUT_URB)    ? " a-out" : "",
291                     (ci->state & SUBMIT_DATA_OUT_URB)   ? " s-out" : "",
292                     (ci->state & ALLOC_CMD_URB)         ? " a-cmd" : "",
293                     (ci->state & SUBMIT_CMD_URB)        ? " s-cmd" : "",
294                     (ci->state & COMMAND_INFLIGHT)      ? " CMD"   : "",
295                     (ci->state & DATA_IN_URB_INFLIGHT)  ? " IN"    : "",
296                     (ci->state & DATA_OUT_URB_INFLIGHT) ? " OUT"   : "",
297                     (ci->state & COMMAND_COMPLETED)     ? " done"  : "",
298                     (ci->state & COMMAND_ABORTED)       ? " abort" : "",
299                     (ci->state & UNLINK_DATA_URBS)      ? " unlink": "",
300                     (ci->state & IS_IN_WORK_LIST)       ? " work"  : "");
301 }
302
303 static int uas_try_complete(struct scsi_cmnd *cmnd, const char *caller)
304 {
305         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
306         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
307
308         lockdep_assert_held(&devinfo->lock);
309         if (cmdinfo->state & (COMMAND_INFLIGHT |
310                               DATA_IN_URB_INFLIGHT |
311                               DATA_OUT_URB_INFLIGHT |
312                               UNLINK_DATA_URBS))
313                 return -EBUSY;
314         WARN_ON_ONCE(cmdinfo->state & COMMAND_COMPLETED);
315         cmdinfo->state |= COMMAND_COMPLETED;
316         usb_free_urb(cmdinfo->data_in_urb);
317         usb_free_urb(cmdinfo->data_out_urb);
318         if (cmdinfo->state & COMMAND_ABORTED)
319                 scmd_printk(KERN_INFO, cmnd, "abort completed\n");
320         list_del(&cmdinfo->list);
321         devinfo->cmnd[uas_get_tag(cmnd) - 1] = NULL;
322         cmnd->scsi_done(cmnd);
323         return 0;
324 }
325
326 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
327                           unsigned direction)
328 {
329         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
330         int err;
331
332         cmdinfo->state |= direction | SUBMIT_STATUS_URB;
333         err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
334         if (err) {
335                 uas_add_work(cmdinfo);
336         }
337 }
338
339 static void uas_stat_cmplt(struct urb *urb)
340 {
341         struct iu *iu = urb->transfer_buffer;
342         struct Scsi_Host *shost = urb->context;
343         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
344         struct scsi_cmnd *cmnd;
345         struct uas_cmd_info *cmdinfo;
346         unsigned long flags;
347         unsigned int idx;
348
349         spin_lock_irqsave(&devinfo->lock, flags);
350
351         if (devinfo->resetting)
352                 goto out;
353
354         if (urb->status) {
355                 if (urb->status == -ENOENT) {
356                         dev_err(&urb->dev->dev, "stat urb: killed, stream %d\n",
357                                 urb->stream_id);
358                 } else {
359                         dev_err(&urb->dev->dev, "stat urb: status %d\n",
360                                 urb->status);
361                 }
362                 goto out;
363         }
364
365         idx = be16_to_cpup(&iu->tag) - 1;
366         if (idx >= MAX_CMNDS || !devinfo->cmnd[idx]) {
367                 dev_err(&urb->dev->dev,
368                         "stat urb: no pending cmd for tag %d\n", idx + 1);
369                 goto out;
370         }
371
372         cmnd = devinfo->cmnd[idx];
373         cmdinfo = (void *)&cmnd->SCp;
374
375         if (!(cmdinfo->state & COMMAND_INFLIGHT)) {
376                 scmd_printk(KERN_ERR, cmnd, "unexpected status cmplt\n");
377                 goto out;
378         }
379
380         switch (iu->iu_id) {
381         case IU_ID_STATUS:
382                 if (urb->actual_length < 16)
383                         devinfo->uas_sense_old = 1;
384                 if (devinfo->uas_sense_old)
385                         uas_sense_old(urb, cmnd);
386                 else
387                         uas_sense(urb, cmnd);
388                 if (cmnd->result != 0) {
389                         /* cancel data transfers on error */
390                         uas_unlink_data_urbs(devinfo, cmdinfo, &flags);
391                 }
392                 cmdinfo->state &= ~COMMAND_INFLIGHT;
393                 uas_try_complete(cmnd, __func__);
394                 break;
395         case IU_ID_READ_READY:
396                 if (!cmdinfo->data_in_urb ||
397                                 (cmdinfo->state & DATA_IN_URB_INFLIGHT)) {
398                         scmd_printk(KERN_ERR, cmnd, "unexpected read rdy\n");
399                         break;
400                 }
401                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
402                 break;
403         case IU_ID_WRITE_READY:
404                 if (!cmdinfo->data_out_urb ||
405                                 (cmdinfo->state & DATA_OUT_URB_INFLIGHT)) {
406                         scmd_printk(KERN_ERR, cmnd, "unexpected write rdy\n");
407                         break;
408                 }
409                 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
410                 break;
411         default:
412                 scmd_printk(KERN_ERR, cmnd,
413                         "Bogus IU (%d) received on status pipe\n", iu->iu_id);
414         }
415 out:
416         usb_free_urb(urb);
417         spin_unlock_irqrestore(&devinfo->lock, flags);
418 }
419
420 static void uas_data_cmplt(struct urb *urb)
421 {
422         struct scsi_cmnd *cmnd = urb->context;
423         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
424         struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
425         struct scsi_data_buffer *sdb = NULL;
426         unsigned long flags;
427
428         spin_lock_irqsave(&devinfo->lock, flags);
429
430         if (cmdinfo->data_in_urb == urb) {
431                 sdb = scsi_in(cmnd);
432                 cmdinfo->state &= ~DATA_IN_URB_INFLIGHT;
433         } else if (cmdinfo->data_out_urb == urb) {
434                 sdb = scsi_out(cmnd);
435                 cmdinfo->state &= ~DATA_OUT_URB_INFLIGHT;
436         }
437         if (sdb == NULL) {
438                 WARN_ON_ONCE(1);
439                 goto out;
440         }
441
442         if (devinfo->resetting)
443                 goto out;
444
445         /* Data urbs should not complete before the cmd urb is submitted */
446         if (cmdinfo->state & SUBMIT_CMD_URB) {
447                 scmd_printk(KERN_ERR, cmnd, "unexpected data cmplt\n");
448                 goto out;
449         }
450
451         if (urb->status) {
452                 if (urb->status != -ECONNRESET) {
453                         uas_log_cmd_state(cmnd, __func__);
454                         scmd_printk(KERN_ERR, cmnd,
455                                 "data cmplt err %d stream %d\n",
456                                 urb->status, urb->stream_id);
457                 }
458                 /* error: no data transfered */
459                 sdb->resid = sdb->length;
460         } else {
461                 sdb->resid = sdb->length - urb->actual_length;
462         }
463         uas_try_complete(cmnd, __func__);
464 out:
465         spin_unlock_irqrestore(&devinfo->lock, flags);
466 }
467
468 static void uas_cmd_cmplt(struct urb *urb)
469 {
470         struct scsi_cmnd *cmnd = urb->context;
471
472         if (urb->status) {
473                 uas_log_cmd_state(cmnd, __func__);
474                 scmd_printk(KERN_ERR, cmnd, "cmd cmplt err %d\n", urb->status);
475         }
476         usb_free_urb(urb);
477 }
478
479 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
480                                       unsigned int pipe, u16 stream_id,
481                                       struct scsi_cmnd *cmnd,
482                                       enum dma_data_direction dir)
483 {
484         struct usb_device *udev = devinfo->udev;
485         struct urb *urb = usb_alloc_urb(0, gfp);
486         struct scsi_data_buffer *sdb = (dir == DMA_FROM_DEVICE)
487                 ? scsi_in(cmnd) : scsi_out(cmnd);
488
489         if (!urb)
490                 goto out;
491         usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length,
492                           uas_data_cmplt, cmnd);
493         urb->stream_id = stream_id;
494         urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
495         urb->sg = sdb->table.sgl;
496  out:
497         return urb;
498 }
499
500 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
501                                        struct Scsi_Host *shost, u16 stream_id)
502 {
503         struct usb_device *udev = devinfo->udev;
504         struct urb *urb = usb_alloc_urb(0, gfp);
505         struct sense_iu *iu;
506
507         if (!urb)
508                 goto out;
509
510         iu = kzalloc(sizeof(*iu), gfp);
511         if (!iu)
512                 goto free;
513
514         usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
515                                                 uas_stat_cmplt, shost);
516         urb->stream_id = stream_id;
517         urb->transfer_flags |= URB_FREE_BUFFER;
518  out:
519         return urb;
520  free:
521         usb_free_urb(urb);
522         return NULL;
523 }
524
525 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
526                                         struct scsi_cmnd *cmnd)
527 {
528         struct usb_device *udev = devinfo->udev;
529         struct scsi_device *sdev = cmnd->device;
530         struct urb *urb = usb_alloc_urb(0, gfp);
531         struct command_iu *iu;
532         int len;
533
534         if (!urb)
535                 goto out;
536
537         len = cmnd->cmd_len - 16;
538         if (len < 0)
539                 len = 0;
540         len = ALIGN(len, 4);
541         iu = kzalloc(sizeof(*iu) + len, gfp);
542         if (!iu)
543                 goto free;
544
545         iu->iu_id = IU_ID_COMMAND;
546         iu->tag = cpu_to_be16(uas_get_tag(cmnd));
547         iu->prio_attr = UAS_SIMPLE_TAG;
548         iu->len = len;
549         int_to_scsilun(sdev->lun, &iu->lun);
550         memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
551
552         usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
553                                                         uas_cmd_cmplt, cmnd);
554         urb->transfer_flags |= URB_FREE_BUFFER;
555  out:
556         return urb;
557  free:
558         usb_free_urb(urb);
559         return NULL;
560 }
561
562 /*
563  * Why should I request the Status IU before sending the Command IU?  Spec
564  * says to, but also says the device may receive them in any order.  Seems
565  * daft to me.
566  */
567
568 static struct urb *uas_submit_sense_urb(struct scsi_cmnd *cmnd,
569                                         gfp_t gfp, unsigned int stream)
570 {
571         struct Scsi_Host *shost = cmnd->device->host;
572         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
573         struct urb *urb;
574         int err;
575
576         urb = uas_alloc_sense_urb(devinfo, gfp, shost, stream);
577         if (!urb)
578                 return NULL;
579         usb_anchor_urb(urb, &devinfo->sense_urbs);
580         err = usb_submit_urb(urb, gfp);
581         if (err) {
582                 usb_unanchor_urb(urb);
583                 uas_log_cmd_state(cmnd, __func__);
584                 shost_printk(KERN_INFO, shost,
585                              "sense urb submission error %d stream %d\n",
586                              err, stream);
587                 usb_free_urb(urb);
588                 return NULL;
589         }
590         return urb;
591 }
592
593 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
594                            struct uas_dev_info *devinfo, gfp_t gfp)
595 {
596         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
597         struct urb *urb;
598         int err;
599
600         lockdep_assert_held(&devinfo->lock);
601         if (cmdinfo->state & SUBMIT_STATUS_URB) {
602                 urb = uas_submit_sense_urb(cmnd, gfp, cmdinfo->stream);
603                 if (!urb)
604                         return SCSI_MLQUEUE_DEVICE_BUSY;
605                 cmdinfo->state &= ~SUBMIT_STATUS_URB;
606         }
607
608         if (cmdinfo->state & ALLOC_DATA_IN_URB) {
609                 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
610                                         devinfo->data_in_pipe, cmdinfo->stream,
611                                         cmnd, DMA_FROM_DEVICE);
612                 if (!cmdinfo->data_in_urb)
613                         return SCSI_MLQUEUE_DEVICE_BUSY;
614                 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
615         }
616
617         if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
618                 usb_anchor_urb(cmdinfo->data_in_urb, &devinfo->data_urbs);
619                 err = usb_submit_urb(cmdinfo->data_in_urb, gfp);
620                 if (err) {
621                         usb_unanchor_urb(cmdinfo->data_in_urb);
622                         uas_log_cmd_state(cmnd, __func__);
623                         scmd_printk(KERN_INFO, cmnd,
624                                 "data in urb submission error %d stream %d\n",
625                                 err, cmdinfo->data_in_urb->stream_id);
626                         return SCSI_MLQUEUE_DEVICE_BUSY;
627                 }
628                 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
629                 cmdinfo->state |= DATA_IN_URB_INFLIGHT;
630         }
631
632         if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
633                 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
634                                         devinfo->data_out_pipe, cmdinfo->stream,
635                                         cmnd, DMA_TO_DEVICE);
636                 if (!cmdinfo->data_out_urb)
637                         return SCSI_MLQUEUE_DEVICE_BUSY;
638                 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
639         }
640
641         if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
642                 usb_anchor_urb(cmdinfo->data_out_urb, &devinfo->data_urbs);
643                 err = usb_submit_urb(cmdinfo->data_out_urb, gfp);
644                 if (err) {
645                         usb_unanchor_urb(cmdinfo->data_out_urb);
646                         uas_log_cmd_state(cmnd, __func__);
647                         scmd_printk(KERN_INFO, cmnd,
648                                 "data out urb submission error %d stream %d\n",
649                                 err, cmdinfo->data_out_urb->stream_id);
650                         return SCSI_MLQUEUE_DEVICE_BUSY;
651                 }
652                 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
653                 cmdinfo->state |= DATA_OUT_URB_INFLIGHT;
654         }
655
656         if (cmdinfo->state & ALLOC_CMD_URB) {
657                 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd);
658                 if (!cmdinfo->cmd_urb)
659                         return SCSI_MLQUEUE_DEVICE_BUSY;
660                 cmdinfo->state &= ~ALLOC_CMD_URB;
661         }
662
663         if (cmdinfo->state & SUBMIT_CMD_URB) {
664                 usb_anchor_urb(cmdinfo->cmd_urb, &devinfo->cmd_urbs);
665                 err = usb_submit_urb(cmdinfo->cmd_urb, gfp);
666                 if (err) {
667                         usb_unanchor_urb(cmdinfo->cmd_urb);
668                         uas_log_cmd_state(cmnd, __func__);
669                         scmd_printk(KERN_INFO, cmnd,
670                                     "cmd urb submission error %d\n", err);
671                         return SCSI_MLQUEUE_DEVICE_BUSY;
672                 }
673                 cmdinfo->cmd_urb = NULL;
674                 cmdinfo->state &= ~SUBMIT_CMD_URB;
675                 cmdinfo->state |= COMMAND_INFLIGHT;
676         }
677
678         return 0;
679 }
680
681 static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
682                                         void (*done)(struct scsi_cmnd *))
683 {
684         struct scsi_device *sdev = cmnd->device;
685         struct uas_dev_info *devinfo = sdev->hostdata;
686         struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
687         unsigned long flags;
688         unsigned int stream;
689         int err;
690
691         BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
692
693         if ((devinfo->flags & US_FL_NO_ATA_1X) &&
694                         (cmnd->cmnd[0] == ATA_12 || cmnd->cmnd[0] == ATA_16)) {
695                 memcpy(cmnd->sense_buffer, usb_stor_sense_invalidCDB,
696                        sizeof(usb_stor_sense_invalidCDB));
697                 cmnd->result = SAM_STAT_CHECK_CONDITION;
698                 cmnd->scsi_done(cmnd);
699                 return 0;
700         }
701
702         spin_lock_irqsave(&devinfo->lock, flags);
703
704         if (devinfo->resetting) {
705                 cmnd->result = DID_ERROR << 16;
706                 cmnd->scsi_done(cmnd);
707                 spin_unlock_irqrestore(&devinfo->lock, flags);
708                 return 0;
709         }
710
711         stream = uas_get_tag(cmnd);
712         if (devinfo->cmnd[stream - 1]) {
713                 spin_unlock_irqrestore(&devinfo->lock, flags);
714                 return SCSI_MLQUEUE_DEVICE_BUSY;
715         }
716
717         cmnd->scsi_done = done;
718
719         memset(cmdinfo, 0, sizeof(*cmdinfo));
720         cmdinfo->stream = stream;
721         cmdinfo->state = SUBMIT_STATUS_URB | ALLOC_CMD_URB | SUBMIT_CMD_URB;
722
723         switch (cmnd->sc_data_direction) {
724         case DMA_FROM_DEVICE:
725                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
726                 break;
727         case DMA_BIDIRECTIONAL:
728                 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
729         case DMA_TO_DEVICE:
730                 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
731         case DMA_NONE:
732                 break;
733         }
734
735         if (!devinfo->use_streams) {
736                 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
737                 cmdinfo->stream = 0;
738         }
739
740         err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
741         if (err) {
742                 /* If we did nothing, give up now */
743                 if (cmdinfo->state & SUBMIT_STATUS_URB) {
744                         spin_unlock_irqrestore(&devinfo->lock, flags);
745                         return SCSI_MLQUEUE_DEVICE_BUSY;
746                 }
747                 uas_add_work(cmdinfo);
748         }
749
750         devinfo->cmnd[stream - 1] = cmnd;
751         list_add_tail(&cmdinfo->list, &devinfo->inflight_list);
752         spin_unlock_irqrestore(&devinfo->lock, flags);
753         return 0;
754 }
755
756 static DEF_SCSI_QCMD(uas_queuecommand)
757
758 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
759 {
760         struct scsi_device *sdev = cmnd->device;
761         struct uas_dev_info *devinfo = sdev->hostdata;
762         struct usb_device *udev = devinfo->udev;
763         unsigned long flags;
764         int err;
765
766         err = usb_lock_device_for_reset(udev, devinfo->intf);
767         if (err) {
768                 shost_printk(KERN_ERR, sdev->host,
769                              "%s FAILED to get lock err %d\n", __func__, err);
770                 return FAILED;
771         }
772
773         shost_printk(KERN_INFO, sdev->host, "%s start\n", __func__);
774
775         spin_lock_irqsave(&devinfo->lock, flags);
776         devinfo->resetting = 1;
777         spin_unlock_irqrestore(&devinfo->lock, flags);
778
779         uas_abort_inflight(devinfo, DID_RESET, __func__);
780         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
781         usb_kill_anchored_urbs(&devinfo->sense_urbs);
782         usb_kill_anchored_urbs(&devinfo->data_urbs);
783         uas_zap_dead(devinfo);
784         err = usb_reset_device(udev);
785
786         spin_lock_irqsave(&devinfo->lock, flags);
787         devinfo->resetting = 0;
788         spin_unlock_irqrestore(&devinfo->lock, flags);
789
790         usb_unlock_device(udev);
791
792         if (err) {
793                 shost_printk(KERN_INFO, sdev->host, "%s FAILED\n", __func__);
794                 return FAILED;
795         }
796
797         shost_printk(KERN_INFO, sdev->host, "%s success\n", __func__);
798         return SUCCESS;
799 }
800
801 static int uas_slave_alloc(struct scsi_device *sdev)
802 {
803         sdev->hostdata = (void *)sdev->host->hostdata;
804
805         /* USB has unusual DMA-alignment requirements: Although the
806          * starting address of each scatter-gather element doesn't matter,
807          * the length of each element except the last must be divisible
808          * by the Bulk maxpacket value.  There's currently no way to
809          * express this by block-layer constraints, so we'll cop out
810          * and simply require addresses to be aligned at 512-byte
811          * boundaries.  This is okay since most block I/O involves
812          * hardware sectors that are multiples of 512 bytes in length,
813          * and since host controllers up through USB 2.0 have maxpacket
814          * values no larger than 512.
815          *
816          * But it doesn't suffice for Wireless USB, where Bulk maxpacket
817          * values can be as large as 2048.  To make that work properly
818          * will require changes to the block layer.
819          */
820         blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
821
822         return 0;
823 }
824
825 static int uas_slave_configure(struct scsi_device *sdev)
826 {
827         struct uas_dev_info *devinfo = sdev->hostdata;
828
829         if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
830                 sdev->no_report_opcodes = 1;
831
832         scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
833         scsi_activate_tcq(sdev, devinfo->qdepth - 2);
834         return 0;
835 }
836
837 static struct scsi_host_template uas_host_template = {
838         .module = THIS_MODULE,
839         .name = "uas",
840         .queuecommand = uas_queuecommand,
841         .slave_alloc = uas_slave_alloc,
842         .slave_configure = uas_slave_configure,
843         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
844         .can_queue = 65536,     /* Is there a limit on the _host_ ? */
845         .this_id = -1,
846         .sg_tablesize = SG_NONE,
847         .cmd_per_lun = 1,       /* until we override it */
848         .skip_settle_delay = 1,
849         .ordered_tag = 1,
850 };
851
852 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
853                     vendorName, productName, useProtocol, useTransport, \
854                     initFunction, flags) \
855 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
856         .driver_info = (flags) }
857
858 static struct usb_device_id uas_usb_ids[] = {
859 #       include "unusual_uas.h"
860         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
861         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
862         /* 0xaa is a prototype device I happen to have access to */
863         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
864         { }
865 };
866 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
867
868 #undef UNUSUAL_DEV
869
870 static int uas_switch_interface(struct usb_device *udev,
871                                 struct usb_interface *intf)
872 {
873         int alt;
874
875         alt = uas_find_uas_alt_setting(intf);
876         if (alt < 0)
877                 return alt;
878
879         return usb_set_interface(udev,
880                         intf->altsetting[0].desc.bInterfaceNumber, alt);
881 }
882
883 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
884 {
885         struct usb_host_endpoint *eps[4] = { };
886         struct usb_device *udev = devinfo->udev;
887         int r;
888
889         devinfo->uas_sense_old = 0;
890
891         r = uas_find_endpoints(devinfo->intf->cur_altsetting, eps);
892         if (r)
893                 return r;
894
895         devinfo->cmd_pipe = usb_sndbulkpipe(udev,
896                                             usb_endpoint_num(&eps[0]->desc));
897         devinfo->status_pipe = usb_rcvbulkpipe(udev,
898                                             usb_endpoint_num(&eps[1]->desc));
899         devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
900                                             usb_endpoint_num(&eps[2]->desc));
901         devinfo->data_out_pipe = usb_sndbulkpipe(udev,
902                                             usb_endpoint_num(&eps[3]->desc));
903
904         if (udev->speed != USB_SPEED_SUPER) {
905                 devinfo->qdepth = 32;
906                 devinfo->use_streams = 0;
907         } else {
908                 devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1,
909                                                     3, MAX_CMNDS, GFP_NOIO);
910                 if (devinfo->qdepth < 0)
911                         return devinfo->qdepth;
912                 devinfo->use_streams = 1;
913         }
914
915         return 0;
916 }
917
918 static void uas_free_streams(struct uas_dev_info *devinfo)
919 {
920         struct usb_device *udev = devinfo->udev;
921         struct usb_host_endpoint *eps[3];
922
923         eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
924         eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
925         eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
926         usb_free_streams(devinfo->intf, eps, 3, GFP_NOIO);
927 }
928
929 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
930 {
931         int result = -ENOMEM;
932         struct Scsi_Host *shost = NULL;
933         struct uas_dev_info *devinfo;
934         struct usb_device *udev = interface_to_usbdev(intf);
935
936         if (!uas_use_uas_driver(intf, id))
937                 return -ENODEV;
938
939         if (uas_switch_interface(udev, intf))
940                 return -ENODEV;
941
942         shost = scsi_host_alloc(&uas_host_template,
943                                 sizeof(struct uas_dev_info));
944         if (!shost)
945                 goto set_alt0;
946
947         shost->max_cmd_len = 16 + 252;
948         shost->max_id = 1;
949         shost->max_lun = 256;
950         shost->max_channel = 0;
951         shost->sg_tablesize = udev->bus->sg_tablesize;
952
953         devinfo = (struct uas_dev_info *)shost->hostdata;
954         devinfo->intf = intf;
955         devinfo->udev = udev;
956         devinfo->resetting = 0;
957         devinfo->shutdown = 0;
958         devinfo->flags = id->driver_info;
959         usb_stor_adjust_quirks(udev, &devinfo->flags);
960         init_usb_anchor(&devinfo->cmd_urbs);
961         init_usb_anchor(&devinfo->sense_urbs);
962         init_usb_anchor(&devinfo->data_urbs);
963         spin_lock_init(&devinfo->lock);
964         INIT_WORK(&devinfo->work, uas_do_work);
965         INIT_LIST_HEAD(&devinfo->inflight_list);
966         INIT_LIST_HEAD(&devinfo->dead_list);
967
968         result = uas_configure_endpoints(devinfo);
969         if (result)
970                 goto set_alt0;
971
972         result = scsi_init_shared_tag_map(shost, devinfo->qdepth - 2);
973         if (result)
974                 goto free_streams;
975
976         usb_set_intfdata(intf, shost);
977         result = scsi_add_host(shost, &intf->dev);
978         if (result)
979                 goto free_streams;
980
981         scsi_scan_host(shost);
982         return result;
983
984 free_streams:
985         uas_free_streams(devinfo);
986         usb_set_intfdata(intf, NULL);
987 set_alt0:
988         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
989         if (shost)
990                 scsi_host_put(shost);
991         return result;
992 }
993
994 static int uas_pre_reset(struct usb_interface *intf)
995 {
996         struct Scsi_Host *shost = usb_get_intfdata(intf);
997         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
998         unsigned long flags;
999
1000         if (devinfo->shutdown)
1001                 return 0;
1002
1003         /* Block new requests */
1004         spin_lock_irqsave(shost->host_lock, flags);
1005         scsi_block_requests(shost);
1006         spin_unlock_irqrestore(shost->host_lock, flags);
1007
1008         /* Wait for any pending requests to complete */
1009         flush_work(&devinfo->work);
1010         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1011                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1012                 return 1;
1013         }
1014
1015         uas_free_streams(devinfo);
1016
1017         return 0;
1018 }
1019
1020 static int uas_post_reset(struct usb_interface *intf)
1021 {
1022         struct Scsi_Host *shost = usb_get_intfdata(intf);
1023         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1024         unsigned long flags;
1025
1026         if (devinfo->shutdown)
1027                 return 0;
1028
1029         if (uas_configure_endpoints(devinfo) != 0) {
1030                 shost_printk(KERN_ERR, shost,
1031                              "%s: alloc streams error after reset", __func__);
1032                 return 1;
1033         }
1034
1035         spin_lock_irqsave(shost->host_lock, flags);
1036         scsi_report_bus_reset(shost, 0);
1037         spin_unlock_irqrestore(shost->host_lock, flags);
1038
1039         scsi_unblock_requests(shost);
1040
1041         return 0;
1042 }
1043
1044 static int uas_suspend(struct usb_interface *intf, pm_message_t message)
1045 {
1046         struct Scsi_Host *shost = usb_get_intfdata(intf);
1047         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1048
1049         /* Wait for any pending requests to complete */
1050         flush_work(&devinfo->work);
1051         if (usb_wait_anchor_empty_timeout(&devinfo->sense_urbs, 5000) == 0) {
1052                 shost_printk(KERN_ERR, shost, "%s: timed out\n", __func__);
1053                 return -ETIME;
1054         }
1055
1056         return 0;
1057 }
1058
1059 static int uas_resume(struct usb_interface *intf)
1060 {
1061         return 0;
1062 }
1063
1064 static int uas_reset_resume(struct usb_interface *intf)
1065 {
1066         struct Scsi_Host *shost = usb_get_intfdata(intf);
1067         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1068         unsigned long flags;
1069
1070         if (uas_configure_endpoints(devinfo) != 0) {
1071                 shost_printk(KERN_ERR, shost,
1072                              "%s: alloc streams error after reset", __func__);
1073                 return -EIO;
1074         }
1075
1076         spin_lock_irqsave(shost->host_lock, flags);
1077         scsi_report_bus_reset(shost, 0);
1078         spin_unlock_irqrestore(shost->host_lock, flags);
1079
1080         return 0;
1081 }
1082
1083 static void uas_disconnect(struct usb_interface *intf)
1084 {
1085         struct Scsi_Host *shost = usb_get_intfdata(intf);
1086         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1087         unsigned long flags;
1088
1089         spin_lock_irqsave(&devinfo->lock, flags);
1090         devinfo->resetting = 1;
1091         spin_unlock_irqrestore(&devinfo->lock, flags);
1092
1093         cancel_work_sync(&devinfo->work);
1094         uas_abort_inflight(devinfo, DID_NO_CONNECT, __func__);
1095         usb_kill_anchored_urbs(&devinfo->cmd_urbs);
1096         usb_kill_anchored_urbs(&devinfo->sense_urbs);
1097         usb_kill_anchored_urbs(&devinfo->data_urbs);
1098         uas_zap_dead(devinfo);
1099         scsi_remove_host(shost);
1100         uas_free_streams(devinfo);
1101         scsi_host_put(shost);
1102 }
1103
1104 /*
1105  * Put the device back in usb-storage mode on shutdown, as some BIOS-es
1106  * hang on reboot when the device is still in uas mode. Note the reset is
1107  * necessary as some devices won't revert to usb-storage mode without it.
1108  */
1109 static void uas_shutdown(struct device *dev)
1110 {
1111         struct usb_interface *intf = to_usb_interface(dev);
1112         struct usb_device *udev = interface_to_usbdev(intf);
1113         struct Scsi_Host *shost = usb_get_intfdata(intf);
1114         struct uas_dev_info *devinfo = (struct uas_dev_info *)shost->hostdata;
1115
1116         if (system_state != SYSTEM_RESTART)
1117                 return;
1118
1119         devinfo->shutdown = 1;
1120         uas_free_streams(devinfo);
1121         usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
1122         usb_reset_device(udev);
1123 }
1124
1125 static struct usb_driver uas_driver = {
1126         .name = "uas",
1127         .probe = uas_probe,
1128         .disconnect = uas_disconnect,
1129         .pre_reset = uas_pre_reset,
1130         .post_reset = uas_post_reset,
1131         .suspend = uas_suspend,
1132         .resume = uas_resume,
1133         .reset_resume = uas_reset_resume,
1134         .drvwrap.driver.shutdown = uas_shutdown,
1135         .id_table = uas_usb_ids,
1136 };
1137
1138 module_usb_driver(uas_driver);
1139
1140 MODULE_LICENSE("GPL");
1141 MODULE_AUTHOR(
1142         "Hans de Goede <hdegoede@redhat.com>, Matthew Wilcox and Sarah Sharp");