3 * Note that this is not the same as the USB Mass Storage driver
5 * Copyright Matthew Wilcox for Intel Corp, 2010
6 * Copyright Sarah Sharp for Intel Corp, 2010
8 * Distributed under the terms of the GNU GPL, version two.
11 #include <linux/blkdev.h>
12 #include <linux/slab.h>
13 #include <linux/types.h>
14 #include <linux/usb.h>
15 #include <linux/usb/storage.h>
17 #include <scsi/scsi.h>
18 #include <scsi/scsi_dbg.h>
19 #include <scsi/scsi_cmnd.h>
20 #include <scsi/scsi_device.h>
21 #include <scsi/scsi_host.h>
22 #include <scsi/scsi_tcq.h>
24 /* Common header for all IUs */
34 IU_ID_RESPONSE = 0x04,
35 IU_ID_TASK_MGMT = 0x05,
36 IU_ID_READ_READY = 0x06,
37 IU_ID_WRITE_READY = 0x07,
49 __u8 cdb[16]; /* XXX: Overflow-checking tools may misunderstand */
58 __u8 service_response;
61 __u8 sense[SCSI_SENSE_BUFFERSIZE];
65 * The r00-r01c specs define this version of the SENSE IU data structure.
66 * It's still in use by several different firmware releases.
74 __u8 service_response;
75 __u8 sense[SCSI_SENSE_BUFFERSIZE];
91 struct usb_interface *intf;
92 struct usb_device *udev;
94 unsigned cmd_pipe, status_pipe, data_in_pipe, data_out_pipe;
95 unsigned use_streams:1;
96 unsigned uas_sense_old:1;
100 ALLOC_SENSE_URB = (1 << 0),
101 SUBMIT_SENSE_URB = (1 << 1),
102 ALLOC_DATA_IN_URB = (1 << 2),
103 SUBMIT_DATA_IN_URB = (1 << 3),
104 ALLOC_DATA_OUT_URB = (1 << 4),
105 SUBMIT_DATA_OUT_URB = (1 << 5),
106 ALLOC_CMD_URB = (1 << 6),
107 SUBMIT_CMD_URB = (1 << 7),
110 /* Overrides scsi_pointer */
111 struct uas_cmd_info {
115 struct urb *sense_urb;
116 struct urb *data_in_urb;
117 struct urb *data_out_urb;
118 struct list_head list;
121 /* I hate forward declarations, but I actually have a loop */
122 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
123 struct uas_dev_info *devinfo, gfp_t gfp);
125 static DEFINE_SPINLOCK(uas_work_lock);
126 static LIST_HEAD(uas_work_list);
128 static void uas_do_work(struct work_struct *work)
130 struct uas_cmd_info *cmdinfo;
131 struct list_head list;
133 spin_lock_irq(&uas_work_lock);
134 list_replace_init(&uas_work_list, &list);
135 spin_unlock_irq(&uas_work_lock);
137 list_for_each_entry(cmdinfo, &list, list) {
138 struct scsi_pointer *scp = (void *)cmdinfo;
139 struct scsi_cmnd *cmnd = container_of(scp,
140 struct scsi_cmnd, SCp);
141 uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_KERNEL);
145 static DECLARE_WORK(uas_work, uas_do_work);
147 static void uas_sense(struct urb *urb, struct scsi_cmnd *cmnd)
149 struct sense_iu *sense_iu = urb->transfer_buffer;
150 struct scsi_device *sdev = cmnd->device;
152 if (urb->actual_length > 16) {
153 unsigned len = be16_to_cpup(&sense_iu->len);
154 if (len + 16 != urb->actual_length) {
155 int newlen = min(len + 16, urb->actual_length) - 16;
158 sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
159 "disagrees with IU sense data length %d, "
160 "using %d bytes of sense data\n", __func__,
161 urb->actual_length, len, newlen);
164 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
167 cmnd->result = sense_iu->status;
168 if (sdev->current_cmnd)
169 sdev->current_cmnd = NULL;
170 cmnd->scsi_done(cmnd);
174 static void uas_sense_old(struct urb *urb, struct scsi_cmnd *cmnd)
176 struct sense_iu_old *sense_iu = urb->transfer_buffer;
177 struct scsi_device *sdev = cmnd->device;
179 if (urb->actual_length > 8) {
180 unsigned len = be16_to_cpup(&sense_iu->len) - 2;
181 if (len + 8 != urb->actual_length) {
182 int newlen = min(len + 8, urb->actual_length) - 8;
185 sdev_printk(KERN_INFO, sdev, "%s: urb length %d "
186 "disagrees with IU sense data length %d, "
187 "using %d bytes of sense data\n", __func__,
188 urb->actual_length, len, newlen);
191 memcpy(cmnd->sense_buffer, sense_iu->sense, len);
194 cmnd->result = sense_iu->status;
195 if (sdev->current_cmnd)
196 sdev->current_cmnd = NULL;
197 cmnd->scsi_done(cmnd);
201 static void uas_xfer_data(struct urb *urb, struct scsi_cmnd *cmnd,
204 struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
207 cmdinfo->state = direction | SUBMIT_SENSE_URB;
208 err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
210 spin_lock(&uas_work_lock);
211 list_add_tail(&cmdinfo->list, &uas_work_list);
212 spin_unlock(&uas_work_lock);
213 schedule_work(&uas_work);
217 static void uas_stat_cmplt(struct urb *urb)
219 struct iu *iu = urb->transfer_buffer;
220 struct scsi_device *sdev = urb->context;
221 struct uas_dev_info *devinfo = sdev->hostdata;
222 struct scsi_cmnd *cmnd;
226 dev_err(&urb->dev->dev, "URB BAD STATUS %d\n", urb->status);
231 tag = be16_to_cpup(&iu->tag) - 1;
232 if (sdev->current_cmnd)
233 cmnd = sdev->current_cmnd;
235 cmnd = scsi_find_tag(sdev, tag);
241 if (urb->actual_length < 16)
242 devinfo->uas_sense_old = 1;
243 if (devinfo->uas_sense_old)
244 uas_sense_old(urb, cmnd);
246 uas_sense(urb, cmnd);
248 case IU_ID_READ_READY:
249 uas_xfer_data(urb, cmnd, SUBMIT_DATA_IN_URB);
251 case IU_ID_WRITE_READY:
252 uas_xfer_data(urb, cmnd, SUBMIT_DATA_OUT_URB);
255 scmd_printk(KERN_ERR, cmnd,
256 "Bogus IU (%d) received on status pipe\n", iu->iu_id);
260 static void uas_data_cmplt(struct urb *urb)
262 struct scsi_data_buffer *sdb = urb->context;
263 sdb->resid = sdb->length - urb->actual_length;
267 static struct urb *uas_alloc_data_urb(struct uas_dev_info *devinfo, gfp_t gfp,
268 unsigned int pipe, u16 stream_id,
269 struct scsi_data_buffer *sdb,
270 enum dma_data_direction dir)
272 struct usb_device *udev = devinfo->udev;
273 struct urb *urb = usb_alloc_urb(0, gfp);
277 usb_fill_bulk_urb(urb, udev, pipe, NULL, sdb->length, uas_data_cmplt,
279 if (devinfo->use_streams)
280 urb->stream_id = stream_id;
281 urb->num_sgs = udev->bus->sg_tablesize ? sdb->table.nents : 0;
282 urb->sg = sdb->table.sgl;
287 static struct urb *uas_alloc_sense_urb(struct uas_dev_info *devinfo, gfp_t gfp,
288 struct scsi_cmnd *cmnd, u16 stream_id)
290 struct usb_device *udev = devinfo->udev;
291 struct urb *urb = usb_alloc_urb(0, gfp);
297 iu = kmalloc(sizeof(*iu), gfp);
301 usb_fill_bulk_urb(urb, udev, devinfo->status_pipe, iu, sizeof(*iu),
302 uas_stat_cmplt, cmnd->device);
303 urb->stream_id = stream_id;
304 urb->transfer_flags |= URB_FREE_BUFFER;
312 static struct urb *uas_alloc_cmd_urb(struct uas_dev_info *devinfo, gfp_t gfp,
313 struct scsi_cmnd *cmnd, u16 stream_id)
315 struct usb_device *udev = devinfo->udev;
316 struct scsi_device *sdev = cmnd->device;
317 struct urb *urb = usb_alloc_urb(0, gfp);
318 struct command_iu *iu;
324 len = cmnd->cmd_len - 16;
328 iu = kmalloc(sizeof(*iu) + len, gfp);
332 iu->iu_id = IU_ID_COMMAND;
333 iu->tag = cpu_to_be16(stream_id);
334 if (sdev->ordered_tags && (cmnd->request->cmd_flags & REQ_HARDBARRIER))
335 iu->prio_attr = UAS_ORDERED_TAG;
337 iu->prio_attr = UAS_SIMPLE_TAG;
339 int_to_scsilun(sdev->lun, &iu->lun);
340 memcpy(iu->cdb, cmnd->cmnd, cmnd->cmd_len);
342 usb_fill_bulk_urb(urb, udev, devinfo->cmd_pipe, iu, sizeof(*iu) + len,
344 urb->transfer_flags |= URB_FREE_BUFFER;
353 * Why should I request the Status IU before sending the Command IU? Spec
354 * says to, but also says the device may receive them in any order. Seems
358 static int uas_submit_urbs(struct scsi_cmnd *cmnd,
359 struct uas_dev_info *devinfo, gfp_t gfp)
361 struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
363 if (cmdinfo->state & ALLOC_SENSE_URB) {
364 cmdinfo->sense_urb = uas_alloc_sense_urb(devinfo, gfp, cmnd,
366 if (!cmdinfo->sense_urb)
367 return SCSI_MLQUEUE_DEVICE_BUSY;
368 cmdinfo->state &= ~ALLOC_SENSE_URB;
371 if (cmdinfo->state & SUBMIT_SENSE_URB) {
372 if (usb_submit_urb(cmdinfo->sense_urb, gfp)) {
373 scmd_printk(KERN_INFO, cmnd,
374 "sense urb submission failure\n");
375 return SCSI_MLQUEUE_DEVICE_BUSY;
377 cmdinfo->state &= ~SUBMIT_SENSE_URB;
380 if (cmdinfo->state & ALLOC_DATA_IN_URB) {
381 cmdinfo->data_in_urb = uas_alloc_data_urb(devinfo, gfp,
382 devinfo->data_in_pipe, cmdinfo->stream,
383 scsi_in(cmnd), DMA_FROM_DEVICE);
384 if (!cmdinfo->data_in_urb)
385 return SCSI_MLQUEUE_DEVICE_BUSY;
386 cmdinfo->state &= ~ALLOC_DATA_IN_URB;
389 if (cmdinfo->state & SUBMIT_DATA_IN_URB) {
390 if (usb_submit_urb(cmdinfo->data_in_urb, gfp)) {
391 scmd_printk(KERN_INFO, cmnd,
392 "data in urb submission failure\n");
393 return SCSI_MLQUEUE_DEVICE_BUSY;
395 cmdinfo->state &= ~SUBMIT_DATA_IN_URB;
398 if (cmdinfo->state & ALLOC_DATA_OUT_URB) {
399 cmdinfo->data_out_urb = uas_alloc_data_urb(devinfo, gfp,
400 devinfo->data_out_pipe, cmdinfo->stream,
401 scsi_out(cmnd), DMA_TO_DEVICE);
402 if (!cmdinfo->data_out_urb)
403 return SCSI_MLQUEUE_DEVICE_BUSY;
404 cmdinfo->state &= ~ALLOC_DATA_OUT_URB;
407 if (cmdinfo->state & SUBMIT_DATA_OUT_URB) {
408 if (usb_submit_urb(cmdinfo->data_out_urb, gfp)) {
409 scmd_printk(KERN_INFO, cmnd,
410 "data out urb submission failure\n");
411 return SCSI_MLQUEUE_DEVICE_BUSY;
413 cmdinfo->state &= ~SUBMIT_DATA_OUT_URB;
416 if (cmdinfo->state & ALLOC_CMD_URB) {
417 cmdinfo->cmd_urb = uas_alloc_cmd_urb(devinfo, gfp, cmnd,
419 if (!cmdinfo->cmd_urb)
420 return SCSI_MLQUEUE_DEVICE_BUSY;
421 cmdinfo->state &= ~ALLOC_CMD_URB;
424 if (cmdinfo->state & SUBMIT_CMD_URB) {
425 if (usb_submit_urb(cmdinfo->cmd_urb, gfp)) {
426 scmd_printk(KERN_INFO, cmnd,
427 "cmd urb submission failure\n");
428 return SCSI_MLQUEUE_DEVICE_BUSY;
430 cmdinfo->state &= ~SUBMIT_CMD_URB;
436 static int uas_queuecommand(struct scsi_cmnd *cmnd,
437 void (*done)(struct scsi_cmnd *))
439 struct scsi_device *sdev = cmnd->device;
440 struct uas_dev_info *devinfo = sdev->hostdata;
441 struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
444 BUILD_BUG_ON(sizeof(struct uas_cmd_info) > sizeof(struct scsi_pointer));
446 if (!cmdinfo->sense_urb && sdev->current_cmnd)
447 return SCSI_MLQUEUE_DEVICE_BUSY;
449 if (blk_rq_tagged(cmnd->request)) {
450 cmdinfo->stream = cmnd->request->tag + 1;
452 sdev->current_cmnd = cmnd;
456 cmnd->scsi_done = done;
458 cmdinfo->state = ALLOC_SENSE_URB | SUBMIT_SENSE_URB |
459 ALLOC_CMD_URB | SUBMIT_CMD_URB;
461 switch (cmnd->sc_data_direction) {
462 case DMA_FROM_DEVICE:
463 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
465 case DMA_BIDIRECTIONAL:
466 cmdinfo->state |= ALLOC_DATA_IN_URB | SUBMIT_DATA_IN_URB;
468 cmdinfo->state |= ALLOC_DATA_OUT_URB | SUBMIT_DATA_OUT_URB;
473 if (!devinfo->use_streams) {
474 cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
478 err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
480 /* If we did nothing, give up now */
481 if (cmdinfo->state & SUBMIT_SENSE_URB) {
482 usb_free_urb(cmdinfo->sense_urb);
483 return SCSI_MLQUEUE_DEVICE_BUSY;
485 spin_lock(&uas_work_lock);
486 list_add_tail(&cmdinfo->list, &uas_work_list);
487 spin_unlock(&uas_work_lock);
488 schedule_work(&uas_work);
494 static int uas_eh_abort_handler(struct scsi_cmnd *cmnd)
496 struct scsi_device *sdev = cmnd->device;
497 sdev_printk(KERN_INFO, sdev, "%s tag %d\n", __func__,
500 /* XXX: Send ABORT TASK Task Management command */
504 static int uas_eh_device_reset_handler(struct scsi_cmnd *cmnd)
506 struct scsi_device *sdev = cmnd->device;
507 sdev_printk(KERN_INFO, sdev, "%s tag %d\n", __func__,
510 /* XXX: Send LOGICAL UNIT RESET Task Management command */
514 static int uas_eh_target_reset_handler(struct scsi_cmnd *cmnd)
516 struct scsi_device *sdev = cmnd->device;
517 sdev_printk(KERN_INFO, sdev, "%s tag %d\n", __func__,
520 /* XXX: Can we reset just the one USB interface?
521 * Would calling usb_set_interface() have the right effect?
526 static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
528 struct scsi_device *sdev = cmnd->device;
529 struct uas_dev_info *devinfo = sdev->hostdata;
530 struct usb_device *udev = devinfo->udev;
532 sdev_printk(KERN_INFO, sdev, "%s tag %d\n", __func__,
535 if (usb_reset_device(udev))
541 static int uas_slave_alloc(struct scsi_device *sdev)
543 sdev->hostdata = (void *)sdev->host->hostdata[0];
547 static int uas_slave_configure(struct scsi_device *sdev)
549 struct uas_dev_info *devinfo = sdev->hostdata;
550 scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
551 scsi_activate_tcq(sdev, devinfo->qdepth - 1);
555 static struct scsi_host_template uas_host_template = {
556 .module = THIS_MODULE,
558 .queuecommand = uas_queuecommand,
559 .slave_alloc = uas_slave_alloc,
560 .slave_configure = uas_slave_configure,
561 .eh_abort_handler = uas_eh_abort_handler,
562 .eh_device_reset_handler = uas_eh_device_reset_handler,
563 .eh_target_reset_handler = uas_eh_target_reset_handler,
564 .eh_bus_reset_handler = uas_eh_bus_reset_handler,
565 .can_queue = 65536, /* Is there a limit on the _host_ ? */
567 .sg_tablesize = SG_NONE,
568 .cmd_per_lun = 1, /* until we override it */
569 .skip_settle_delay = 1,
573 static struct usb_device_id uas_usb_ids[] = {
574 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_BULK) },
575 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, USB_PR_UAS) },
576 /* 0xaa is a prototype device I happen to have access to */
577 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, USB_SC_SCSI, 0xaa) },
580 MODULE_DEVICE_TABLE(usb, uas_usb_ids);
582 static void uas_configure_endpoints(struct uas_dev_info *devinfo)
584 struct usb_host_endpoint *eps[4] = { };
585 struct usb_interface *intf = devinfo->intf;
586 struct usb_device *udev = devinfo->udev;
587 struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
588 unsigned i, n_endpoints = intf->cur_altsetting->desc.bNumEndpoints;
590 devinfo->uas_sense_old = 0;
592 for (i = 0; i < n_endpoints; i++) {
593 unsigned char *extra = endpoint[i].extra;
594 int len = endpoint[i].extralen;
596 if (extra[1] == USB_DT_PIPE_USAGE) {
597 unsigned pipe_id = extra[2];
598 if (pipe_id > 0 && pipe_id < 5)
599 eps[pipe_id - 1] = &endpoint[i];
608 * Assume that if we didn't find a control pipe descriptor, we're
609 * using a device with old firmware that happens to be set up like
613 devinfo->cmd_pipe = usb_sndbulkpipe(udev, 1);
614 devinfo->status_pipe = usb_rcvbulkpipe(udev, 1);
615 devinfo->data_in_pipe = usb_rcvbulkpipe(udev, 2);
616 devinfo->data_out_pipe = usb_sndbulkpipe(udev, 2);
618 eps[1] = usb_pipe_endpoint(udev, devinfo->status_pipe);
619 eps[2] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
620 eps[3] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
622 devinfo->cmd_pipe = usb_sndbulkpipe(udev,
623 eps[0]->desc.bEndpointAddress);
624 devinfo->status_pipe = usb_rcvbulkpipe(udev,
625 eps[1]->desc.bEndpointAddress);
626 devinfo->data_in_pipe = usb_rcvbulkpipe(udev,
627 eps[2]->desc.bEndpointAddress);
628 devinfo->data_out_pipe = usb_sndbulkpipe(udev,
629 eps[3]->desc.bEndpointAddress);
632 devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1, 3, 256,
634 if (devinfo->qdepth < 0) {
635 devinfo->qdepth = 256;
636 devinfo->use_streams = 0;
638 devinfo->use_streams = 1;
643 * XXX: What I'd like to do here is register a SCSI host for each USB host in
644 * the system. Follow usb-storage's design of registering a SCSI host for
645 * each USB device for the moment. Can implement this by walking up the
646 * USB hierarchy until we find a USB host.
648 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
651 struct Scsi_Host *shost;
652 struct uas_dev_info *devinfo;
653 struct usb_device *udev = interface_to_usbdev(intf);
655 if (id->bInterfaceProtocol == 0x50) {
656 int ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
657 /* XXX: Shouldn't assume that 1 is the alternative we want */
658 int ret = usb_set_interface(udev, ifnum, 1);
663 devinfo = kmalloc(sizeof(struct uas_dev_info), GFP_KERNEL);
668 shost = scsi_host_alloc(&uas_host_template, sizeof(void *));
672 shost->max_cmd_len = 16 + 252;
674 shost->sg_tablesize = udev->bus->sg_tablesize;
676 result = scsi_add_host(shost, &intf->dev);
679 shost->hostdata[0] = (unsigned long)devinfo;
681 devinfo->intf = intf;
682 devinfo->udev = udev;
683 uas_configure_endpoints(devinfo);
685 scsi_scan_host(shost);
686 usb_set_intfdata(intf, shost);
691 scsi_host_put(shost);
695 static int uas_pre_reset(struct usb_interface *intf)
697 /* XXX: Need to return 1 if it's not our device in error handling */
701 static int uas_post_reset(struct usb_interface *intf)
703 /* XXX: Need to return 1 if it's not our device in error handling */
707 static void uas_disconnect(struct usb_interface *intf)
709 struct usb_device *udev = interface_to_usbdev(intf);
710 struct usb_host_endpoint *eps[3];
711 struct Scsi_Host *shost = usb_get_intfdata(intf);
712 struct uas_dev_info *devinfo = (void *)shost->hostdata[0];
714 scsi_remove_host(shost);
716 eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
717 eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
718 eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
719 usb_free_streams(intf, eps, 3, GFP_KERNEL);
725 * XXX: Should this plug into libusual so we can auto-upgrade devices from
728 static struct usb_driver uas_driver = {
731 .disconnect = uas_disconnect,
732 .pre_reset = uas_pre_reset,
733 .post_reset = uas_post_reset,
734 .id_table = uas_usb_ids,
737 static int uas_init(void)
739 return usb_register(&uas_driver);
742 static void uas_exit(void)
744 usb_deregister(&uas_driver);
747 module_init(uas_init);
748 module_exit(uas_exit);
750 MODULE_LICENSE("GPL");
751 MODULE_AUTHOR("Matthew Wilcox and Sarah Sharp");