cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

microtek.c (23313B)


      1// SPDX-License-Identifier: GPL-2.0
      2/* Driver for Microtek Scanmaker X6 USB scanner, and possibly others.
      3 *
      4 * (C) Copyright 2000 John Fremlin <vii@penguinpowered.com>
      5 * (C) Copyright 2000 Oliver Neukum <Oliver.Neukum@lrz.uni-muenchen.de>
      6 *
      7 * Parts shamelessly stolen from usb-storage and copyright by their
      8 * authors. Thanks to Matt Dharm for giving us permission!
      9 *
     10 * This driver implements a SCSI host controller driver and a USB
     11 * device driver. To avoid confusion, all the USB related stuff is
     12 * prefixed by mts_usb_ and all the SCSI stuff by mts_scsi_.
     13 *
     14 * Microtek (www.microtek.com) did not release the specifications for
     15 * their USB protocol to us, so we had to reverse engineer them. We
     16 * don't know for which models they are valid.
     17 *
     18 * The X6 USB has three bulk endpoints, one output (0x1) down which
     19 * commands and outgoing data are sent, and two input: 0x82 from which
     20 * normal data is read from the scanner (in packets of maximum 32
     21 * bytes) and from which the status byte is read, and 0x83 from which
     22 * the results of a scan (or preview) are read in up to 64 * 1024 byte
     23 * chunks by the Windows driver. We don't know how much it is possible
     24 * to read at a time from 0x83.
     25 *
     26 * It seems possible to read (with URB transfers) everything from 0x82
     27 * in one go, without bothering to read in 32 byte chunks.
     28 *
     29 * There seems to be an optimisation of a further READ implicit if
     30 * you simply read from 0x83.
     31 *
     32 * Guessed protocol:
     33 *
     34 *	Send raw SCSI command to EP 0x1
     35 *
     36 *	If there is data to receive:
     37 *		If the command was READ datatype=image:
     38 *			Read a lot of data from EP 0x83
     39 *		Else:
     40 *			Read data from EP 0x82
     41 *	Else:
     42 *		If there is data to transmit:
     43 *			Write it to EP 0x1
     44 *
     45 *	Read status byte from EP 0x82
     46 *
     47 * References:
     48 *
     49 * The SCSI command set for the scanner is available from
     50 *	ftp://ftp.microtek.com/microtek/devpack/
     51 *
     52 * Microtek NV sent us a more up to date version of the document. If
     53 * you want it, just send mail.
     54 *
     55 * Status:
     56 *
     57 *	Untested with multiple scanners.
     58 *	Untested on SMP.
     59 *	Untested on a bigendian machine.
     60 *
     61 * History:
     62 *
     63 *	20000417 starting history
     64 *	20000417 fixed load oops
     65 *	20000417 fixed unload oops
     66 *	20000419 fixed READ IMAGE detection
     67 *	20000424 started conversion to use URBs
     68 *	20000502 handled short transfers as errors
     69 *	20000513 rename and organisation of functions (john)
     70 *	20000513 added IDs for all products supported by Windows driver (john)
     71 *	20000514 Rewrote mts_scsi_queuecommand to use URBs (john)
     72 *	20000514 Version 0.0.8j
     73 *      20000514 Fix reporting of non-existent devices to SCSI layer (john)
     74 *	20000514 Added MTS_DEBUG_INT (john)
     75 *	20000514 Changed "usb-microtek" to "microtek" for consistency (john)
     76 *	20000514 Stupid bug fixes (john)
     77 *	20000514 Version 0.0.9j
     78 *	20000515 Put transfer context and URB in mts_desc (john)
     79 *	20000515 Added prelim turn off debugging support (john)
     80 *	20000515 Version 0.0.10j
     81 *      20000515 Fixed up URB allocation (clear URB on alloc) (john)
     82 *      20000515 Version 0.0.11j
     83 *	20000516 Removed unnecessary spinlock in mts_transfer_context (john)
     84 *	20000516 Removed unnecessary up on instance lock in mts_remove_nolock (john)
     85 *	20000516 Implemented (badly) scsi_abort (john)
     86 *	20000516 Version 0.0.12j
     87 *      20000517 Hopefully removed mts_remove_nolock quasideadlock (john)
     88 *      20000517 Added mts_debug_dump to print ll USB info (john)
     89 *	20000518 Tweaks and documentation updates (john)
     90 *	20000518 Version 0.0.13j
     91 *	20000518 Cleaned up abort handling (john)
     92 *	20000523 Removed scsi_command and various scsi_..._resets (john)
     93 *	20000523 Added unlink URB on scsi_abort, now OHCI supports it (john)
     94 *	20000523 Fixed last tiresome compile warning (john)
     95 *	20000523 Version 0.0.14j (though version 0.1 has come out?)
     96 *	20000602 Added primitive reset
     97 *	20000602 Version 0.2.0
     98 *	20000603 various cosmetic changes
     99 *	20000603 Version 0.2.1
    100 *	20000620 minor cosmetic changes
    101 *	20000620 Version 0.2.2
    102 *	20000822 Hopefully fixed deadlock in mts_remove_nolock()
    103 *	20000822 Fixed minor race in mts_transfer_cleanup()
    104 *	20000822 Fixed deadlock on submission error in queuecommand
    105 *	20000822 Version 0.2.3
    106 *	20000913 Reduced module size if debugging is off
    107 *	20000913 Version 0.2.4
    108 *      20010210 New abort logic
    109 *      20010210 Version 0.3.0
    110 *	20010217 Merged scatter/gather
    111 *	20010218 Version 0.4.0
    112 *	20010218 Cosmetic fixes
    113 *	20010218 Version 0.4.1
    114 *      20010306 Abort while using scatter/gather
    115 *      20010306 Version 0.4.2
    116 *      20010311 Remove all timeouts and tidy up generally (john)
    117 *	20010320 check return value of scsi_register()
    118 *	20010320 Version 0.4.3
    119 *	20010408 Identify version on module load.
    120 *	20011003 Fix multiple requests
    121 */
    122
    123#include <linux/module.h>
    124#include <linux/kernel.h>
    125#include <linux/signal.h>
    126#include <linux/errno.h>
    127#include <linux/random.h>
    128#include <linux/poll.h>
    129#include <linux/slab.h>
    130#include <linux/spinlock.h>
    131#include <linux/usb.h>
    132#include <linux/proc_fs.h>
    133#include <linux/atomic.h>
    134#include <linux/blkdev.h>
    135
    136#include <scsi/scsi.h>
    137#include <scsi/scsi_cmnd.h>
    138#include <scsi/scsi_device.h>
    139#include <scsi/scsi_eh.h>
    140#include <scsi/scsi_host.h>
    141#include <scsi/scsi_tcq.h>
    142
    143#include "microtek.h"
    144
    145#define DRIVER_AUTHOR "John Fremlin <vii@penguinpowered.com>, Oliver Neukum <Oliver.Neukum@lrz.uni-muenchen.de>"
    146#define DRIVER_DESC "Microtek Scanmaker X6 USB scanner driver"
    147
    148/* Should we do debugging? */
    149
    150//#define MTS_DO_DEBUG
    151
    152/* USB layer driver interface */
    153
    154static int mts_usb_probe(struct usb_interface *intf,
    155			 const struct usb_device_id *id);
    156static void mts_usb_disconnect(struct usb_interface *intf);
    157
    158static const struct usb_device_id mts_usb_ids[];
    159
    160static struct usb_driver mts_usb_driver = {
    161	.name =		"microtekX6",
    162	.probe =	mts_usb_probe,
    163	.disconnect =	mts_usb_disconnect,
    164	.id_table =	mts_usb_ids,
    165};
    166
    167
    168/* Internal driver stuff */
    169
    170#define MTS_VERSION	"0.4.3"
    171#define MTS_NAME	"microtek usb (rev " MTS_VERSION "): "
    172
    173#define MTS_WARNING(x...) \
    174	printk( KERN_WARNING MTS_NAME x )
    175#define MTS_ERROR(x...) \
    176	printk( KERN_ERR MTS_NAME x )
    177#define MTS_INT_ERROR(x...) \
    178	MTS_ERROR(x)
    179#define MTS_MESSAGE(x...) \
    180	printk( KERN_INFO MTS_NAME x )
    181
    182#if defined MTS_DO_DEBUG
    183
    184#define MTS_DEBUG(x...) \
    185	printk( KERN_DEBUG MTS_NAME x )
    186
    187#define MTS_DEBUG_GOT_HERE() \
    188	MTS_DEBUG("got to %s:%d (%s)\n", __FILE__, (int)__LINE__, __func__ )
    189#define MTS_DEBUG_INT() \
    190	do { MTS_DEBUG_GOT_HERE(); \
    191	     MTS_DEBUG("transfer = 0x%x context = 0x%x\n",(int)transfer,(int)context ); \
    192	     MTS_DEBUG("status = 0x%x data-length = 0x%x sent = 0x%x\n",transfer->status,(int)context->data_length, (int)transfer->actual_length ); \
    193             mts_debug_dump(context->instance);\
    194	   } while(0)
    195#else
    196
    197#define MTS_NUL_STATEMENT do { } while(0)
    198
    199#define MTS_DEBUG(x...)	MTS_NUL_STATEMENT
    200#define MTS_DEBUG_GOT_HERE() MTS_NUL_STATEMENT
    201#define MTS_DEBUG_INT() MTS_NUL_STATEMENT
    202
    203#endif
    204
    205
    206
    207#define MTS_INT_INIT()\
    208	struct mts_transfer_context* context = (struct mts_transfer_context*)transfer->context; \
    209	MTS_DEBUG_INT();\
    210
    211#ifdef MTS_DO_DEBUG
    212
    213static inline void mts_debug_dump(struct mts_desc* desc) {
    214	MTS_DEBUG("desc at 0x%x: toggle = %02x%02x\n",
    215		  (int)desc,
    216		  (int)desc->usb_dev->toggle[1],(int)desc->usb_dev->toggle[0]
    217		);
    218	MTS_DEBUG("ep_out=%x ep_response=%x ep_image=%x\n",
    219		  usb_sndbulkpipe(desc->usb_dev,desc->ep_out),
    220		  usb_rcvbulkpipe(desc->usb_dev,desc->ep_response),
    221		  usb_rcvbulkpipe(desc->usb_dev,desc->ep_image)
    222		);
    223}
    224
    225
    226static inline void mts_show_command(struct scsi_cmnd *srb)
    227{
    228	char *what = NULL;
    229
    230	switch (srb->cmnd[0]) {
    231	case TEST_UNIT_READY: what = "TEST_UNIT_READY"; break;
    232	case REZERO_UNIT: what = "REZERO_UNIT"; break;
    233	case REQUEST_SENSE: what = "REQUEST_SENSE"; break;
    234	case FORMAT_UNIT: what = "FORMAT_UNIT"; break;
    235	case READ_BLOCK_LIMITS: what = "READ_BLOCK_LIMITS"; break;
    236	case REASSIGN_BLOCKS: what = "REASSIGN_BLOCKS"; break;
    237	case READ_6: what = "READ_6"; break;
    238	case WRITE_6: what = "WRITE_6"; break;
    239	case SEEK_6: what = "SEEK_6"; break;
    240	case READ_REVERSE: what = "READ_REVERSE"; break;
    241	case WRITE_FILEMARKS: what = "WRITE_FILEMARKS"; break;
    242	case SPACE: what = "SPACE"; break;
    243	case INQUIRY: what = "INQUIRY"; break;
    244	case RECOVER_BUFFERED_DATA: what = "RECOVER_BUFFERED_DATA"; break;
    245	case MODE_SELECT: what = "MODE_SELECT"; break;
    246	case RESERVE: what = "RESERVE"; break;
    247	case RELEASE: what = "RELEASE"; break;
    248	case COPY: what = "COPY"; break;
    249	case ERASE: what = "ERASE"; break;
    250	case MODE_SENSE: what = "MODE_SENSE"; break;
    251	case START_STOP: what = "START_STOP"; break;
    252	case RECEIVE_DIAGNOSTIC: what = "RECEIVE_DIAGNOSTIC"; break;
    253	case SEND_DIAGNOSTIC: what = "SEND_DIAGNOSTIC"; break;
    254	case ALLOW_MEDIUM_REMOVAL: what = "ALLOW_MEDIUM_REMOVAL"; break;
    255	case SET_WINDOW: what = "SET_WINDOW"; break;
    256	case READ_CAPACITY: what = "READ_CAPACITY"; break;
    257	case READ_10: what = "READ_10"; break;
    258	case WRITE_10: what = "WRITE_10"; break;
    259	case SEEK_10: what = "SEEK_10"; break;
    260	case WRITE_VERIFY: what = "WRITE_VERIFY"; break;
    261	case VERIFY: what = "VERIFY"; break;
    262	case SEARCH_HIGH: what = "SEARCH_HIGH"; break;
    263	case SEARCH_EQUAL: what = "SEARCH_EQUAL"; break;
    264	case SEARCH_LOW: what = "SEARCH_LOW"; break;
    265	case SET_LIMITS: what = "SET_LIMITS"; break;
    266	case READ_POSITION: what = "READ_POSITION"; break;
    267	case SYNCHRONIZE_CACHE: what = "SYNCHRONIZE_CACHE"; break;
    268	case LOCK_UNLOCK_CACHE: what = "LOCK_UNLOCK_CACHE"; break;
    269	case READ_DEFECT_DATA: what = "READ_DEFECT_DATA"; break;
    270	case MEDIUM_SCAN: what = "MEDIUM_SCAN"; break;
    271	case COMPARE: what = "COMPARE"; break;
    272	case COPY_VERIFY: what = "COPY_VERIFY"; break;
    273	case WRITE_BUFFER: what = "WRITE_BUFFER"; break;
    274	case READ_BUFFER: what = "READ_BUFFER"; break;
    275	case UPDATE_BLOCK: what = "UPDATE_BLOCK"; break;
    276	case READ_LONG: what = "READ_LONG"; break;
    277	case WRITE_LONG: what = "WRITE_LONG"; break;
    278	case CHANGE_DEFINITION: what = "CHANGE_DEFINITION"; break;
    279	case WRITE_SAME: what = "WRITE_SAME"; break;
    280	case READ_TOC: what = "READ_TOC"; break;
    281	case LOG_SELECT: what = "LOG_SELECT"; break;
    282	case LOG_SENSE: what = "LOG_SENSE"; break;
    283	case MODE_SELECT_10: what = "MODE_SELECT_10"; break;
    284	case MODE_SENSE_10: what = "MODE_SENSE_10"; break;
    285	case MOVE_MEDIUM: what = "MOVE_MEDIUM"; break;
    286	case READ_12: what = "READ_12"; break;
    287	case WRITE_12: what = "WRITE_12"; break;
    288	case WRITE_VERIFY_12: what = "WRITE_VERIFY_12"; break;
    289	case SEARCH_HIGH_12: what = "SEARCH_HIGH_12"; break;
    290	case SEARCH_EQUAL_12: what = "SEARCH_EQUAL_12"; break;
    291	case SEARCH_LOW_12: what = "SEARCH_LOW_12"; break;
    292	case READ_ELEMENT_STATUS: what = "READ_ELEMENT_STATUS"; break;
    293	case SEND_VOLUME_TAG: what = "SEND_VOLUME_TAG"; break;
    294	case WRITE_LONG_2: what = "WRITE_LONG_2"; break;
    295	default:
    296		MTS_DEBUG("can't decode command\n");
    297		goto out;
    298		break;
    299	}
    300	MTS_DEBUG( "Command %s (%d bytes)\n", what, srb->cmd_len);
    301
    302 out:
    303	MTS_DEBUG( "  %10ph\n", srb->cmnd);
    304}
    305
    306#else
    307
    308static inline void mts_show_command(struct scsi_cmnd * dummy)
    309{
    310}
    311
    312static inline void mts_debug_dump(struct mts_desc* dummy)
    313{
    314}
    315
    316#endif
    317
    318static inline void mts_urb_abort(struct mts_desc* desc) {
    319	MTS_DEBUG_GOT_HERE();
    320	mts_debug_dump(desc);
    321
    322	usb_kill_urb( desc->urb );
    323}
    324
    325static int mts_slave_alloc (struct scsi_device *s)
    326{
    327	s->inquiry_len = 0x24;
    328	return 0;
    329}
    330
    331static int mts_slave_configure (struct scsi_device *s)
    332{
    333	blk_queue_dma_alignment(s->request_queue, (512 - 1));
    334	return 0;
    335}
    336
    337static int mts_scsi_abort(struct scsi_cmnd *srb)
    338{
    339	struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]);
    340
    341	MTS_DEBUG_GOT_HERE();
    342
    343	mts_urb_abort(desc);
    344
    345	return FAILED;
    346}
    347
    348static int mts_scsi_host_reset(struct scsi_cmnd *srb)
    349{
    350	struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]);
    351	int result;
    352
    353	MTS_DEBUG_GOT_HERE();
    354	mts_debug_dump(desc);
    355
    356	result = usb_lock_device_for_reset(desc->usb_dev, desc->usb_intf);
    357	if (result == 0) {
    358		result = usb_reset_device(desc->usb_dev);
    359		usb_unlock_device(desc->usb_dev);
    360	}
    361	return result ? FAILED : SUCCESS;
    362}
    363
    364static int
    365mts_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *srb);
    366
    367static void mts_transfer_cleanup( struct urb *transfer );
    368static void mts_do_sg(struct urb * transfer);
    369
    370static inline
    371void mts_int_submit_urb (struct urb* transfer,
    372			int pipe,
    373			void* data,
    374			unsigned length,
    375			usb_complete_t callback )
    376/* Interrupt context! */
    377
    378/* Holding transfer->context->lock! */
    379{
    380	int res;
    381
    382	MTS_INT_INIT();
    383
    384	usb_fill_bulk_urb(transfer,
    385		      context->instance->usb_dev,
    386		      pipe,
    387		      data,
    388		      length,
    389		      callback,
    390		      context
    391		);
    392
    393	res = usb_submit_urb( transfer, GFP_ATOMIC );
    394	if ( unlikely(res) ) {
    395		MTS_INT_ERROR( "could not submit URB! Error was %d\n",(int)res );
    396		set_host_byte(context->srb, DID_ERROR);
    397		mts_transfer_cleanup(transfer);
    398	}
    399}
    400
    401
    402static void mts_transfer_cleanup( struct urb *transfer )
    403/* Interrupt context! */
    404{
    405	MTS_INT_INIT();
    406
    407	if ( likely(context->final_callback != NULL) )
    408		context->final_callback(context->srb);
    409}
    410
    411static void mts_transfer_done( struct urb *transfer )
    412{
    413	MTS_INT_INIT();
    414
    415	context->srb->result &= MTS_SCSI_ERR_MASK;
    416	context->srb->result |= (unsigned)(*context->scsi_status)<<1;
    417
    418	mts_transfer_cleanup(transfer);
    419}
    420
    421
    422static void mts_get_status( struct urb *transfer )
    423/* Interrupt context! */
    424{
    425	MTS_INT_INIT();
    426
    427	mts_int_submit_urb(transfer,
    428			   usb_rcvbulkpipe(context->instance->usb_dev,
    429					   context->instance->ep_response),
    430			   context->scsi_status,
    431			   1,
    432			   mts_transfer_done );
    433}
    434
    435static void mts_data_done( struct urb* transfer )
    436/* Interrupt context! */
    437{
    438	int status = transfer->status;
    439	MTS_INT_INIT();
    440
    441	if ( context->data_length != transfer->actual_length ) {
    442		scsi_set_resid(context->srb, context->data_length -
    443			       transfer->actual_length);
    444	} else if ( unlikely(status) ) {
    445		set_host_byte(context->srb, (status == -ENOENT ? DID_ABORT : DID_ERROR));
    446	}
    447
    448	mts_get_status(transfer);
    449}
    450
    451
    452static void mts_command_done( struct urb *transfer )
    453/* Interrupt context! */
    454{
    455	int status = transfer->status;
    456	MTS_INT_INIT();
    457
    458	if ( unlikely(status) ) {
    459	        if (status == -ENOENT) {
    460		        /* We are being killed */
    461			MTS_DEBUG_GOT_HERE();
    462			set_host_byte(context->srb, DID_ABORT);
    463                } else {
    464		        /* A genuine error has occurred */
    465			MTS_DEBUG_GOT_HERE();
    466
    467		        set_host_byte(context->srb, DID_ERROR);
    468                }
    469		mts_transfer_cleanup(transfer);
    470
    471		return;
    472	}
    473
    474	if (context->srb->cmnd[0] == REQUEST_SENSE) {
    475		mts_int_submit_urb(transfer,
    476				   context->data_pipe,
    477				   context->srb->sense_buffer,
    478				   context->data_length,
    479				   mts_data_done);
    480	} else { if ( context->data ) {
    481			mts_int_submit_urb(transfer,
    482					   context->data_pipe,
    483					   context->data,
    484					   context->data_length,
    485					   scsi_sg_count(context->srb) > 1 ?
    486					           mts_do_sg : mts_data_done);
    487		} else {
    488			mts_get_status(transfer);
    489		}
    490	}
    491}
    492
    493static void mts_do_sg (struct urb* transfer)
    494{
    495	int status = transfer->status;
    496	MTS_INT_INIT();
    497
    498	MTS_DEBUG("Processing fragment %d of %d\n", context->fragment,
    499	                                          scsi_sg_count(context->srb));
    500
    501	if (unlikely(status)) {
    502                set_host_byte(context->srb, (status == -ENOENT ? DID_ABORT : DID_ERROR));
    503		mts_transfer_cleanup(transfer);
    504        }
    505
    506	context->curr_sg = sg_next(context->curr_sg);
    507	mts_int_submit_urb(transfer,
    508			   context->data_pipe,
    509			   sg_virt(context->curr_sg),
    510			   context->curr_sg->length,
    511			   sg_is_last(context->curr_sg) ?
    512			   mts_data_done : mts_do_sg);
    513}
    514
    515static const u8 mts_read_image_sig[] = { 0x28, 00, 00, 00 };
    516static const u8 mts_read_image_sig_len = 4;
    517static const unsigned char mts_direction[256/8] = {
    518	0x28, 0x81, 0x14, 0x14, 0x20, 0x01, 0x90, 0x77,
    519	0x0C, 0x20, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
    520	0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01,
    521	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    522};
    523
    524
    525#define MTS_DIRECTION_IS_IN(x) ((mts_direction[x>>3] >> (x & 7)) & 1)
    526
    527static void
    528mts_build_transfer_context(struct scsi_cmnd *srb, struct mts_desc* desc)
    529{
    530	int pipe;
    531
    532	MTS_DEBUG_GOT_HERE();
    533
    534	desc->context.instance = desc;
    535	desc->context.srb = srb;
    536
    537	if (!scsi_bufflen(srb)) {
    538		desc->context.data = NULL;
    539		desc->context.data_length = 0;
    540		return;
    541	} else {
    542		desc->context.curr_sg = scsi_sglist(srb);
    543		desc->context.data = sg_virt(desc->context.curr_sg);
    544		desc->context.data_length = desc->context.curr_sg->length;
    545	}
    546
    547
    548	/* can't rely on srb->sc_data_direction */
    549
    550	/* Brutally ripped from usb-storage */
    551
    552	if ( !memcmp( srb->cmnd, mts_read_image_sig, mts_read_image_sig_len )
    553) { 		pipe = usb_rcvbulkpipe(desc->usb_dev,desc->ep_image);
    554		MTS_DEBUG( "transferring from desc->ep_image == %d\n",
    555			   (int)desc->ep_image );
    556	} else if ( MTS_DIRECTION_IS_IN(srb->cmnd[0]) ) {
    557			pipe = usb_rcvbulkpipe(desc->usb_dev,desc->ep_response);
    558			MTS_DEBUG( "transferring from desc->ep_response == %d\n",
    559				   (int)desc->ep_response);
    560	} else {
    561		MTS_DEBUG("transferring to desc->ep_out == %d\n",
    562			  (int)desc->ep_out);
    563		pipe = usb_sndbulkpipe(desc->usb_dev,desc->ep_out);
    564	}
    565	desc->context.data_pipe = pipe;
    566}
    567
    568static int mts_scsi_queuecommand_lck(struct scsi_cmnd *srb)
    569{
    570	mts_scsi_cmnd_callback callback = scsi_done;
    571	struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]);
    572	int res;
    573
    574	MTS_DEBUG_GOT_HERE();
    575	mts_show_command(srb);
    576	mts_debug_dump(desc);
    577
    578	if ( srb->device->lun || srb->device->id || srb->device->channel ) {
    579
    580		MTS_DEBUG("Command to LUN=%d ID=%d CHANNEL=%d from SCSI layer\n",(int)srb->device->lun,(int)srb->device->id, (int)srb->device->channel );
    581
    582		MTS_DEBUG("this device doesn't exist\n");
    583
    584		set_host_byte(srb, DID_BAD_TARGET);
    585
    586		if(likely(callback != NULL))
    587			callback(srb);
    588
    589		goto out;
    590	}
    591
    592	
    593	usb_fill_bulk_urb(desc->urb,
    594		      desc->usb_dev,
    595		      usb_sndbulkpipe(desc->usb_dev,desc->ep_out),
    596		      srb->cmnd,
    597		      srb->cmd_len,
    598		      mts_command_done,
    599		      &desc->context
    600		      );
    601
    602
    603	mts_build_transfer_context( srb, desc );
    604	desc->context.final_callback = callback;
    605	
    606	/* here we need ATOMIC as we are called with the iolock */
    607	res=usb_submit_urb(desc->urb, GFP_ATOMIC);
    608
    609	if(unlikely(res)){
    610		MTS_ERROR("error %d submitting URB\n",(int)res);
    611		set_host_byte(srb, DID_ERROR);
    612
    613		if(likely(callback != NULL))
    614			callback(srb);
    615
    616	}
    617out:
    618	return 0;
    619}
    620
    621static DEF_SCSI_QCMD(mts_scsi_queuecommand)
    622
    623static struct scsi_host_template mts_scsi_host_template = {
    624	.module			= THIS_MODULE,
    625	.name			= "microtekX6",
    626	.proc_name		= "microtekX6",
    627	.queuecommand		= mts_scsi_queuecommand,
    628	.eh_abort_handler	= mts_scsi_abort,
    629	.eh_host_reset_handler	= mts_scsi_host_reset,
    630	.sg_tablesize =		SG_ALL,
    631	.can_queue =		1,
    632	.this_id =		-1,
    633	.emulated =		1,
    634	.slave_alloc =		mts_slave_alloc,
    635	.slave_configure =	mts_slave_configure,
    636	.max_sectors=		256, /* 128 K */
    637};
    638
    639/* The entries of microtek_table must correspond, line-by-line to
    640   the entries of mts_supported_products[]. */
    641
    642static const struct usb_device_id mts_usb_ids[] =
    643{
    644	{ USB_DEVICE(0x4ce, 0x0300) },
    645	{ USB_DEVICE(0x5da, 0x0094) },
    646	{ USB_DEVICE(0x5da, 0x0099) },
    647	{ USB_DEVICE(0x5da, 0x009a) },
    648	{ USB_DEVICE(0x5da, 0x00a0) },
    649	{ USB_DEVICE(0x5da, 0x00a3) },
    650	{ USB_DEVICE(0x5da, 0x80a3) },
    651	{ USB_DEVICE(0x5da, 0x80ac) },
    652	{ USB_DEVICE(0x5da, 0x00b6) },
    653	{ }						/* Terminating entry */
    654};
    655
    656MODULE_DEVICE_TABLE (usb, mts_usb_ids);
    657
    658
    659static int mts_usb_probe(struct usb_interface *intf,
    660			 const struct usb_device_id *id)
    661{
    662	int i;
    663	int ep_out = -1;
    664	int ep_in_set[3]; /* this will break if we have more than three endpoints
    665			   which is why we check */
    666	int *ep_in_current = ep_in_set;
    667	int err_retval = -ENOMEM;
    668
    669	struct mts_desc * new_desc;
    670	struct usb_device *dev = interface_to_usbdev (intf);
    671
    672	/* the current altsetting on the interface we're probing */
    673	struct usb_host_interface *altsetting;
    674
    675	MTS_DEBUG_GOT_HERE();
    676	MTS_DEBUG( "usb-device descriptor at %x\n", (int)dev );
    677
    678	MTS_DEBUG( "product id = 0x%x, vendor id = 0x%x\n",
    679		   le16_to_cpu(dev->descriptor.idProduct),
    680		   le16_to_cpu(dev->descriptor.idVendor) );
    681
    682	MTS_DEBUG_GOT_HERE();
    683
    684	/* the current altsetting on the interface we're probing */
    685	altsetting = intf->cur_altsetting;
    686
    687
    688	/* Check if the config is sane */
    689
    690	if ( altsetting->desc.bNumEndpoints != MTS_EP_TOTAL ) {
    691		MTS_WARNING( "expecting %d got %d endpoints! Bailing out.\n",
    692			     (int)MTS_EP_TOTAL, (int)altsetting->desc.bNumEndpoints );
    693		return -ENODEV;
    694	}
    695
    696	for( i = 0; i < altsetting->desc.bNumEndpoints; i++ ) {
    697		if ((altsetting->endpoint[i].desc.bmAttributes &
    698		     USB_ENDPOINT_XFERTYPE_MASK) != USB_ENDPOINT_XFER_BULK) {
    699
    700			MTS_WARNING( "can only deal with bulk endpoints; endpoint %d is not bulk.\n",
    701			     (int)altsetting->endpoint[i].desc.bEndpointAddress );
    702		} else {
    703			if (altsetting->endpoint[i].desc.bEndpointAddress &
    704			    USB_DIR_IN)
    705				*ep_in_current++
    706					= altsetting->endpoint[i].desc.bEndpointAddress &
    707					USB_ENDPOINT_NUMBER_MASK;
    708			else {
    709				if ( ep_out != -1 ) {
    710					MTS_WARNING( "can only deal with one output endpoints. Bailing out." );
    711					return -ENODEV;
    712				}
    713
    714				ep_out = altsetting->endpoint[i].desc.bEndpointAddress &
    715					USB_ENDPOINT_NUMBER_MASK;
    716			}
    717		}
    718
    719	}
    720
    721	if (ep_in_current != &ep_in_set[2]) {
    722		MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n");
    723		return -ENODEV;
    724	}
    725
    726	if ( ep_out == -1 ) {
    727		MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" );
    728		return -ENODEV;
    729	}
    730
    731
    732	new_desc = kzalloc(sizeof(struct mts_desc), GFP_KERNEL);
    733	if (!new_desc)
    734		goto out;
    735
    736	new_desc->urb = usb_alloc_urb(0, GFP_KERNEL);
    737	if (!new_desc->urb)
    738		goto out_kfree;
    739
    740	new_desc->context.scsi_status = kmalloc(1, GFP_KERNEL);
    741	if (!new_desc->context.scsi_status)
    742		goto out_free_urb;
    743
    744	new_desc->usb_dev = dev;
    745	new_desc->usb_intf = intf;
    746
    747	/* endpoints */
    748	new_desc->ep_out = ep_out;
    749	new_desc->ep_response = ep_in_set[0];
    750	new_desc->ep_image = ep_in_set[1];
    751
    752	if ( new_desc->ep_out != MTS_EP_OUT )
    753		MTS_WARNING( "will this work? Command EP is not usually %d\n",
    754			     (int)new_desc->ep_out );
    755
    756	if ( new_desc->ep_response != MTS_EP_RESPONSE )
    757		MTS_WARNING( "will this work? Response EP is not usually %d\n",
    758			     (int)new_desc->ep_response );
    759
    760	if ( new_desc->ep_image != MTS_EP_IMAGE )
    761		MTS_WARNING( "will this work? Image data EP is not usually %d\n",
    762			     (int)new_desc->ep_image );
    763
    764	new_desc->host = scsi_host_alloc(&mts_scsi_host_template,
    765			sizeof(new_desc));
    766	if (!new_desc->host)
    767		goto out_kfree2;
    768
    769	new_desc->host->hostdata[0] = (unsigned long)new_desc;
    770	if (scsi_add_host(new_desc->host, &dev->dev)) {
    771		err_retval = -EIO;
    772		goto out_host_put;
    773	}
    774	scsi_scan_host(new_desc->host);
    775
    776	usb_set_intfdata(intf, new_desc);
    777	return 0;
    778
    779 out_host_put:
    780	scsi_host_put(new_desc->host);
    781 out_kfree2:
    782	kfree(new_desc->context.scsi_status);
    783 out_free_urb:
    784	usb_free_urb(new_desc->urb);
    785 out_kfree:
    786	kfree(new_desc);
    787 out:
    788	return err_retval;
    789}
    790
    791static void mts_usb_disconnect (struct usb_interface *intf)
    792{
    793	struct mts_desc *desc = usb_get_intfdata(intf);
    794
    795	usb_set_intfdata(intf, NULL);
    796
    797	usb_kill_urb(desc->urb);
    798	scsi_remove_host(desc->host);
    799
    800	scsi_host_put(desc->host);
    801	usb_free_urb(desc->urb);
    802	kfree(desc->context.scsi_status);
    803	kfree(desc);
    804}
    805
    806module_usb_driver(mts_usb_driver);
    807
    808MODULE_AUTHOR( DRIVER_AUTHOR );
    809MODULE_DESCRIPTION( DRIVER_DESC );
    810MODULE_LICENSE("GPL");