Merge branch 'i915fb' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/intelf...
[linux-2.6] / drivers / block / ub.c
1 /*
2  * The low performance USB storage driver (ub).
3  *
4  * Copyright (c) 1999, 2000 Matthew Dharm (mdharm-usb@one-eyed-alien.net)
5  * Copyright (C) 2004 Pete Zaitcev (zaitcev@yahoo.com)
6  *
7  * This work is a part of Linux kernel, is derived from it,
8  * and is not licensed separately. See file COPYING for details.
9  *
10  * TODO (sorted by decreasing priority)
11  *  -- set readonly flag for CDs, set removable flag for CF readers
12  *  -- do inquiry and verify we got a disk and not a tape (for LUN mismatch)
13  *  -- special case some senses, e.g. 3a/0 -> no media present, reduce retries
14  *  -- verify the 13 conditions and do bulk resets
15  *  -- kill last_pipe and simply do two-state clearing on both pipes
16  *  -- highmem
17  *  -- move top_sense and work_bcs into separate allocations (if they survive)
18  *     for cache purists and esoteric architectures.
19  *  -- Allocate structure for LUN 0 before the first ub_sync_tur, avoid NULL. ?
20  *  -- prune comments, they are too volumnous
21  *  -- Exterminate P3 printks
22  *  -- Resove XXX's
23  *  -- Redo "benh's retries", perhaps have spin-up code to handle them. V:D=?
24  *  -- CLEAR, CLR2STS, CLRRS seem to be ripe for refactoring.
25  */
26 #include <linux/kernel.h>
27 #include <linux/module.h>
28 #include <linux/usb.h>
29 #include <linux/usb_usual.h>
30 #include <linux/blkdev.h>
31 #include <linux/devfs_fs_kernel.h>
32 #include <linux/timer.h>
33 #include <scsi/scsi.h>
34
35 #define DRV_NAME "ub"
36 #define DEVFS_NAME DRV_NAME
37
38 #define UB_MAJOR 180
39
40 /*
41  * The command state machine is the key model for understanding of this driver.
42  *
43  * The general rule is that all transitions are done towards the bottom
44  * of the diagram, thus preventing any loops.
45  *
46  * An exception to that is how the STAT state is handled. A counter allows it
47  * to be re-entered along the path marked with [C].
48  *
49  *       +--------+
50  *       ! INIT   !
51  *       +--------+
52  *           !
53  *        ub_scsi_cmd_start fails ->--------------------------------------\
54  *           !                                                            !
55  *           V                                                            !
56  *       +--------+                                                       !
57  *       ! CMD    !                                                       !
58  *       +--------+                                                       !
59  *           !                                            +--------+      !
60  *         was -EPIPE -->-------------------------------->! CLEAR  !      !
61  *           !                                            +--------+      !
62  *           !                                                !           !
63  *         was error -->------------------------------------- ! --------->\
64  *           !                                                !           !
65  *  /--<-- cmd->dir == NONE ?                                 !           !
66  *  !        !                                                !           !
67  *  !        V                                                !           !
68  *  !    +--------+                                           !           !
69  *  !    ! DATA   !                                           !           !
70  *  !    +--------+                                           !           !
71  *  !        !                           +---------+          !           !
72  *  !      was -EPIPE -->--------------->! CLR2STS !          !           !
73  *  !        !                           +---------+          !           !
74  *  !        !                                !               !           !
75  *  !        !                              was error -->---- ! --------->\
76  *  !      was error -->--------------------- ! ------------- ! --------->\
77  *  !        !                                !               !           !
78  *  !        V                                !               !           !
79  *  \--->+--------+                           !               !           !
80  *       ! STAT   !<--------------------------/               !           !
81  *  /--->+--------+                                           !           !
82  *  !        !                                                !           !
83  * [C]     was -EPIPE -->-----------\                         !           !
84  *  !        !                      !                         !           !
85  *  +<---- len == 0                 !                         !           !
86  *  !        !                      !                         !           !
87  *  !      was error -->--------------------------------------!---------->\
88  *  !        !                      !                         !           !
89  *  +<---- bad CSW                  !                         !           !
90  *  +<---- bad tag                  !                         !           !
91  *  !        !                      V                         !           !
92  *  !        !                 +--------+                     !           !
93  *  !        !                 ! CLRRS  !                     !           !
94  *  !        !                 +--------+                     !           !
95  *  !        !                      !                         !           !
96  *  \------- ! --------------------[C]--------\               !           !
97  *           !                                !               !           !
98  *         cmd->error---\                +--------+           !           !
99  *           !          +--------------->! SENSE  !<----------/           !
100  *         STAT_FAIL----/                +--------+                       !
101  *           !                                !                           V
102  *           !                                V                      +--------+
103  *           \--------------------------------\--------------------->! DONE   !
104  *                                                                   +--------+
105  */
106
107 /*
108  * This many LUNs per USB device.
109  * Every one of them takes a host, see UB_MAX_HOSTS.
110  */
111 #define UB_MAX_LUNS   9
112
113 /*
114  */
115
116 #define UB_PARTS_PER_LUN      8
117
118 #define UB_MAX_CDB_SIZE      16         /* Corresponds to Bulk */
119
120 #define UB_SENSE_SIZE  18
121
122 /*
123  */
124
125 /* command block wrapper */
126 struct bulk_cb_wrap {
127         __le32  Signature;              /* contains 'USBC' */
128         u32     Tag;                    /* unique per command id */
129         __le32  DataTransferLength;     /* size of data */
130         u8      Flags;                  /* direction in bit 0 */
131         u8      Lun;                    /* LUN */
132         u8      Length;                 /* of of the CDB */
133         u8      CDB[UB_MAX_CDB_SIZE];   /* max command */
134 };
135
136 #define US_BULK_CB_WRAP_LEN     31
137 #define US_BULK_CB_SIGN         0x43425355      /*spells out USBC */
138 #define US_BULK_FLAG_IN         1
139 #define US_BULK_FLAG_OUT        0
140
141 /* command status wrapper */
142 struct bulk_cs_wrap {
143         __le32  Signature;              /* should = 'USBS' */
144         u32     Tag;                    /* same as original command */
145         __le32  Residue;                /* amount not transferred */
146         u8      Status;                 /* see below */
147 };
148
149 #define US_BULK_CS_WRAP_LEN     13
150 #define US_BULK_CS_SIGN         0x53425355      /* spells out 'USBS' */
151 #define US_BULK_STAT_OK         0
152 #define US_BULK_STAT_FAIL       1
153 #define US_BULK_STAT_PHASE      2
154
155 /* bulk-only class specific requests */
156 #define US_BULK_RESET_REQUEST   0xff
157 #define US_BULK_GET_MAX_LUN     0xfe
158
159 /*
160  */
161 struct ub_dev;
162
163 #define UB_MAX_REQ_SG   9       /* cdrecord requires 32KB and maybe a header */
164 #define UB_MAX_SECTORS 64
165
166 /*
167  * A second is more than enough for a 32K transfer (UB_MAX_SECTORS)
168  * even if a webcam hogs the bus, but some devices need time to spin up.
169  */
170 #define UB_URB_TIMEOUT  (HZ*2)
171 #define UB_DATA_TIMEOUT (HZ*5)  /* ZIP does spin-ups in the data phase */
172 #define UB_STAT_TIMEOUT (HZ*5)  /* Same spinups and eject for a dataless cmd. */
173 #define UB_CTRL_TIMEOUT (HZ/2)  /* 500ms ought to be enough to clear a stall */
174
175 /*
176  * An instance of a SCSI command in transit.
177  */
178 #define UB_DIR_NONE     0
179 #define UB_DIR_READ     1
180 #define UB_DIR_ILLEGAL2 2
181 #define UB_DIR_WRITE    3
182
183 /* P3 */
184 #define UB_DIR_CHAR(c)  (((c)==UB_DIR_WRITE)? 'w': \
185                          (((c)==UB_DIR_READ)? 'r': 'n'))
186
187 enum ub_scsi_cmd_state {
188         UB_CMDST_INIT,                  /* Initial state */
189         UB_CMDST_CMD,                   /* Command submitted */
190         UB_CMDST_DATA,                  /* Data phase */
191         UB_CMDST_CLR2STS,               /* Clearing before requesting status */
192         UB_CMDST_STAT,                  /* Status phase */
193         UB_CMDST_CLEAR,                 /* Clearing a stall (halt, actually) */
194         UB_CMDST_CLRRS,                 /* Clearing before retrying status */
195         UB_CMDST_SENSE,                 /* Sending Request Sense */
196         UB_CMDST_DONE                   /* Final state */
197 };
198
199 struct ub_scsi_cmd {
200         unsigned char cdb[UB_MAX_CDB_SIZE];
201         unsigned char cdb_len;
202
203         unsigned char dir;              /* 0 - none, 1 - read, 3 - write. */
204         enum ub_scsi_cmd_state state;
205         unsigned int tag;
206         struct ub_scsi_cmd *next;
207
208         int error;                      /* Return code - valid upon done */
209         unsigned int act_len;           /* Return size */
210         unsigned char key, asc, ascq;   /* May be valid if error==-EIO */
211
212         int stat_count;                 /* Retries getting status. */
213
214         unsigned int len;               /* Requested length */
215         unsigned int current_sg;
216         unsigned int nsg;               /* sgv[nsg] */
217         struct scatterlist sgv[UB_MAX_REQ_SG];
218
219         struct ub_lun *lun;
220         void (*done)(struct ub_dev *, struct ub_scsi_cmd *);
221         void *back;
222 };
223
224 struct ub_request {
225         struct request *rq;
226         unsigned int current_try;
227         unsigned int nsg;               /* sgv[nsg] */
228         struct scatterlist sgv[UB_MAX_REQ_SG];
229 };
230
231 /*
232  */
233 struct ub_capacity {
234         unsigned long nsec;             /* Linux size - 512 byte sectors */
235         unsigned int bsize;             /* Linux hardsect_size */
236         unsigned int bshift;            /* Shift between 512 and hard sects */
237 };
238
239 /*
240  * This is a direct take-off from linux/include/completion.h
241  * The difference is that I do not wait on this thing, just poll.
242  * When I want to wait (ub_probe), I just use the stock completion.
243  *
244  * Note that INIT_COMPLETION takes no lock. It is correct. But why
245  * in the bloody hell that thing takes struct instead of pointer to struct
246  * is quite beyond me. I just copied it from the stock completion.
247  */
248 struct ub_completion {
249         unsigned int done;
250         spinlock_t lock;
251 };
252
253 static inline void ub_init_completion(struct ub_completion *x)
254 {
255         x->done = 0;
256         spin_lock_init(&x->lock);
257 }
258
259 #define UB_INIT_COMPLETION(x)   ((x).done = 0)
260
261 static void ub_complete(struct ub_completion *x)
262 {
263         unsigned long flags;
264
265         spin_lock_irqsave(&x->lock, flags);
266         x->done++;
267         spin_unlock_irqrestore(&x->lock, flags);
268 }
269
270 static int ub_is_completed(struct ub_completion *x)
271 {
272         unsigned long flags;
273         int ret;
274
275         spin_lock_irqsave(&x->lock, flags);
276         ret = x->done;
277         spin_unlock_irqrestore(&x->lock, flags);
278         return ret;
279 }
280
281 /*
282  */
283 struct ub_scsi_cmd_queue {
284         int qlen, qmax;
285         struct ub_scsi_cmd *head, *tail;
286 };
287
288 /*
289  * The block device instance (one per LUN).
290  */
291 struct ub_lun {
292         struct ub_dev *udev;
293         struct list_head link;
294         struct gendisk *disk;
295         int id;                         /* Host index */
296         int num;                        /* LUN number */
297         char name[16];
298
299         int changed;                    /* Media was changed */
300         int removable;
301         int readonly;
302
303         struct ub_request urq;
304
305         /* Use Ingo's mempool if or when we have more than one command. */
306         /*
307          * Currently we never need more than one command for the whole device.
308          * However, giving every LUN a command is a cheap and automatic way
309          * to enforce fairness between them.
310          */
311         int cmda[1];
312         struct ub_scsi_cmd cmdv[1];
313
314         struct ub_capacity capacity; 
315 };
316
317 /*
318  * The USB device instance.
319  */
320 struct ub_dev {
321         spinlock_t *lock;
322         atomic_t poison;                /* The USB device is disconnected */
323         int openc;                      /* protected by ub_lock! */
324                                         /* kref is too implicit for our taste */
325         int reset;                      /* Reset is running */
326         unsigned int tagcnt;
327         char name[12];
328         struct usb_device *dev;
329         struct usb_interface *intf;
330
331         struct list_head luns;
332
333         unsigned int send_bulk_pipe;    /* cached pipe values */
334         unsigned int recv_bulk_pipe;
335         unsigned int send_ctrl_pipe;
336         unsigned int recv_ctrl_pipe;
337
338         struct tasklet_struct tasklet;
339
340         struct ub_scsi_cmd_queue cmd_queue;
341         struct ub_scsi_cmd top_rqs_cmd; /* REQUEST SENSE */
342         unsigned char top_sense[UB_SENSE_SIZE];
343
344         struct ub_completion work_done;
345         struct urb work_urb;
346         struct timer_list work_timer;
347         int last_pipe;                  /* What might need clearing */
348         __le32 signature;               /* Learned signature */
349         struct bulk_cb_wrap work_bcb;
350         struct bulk_cs_wrap work_bcs;
351         struct usb_ctrlrequest work_cr;
352
353         struct work_struct reset_work;
354         wait_queue_head_t reset_wait;
355
356         int sg_stat[6];
357 };
358
359 /*
360  */
361 static void ub_cleanup(struct ub_dev *sc);
362 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq);
363 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
364     struct ub_scsi_cmd *cmd, struct ub_request *urq);
365 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
366     struct ub_scsi_cmd *cmd, struct ub_request *urq);
367 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
368 static void ub_end_rq(struct request *rq, int uptodate);
369 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
370     struct ub_request *urq, struct ub_scsi_cmd *cmd);
371 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
372 static void ub_urb_complete(struct urb *urb, struct pt_regs *pt);
373 static void ub_scsi_action(unsigned long _dev);
374 static void ub_scsi_dispatch(struct ub_dev *sc);
375 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
376 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
377 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc);
378 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
379 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
380 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
381 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
382 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
383     int stalled_pipe);
384 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd);
385 static void ub_reset_enter(struct ub_dev *sc, int try);
386 static void ub_reset_task(void *arg);
387 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun);
388 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
389     struct ub_capacity *ret);
390 static int ub_sync_reset(struct ub_dev *sc);
391 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe);
392 static int ub_probe_lun(struct ub_dev *sc, int lnum);
393
394 /*
395  */
396 #ifdef CONFIG_USB_LIBUSUAL
397
398 #define ub_usb_ids  storage_usb_ids
399 #else
400
401 static struct usb_device_id ub_usb_ids[] = {
402         { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, US_SC_SCSI, US_PR_BULK) },
403         { }
404 };
405
406 MODULE_DEVICE_TABLE(usb, ub_usb_ids);
407 #endif /* CONFIG_USB_LIBUSUAL */
408
409 /*
410  * Find me a way to identify "next free minor" for add_disk(),
411  * and the array disappears the next day. However, the number of
412  * hosts has something to do with the naming and /proc/partitions.
413  * This has to be thought out in detail before changing.
414  * If UB_MAX_HOST was 1000, we'd use a bitmap. Or a better data structure.
415  */
416 #define UB_MAX_HOSTS  26
417 static char ub_hostv[UB_MAX_HOSTS];
418
419 #define UB_QLOCK_NUM 5
420 static spinlock_t ub_qlockv[UB_QLOCK_NUM];
421 static int ub_qlock_next = 0;
422
423 static DEFINE_SPINLOCK(ub_lock);        /* Locks globals and ->openc */
424
425 /*
426  * The id allocator.
427  *
428  * This also stores the host for indexing by minor, which is somewhat dirty.
429  */
430 static int ub_id_get(void)
431 {
432         unsigned long flags;
433         int i;
434
435         spin_lock_irqsave(&ub_lock, flags);
436         for (i = 0; i < UB_MAX_HOSTS; i++) {
437                 if (ub_hostv[i] == 0) {
438                         ub_hostv[i] = 1;
439                         spin_unlock_irqrestore(&ub_lock, flags);
440                         return i;
441                 }
442         }
443         spin_unlock_irqrestore(&ub_lock, flags);
444         return -1;
445 }
446
447 static void ub_id_put(int id)
448 {
449         unsigned long flags;
450
451         if (id < 0 || id >= UB_MAX_HOSTS) {
452                 printk(KERN_ERR DRV_NAME ": bad host ID %d\n", id);
453                 return;
454         }
455
456         spin_lock_irqsave(&ub_lock, flags);
457         if (ub_hostv[id] == 0) {
458                 spin_unlock_irqrestore(&ub_lock, flags);
459                 printk(KERN_ERR DRV_NAME ": freeing free host ID %d\n", id);
460                 return;
461         }
462         ub_hostv[id] = 0;
463         spin_unlock_irqrestore(&ub_lock, flags);
464 }
465
466 /*
467  * This is necessitated by the fact that blk_cleanup_queue does not
468  * necesserily destroy the queue. Instead, it may merely decrease q->refcnt.
469  * Since our blk_init_queue() passes a spinlock common with ub_dev,
470  * we have life time issues when ub_cleanup frees ub_dev.
471  */
472 static spinlock_t *ub_next_lock(void)
473 {
474         unsigned long flags;
475         spinlock_t *ret;
476
477         spin_lock_irqsave(&ub_lock, flags);
478         ret = &ub_qlockv[ub_qlock_next];
479         ub_qlock_next = (ub_qlock_next + 1) % UB_QLOCK_NUM;
480         spin_unlock_irqrestore(&ub_lock, flags);
481         return ret;
482 }
483
484 /*
485  * Downcount for deallocation. This rides on two assumptions:
486  *  - once something is poisoned, its refcount cannot grow
487  *  - opens cannot happen at this time (del_gendisk was done)
488  * If the above is true, we can drop the lock, which we need for
489  * blk_cleanup_queue(): the silly thing may attempt to sleep.
490  * [Actually, it never needs to sleep for us, but it calls might_sleep()]
491  */
492 static void ub_put(struct ub_dev *sc)
493 {
494         unsigned long flags;
495
496         spin_lock_irqsave(&ub_lock, flags);
497         --sc->openc;
498         if (sc->openc == 0 && atomic_read(&sc->poison)) {
499                 spin_unlock_irqrestore(&ub_lock, flags);
500                 ub_cleanup(sc);
501         } else {
502                 spin_unlock_irqrestore(&ub_lock, flags);
503         }
504 }
505
506 /*
507  * Final cleanup and deallocation.
508  */
509 static void ub_cleanup(struct ub_dev *sc)
510 {
511         struct list_head *p;
512         struct ub_lun *lun;
513         request_queue_t *q;
514
515         while (!list_empty(&sc->luns)) {
516                 p = sc->luns.next;
517                 lun = list_entry(p, struct ub_lun, link);
518                 list_del(p);
519
520                 /* I don't think queue can be NULL. But... Stolen from sx8.c */
521                 if ((q = lun->disk->queue) != NULL)
522                         blk_cleanup_queue(q);
523                 /*
524                  * If we zero disk->private_data BEFORE put_disk, we have
525                  * to check for NULL all over the place in open, release,
526                  * check_media and revalidate, because the block level
527                  * semaphore is well inside the put_disk.
528                  * But we cannot zero after the call, because *disk is gone.
529                  * The sd.c is blatantly racy in this area.
530                  */
531                 /* disk->private_data = NULL; */
532                 put_disk(lun->disk);
533                 lun->disk = NULL;
534
535                 ub_id_put(lun->id);
536                 kfree(lun);
537         }
538
539         usb_set_intfdata(sc->intf, NULL);
540         usb_put_intf(sc->intf);
541         usb_put_dev(sc->dev);
542         kfree(sc);
543 }
544
545 /*
546  * The "command allocator".
547  */
548 static struct ub_scsi_cmd *ub_get_cmd(struct ub_lun *lun)
549 {
550         struct ub_scsi_cmd *ret;
551
552         if (lun->cmda[0])
553                 return NULL;
554         ret = &lun->cmdv[0];
555         lun->cmda[0] = 1;
556         return ret;
557 }
558
559 static void ub_put_cmd(struct ub_lun *lun, struct ub_scsi_cmd *cmd)
560 {
561         if (cmd != &lun->cmdv[0]) {
562                 printk(KERN_WARNING "%s: releasing a foreign cmd %p\n",
563                     lun->name, cmd);
564                 return;
565         }
566         if (!lun->cmda[0]) {
567                 printk(KERN_WARNING "%s: releasing a free cmd\n", lun->name);
568                 return;
569         }
570         lun->cmda[0] = 0;
571 }
572
573 /*
574  * The command queue.
575  */
576 static void ub_cmdq_add(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
577 {
578         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
579
580         if (t->qlen++ == 0) {
581                 t->head = cmd;
582                 t->tail = cmd;
583         } else {
584                 t->tail->next = cmd;
585                 t->tail = cmd;
586         }
587
588         if (t->qlen > t->qmax)
589                 t->qmax = t->qlen;
590 }
591
592 static void ub_cmdq_insert(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
593 {
594         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
595
596         if (t->qlen++ == 0) {
597                 t->head = cmd;
598                 t->tail = cmd;
599         } else {
600                 cmd->next = t->head;
601                 t->head = cmd;
602         }
603
604         if (t->qlen > t->qmax)
605                 t->qmax = t->qlen;
606 }
607
608 static struct ub_scsi_cmd *ub_cmdq_pop(struct ub_dev *sc)
609 {
610         struct ub_scsi_cmd_queue *t = &sc->cmd_queue;
611         struct ub_scsi_cmd *cmd;
612
613         if (t->qlen == 0)
614                 return NULL;
615         if (--t->qlen == 0)
616                 t->tail = NULL;
617         cmd = t->head;
618         t->head = cmd->next;
619         cmd->next = NULL;
620         return cmd;
621 }
622
623 #define ub_cmdq_peek(sc)  ((sc)->cmd_queue.head)
624
625 /*
626  * The request function is our main entry point
627  */
628
629 static void ub_request_fn(request_queue_t *q)
630 {
631         struct ub_lun *lun = q->queuedata;
632         struct request *rq;
633
634         while ((rq = elv_next_request(q)) != NULL) {
635                 if (ub_request_fn_1(lun, rq) != 0) {
636                         blk_stop_queue(q);
637                         break;
638                 }
639         }
640 }
641
642 static int ub_request_fn_1(struct ub_lun *lun, struct request *rq)
643 {
644         struct ub_dev *sc = lun->udev;
645         struct ub_scsi_cmd *cmd;
646         struct ub_request *urq;
647         int n_elem;
648
649         if (atomic_read(&sc->poison) || lun->changed) {
650                 blkdev_dequeue_request(rq);
651                 ub_end_rq(rq, 0);
652                 return 0;
653         }
654
655         if (lun->urq.rq != NULL)
656                 return -1;
657         if ((cmd = ub_get_cmd(lun)) == NULL)
658                 return -1;
659         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
660
661         blkdev_dequeue_request(rq);
662
663         urq = &lun->urq;
664         memset(urq, 0, sizeof(struct ub_request));
665         urq->rq = rq;
666
667         /*
668          * get scatterlist from block layer
669          */
670         n_elem = blk_rq_map_sg(lun->disk->queue, rq, &urq->sgv[0]);
671         if (n_elem < 0) {
672                 printk(KERN_INFO "%s: failed request map (%d)\n",
673                     lun->name, n_elem); /* P3 */
674                 goto drop;
675         }
676         if (n_elem > UB_MAX_REQ_SG) {   /* Paranoia */
677                 printk(KERN_WARNING "%s: request with %d segments\n",
678                     lun->name, n_elem);
679                 goto drop;
680         }
681         urq->nsg = n_elem;
682         sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
683
684         if (blk_pc_request(rq)) {
685                 ub_cmd_build_packet(sc, lun, cmd, urq);
686         } else {
687                 ub_cmd_build_block(sc, lun, cmd, urq);
688         }
689         cmd->state = UB_CMDST_INIT;
690         cmd->lun = lun;
691         cmd->done = ub_rw_cmd_done;
692         cmd->back = urq;
693
694         cmd->tag = sc->tagcnt++;
695         if (ub_submit_scsi(sc, cmd) != 0)
696                 goto drop;
697
698         return 0;
699
700 drop:
701         ub_put_cmd(lun, cmd);
702         ub_end_rq(rq, 0);
703         return 0;
704 }
705
706 static void ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
707     struct ub_scsi_cmd *cmd, struct ub_request *urq)
708 {
709         struct request *rq = urq->rq;
710         unsigned int block, nblks;
711
712         if (rq_data_dir(rq) == WRITE)
713                 cmd->dir = UB_DIR_WRITE;
714         else
715                 cmd->dir = UB_DIR_READ;
716
717         cmd->nsg = urq->nsg;
718         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
719
720         /*
721          * build the command
722          *
723          * The call to blk_queue_hardsect_size() guarantees that request
724          * is aligned, but it is given in terms of 512 byte units, always.
725          */
726         block = rq->sector >> lun->capacity.bshift;
727         nblks = rq->nr_sectors >> lun->capacity.bshift;
728
729         cmd->cdb[0] = (cmd->dir == UB_DIR_READ)? READ_10: WRITE_10;
730         /* 10-byte uses 4 bytes of LBA: 2147483648KB, 2097152MB, 2048GB */
731         cmd->cdb[2] = block >> 24;
732         cmd->cdb[3] = block >> 16;
733         cmd->cdb[4] = block >> 8;
734         cmd->cdb[5] = block;
735         cmd->cdb[7] = nblks >> 8;
736         cmd->cdb[8] = nblks;
737         cmd->cdb_len = 10;
738
739         cmd->len = rq->nr_sectors * 512;
740 }
741
742 static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
743     struct ub_scsi_cmd *cmd, struct ub_request *urq)
744 {
745         struct request *rq = urq->rq;
746
747         if (rq->data_len == 0) {
748                 cmd->dir = UB_DIR_NONE;
749         } else {
750                 if (rq_data_dir(rq) == WRITE)
751                         cmd->dir = UB_DIR_WRITE;
752                 else
753                         cmd->dir = UB_DIR_READ;
754         }
755
756         cmd->nsg = urq->nsg;
757         memcpy(cmd->sgv, urq->sgv, sizeof(struct scatterlist) * cmd->nsg);
758
759         memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
760         cmd->cdb_len = rq->cmd_len;
761
762         cmd->len = rq->data_len;
763 }
764
765 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
766 {
767         struct ub_lun *lun = cmd->lun;
768         struct ub_request *urq = cmd->back;
769         struct request *rq;
770         int uptodate;
771
772         rq = urq->rq;
773
774         if (cmd->error == 0) {
775                 uptodate = 1;
776
777                 if (blk_pc_request(rq)) {
778                         if (cmd->act_len >= rq->data_len)
779                                 rq->data_len = 0;
780                         else
781                                 rq->data_len -= cmd->act_len;
782                 }
783         } else {
784                 uptodate = 0;
785
786                 if (blk_pc_request(rq)) {
787                         /* UB_SENSE_SIZE is smaller than SCSI_SENSE_BUFFERSIZE */
788                         memcpy(rq->sense, sc->top_sense, UB_SENSE_SIZE);
789                         rq->sense_len = UB_SENSE_SIZE;
790                         if (sc->top_sense[0] != 0)
791                                 rq->errors = SAM_STAT_CHECK_CONDITION;
792                         else
793                                 rq->errors = DID_ERROR << 16;
794                 } else {
795                         if (cmd->error == -EIO) {
796                                 if (ub_rw_cmd_retry(sc, lun, urq, cmd) == 0)
797                                         return;
798                         }
799                 }
800         }
801
802         urq->rq = NULL;
803
804         ub_put_cmd(lun, cmd);
805         ub_end_rq(rq, uptodate);
806         blk_start_queue(lun->disk->queue);
807 }
808
809 static void ub_end_rq(struct request *rq, int uptodate)
810 {
811         end_that_request_first(rq, uptodate, rq->hard_nr_sectors);
812         end_that_request_last(rq, uptodate);
813 }
814
815 static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
816     struct ub_request *urq, struct ub_scsi_cmd *cmd)
817 {
818
819         if (atomic_read(&sc->poison))
820                 return -ENXIO;
821
822         ub_reset_enter(sc, urq->current_try);
823
824         if (urq->current_try >= 3)
825                 return -EIO;
826         urq->current_try++;
827         /* P3 */ printk("%s: dir %c len/act %d/%d "
828             "[sense %x %02x %02x] retry %d\n",
829             sc->name, UB_DIR_CHAR(cmd->dir), cmd->len, cmd->act_len,
830             cmd->key, cmd->asc, cmd->ascq, urq->current_try);
831
832         memset(cmd, 0, sizeof(struct ub_scsi_cmd));
833         ub_cmd_build_block(sc, lun, cmd, urq);
834
835         cmd->state = UB_CMDST_INIT;
836         cmd->lun = lun;
837         cmd->done = ub_rw_cmd_done;
838         cmd->back = urq;
839
840         cmd->tag = sc->tagcnt++;
841
842 #if 0 /* Wasteful */
843         return ub_submit_scsi(sc, cmd);
844 #else
845         ub_cmdq_add(sc, cmd);
846         return 0;
847 #endif
848 }
849
850 /*
851  * Submit a regular SCSI operation (not an auto-sense).
852  *
853  * The Iron Law of Good Submit Routine is:
854  * Zero return - callback is done, Nonzero return - callback is not done.
855  * No exceptions.
856  *
857  * Host is assumed locked.
858  */
859 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
860 {
861
862         if (cmd->state != UB_CMDST_INIT ||
863             (cmd->dir != UB_DIR_NONE && cmd->len == 0)) {
864                 return -EINVAL;
865         }
866
867         ub_cmdq_add(sc, cmd);
868         /*
869          * We can call ub_scsi_dispatch(sc) right away here, but it's a little
870          * safer to jump to a tasklet, in case upper layers do something silly.
871          */
872         tasklet_schedule(&sc->tasklet);
873         return 0;
874 }
875
876 /*
877  * Submit the first URB for the queued command.
878  * This function does not deal with queueing in any way.
879  */
880 static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
881 {
882         struct bulk_cb_wrap *bcb;
883         int rc;
884
885         bcb = &sc->work_bcb;
886
887         /*
888          * ``If the allocation length is eighteen or greater, and a device
889          * server returns less than eithteen bytes of data, the application
890          * client should assume that the bytes not transferred would have been
891          * zeroes had the device server returned those bytes.''
892          *
893          * We zero sense for all commands so that when a packet request
894          * fails it does not return a stale sense.
895          */
896         memset(&sc->top_sense, 0, UB_SENSE_SIZE);
897
898         /* set up the command wrapper */
899         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
900         bcb->Tag = cmd->tag;            /* Endianness is not important */
901         bcb->DataTransferLength = cpu_to_le32(cmd->len);
902         bcb->Flags = (cmd->dir == UB_DIR_READ) ? 0x80 : 0;
903         bcb->Lun = (cmd->lun != NULL) ? cmd->lun->num : 0;
904         bcb->Length = cmd->cdb_len;
905
906         /* copy the command payload */
907         memcpy(bcb->CDB, cmd->cdb, UB_MAX_CDB_SIZE);
908
909         UB_INIT_COMPLETION(sc->work_done);
910
911         sc->last_pipe = sc->send_bulk_pipe;
912         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
913             bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
914
915         /* Fill what we shouldn't be filling, because usb-storage did so. */
916         sc->work_urb.actual_length = 0;
917         sc->work_urb.error_count = 0;
918         sc->work_urb.status = 0;
919
920         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
921                 /* XXX Clear stalls */
922                 ub_complete(&sc->work_done);
923                 return rc;
924         }
925
926         sc->work_timer.expires = jiffies + UB_URB_TIMEOUT;
927         add_timer(&sc->work_timer);
928
929         cmd->state = UB_CMDST_CMD;
930         return 0;
931 }
932
933 /*
934  * Timeout handler.
935  */
936 static void ub_urb_timeout(unsigned long arg)
937 {
938         struct ub_dev *sc = (struct ub_dev *) arg;
939         unsigned long flags;
940
941         spin_lock_irqsave(sc->lock, flags);
942         if (!ub_is_completed(&sc->work_done))
943                 usb_unlink_urb(&sc->work_urb);
944         spin_unlock_irqrestore(sc->lock, flags);
945 }
946
947 /*
948  * Completion routine for the work URB.
949  *
950  * This can be called directly from usb_submit_urb (while we have
951  * the sc->lock taken) and from an interrupt (while we do NOT have
952  * the sc->lock taken). Therefore, bounce this off to a tasklet.
953  */
954 static void ub_urb_complete(struct urb *urb, struct pt_regs *pt)
955 {
956         struct ub_dev *sc = urb->context;
957
958         ub_complete(&sc->work_done);
959         tasklet_schedule(&sc->tasklet);
960 }
961
962 static void ub_scsi_action(unsigned long _dev)
963 {
964         struct ub_dev *sc = (struct ub_dev *) _dev;
965         unsigned long flags;
966
967         spin_lock_irqsave(sc->lock, flags);
968         ub_scsi_dispatch(sc);
969         spin_unlock_irqrestore(sc->lock, flags);
970 }
971
972 static void ub_scsi_dispatch(struct ub_dev *sc)
973 {
974         struct ub_scsi_cmd *cmd;
975         int rc;
976
977         while (!sc->reset && (cmd = ub_cmdq_peek(sc)) != NULL) {
978                 if (cmd->state == UB_CMDST_DONE) {
979                         ub_cmdq_pop(sc);
980                         (*cmd->done)(sc, cmd);
981                 } else if (cmd->state == UB_CMDST_INIT) {
982                         if ((rc = ub_scsi_cmd_start(sc, cmd)) == 0)
983                                 break;
984                         cmd->error = rc;
985                         cmd->state = UB_CMDST_DONE;
986                 } else {
987                         if (!ub_is_completed(&sc->work_done))
988                                 break;
989                         del_timer(&sc->work_timer);
990                         ub_scsi_urb_compl(sc, cmd);
991                 }
992         }
993 }
994
995 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
996 {
997         struct urb *urb = &sc->work_urb;
998         struct bulk_cs_wrap *bcs;
999         int len;
1000         int rc;
1001
1002         if (atomic_read(&sc->poison)) {
1003                 ub_state_done(sc, cmd, -ENODEV);
1004                 return;
1005         }
1006
1007         if (cmd->state == UB_CMDST_CLEAR) {
1008                 if (urb->status == -EPIPE) {
1009                         /*
1010                          * STALL while clearning STALL.
1011                          * The control pipe clears itself - nothing to do.
1012                          */
1013                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1014                             sc->name);
1015                         goto Bad_End;
1016                 }
1017
1018                 /*
1019                  * We ignore the result for the halt clear.
1020                  */
1021
1022                 /* reset the endpoint toggle */
1023                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1024                         usb_pipeout(sc->last_pipe), 0);
1025
1026                 ub_state_sense(sc, cmd);
1027
1028         } else if (cmd->state == UB_CMDST_CLR2STS) {
1029                 if (urb->status == -EPIPE) {
1030                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1031                             sc->name);
1032                         goto Bad_End;
1033                 }
1034
1035                 /*
1036                  * We ignore the result for the halt clear.
1037                  */
1038
1039                 /* reset the endpoint toggle */
1040                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1041                         usb_pipeout(sc->last_pipe), 0);
1042
1043                 ub_state_stat(sc, cmd);
1044
1045         } else if (cmd->state == UB_CMDST_CLRRS) {
1046                 if (urb->status == -EPIPE) {
1047                         printk(KERN_NOTICE "%s: stall on control pipe\n",
1048                             sc->name);
1049                         goto Bad_End;
1050                 }
1051
1052                 /*
1053                  * We ignore the result for the halt clear.
1054                  */
1055
1056                 /* reset the endpoint toggle */
1057                 usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
1058                         usb_pipeout(sc->last_pipe), 0);
1059
1060                 ub_state_stat_counted(sc, cmd);
1061
1062         } else if (cmd->state == UB_CMDST_CMD) {
1063                 switch (urb->status) {
1064                 case 0:
1065                         break;
1066                 case -EOVERFLOW:
1067                         goto Bad_End;
1068                 case -EPIPE:
1069                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1070                         if (rc != 0) {
1071                                 printk(KERN_NOTICE "%s: "
1072                                     "unable to submit clear (%d)\n",
1073                                     sc->name, rc);
1074                                 /*
1075                                  * This is typically ENOMEM or some other such shit.
1076                                  * Retrying is pointless. Just do Bad End on it...
1077                                  */
1078                                 ub_state_done(sc, cmd, rc);
1079                                 return;
1080                         }
1081                         cmd->state = UB_CMDST_CLEAR;
1082                         return;
1083                 case -ESHUTDOWN:        /* unplug */
1084                 case -EILSEQ:           /* unplug timeout on uhci */
1085                         ub_state_done(sc, cmd, -ENODEV);
1086                         return;
1087                 default:
1088                         goto Bad_End;
1089                 }
1090                 if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
1091                         goto Bad_End;
1092                 }
1093
1094                 if (cmd->dir == UB_DIR_NONE || cmd->nsg < 1) {
1095                         ub_state_stat(sc, cmd);
1096                         return;
1097                 }
1098
1099                 // udelay(125);         // usb-storage has this
1100                 ub_data_start(sc, cmd);
1101
1102         } else if (cmd->state == UB_CMDST_DATA) {
1103                 if (urb->status == -EPIPE) {
1104                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1105                         if (rc != 0) {
1106                                 printk(KERN_NOTICE "%s: "
1107                                     "unable to submit clear (%d)\n",
1108                                     sc->name, rc);
1109                                 ub_state_done(sc, cmd, rc);
1110                                 return;
1111                         }
1112                         cmd->state = UB_CMDST_CLR2STS;
1113                         return;
1114                 }
1115                 if (urb->status == -EOVERFLOW) {
1116                         /*
1117                          * A babble? Failure, but we must transfer CSW now.
1118                          */
1119                         cmd->error = -EOVERFLOW;        /* A cheap trick... */
1120                         ub_state_stat(sc, cmd);
1121                         return;
1122                 }
1123
1124                 if (cmd->dir == UB_DIR_WRITE) {
1125                         /*
1126                          * Do not continue writes in case of a failure.
1127                          * Doing so would cause sectors to be mixed up,
1128                          * which is worse than sectors lost.
1129                          *
1130                          * We must try to read the CSW, or many devices
1131                          * get confused.
1132                          */
1133                         len = urb->actual_length;
1134                         if (urb->status != 0 ||
1135                             len != cmd->sgv[cmd->current_sg].length) {
1136                                 cmd->act_len += len;
1137
1138                                 cmd->error = -EIO;
1139                                 ub_state_stat(sc, cmd);
1140                                 return;
1141                         }
1142
1143                 } else {
1144                         /*
1145                          * If an error occurs on read, we record it, and
1146                          * continue to fetch data in order to avoid bubble.
1147                          *
1148                          * As a small shortcut, we stop if we detect that
1149                          * a CSW mixed into data.
1150                          */
1151                         if (urb->status != 0)
1152                                 cmd->error = -EIO;
1153
1154                         len = urb->actual_length;
1155                         if (urb->status != 0 ||
1156                             len != cmd->sgv[cmd->current_sg].length) {
1157                                 if ((len & 0x1FF) == US_BULK_CS_WRAP_LEN)
1158                                         goto Bad_End;
1159                         }
1160                 }
1161
1162                 cmd->act_len += urb->actual_length;
1163
1164                 if (++cmd->current_sg < cmd->nsg) {
1165                         ub_data_start(sc, cmd);
1166                         return;
1167                 }
1168                 ub_state_stat(sc, cmd);
1169
1170         } else if (cmd->state == UB_CMDST_STAT) {
1171                 if (urb->status == -EPIPE) {
1172                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
1173                         if (rc != 0) {
1174                                 printk(KERN_NOTICE "%s: "
1175                                     "unable to submit clear (%d)\n",
1176                                     sc->name, rc);
1177                                 ub_state_done(sc, cmd, rc);
1178                                 return;
1179                         }
1180
1181                         /*
1182                          * Having a stall when getting CSW is an error, so
1183                          * make sure uppper levels are not oblivious to it.
1184                          */
1185                         cmd->error = -EIO;              /* A cheap trick... */
1186
1187                         cmd->state = UB_CMDST_CLRRS;
1188                         return;
1189                 }
1190
1191                 /* Catch everything, including -EOVERFLOW and other nasties. */
1192                 if (urb->status != 0)
1193                         goto Bad_End;
1194
1195                 if (urb->actual_length == 0) {
1196                         ub_state_stat_counted(sc, cmd);
1197                         return;
1198                 }
1199
1200                 /*
1201                  * Check the returned Bulk protocol status.
1202                  * The status block has to be validated first.
1203                  */
1204
1205                 bcs = &sc->work_bcs;
1206
1207                 if (sc->signature == cpu_to_le32(0)) {
1208                         /*
1209                          * This is the first reply, so do not perform the check.
1210                          * Instead, remember the signature the device uses
1211                          * for future checks. But do not allow a nul.
1212                          */
1213                         sc->signature = bcs->Signature;
1214                         if (sc->signature == cpu_to_le32(0)) {
1215                                 ub_state_stat_counted(sc, cmd);
1216                                 return;
1217                         }
1218                 } else {
1219                         if (bcs->Signature != sc->signature) {
1220                                 ub_state_stat_counted(sc, cmd);
1221                                 return;
1222                         }
1223                 }
1224
1225                 if (bcs->Tag != cmd->tag) {
1226                         /*
1227                          * This usually happens when we disagree with the
1228                          * device's microcode about something. For instance,
1229                          * a few of them throw this after timeouts. They buffer
1230                          * commands and reply at commands we timed out before.
1231                          * Without flushing these replies we loop forever.
1232                          */
1233                         ub_state_stat_counted(sc, cmd);
1234                         return;
1235                 }
1236
1237                 len = le32_to_cpu(bcs->Residue);
1238                 if (len != cmd->len - cmd->act_len) {
1239                         /*
1240                          * It is all right to transfer less, the caller has
1241                          * to check. But it's not all right if the device
1242                          * counts disagree with our counts.
1243                          */
1244                         /* P3 */ printk("%s: resid %d len %d act %d\n",
1245                             sc->name, len, cmd->len, cmd->act_len);
1246                         goto Bad_End;
1247                 }
1248
1249                 switch (bcs->Status) {
1250                 case US_BULK_STAT_OK:
1251                         break;
1252                 case US_BULK_STAT_FAIL:
1253                         ub_state_sense(sc, cmd);
1254                         return;
1255                 case US_BULK_STAT_PHASE:
1256                         /* P3 */ printk("%s: status PHASE\n", sc->name);
1257                         goto Bad_End;
1258                 default:
1259                         printk(KERN_INFO "%s: unknown CSW status 0x%x\n",
1260                             sc->name, bcs->Status);
1261                         ub_state_done(sc, cmd, -EINVAL);
1262                         return;
1263                 }
1264
1265                 /* Not zeroing error to preserve a babble indicator */
1266                 if (cmd->error != 0) {
1267                         ub_state_sense(sc, cmd);
1268                         return;
1269                 }
1270                 cmd->state = UB_CMDST_DONE;
1271                 ub_cmdq_pop(sc);
1272                 (*cmd->done)(sc, cmd);
1273
1274         } else if (cmd->state == UB_CMDST_SENSE) {
1275                 ub_state_done(sc, cmd, -EIO);
1276
1277         } else {
1278                 printk(KERN_WARNING "%s: "
1279                     "wrong command state %d\n",
1280                     sc->name, cmd->state);
1281                 ub_state_done(sc, cmd, -EINVAL);
1282                 return;
1283         }
1284         return;
1285
1286 Bad_End: /* Little Excel is dead */
1287         ub_state_done(sc, cmd, -EIO);
1288 }
1289
1290 /*
1291  * Factorization helper for the command state machine:
1292  * Initiate a data segment transfer.
1293  */
1294 static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1295 {
1296         struct scatterlist *sg = &cmd->sgv[cmd->current_sg];
1297         int pipe;
1298         int rc;
1299
1300         UB_INIT_COMPLETION(sc->work_done);
1301
1302         if (cmd->dir == UB_DIR_READ)
1303                 pipe = sc->recv_bulk_pipe;
1304         else
1305                 pipe = sc->send_bulk_pipe;
1306         sc->last_pipe = pipe;
1307         usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe,
1308             page_address(sg->page) + sg->offset, sg->length,
1309             ub_urb_complete, sc);
1310         sc->work_urb.actual_length = 0;
1311         sc->work_urb.error_count = 0;
1312         sc->work_urb.status = 0;
1313
1314         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1315                 /* XXX Clear stalls */
1316                 ub_complete(&sc->work_done);
1317                 ub_state_done(sc, cmd, rc);
1318                 return;
1319         }
1320
1321         sc->work_timer.expires = jiffies + UB_DATA_TIMEOUT;
1322         add_timer(&sc->work_timer);
1323
1324         cmd->state = UB_CMDST_DATA;
1325 }
1326
1327 /*
1328  * Factorization helper for the command state machine:
1329  * Finish the command.
1330  */
1331 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc)
1332 {
1333
1334         cmd->error = rc;
1335         cmd->state = UB_CMDST_DONE;
1336         ub_cmdq_pop(sc);
1337         (*cmd->done)(sc, cmd);
1338 }
1339
1340 /*
1341  * Factorization helper for the command state machine:
1342  * Submit a CSW read.
1343  */
1344 static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1345 {
1346         int rc;
1347
1348         UB_INIT_COMPLETION(sc->work_done);
1349
1350         sc->last_pipe = sc->recv_bulk_pipe;
1351         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
1352             &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
1353         sc->work_urb.actual_length = 0;
1354         sc->work_urb.error_count = 0;
1355         sc->work_urb.status = 0;
1356
1357         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1358                 /* XXX Clear stalls */
1359                 ub_complete(&sc->work_done);
1360                 ub_state_done(sc, cmd, rc);
1361                 return -1;
1362         }
1363
1364         sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
1365         add_timer(&sc->work_timer);
1366         return 0;
1367 }
1368
1369 /*
1370  * Factorization helper for the command state machine:
1371  * Submit a CSW read and go to STAT state.
1372  */
1373 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1374 {
1375
1376         if (__ub_state_stat(sc, cmd) != 0)
1377                 return;
1378
1379         cmd->stat_count = 0;
1380         cmd->state = UB_CMDST_STAT;
1381 }
1382
1383 /*
1384  * Factorization helper for the command state machine:
1385  * Submit a CSW read and go to STAT state with counter (along [C] path).
1386  */
1387 static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1388 {
1389
1390         if (++cmd->stat_count >= 4) {
1391                 ub_state_sense(sc, cmd);
1392                 return;
1393         }
1394
1395         if (__ub_state_stat(sc, cmd) != 0)
1396                 return;
1397
1398         cmd->state = UB_CMDST_STAT;
1399 }
1400
1401 /*
1402  * Factorization helper for the command state machine:
1403  * Submit a REQUEST SENSE and go to SENSE state.
1404  */
1405 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1406 {
1407         struct ub_scsi_cmd *scmd;
1408         struct scatterlist *sg;
1409         int rc;
1410
1411         if (cmd->cdb[0] == REQUEST_SENSE) {
1412                 rc = -EPIPE;
1413                 goto error;
1414         }
1415
1416         scmd = &sc->top_rqs_cmd;
1417         memset(scmd, 0, sizeof(struct ub_scsi_cmd));
1418         scmd->cdb[0] = REQUEST_SENSE;
1419         scmd->cdb[4] = UB_SENSE_SIZE;
1420         scmd->cdb_len = 6;
1421         scmd->dir = UB_DIR_READ;
1422         scmd->state = UB_CMDST_INIT;
1423         scmd->nsg = 1;
1424         sg = &scmd->sgv[0];
1425         sg->page = virt_to_page(sc->top_sense);
1426         sg->offset = (unsigned long)sc->top_sense & (PAGE_SIZE-1);
1427         sg->length = UB_SENSE_SIZE;
1428         scmd->len = UB_SENSE_SIZE;
1429         scmd->lun = cmd->lun;
1430         scmd->done = ub_top_sense_done;
1431         scmd->back = cmd;
1432
1433         scmd->tag = sc->tagcnt++;
1434
1435         cmd->state = UB_CMDST_SENSE;
1436
1437         ub_cmdq_insert(sc, scmd);
1438         return;
1439
1440 error:
1441         ub_state_done(sc, cmd, rc);
1442 }
1443
1444 /*
1445  * A helper for the command's state machine:
1446  * Submit a stall clear.
1447  */
1448 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
1449     int stalled_pipe)
1450 {
1451         int endp;
1452         struct usb_ctrlrequest *cr;
1453         int rc;
1454
1455         endp = usb_pipeendpoint(stalled_pipe);
1456         if (usb_pipein (stalled_pipe))
1457                 endp |= USB_DIR_IN;
1458
1459         cr = &sc->work_cr;
1460         cr->bRequestType = USB_RECIP_ENDPOINT;
1461         cr->bRequest = USB_REQ_CLEAR_FEATURE;
1462         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
1463         cr->wIndex = cpu_to_le16(endp);
1464         cr->wLength = cpu_to_le16(0);
1465
1466         UB_INIT_COMPLETION(sc->work_done);
1467
1468         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1469             (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
1470         sc->work_urb.actual_length = 0;
1471         sc->work_urb.error_count = 0;
1472         sc->work_urb.status = 0;
1473
1474         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
1475                 ub_complete(&sc->work_done);
1476                 return rc;
1477         }
1478
1479         sc->work_timer.expires = jiffies + UB_CTRL_TIMEOUT;
1480         add_timer(&sc->work_timer);
1481         return 0;
1482 }
1483
1484 /*
1485  */
1486 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
1487 {
1488         unsigned char *sense = sc->top_sense;
1489         struct ub_scsi_cmd *cmd;
1490
1491         /*
1492          * Find the command which triggered the unit attention or a check,
1493          * save the sense into it, and advance its state machine.
1494          */
1495         if ((cmd = ub_cmdq_peek(sc)) == NULL) {
1496                 printk(KERN_WARNING "%s: sense done while idle\n", sc->name);
1497                 return;
1498         }
1499         if (cmd != scmd->back) {
1500                 printk(KERN_WARNING "%s: "
1501                     "sense done for wrong command 0x%x\n",
1502                     sc->name, cmd->tag);
1503                 return;
1504         }
1505         if (cmd->state != UB_CMDST_SENSE) {
1506                 printk(KERN_WARNING "%s: "
1507                     "sense done with bad cmd state %d\n",
1508                     sc->name, cmd->state);
1509                 return;
1510         }
1511
1512         /*
1513          * Ignoring scmd->act_len, because the buffer was pre-zeroed.
1514          */
1515         cmd->key = sense[2] & 0x0F;
1516         cmd->asc = sense[12];
1517         cmd->ascq = sense[13];
1518
1519         ub_scsi_urb_compl(sc, cmd);
1520 }
1521
1522 /*
1523  * Reset management
1524  * XXX Move usb_reset_device to khubd. Hogging kevent is not a good thing.
1525  * XXX Make usb_sync_reset asynchronous.
1526  */
1527
1528 static void ub_reset_enter(struct ub_dev *sc, int try)
1529 {
1530
1531         if (sc->reset) {
1532                 /* This happens often on multi-LUN devices. */
1533                 return;
1534         }
1535         sc->reset = try + 1;
1536
1537 #if 0 /* Not needed because the disconnect waits for us. */
1538         unsigned long flags;
1539         spin_lock_irqsave(&ub_lock, flags);
1540         sc->openc++;
1541         spin_unlock_irqrestore(&ub_lock, flags);
1542 #endif
1543
1544 #if 0 /* We let them stop themselves. */
1545         struct list_head *p;
1546         struct ub_lun *lun;
1547         list_for_each(p, &sc->luns) {
1548                 lun = list_entry(p, struct ub_lun, link);
1549                 blk_stop_queue(lun->disk->queue);
1550         }
1551 #endif
1552
1553         schedule_work(&sc->reset_work);
1554 }
1555
1556 static void ub_reset_task(void *arg)
1557 {
1558         struct ub_dev *sc = arg;
1559         unsigned long flags;
1560         struct list_head *p;
1561         struct ub_lun *lun;
1562         int lkr, rc;
1563
1564         if (!sc->reset) {
1565                 printk(KERN_WARNING "%s: Running reset unrequested\n",
1566                     sc->name);
1567                 return;
1568         }
1569
1570         if (atomic_read(&sc->poison)) {
1571                 printk(KERN_NOTICE "%s: Not resetting disconnected device\n",
1572                     sc->name); /* P3 This floods. Remove soon. XXX */
1573         } else if ((sc->reset & 1) == 0) {
1574                 ub_sync_reset(sc);
1575                 msleep(700);    /* usb-storage sleeps 6s (!) */
1576                 ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
1577                 ub_probe_clear_stall(sc, sc->send_bulk_pipe);
1578         } else if (sc->dev->actconfig->desc.bNumInterfaces != 1) {
1579                 printk(KERN_NOTICE "%s: Not resetting multi-interface device\n",
1580                     sc->name); /* P3 This floods. Remove soon. XXX */
1581         } else {
1582                 if ((lkr = usb_lock_device_for_reset(sc->dev, sc->intf)) < 0) {
1583                         printk(KERN_NOTICE
1584                             "%s: usb_lock_device_for_reset failed (%d)\n",
1585                             sc->name, lkr);
1586                 } else {
1587                         rc = usb_reset_device(sc->dev);
1588                         if (rc < 0) {
1589                                 printk(KERN_NOTICE "%s: "
1590                                     "usb_lock_device_for_reset failed (%d)\n",
1591                                     sc->name, rc);
1592                         }
1593
1594                         if (lkr)
1595                                 usb_unlock_device(sc->dev);
1596                 }
1597         }
1598
1599         /*
1600          * In theory, no commands can be running while reset is active,
1601          * so nobody can ask for another reset, and so we do not need any
1602          * queues of resets or anything. We do need a spinlock though,
1603          * to interact with block layer.
1604          */
1605         spin_lock_irqsave(sc->lock, flags);
1606         sc->reset = 0;
1607         tasklet_schedule(&sc->tasklet);
1608         list_for_each(p, &sc->luns) {
1609                 lun = list_entry(p, struct ub_lun, link);
1610                 blk_start_queue(lun->disk->queue);
1611         }
1612         wake_up(&sc->reset_wait);
1613         spin_unlock_irqrestore(sc->lock, flags);
1614 }
1615
1616 /*
1617  * This is called from a process context.
1618  */
1619 static void ub_revalidate(struct ub_dev *sc, struct ub_lun *lun)
1620 {
1621
1622         lun->readonly = 0;      /* XXX Query this from the device */
1623
1624         lun->capacity.nsec = 0;
1625         lun->capacity.bsize = 512;
1626         lun->capacity.bshift = 0;
1627
1628         if (ub_sync_tur(sc, lun) != 0)
1629                 return;                 /* Not ready */
1630         lun->changed = 0;
1631
1632         if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1633                 /*
1634                  * The retry here means something is wrong, either with the
1635                  * device, with the transport, or with our code.
1636                  * We keep this because sd.c has retries for capacity.
1637                  */
1638                 if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
1639                         lun->capacity.nsec = 0;
1640                         lun->capacity.bsize = 512;
1641                         lun->capacity.bshift = 0;
1642                 }
1643         }
1644 }
1645
1646 /*
1647  * The open funcion.
1648  * This is mostly needed to keep refcounting, but also to support
1649  * media checks on removable media drives.
1650  */
1651 static int ub_bd_open(struct inode *inode, struct file *filp)
1652 {
1653         struct gendisk *disk = inode->i_bdev->bd_disk;
1654         struct ub_lun *lun;
1655         struct ub_dev *sc;
1656         unsigned long flags;
1657         int rc;
1658
1659         if ((lun = disk->private_data) == NULL)
1660                 return -ENXIO;
1661         sc = lun->udev;
1662
1663         spin_lock_irqsave(&ub_lock, flags);
1664         if (atomic_read(&sc->poison)) {
1665                 spin_unlock_irqrestore(&ub_lock, flags);
1666                 return -ENXIO;
1667         }
1668         sc->openc++;
1669         spin_unlock_irqrestore(&ub_lock, flags);
1670
1671         if (lun->removable || lun->readonly)
1672                 check_disk_change(inode->i_bdev);
1673
1674         /*
1675          * The sd.c considers ->media_present and ->changed not equivalent,
1676          * under some pretty murky conditions (a failure of READ CAPACITY).
1677          * We may need it one day.
1678          */
1679         if (lun->removable && lun->changed && !(filp->f_flags & O_NDELAY)) {
1680                 rc = -ENOMEDIUM;
1681                 goto err_open;
1682         }
1683
1684         if (lun->readonly && (filp->f_mode & FMODE_WRITE)) {
1685                 rc = -EROFS;
1686                 goto err_open;
1687         }
1688
1689         return 0;
1690
1691 err_open:
1692         ub_put(sc);
1693         return rc;
1694 }
1695
1696 /*
1697  */
1698 static int ub_bd_release(struct inode *inode, struct file *filp)
1699 {
1700         struct gendisk *disk = inode->i_bdev->bd_disk;
1701         struct ub_lun *lun = disk->private_data;
1702         struct ub_dev *sc = lun->udev;
1703
1704         ub_put(sc);
1705         return 0;
1706 }
1707
1708 /*
1709  * The ioctl interface.
1710  */
1711 static int ub_bd_ioctl(struct inode *inode, struct file *filp,
1712     unsigned int cmd, unsigned long arg)
1713 {
1714         struct gendisk *disk = inode->i_bdev->bd_disk;
1715         void __user *usermem = (void __user *) arg;
1716
1717         return scsi_cmd_ioctl(filp, disk, cmd, usermem);
1718 }
1719
1720 /*
1721  * This is called once a new disk was seen by the block layer or by ub_probe().
1722  * The main onjective here is to discover the features of the media such as
1723  * the capacity, read-only status, etc. USB storage generally does not
1724  * need to be spun up, but if we needed it, this would be the place.
1725  *
1726  * This call can sleep.
1727  *
1728  * The return code is not used.
1729  */
1730 static int ub_bd_revalidate(struct gendisk *disk)
1731 {
1732         struct ub_lun *lun = disk->private_data;
1733
1734         ub_revalidate(lun->udev, lun);
1735
1736         /* XXX Support sector size switching like in sr.c */
1737         blk_queue_hardsect_size(disk->queue, lun->capacity.bsize);
1738         set_capacity(disk, lun->capacity.nsec);
1739         // set_disk_ro(sdkp->disk, lun->readonly);
1740
1741         return 0;
1742 }
1743
1744 /*
1745  * The check is called by the block layer to verify if the media
1746  * is still available. It is supposed to be harmless, lightweight and
1747  * non-intrusive in case the media was not changed.
1748  *
1749  * This call can sleep.
1750  *
1751  * The return code is bool!
1752  */
1753 static int ub_bd_media_changed(struct gendisk *disk)
1754 {
1755         struct ub_lun *lun = disk->private_data;
1756
1757         if (!lun->removable)
1758                 return 0;
1759
1760         /*
1761          * We clean checks always after every command, so this is not
1762          * as dangerous as it looks. If the TEST_UNIT_READY fails here,
1763          * the device is actually not ready with operator or software
1764          * intervention required. One dangerous item might be a drive which
1765          * spins itself down, and come the time to write dirty pages, this
1766          * will fail, then block layer discards the data. Since we never
1767          * spin drives up, such devices simply cannot be used with ub anyway.
1768          */
1769         if (ub_sync_tur(lun->udev, lun) != 0) {
1770                 lun->changed = 1;
1771                 return 1;
1772         }
1773
1774         return lun->changed;
1775 }
1776
1777 static struct block_device_operations ub_bd_fops = {
1778         .owner          = THIS_MODULE,
1779         .open           = ub_bd_open,
1780         .release        = ub_bd_release,
1781         .ioctl          = ub_bd_ioctl,
1782         .media_changed  = ub_bd_media_changed,
1783         .revalidate_disk = ub_bd_revalidate,
1784 };
1785
1786 /*
1787  * Common ->done routine for commands executed synchronously.
1788  */
1789 static void ub_probe_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
1790 {
1791         struct completion *cop = cmd->back;
1792         complete(cop);
1793 }
1794
1795 /*
1796  * Test if the device has a check condition on it, synchronously.
1797  */
1798 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun)
1799 {
1800         struct ub_scsi_cmd *cmd;
1801         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) };
1802         unsigned long flags;
1803         struct completion compl;
1804         int rc;
1805
1806         init_completion(&compl);
1807
1808         rc = -ENOMEM;
1809         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1810                 goto err_alloc;
1811
1812         cmd->cdb[0] = TEST_UNIT_READY;
1813         cmd->cdb_len = 6;
1814         cmd->dir = UB_DIR_NONE;
1815         cmd->state = UB_CMDST_INIT;
1816         cmd->lun = lun;                 /* This may be NULL, but that's ok */
1817         cmd->done = ub_probe_done;
1818         cmd->back = &compl;
1819
1820         spin_lock_irqsave(sc->lock, flags);
1821         cmd->tag = sc->tagcnt++;
1822
1823         rc = ub_submit_scsi(sc, cmd);
1824         spin_unlock_irqrestore(sc->lock, flags);
1825
1826         if (rc != 0) {
1827                 printk("ub: testing ready: submit error (%d)\n", rc); /* P3 */
1828                 goto err_submit;
1829         }
1830
1831         wait_for_completion(&compl);
1832
1833         rc = cmd->error;
1834
1835         if (rc == -EIO && cmd->key != 0)        /* Retries for benh's key */
1836                 rc = cmd->key;
1837
1838 err_submit:
1839         kfree(cmd);
1840 err_alloc:
1841         return rc;
1842 }
1843
1844 /*
1845  * Read the SCSI capacity synchronously (for probing).
1846  */
1847 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
1848     struct ub_capacity *ret)
1849 {
1850         struct ub_scsi_cmd *cmd;
1851         struct scatterlist *sg;
1852         char *p;
1853         enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) + 8 };
1854         unsigned long flags;
1855         unsigned int bsize, shift;
1856         unsigned long nsec;
1857         struct completion compl;
1858         int rc;
1859
1860         init_completion(&compl);
1861
1862         rc = -ENOMEM;
1863         if ((cmd = kzalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
1864                 goto err_alloc;
1865         p = (char *)cmd + sizeof(struct ub_scsi_cmd);
1866
1867         cmd->cdb[0] = 0x25;
1868         cmd->cdb_len = 10;
1869         cmd->dir = UB_DIR_READ;
1870         cmd->state = UB_CMDST_INIT;
1871         cmd->nsg = 1;
1872         sg = &cmd->sgv[0];
1873         sg->page = virt_to_page(p);
1874         sg->offset = (unsigned long)p & (PAGE_SIZE-1);
1875         sg->length = 8;
1876         cmd->len = 8;
1877         cmd->lun = lun;
1878         cmd->done = ub_probe_done;
1879         cmd->back = &compl;
1880
1881         spin_lock_irqsave(sc->lock, flags);
1882         cmd->tag = sc->tagcnt++;
1883
1884         rc = ub_submit_scsi(sc, cmd);
1885         spin_unlock_irqrestore(sc->lock, flags);
1886
1887         if (rc != 0) {
1888                 printk("ub: reading capacity: submit error (%d)\n", rc); /* P3 */
1889                 goto err_submit;
1890         }
1891
1892         wait_for_completion(&compl);
1893
1894         if (cmd->error != 0) {
1895                 printk("ub: reading capacity: error %d\n", cmd->error); /* P3 */
1896                 rc = -EIO;
1897                 goto err_read;
1898         }
1899         if (cmd->act_len != 8) {
1900                 printk("ub: reading capacity: size %d\n", cmd->act_len); /* P3 */
1901                 rc = -EIO;
1902                 goto err_read;
1903         }
1904
1905         /* sd.c special-cases sector size of 0 to mean 512. Needed? Safe? */
1906         nsec = be32_to_cpu(*(__be32 *)p) + 1;
1907         bsize = be32_to_cpu(*(__be32 *)(p + 4));
1908         switch (bsize) {
1909         case 512:       shift = 0;      break;
1910         case 1024:      shift = 1;      break;
1911         case 2048:      shift = 2;      break;
1912         case 4096:      shift = 3;      break;
1913         default:
1914                 printk("ub: Bad sector size %u\n", bsize); /* P3 */
1915                 rc = -EDOM;
1916                 goto err_inv_bsize;
1917         }
1918
1919         ret->bsize = bsize;
1920         ret->bshift = shift;
1921         ret->nsec = nsec << shift;
1922         rc = 0;
1923
1924 err_inv_bsize:
1925 err_read:
1926 err_submit:
1927         kfree(cmd);
1928 err_alloc:
1929         return rc;
1930 }
1931
1932 /*
1933  */
1934 static void ub_probe_urb_complete(struct urb *urb, struct pt_regs *pt)
1935 {
1936         struct completion *cop = urb->context;
1937         complete(cop);
1938 }
1939
1940 static void ub_probe_timeout(unsigned long arg)
1941 {
1942         struct completion *cop = (struct completion *) arg;
1943         complete(cop);
1944 }
1945
1946 /*
1947  * Reset with a Bulk reset.
1948  */
1949 static int ub_sync_reset(struct ub_dev *sc)
1950 {
1951         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
1952         struct usb_ctrlrequest *cr;
1953         struct completion compl;
1954         struct timer_list timer;
1955         int rc;
1956
1957         init_completion(&compl);
1958
1959         cr = &sc->work_cr;
1960         cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
1961         cr->bRequest = US_BULK_RESET_REQUEST;
1962         cr->wValue = cpu_to_le16(0);
1963         cr->wIndex = cpu_to_le16(ifnum);
1964         cr->wLength = cpu_to_le16(0);
1965
1966         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
1967             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
1968         sc->work_urb.actual_length = 0;
1969         sc->work_urb.error_count = 0;
1970         sc->work_urb.status = 0;
1971
1972         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
1973                 printk(KERN_WARNING
1974                      "%s: Unable to submit a bulk reset (%d)\n", sc->name, rc);
1975                 return rc;
1976         }
1977
1978         init_timer(&timer);
1979         timer.function = ub_probe_timeout;
1980         timer.data = (unsigned long) &compl;
1981         timer.expires = jiffies + UB_CTRL_TIMEOUT;
1982         add_timer(&timer);
1983
1984         wait_for_completion(&compl);
1985
1986         del_timer_sync(&timer);
1987         usb_kill_urb(&sc->work_urb);
1988
1989         return sc->work_urb.status;
1990 }
1991
1992 /*
1993  * Get number of LUNs by the way of Bulk GetMaxLUN command.
1994  */
1995 static int ub_sync_getmaxlun(struct ub_dev *sc)
1996 {
1997         int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
1998         unsigned char *p;
1999         enum { ALLOC_SIZE = 1 };
2000         struct usb_ctrlrequest *cr;
2001         struct completion compl;
2002         struct timer_list timer;
2003         int nluns;
2004         int rc;
2005
2006         init_completion(&compl);
2007
2008         rc = -ENOMEM;
2009         if ((p = kmalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
2010                 goto err_alloc;
2011         *p = 55;
2012
2013         cr = &sc->work_cr;
2014         cr->bRequestType = USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
2015         cr->bRequest = US_BULK_GET_MAX_LUN;
2016         cr->wValue = cpu_to_le16(0);
2017         cr->wIndex = cpu_to_le16(ifnum);
2018         cr->wLength = cpu_to_le16(1);
2019
2020         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
2021             (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
2022         sc->work_urb.actual_length = 0;
2023         sc->work_urb.error_count = 0;
2024         sc->work_urb.status = 0;
2025
2026         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
2027                 if (rc == -EPIPE) {
2028                         printk("%s: Stall submitting GetMaxLUN, using 1 LUN\n",
2029                              sc->name); /* P3 */
2030                 } else {
2031                         printk(KERN_NOTICE
2032                              "%s: Unable to submit GetMaxLUN (%d)\n",
2033                              sc->name, rc);
2034                 }
2035                 goto err_submit;
2036         }
2037
2038         init_timer(&timer);
2039         timer.function = ub_probe_timeout;
2040         timer.data = (unsigned long) &compl;
2041         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2042         add_timer(&timer);
2043
2044         wait_for_completion(&compl);
2045
2046         del_timer_sync(&timer);
2047         usb_kill_urb(&sc->work_urb);
2048
2049         if ((rc = sc->work_urb.status) < 0) {
2050                 if (rc == -EPIPE) {
2051                         printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
2052                              sc->name); /* P3 */
2053                 } else {
2054                         printk(KERN_NOTICE
2055                              "%s: Error at GetMaxLUN (%d)\n",
2056                              sc->name, rc);
2057                 }
2058                 goto err_io;
2059         }
2060
2061         if (sc->work_urb.actual_length != 1) {
2062                 printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
2063                     sc->work_urb.actual_length); /* P3 */
2064                 nluns = 0;
2065         } else {
2066                 if ((nluns = *p) == 55) {
2067                         nluns = 0;
2068                 } else {
2069                         /* GetMaxLUN returns the maximum LUN number */
2070                         nluns += 1;
2071                         if (nluns > UB_MAX_LUNS)
2072                                 nluns = UB_MAX_LUNS;
2073                 }
2074                 printk("%s: GetMaxLUN returned %d, using %d LUNs\n", sc->name,
2075                     *p, nluns); /* P3 */
2076         }
2077
2078         kfree(p);
2079         return nluns;
2080
2081 err_io:
2082 err_submit:
2083         kfree(p);
2084 err_alloc:
2085         return rc;
2086 }
2087
2088 /*
2089  * Clear initial stalls.
2090  */
2091 static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe)
2092 {
2093         int endp;
2094         struct usb_ctrlrequest *cr;
2095         struct completion compl;
2096         struct timer_list timer;
2097         int rc;
2098
2099         init_completion(&compl);
2100
2101         endp = usb_pipeendpoint(stalled_pipe);
2102         if (usb_pipein (stalled_pipe))
2103                 endp |= USB_DIR_IN;
2104
2105         cr = &sc->work_cr;
2106         cr->bRequestType = USB_RECIP_ENDPOINT;
2107         cr->bRequest = USB_REQ_CLEAR_FEATURE;
2108         cr->wValue = cpu_to_le16(USB_ENDPOINT_HALT);
2109         cr->wIndex = cpu_to_le16(endp);
2110         cr->wLength = cpu_to_le16(0);
2111
2112         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
2113             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
2114         sc->work_urb.actual_length = 0;
2115         sc->work_urb.error_count = 0;
2116         sc->work_urb.status = 0;
2117
2118         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
2119                 printk(KERN_WARNING
2120                      "%s: Unable to submit a probe clear (%d)\n", sc->name, rc);
2121                 return rc;
2122         }
2123
2124         init_timer(&timer);
2125         timer.function = ub_probe_timeout;
2126         timer.data = (unsigned long) &compl;
2127         timer.expires = jiffies + UB_CTRL_TIMEOUT;
2128         add_timer(&timer);
2129
2130         wait_for_completion(&compl);
2131
2132         del_timer_sync(&timer);
2133         usb_kill_urb(&sc->work_urb);
2134
2135         /* reset the endpoint toggle */
2136         usb_settoggle(sc->dev, endp, usb_pipeout(sc->last_pipe), 0);
2137
2138         return 0;
2139 }
2140
2141 /*
2142  * Get the pipe settings.
2143  */
2144 static int ub_get_pipes(struct ub_dev *sc, struct usb_device *dev,
2145     struct usb_interface *intf)
2146 {
2147         struct usb_host_interface *altsetting = intf->cur_altsetting;
2148         struct usb_endpoint_descriptor *ep_in = NULL;
2149         struct usb_endpoint_descriptor *ep_out = NULL;
2150         struct usb_endpoint_descriptor *ep;
2151         int i;
2152
2153         /*
2154          * Find the endpoints we need.
2155          * We are expecting a minimum of 2 endpoints - in and out (bulk).
2156          * We will ignore any others.
2157          */
2158         for (i = 0; i < altsetting->desc.bNumEndpoints; i++) {
2159                 ep = &altsetting->endpoint[i].desc;
2160
2161                 /* Is it a BULK endpoint? */
2162                 if ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
2163                                 == USB_ENDPOINT_XFER_BULK) {
2164                         /* BULK in or out? */
2165                         if (ep->bEndpointAddress & USB_DIR_IN)
2166                                 ep_in = ep;
2167                         else
2168                                 ep_out = ep;
2169                 }
2170         }
2171
2172         if (ep_in == NULL || ep_out == NULL) {
2173                 printk(KERN_NOTICE "%s: failed endpoint check\n",
2174                     sc->name);
2175                 return -ENODEV;
2176         }
2177
2178         /* Calculate and store the pipe values */
2179         sc->send_ctrl_pipe = usb_sndctrlpipe(dev, 0);
2180         sc->recv_ctrl_pipe = usb_rcvctrlpipe(dev, 0);
2181         sc->send_bulk_pipe = usb_sndbulkpipe(dev,
2182                 ep_out->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2183         sc->recv_bulk_pipe = usb_rcvbulkpipe(dev, 
2184                 ep_in->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2185
2186         return 0;
2187 }
2188
2189 /*
2190  * Probing is done in the process context, which allows us to cheat
2191  * and not to build a state machine for the discovery.
2192  */
2193 static int ub_probe(struct usb_interface *intf,
2194     const struct usb_device_id *dev_id)
2195 {
2196         struct ub_dev *sc;
2197         int nluns;
2198         int rc;
2199         int i;
2200
2201         if (usb_usual_check_type(dev_id, USB_US_TYPE_UB))
2202                 return -ENXIO;
2203
2204         rc = -ENOMEM;
2205         if ((sc = kzalloc(sizeof(struct ub_dev), GFP_KERNEL)) == NULL)
2206                 goto err_core;
2207         sc->lock = ub_next_lock();
2208         INIT_LIST_HEAD(&sc->luns);
2209         usb_init_urb(&sc->work_urb);
2210         tasklet_init(&sc->tasklet, ub_scsi_action, (unsigned long)sc);
2211         atomic_set(&sc->poison, 0);
2212         INIT_WORK(&sc->reset_work, ub_reset_task, sc);
2213         init_waitqueue_head(&sc->reset_wait);
2214
2215         init_timer(&sc->work_timer);
2216         sc->work_timer.data = (unsigned long) sc;
2217         sc->work_timer.function = ub_urb_timeout;
2218
2219         ub_init_completion(&sc->work_done);
2220         sc->work_done.done = 1;         /* A little yuk, but oh well... */
2221
2222         sc->dev = interface_to_usbdev(intf);
2223         sc->intf = intf;
2224         // sc->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
2225         usb_set_intfdata(intf, sc);
2226         usb_get_dev(sc->dev);
2227         /*
2228          * Since we give the interface struct to the block level through
2229          * disk->driverfs_dev, we have to pin it. Otherwise, block_uevent
2230          * oopses on close after a disconnect (kernels 2.6.16 and up).
2231          */
2232         usb_get_intf(sc->intf);
2233
2234         snprintf(sc->name, 12, DRV_NAME "(%d.%d)",
2235             sc->dev->bus->busnum, sc->dev->devnum);
2236
2237         /* XXX Verify that we can handle the device (from descriptors) */
2238
2239         if (ub_get_pipes(sc, sc->dev, intf) != 0)
2240                 goto err_dev_desc;
2241
2242         /*
2243          * At this point, all USB initialization is done, do upper layer.
2244          * We really hate halfway initialized structures, so from the
2245          * invariants perspective, this ub_dev is fully constructed at
2246          * this point.
2247          */
2248
2249         /*
2250          * This is needed to clear toggles. It is a problem only if we do
2251          * `rmmod ub && modprobe ub` without disconnects, but we like that.
2252          */
2253 #if 0 /* iPod Mini fails if we do this (big white iPod works) */
2254         ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
2255         ub_probe_clear_stall(sc, sc->send_bulk_pipe);
2256 #endif
2257
2258         /*
2259          * The way this is used by the startup code is a little specific.
2260          * A SCSI check causes a USB stall. Our common case code sees it
2261          * and clears the check, after which the device is ready for use.
2262          * But if a check was not present, any command other than
2263          * TEST_UNIT_READY ends with a lockup (including REQUEST_SENSE).
2264          *
2265          * If we neglect to clear the SCSI check, the first real command fails
2266          * (which is the capacity readout). We clear that and retry, but why
2267          * causing spurious retries for no reason.
2268          *
2269          * Revalidation may start with its own TEST_UNIT_READY, but that one
2270          * has to succeed, so we clear checks with an additional one here.
2271          * In any case it's not our business how revaliadation is implemented.
2272          */
2273         for (i = 0; i < 3; i++) {       /* Retries for benh's key */
2274                 if ((rc = ub_sync_tur(sc, NULL)) <= 0) break;
2275                 if (rc != 0x6) break;
2276                 msleep(10);
2277         }
2278
2279         nluns = 1;
2280         for (i = 0; i < 3; i++) {
2281                 if ((rc = ub_sync_getmaxlun(sc)) < 0)
2282                         break;
2283                 if (rc != 0) {
2284                         nluns = rc;
2285                         break;
2286                 }
2287                 msleep(100);
2288         }
2289
2290         for (i = 0; i < nluns; i++) {
2291                 ub_probe_lun(sc, i);
2292         }
2293         return 0;
2294
2295 err_dev_desc:
2296         usb_set_intfdata(intf, NULL);
2297         usb_put_intf(sc->intf);
2298         usb_put_dev(sc->dev);
2299         kfree(sc);
2300 err_core:
2301         return rc;
2302 }
2303
2304 static int ub_probe_lun(struct ub_dev *sc, int lnum)
2305 {
2306         struct ub_lun *lun;
2307         request_queue_t *q;
2308         struct gendisk *disk;
2309         int rc;
2310
2311         rc = -ENOMEM;
2312         if ((lun = kzalloc(sizeof(struct ub_lun), GFP_KERNEL)) == NULL)
2313                 goto err_alloc;
2314         lun->num = lnum;
2315
2316         rc = -ENOSR;
2317         if ((lun->id = ub_id_get()) == -1)
2318                 goto err_id;
2319
2320         lun->udev = sc;
2321         list_add(&lun->link, &sc->luns);
2322
2323         snprintf(lun->name, 16, DRV_NAME "%c(%d.%d.%d)",
2324             lun->id + 'a', sc->dev->bus->busnum, sc->dev->devnum, lun->num);
2325
2326         lun->removable = 1;             /* XXX Query this from the device */
2327         lun->changed = 1;               /* ub_revalidate clears only */
2328         ub_revalidate(sc, lun);
2329
2330         rc = -ENOMEM;
2331         if ((disk = alloc_disk(UB_PARTS_PER_LUN)) == NULL)
2332                 goto err_diskalloc;
2333
2334         lun->disk = disk;
2335         sprintf(disk->disk_name, DRV_NAME "%c", lun->id + 'a');
2336         sprintf(disk->devfs_name, DEVFS_NAME "/%c", lun->id + 'a');
2337         disk->major = UB_MAJOR;
2338         disk->first_minor = lun->id * UB_PARTS_PER_LUN;
2339         disk->fops = &ub_bd_fops;
2340         disk->private_data = lun;
2341         disk->driverfs_dev = &sc->intf->dev;
2342
2343         rc = -ENOMEM;
2344         if ((q = blk_init_queue(ub_request_fn, sc->lock)) == NULL)
2345                 goto err_blkqinit;
2346
2347         disk->queue = q;
2348
2349         blk_queue_bounce_limit(q, BLK_BOUNCE_HIGH);
2350         blk_queue_max_hw_segments(q, UB_MAX_REQ_SG);
2351         blk_queue_max_phys_segments(q, UB_MAX_REQ_SG);
2352         blk_queue_segment_boundary(q, 0xffffffff);      /* Dubious. */
2353         blk_queue_max_sectors(q, UB_MAX_SECTORS);
2354         blk_queue_hardsect_size(q, lun->capacity.bsize);
2355
2356         q->queuedata = lun;
2357
2358         set_capacity(disk, lun->capacity.nsec);
2359         if (lun->removable)
2360                 disk->flags |= GENHD_FL_REMOVABLE;
2361
2362         add_disk(disk);
2363
2364         return 0;
2365
2366 err_blkqinit:
2367         put_disk(disk);
2368 err_diskalloc:
2369         list_del(&lun->link);
2370         ub_id_put(lun->id);
2371 err_id:
2372         kfree(lun);
2373 err_alloc:
2374         return rc;
2375 }
2376
2377 static void ub_disconnect(struct usb_interface *intf)
2378 {
2379         struct ub_dev *sc = usb_get_intfdata(intf);
2380         struct list_head *p;
2381         struct ub_lun *lun;
2382         struct gendisk *disk;
2383         unsigned long flags;
2384
2385         /*
2386          * Prevent ub_bd_release from pulling the rug from under us.
2387          * XXX This is starting to look like a kref.
2388          * XXX Why not to take this ref at probe time?
2389          */
2390         spin_lock_irqsave(&ub_lock, flags);
2391         sc->openc++;
2392         spin_unlock_irqrestore(&ub_lock, flags);
2393
2394         /*
2395          * Fence stall clearnings, operations triggered by unlinkings and so on.
2396          * We do not attempt to unlink any URBs, because we do not trust the
2397          * unlink paths in HC drivers. Also, we get -84 upon disconnect anyway.
2398          */
2399         atomic_set(&sc->poison, 1);
2400
2401         /*
2402          * Wait for reset to end, if any.
2403          */
2404         wait_event(sc->reset_wait, !sc->reset);
2405
2406         /*
2407          * Blow away queued commands.
2408          *
2409          * Actually, this never works, because before we get here
2410          * the HCD terminates outstanding URB(s). It causes our
2411          * SCSI command queue to advance, commands fail to submit,
2412          * and the whole queue drains. So, we just use this code to
2413          * print warnings.
2414          */
2415         spin_lock_irqsave(sc->lock, flags);
2416         {
2417                 struct ub_scsi_cmd *cmd;
2418                 int cnt = 0;
2419                 while ((cmd = ub_cmdq_peek(sc)) != NULL) {
2420                         cmd->error = -ENOTCONN;
2421                         cmd->state = UB_CMDST_DONE;
2422                         ub_cmdq_pop(sc);
2423                         (*cmd->done)(sc, cmd);
2424                         cnt++;
2425                 }
2426                 if (cnt != 0) {
2427                         printk(KERN_WARNING "%s: "
2428                             "%d was queued after shutdown\n", sc->name, cnt);
2429                 }
2430         }
2431         spin_unlock_irqrestore(sc->lock, flags);
2432
2433         /*
2434          * Unregister the upper layer.
2435          */
2436         list_for_each (p, &sc->luns) {
2437                 lun = list_entry(p, struct ub_lun, link);
2438                 disk = lun->disk;
2439                 if (disk->flags & GENHD_FL_UP)
2440                         del_gendisk(disk);
2441                 /*
2442                  * I wish I could do:
2443                  *    set_bit(QUEUE_FLAG_DEAD, &q->queue_flags);
2444                  * As it is, we rely on our internal poisoning and let
2445                  * the upper levels to spin furiously failing all the I/O.
2446                  */
2447         }
2448
2449         /*
2450          * Testing for -EINPROGRESS is always a bug, so we are bending
2451          * the rules a little.
2452          */
2453         spin_lock_irqsave(sc->lock, flags);
2454         if (sc->work_urb.status == -EINPROGRESS) {      /* janitors: ignore */
2455                 printk(KERN_WARNING "%s: "
2456                     "URB is active after disconnect\n", sc->name);
2457         }
2458         spin_unlock_irqrestore(sc->lock, flags);
2459
2460         /*
2461          * There is virtually no chance that other CPU runs times so long
2462          * after ub_urb_complete should have called del_timer, but only if HCD
2463          * didn't forget to deliver a callback on unlink.
2464          */
2465         del_timer_sync(&sc->work_timer);
2466
2467         /*
2468          * At this point there must be no commands coming from anyone
2469          * and no URBs left in transit.
2470          */
2471
2472         ub_put(sc);
2473 }
2474
2475 static struct usb_driver ub_driver = {
2476         .name =         "ub",
2477         .probe =        ub_probe,
2478         .disconnect =   ub_disconnect,
2479         .id_table =     ub_usb_ids,
2480 };
2481
2482 static int __init ub_init(void)
2483 {
2484         int rc;
2485         int i;
2486
2487         for (i = 0; i < UB_QLOCK_NUM; i++)
2488                 spin_lock_init(&ub_qlockv[i]);
2489
2490         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
2491                 goto err_regblkdev;
2492         devfs_mk_dir(DEVFS_NAME);
2493
2494         if ((rc = usb_register(&ub_driver)) != 0)
2495                 goto err_register;
2496
2497         usb_usual_set_present(USB_US_TYPE_UB);
2498         return 0;
2499
2500 err_register:
2501         devfs_remove(DEVFS_NAME);
2502         unregister_blkdev(UB_MAJOR, DRV_NAME);
2503 err_regblkdev:
2504         return rc;
2505 }
2506
2507 static void __exit ub_exit(void)
2508 {
2509         usb_deregister(&ub_driver);
2510
2511         devfs_remove(DEVFS_NAME);
2512         unregister_blkdev(UB_MAJOR, DRV_NAME);
2513         usb_usual_clear_present(USB_US_TYPE_UB);
2514 }
2515
2516 module_init(ub_init);
2517 module_exit(ub_exit);
2518
2519 MODULE_LICENSE("GPL");