err.no Git - linux-2.6/blob - drivers/block/ub.c

   1 /*
   2  * The low performance USB storage driver (ub).
   3  *
   4  * Copyright (c) 1999, 2000 Matthew Dharm (mdharm-usb@one-eyed-alien.net)
   5  * Copyright (C) 2004 Pete Zaitcev (zaitcev@yahoo.com)
   6  *
   7  * This work is a part of Linux kernel, is derived from it,
   8  * and is not licensed separately. See file COPYING for details.
   9  *
  10  * TODO (sorted by decreasing priority)
  11  *  -- Return sense now that rq allows it (we always auto-sense anyway).
  12  *  -- set readonly flag for CDs, set removable flag for CF readers
  13  *  -- do inquiry and verify we got a disk and not a tape (for LUN mismatch)
  14  *  -- verify the 13 conditions and do bulk resets
  15  *  -- highmem
  16  *  -- move top_sense and work_bcs into separate allocations (if they survive)
  17  *     for cache purists and esoteric architectures.
  18  *  -- Allocate structure for LUN 0 before the first ub_sync_tur, avoid NULL. ?
  19  *  -- prune comments, they are too volumnous
  20  *  -- Resove XXX's
  21  *  -- CLEAR, CLR2STS, CLRRS seem to be ripe for refactoring.
  22  */
  23 #include <linux/kernel.h>
  24 #include <linux/module.h>
  25 #include <linux/usb.h>
  26 #include <linux/usb_usual.h>
  27 #include <linux/blkdev.h>
  28 #include <linux/timer.h>
  29 #include <linux/scatterlist.h>
  30 #include <scsi/scsi.h>
  31
  32 #define DRV_NAME "ub"
  33
  34 #define UB_MAJOR 180
  35
  36 /*
  37  * The command state machine is the key model for understanding of this driver.
  38  *
  39  * The general rule is that all transitions are done towards the bottom
  40  * of the diagram, thus preventing any loops.
  41  *
  42  * An exception to that is how the STAT state is handled. A counter allows it
  43  * to be re-entered along the path marked with [C].
  44  *
  45  *       +--------+
  46  *       ! INIT   !
  47  *       +--------+
  48  *           !
  49  *        ub_scsi_cmd_start fails ->--------------------------------------\
  50  *           !                                                            !
  51  *           V                                                            !
  52  *       +--------+                                                       !
  53  *       ! CMD    !                                                       !
  54  *       +--------+                                                       !
  55  *           !                                            +--------+      !
  56  *         was -EPIPE -->-------------------------------->! CLEAR  !      !
  57  *           !                                            +--------+      !
  58  *           !                                                !           !
  59  *         was error -->------------------------------------- ! --------->\
  60  *           !                                                !           !
  61  *  /--<-- cmd->dir == NONE ?                                 !           !
  62  *  !        !                                                !           !
  63  *  !        V                                                !           !
  64  *  !    +--------+                                           !           !
  65  *  !    ! DATA   !                                           !           !
  66  *  !    +--------+                                           !           !
  67  *  !        !                           +---------+          !           !
  68  *  !      was -EPIPE -->--------------->! CLR2STS !          !           !
  69  *  !        !                           +---------+          !           !
  70  *  !        !                                !               !           !
  71  *  !        !                              was error -->---- ! --------->\
  72  *  !      was error -->--------------------- ! ------------- ! --------->\
  73  *  !        !                                !               !           !
  74  *  !        V                                !               !           !
  75  *  \--->+--------+                           !               !           !
  76  *       ! STAT   !<--------------------------/               !           !
  77  *  /--->+--------+                                           !           !
  78  *  !        !                                                !           !
  79  * [C]     was -EPIPE -->-----------\                         !           !
  80  *  !        !                      !                         !           !
  81  *  +<---- len == 0                 !                         !           !
  82  *  !        !                      !                         !           !
  83  *  !      was error -->--------------------------------------!---------->\
  84  *  !        !                      !                         !           !
  85  *  +<---- bad CSW                  !                         !           !
  86  *  +<---- bad tag                  !                         !           !
  87  *  !        !                      V                         !           !
  88  *  !        !                 +--------+                     !           !
  89  *  !        !                 ! CLRRS  !                     !           !
  90  *  !        !                 +--------+                     !           !
  91  *  !        !                      !                         !           !
  92  *  \------- ! --------------------[C]--------\               !           !
  93  *           !                                !               !           !
  94  *         cmd->error---\                +--------+           !           !
  95  *           !          +--------------->! SENSE  !<----------/           !
  96  *         STAT_FAIL----/                +--------+                       !
  97  *           !                                !                           V
  98  *           !                                V                      +--------+
  99  *           \--------------------------------\--------------------->! DONE   !
 100  *                                                                   +--------+
 101  */
 102
 103 /*
 104  * This many LUNs per USB device.
 105  * Every one of them takes a host, see UB_MAX_HOSTS.
 106  */
 107 #define UB_MAX_LUNS   9
 108
 109 /*
 110  */
 111
 112 #define UB_PARTS_PER_LUN      8
 113
 114 #define UB_MAX_CDB_SIZE      16         /* Corresponds to Bulk */
 115
 116 #define UB_SENSE_SIZE  18
 117
 118 /*
 119  */
 120
 121 /* command block wrapper */
 122 struct bulk_cb_wrap {
 123         __le32  Signature;              /* contains 'USBC' */
 124         u32     Tag;                    /* unique per command id */
 125         __le32  DataTransferLength;     /* size of data */
 126         u8      Flags;                  /* direction in bit 0 */
 127         u8      Lun;                    /* LUN */
 128         u8      Length;                 /* of of the CDB */
 129         u8      CDB[UB_MAX_CDB_SIZE];   /* max command */
 130 };
 131
 132 #define US_BULK_CB_WRAP_LEN     31
 133 #define US_BULK_CB_SIGN         0x43425355      /*spells out USBC */
 134 #define US_BULK_FLAG_IN         1
 135 #define US_BULK_FLAG_OUT        0
 136
 137 /* command status wrapper */
 138 struct bulk_cs_wrap {
 139         __le32  Signature;              /* should = 'USBS' */
 140         u32     Tag;                    /* same as original command */
 141         __le32  Residue;                /* amount not transferred */
 142         u8      Status;                 /* see below */
 143 };
 144
 145 #define US_BULK_CS_WRAP_LEN     13
 146 #define US_BULK_CS_SIGN         0x53425355      /* spells out 'USBS' */
 147 #define US_BULK_STAT_OK         0
 148 #define US_BULK_STAT_FAIL       1
 149 #define US_BULK_STAT_PHASE      2
 150
 151 /* bulk-only class specific requests */
 152 #define US_BULK_RESET_REQUEST   0xff
 153 #define US_BULK_GET_MAX_LUN     0xfe
 154
 155 /*
 156  */
 157 struct ub_dev;
 158
 159 #define UB_MAX_REQ_SG   9       /* cdrecord requires 32KB and maybe a header */
 160 #define UB_MAX_SECTORS 64
 161
 162 /*
 163  * A second is more than enough for a 32K transfer (UB_MAX_SECTORS)
 164  * even if a webcam hogs the bus, but some devices need time to spin up.
 165  */
 166 #define UB_URB_TIMEOUT  (HZ*2)
 167 #define UB_DATA_TIMEOUT (HZ*5)  /* ZIP does spin-ups in the data phase */
 168 #define UB_STAT_TIMEOUT (HZ*5)  /* Same spinups and eject for a dataless cmd. */
 169 #define UB_CTRL_TIMEOUT (HZ/2)  /* 500ms ought to be enough to clear a stall */
 170
 171 /*
 172  * An instance of a SCSI command in transit.
 173  */
 174 #define UB_DIR_NONE     0
 175 #define UB_DIR_READ     1
 176 #define UB_DIR_ILLEGAL2 2
 177 #define UB_DIR_WRITE    3
 178
 179 #define UB_DIR_CHAR(c)  (((c)==UB_DIR_WRITE)? 'w': \
 180                          (((c)==UB_DIR_READ)? 'r': 'n'))
 181
 182 enum ub_scsi_cmd_state {
 183         UB_CMDST_INIT,                  /* Initial state */
 184         UB_CMDST_CMD,                   /* Command submitted */
 185         UB_CMDST_DATA,                  /* Data phase */
 186         UB_CMDST_CLR2STS,               /* Clearing before requesting status */
 187         UB_CMDST_STAT,                  /* Status phase */
 188         UB_CMDST_CLEAR,                 /* Clearing a stall (halt, actually) */
 189         UB_CMDST_CLRRS,                 /* Clearing before retrying status */
 190         UB_CMDST_SENSE,                 /* Sending Request Sense */
 191         UB_CMDST_DONE                   /* Final state */
 192 };
 193
 194 struct ub_scsi_cmd {
 195         unsigned char cdb[UB_MAX_CDB_SIZE];
 196         unsigned char cdb_len;
 197
 198         unsigned char dir;              /* 0 - none, 1 - read, 3 - write. */
 199         enum ub_scsi_cmd_state state;
 200         unsigned int tag;
 201         struct ub_scsi_cmd *next;
 202
 203         int error;                      /* Return code - valid upon done */
 204         unsigned int act_len;           /* Return size */
 205         unsigned char key, asc, ascq;   /* May be valid if error==-EIO */
 206
 207         int stat_count;                 /* Retries getting status. */
 208         unsigned int timeo;             /* jiffies until rq->timeout changes */
 209
 210         unsigned int len;               /* Requested length */
 211         unsigned int current_sg;
 212         unsigned int nsg;               /* sgv[nsg] */
 213         struct scatterlist sgv[UB_MAX_REQ_SG];
 214
 215         struct ub_lun *lun;
 216         void (*done)(struct ub_dev *, struct ub_scsi_cmd *);
 217         void *back;
 218 };
 219
 220 struct ub_request {
 221         struct request *rq;
 222         unsigned int current_try;
 223         unsigned int nsg;               /* sgv[nsg] */
 224         struct scatterlist sgv[UB_MAX_REQ_SG];
 225 };
 226
 227 /*
 228  */
 229 struct ub_capacity {
 230         unsigned long nsec;             /* Linux size - 512 byte sectors */
 231         unsigned int bsize;             /* Linux hardsect_size */
 232         unsigned int bshift;            /* Shift between 512 and hard sects */
 233 };
 234
 235 /*
 236  * This is a direct take-off from linux/include/completion.h
 237  * The difference is that I do not wait on this thing, just poll.
 238  * When I want to wait (ub_probe), I just use the stock completion.
 239  *
 240  * Note that INIT_COMPLETION takes no lock. It is correct. But why
 241  * in the bloody hell that thing takes struct instead of pointer to struct
 242  * is quite beyond me. I just copied it from the stock completion.
 243  */
 244 struct ub_completion {
 245         unsigned int done;
 246         spinlock_t lock;
 247 };
 248
 249 static inline void ub_init_completion(struct ub_completion *x)
 250 {
 251         x->done = 0;
 252         spin_lock_init(&x->lock);
 253 }
 254
 255 #define UB_INIT_COMPLETION(x)   ((x).done = 0)
 256
 257 static void ub_complete(struct ub_completion *x)
 258 {
 259         unsigned long flags;
 260
 261         spin_lock_irqsave(&x->lock, flags);
 262         x->done++;
 263         spin_unlock_irqrestore(&x->lock, flags);
 264 }
 265
 266 static int ub_is_completed(struct ub_completion *x)
 267 {
 268         unsigned long flags;
 269         int ret;
 270
 271         spin_lock_irqsave(&x->lock, flags);
 272         ret = x->done;
 273         spin_unlock_irqrestore(&x->lock, flags);
 274         return ret;
 275 }
 276
 277 /*
 278  */
 279 struct ub_scsi_cmd_queue {
 280         int qlen, qmax;
 281         struct ub_scsi_cmd *head, *tail;
 282 };
 283
 284 /*
 285  * The block device instance (one per LUN).
 286  */
 287 struct ub_lun {
 288         struct ub_dev *udev;
 289         struct list_head link;
 290         struct gendisk *disk;
 291         int id;                         /* Host index */
 292         int num;                        /* LUN number */
 293         char name[16];
 294
 295         int changed;                    /* Media was changed */
 296         int removable;
 297         int readonly;
 298
 299         struct ub_request urq;
 300
 301         /* Use Ingo's mempool if or when we have more than one command. */
 302         /*
 303          * Currently we never need more than one command for the whole device.
 304          * However, giving every LUN a command is a cheap and automatic way
 305          * to enforce fairness between them.
 306          */
 307         int cmda[1];
 308         struct ub_scsi_cmd cmdv[1];
 309
 310         struct ub_capacity capacity;
 311 };
 312
 313 /*
 314  * The USB device instance.
 315  */
 316 struct ub_dev {
 317         spinlock_t *lock;
 318         atomic_t poison;                /* The USB device is disconnected */
 319         int openc;                      /* protected by ub_lock! */
 320                                         /* kref is too implicit for our taste */
 321         int reset;                      /* Reset is running */
 322         unsigned int tagcnt;
 323         char name[12];
 324         struct usb_device *dev;
 325         struct usb_interface *intf;
 326
 327         struct list_head luns;
 328
 329         unsigned int send_bulk_pipe;    /* cached pipe values */
 330         unsigned int recv_bulk_pipe;
 331         unsigned int send_ctrl_pipe;
 332         unsigned int recv_ctrl_pipe;
 333
 334         struct tasklet_struct tasklet;
 335
 336         struct ub_scsi_cmd_queue cmd_queue;
 337         struct ub_scsi_cmd top_rqs_cmd; /* REQUEST SENSE */
 338         unsigned char top_sense[UB_SENSE_SIZE];
 339
 340         struct ub_completion work_done;
 341         struct urb work_urb;
 342         struct timer_list work_timer;
 343         int last_pipe;                  /* What might need clearing */
 344         __le32 signature;               /* Learned signature */
 345         struct bulk_cb_wrap work_bcb;
 346         struct bulk_cs_wrap work_bcs;
 347         struct usb_ctrlrequest work_cr;
 348
 349         struct work_struct reset_work;
 350         wait_queue_head_t reset_wait;
 351
 352         int sg_stat[6];
 353 };
 354
 355 /*
 356  */
 357 static void ub_cleanup(struct ub_dev *sc);
 358 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq);
 359 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
 360     struct ub_scsi_cmd *cmd, struct ub_request *urq);
 361 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
 362     struct ub_scsi_cmd *cmd, struct ub_request *urq);
 363 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 364 static void ub_end_rq(struct request *rq, unsigned int status,
 365     unsigned int cmd_len);
 366 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
 367     struct ub_request *urq, struct ub_scsi_cmd *cmd);
 368 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 369 static void ub_urb_complete(struct urb *urb);
 370 static void ub_scsi_action(unsigned long _dev);
 371 static void ub_scsi_dispatch(struct ub_dev *sc);
 372 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 373 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 374 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc);
 375 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 376 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 377 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 378 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 379 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
 380     int stalled_pipe);
 381 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd);
 382 static void ub_reset_enter(struct ub_dev *sc, int try);
 383 static void ub_reset_task(struct work_struct *work);
 384 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun);
 385 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
 386     struct ub_capacity *ret);
 387 static int ub_sync_reset(struct ub_dev *sc);
 388 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe);
 389 static int ub_probe_lun(struct ub_dev *sc, int lnum);
 390
 391 /*
 392  */
 393 #ifdef CONFIG_USB_LIBUSUAL
 394
 395 #define ub_usb_ids  storage_usb_ids
 396 #else
 397
 398 static struct usb_device_id ub_usb_ids[] = {
 399         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, US_SC_SCSI, US_PR_BULK) },
 400         { }
 401 };
 402
 403 MODULE_DEVICE_TABLE(usb, ub_usb_ids);
 404 #endif /* CONFIG_USB_LIBUSUAL */
 405
 406 /*
 407  * Find me a way to identify "next free minor" for add_disk(),
 408  * and the array disappears the next day. However, the number of
 409  * hosts has something to do with the naming and /proc/partitions.
 410  * This has to be thought out in detail before changing.
 411  * If UB_MAX_HOST was 1000, we'd use a bitmap. Or a better data structure.
 412  */
 413 #define UB_MAX_HOSTS  26
 414 static char ub_hostv[UB_MAX_HOSTS];
 415
 416 #define UB_QLOCK_NUM 5
 417 static spinlock_t ub_qlockv[UB_QLOCK_NUM];
 418 static int ub_qlock_next = 0;
 419
 420 static DEFINE_SPINLOCK(ub_lock);        /* Locks globals and ->openc */
 421
 422 /*
 423  * The id allocator.
 424  *
 425  * This also stores the host for indexing by minor, which is somewhat dirty.
 426  */
 427 static int ub_id_get(void)
 428 {
 429         unsigned long flags;
 430         int i;
 431
 432         spin_lock_irqsave(&ub_lock, flags);
 433         for (i = 0; i < UB_MAX_HOSTS; i++) {
 434                 if (ub_hostv[i] == 0) {
 435                         ub_hostv[i] = 1;
 436                         spin_unlock_irqrestore(&ub_lock, flags);
 437                         return i;
 438                 }
 439         }
 440         spin_unlock_irqrestore(&ub_lock, flags);
 441         return -1;
 442 }
 443
 444 static void ub_id_put(int id)
 445 {
 446         unsigned long flags;
 447
 448         if (id < 0 || id >= UB_MAX_HOSTS) {
 449                 printk(KERN_ERR DRV_NAME ": bad host ID %d\n", id);
 450                 return;
 451         }
 452
 453         spin_lock_irqsave(&ub_lock, flags);
 454         if (ub_hostv[id] == 0) {
 455                 spin_unlock_irqrestore(&ub_lock, flags);
 456                 printk(KERN_ERR DRV_NAME ": freeing free host ID %d\n", id);
 457                 return;
 458         }
 459         ub_hostv[id] = 0;
 460         spin_unlock_irqrestore(&ub_lock, flags);
 461 }
 462
 463 /*
 464  * This is necessitated by the fact that blk_cleanup_queue does not
 465  * necesserily destroy the queue. Instead, it may merely decrease q->refcnt.
 466  * Since our blk_init_queue() passes a spinlock common with ub_dev,
 467  * we have life time issues when ub_cleanup frees ub_dev.
 468  */
 469 static spinlock_t *ub_next_lock(void)
 470 {
 471         unsigned long flags;
 472         spinlock_t *ret;
 473
 474         spin_lock_irqsave(&ub_lock, flags);
 475         ret = &ub_qlockv[ub_qlock_next];
 476         ub_qlock_next = (ub_qlock_next + 1) % UB_QLOCK_NUM;
 477         spin_unlock_irqrestore(&ub_lock, flags);
 478         return ret;
 479 }
 480
 481 /*
 482  * Downcount for deallocation. This rides on two assumptions:
 483  *  - once something is poisoned, its refcount cannot grow
 484  *  - opens cannot happen at this time (del_gendisk was done)
 485  * If the above is true, we can drop the lock, which we need for
 486  * blk_cleanup_queue(): the silly thing may attempt to sleep.
 487  * [Actually, it never needs to sleep for us, but it calls might_sleep()]
 488  */
 489 static void ub_put(struct ub_dev *sc)
 490 {
 491         unsigned long flags;
 492
 493         spin_lock_irqsave(&ub_lock, flags);
 494         --sc->openc;
 495         if (sc->openc == 0 && atomic_read(&sc->poison)) {
 496                 spin_unlock_irqrestore(&ub_lock, flags);
 497                 ub_cleanup(sc);
 498         } else {
 499                 spin_unlock_irqrestore(&ub_lock, flags);
 500         }
 501 }
 502
 503 /*
 504  * Final cleanup and deallocation.
 505  */
 506 static void ub_cleanup(struct ub_dev *sc)
 507 {
 508         struct list_head *p;
 509         struct ub_lun *lun;
 510         struct request_queue *q;
 511
 512         while (!list_empty(&sc->luns)) {
 513                 p = sc->luns.next;
 514                 lun = list_entry(p, struct ub_lun, link);
 515                 list_del(p);
 516
 517                 /* I don't think queue can be NULL. But... Stolen from sx8.c */
 518                 if ((q = lun->disk->queue) != NULL)
 519                         blk_cleanup_queue(q);
 520                 /*
 521                  * If we zero disk->private_data BEFORE put_disk, we have
 522                  * to check for NULL all over the place in open, release,
 523                  * check_media and revalidate, because the block level
 524                  * semaphore is well inside the put_disk.
 525                  * But we cannot zero after the call, because *disk is gone.
 526                  * The sd.c is blatantly racy in this area.
 527                  */
 528                 /* disk->private_data = NULL; */
 529                 put_disk(lun->disk);
 530                 lun->disk = NULL;
 531
 532                 ub_id_put(lun->id);
 533                 kfree(lun);
 534         }
 535
 536         usb_set_intfdata(sc->intf, NULL);
 537         usb_put_intf(sc->intf);
 538         usb_put_dev(sc->dev);
 539         kfree(sc);
 540 }
 541
 542 /*
 543  * The "command allocator".
 544  */
 545 static struct ub_scsi_cmd *ub_get_cmd(struct ub_lun *lun)
 546 {
 547         struct ub_scsi_cmd *ret;
 548
 549         if (lun->cmda[0])
 550                 return NULL;
 551         ret = &lun->cmdv[0];
 552         lun->cmda[0] = 1;
 553         return ret;
 554 }
 555
 556 static void ub_put_cmd(struct ub_lun *lun, struct ub_scsi_cmd *cmd)
 557 {
 558         if (cmd != &lun->cmdv[0]) {
 559                 printk(KERN_WARNING "%s: releasing a foreign cmd %p\n",
 560                     lun->name, cmd);
 561                 return;
 562         }
 563         if (!lun->cmda[0]) {
 564                 printk(KERN_WARNING "%s: releasing a free cmd\n", lun->name);
 565                 return;
 566         }
 567         lun->cmda[0] = 0;
 568 }
 569
 570 /*
 571  * The command queue.
 572  */
 573 static void ub_cmdq_add(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 574 {
 575         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 576
 577         if (t->qlen++ == 0) {
 578                 t->head = cmd;
 579                 t->tail = cmd;
 580         } else {
 581                 t->tail->next = cmd;
 582                 t->tail = cmd;
 583         }
 584
 585         if (t->qlen > t->qmax)
 586                 t->qmax = t->qlen;
 587 }
 588
 589 static void ub_cmdq_insert(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 590 {
 591         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 592
 593         if (t->qlen++ == 0) {
 594                 t->head = cmd;
 595                 t->tail = cmd;
 596         } else {
 597                 cmd->next = t->head;
 598                 t->head = cmd;
 599         }
 600
 601         if (t->qlen > t->qmax)
 602                 t->qmax = t->qlen;
 603 }
 604
 605 static struct ub_scsi_cmd *ub_cmdq_pop(struct ub_dev *sc)
 606 {
 607         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 608         struct ub_scsi_cmd *cmd;
 609
 610         if (t->qlen == 0)
 611                 return NULL;
 612         if (--t->qlen == 0)
 613                 t->tail = NULL;
 614         cmd = t->head;
 615         t->head = cmd->next;
 616         cmd->next = NULL;
 617         return cmd;
 618 }
 619
 620 #define ub_cmdq_peek(sc)  ((sc)->cmd_queue.head)
 621
 622 /*
 623  * The request function is our main entry point
 624  */
 625
 626 static void ub_request_fn(struct request_queue *q)
 627 {
 628         struct ub_lun *lun = q->queuedata;
 629         struct request *rq;
 630
 631         while ((rq = elv_next_request(q)) != NULL) {
 632                 if (ub_request_fn_1(lun, rq) != 0) {
 633                         blk_stop_queue(q);
 634                         break;
 635                 }
 636         }
 637 }
 638
 639 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
 640 {
 641         struct ub_dev *sc = lun->udev;
 642         struct ub_scsi_cmd *cmd;
 643         struct ub_request *urq;
 644         int n_elem;
 645
 646         if (atomic_read(&sc->poison)) {
 647                 blkdev_dequeue_request(rq);
 648                 ub_end_rq(rq, DID_NO_CONNECT << 16, blk_rq_bytes(rq));
 649                 return 0;
 650         }
 651
 652         if (lun->changed && !blk_pc_request(rq)) {
 653                 blkdev_dequeue_request(rq);
 654                 ub_end_rq(rq, SAM_STAT_CHECK_CONDITION, blk_rq_bytes(rq));
 655                 return 0;
 656         }
 657
 658         if (lun->urq.rq != NULL)
 659                 return -1;
 660         if ((cmd = ub_get_cmd(lun)) == NULL)
 661                 return -1;
 662         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
 663
 664         blkdev_dequeue_request(rq);
 665
 666         urq = &lun->urq;
 667         memset(urq, 0, sizeof(struct ub_request));
 668         urq->rq = rq;
 669
 670         /*
 671          * get scatterlist from block layer
 672          */
 673         sg_init_table(&urq->sgv[0], UB_MAX_REQ_SG);
 674         n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
 675         if (n_elem < 0) {
 676                 /* Impossible, because blk_rq_map_sg should not hit ENOMEM. */
 677                 printk(KERN_INFO "%s: failed request map (%d)\n",
 678                     lun->name, n_elem);
 679                 goto drop;
 680         }
 681         if (n_elem > UB_MAX_REQ_SG) {   /* Paranoia */
 682                 printk(KERN_WARNING "%s: request with %d segments\n",
 683                     lun->name, n_elem);
 684                 goto drop;
 685         }
 686         urq->nsg = n_elem;
 687         sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 688
 689         if (blk_pc_request(rq)) {
 690                 ub_cmd_build_packet(sc, lun, cmd, urq);
 691         } else {
 692                 ub_cmd_build_block(sc, lun, cmd, urq);
 693         }
 694         cmd->state = UB_CMDST_INIT;
 695         cmd->lun = lun;
 696         cmd->done = ub_rw_cmd_done;
 697         cmd->back = urq;
 698
 699         cmd->tag = sc->tagcnt++;
 700         if (ub_submit_scsi(sc, cmd) != 0)
 701                 goto drop;
 702
 703         return 0;
 704
 705 drop:
 706         ub_put_cmd(lun, cmd);
 707         ub_end_rq(rq, DID_ERROR << 16, blk_rq_bytes(rq));
 708         return 0;
 709 }
 710
 711 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
 712     struct ub_scsi_cmd *cmd, struct ub_request *urq)
 713 {
 714         struct request *rq = urq->rq;
 715         unsigned int block, nblks;
 716
 717         if (rq_data_dir(rq) == WRITE)
 718                 cmd->dir = UB_DIR_WRITE;
 719         else
 720                 cmd->dir = UB_DIR_READ;
 721
 722         cmd->nsg = urq->nsg;
 723         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
 724
 725         /*
 726          * build the command
 727          *
 728          * The call to blk_queue_hardsect_size() guarantees that request
 729          * is aligned, but it is given in terms of 512 byte units, always.
 730          */
 731         block = rq->sector >> lun->capacity.bshift;
 732         nblks = rq->nr_sectors >> lun->capacity.bshift;
 733
 734         cmd->cdb[0] = (cmd->dir == UB_DIR_READ)? READ_10: WRITE_10;
 735         /* 10-byte uses 4 bytes of LBA: 2147483648KB, 2097152MB, 2048GB */
 736         cmd->cdb[2] = block >> 24;
 737         cmd->cdb[3] = block >> 16;
 738         cmd->cdb[4] = block >> 8;
 739         cmd->cdb[5] = block;
 740         cmd->cdb[7] = nblks >> 8;
 741         cmd->cdb[8] = nblks;
 742         cmd->cdb_len = 10;
 743
 744         cmd->len = rq->nr_sectors * 512;
 745 }
 746
 747 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
 748     struct ub_scsi_cmd *cmd, struct ub_request *urq)
 749 {
 750         struct request *rq = urq->rq;
 751
 752         if (rq->data_len == 0) {
 753                 cmd->dir = UB_DIR_NONE;
 754         } else {
 755                 if (rq_data_dir(rq) == WRITE)
 756                         cmd->dir = UB_DIR_WRITE;
 757                 else
 758                         cmd->dir = UB_DIR_READ;
 759         }
 760
 761         cmd->nsg = urq->nsg;
 762         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
 763
 764         memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
 765         cmd->cdb_len = rq->cmd_len;
 766
 767         cmd->len = rq->data_len;
 768
 769         /*
 770          * To reapply this to every URB is not as incorrect as it looks.
 771          * In return, we avoid any complicated tracking calculations.
 772          */
 773         cmd->timeo = rq->timeout;
 774 }
 775
 776 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 777 {
 778         struct ub_lun *lun = cmd->lun;
 779         struct ub_request *urq = cmd->back;
 780         struct request *rq;
 781         unsigned int scsi_status;
 782         unsigned int cmd_len;
 783
 784         rq = urq->rq;
 785
 786         if (cmd->error == 0) {
 787                 if (blk_pc_request(rq)) {
 788                         if (cmd->act_len >= rq->data_len)
 789                                 rq->data_len = 0;
 790                         else
 791                                 rq->data_len -= cmd->act_len;
 792                         scsi_status = 0;
 793                 } else {
 794                         if (cmd->act_len != cmd->len) {
 795                                 scsi_status = SAM_STAT_CHECK_CONDITION;
 796                         } else {
 797                                 scsi_status = 0;
 798                         }
 799                 }
 800         } else {
 801                 if (blk_pc_request(rq)) {
 802                         /* UB_SENSE_SIZE is smaller than SCSI_SENSE_BUFFERSIZE */
 803                         memcpy(rq->sense, sc->top_sense, UB_SENSE_SIZE);
 804                         rq->sense_len = UB_SENSE_SIZE;
 805                         if (sc->top_sense[0] != 0)
 806                                 scsi_status = SAM_STAT_CHECK_CONDITION;
 807                         else
 808                                 scsi_status = DID_ERROR << 16;
 809                 } else {
 810                         if (cmd->error == -EIO &&
 811                             (cmd->key == 0 ||
 812                              cmd->key == MEDIUM_ERROR ||
 813                              cmd->key == UNIT_ATTENTION)) {
 814                                 if (ub_rw_cmd_retry(sc, lun, urq, cmd) == 0)
 815                                         return;
 816                         }
 817                         scsi_status = SAM_STAT_CHECK_CONDITION;
 818                 }
 819         }
 820
 821         urq->rq = NULL;
 822
 823         cmd_len = cmd->len;
 824         ub_put_cmd(lun, cmd);
 825         ub_end_rq(rq, scsi_status, cmd_len);
 826         blk_start_queue(lun->disk->queue);
 827 }
 828
 829 static void ub_end_rq(struct request *rq, unsigned int scsi_status,
 830     unsigned int cmd_len)
 831 {
 832         int error;
 833         long rqlen;
 834
 835         if (scsi_status == 0) {
 836                 error = 0;
 837         } else {
 838                 error = -EIO;
 839                 rq->errors = scsi_status;
 840         }
 841         rqlen = blk_rq_bytes(rq);    /* Oddly enough, this is the residue. */
 842         if (__blk_end_request(rq, error, cmd_len)) {
 843                 printk(KERN_WARNING DRV_NAME
 844                     ": __blk_end_request blew, %s-cmd total %u rqlen %ld\n",
 845                     blk_pc_request(rq)? "pc": "fs", cmd_len, rqlen);
 846         }
 847 }
 848
 849 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
 850     struct ub_request *urq, struct ub_scsi_cmd *cmd)
 851 {
 852
 853         if (atomic_read(&sc->poison))
 854                 return -ENXIO;
 855
 856         ub_reset_enter(sc, urq->current_try);
 857
 858         if (urq->current_try >= 3)
 859                 return -EIO;
 860         urq->current_try++;
 861
 862         /* Remove this if anyone complains of flooding. */
 863         printk(KERN_DEBUG "%s: dir %c len/act %d/%d "
 864             "[sense %x %02x %02x] retry %d\n",
 865             sc->name, UB_DIR_CHAR(cmd->dir), cmd->len, cmd->act_len,
 866             cmd->key, cmd->asc, cmd->ascq, urq->current_try);
 867
 868         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
 869         ub_cmd_build_block(sc, lun, cmd, urq);
 870
 871         cmd->state = UB_CMDST_INIT;
 872         cmd->lun = lun;
 873         cmd->done = ub_rw_cmd_done;
 874         cmd->back = urq;
 875
 876         cmd->tag = sc->tagcnt++;
 877
 878 #if 0 /* Wasteful */
 879         return ub_submit_scsi(sc, cmd);
 880 #else
 881         ub_cmdq_add(sc, cmd);
 882         return 0;
 883 #endif
 884 }
 885
 886 /*
 887  * Submit a regular SCSI operation (not an auto-sense).
 888  *
 889  * The Iron Law of Good Submit Routine is:
 890  * Zero return - callback is done, Nonzero return - callback is not done.
 891  * No exceptions.
 892  *
 893  * Host is assumed locked.
 894  */
 895 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 896 {
 897
 898         if (cmd->state != UB_CMDST_INIT ||
 899             (cmd->dir != UB_DIR_NONE && cmd->len == 0)) {
 900                 return -EINVAL;
 901         }
 902
 903         ub_cmdq_add(sc, cmd);
 904         /*
 905          * We can call ub_scsi_dispatch(sc) right away here, but it's a little
 906          * safer to jump to a tasklet, in case upper layers do something silly.
 907          */
 908         tasklet_schedule(&sc->tasklet);
 909         return 0;
 910 }
 911
 912 /*
 913  * Submit the first URB for the queued command.
 914  * This function does not deal with queueing in any way.
 915  */
 916 static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 917 {
 918         struct bulk_cb_wrap *bcb;
 919         int rc;
 920
 921         bcb = &sc->work_bcb;
 922
 923         /*
 924          * ``If the allocation length is eighteen or greater, and a device
 925          * server returns less than eithteen bytes of data, the application
 926          * client should assume that the bytes not transferred would have been
 927          * zeroes had the device server returned those bytes.''
 928          *
 929          * We zero sense for all commands so that when a packet request
 930          * fails it does not return a stale sense.
 931          */
 932         memset(&sc->top_sense, 0, UB_SENSE_SIZE);
 933
 934         /* set up the command wrapper */
 935         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
 936         bcb->Tag = cmd->tag;            /* Endianness is not important */
 937         bcb->DataTransferLength = cpu_to_le32(cmd->len);
 938         bcb->Flags = (cmd->dir == UB_DIR_READ) ? 0x80 : 0;
 939         bcb->Lun = (cmd->lun != NULL) ? cmd->lun->num : 0;
 940         bcb->Length = cmd->cdb_len;
 941
 942         /* copy the command payload */
 943         memcpy(bcb->CDB, cmd->cdb, UB_MAX_CDB_SIZE);
 944
 945         UB_INIT_COMPLETION(sc->work_done);
 946
 947         sc->last_pipe = sc->send_bulk_pipe;
 948         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
 949             bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
 950
 951         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
 952                 /* XXX Clear stalls */
 953                 ub_complete(&sc->work_done);
 954                 return rc;
 955         }
 956
 957         sc->work_timer.expires = jiffies + UB_URB_TIMEOUT;
 958         add_timer(&sc->work_timer);
 959
 960         cmd->state = UB_CMDST_CMD;
 961         return 0;
 962 }
 963
 964 /*
 965  * Timeout handler.
 966  */
 967 static void ub_urb_timeout(unsigned long arg)
 968 {
 969         struct ub_dev *sc = (struct ub_dev *) arg;
 970         unsigned long flags;
 971
 972         spin_lock_irqsave(sc->lock, flags);
 973         if (!ub_is_completed(&sc->work_done))
 974                 usb_unlink_urb(&sc->work_urb);
 975         spin_unlock_irqrestore(sc->lock, flags);
 976 }
 977
 978 /*
 979  * Completion routine for the work URB.
 980  *
 981  * This can be called directly from usb_submit_urb (while we have
 982  * the sc->lock taken) and from an interrupt (while we do NOT have
 983  * the sc->lock taken). Therefore, bounce this off to a tasklet.
 984  */
 985 static void ub_urb_complete(struct urb *urb)
 986 {
 987         struct ub_dev *sc = urb->context;
 988
 989         ub_complete(&sc->work_done);
 990         tasklet_schedule(&sc->tasklet);
 991 }
 992
 993 static void ub_scsi_action(unsigned long _dev)
 994 {
 995         struct ub_dev *sc = (struct ub_dev *) _dev;
 996         unsigned long flags;
 997
 998         spin_lock_irqsave(sc->lock, flags);
 999         ub_scsi_dispatch(sc);
1000         spin_unlock_irqrestore(sc->lock, flags);
1001 }
1002
1003 static void ub_scsi_dispatch(struct ub_dev *sc)
1004 {
1005         struct ub_scsi_cmd *cmd;
1006         int rc;
1007
1008         while (!sc->reset && (cmd = ub_cmdq_peek(sc)) != NULL) {
1009                 if (cmd->state == UB_CMDST_DONE) {
1010                         ub_cmdq_pop(sc);
1011                         (*cmd->done)(sc, cmd);
1012                 } else if (cmd->state == UB_CMDST_INIT) {
1013                         if ((rc = ub_scsi_cmd_start(sc, cmd)) == 0)
1014                                 break;
1015                         cmd->error = rc;
1016                         cmd->state = UB_CMDST_DONE;
1017                 } else {
1018                         if (!ub_is_completed(&sc->work_done))
1019                                 break;
1020                         del_timer(&sc->work_timer);
1021                         ub_scsi_urb_compl(sc, cmd);
1022                 }
1023         }
1024 }
1025
1026 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1027 {
1028         struct urb *urb = &sc->work_urb;
1029         struct bulk_cs_wrap *bcs;
1030         int len;
1031         int rc;
1032
1033         if (atomic_read(&sc->poison)) {
1034                 ub_state_done(sc, cmd, -ENODEV);
1035                 return;
1036         }
1037
1038         if (cmd->state == UB_CMDST_CLEAR) {
1039                 if (urb->status == -EPIPE) {
1040                         /*
1041                          * STALL while clearning STALL.
1042                          * The control pipe clears itself - nothing to do.
1043                          */
1044                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1045                             sc->name);
1046                         goto Bad_End;
1047                 }
1048
1049                 /*
1050                  * We ignore the result for the halt clear.
1051                  */
1052
1053                 /* reset the endpoint toggle */
1054                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1055                         usb_pipeout(sc->last_pipe), 0);
1056
1057                 ub_state_sense(sc, cmd);
1058
1059         } else if (cmd->state == UB_CMDST_CLR2STS) {
1060                 if (urb->status == -EPIPE) {
1061                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1062                             sc->name);
1063                         goto Bad_End;
1064                 }
1065
1066                 /*
1067                  * We ignore the result for the halt clear.
1068                  */
1069
1070                 /* reset the endpoint toggle */
1071                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1072                         usb_pipeout(sc->last_pipe), 0);
1073
1074                 ub_state_stat(sc, cmd);
1075
1076         } else if (cmd->state == UB_CMDST_CLRRS) {
1077                 if (urb->status == -EPIPE) {
1078                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1079                             sc->name);
1080                         goto Bad_End;
1081                 }
1082
1083                 /*
1084                  * We ignore the result for the halt clear.
1085                  */
1086
1087                 /* reset the endpoint toggle */
1088                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1089                         usb_pipeout(sc->last_pipe), 0);
1090
1091                 ub_state_stat_counted(sc, cmd);
1092
1093         } else if (cmd->state == UB_CMDST_CMD) {
1094                 switch (urb->status) {
1095                 case 0:
1096                         break;
1097                 case -EOVERFLOW:
1098                         goto Bad_End;
1099                 case -EPIPE:
1100                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1101                         if (rc != 0) {
1102                                 printk(KERN_NOTICE "%s: "
1103                                     "unable to submit clear (%d)\n",
1104                                     sc->name, rc);
1105                                 /*
1106                                  * This is typically ENOMEM or some other such shit.
1107                                  * Retrying is pointless. Just do Bad End on it...
1108                                  */
1109                                 ub_state_done(sc, cmd, rc);
1110                                 return;
1111                         }
1112                         cmd->state = UB_CMDST_CLEAR;
1113                         return;
1114                 case -ESHUTDOWN:        /* unplug */
1115                 case -EILSEQ:           /* unplug timeout on uhci */
1116                         ub_state_done(sc, cmd, -ENODEV);
1117                         return;
1118                 default:
1119                         goto Bad_End;
1120                 }
1121                 if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
1122                         goto Bad_End;
1123                 }
1124
1125                 if (cmd->dir == UB_DIR_NONE || cmd->nsg < 1) {
1126                         ub_state_stat(sc, cmd);
1127                         return;
1128                 }
1129
1130                 // udelay(125);         // usb-storage has this
1131                 ub_data_start(sc, cmd);
1132
1133         } else if (cmd->state == UB_CMDST_DATA) {
1134                 if (urb->status == -EPIPE) {
1135                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1136                         if (rc != 0) {
1137                                 printk(KERN_NOTICE "%s: "
1138                                     "unable to submit clear (%d)\n",
1139                                     sc->name, rc);
1140                                 ub_state_done(sc, cmd, rc);
1141                                 return;
1142                         }
1143                         cmd->state = UB_CMDST_CLR2STS;
1144                         return;
1145                 }
1146                 if (urb->status == -EOVERFLOW) {
1147                         /*
1148                          * A babble? Failure, but we must transfer CSW now.
1149                          */
1150                         cmd->error = -EOVERFLOW;        /* A cheap trick... */
1151                         ub_state_stat(sc, cmd);
1152                         return;
1153                 }
1154
1155                 if (cmd->dir == UB_DIR_WRITE) {
1156                         /*
1157                          * Do not continue writes in case of a failure.
1158                          * Doing so would cause sectors to be mixed up,
1159                          * which is worse than sectors lost.
1160                          *
1161                          * We must try to read the CSW, or many devices
1162                          * get confused.
1163                          */
1164                         len = urb->actual_length;
1165                         if (urb->status != 0 ||
1166                             len != cmd->sgv[cmd->current_sg].length) {
1167                                 cmd->act_len += len;
1168
1169                                 cmd->error = -EIO;
1170                                 ub_state_stat(sc, cmd);
1171                                 return;
1172                         }
1173
1174                 } else {
1175                         /*
1176                          * If an error occurs on read, we record it, and
1177                          * continue to fetch data in order to avoid bubble.
1178                          *
1179                          * As a small shortcut, we stop if we detect that
1180                          * a CSW mixed into data.
1181                          */
1182                         if (urb->status != 0)
1183                                 cmd->error = -EIO;
1184
1185                         len = urb->actual_length;
1186                         if (urb->status != 0 ||
1187                             len != cmd->sgv[cmd->current_sg].length) {
1188                                 if ((len & 0x1FF) == US_BULK_CS_WRAP_LEN)
1189                                         goto Bad_End;
1190                         }
1191                 }
1192
1193                 cmd->act_len += urb->actual_length;
1194
1195                 if (++cmd->current_sg < cmd->nsg) {
1196                         ub_data_start(sc, cmd);
1197                         return;
1198                 }
1199                 ub_state_stat(sc, cmd);
1200
1201         } else if (cmd->state == UB_CMDST_STAT) {
1202                 if (urb->status == -EPIPE) {
1203                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1204                         if (rc != 0) {
1205                                 printk(KERN_NOTICE "%s: "
1206                                     "unable to submit clear (%d)\n",
1207                                     sc->name, rc);
1208                                 ub_state_done(sc, cmd, rc);
1209                                 return;
1210                         }
1211
1212                         /*
1213                          * Having a stall when getting CSW is an error, so
1214                          * make sure uppper levels are not oblivious to it.
1215                          */
1216                         cmd->error = -EIO;              /* A cheap trick... */
1217
1218                         cmd->state = UB_CMDST_CLRRS;
1219                         return;
1220                 }
1221
1222                 /* Catch everything, including -EOVERFLOW and other nasties. */
1223                 if (urb->status != 0)
1224                         goto Bad_End;
1225
1226                 if (urb->actual_length == 0) {
1227                         ub_state_stat_counted(sc, cmd);
1228                         return;
1229                 }
1230
1231                 /*
1232                  * Check the returned Bulk protocol status.
1233                  * The status block has to be validated first.
1234                  */
1235
1236                 bcs = &sc->work_bcs;
1237
1238                 if (sc->signature == cpu_to_le32(0)) {
1239                         /*
1240                          * This is the first reply, so do not perform the check.
1241                          * Instead, remember the signature the device uses
1242                          * for future checks. But do not allow a nul.
1243                          */
1244                         sc->signature = bcs->Signature;
1245                         if (sc->signature == cpu_to_le32(0)) {
1246                                 ub_state_stat_counted(sc, cmd);
1247                                 return;
1248                         }
1249                 } else {
1250                         if (bcs->Signature != sc->signature) {
1251                                 ub_state_stat_counted(sc, cmd);
1252                                 return;
1253                         }
1254                 }
1255
1256                 if (bcs->Tag != cmd->tag) {
1257                         /*
1258                          * This usually happens when we disagree with the
1259                          * device's microcode about something. For instance,
1260                          * a few of them throw this after timeouts. They buffer
1261                          * commands and reply at commands we timed out before.
1262                          * Without flushing these replies we loop forever.
1263                          */
1264                         ub_state_stat_counted(sc, cmd);
1265                         return;
1266                 }
1267
1268                 len = le32_to_cpu(bcs->Residue);
1269                 if (len != cmd->len - cmd->act_len) {
1270                         /*
1271                          * It is all right to transfer less, the caller has
1272                          * to check. But it's not all right if the device
1273                          * counts disagree with our counts.
1274                          */
1275                         goto Bad_End;
1276                 }
1277
1278                 switch (bcs->Status) {
1279                 case US_BULK_STAT_OK:
1280                         break;
1281                 case US_BULK_STAT_FAIL:
1282                         ub_state_sense(sc, cmd);
1283                         return;
1284                 case US_BULK_STAT_PHASE:
1285                         goto Bad_End;
1286                 default:
1287                         printk(KERN_INFO "%s: unknown CSW status 0x%x\n",
1288                             sc->name, bcs->Status);
1289                         ub_state_done(sc, cmd, -EINVAL);
1290                         return;
1291                 }
1292
1293                 /* Not zeroing error to preserve a babble indicator */
1294                 if (cmd->error != 0) {
1295                         ub_state_sense(sc, cmd);
1296                         return;
1297                 }
1298                 cmd->state = UB_CMDST_DONE;
1299                 ub_cmdq_pop(sc);
1300                 (*cmd->done)(sc, cmd);
1301
1302         } else if (cmd->state == UB_CMDST_SENSE) {
1303                 ub_state_done(sc, cmd, -EIO);
1304
1305         } else {
1306                 printk(KERN_WARNING "%s: "
1307                     "wrong command state %d\n",
1308                     sc->name, cmd->state);
1309                 ub_state_done(sc, cmd, -EINVAL);
1310                 return;
1311         }
1312         return;
1313
1314 Bad_End: /* Little Excel is dead */
1315         ub_state_done(sc, cmd, -EIO);
1316 }
1317
1318 /*
1319  * Factorization helper for the command state machine:
1320  * Initiate a data segment transfer.
1321  */
1322 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1323 {
1324         struct scatterlist *sg = &cmd->sgv[cmd->current_sg];
1325         int pipe;
1326         int rc;
1327
1328         UB_INIT_COMPLETION(sc->work_done);
1329
1330         if (cmd->dir == UB_DIR_READ)
1331                 pipe = sc->recv_bulk_pipe;
1332         else
1333                 pipe = sc->send_bulk_pipe;
1334         sc->last_pipe = pipe;
1335         usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe, sg_virt(sg),
1336             sg->length, ub_urb_complete, sc);
1337
1338         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1339                 /* XXX Clear stalls */
1340                 ub_complete(&sc->work_done);
1341                 ub_state_done(sc, cmd, rc);
1342                 return;
1343         }
1344
1345         if (cmd->timeo)
1346                 sc->work_timer.expires = jiffies + cmd->timeo;
1347         else
1348                 sc->work_timer.expires = jiffies + UB_DATA_TIMEOUT;
1349         add_timer(&sc->work_timer);
1350
1351         cmd->state = UB_CMDST_DATA;
1352 }
1353
1354 /*
1355  * Factorization helper for the command state machine:
1356  * Finish the command.
1357  */
1358 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc)
1359 {
1360
1361         cmd->error = rc;
1362         cmd->state = UB_CMDST_DONE;
1363         ub_cmdq_pop(sc);
1364         (*cmd->done)(sc, cmd);
1365 }
1366
1367 /*
1368  * Factorization helper for the command state machine:
1369  * Submit a CSW read.
1370  */
1371 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1372 {
1373         int rc;
1374
1375         UB_INIT_COMPLETION(sc->work_done);
1376
1377         sc->last_pipe = sc->recv_bulk_pipe;
1378         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
1379             &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
1380
1381         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1382                 /* XXX Clear stalls */
1383                 ub_complete(&sc->work_done);
1384                 ub_state_done(sc, cmd, rc);
1385                 return -1;
1386         }
1387
1388         if (cmd->timeo)
1389                 sc->work_timer.expires = jiffies + cmd->timeo;
1390         else
1391                 sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
1392         add_timer(&sc->work_timer);
1393         return 0;
1394 }
1395
1396 /*
1397  * Factorization helper for the command state machine:
1398  * Submit a CSW read and go to STAT state.
1399  */
1400 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1401 {
1402
1403         if (__ub_state_stat(sc, cmd) != 0)
1404                 return;
1405
1406         cmd->stat_count = 0;
1407         cmd->state = UB_CMDST_STAT;
1408 }
1409
1410 /*
1411  * Factorization helper for the command state machine:
1412  * Submit a CSW read and go to STAT state with counter (along [C] path).
1413  */
1414 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1415 {
1416
1417         if (++cmd->stat_count >= 4) {
1418                 ub_state_sense(sc, cmd);
1419                 return;
1420         }
1421
1422         if (__ub_state_stat(sc, cmd) != 0)
1423                 return;
1424
1425         cmd->state = UB_CMDST_STAT;
1426 }
1427
1428 /*
1429  * Factorization helper for the command state machine:
1430  * Submit a REQUEST SENSE and go to SENSE state.
1431  */
1432 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1433 {
1434         struct ub_scsi_cmd *scmd;
1435         struct scatterlist *sg;
1436         int rc;
1437
1438         if (cmd->cdb[0] == REQUEST_SENSE) {
1439                 rc = -EPIPE;
1440                 goto error;
1441         }
1442
1443         scmd = &sc->top_rqs_cmd;
1444         memset(scmd, 0, sizeof(struct ub_scsi_cmd));
1445         scmd->cdb[0] = REQUEST_SENSE;
1446         scmd->cdb[4] = UB_SENSE_SIZE;
1447         scmd->cdb_len = 6;
1448         scmd->dir = UB_DIR_READ;
1449         scmd->state = UB_CMDST_INIT;
1450         scmd->nsg = 1;
1451         sg = &scmd->sgv[0];
1452         sg_init_table(sg, UB_MAX_REQ_SG);
1453         sg_set_page(sg, virt_to_page(sc->top_sense), UB_SENSE_SIZE,
1454                         (unsigned long)sc->top_sense & (PAGE_SIZE-1));
1455         scmd->len = UB_SENSE_SIZE;
1456         scmd->lun = cmd->lun;
1457         scmd->done = ub_top_sense_done;
1458         scmd->back = cmd;
1459
1460         scmd->tag = sc->tagcnt++;
1461
1462         cmd->state = UB_CMDST_SENSE;
1463
1464         ub_cmdq_insert(sc, scmd);
1465         return;
1466
1467 error:
1468         ub_state_done(sc, cmd, rc);
1469 }
1470
1471 /*
1472  * A helper for the command's state machine:
1473  * Submit a stall clear.
1474  */
1475 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
1476     int stalled_pipe)
1477 {
1478         int endp;
1479         struct usb_ctrlrequest *cr;
1480         int rc;
1481
1482         endp = usb_pipeendpoint(stalled_pipe);
1483         if (usb_pipein (stalled_pipe))
1484                 endp |= USB_DIR_IN;
1485
1486         cr = &sc->work_cr;
1487         cr->bRequestType = USB_RECIP_ENDPOINT;
1488         cr->bRequest = USB_REQ_CLEAR_FEATURE;
1489         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
1490         cr->wIndex = cpu_to_le16(endp);
1491         cr->wLength = cpu_to_le16(0);
1492
1493         UB_INIT_COMPLETION(sc->work_done);
1494
1495         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1496             (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
1497
1498         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1499                 ub_complete(&sc->work_done);
1500                 return rc;
1501         }
1502
1503         sc->work_timer.expires = jiffies + UB_CTRL_TIMEOUT;
1504         add_timer(&sc->work_timer);
1505         return 0;
1506 }
1507
1508 /*
1509  */
1510 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
1511 {
1512         unsigned char *sense = sc->top_sense;
1513         struct ub_scsi_cmd *cmd;
1514
1515         /*
1516          * Find the command which triggered the unit attention or a check,
1517          * save the sense into it, and advance its state machine.
1518          */
1519         if ((cmd = ub_cmdq_peek(sc)) == NULL) {
1520                 printk(KERN_WARNING "%s: sense done while idle\n", sc->name);
1521                 return;
1522         }
1523         if (cmd != scmd->back) {
1524                 printk(KERN_WARNING "%s: "
1525                     "sense done for wrong command 0x%x\n",
1526                     sc->name, cmd->tag);
1527                 return;
1528         }
1529         if (cmd->state != UB_CMDST_SENSE) {
1530                 printk(KERN_WARNING "%s: "
1531                     "sense done with bad cmd state %d\n",
1532                     sc->name, cmd->state);
1533                 return;
1534         }
1535
1536         /*
1537          * Ignoring scmd->act_len, because the buffer was pre-zeroed.
1538          */
1539         cmd->key = sense[2] & 0x0F;
1540         cmd->asc = sense[12];
1541         cmd->ascq = sense[13];
1542
1543         ub_scsi_urb_compl(sc, cmd);
1544 }
1545
1546 /*
1547  * Reset management
1548  * XXX Move usb_reset_device to khubd. Hogging kevent is not a good thing.
1549  * XXX Make usb_sync_reset asynchronous.
1550  */
1551
1552 static void ub_reset_enter(struct ub_dev *sc, int try)
1553 {
1554
1555         if (sc->reset) {
1556                 /* This happens often on multi-LUN devices. */
1557                 return;
1558         }
1559         sc->reset = try + 1;
1560
1561 #if 0 /* Not needed because the disconnect waits for us. */
1562         unsigned long flags;
1563         spin_lock_irqsave(&ub_lock, flags);
1564         sc->openc++;
1565         spin_unlock_irqrestore(&ub_lock, flags);
1566 #endif
1567
1568 #if 0 /* We let them stop themselves. */
1569         struct ub_lun *lun;
1570         list_for_each_entry(lun, &sc->luns, link) {
1571                 blk_stop_queue(lun->disk->queue);
1572         }
1573 #endif
1574
1575         schedule_work(&sc->reset_work);
1576 }
1577
1578 static void ub_reset_task(struct work_struct *work)
1579 {
1580         struct ub_dev *sc = container_of(work, struct ub_dev, reset_work);
1581         unsigned long flags;
1582         struct ub_lun *lun;
1583         int lkr, rc;
1584
1585         if (!sc->reset) {
1586                 printk(KERN_WARNING "%s: Running reset unrequested\n",
1587                     sc->name);
1588                 return;
1589         }
1590
1591         if (atomic_read(&sc->poison)) {
1592                 ;
1593         } else if ((sc->reset & 1) == 0) {
1594                 ub_sync_reset(sc);
1595                 msleep(700);    /* usb-storage sleeps 6s (!) */
1596                 ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
1597                 ub_probe_clear_stall(sc, sc->send_bulk_pipe);
1598         } else if (sc->dev->actconfig->desc.bNumInterfaces != 1) {
1599                 ;
1600         } else {
1601                 if ((lkr = usb_lock_device_for_reset(sc->dev, sc->intf)) < 0) {
1602                         printk(KERN_NOTICE
1603                             "%s: usb_lock_device_for_reset failed (%d)\n",
1604                             sc->name, lkr);
1605                 } else {
1606                         rc = usb_reset_device(sc->dev);
1607                         if (rc < 0) {
1608                                 printk(KERN_NOTICE "%s: "
1609                                     "usb_lock_device_for_reset failed (%d)\n",
1610                                     sc->name, rc);
1611                         }
1612
1613                         if (lkr)
1614                                 usb_unlock_device(sc->dev);
1615                 }
1616         }
1617
1618         /*
1619          * In theory, no commands can be running while reset is active,
1620          * so nobody can ask for another reset, and so we do not need any
1621          * queues of resets or anything. We do need a spinlock though,
1622          * to interact with block layer.
1623          */
1624         spin_lock_irqsave(sc->lock, flags);
1625         sc->reset = 0;
1626         tasklet_schedule(&sc->tasklet);
1627         list_for_each_entry(lun, &sc->luns, link) {
1628                 blk_start_queue(lun->disk->queue);
1629         }
1630         wake_up(&sc->reset_wait);
1631         spin_unlock_irqrestore(sc->lock, flags);
1632 }
1633
1634 /*
1635  * This is called from a process context.
1636  */
1637 static void ub_revalidate(struct ub_dev *sc, struct ub_lun *lun)
1638 {
1639
1640         lun->readonly = 0;      /* XXX Query this from the device */
1641
1642         lun->capacity.nsec = 0;
1643         lun->capacity.bsize = 512;
1644         lun->capacity.bshift = 0;
1645
1646         if (ub_sync_tur(sc, lun) != 0)
1647                 return;                 /* Not ready */
1648         lun->changed = 0;
1649
1650         if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1651                 /*
1652                  * The retry here means something is wrong, either with the
1653                  * device, with the transport, or with our code.
1654                  * We keep this because sd.c has retries for capacity.
1655                  */
1656                 if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1657                         lun->capacity.nsec = 0;
1658                         lun->capacity.bsize = 512;
1659                         lun->capacity.bshift = 0;
1660                 }
1661         }
1662 }
1663
1664 /*
1665  * The open funcion.
1666  * This is mostly needed to keep refcounting, but also to support
1667  * media checks on removable media drives.
1668  */
1669 static int ub_bd_open(struct inode *inode, struct file *filp)
1670 {
1671         struct gendisk *disk = inode->i_bdev->bd_disk;
1672         struct ub_lun *lun = disk->private_data;
1673         struct ub_dev *sc = lun->udev;
1674         unsigned long flags;
1675         int rc;
1676
1677         spin_lock_irqsave(&ub_lock, flags);
1678         if (atomic_read(&sc->poison)) {
1679                 spin_unlock_irqrestore(&ub_lock, flags);
1680                 return -ENXIO;
1681         }
1682         sc->openc++;
1683         spin_unlock_irqrestore(&ub_lock, flags);
1684
1685         if (lun->removable || lun->readonly)
1686                 check_disk_change(inode->i_bdev);
1687
1688         /*
1689          * The sd.c considers ->media_present and ->changed not equivalent,
1690          * under some pretty murky conditions (a failure of READ CAPACITY).
1691          * We may need it one day.
1692          */
1693         if (lun->removable && lun->changed && !(filp->f_flags & O_NDELAY)) {
1694                 rc = -ENOMEDIUM;
1695                 goto err_open;
1696         }
1697
1698         if (lun->readonly && (filp->f_mode & FMODE_WRITE)) {
1699                 rc = -EROFS;
1700                 goto err_open;
1701         }
1702
1703         return 0;
1704
1705 err_open:
1706         ub_put(sc);
1707         return rc;
1708 }
1709
1710 /*
1711  */
1712 static int ub_bd_release(struct inode *inode, struct file *filp)
1713 {
1714         struct gendisk *disk = inode->i_bdev->bd_disk;
1715         struct ub_lun *lun = disk->private_data;
1716         struct ub_dev *sc = lun->udev;
1717
1718         ub_put(sc);
1719         return 0;
1720 }
1721
1722 /*
1723  * The ioctl interface.
1724  */
1725 static int ub_bd_ioctl(struct inode *inode, struct file *filp,
1726     unsigned int cmd, unsigned long arg)
1727 {
1728         struct gendisk *disk = inode->i_bdev->bd_disk;
1729         void __user *usermem = (void __user *) arg;
1730
1731         return scsi_cmd_ioctl(filp, disk->queue, disk, cmd, usermem);
1732 }
1733
1734 /*
1735  * This is called once a new disk was seen by the block layer or by ub_probe().
1736  * The main onjective here is to discover the features of the media such as
1737  * the capacity, read-only status, etc. USB storage generally does not
1738  * need to be spun up, but if we needed it, this would be the place.
1739  *
1740  * This call can sleep.
1741  *
1742  * The return code is not used.
1743  */
1744 static int ub_bd_revalidate(struct gendisk *disk)
1745 {
1746         struct ub_lun *lun = disk->private_data;
1747
1748         ub_revalidate(lun->udev, lun);
1749
1750         /* XXX Support sector size switching like in sr.c */
1751         blk_queue_hardsect_size(disk->queue, lun->capacity.bsize);
1752         set_capacity(disk, lun->capacity.nsec);
1753         // set_disk_ro(sdkp->disk, lun->readonly);
1754
1755         return 0;
1756 }
1757
1758 /*
1759  * The check is called by the block layer to verify if the media
1760  * is still available. It is supposed to be harmless, lightweight and
1761  * non-intrusive in case the media was not changed.
1762  *
1763  * This call can sleep.
1764  *
1765  * The return code is bool!
1766  */
1767 static int ub_bd_media_changed(struct gendisk *disk)
1768 {
1769         struct ub_lun *lun = disk->private_data;
1770
1771         if (!lun->removable)
1772                 return 0;
1773
1774         /*
1775          * We clean checks always after every command, so this is not
1776          * as dangerous as it looks. If the TEST_UNIT_READY fails here,
1777          * the device is actually not ready with operator or software
1778          * intervention required. One dangerous item might be a drive which
1779          * spins itself down, and come the time to write dirty pages, this
1780          * will fail, then block layer discards the data. Since we never
1781          * spin drives up, such devices simply cannot be used with ub anyway.
1782          */
1783         if (ub_sync_tur(lun->udev, lun) != 0) {
1784                 lun->changed = 1;
1785                 return 1;
1786         }
1787
1788         return lun->changed;
1789 }
1790
1791 static struct block_device_operations ub_bd_fops = {
1792         .owner          = THIS_MODULE,
1793         .open           = ub_bd_open,
1794         .release        = ub_bd_release,
1795         .ioctl          = ub_bd_ioctl,
1796         .media_changed  = ub_bd_media_changed,
1797         .revalidate_disk = ub_bd_revalidate,
1798 };
1799
1800 /*
1801  * Common ->done routine for commands executed synchronously.
1802  */
1803 static void ub_probe_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1804 {
1805         struct completion *cop = cmd->back;
1806         complete(cop);
1807 }
1808
1809 /*
1810  * Test if the device has a check condition on it, synchronously.
1811  */
1812 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun)
1813 {
1814         struct ub_scsi_cmd *cmd;
1815         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) };
1816         unsigned long flags;
1817         struct completion compl;
1818         int rc;
1819
1820         init_completion(&compl);
1821
1822         rc = -ENOMEM;
1823         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1824                 goto err_alloc;
1825
1826         cmd->cdb[0] = TEST_UNIT_READY;
1827         cmd->cdb_len = 6;
1828         cmd->dir = UB_DIR_NONE;
1829         cmd->state = UB_CMDST_INIT;
1830         cmd->lun = lun;                 /* This may be NULL, but that's ok */
1831         cmd->done = ub_probe_done;
1832         cmd->back = &compl;
1833
1834         spin_lock_irqsave(sc->lock, flags);
1835         cmd->tag = sc->tagcnt++;
1836
1837         rc = ub_submit_scsi(sc, cmd);
1838         spin_unlock_irqrestore(sc->lock, flags);
1839
1840         if (rc != 0)
1841                 goto err_submit;
1842
1843         wait_for_completion(&compl);
1844
1845         rc = cmd->error;
1846
1847         if (rc == -EIO && cmd->key != 0)        /* Retries for benh's key */
1848                 rc = cmd->key;
1849
1850 err_submit:
1851         kfree(cmd);
1852 err_alloc:
1853         return rc;
1854 }
1855
1856 /*
1857  * Read the SCSI capacity synchronously (for probing).
1858  */
1859 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
1860     struct ub_capacity *ret)
1861 {
1862         struct ub_scsi_cmd *cmd;
1863         struct scatterlist *sg;
1864         char *p;
1865         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) + 8 };
1866         unsigned long flags;
1867         unsigned int bsize, shift;
1868         unsigned long nsec;
1869         struct completion compl;
1870         int rc;
1871
1872         init_completion(&compl);
1873
1874         rc = -ENOMEM;
1875         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1876                 goto err_alloc;
1877         p = (char *)cmd + sizeof(struct ub_scsi_cmd);
1878
1879         cmd->cdb[0] = 0x25;
1880         cmd->cdb_len = 10;
1881         cmd->dir = UB_DIR_READ;
1882         cmd->state = UB_CMDST_INIT;
1883         cmd->nsg = 1;
1884         sg = &cmd->sgv[0];
1885         sg_init_table(sg, UB_MAX_REQ_SG);
1886         sg_set_page(sg, virt_to_page(p), 8, (unsigned long)p & (PAGE_SIZE-1));
1887         cmd->len = 8;
1888         cmd->lun = lun;
1889         cmd->done = ub_probe_done;
1890         cmd->back = &compl;
1891
1892         spin_lock_irqsave(sc->lock, flags);
1893         cmd->tag = sc->tagcnt++;
1894
1895         rc = ub_submit_scsi(sc, cmd);
1896         spin_unlock_irqrestore(sc->lock, flags);
1897
1898         if (rc != 0)
1899                 goto err_submit;
1900
1901         wait_for_completion(&compl);
1902
1903         if (cmd->error != 0) {
1904                 rc = -EIO;
1905                 goto err_read;
1906         }
1907         if (cmd->act_len != 8) {
1908                 rc = -EIO;
1909                 goto err_read;
1910         }
1911
1912         /* sd.c special-cases sector size of 0 to mean 512. Needed? Safe? */
1913         nsec = be32_to_cpu(*(__be32 *)p) + 1;
1914         bsize = be32_to_cpu(*(__be32 *)(p + 4));
1915         switch (bsize) {
1916         case 512:       shift = 0;      break;
1917         case 1024:      shift = 1;      break;
1918         case 2048:      shift = 2;      break;
1919         case 4096:      shift = 3;      break;
1920         default:
1921                 rc = -EDOM;
1922                 goto err_inv_bsize;
1923         }
1924
1925         ret->bsize = bsize;
1926         ret->bshift = shift;
1927         ret->nsec = nsec << shift;
1928         rc = 0;
1929
1930 err_inv_bsize:
1931 err_read:
1932 err_submit:
1933         kfree(cmd);
1934 err_alloc:
1935         return rc;
1936 }
1937
1938 /*
1939  */
1940 static void ub_probe_urb_complete(struct urb *urb)
1941 {
1942         struct completion *cop = urb->context;
1943         complete(cop);
1944 }
1945
1946 static void ub_probe_timeout(unsigned long arg)
1947 {
1948         struct completion *cop = (struct completion *) arg;
1949         complete(cop);
1950 }
1951
1952 /*
1953  * Reset with a Bulk reset.
1954  */
1955 static int ub_sync_reset(struct ub_dev *sc)
1956 {
1957         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
1958         struct usb_ctrlrequest *cr;
1959         struct completion compl;
1960         struct timer_list timer;
1961         int rc;
1962
1963         init_completion(&compl);
1964
1965         cr = &sc->work_cr;
1966         cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
1967         cr->bRequest = US_BULK_RESET_REQUEST;
1968         cr->wValue = cpu_to_le16(0);
1969         cr->wIndex = cpu_to_le16(ifnum);
1970         cr->wLength = cpu_to_le16(0);
1971
1972         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1973             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
1974
1975         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
1976                 printk(KERN_WARNING
1977                      "%s: Unable to submit a bulk reset (%d)\n", sc->name, rc);
1978                 return rc;
1979         }
1980
1981         init_timer(&timer);
1982         timer.function = ub_probe_timeout;
1983         timer.data = (unsigned long) &compl;
1984         timer.expires = jiffies + UB_CTRL_TIMEOUT;
1985         add_timer(&timer);
1986
1987         wait_for_completion(&compl);
1988
1989         del_timer_sync(&timer);
1990         usb_kill_urb(&sc->work_urb);
1991
1992         return sc->work_urb.status;
1993 }
1994
1995 /*
1996  * Get number of LUNs by the way of Bulk GetMaxLUN command.
1997  */
1998 static int ub_sync_getmaxlun(struct ub_dev *sc)
1999 {
2000         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
2001         unsigned char *p;
2002         enum { ALLOC_SIZE = 1 };
2003         struct usb_ctrlrequest *cr;
2004         struct completion compl;
2005         struct timer_list timer;
2006         int nluns;
2007         int rc;
2008
2009         init_completion(&compl);
2010
2011         rc = -ENOMEM;
2012         if ((p = kmalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
2013                 goto err_alloc;
2014         *p = 55;
2015
2016         cr = &sc->work_cr;
2017         cr->bRequestType = USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
2018         cr->bRequest = US_BULK_GET_MAX_LUN;
2019         cr->wValue = cpu_to_le16(0);
2020         cr->wIndex = cpu_to_le16(ifnum);
2021         cr->wLength = cpu_to_le16(1);
2022
2023         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
2024             (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
2025
2026         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0)
2027                 goto err_submit;
2028
2029         init_timer(&timer);
2030         timer.function = ub_probe_timeout;
2031         timer.data = (unsigned long) &compl;
2032         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2033         add_timer(&timer);
2034
2035         wait_for_completion(&compl);
2036
2037         del_timer_sync(&timer);
2038         usb_kill_urb(&sc->work_urb);
2039
2040         if ((rc = sc->work_urb.status) < 0)
2041                 goto err_io;
2042
2043         if (sc->work_urb.actual_length != 1) {
2044                 nluns = 0;
2045         } else {
2046                 if ((nluns = *p) == 55) {
2047                         nluns = 0;
2048                 } else {
2049                         /* GetMaxLUN returns the maximum LUN number */
2050                         nluns += 1;
2051                         if (nluns > UB_MAX_LUNS)
2052                                 nluns = UB_MAX_LUNS;
2053                 }
2054         }
2055
2056         kfree(p);
2057         return nluns;
2058
2059 err_io:
2060 err_submit:
2061         kfree(p);
2062 err_alloc:
2063         return rc;
2064 }
2065
2066 /*
2067  * Clear initial stalls.
2068  */
2069 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe)
2070 {
2071         int endp;
2072         struct usb_ctrlrequest *cr;
2073         struct completion compl;
2074         struct timer_list timer;
2075         int rc;
2076
2077         init_completion(&compl);
2078
2079         endp = usb_pipeendpoint(stalled_pipe);
2080         if (usb_pipein (stalled_pipe))
2081                 endp |= USB_DIR_IN;
2082
2083         cr = &sc->work_cr;
2084         cr->bRequestType = USB_RECIP_ENDPOINT;
2085         cr->bRequest = USB_REQ_CLEAR_FEATURE;
2086         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
2087         cr->wIndex = cpu_to_le16(endp);
2088         cr->wLength = cpu_to_le16(0);
2089
2090         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
2091             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
2092
2093         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
2094                 printk(KERN_WARNING
2095                      "%s: Unable to submit a probe clear (%d)\n", sc->name, rc);
2096                 return rc;
2097         }
2098
2099         init_timer(&timer);
2100         timer.function = ub_probe_timeout;
2101         timer.data = (unsigned long) &compl;
2102         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2103         add_timer(&timer);
2104
2105         wait_for_completion(&compl);
2106
2107         del_timer_sync(&timer);
2108         usb_kill_urb(&sc->work_urb);
2109
2110         /* reset the endpoint toggle */
2111         usb_settoggle(sc->dev, endp, usb_pipeout(sc->last_pipe), 0);
2112
2113         return 0;
2114 }
2115
2116 /*
2117  * Get the pipe settings.
2118  */
2119 static int ub_get_pipes(struct ub_dev *sc, struct usb_device *dev,
2120     struct usb_interface *intf)
2121 {
2122         struct usb_host_interface *altsetting = intf->cur_altsetting;
2123         struct usb_endpoint_descriptor *ep_in = NULL;
2124         struct usb_endpoint_descriptor *ep_out = NULL;
2125         struct usb_endpoint_descriptor *ep;
2126         int i;
2127
2128         /*
2129          * Find the endpoints we need.
2130          * We are expecting a minimum of 2 endpoints - in and out (bulk).
2131          * We will ignore any others.
2132          */
2133         for (i = 0; i < altsetting->desc.bNumEndpoints; i++) {
2134                 ep = &altsetting->endpoint[i].desc;
2135
2136                 /* Is it a BULK endpoint? */
2137                 if ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
2138                                 == USB_ENDPOINT_XFER_BULK) {
2139                         /* BULK in or out? */
2140                         if (ep->bEndpointAddress & USB_DIR_IN) {
2141                                 if (ep_in == NULL)
2142                                         ep_in = ep;
2143                         } else {
2144                                 if (ep_out == NULL)
2145                                         ep_out = ep;
2146                         }
2147                 }
2148         }
2149
2150         if (ep_in == NULL || ep_out == NULL) {
2151                 printk(KERN_NOTICE "%s: failed endpoint check\n",
2152                     sc->name);
2153                 return -ENODEV;
2154         }
2155
2156         /* Calculate and store the pipe values */
2157         sc->send_ctrl_pipe = usb_sndctrlpipe(dev, 0);
2158         sc->recv_ctrl_pipe = usb_rcvctrlpipe(dev, 0);
2159         sc->send_bulk_pipe = usb_sndbulkpipe(dev,
2160                 ep_out->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2161         sc->recv_bulk_pipe = usb_rcvbulkpipe(dev,
2162                 ep_in->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2163
2164         return 0;
2165 }
2166
2167 /*
2168  * Probing is done in the process context, which allows us to cheat
2169  * and not to build a state machine for the discovery.
2170  */
2171 static int ub_probe(struct usb_interface *intf,
2172     const struct usb_device_id *dev_id)
2173 {
2174         struct ub_dev *sc;
2175         int nluns;
2176         int rc;
2177         int i;
2178
2179         if (usb_usual_check_type(dev_id, USB_US_TYPE_UB))
2180                 return -ENXIO;
2181
2182         rc = -ENOMEM;
2183         if ((sc = kzalloc(sizeof(struct ub_dev), GFP_KERNEL)) == NULL)
2184                 goto err_core;
2185         sc->lock = ub_next_lock();
2186         INIT_LIST_HEAD(&sc->luns);
2187         usb_init_urb(&sc->work_urb);
2188         tasklet_init(&sc->tasklet, ub_scsi_action, (unsigned long)sc);
2189         atomic_set(&sc->poison, 0);
2190         INIT_WORK(&sc->reset_work, ub_reset_task);
2191         init_waitqueue_head(&sc->reset_wait);
2192
2193         init_timer(&sc->work_timer);
2194         sc->work_timer.data = (unsigned long) sc;
2195         sc->work_timer.function = ub_urb_timeout;
2196
2197         ub_init_completion(&sc->work_done);
2198         sc->work_done.done = 1;         /* A little yuk, but oh well... */
2199
2200         sc->dev = interface_to_usbdev(intf);
2201         sc->intf = intf;
2202         // sc->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
2203         usb_set_intfdata(intf, sc);
2204         usb_get_dev(sc->dev);
2205         /*
2206          * Since we give the interface struct to the block level through
2207          * disk->driverfs_dev, we have to pin it. Otherwise, block_uevent
2208          * oopses on close after a disconnect (kernels 2.6.16 and up).
2209          */
2210         usb_get_intf(sc->intf);
2211
2212         snprintf(sc->name, 12, DRV_NAME "(%d.%d)",
2213             sc->dev->bus->busnum, sc->dev->devnum);
2214
2215         /* XXX Verify that we can handle the device (from descriptors) */
2216
2217         if (ub_get_pipes(sc, sc->dev, intf) != 0)
2218                 goto err_dev_desc;
2219
2220         /*
2221          * At this point, all USB initialization is done, do upper layer.
2222          * We really hate halfway initialized structures, so from the
2223          * invariants perspective, this ub_dev is fully constructed at
2224          * this point.
2225          */
2226
2227         /*
2228          * This is needed to clear toggles. It is a problem only if we do
2229          * `rmmod ub && modprobe ub` without disconnects, but we like that.
2230          */
2231 #if 0 /* iPod Mini fails if we do this (big white iPod works) */
2232         ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
2233         ub_probe_clear_stall(sc, sc->send_bulk_pipe);
2234 #endif
2235
2236         /*
2237          * The way this is used by the startup code is a little specific.
2238          * A SCSI check causes a USB stall. Our common case code sees it
2239          * and clears the check, after which the device is ready for use.
2240          * But if a check was not present, any command other than
2241          * TEST_UNIT_READY ends with a lockup (including REQUEST_SENSE).
2242          *
2243          * If we neglect to clear the SCSI check, the first real command fails
2244          * (which is the capacity readout). We clear that and retry, but why
2245          * causing spurious retries for no reason.
2246          *
2247          * Revalidation may start with its own TEST_UNIT_READY, but that one
2248          * has to succeed, so we clear checks with an additional one here.
2249          * In any case it's not our business how revaliadation is implemented.
2250          */
2251         for (i = 0; i < 3; i++) {  /* Retries for the schwag key from KS'04 */
2252                 if ((rc = ub_sync_tur(sc, NULL)) <= 0) break;
2253                 if (rc != 0x6) break;
2254                 msleep(10);
2255         }
2256
2257         nluns = 1;
2258         for (i = 0; i < 3; i++) {
2259                 if ((rc = ub_sync_getmaxlun(sc)) < 0)
2260                         break;
2261                 if (rc != 0) {
2262                         nluns = rc;
2263                         break;
2264                 }
2265                 msleep(100);
2266         }
2267
2268         for (i = 0; i < nluns; i++) {
2269                 ub_probe_lun(sc, i);
2270         }
2271         return 0;
2272
2273 err_dev_desc:
2274         usb_set_intfdata(intf, NULL);
2275         usb_put_intf(sc->intf);
2276         usb_put_dev(sc->dev);
2277         kfree(sc);
2278 err_core:
2279         return rc;
2280 }
2281
2282 static int ub_probe_lun(struct ub_dev *sc, int lnum)
2283 {
2284         struct ub_lun *lun;
2285         struct request_queue *q;
2286         struct gendisk *disk;
2287         int rc;
2288
2289         rc = -ENOMEM;
2290         if ((lun = kzalloc(sizeof(struct ub_lun), GFP_KERNEL)) == NULL)
2291                 goto err_alloc;
2292         lun->num = lnum;
2293
2294         rc = -ENOSR;
2295         if ((lun->id = ub_id_get()) == -1)
2296                 goto err_id;
2297
2298         lun->udev = sc;
2299
2300         snprintf(lun->name, 16, DRV_NAME "%c(%d.%d.%d)",
2301             lun->id + 'a', sc->dev->bus->busnum, sc->dev->devnum, lun->num);
2302
2303         lun->removable = 1;             /* XXX Query this from the device */
2304         lun->changed = 1;               /* ub_revalidate clears only */
2305         ub_revalidate(sc, lun);
2306
2307         rc = -ENOMEM;
2308         if ((disk = alloc_disk(UB_PARTS_PER_LUN)) == NULL)
2309                 goto err_diskalloc;
2310
2311         sprintf(disk->disk_name, DRV_NAME "%c", lun->id + 'a');
2312         disk->major = UB_MAJOR;
2313         disk->first_minor = lun->id * UB_PARTS_PER_LUN;
2314         disk->fops = &ub_bd_fops;
2315         disk->private_data = lun;
2316         disk->driverfs_dev = &sc->intf->dev;
2317
2318         rc = -ENOMEM;
2319         if ((q = blk_init_queue(ub_request_fn, sc->lock)) == NULL)
2320                 goto err_blkqinit;
2321
2322         disk->queue = q;
2323
2324         blk_queue_bounce_limit(q, BLK_BOUNCE_HIGH);
2325         blk_queue_max_hw_segments(q, UB_MAX_REQ_SG);
2326         blk_queue_max_phys_segments(q, UB_MAX_REQ_SG);
2327         blk_queue_segment_boundary(q, 0xffffffff);      /* Dubious. */
2328         blk_queue_max_sectors(q, UB_MAX_SECTORS);
2329         blk_queue_hardsect_size(q, lun->capacity.bsize);
2330
2331         lun->disk = disk;
2332         q->queuedata = lun;
2333         list_add(&lun->link, &sc->luns);
2334
2335         set_capacity(disk, lun->capacity.nsec);
2336         if (lun->removable)
2337                 disk->flags |= GENHD_FL_REMOVABLE;
2338
2339         add_disk(disk);
2340
2341         return 0;
2342
2343 err_blkqinit:
2344         put_disk(disk);
2345 err_diskalloc:
2346         ub_id_put(lun->id);
2347 err_id:
2348         kfree(lun);
2349 err_alloc:
2350         return rc;
2351 }
2352
2353 static void ub_disconnect(struct usb_interface *intf)
2354 {
2355         struct ub_dev *sc = usb_get_intfdata(intf);
2356         struct ub_lun *lun;
2357         unsigned long flags;
2358
2359         /*
2360          * Prevent ub_bd_release from pulling the rug from under us.
2361          * XXX This is starting to look like a kref.
2362          * XXX Why not to take this ref at probe time?
2363          */
2364         spin_lock_irqsave(&ub_lock, flags);
2365         sc->openc++;
2366         spin_unlock_irqrestore(&ub_lock, flags);
2367
2368         /*
2369          * Fence stall clearnings, operations triggered by unlinkings and so on.
2370          * We do not attempt to unlink any URBs, because we do not trust the
2371          * unlink paths in HC drivers. Also, we get -84 upon disconnect anyway.
2372          */
2373         atomic_set(&sc->poison, 1);
2374
2375         /*
2376          * Wait for reset to end, if any.
2377          */
2378         wait_event(sc->reset_wait, !sc->reset);
2379
2380         /*
2381          * Blow away queued commands.
2382          *
2383          * Actually, this never works, because before we get here
2384          * the HCD terminates outstanding URB(s). It causes our
2385          * SCSI command queue to advance, commands fail to submit,
2386          * and the whole queue drains. So, we just use this code to
2387          * print warnings.
2388          */
2389         spin_lock_irqsave(sc->lock, flags);
2390         {
2391                 struct ub_scsi_cmd *cmd;
2392                 int cnt = 0;
2393                 while ((cmd = ub_cmdq_peek(sc)) != NULL) {
2394                         cmd->error = -ENOTCONN;
2395                         cmd->state = UB_CMDST_DONE;
2396                         ub_cmdq_pop(sc);
2397                         (*cmd->done)(sc, cmd);
2398                         cnt++;
2399                 }
2400                 if (cnt != 0) {
2401                         printk(KERN_WARNING "%s: "
2402                             "%d was queued after shutdown\n", sc->name, cnt);
2403                 }
2404         }
2405         spin_unlock_irqrestore(sc->lock, flags);
2406
2407         /*
2408          * Unregister the upper layer.
2409          */
2410         list_for_each_entry(lun, &sc->luns, link) {
2411                 del_gendisk(lun->disk);
2412                 /*
2413                  * I wish I could do:
2414                  *    queue_flag_set(QUEUE_FLAG_DEAD, q);
2415                  * As it is, we rely on our internal poisoning and let
2416                  * the upper levels to spin furiously failing all the I/O.
2417                  */
2418         }
2419
2420         /*
2421          * Testing for -EINPROGRESS is always a bug, so we are bending
2422          * the rules a little.
2423          */
2424         spin_lock_irqsave(sc->lock, flags);
2425         if (sc->work_urb.status == -EINPROGRESS) {      /* janitors: ignore */
2426                 printk(KERN_WARNING "%s: "
2427                     "URB is active after disconnect\n", sc->name);
2428         }
2429         spin_unlock_irqrestore(sc->lock, flags);
2430
2431         /*
2432          * There is virtually no chance that other CPU runs times so long
2433          * after ub_urb_complete should have called del_timer, but only if HCD
2434          * didn't forget to deliver a callback on unlink.
2435          */
2436         del_timer_sync(&sc->work_timer);
2437
2438         /*
2439          * At this point there must be no commands coming from anyone
2440          * and no URBs left in transit.
2441          */
2442
2443         ub_put(sc);
2444 }
2445
2446 static struct usb_driver ub_driver = {
2447         .name =         "ub",
2448         .probe =        ub_probe,
2449         .disconnect =   ub_disconnect,
2450         .id_table =     ub_usb_ids,
2451 };
2452
2453 static int __init ub_init(void)
2454 {
2455         int rc;
2456         int i;
2457
2458         for (i = 0; i < UB_QLOCK_NUM; i++)
2459                 spin_lock_init(&ub_qlockv[i]);
2460
2461         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
2462                 goto err_regblkdev;
2463
2464         if ((rc = usb_register(&ub_driver)) != 0)
2465                 goto err_register;
2466
2467         usb_usual_set_present(USB_US_TYPE_UB);
2468         return 0;
2469
2470 err_register:
2471         unregister_blkdev(UB_MAJOR, DRV_NAME);
2472 err_regblkdev:
2473         return rc;
2474 }
2475
2476 static void __exit ub_exit(void)
2477 {
2478         usb_deregister(&ub_driver);
2479
2480         unregister_blkdev(UB_MAJOR, DRV_NAME);
2481         usb_usual_clear_present(USB_US_TYPE_UB);
2482 }
2483
2484 module_init(ub_init);
2485 module_exit(ub_exit);
2486
2487 MODULE_LICENSE("GPL");