drivers/block/ub.c

   1 /*
   2  * The low performance USB storage driver (ub).
   3  *
   4  * Copyright (c) 1999, 2000 Matthew Dharm (mdharm-usb@one-eyed-alien.net)
   5  * Copyright (C) 2004 Pete Zaitcev (zaitcev@yahoo.com)
   6  *
   7  * This work is a part of Linux kernel, is derived from it,
   8  * and is not licensed separately. See file COPYING for details.
   9  *
  10  * TODO (sorted by decreasing priority)
  11  *  -- set readonly flag for CDs, set removable flag for CF readers
  12  *  -- do inquiry and verify we got a disk and not a tape (for LUN mismatch)
  13  *  -- special case some senses, e.g. 3a/0 -> no media present, reduce retries
  14  *  -- verify the 13 conditions and do bulk resets
  15  *  -- kill last_pipe and simply do two-state clearing on both pipes
  16  *  -- highmem
  17  *  -- move top_sense and work_bcs into separate allocations (if they survive)
  18  *     for cache purists and esoteric architectures.
  19  *  -- Allocate structure for LUN 0 before the first ub_sync_tur, avoid NULL. ?
  20  *  -- prune comments, they are too volumnous
  21  *  -- Exterminate P3 printks
  22  *  -- Resove XXX's
  23  *  -- Redo "benh's retries", perhaps have spin-up code to handle them. V:D=?
  24  *  -- CLEAR, CLR2STS, CLRRS seem to be ripe for refactoring.
  25  */
  26 #include <linux/kernel.h>
  27 #include <linux/module.h>
  28 #include <linux/usb.h>
  29 #include <linux/usb_usual.h>
  30 #include <linux/blkdev.h>
  31 #include <linux/devfs_fs_kernel.h>
  32 #include <linux/timer.h>
  33 #include <scsi/scsi.h>
  34
  35 #define DRV_NAME "ub"
  36 #define DEVFS_NAME DRV_NAME
  37
  38 #define UB_MAJOR 180
  39
  40 /*
  41  * The command state machine is the key model for understanding of this driver.
  42  *
  43  * The general rule is that all transitions are done towards the bottom
  44  * of the diagram, thus preventing any loops.
  45  *
  46  * An exception to that is how the STAT state is handled. A counter allows it
  47  * to be re-entered along the path marked with [C].
  48  *
  49  *       +--------+
  50  *       ! INIT   !
  51  *       +--------+
  52  *           !
  53  *        ub_scsi_cmd_start fails ->--------------------------------------\
  54  *           !                                                            !
  55  *           V                                                            !
  56  *       +--------+                                                       !
  57  *       ! CMD    !                                                       !
  58  *       +--------+                                                       !
  59  *           !                                            +--------+      !
  60  *         was -EPIPE -->-------------------------------->! CLEAR  !      !
  61  *           !                                            +--------+      !
  62  *           !                                                !           !
  63  *         was error -->------------------------------------- ! --------->\
  64  *           !                                                !           !
  65  *  /--<-- cmd->dir == NONE ?                                 !           !
  66  *  !        !                                                !           !
  67  *  !        V                                                !           !
  68  *  !    +--------+                                           !           !
  69  *  !    ! DATA   !                                           !           !
  70  *  !    +--------+                                           !           !
  71  *  !        !                           +---------+          !           !
  72  *  !      was -EPIPE -->--------------->! CLR2STS !          !           !
  73  *  !        !                           +---------+          !           !
  74  *  !        !                                !               !           !
  75  *  !        !                              was error -->---- ! --------->\
  76  *  !      was error -->--------------------- ! ------------- ! --------->\
  77  *  !        !                                !               !           !
  78  *  !        V                                !               !           !
  79  *  \--->+--------+                           !               !           !
  80  *       ! STAT   !<--------------------------/               !           !
  81  *  /--->+--------+                                           !           !
  82  *  !        !                                                !           !
  83  * [C]     was -EPIPE -->-----------\                         !           !
  84  *  !        !                      !                         !           !
  85  *  +<---- len == 0                 !                         !           !
  86  *  !        !                      !                         !           !
  87  *  !      was error -->--------------------------------------!---------->\
  88  *  !        !                      !                         !           !
  89  *  +<---- bad CSW                  !                         !           !
  90  *  +<---- bad tag                  !                         !           !
  91  *  !        !                      V                         !           !
  92  *  !        !                 +--------+                     !           !
  93  *  !        !                 ! CLRRS  !                     !           !
  94  *  !        !                 +--------+                     !           !
  95  *  !        !                      !                         !           !
  96  *  \------- ! --------------------[C]--------\               !           !
  97  *           !                                !               !           !
  98  *         cmd->error---\                +--------+           !           !
  99  *           !          +--------------->! SENSE  !<----------/           !
 100  *         STAT_FAIL----/                +--------+                       !
 101  *           !                                !                           V
 102  *           !                                V                      +--------+
 103  *           \--------------------------------\--------------------->! DONE   !
 104  *                                                                   +--------+
 105  */
 106
 107 /*
 108  * This many LUNs per USB device.
 109  * Every one of them takes a host, see UB_MAX_HOSTS.
 110  */
 111 #define UB_MAX_LUNS   9
 112
 113 /*
 114  */
 115
 116 #define UB_PARTS_PER_LUN      8
 117
 118 #define UB_MAX_CDB_SIZE      16         /* Corresponds to Bulk */
 119
 120 #define UB_SENSE_SIZE  18
 121
 122 /*
 123  */
 124
 125 /* command block wrapper */
 126 struct bulk_cb_wrap {
 127         __le32  Signature;              /* contains 'USBC' */
 128         u32     Tag;                    /* unique per command id */
 129         __le32  DataTransferLength;     /* size of data */
 130         u8      Flags;                  /* direction in bit 0 */
 131         u8      Lun;                    /* LUN */
 132         u8      Length;                 /* of of the CDB */
 133         u8      CDB[UB_MAX_CDB_SIZE];   /* max command */
 134 };
 135
 136 #define US_BULK_CB_WRAP_LEN     31
 137 #define US_BULK_CB_SIGN         0x43425355      /*spells out USBC */
 138 #define US_BULK_FLAG_IN         1
 139 #define US_BULK_FLAG_OUT        0
 140
 141 /* command status wrapper */
 142 struct bulk_cs_wrap {
 143         __le32  Signature;              /* should = 'USBS' */
 144         u32     Tag;                    /* same as original command */
 145         __le32  Residue;                /* amount not transferred */
 146         u8      Status;                 /* see below */
 147 };
 148
 149 #define US_BULK_CS_WRAP_LEN     13
 150 #define US_BULK_CS_SIGN         0x53425355      /* spells out 'USBS' */
 151 #define US_BULK_STAT_OK         0
 152 #define US_BULK_STAT_FAIL       1
 153 #define US_BULK_STAT_PHASE      2
 154
 155 /* bulk-only class specific requests */
 156 #define US_BULK_RESET_REQUEST   0xff
 157 #define US_BULK_GET_MAX_LUN     0xfe
 158
 159 /*
 160  */
 161 struct ub_dev;
 162
 163 #define UB_MAX_REQ_SG   9       /* cdrecord requires 32KB and maybe a header */
 164 #define UB_MAX_SECTORS 64
 165
 166 /*
 167  * A second is more than enough for a 32K transfer (UB_MAX_SECTORS)
 168  * even if a webcam hogs the bus, but some devices need time to spin up.
 169  */
 170 #define UB_URB_TIMEOUT  (HZ*2)
 171 #define UB_DATA_TIMEOUT (HZ*5)  /* ZIP does spin-ups in the data phase */
 172 #define UB_STAT_TIMEOUT (HZ*5)  /* Same spinups and eject for a dataless cmd. */
 173 #define UB_CTRL_TIMEOUT (HZ/2)  /* 500ms ought to be enough to clear a stall */
 174
 175 /*
 176  * An instance of a SCSI command in transit.
 177  */
 178 #define UB_DIR_NONE     0
 179 #define UB_DIR_READ     1
 180 #define UB_DIR_ILLEGAL2 2
 181 #define UB_DIR_WRITE    3
 182
 183 /* P3 */
 184 #define UB_DIR_CHAR(c)  (((c)==UB_DIR_WRITE)? 'w': \
 185                          (((c)==UB_DIR_READ)? 'r': 'n'))
 186
 187 enum ub_scsi_cmd_state {
 188         UB_CMDST_INIT,                  /* Initial state */
 189         UB_CMDST_CMD,                   /* Command submitted */
 190         UB_CMDST_DATA,                  /* Data phase */
 191         UB_CMDST_CLR2STS,               /* Clearing before requesting status */
 192         UB_CMDST_STAT,                  /* Status phase */
 193         UB_CMDST_CLEAR,                 /* Clearing a stall (halt, actually) */
 194         UB_CMDST_CLRRS,                 /* Clearing before retrying status */
 195         UB_CMDST_SENSE,                 /* Sending Request Sense */
 196         UB_CMDST_DONE                   /* Final state */
 197 };
 198
 199 struct ub_scsi_cmd {
 200         unsigned char cdb[UB_MAX_CDB_SIZE];
 201         unsigned char cdb_len;
 202
 203         unsigned char dir;              /* 0 - none, 1 - read, 3 - write. */
 204         enum ub_scsi_cmd_state state;
 205         unsigned int tag;
 206         struct ub_scsi_cmd *next;
 207
 208         int error;                      /* Return code - valid upon done */
 209         unsigned int act_len;           /* Return size */
 210         unsigned char key, asc, ascq;   /* May be valid if error==-EIO */
 211
 212         int stat_count;                 /* Retries getting status. */
 213
 214         unsigned int len;               /* Requested length */
 215         unsigned int current_sg;
 216         unsigned int nsg;               /* sgv[nsg] */
 217         struct scatterlist sgv[UB_MAX_REQ_SG];
 218
 219         struct ub_lun *lun;
 220         void (*done)(struct ub_dev *, struct ub_scsi_cmd *);
 221         void *back;
 222 };
 223
 224 struct ub_request {
 225         struct request *rq;
 226         unsigned int current_try;
 227         unsigned int nsg;               /* sgv[nsg] */
 228         struct scatterlist sgv[UB_MAX_REQ_SG];
 229 };
 230
 231 /*
 232  */
 233 struct ub_capacity {
 234         unsigned long nsec;             /* Linux size - 512 byte sectors */
 235         unsigned int bsize;             /* Linux hardsect_size */
 236         unsigned int bshift;            /* Shift between 512 and hard sects */
 237 };
 238
 239 /*
 240  * This is a direct take-off from linux/include/completion.h
 241  * The difference is that I do not wait on this thing, just poll.
 242  * When I want to wait (ub_probe), I just use the stock completion.
 243  *
 244  * Note that INIT_COMPLETION takes no lock. It is correct. But why
 245  * in the bloody hell that thing takes struct instead of pointer to struct
 246  * is quite beyond me. I just copied it from the stock completion.
 247  */
 248 struct ub_completion {
 249         unsigned int done;
 250         spinlock_t lock;
 251 };
 252
 253 static inline void ub_init_completion(struct ub_completion *x)
 254 {
 255         x->done = 0;
 256         spin_lock_init(&x->lock);
 257 }
 258
 259 #define UB_INIT_COMPLETION(x)   ((x).done = 0)
 260
 261 static void ub_complete(struct ub_completion *x)
 262 {
 263         unsigned long flags;
 264
 265         spin_lock_irqsave(&x->lock, flags);
 266         x->done++;
 267         spin_unlock_irqrestore(&x->lock, flags);
 268 }
 269
 270 static int ub_is_completed(struct ub_completion *x)
 271 {
 272         unsigned long flags;
 273         int ret;
 274
 275         spin_lock_irqsave(&x->lock, flags);
 276         ret = x->done;
 277         spin_unlock_irqrestore(&x->lock, flags);
 278         return ret;
 279 }
 280
 281 /*
 282  */
 283 struct ub_scsi_cmd_queue {
 284         int qlen, qmax;
 285         struct ub_scsi_cmd *head, *tail;
 286 };
 287
 288 /*
 289  * The block device instance (one per LUN).
 290  */
 291 struct ub_lun {
 292         struct ub_dev *udev;
 293         struct list_head link;
 294         struct gendisk *disk;
 295         int id;                         /* Host index */
 296         int num;                        /* LUN number */
 297         char name[16];
 298
 299         int changed;                    /* Media was changed */
 300         int removable;
 301         int readonly;
 302
 303         struct ub_request urq;
 304
 305         /* Use Ingo's mempool if or when we have more than one command. */
 306         /*
 307          * Currently we never need more than one command for the whole device.
 308          * However, giving every LUN a command is a cheap and automatic way
 309          * to enforce fairness between them.
 310          */
 311         int cmda[1];
 312         struct ub_scsi_cmd cmdv[1];
 313
 314         struct ub_capacity capacity;
 315 };
 316
 317 /*
 318  * The USB device instance.
 319  */
 320 struct ub_dev {
 321         spinlock_t *lock;
 322         atomic_t poison;                /* The USB device is disconnected */
 323         int openc;                      /* protected by ub_lock! */
 324                                         /* kref is too implicit for our taste */
 325         int reset;                      /* Reset is running */
 326         unsigned int tagcnt;
 327         char name[12];
 328         struct usb_device *dev;
 329         struct usb_interface *intf;
 330
 331         struct list_head luns;
 332
 333         unsigned int send_bulk_pipe;    /* cached pipe values */
 334         unsigned int recv_bulk_pipe;
 335         unsigned int send_ctrl_pipe;
 336         unsigned int recv_ctrl_pipe;
 337
 338         struct tasklet_struct tasklet;
 339
 340         struct ub_scsi_cmd_queue cmd_queue;
 341         struct ub_scsi_cmd top_rqs_cmd; /* REQUEST SENSE */
 342         unsigned char top_sense[UB_SENSE_SIZE];
 343
 344         struct ub_completion work_done;
 345         struct urb work_urb;
 346         struct timer_list work_timer;
 347         int last_pipe;                  /* What might need clearing */
 348         __le32 signature;               /* Learned signature */
 349         struct bulk_cb_wrap work_bcb;
 350         struct bulk_cs_wrap work_bcs;
 351         struct usb_ctrlrequest work_cr;
 352
 353         struct work_struct reset_work;
 354         wait_queue_head_t reset_wait;
 355
 356         int sg_stat[6];
 357 };
 358
 359 /*
 360  */
 361 static void ub_cleanup(struct ub_dev *sc);
 362 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq);
 363 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
 364     struct ub_scsi_cmd *cmd, struct ub_request *urq);
 365 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
 366     struct ub_scsi_cmd *cmd, struct ub_request *urq);
 367 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 368 static void ub_end_rq(struct request *rq, int uptodate);
 369 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
 370     struct ub_request *urq, struct ub_scsi_cmd *cmd);
 371 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 372 static void ub_urb_complete(struct urb *urb, struct pt_regs *pt);
 373 static void ub_scsi_action(unsigned long _dev);
 374 static void ub_scsi_dispatch(struct ub_dev *sc);
 375 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 376 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 377 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc);
 378 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 379 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 380 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 381 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 382 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
 383     int stalled_pipe);
 384 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd);
 385 static void ub_reset_enter(struct ub_dev *sc, int try);
 386 static void ub_reset_task(void *arg);
 387 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun);
 388 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
 389     struct ub_capacity *ret);
 390 static int ub_sync_reset(struct ub_dev *sc);
 391 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe);
 392 static int ub_probe_lun(struct ub_dev *sc, int lnum);
 393
 394 /*
 395  */
 396 #ifdef CONFIG_USB_LIBUSUAL
 397
 398 #define ub_usb_ids  storage_usb_ids
 399 #else
 400
 401 static struct usb_device_id ub_usb_ids[] = {
 402         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, US_SC_SCSI, US_PR_BULK) },
 403         { }
 404 };
 405
 406 MODULE_DEVICE_TABLE(usb, ub_usb_ids);
 407 #endif /* CONFIG_USB_LIBUSUAL */
 408
 409 /*
 410  * Find me a way to identify "next free minor" for add_disk(),
 411  * and the array disappears the next day. However, the number of
 412  * hosts has something to do with the naming and /proc/partitions.
 413  * This has to be thought out in detail before changing.
 414  * If UB_MAX_HOST was 1000, we'd use a bitmap. Or a better data structure.
 415  */
 416 #define UB_MAX_HOSTS  26
 417 static char ub_hostv[UB_MAX_HOSTS];
 418
 419 #define UB_QLOCK_NUM 5
 420 static spinlock_t ub_qlockv[UB_QLOCK_NUM];
 421 static int ub_qlock_next = 0;
 422
 423 static DEFINE_SPINLOCK(ub_lock);        /* Locks globals and ->openc */
 424
 425 /*
 426  * The id allocator.
 427  *
 428  * This also stores the host for indexing by minor, which is somewhat dirty.
 429  */
 430 static int ub_id_get(void)
 431 {
 432         unsigned long flags;
 433         int i;
 434
 435         spin_lock_irqsave(&ub_lock, flags);
 436         for (i = 0; i < UB_MAX_HOSTS; i++) {
 437                 if (ub_hostv[i] == 0) {
 438                         ub_hostv[i] = 1;
 439                         spin_unlock_irqrestore(&ub_lock, flags);
 440                         return i;
 441                 }
 442         }
 443         spin_unlock_irqrestore(&ub_lock, flags);
 444         return -1;
 445 }
 446
 447 static void ub_id_put(int id)
 448 {
 449         unsigned long flags;
 450
 451         if (id < 0 || id >= UB_MAX_HOSTS) {
 452                 printk(KERN_ERR DRV_NAME ": bad host ID %d\n", id);
 453                 return;
 454         }
 455
 456         spin_lock_irqsave(&ub_lock, flags);
 457         if (ub_hostv[id] == 0) {
 458                 spin_unlock_irqrestore(&ub_lock, flags);
 459                 printk(KERN_ERR DRV_NAME ": freeing free host ID %d\n", id);
 460                 return;
 461         }
 462         ub_hostv[id] = 0;
 463         spin_unlock_irqrestore(&ub_lock, flags);
 464 }
 465
 466 /*
 467  * This is necessitated by the fact that blk_cleanup_queue does not
 468  * necesserily destroy the queue. Instead, it may merely decrease q->refcnt.
 469  * Since our blk_init_queue() passes a spinlock common with ub_dev,
 470  * we have life time issues when ub_cleanup frees ub_dev.
 471  */
 472 static spinlock_t *ub_next_lock(void)
 473 {
 474         unsigned long flags;
 475         spinlock_t *ret;
 476
 477         spin_lock_irqsave(&ub_lock, flags);
 478         ret = &ub_qlockv[ub_qlock_next];
 479         ub_qlock_next = (ub_qlock_next + 1) % UB_QLOCK_NUM;
 480         spin_unlock_irqrestore(&ub_lock, flags);
 481         return ret;
 482 }
 483
 484 /*
 485  * Downcount for deallocation. This rides on two assumptions:
 486  *  - once something is poisoned, its refcount cannot grow
 487  *  - opens cannot happen at this time (del_gendisk was done)
 488  * If the above is true, we can drop the lock, which we need for
 489  * blk_cleanup_queue(): the silly thing may attempt to sleep.
 490  * [Actually, it never needs to sleep for us, but it calls might_sleep()]
 491  */
 492 static void ub_put(struct ub_dev *sc)
 493 {
 494         unsigned long flags;
 495
 496         spin_lock_irqsave(&ub_lock, flags);
 497         --sc->openc;
 498         if (sc->openc == 0 && atomic_read(&sc->poison)) {
 499                 spin_unlock_irqrestore(&ub_lock, flags);
 500                 ub_cleanup(sc);
 501         } else {
 502                 spin_unlock_irqrestore(&ub_lock, flags);
 503         }
 504 }
 505
 506 /*
 507  * Final cleanup and deallocation.
 508  */
 509 static void ub_cleanup(struct ub_dev *sc)
 510 {
 511         struct list_head *p;
 512         struct ub_lun *lun;
 513         request_queue_t *q;
 514
 515         while (!list_empty(&sc->luns)) {
 516                 p = sc->luns.next;
 517                 lun = list_entry(p, struct ub_lun, link);
 518                 list_del(p);
 519
 520                 /* I don't think queue can be NULL. But... Stolen from sx8.c */
 521                 if ((q = lun->disk->queue) != NULL)
 522                         blk_cleanup_queue(q);
 523                 /*
 524                  * If we zero disk->private_data BEFORE put_disk, we have
 525                  * to check for NULL all over the place in open, release,
 526                  * check_media and revalidate, because the block level
 527                  * semaphore is well inside the put_disk.
 528                  * But we cannot zero after the call, because *disk is gone.
 529                  * The sd.c is blatantly racy in this area.
 530                  */
 531                 /* disk->private_data = NULL; */
 532                 put_disk(lun->disk);
 533                 lun->disk = NULL;
 534
 535                 ub_id_put(lun->id);
 536                 kfree(lun);
 537         }
 538
 539         usb_set_intfdata(sc->intf, NULL);
 540         usb_put_intf(sc->intf);
 541         usb_put_dev(sc->dev);
 542         kfree(sc);
 543 }
 544
 545 /*
 546  * The "command allocator".
 547  */
 548 static struct ub_scsi_cmd *ub_get_cmd(struct ub_lun *lun)
 549 {
 550         struct ub_scsi_cmd *ret;
 551
 552         if (lun->cmda[0])
 553                 return NULL;
 554         ret = &lun->cmdv[0];
 555         lun->cmda[0] = 1;
 556         return ret;
 557 }
 558
 559 static void ub_put_cmd(struct ub_lun *lun, struct ub_scsi_cmd *cmd)
 560 {
 561         if (cmd != &lun->cmdv[0]) {
 562                 printk(KERN_WARNING "%s: releasing a foreign cmd %p\n",
 563                     lun->name, cmd);
 564                 return;
 565         }
 566         if (!lun->cmda[0]) {
 567                 printk(KERN_WARNING "%s: releasing a free cmd\n", lun->name);
 568                 return;
 569         }
 570         lun->cmda[0] = 0;
 571 }
 572
 573 /*
 574  * The command queue.
 575  */
 576 static void ub_cmdq_add(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 577 {
 578         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 579
 580         if (t->qlen++ == 0) {
 581                 t->head = cmd;
 582                 t->tail = cmd;
 583         } else {
 584                 t->tail->next = cmd;
 585                 t->tail = cmd;
 586         }
 587
 588         if (t->qlen > t->qmax)
 589                 t->qmax = t->qlen;
 590 }
 591
 592 static void ub_cmdq_insert(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 593 {
 594         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 595
 596         if (t->qlen++ == 0) {
 597                 t->head = cmd;
 598                 t->tail = cmd;
 599         } else {
 600                 cmd->next = t->head;
 601                 t->head = cmd;
 602         }
 603
 604         if (t->qlen > t->qmax)
 605                 t->qmax = t->qlen;
 606 }
 607
 608 static struct ub_scsi_cmd *ub_cmdq_pop(struct ub_dev *sc)
 609 {
 610         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
 611         struct ub_scsi_cmd *cmd;
 612
 613         if (t->qlen == 0)
 614                 return NULL;
 615         if (--t->qlen == 0)
 616                 t->tail = NULL;
 617         cmd = t->head;
 618         t->head = cmd->next;
 619         cmd->next = NULL;
 620         return cmd;
 621 }
 622
 623 #define ub_cmdq_peek(sc)  ((sc)->cmd_queue.head)
 624
 625 /*
 626  * The request function is our main entry point
 627  */
 628
 629 static void ub_request_fn(request_queue_t *q)
 630 {
 631         struct ub_lun *lun = q->queuedata;
 632         struct request *rq;
 633
 634         while ((rq = elv_next_request(q)) != NULL) {
 635                 if (ub_request_fn_1(lun, rq) != 0) {
 636                         blk_stop_queue(q);
 637                         break;
 638                 }
 639         }
 640 }
 641
 642 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
 643 {
 644         struct ub_dev *sc = lun->udev;
 645         struct ub_scsi_cmd *cmd;
 646         struct ub_request *urq;
 647         int n_elem;
 648
 649         if (atomic_read(&sc->poison) || lun->changed) {
 650                 blkdev_dequeue_request(rq);
 651                 ub_end_rq(rq, 0);
 652                 return 0;
 653         }
 654
 655         if (lun->urq.rq != NULL)
 656                 return -1;
 657         if ((cmd = ub_get_cmd(lun)) == NULL)
 658                 return -1;
 659         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
 660
 661         blkdev_dequeue_request(rq);
 662
 663         urq = &lun->urq;
 664         memset(urq, 0, sizeof(struct ub_request));
 665         urq->rq = rq;
 666
 667         /*
 668          * get scatterlist from block layer
 669          */
 670         n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
 671         if (n_elem < 0) {
 672                 printk(KERN_INFO "%s: failed request map (%d)\n",
 673                     lun->name, n_elem); /* P3 */
 674                 goto drop;
 675         }
 676         if (n_elem > UB_MAX_REQ_SG) {   /* Paranoia */
 677                 printk(KERN_WARNING "%s: request with %d segments\n",
 678                     lun->name, n_elem);
 679                 goto drop;
 680         }
 681         urq->nsg = n_elem;
 682         sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 683
 684         if (blk_pc_request(rq)) {
 685                 ub_cmd_build_packet(sc, lun, cmd, urq);
 686         } else {
 687                 ub_cmd_build_block(sc, lun, cmd, urq);
 688         }
 689         cmd->state = UB_CMDST_INIT;
 690         cmd->lun = lun;
 691         cmd->done = ub_rw_cmd_done;
 692         cmd->back = urq;
 693
 694         cmd->tag = sc->tagcnt++;
 695         if (ub_submit_scsi(sc, cmd) != 0)
 696                 goto drop;
 697
 698         return 0;
 699
 700 drop:
 701         ub_put_cmd(lun, cmd);
 702         ub_end_rq(rq, 0);
 703         return 0;
 704 }
 705
 706 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
 707     struct ub_scsi_cmd *cmd, struct ub_request *urq)
 708 {
 709         struct request *rq = urq->rq;
 710         unsigned int block, nblks;
 711
 712         if (rq_data_dir(rq) == WRITE)
 713                 cmd->dir = UB_DIR_WRITE;
 714         else
 715                 cmd->dir = UB_DIR_READ;
 716
 717         cmd->nsg = urq->nsg;
 718         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
 719
 720         /*
 721          * build the command
 722          *
 723          * The call to blk_queue_hardsect_size() guarantees that request
 724          * is aligned, but it is given in terms of 512 byte units, always.
 725          */
 726         block = rq->sector >> lun->capacity.bshift;
 727         nblks = rq->nr_sectors >> lun->capacity.bshift;
 728
 729         cmd->cdb[0] = (cmd->dir == UB_DIR_READ)? READ_10: WRITE_10;
 730         /* 10-byte uses 4 bytes of LBA: 2147483648KB, 2097152MB, 2048GB */
 731         cmd->cdb[2] = block >> 24;
 732         cmd->cdb[3] = block >> 16;
 733         cmd->cdb[4] = block >> 8;
 734         cmd->cdb[5] = block;
 735         cmd->cdb[7] = nblks >> 8;
 736         cmd->cdb[8] = nblks;
 737         cmd->cdb_len = 10;
 738
 739         cmd->len = rq->nr_sectors * 512;
 740 }
 741
 742 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
 743     struct ub_scsi_cmd *cmd, struct ub_request *urq)
 744 {
 745         struct request *rq = urq->rq;
 746
 747         if (rq->data_len == 0) {
 748                 cmd->dir = UB_DIR_NONE;
 749         } else {
 750                 if (rq_data_dir(rq) == WRITE)
 751                         cmd->dir = UB_DIR_WRITE;
 752                 else
 753                         cmd->dir = UB_DIR_READ;
 754         }
 755
 756         cmd->nsg = urq->nsg;
 757         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
 758
 759         memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
 760         cmd->cdb_len = rq->cmd_len;
 761
 762         cmd->len = rq->data_len;
 763 }
 764
 765 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 766 {
 767         struct ub_lun *lun = cmd->lun;
 768         struct ub_request *urq = cmd->back;
 769         struct request *rq;
 770         int uptodate;
 771
 772         rq = urq->rq;
 773
 774         if (cmd->error == 0) {
 775                 uptodate = 1;
 776
 777                 if (blk_pc_request(rq)) {
 778                         if (cmd->act_len >= rq->data_len)
 779                                 rq->data_len = 0;
 780                         else
 781                                 rq->data_len -= cmd->act_len;
 782                 }
 783         } else {
 784                 uptodate = 0;
 785
 786                 if (blk_pc_request(rq)) {
 787                         /* UB_SENSE_SIZE is smaller than SCSI_SENSE_BUFFERSIZE */
 788                         memcpy(rq->sense, sc->top_sense, UB_SENSE_SIZE);
 789                         rq->sense_len = UB_SENSE_SIZE;
 790                         if (sc->top_sense[0] != 0)
 791                                 rq->errors = SAM_STAT_CHECK_CONDITION;
 792                         else
 793                                 rq->errors = DID_ERROR << 16;
 794                 } else {
 795                         if (cmd->error == -EIO) {
 796                                 if (ub_rw_cmd_retry(sc, lun, urq, cmd) == 0)
 797                                         return;
 798                         }
 799                 }
 800         }
 801
 802         urq->rq = NULL;
 803
 804         ub_put_cmd(lun, cmd);
 805         ub_end_rq(rq, uptodate);
 806         blk_start_queue(lun->disk->queue);
 807 }
 808
 809 static void ub_end_rq(struct request *rq, int uptodate)
 810 {
 811         end_that_request_first(rq, uptodate, rq->hard_nr_sectors);
 812         end_that_request_last(rq, uptodate);
 813 }
 814
 815 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
 816     struct ub_request *urq, struct ub_scsi_cmd *cmd)
 817 {
 818
 819         if (atomic_read(&sc->poison))
 820                 return -ENXIO;
 821
 822         ub_reset_enter(sc, urq->current_try);
 823
 824         if (urq->current_try >= 3)
 825                 return -EIO;
 826         urq->current_try++;
 827         /* P3 */ printk("%s: dir %c len/act %d/%d "
 828             "[sense %x %02x %02x] retry %d\n",
 829             sc->name, UB_DIR_CHAR(cmd->dir), cmd->len, cmd->act_len,
 830             cmd->key, cmd->asc, cmd->ascq, urq->current_try);
 831
 832         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
 833         ub_cmd_build_block(sc, lun, cmd, urq);
 834
 835         cmd->state = UB_CMDST_INIT;
 836         cmd->lun = lun;
 837         cmd->done = ub_rw_cmd_done;
 838         cmd->back = urq;
 839
 840         cmd->tag = sc->tagcnt++;
 841
 842 #if 0 /* Wasteful */
 843         return ub_submit_scsi(sc, cmd);
 844 #else
 845         ub_cmdq_add(sc, cmd);
 846         return 0;
 847 #endif
 848 }
 849
 850 /*
 851  * Submit a regular SCSI operation (not an auto-sense).
 852  *
 853  * The Iron Law of Good Submit Routine is:
 854  * Zero return - callback is done, Nonzero return - callback is not done.
 855  * No exceptions.
 856  *
 857  * Host is assumed locked.
 858  */
 859 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 860 {
 861
 862         if (cmd->state != UB_CMDST_INIT ||
 863             (cmd->dir != UB_DIR_NONE && cmd->len == 0)) {
 864                 return -EINVAL;
 865         }
 866
 867         ub_cmdq_add(sc, cmd);
 868         /*
 869          * We can call ub_scsi_dispatch(sc) right away here, but it's a little
 870          * safer to jump to a tasklet, in case upper layers do something silly.
 871          */
 872         tasklet_schedule(&sc->tasklet);
 873         return 0;
 874 }
 875
 876 /*
 877  * Submit the first URB for the queued command.
 878  * This function does not deal with queueing in any way.
 879  */
 880 static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 881 {
 882         struct bulk_cb_wrap *bcb;
 883         int rc;
 884
 885         bcb = &sc->work_bcb;
 886
 887         /*
 888          * ``If the allocation length is eighteen or greater, and a device
 889          * server returns less than eithteen bytes of data, the application
 890          * client should assume that the bytes not transferred would have been
 891          * zeroes had the device server returned those bytes.''
 892          *
 893          * We zero sense for all commands so that when a packet request
 894          * fails it does not return a stale sense.
 895          */
 896         memset(&sc->top_sense, 0, UB_SENSE_SIZE);
 897
 898         /* set up the command wrapper */
 899         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
 900         bcb->Tag = cmd->tag;            /* Endianness is not important */
 901         bcb->DataTransferLength = cpu_to_le32(cmd->len);
 902         bcb->Flags = (cmd->dir == UB_DIR_READ) ? 0x80 : 0;
 903         bcb->Lun = (cmd->lun != NULL) ? cmd->lun->num : 0;
 904         bcb->Length = cmd->cdb_len;
 905
 906         /* copy the command payload */
 907         memcpy(bcb->CDB, cmd->cdb, UB_MAX_CDB_SIZE);
 908
 909         UB_INIT_COMPLETION(sc->work_done);
 910
 911         sc->last_pipe = sc->send_bulk_pipe;
 912         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
 913             bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
 914
 915         /* Fill what we shouldn't be filling, because usb-storage did so. */
 916         sc->work_urb.actual_length = 0;
 917         sc->work_urb.error_count = 0;
 918         sc->work_urb.status = 0;
 919
 920         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
 921                 /* XXX Clear stalls */
 922                 ub_complete(&sc->work_done);
 923                 return rc;
 924         }
 925
 926         sc->work_timer.expires = jiffies + UB_URB_TIMEOUT;
 927         add_timer(&sc->work_timer);
 928
 929         cmd->state = UB_CMDST_CMD;
 930         return 0;
 931 }
 932
 933 /*
 934  * Timeout handler.
 935  */
 936 static void ub_urb_timeout(unsigned long arg)
 937 {
 938         struct ub_dev *sc = (struct ub_dev *) arg;
 939         unsigned long flags;
 940
 941         spin_lock_irqsave(sc->lock, flags);
 942         if (!ub_is_completed(&sc->work_done))
 943                 usb_unlink_urb(&sc->work_urb);
 944         spin_unlock_irqrestore(sc->lock, flags);
 945 }
 946
 947 /*
 948  * Completion routine for the work URB.
 949  *
 950  * This can be called directly from usb_submit_urb (while we have
 951  * the sc->lock taken) and from an interrupt (while we do NOT have
 952  * the sc->lock taken). Therefore, bounce this off to a tasklet.
 953  */
 954 static void ub_urb_complete(struct urb *urb, struct pt_regs *pt)
 955 {
 956         struct ub_dev *sc = urb->context;
 957
 958         ub_complete(&sc->work_done);
 959         tasklet_schedule(&sc->tasklet);
 960 }
 961
 962 static void ub_scsi_action(unsigned long _dev)
 963 {
 964         struct ub_dev *sc = (struct ub_dev *) _dev;
 965         unsigned long flags;
 966
 967         spin_lock_irqsave(sc->lock, flags);
 968         ub_scsi_dispatch(sc);
 969         spin_unlock_irqrestore(sc->lock, flags);
 970 }
 971
 972 static void ub_scsi_dispatch(struct ub_dev *sc)
 973 {
 974         struct ub_scsi_cmd *cmd;
 975         int rc;
 976
 977         while (!sc->reset && (cmd = ub_cmdq_peek(sc)) != NULL) {
 978                 if (cmd->state == UB_CMDST_DONE) {
 979                         ub_cmdq_pop(sc);
 980                         (*cmd->done)(sc, cmd);
 981                 } else if (cmd->state == UB_CMDST_INIT) {
 982                         if ((rc = ub_scsi_cmd_start(sc, cmd)) == 0)
 983                                 break;
 984                         cmd->error = rc;
 985                         cmd->state = UB_CMDST_DONE;
 986                 } else {
 987                         if (!ub_is_completed(&sc->work_done))
 988                                 break;
 989                         del_timer(&sc->work_timer);
 990                         ub_scsi_urb_compl(sc, cmd);
 991                 }
 992         }
 993 }
 994
 995 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 996 {
 997         struct urb *urb = &sc->work_urb;
 998         struct bulk_cs_wrap *bcs;
 999         int len;
1000         int rc;
1001
1002         if (atomic_read(&sc->poison)) {
1003                 ub_state_done(sc, cmd, -ENODEV);
1004                 return;
1005         }
1006
1007         if (cmd->state == UB_CMDST_CLEAR) {
1008                 if (urb->status == -EPIPE) {
1009                         /*
1010                          * STALL while clearning STALL.
1011                          * The control pipe clears itself - nothing to do.
1012                          */
1013                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1014                             sc->name);
1015                         goto Bad_End;
1016                 }
1017
1018                 /*
1019                  * We ignore the result for the halt clear.
1020                  */
1021
1022                 /* reset the endpoint toggle */
1023                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1024                         usb_pipeout(sc->last_pipe), 0);
1025
1026                 ub_state_sense(sc, cmd);
1027
1028         } else if (cmd->state == UB_CMDST_CLR2STS) {
1029                 if (urb->status == -EPIPE) {
1030                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1031                             sc->name);
1032                         goto Bad_End;
1033                 }
1034
1035                 /*
1036                  * We ignore the result for the halt clear.
1037                  */
1038
1039                 /* reset the endpoint toggle */
1040                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1041                         usb_pipeout(sc->last_pipe), 0);
1042
1043                 ub_state_stat(sc, cmd);
1044
1045         } else if (cmd->state == UB_CMDST_CLRRS) {
1046                 if (urb->status == -EPIPE) {
1047                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1048                             sc->name);
1049                         goto Bad_End;
1050                 }
1051
1052                 /*
1053                  * We ignore the result for the halt clear.
1054                  */
1055
1056                 /* reset the endpoint toggle */
1057                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1058                         usb_pipeout(sc->last_pipe), 0);
1059
1060                 ub_state_stat_counted(sc, cmd);
1061
1062         } else if (cmd->state == UB_CMDST_CMD) {
1063                 switch (urb->status) {
1064                 case 0:
1065                         break;
1066                 case -EOVERFLOW:
1067                         goto Bad_End;
1068                 case -EPIPE:
1069                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1070                         if (rc != 0) {
1071                                 printk(KERN_NOTICE "%s: "
1072                                     "unable to submit clear (%d)\n",
1073                                     sc->name, rc);
1074                                 /*
1075                                  * This is typically ENOMEM or some other such shit.
1076                                  * Retrying is pointless. Just do Bad End on it...
1077                                  */
1078                                 ub_state_done(sc, cmd, rc);
1079                                 return;
1080                         }
1081                         cmd->state = UB_CMDST_CLEAR;
1082                         return;
1083                 case -ESHUTDOWN:        /* unplug */
1084                 case -EILSEQ:           /* unplug timeout on uhci */
1085                         ub_state_done(sc, cmd, -ENODEV);
1086                         return;
1087                 default:
1088                         goto Bad_End;
1089                 }
1090                 if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
1091                         goto Bad_End;
1092                 }
1093
1094                 if (cmd->dir == UB_DIR_NONE || cmd->nsg < 1) {
1095                         ub_state_stat(sc, cmd);
1096                         return;
1097                 }
1098
1099                 // udelay(125);         // usb-storage has this
1100                 ub_data_start(sc, cmd);
1101
1102         } else if (cmd->state == UB_CMDST_DATA) {
1103                 if (urb->status == -EPIPE) {
1104                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1105                         if (rc != 0) {
1106                                 printk(KERN_NOTICE "%s: "
1107                                     "unable to submit clear (%d)\n",
1108                                     sc->name, rc);
1109                                 ub_state_done(sc, cmd, rc);
1110                                 return;
1111                         }
1112                         cmd->state = UB_CMDST_CLR2STS;
1113                         return;
1114                 }
1115                 if (urb->status == -EOVERFLOW) {
1116                         /*
1117                          * A babble? Failure, but we must transfer CSW now.
1118                          */
1119                         cmd->error = -EOVERFLOW;        /* A cheap trick... */
1120                         ub_state_stat(sc, cmd);
1121                         return;
1122                 }
1123
1124                 if (cmd->dir == UB_DIR_WRITE) {
1125                         /*
1126                          * Do not continue writes in case of a failure.
1127                          * Doing so would cause sectors to be mixed up,
1128                          * which is worse than sectors lost.
1129                          *
1130                          * We must try to read the CSW, or many devices
1131                          * get confused.
1132                          */
1133                         len = urb->actual_length;
1134                         if (urb->status != 0 ||
1135                             len != cmd->sgv[cmd->current_sg].length) {
1136                                 cmd->act_len += len;
1137
1138                                 cmd->error = -EIO;
1139                                 ub_state_stat(sc, cmd);
1140                                 return;
1141                         }
1142
1143                 } else {
1144                         /*
1145                          * If an error occurs on read, we record it, and
1146                          * continue to fetch data in order to avoid bubble.
1147                          *
1148                          * As a small shortcut, we stop if we detect that
1149                          * a CSW mixed into data.
1150                          */
1151                         if (urb->status != 0)
1152                                 cmd->error = -EIO;
1153
1154                         len = urb->actual_length;
1155                         if (urb->status != 0 ||
1156                             len != cmd->sgv[cmd->current_sg].length) {
1157                                 if ((len & 0x1FF) == US_BULK_CS_WRAP_LEN)
1158                                         goto Bad_End;
1159                         }
1160                 }
1161
1162                 cmd->act_len += urb->actual_length;
1163
1164                 if (++cmd->current_sg < cmd->nsg) {
1165                         ub_data_start(sc, cmd);
1166                         return;
1167                 }
1168                 ub_state_stat(sc, cmd);
1169
1170         } else if (cmd->state == UB_CMDST_STAT) {
1171                 if (urb->status == -EPIPE) {
1172                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1173                         if (rc != 0) {
1174                                 printk(KERN_NOTICE "%s: "
1175                                     "unable to submit clear (%d)\n",
1176                                     sc->name, rc);
1177                                 ub_state_done(sc, cmd, rc);
1178                                 return;
1179                         }
1180
1181                         /*
1182                          * Having a stall when getting CSW is an error, so
1183                          * make sure uppper levels are not oblivious to it.
1184                          */
1185                         cmd->error = -EIO;              /* A cheap trick... */
1186
1187                         cmd->state = UB_CMDST_CLRRS;
1188                         return;
1189                 }
1190
1191                 /* Catch everything, including -EOVERFLOW and other nasties. */
1192                 if (urb->status != 0)
1193                         goto Bad_End;
1194
1195                 if (urb->actual_length == 0) {
1196                         ub_state_stat_counted(sc, cmd);
1197                         return;
1198                 }
1199
1200                 /*
1201                  * Check the returned Bulk protocol status.
1202                  * The status block has to be validated first.
1203                  */
1204
1205                 bcs = &sc->work_bcs;
1206
1207                 if (sc->signature == cpu_to_le32(0)) {
1208                         /*
1209                          * This is the first reply, so do not perform the check.
1210                          * Instead, remember the signature the device uses
1211                          * for future checks. But do not allow a nul.
1212                          */
1213                         sc->signature = bcs->Signature;
1214                         if (sc->signature == cpu_to_le32(0)) {
1215                                 ub_state_stat_counted(sc, cmd);
1216                                 return;
1217                         }
1218                 } else {
1219                         if (bcs->Signature != sc->signature) {
1220                                 ub_state_stat_counted(sc, cmd);
1221                                 return;
1222                         }
1223                 }
1224
1225                 if (bcs->Tag != cmd->tag) {
1226                         /*
1227                          * This usually happens when we disagree with the
1228                          * device's microcode about something. For instance,
1229                          * a few of them throw this after timeouts. They buffer
1230                          * commands and reply at commands we timed out before.
1231                          * Without flushing these replies we loop forever.
1232                          */
1233                         ub_state_stat_counted(sc, cmd);
1234                         return;
1235                 }
1236
1237                 len = le32_to_cpu(bcs->Residue);
1238                 if (len != cmd->len - cmd->act_len) {
1239                         /*
1240                          * It is all right to transfer less, the caller has
1241                          * to check. But it's not all right if the device
1242                          * counts disagree with our counts.
1243                          */
1244                         /* P3 */ printk("%s: resid %d len %d act %d\n",
1245                             sc->name, len, cmd->len, cmd->act_len);
1246                         goto Bad_End;
1247                 }
1248
1249                 switch (bcs->Status) {
1250                 case US_BULK_STAT_OK:
1251                         break;
1252                 case US_BULK_STAT_FAIL:
1253                         ub_state_sense(sc, cmd);
1254                         return;
1255                 case US_BULK_STAT_PHASE:
1256                         /* P3 */ printk("%s: status PHASE\n", sc->name);
1257                         goto Bad_End;
1258                 default:
1259                         printk(KERN_INFO "%s: unknown CSW status 0x%x\n",
1260                             sc->name, bcs->Status);
1261                         ub_state_done(sc, cmd, -EINVAL);
1262                         return;
1263                 }
1264
1265                 /* Not zeroing error to preserve a babble indicator */
1266                 if (cmd->error != 0) {
1267                         ub_state_sense(sc, cmd);
1268                         return;
1269                 }
1270                 cmd->state = UB_CMDST_DONE;
1271                 ub_cmdq_pop(sc);
1272                 (*cmd->done)(sc, cmd);
1273
1274         } else if (cmd->state == UB_CMDST_SENSE) {
1275                 ub_state_done(sc, cmd, -EIO);
1276
1277         } else {
1278                 printk(KERN_WARNING "%s: "
1279                     "wrong command state %d\n",
1280                     sc->name, cmd->state);
1281                 ub_state_done(sc, cmd, -EINVAL);
1282                 return;
1283         }
1284         return;
1285
1286 Bad_End: /* Little Excel is dead */
1287         ub_state_done(sc, cmd, -EIO);
1288 }
1289
1290 /*
1291  * Factorization helper for the command state machine:
1292  * Initiate a data segment transfer.
1293  */
1294 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1295 {
1296         struct scatterlist *sg = &cmd->sgv[cmd->current_sg];
1297         int pipe;
1298         int rc;
1299
1300         UB_INIT_COMPLETION(sc->work_done);
1301
1302         if (cmd->dir == UB_DIR_READ)
1303                 pipe = sc->recv_bulk_pipe;
1304         else
1305                 pipe = sc->send_bulk_pipe;
1306         sc->last_pipe = pipe;
1307         usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe,
1308             page_address(sg->page) + sg->offset, sg->length,
1309             ub_urb_complete, sc);
1310         sc->work_urb.actual_length = 0;
1311         sc->work_urb.error_count = 0;
1312         sc->work_urb.status = 0;
1313
1314         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1315                 /* XXX Clear stalls */
1316                 ub_complete(&sc->work_done);
1317                 ub_state_done(sc, cmd, rc);
1318                 return;
1319         }
1320
1321         sc->work_timer.expires = jiffies + UB_DATA_TIMEOUT;
1322         add_timer(&sc->work_timer);
1323
1324         cmd->state = UB_CMDST_DATA;
1325 }
1326
1327 /*
1328  * Factorization helper for the command state machine:
1329  * Finish the command.
1330  */
1331 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc)
1332 {
1333
1334         cmd->error = rc;
1335         cmd->state = UB_CMDST_DONE;
1336         ub_cmdq_pop(sc);
1337         (*cmd->done)(sc, cmd);
1338 }
1339
1340 /*
1341  * Factorization helper for the command state machine:
1342  * Submit a CSW read.
1343  */
1344 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1345 {
1346         int rc;
1347
1348         UB_INIT_COMPLETION(sc->work_done);
1349
1350         sc->last_pipe = sc->recv_bulk_pipe;
1351         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
1352             &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
1353         sc->work_urb.actual_length = 0;
1354         sc->work_urb.error_count = 0;
1355         sc->work_urb.status = 0;
1356
1357         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1358                 /* XXX Clear stalls */
1359                 ub_complete(&sc->work_done);
1360                 ub_state_done(sc, cmd, rc);
1361                 return -1;
1362         }
1363
1364         sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
1365         add_timer(&sc->work_timer);
1366         return 0;
1367 }
1368
1369 /*
1370  * Factorization helper for the command state machine:
1371  * Submit a CSW read and go to STAT state.
1372  */
1373 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1374 {
1375
1376         if (__ub_state_stat(sc, cmd) != 0)
1377                 return;
1378
1379         cmd->stat_count = 0;
1380         cmd->state = UB_CMDST_STAT;
1381 }
1382
1383 /*
1384  * Factorization helper for the command state machine:
1385  * Submit a CSW read and go to STAT state with counter (along [C] path).
1386  */
1387 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1388 {
1389
1390         if (++cmd->stat_count >= 4) {
1391                 ub_state_sense(sc, cmd);
1392                 return;
1393         }
1394
1395         if (__ub_state_stat(sc, cmd) != 0)
1396                 return;
1397
1398         cmd->state = UB_CMDST_STAT;
1399 }
1400
1401 /*
1402  * Factorization helper for the command state machine:
1403  * Submit a REQUEST SENSE and go to SENSE state.
1404  */
1405 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1406 {
1407         struct ub_scsi_cmd *scmd;
1408         struct scatterlist *sg;
1409         int rc;
1410
1411         if (cmd->cdb[0] == REQUEST_SENSE) {
1412                 rc = -EPIPE;
1413                 goto error;
1414         }
1415
1416         scmd = &sc->top_rqs_cmd;
1417         memset(scmd, 0, sizeof(struct ub_scsi_cmd));
1418         scmd->cdb[0] = REQUEST_SENSE;
1419         scmd->cdb[4] = UB_SENSE_SIZE;
1420         scmd->cdb_len = 6;
1421         scmd->dir = UB_DIR_READ;
1422         scmd->state = UB_CMDST_INIT;
1423         scmd->nsg = 1;
1424         sg = &scmd->sgv[0];
1425         sg->page = virt_to_page(sc->top_sense);
1426         sg->offset = (unsigned long)sc->top_sense & (PAGE_SIZE-1);
1427         sg->length = UB_SENSE_SIZE;
1428         scmd->len = UB_SENSE_SIZE;
1429         scmd->lun = cmd->lun;
1430         scmd->done = ub_top_sense_done;
1431         scmd->back = cmd;
1432
1433         scmd->tag = sc->tagcnt++;
1434
1435         cmd->state = UB_CMDST_SENSE;
1436
1437         ub_cmdq_insert(sc, scmd);
1438         return;
1439
1440 error:
1441         ub_state_done(sc, cmd, rc);
1442 }
1443
1444 /*
1445  * A helper for the command's state machine:
1446  * Submit a stall clear.
1447  */
1448 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
1449     int stalled_pipe)
1450 {
1451         int endp;
1452         struct usb_ctrlrequest *cr;
1453         int rc;
1454
1455         endp = usb_pipeendpoint(stalled_pipe);
1456         if (usb_pipein (stalled_pipe))
1457                 endp |= USB_DIR_IN;
1458
1459         cr = &sc->work_cr;
1460         cr->bRequestType = USB_RECIP_ENDPOINT;
1461         cr->bRequest = USB_REQ_CLEAR_FEATURE;
1462         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
1463         cr->wIndex = cpu_to_le16(endp);
1464         cr->wLength = cpu_to_le16(0);
1465
1466         UB_INIT_COMPLETION(sc->work_done);
1467
1468         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1469             (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
1470         sc->work_urb.actual_length = 0;
1471         sc->work_urb.error_count = 0;
1472         sc->work_urb.status = 0;
1473
1474         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1475                 ub_complete(&sc->work_done);
1476                 return rc;
1477         }
1478
1479         sc->work_timer.expires = jiffies + UB_CTRL_TIMEOUT;
1480         add_timer(&sc->work_timer);
1481         return 0;
1482 }
1483
1484 /*
1485  */
1486 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
1487 {
1488         unsigned char *sense = sc->top_sense;
1489         struct ub_scsi_cmd *cmd;
1490
1491         /*
1492          * Find the command which triggered the unit attention or a check,
1493          * save the sense into it, and advance its state machine.
1494          */
1495         if ((cmd = ub_cmdq_peek(sc)) == NULL) {
1496                 printk(KERN_WARNING "%s: sense done while idle\n", sc->name);
1497                 return;
1498         }
1499         if (cmd != scmd->back) {
1500                 printk(KERN_WARNING "%s: "
1501                     "sense done for wrong command 0x%x\n",
1502                     sc->name, cmd->tag);
1503                 return;
1504         }
1505         if (cmd->state != UB_CMDST_SENSE) {
1506                 printk(KERN_WARNING "%s: "
1507                     "sense done with bad cmd state %d\n",
1508                     sc->name, cmd->state);
1509                 return;
1510         }
1511
1512         /*
1513          * Ignoring scmd->act_len, because the buffer was pre-zeroed.
1514          */
1515         cmd->key = sense[2] & 0x0F;
1516         cmd->asc = sense[12];
1517         cmd->ascq = sense[13];
1518
1519         ub_scsi_urb_compl(sc, cmd);
1520 }
1521
1522 /*
1523  * Reset management
1524  * XXX Move usb_reset_device to khubd. Hogging kevent is not a good thing.
1525  * XXX Make usb_sync_reset asynchronous.
1526  */
1527
1528 static void ub_reset_enter(struct ub_dev *sc, int try)
1529 {
1530
1531         if (sc->reset) {
1532                 /* This happens often on multi-LUN devices. */
1533                 return;
1534         }
1535         sc->reset = try + 1;
1536
1537 #if 0 /* Not needed because the disconnect waits for us. */
1538         unsigned long flags;
1539         spin_lock_irqsave(&ub_lock, flags);
1540         sc->openc++;
1541         spin_unlock_irqrestore(&ub_lock, flags);
1542 #endif
1543
1544 #if 0 /* We let them stop themselves. */
1545         struct list_head *p;
1546         struct ub_lun *lun;
1547         list_for_each(p, &sc->luns) {
1548                 lun = list_entry(p, struct ub_lun, link);
1549                 blk_stop_queue(lun->disk->queue);
1550         }
1551 #endif
1552
1553         schedule_work(&sc->reset_work);
1554 }
1555
1556 static void ub_reset_task(void *arg)
1557 {
1558         struct ub_dev *sc = arg;
1559         unsigned long flags;
1560         struct list_head *p;
1561         struct ub_lun *lun;
1562         int lkr, rc;
1563
1564         if (!sc->reset) {
1565                 printk(KERN_WARNING "%s: Running reset unrequested\n",
1566                     sc->name);
1567                 return;
1568         }
1569
1570         if (atomic_read(&sc->poison)) {
1571                 printk(KERN_NOTICE "%s: Not resetting disconnected device\n",
1572                     sc->name); /* P3 This floods. Remove soon. XXX */
1573         } else if ((sc->reset & 1) == 0) {
1574                 ub_sync_reset(sc);
1575                 msleep(700);    /* usb-storage sleeps 6s (!) */
1576                 ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
1577                 ub_probe_clear_stall(sc, sc->send_bulk_pipe);
1578         } else if (sc->dev->actconfig->desc.bNumInterfaces != 1) {
1579                 printk(KERN_NOTICE "%s: Not resetting multi-interface device\n",
1580                     sc->name); /* P3 This floods. Remove soon. XXX */
1581         } else {
1582                 if ((lkr = usb_lock_device_for_reset(sc->dev, sc->intf)) < 0) {
1583                         printk(KERN_NOTICE
1584                             "%s: usb_lock_device_for_reset failed (%d)\n",
1585                             sc->name, lkr);
1586                 } else {
1587                         rc = usb_reset_device(sc->dev);
1588                         if (rc < 0) {
1589                                 printk(KERN_NOTICE "%s: "
1590                                     "usb_lock_device_for_reset failed (%d)\n",
1591                                     sc->name, rc);
1592                         }
1593
1594                         if (lkr)
1595                                 usb_unlock_device(sc->dev);
1596                 }
1597         }
1598
1599         /*
1600          * In theory, no commands can be running while reset is active,
1601          * so nobody can ask for another reset, and so we do not need any
1602          * queues of resets or anything. We do need a spinlock though,
1603          * to interact with block layer.
1604          */
1605         spin_lock_irqsave(sc->lock, flags);
1606         sc->reset = 0;
1607         tasklet_schedule(&sc->tasklet);
1608         list_for_each(p, &sc->luns) {
1609                 lun = list_entry(p, struct ub_lun, link);
1610                 blk_start_queue(lun->disk->queue);
1611         }
1612         wake_up(&sc->reset_wait);
1613         spin_unlock_irqrestore(sc->lock, flags);
1614 }
1615
1616 /*
1617  * This is called from a process context.
1618  */
1619 static void ub_revalidate(struct ub_dev *sc, struct ub_lun *lun)
1620 {
1621
1622         lun->readonly = 0;      /* XXX Query this from the device */
1623
1624         lun->capacity.nsec = 0;
1625         lun->capacity.bsize = 512;
1626         lun->capacity.bshift = 0;
1627
1628         if (ub_sync_tur(sc, lun) != 0)
1629                 return;                 /* Not ready */
1630         lun->changed = 0;
1631
1632         if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1633                 /*
1634                  * The retry here means something is wrong, either with the
1635                  * device, with the transport, or with our code.
1636                  * We keep this because sd.c has retries for capacity.
1637                  */
1638                 if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1639                         lun->capacity.nsec = 0;
1640                         lun->capacity.bsize = 512;
1641                         lun->capacity.bshift = 0;
1642                 }
1643         }
1644 }
1645
1646 /*
1647  * The open funcion.
1648  * This is mostly needed to keep refcounting, but also to support
1649  * media checks on removable media drives.
1650  */
1651 static int ub_bd_open(struct inode *inode, struct file *filp)
1652 {
1653         struct gendisk *disk = inode->i_bdev->bd_disk;
1654         struct ub_lun *lun;
1655         struct ub_dev *sc;
1656         unsigned long flags;
1657         int rc;
1658
1659         if ((lun = disk->private_data) == NULL)
1660                 return -ENXIO;
1661         sc = lun->udev;
1662
1663         spin_lock_irqsave(&ub_lock, flags);
1664         if (atomic_read(&sc->poison)) {
1665                 spin_unlock_irqrestore(&ub_lock, flags);
1666                 return -ENXIO;
1667         }
1668         sc->openc++;
1669         spin_unlock_irqrestore(&ub_lock, flags);
1670
1671         if (lun->removable || lun->readonly)
1672                 check_disk_change(inode->i_bdev);
1673
1674         /*
1675          * The sd.c considers ->media_present and ->changed not equivalent,
1676          * under some pretty murky conditions (a failure of READ CAPACITY).
1677          * We may need it one day.
1678          */
1679         if (lun->removable && lun->changed && !(filp->f_flags & O_NDELAY)) {
1680                 rc = -ENOMEDIUM;
1681                 goto err_open;
1682         }
1683
1684         if (lun->readonly && (filp->f_mode & FMODE_WRITE)) {
1685                 rc = -EROFS;
1686                 goto err_open;
1687         }
1688
1689         return 0;
1690
1691 err_open:
1692         ub_put(sc);
1693         return rc;
1694 }
1695
1696 /*
1697  */
1698 static int ub_bd_release(struct inode *inode, struct file *filp)
1699 {
1700         struct gendisk *disk = inode->i_bdev->bd_disk;
1701         struct ub_lun *lun = disk->private_data;
1702         struct ub_dev *sc = lun->udev;
1703
1704         ub_put(sc);
1705         return 0;
1706 }
1707
1708 /*
1709  * The ioctl interface.
1710  */
1711 static int ub_bd_ioctl(struct inode *inode, struct file *filp,
1712     unsigned int cmd, unsigned long arg)
1713 {
1714         struct gendisk *disk = inode->i_bdev->bd_disk;
1715         void __user *usermem = (void __user *) arg;
1716
1717         return scsi_cmd_ioctl(filp, disk, cmd, usermem);
1718 }
1719
1720 /*
1721  * This is called once a new disk was seen by the block layer or by ub_probe().
1722  * The main onjective here is to discover the features of the media such as
1723  * the capacity, read-only status, etc. USB storage generally does not
1724  * need to be spun up, but if we needed it, this would be the place.
1725  *
1726  * This call can sleep.
1727  *
1728  * The return code is not used.
1729  */
1730 static int ub_bd_revalidate(struct gendisk *disk)
1731 {
1732         struct ub_lun *lun = disk->private_data;
1733
1734         ub_revalidate(lun->udev, lun);
1735
1736         /* XXX Support sector size switching like in sr.c */
1737         blk_queue_hardsect_size(disk->queue, lun->capacity.bsize);
1738         set_capacity(disk, lun->capacity.nsec);
1739         // set_disk_ro(sdkp->disk, lun->readonly);
1740
1741         return 0;
1742 }
1743
1744 /*
1745  * The check is called by the block layer to verify if the media
1746  * is still available. It is supposed to be harmless, lightweight and
1747  * non-intrusive in case the media was not changed.
1748  *
1749  * This call can sleep.
1750  *
1751  * The return code is bool!
1752  */
1753 static int ub_bd_media_changed(struct gendisk *disk)
1754 {
1755         struct ub_lun *lun = disk->private_data;
1756
1757         if (!lun->removable)
1758                 return 0;
1759
1760         /*
1761          * We clean checks always after every command, so this is not
1762          * as dangerous as it looks. If the TEST_UNIT_READY fails here,
1763          * the device is actually not ready with operator or software
1764          * intervention required. One dangerous item might be a drive which
1765          * spins itself down, and come the time to write dirty pages, this
1766          * will fail, then block layer discards the data. Since we never
1767          * spin drives up, such devices simply cannot be used with ub anyway.
1768          */
1769         if (ub_sync_tur(lun->udev, lun) != 0) {
1770                 lun->changed = 1;
1771                 return 1;
1772         }
1773
1774         return lun->changed;
1775 }
1776
1777 static struct block_device_operations ub_bd_fops = {
1778         .owner          = THIS_MODULE,
1779         .open           = ub_bd_open,
1780         .release        = ub_bd_release,
1781         .ioctl          = ub_bd_ioctl,
1782         .media_changed  = ub_bd_media_changed,
1783         .revalidate_disk = ub_bd_revalidate,
1784 };
1785
1786 /*
1787  * Common ->done routine for commands executed synchronously.
1788  */
1789 static void ub_probe_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1790 {
1791         struct completion *cop = cmd->back;
1792         complete(cop);
1793 }
1794
1795 /*
1796  * Test if the device has a check condition on it, synchronously.
1797  */
1798 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun)
1799 {
1800         struct ub_scsi_cmd *cmd;
1801         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) };
1802         unsigned long flags;
1803         struct completion compl;
1804         int rc;
1805
1806         init_completion(&compl);
1807
1808         rc = -ENOMEM;
1809         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1810                 goto err_alloc;
1811
1812         cmd->cdb[0] = TEST_UNIT_READY;
1813         cmd->cdb_len = 6;
1814         cmd->dir = UB_DIR_NONE;
1815         cmd->state = UB_CMDST_INIT;
1816         cmd->lun = lun;                 /* This may be NULL, but that's ok */
1817         cmd->done = ub_probe_done;
1818         cmd->back = &compl;
1819
1820         spin_lock_irqsave(sc->lock, flags);
1821         cmd->tag = sc->tagcnt++;
1822
1823         rc = ub_submit_scsi(sc, cmd);
1824         spin_unlock_irqrestore(sc->lock, flags);
1825
1826         if (rc != 0) {
1827                 printk("ub: testing ready: submit error (%d)\n", rc); /* P3 */
1828                 goto err_submit;
1829         }
1830
1831         wait_for_completion(&compl);
1832
1833         rc = cmd->error;
1834
1835         if (rc == -EIO && cmd->key != 0)        /* Retries for benh's key */
1836                 rc = cmd->key;
1837
1838 err_submit:
1839         kfree(cmd);
1840 err_alloc:
1841         return rc;
1842 }
1843
1844 /*
1845  * Read the SCSI capacity synchronously (for probing).
1846  */
1847 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
1848     struct ub_capacity *ret)
1849 {
1850         struct ub_scsi_cmd *cmd;
1851         struct scatterlist *sg;
1852         char *p;
1853         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) + 8 };
1854         unsigned long flags;
1855         unsigned int bsize, shift;
1856         unsigned long nsec;
1857         struct completion compl;
1858         int rc;
1859
1860         init_completion(&compl);
1861
1862         rc = -ENOMEM;
1863         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1864                 goto err_alloc;
1865         p = (char *)cmd + sizeof(struct ub_scsi_cmd);
1866
1867         cmd->cdb[0] = 0x25;
1868         cmd->cdb_len = 10;
1869         cmd->dir = UB_DIR_READ;
1870         cmd->state = UB_CMDST_INIT;
1871         cmd->nsg = 1;
1872         sg = &cmd->sgv[0];
1873         sg->page = virt_to_page(p);
1874         sg->offset = (unsigned long)p & (PAGE_SIZE-1);
1875         sg->length = 8;
1876         cmd->len = 8;
1877         cmd->lun = lun;
1878         cmd->done = ub_probe_done;
1879         cmd->back = &compl;
1880
1881         spin_lock_irqsave(sc->lock, flags);
1882         cmd->tag = sc->tagcnt++;
1883
1884         rc = ub_submit_scsi(sc, cmd);
1885         spin_unlock_irqrestore(sc->lock, flags);
1886
1887         if (rc != 0) {
1888                 printk("ub: reading capacity: submit error (%d)\n", rc); /* P3 */
1889                 goto err_submit;
1890         }
1891
1892         wait_for_completion(&compl);
1893
1894         if (cmd->error != 0) {
1895                 printk("ub: reading capacity: error %d\n", cmd->error); /* P3 */
1896                 rc = -EIO;
1897                 goto err_read;
1898         }
1899         if (cmd->act_len != 8) {
1900                 printk("ub: reading capacity: size %d\n", cmd->act_len); /* P3 */
1901                 rc = -EIO;
1902                 goto err_read;
1903         }
1904
1905         /* sd.c special-cases sector size of 0 to mean 512. Needed? Safe? */
1906         nsec = be32_to_cpu(*(__be32 *)p) + 1;
1907         bsize = be32_to_cpu(*(__be32 *)(p + 4));
1908         switch (bsize) {
1909         case 512:       shift = 0;      break;
1910         case 1024:      shift = 1;      break;
1911         case 2048:      shift = 2;      break;
1912         case 4096:      shift = 3;      break;
1913         default:
1914                 printk("ub: Bad sector size %u\n", bsize); /* P3 */
1915                 rc = -EDOM;
1916                 goto err_inv_bsize;
1917         }
1918
1919         ret->bsize = bsize;
1920         ret->bshift = shift;
1921         ret->nsec = nsec << shift;
1922         rc = 0;
1923
1924 err_inv_bsize:
1925 err_read:
1926 err_submit:
1927         kfree(cmd);
1928 err_alloc:
1929         return rc;
1930 }
1931
1932 /*
1933  */
1934 static void ub_probe_urb_complete(struct urb *urb, struct pt_regs *pt)
1935 {
1936         struct completion *cop = urb->context;
1937         complete(cop);
1938 }
1939
1940 static void ub_probe_timeout(unsigned long arg)
1941 {
1942         struct completion *cop = (struct completion *) arg;
1943         complete(cop);
1944 }
1945
1946 /*
1947  * Reset with a Bulk reset.
1948  */
1949 static int ub_sync_reset(struct ub_dev *sc)
1950 {
1951         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
1952         struct usb_ctrlrequest *cr;
1953         struct completion compl;
1954         struct timer_list timer;
1955         int rc;
1956
1957         init_completion(&compl);
1958
1959         cr = &sc->work_cr;
1960         cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
1961         cr->bRequest = US_BULK_RESET_REQUEST;
1962         cr->wValue = cpu_to_le16(0);
1963         cr->wIndex = cpu_to_le16(ifnum);
1964         cr->wLength = cpu_to_le16(0);
1965
1966         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1967             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
1968         sc->work_urb.actual_length = 0;
1969         sc->work_urb.error_count = 0;
1970         sc->work_urb.status = 0;
1971
1972         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
1973                 printk(KERN_WARNING
1974                      "%s: Unable to submit a bulk reset (%d)\n", sc->name, rc);
1975                 return rc;
1976         }
1977
1978         init_timer(&timer);
1979         timer.function = ub_probe_timeout;
1980         timer.data = (unsigned long) &compl;
1981         timer.expires = jiffies + UB_CTRL_TIMEOUT;
1982         add_timer(&timer);
1983
1984         wait_for_completion(&compl);
1985
1986         del_timer_sync(&timer);
1987         usb_kill_urb(&sc->work_urb);
1988
1989         return sc->work_urb.status;
1990 }
1991
1992 /*
1993  * Get number of LUNs by the way of Bulk GetMaxLUN command.
1994  */
1995 static int ub_sync_getmaxlun(struct ub_dev *sc)
1996 {
1997         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
1998         unsigned char *p;
1999         enum { ALLOC_SIZE = 1 };
2000         struct usb_ctrlrequest *cr;
2001         struct completion compl;
2002         struct timer_list timer;
2003         int nluns;
2004         int rc;
2005
2006         init_completion(&compl);
2007
2008         rc = -ENOMEM;
2009         if ((p = kmalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
2010                 goto err_alloc;
2011         *p = 55;
2012
2013         cr = &sc->work_cr;
2014         cr->bRequestType = USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
2015         cr->bRequest = US_BULK_GET_MAX_LUN;
2016         cr->wValue = cpu_to_le16(0);
2017         cr->wIndex = cpu_to_le16(ifnum);
2018         cr->wLength = cpu_to_le16(1);
2019
2020         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
2021             (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
2022         sc->work_urb.actual_length = 0;
2023         sc->work_urb.error_count = 0;
2024         sc->work_urb.status = 0;
2025
2026         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
2027                 if (rc == -EPIPE) {
2028                         printk("%s: Stall submitting GetMaxLUN, using 1 LUN\n",
2029                              sc->name); /* P3 */
2030                 } else {
2031                         printk(KERN_NOTICE
2032                              "%s: Unable to submit GetMaxLUN (%d)\n",
2033                              sc->name, rc);
2034                 }
2035                 goto err_submit;
2036         }
2037
2038         init_timer(&timer);
2039         timer.function = ub_probe_timeout;
2040         timer.data = (unsigned long) &compl;
2041         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2042         add_timer(&timer);
2043
2044         wait_for_completion(&compl);
2045
2046         del_timer_sync(&timer);
2047         usb_kill_urb(&sc->work_urb);
2048
2049         if ((rc = sc->work_urb.status) < 0) {
2050                 if (rc == -EPIPE) {
2051                         printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
2052                              sc->name); /* P3 */
2053                 } else {
2054                         printk(KERN_NOTICE
2055                              "%s: Error at GetMaxLUN (%d)\n",
2056                              sc->name, rc);
2057                 }
2058                 goto err_io;
2059         }
2060
2061         if (sc->work_urb.actual_length != 1) {
2062                 printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
2063                     sc->work_urb.actual_length); /* P3 */
2064                 nluns = 0;
2065         } else {
2066                 if ((nluns = *p) == 55) {
2067                         nluns = 0;
2068                 } else {
2069                         /* GetMaxLUN returns the maximum LUN number */
2070                         nluns += 1;
2071                         if (nluns > UB_MAX_LUNS)
2072                                 nluns = UB_MAX_LUNS;
2073                 }
2074                 printk("%s: GetMaxLUN returned %d, using %d LUNs\n", sc->name,
2075                     *p, nluns); /* P3 */
2076         }
2077
2078         kfree(p);
2079         return nluns;
2080
2081 err_io:
2082 err_submit:
2083         kfree(p);
2084 err_alloc:
2085         return rc;
2086 }
2087
2088 /*
2089  * Clear initial stalls.
2090  */
2091 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe)
2092 {
2093         int endp;
2094         struct usb_ctrlrequest *cr;
2095         struct completion compl;
2096         struct timer_list timer;
2097         int rc;
2098
2099         init_completion(&compl);
2100
2101         endp = usb_pipeendpoint(stalled_pipe);
2102         if (usb_pipein (stalled_pipe))
2103                 endp |= USB_DIR_IN;
2104
2105         cr = &sc->work_cr;
2106         cr->bRequestType = USB_RECIP_ENDPOINT;
2107         cr->bRequest = USB_REQ_CLEAR_FEATURE;
2108         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
2109         cr->wIndex = cpu_to_le16(endp);
2110         cr->wLength = cpu_to_le16(0);
2111
2112         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
2113             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
2114         sc->work_urb.actual_length = 0;
2115         sc->work_urb.error_count = 0;
2116         sc->work_urb.status = 0;
2117
2118         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
2119                 printk(KERN_WARNING
2120                      "%s: Unable to submit a probe clear (%d)\n", sc->name, rc);
2121                 return rc;
2122         }
2123
2124         init_timer(&timer);
2125         timer.function = ub_probe_timeout;
2126         timer.data = (unsigned long) &compl;
2127         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2128         add_timer(&timer);
2129
2130         wait_for_completion(&compl);
2131
2132         del_timer_sync(&timer);
2133         usb_kill_urb(&sc->work_urb);
2134
2135         /* reset the endpoint toggle */
2136         usb_settoggle(sc->dev, endp, usb_pipeout(sc->last_pipe), 0);
2137
2138         return 0;
2139 }
2140
2141 /*
2142  * Get the pipe settings.
2143  */
2144 static int ub_get_pipes(struct ub_dev *sc, struct usb_device *dev,
2145     struct usb_interface *intf)
2146 {
2147         struct usb_host_interface *altsetting = intf->cur_altsetting;
2148         struct usb_endpoint_descriptor *ep_in = NULL;
2149         struct usb_endpoint_descriptor *ep_out = NULL;
2150         struct usb_endpoint_descriptor *ep;
2151         int i;
2152
2153         /*
2154          * Find the endpoints we need.
2155          * We are expecting a minimum of 2 endpoints - in and out (bulk).
2156          * We will ignore any others.
2157          */
2158         for (i = 0; i < altsetting->desc.bNumEndpoints; i++) {
2159                 ep = &altsetting->endpoint[i].desc;
2160
2161                 /* Is it a BULK endpoint? */
2162                 if ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
2163                                 == USB_ENDPOINT_XFER_BULK) {
2164                         /* BULK in or out? */
2165                         if (ep->bEndpointAddress & USB_DIR_IN)
2166                                 ep_in = ep;
2167                         else
2168                                 ep_out = ep;
2169                 }
2170         }
2171
2172         if (ep_in == NULL || ep_out == NULL) {
2173                 printk(KERN_NOTICE "%s: failed endpoint check\n",
2174                     sc->name);
2175                 return -ENODEV;
2176         }
2177
2178         /* Calculate and store the pipe values */
2179         sc->send_ctrl_pipe = usb_sndctrlpipe(dev, 0);
2180         sc->recv_ctrl_pipe = usb_rcvctrlpipe(dev, 0);
2181         sc->send_bulk_pipe = usb_sndbulkpipe(dev,
2182                 ep_out->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2183         sc->recv_bulk_pipe = usb_rcvbulkpipe(dev,
2184                 ep_in->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2185
2186         return 0;
2187 }
2188
2189 /*
2190  * Probing is done in the process context, which allows us to cheat
2191  * and not to build a state machine for the discovery.
2192  */
2193 static int ub_probe(struct usb_interface *intf,
2194     const struct usb_device_id *dev_id)
2195 {
2196         struct ub_dev *sc;
2197         int nluns;
2198         int rc;
2199         int i;
2200
2201         if (usb_usual_check_type(dev_id, USB_US_TYPE_UB))
2202                 return -ENXIO;
2203
2204         rc = -ENOMEM;
2205         if ((sc = kzalloc(sizeof(struct ub_dev), GFP_KERNEL)) == NULL)
2206                 goto err_core;
2207         sc->lock = ub_next_lock();
2208         INIT_LIST_HEAD(&sc->luns);
2209         usb_init_urb(&sc->work_urb);
2210         tasklet_init(&sc->tasklet, ub_scsi_action, (unsigned long)sc);
2211         atomic_set(&sc->poison, 0);
2212         INIT_WORK(&sc->reset_work, ub_reset_task, sc);
2213         init_waitqueue_head(&sc->reset_wait);
2214
2215         init_timer(&sc->work_timer);
2216         sc->work_timer.data = (unsigned long) sc;
2217         sc->work_timer.function = ub_urb_timeout;
2218
2219         ub_init_completion(&sc->work_done);
2220         sc->work_done.done = 1;         /* A little yuk, but oh well... */
2221
2222         sc->dev = interface_to_usbdev(intf);
2223         sc->intf = intf;
2224         // sc->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
2225         usb_set_intfdata(intf, sc);
2226         usb_get_dev(sc->dev);
2227         /*
2228          * Since we give the interface struct to the block level through
2229          * disk->driverfs_dev, we have to pin it. Otherwise, block_uevent
2230          * oopses on close after a disconnect (kernels 2.6.16 and up).
2231          */
2232         usb_get_intf(sc->intf);
2233
2234         snprintf(sc->name, 12, DRV_NAME "(%d.%d)",
2235             sc->dev->bus->busnum, sc->dev->devnum);
2236
2237         /* XXX Verify that we can handle the device (from descriptors) */
2238
2239         if (ub_get_pipes(sc, sc->dev, intf) != 0)
2240                 goto err_dev_desc;
2241
2242         /*
2243          * At this point, all USB initialization is done, do upper layer.
2244          * We really hate halfway initialized structures, so from the
2245          * invariants perspective, this ub_dev is fully constructed at
2246          * this point.
2247          */
2248
2249         /*
2250          * This is needed to clear toggles. It is a problem only if we do
2251          * `rmmod ub && modprobe ub` without disconnects, but we like that.
2252          */
2253 #if 0 /* iPod Mini fails if we do this (big white iPod works) */
2254         ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
2255         ub_probe_clear_stall(sc, sc->send_bulk_pipe);
2256 #endif
2257
2258         /*
2259          * The way this is used by the startup code is a little specific.
2260          * A SCSI check causes a USB stall. Our common case code sees it
2261          * and clears the check, after which the device is ready for use.
2262          * But if a check was not present, any command other than
2263          * TEST_UNIT_READY ends with a lockup (including REQUEST_SENSE).
2264          *
2265          * If we neglect to clear the SCSI check, the first real command fails
2266          * (which is the capacity readout). We clear that and retry, but why
2267          * causing spurious retries for no reason.
2268          *
2269          * Revalidation may start with its own TEST_UNIT_READY, but that one
2270          * has to succeed, so we clear checks with an additional one here.
2271          * In any case it's not our business how revaliadation is implemented.
2272          */
2273         for (i = 0; i < 3; i++) {       /* Retries for benh's key */
2274                 if ((rc = ub_sync_tur(sc, NULL)) <= 0) break;
2275                 if (rc != 0x6) break;
2276                 msleep(10);
2277         }
2278
2279         nluns = 1;
2280         for (i = 0; i < 3; i++) {
2281                 if ((rc = ub_sync_getmaxlun(sc)) < 0)
2282                         break;
2283                 if (rc != 0) {
2284                         nluns = rc;
2285                         break;
2286                 }
2287                 msleep(100);
2288         }
2289
2290         for (i = 0; i < nluns; i++) {
2291                 ub_probe_lun(sc, i);
2292         }
2293         return 0;
2294
2295 err_dev_desc:
2296         usb_set_intfdata(intf, NULL);
2297         usb_put_intf(sc->intf);
2298         usb_put_dev(sc->dev);
2299         kfree(sc);
2300 err_core:
2301         return rc;
2302 }
2303
2304 static int ub_probe_lun(struct ub_dev *sc, int lnum)
2305 {
2306         struct ub_lun *lun;
2307         request_queue_t *q;
2308         struct gendisk *disk;
2309         int rc;
2310
2311         rc = -ENOMEM;
2312         if ((lun = kzalloc(sizeof(struct ub_lun), GFP_KERNEL)) == NULL)
2313                 goto err_alloc;
2314         lun->num = lnum;
2315
2316         rc = -ENOSR;
2317         if ((lun->id = ub_id_get()) == -1)
2318                 goto err_id;
2319
2320         lun->udev = sc;
2321         list_add(&lun->link, &sc->luns);
2322
2323         snprintf(lun->name, 16, DRV_NAME "%c(%d.%d.%d)",
2324             lun->id + 'a', sc->dev->bus->busnum, sc->dev->devnum, lun->num);
2325
2326         lun->removable = 1;             /* XXX Query this from the device */
2327         lun->changed = 1;               /* ub_revalidate clears only */
2328         ub_revalidate(sc, lun);
2329
2330         rc = -ENOMEM;
2331         if ((disk = alloc_disk(UB_PARTS_PER_LUN)) == NULL)
2332                 goto err_diskalloc;
2333
2334         lun->disk = disk;
2335         sprintf(disk->disk_name, DRV_NAME "%c", lun->id + 'a');
2336         sprintf(disk->devfs_name, DEVFS_NAME "/%c", lun->id + 'a');
2337         disk->major = UB_MAJOR;
2338         disk->first_minor = lun->id * UB_PARTS_PER_LUN;
2339         disk->fops = &ub_bd_fops;
2340         disk->private_data = lun;
2341         disk->driverfs_dev = &sc->intf->dev;
2342
2343         rc = -ENOMEM;
2344         if ((q = blk_init_queue(ub_request_fn, sc->lock)) == NULL)
2345                 goto err_blkqinit;
2346
2347         disk->queue = q;
2348
2349         blk_queue_bounce_limit(q, BLK_BOUNCE_HIGH);
2350         blk_queue_max_hw_segments(q, UB_MAX_REQ_SG);
2351         blk_queue_max_phys_segments(q, UB_MAX_REQ_SG);
2352         blk_queue_segment_boundary(q, 0xffffffff);      /* Dubious. */
2353         blk_queue_max_sectors(q, UB_MAX_SECTORS);
2354         blk_queue_hardsect_size(q, lun->capacity.bsize);
2355
2356         q->queuedata = lun;
2357
2358         set_capacity(disk, lun->capacity.nsec);
2359         if (lun->removable)
2360                 disk->flags |= GENHD_FL_REMOVABLE;
2361
2362         add_disk(disk);
2363
2364         return 0;
2365
2366 err_blkqinit:
2367         put_disk(disk);
2368 err_diskalloc:
2369         list_del(&lun->link);
2370         ub_id_put(lun->id);
2371 err_id:
2372         kfree(lun);
2373 err_alloc:
2374         return rc;
2375 }
2376
2377 static void ub_disconnect(struct usb_interface *intf)
2378 {
2379         struct ub_dev *sc = usb_get_intfdata(intf);
2380         struct list_head *p;
2381         struct ub_lun *lun;
2382         struct gendisk *disk;
2383         unsigned long flags;
2384
2385         /*
2386          * Prevent ub_bd_release from pulling the rug from under us.
2387          * XXX This is starting to look like a kref.
2388          * XXX Why not to take this ref at probe time?
2389          */
2390         spin_lock_irqsave(&ub_lock, flags);
2391         sc->openc++;
2392         spin_unlock_irqrestore(&ub_lock, flags);
2393
2394         /*
2395          * Fence stall clearnings, operations triggered by unlinkings and so on.
2396          * We do not attempt to unlink any URBs, because we do not trust the
2397          * unlink paths in HC drivers. Also, we get -84 upon disconnect anyway.
2398          */
2399         atomic_set(&sc->poison, 1);
2400
2401         /*
2402          * Wait for reset to end, if any.
2403          */
2404         wait_event(sc->reset_wait, !sc->reset);
2405
2406         /*
2407          * Blow away queued commands.
2408          *
2409          * Actually, this never works, because before we get here
2410          * the HCD terminates outstanding URB(s). It causes our
2411          * SCSI command queue to advance, commands fail to submit,
2412          * and the whole queue drains. So, we just use this code to
2413          * print warnings.
2414          */
2415         spin_lock_irqsave(sc->lock, flags);
2416         {
2417                 struct ub_scsi_cmd *cmd;
2418                 int cnt = 0;
2419                 while ((cmd = ub_cmdq_peek(sc)) != NULL) {
2420                         cmd->error = -ENOTCONN;
2421                         cmd->state = UB_CMDST_DONE;
2422                         ub_cmdq_pop(sc);
2423                         (*cmd->done)(sc, cmd);
2424                         cnt++;
2425                 }
2426                 if (cnt != 0) {
2427                         printk(KERN_WARNING "%s: "
2428                             "%d was queued after shutdown\n", sc->name, cnt);
2429                 }
2430         }
2431         spin_unlock_irqrestore(sc->lock, flags);
2432
2433         /*
2434          * Unregister the upper layer.
2435          */
2436         list_for_each (p, &sc->luns) {
2437                 lun = list_entry(p, struct ub_lun, link);
2438                 disk = lun->disk;
2439                 if (disk->flags & GENHD_FL_UP)
2440                         del_gendisk(disk);
2441                 /*
2442                  * I wish I could do:
2443                  *    set_bit(QUEUE_FLAG_DEAD, &q->queue_flags);
2444                  * As it is, we rely on our internal poisoning and let
2445                  * the upper levels to spin furiously failing all the I/O.
2446                  */
2447         }
2448
2449         /*
2450          * Testing for -EINPROGRESS is always a bug, so we are bending
2451          * the rules a little.
2452          */
2453         spin_lock_irqsave(sc->lock, flags);
2454         if (sc->work_urb.status == -EINPROGRESS) {      /* janitors: ignore */
2455                 printk(KERN_WARNING "%s: "
2456                     "URB is active after disconnect\n", sc->name);
2457         }
2458         spin_unlock_irqrestore(sc->lock, flags);
2459
2460         /*
2461          * There is virtually no chance that other CPU runs times so long
2462          * after ub_urb_complete should have called del_timer, but only if HCD
2463          * didn't forget to deliver a callback on unlink.
2464          */
2465         del_timer_sync(&sc->work_timer);
2466
2467         /*
2468          * At this point there must be no commands coming from anyone
2469          * and no URBs left in transit.
2470          */
2471
2472         ub_put(sc);
2473 }
2474
2475 static struct usb_driver ub_driver = {
2476         .name =         "ub",
2477         .probe =        ub_probe,
2478         .disconnect =   ub_disconnect,
2479         .id_table =     ub_usb_ids,
2480 };
2481
2482 static int __init ub_init(void)
2483 {
2484         int rc;
2485         int i;
2486
2487         for (i = 0; i < UB_QLOCK_NUM; i++)
2488                 spin_lock_init(&ub_qlockv[i]);
2489
2490         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
2491                 goto err_regblkdev;
2492         devfs_mk_dir(DEVFS_NAME);
2493
2494         if ((rc = usb_register(&ub_driver)) != 0)
2495                 goto err_register;
2496
2497         usb_usual_set_present(USB_US_TYPE_UB);
2498         return 0;
2499
2500 err_register:
2501         devfs_remove(DEVFS_NAME);
2502         unregister_blkdev(UB_MAJOR, DRV_NAME);
2503 err_regblkdev:
2504         return rc;
2505 }
2506
2507 static void __exit ub_exit(void)
2508 {
2509         usb_deregister(&ub_driver);
2510
2511         devfs_remove(DEVFS_NAME);
2512         unregister_blkdev(UB_MAJOR, DRV_NAME);
2513         usb_usual_clear_present(USB_US_TYPE_UB);
2514 }
2515
2516 module_init(ub_init);
2517 module_exit(ub_exit);
2518
2519 MODULE_LICENSE("GPL");