Loading...
1/*
2 * f_mass_storage.c -- Mass Storage USB Composite Function
3 *
4 * Copyright (C) 2003-2008 Alan Stern
5 * Copyright (C) 2009 Samsung Electronics
6 * Author: Michal Nazarewicz <mina86@mina86.com>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions, and the following disclaimer,
14 * without modification.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. The names of the above-listed copyright holders may not be used
19 * to endorse or promote products derived from this software without
20 * specific prior written permission.
21 *
22 * ALTERNATIVELY, this software may be distributed under the terms of the
23 * GNU General Public License ("GPL") as published by the Free Software
24 * Foundation, either version 2 of that License or (at your option) any
25 * later version.
26 *
27 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
28 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
29 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
31 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
32 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
33 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
34 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
35 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
36 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
37 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 */
39
40/*
41 * The Mass Storage Function acts as a USB Mass Storage device,
42 * appearing to the host as a disk drive or as a CD-ROM drive. In
43 * addition to providing an example of a genuinely useful composite
44 * function for a USB device, it also illustrates a technique of
45 * double-buffering for increased throughput.
46 *
47 * For more information about MSF and in particular its module
48 * parameters and sysfs interface read the
49 * <Documentation/usb/mass-storage.txt> file.
50 */
51
52/*
53 * MSF is configured by specifying a fsg_config structure. It has the
54 * following fields:
55 *
56 * nluns Number of LUNs function have (anywhere from 1
57 * to FSG_MAX_LUNS).
58 * luns An array of LUN configuration values. This
59 * should be filled for each LUN that
60 * function will include (ie. for "nluns"
61 * LUNs). Each element of the array has
62 * the following fields:
63 * ->filename The path to the backing file for the LUN.
64 * Required if LUN is not marked as
65 * removable.
66 * ->ro Flag specifying access to the LUN shall be
67 * read-only. This is implied if CD-ROM
68 * emulation is enabled as well as when
69 * it was impossible to open "filename"
70 * in R/W mode.
71 * ->removable Flag specifying that LUN shall be indicated as
72 * being removable.
73 * ->cdrom Flag specifying that LUN shall be reported as
74 * being a CD-ROM.
75 * ->nofua Flag specifying that FUA flag in SCSI WRITE(10,12)
76 * commands for this LUN shall be ignored.
77 *
78 * vendor_name
79 * product_name
80 * release Information used as a reply to INQUIRY
81 * request. To use default set to NULL,
82 * NULL, 0xffff respectively. The first
83 * field should be 8 and the second 16
84 * characters or less.
85 *
86 * can_stall Set to permit function to halt bulk endpoints.
87 * Disabled on some USB devices known not
88 * to work correctly. You should set it
89 * to true.
90 *
91 * If "removable" is not set for a LUN then a backing file must be
92 * specified. If it is set, then NULL filename means the LUN's medium
93 * is not loaded (an empty string as "filename" in the fsg_config
94 * structure causes error). The CD-ROM emulation includes a single
95 * data track and no audio tracks; hence there need be only one
96 * backing file per LUN.
97 *
98 * This function is heavily based on "File-backed Storage Gadget" by
99 * Alan Stern which in turn is heavily based on "Gadget Zero" by David
100 * Brownell. The driver's SCSI command interface was based on the
101 * "Information technology - Small Computer System Interface - 2"
102 * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
103 * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
104 * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
105 * was based on the "Universal Serial Bus Mass Storage Class UFI
106 * Command Specification" document, Revision 1.0, December 14, 1998,
107 * available at
108 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
109 */
110
111/*
112 * Driver Design
113 *
114 * The MSF is fairly straightforward. There is a main kernel
115 * thread that handles most of the work. Interrupt routines field
116 * callbacks from the controller driver: bulk- and interrupt-request
117 * completion notifications, endpoint-0 events, and disconnect events.
118 * Completion events are passed to the main thread by wakeup calls. Many
119 * ep0 requests are handled at interrupt time, but SetInterface,
120 * SetConfiguration, and device reset requests are forwarded to the
121 * thread in the form of "exceptions" using SIGUSR1 signals (since they
122 * should interrupt any ongoing file I/O operations).
123 *
124 * The thread's main routine implements the standard command/data/status
125 * parts of a SCSI interaction. It and its subroutines are full of tests
126 * for pending signals/exceptions -- all this polling is necessary since
127 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
128 * indication that the driver really wants to be running in userspace.)
129 * An important point is that so long as the thread is alive it keeps an
130 * open reference to the backing file. This will prevent unmounting
131 * the backing file's underlying filesystem and could cause problems
132 * during system shutdown, for example. To prevent such problems, the
133 * thread catches INT, TERM, and KILL signals and converts them into
134 * an EXIT exception.
135 *
136 * In normal operation the main thread is started during the gadget's
137 * fsg_bind() callback and stopped during fsg_unbind(). But it can
138 * also exit when it receives a signal, and there's no point leaving
139 * the gadget running when the thread is dead. As of this moment, MSF
140 * provides no way to deregister the gadget when thread dies -- maybe
141 * a callback functions is needed.
142 *
143 * To provide maximum throughput, the driver uses a circular pipeline of
144 * buffer heads (struct fsg_buffhd). In principle the pipeline can be
145 * arbitrarily long; in practice the benefits don't justify having more
146 * than 2 stages (i.e., double buffering). But it helps to think of the
147 * pipeline as being a long one. Each buffer head contains a bulk-in and
148 * a bulk-out request pointer (since the buffer can be used for both
149 * output and input -- directions always are given from the host's
150 * point of view) as well as a pointer to the buffer and various state
151 * variables.
152 *
153 * Use of the pipeline follows a simple protocol. There is a variable
154 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
155 * At any time that buffer head may still be in use from an earlier
156 * request, so each buffer head has a state variable indicating whether
157 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
158 * buffer head to be EMPTY, filling the buffer either by file I/O or by
159 * USB I/O (during which the buffer head is BUSY), and marking the buffer
160 * head FULL when the I/O is complete. Then the buffer will be emptied
161 * (again possibly by USB I/O, during which it is marked BUSY) and
162 * finally marked EMPTY again (possibly by a completion routine).
163 *
164 * A module parameter tells the driver to avoid stalling the bulk
165 * endpoints wherever the transport specification allows. This is
166 * necessary for some UDCs like the SuperH, which cannot reliably clear a
167 * halt on a bulk endpoint. However, under certain circumstances the
168 * Bulk-only specification requires a stall. In such cases the driver
169 * will halt the endpoint and set a flag indicating that it should clear
170 * the halt in software during the next device reset. Hopefully this
171 * will permit everything to work correctly. Furthermore, although the
172 * specification allows the bulk-out endpoint to halt when the host sends
173 * too much data, implementing this would cause an unavoidable race.
174 * The driver will always use the "no-stall" approach for OUT transfers.
175 *
176 * One subtle point concerns sending status-stage responses for ep0
177 * requests. Some of these requests, such as device reset, can involve
178 * interrupting an ongoing file I/O operation, which might take an
179 * arbitrarily long time. During that delay the host might give up on
180 * the original ep0 request and issue a new one. When that happens the
181 * driver should not notify the host about completion of the original
182 * request, as the host will no longer be waiting for it. So the driver
183 * assigns to each ep0 request a unique tag, and it keeps track of the
184 * tag value of the request associated with a long-running exception
185 * (device-reset, interface-change, or configuration-change). When the
186 * exception handler is finished, the status-stage response is submitted
187 * only if the current ep0 request tag is equal to the exception request
188 * tag. Thus only the most recently received ep0 request will get a
189 * status-stage response.
190 *
191 * Warning: This driver source file is too long. It ought to be split up
192 * into a header file plus about 3 separate .c files, to handle the details
193 * of the Gadget, USB Mass Storage, and SCSI protocols.
194 */
195
196
197/* #define VERBOSE_DEBUG */
198/* #define DUMP_MSGS */
199
200#include <linux/blkdev.h>
201#include <linux/completion.h>
202#include <linux/dcache.h>
203#include <linux/delay.h>
204#include <linux/device.h>
205#include <linux/fcntl.h>
206#include <linux/file.h>
207#include <linux/fs.h>
208#include <linux/kref.h>
209#include <linux/kthread.h>
210#include <linux/limits.h>
211#include <linux/rwsem.h>
212#include <linux/slab.h>
213#include <linux/spinlock.h>
214#include <linux/string.h>
215#include <linux/freezer.h>
216#include <linux/module.h>
217#include <linux/uaccess.h>
218
219#include <linux/usb/ch9.h>
220#include <linux/usb/gadget.h>
221#include <linux/usb/composite.h>
222
223#include "configfs.h"
224
225
226/*------------------------------------------------------------------------*/
227
228#define FSG_DRIVER_DESC "Mass Storage Function"
229#define FSG_DRIVER_VERSION "2009/09/11"
230
231static const char fsg_string_interface[] = "Mass Storage";
232
233#include "storage_common.h"
234#include "f_mass_storage.h"
235
236/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
237static struct usb_string fsg_strings[] = {
238 {FSG_STRING_INTERFACE, fsg_string_interface},
239 {}
240};
241
242static struct usb_gadget_strings fsg_stringtab = {
243 .language = 0x0409, /* en-us */
244 .strings = fsg_strings,
245};
246
247static struct usb_gadget_strings *fsg_strings_array[] = {
248 &fsg_stringtab,
249 NULL,
250};
251
252/*-------------------------------------------------------------------------*/
253
254struct fsg_dev;
255struct fsg_common;
256
257/* Data shared by all the FSG instances. */
258struct fsg_common {
259 struct usb_gadget *gadget;
260 struct usb_composite_dev *cdev;
261 struct fsg_dev *fsg, *new_fsg;
262 wait_queue_head_t fsg_wait;
263
264 /* filesem protects: backing files in use */
265 struct rw_semaphore filesem;
266
267 /* lock protects: state, all the req_busy's */
268 spinlock_t lock;
269
270 struct usb_ep *ep0; /* Copy of gadget->ep0 */
271 struct usb_request *ep0req; /* Copy of cdev->req */
272 unsigned int ep0_req_tag;
273
274 struct fsg_buffhd *next_buffhd_to_fill;
275 struct fsg_buffhd *next_buffhd_to_drain;
276 struct fsg_buffhd *buffhds;
277 unsigned int fsg_num_buffers;
278
279 int cmnd_size;
280 u8 cmnd[MAX_COMMAND_SIZE];
281
282 unsigned int lun;
283 struct fsg_lun *luns[FSG_MAX_LUNS];
284 struct fsg_lun *curlun;
285
286 unsigned int bulk_out_maxpacket;
287 enum fsg_state state; /* For exception handling */
288 unsigned int exception_req_tag;
289
290 enum data_direction data_dir;
291 u32 data_size;
292 u32 data_size_from_cmnd;
293 u32 tag;
294 u32 residue;
295 u32 usb_amount_left;
296
297 unsigned int can_stall:1;
298 unsigned int free_storage_on_release:1;
299 unsigned int phase_error:1;
300 unsigned int short_packet_received:1;
301 unsigned int bad_lun_okay:1;
302 unsigned int running:1;
303 unsigned int sysfs:1;
304
305 int thread_wakeup_needed;
306 struct completion thread_notifier;
307 struct task_struct *thread_task;
308
309 /* Callback functions. */
310 const struct fsg_operations *ops;
311 /* Gadget's private data. */
312 void *private_data;
313
314 /*
315 * Vendor (8 chars), product (16 chars), release (4
316 * hexadecimal digits) and NUL byte
317 */
318 char inquiry_string[8 + 16 + 4 + 1];
319
320 struct kref ref;
321};
322
323struct fsg_dev {
324 struct usb_function function;
325 struct usb_gadget *gadget; /* Copy of cdev->gadget */
326 struct fsg_common *common;
327
328 u16 interface_number;
329
330 unsigned int bulk_in_enabled:1;
331 unsigned int bulk_out_enabled:1;
332
333 unsigned long atomic_bitflags;
334#define IGNORE_BULK_OUT 0
335
336 struct usb_ep *bulk_in;
337 struct usb_ep *bulk_out;
338};
339
340static inline int __fsg_is_set(struct fsg_common *common,
341 const char *func, unsigned line)
342{
343 if (common->fsg)
344 return 1;
345 ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
346 WARN_ON(1);
347 return 0;
348}
349
350#define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
351
352static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
353{
354 return container_of(f, struct fsg_dev, function);
355}
356
357typedef void (*fsg_routine_t)(struct fsg_dev *);
358
359static int exception_in_progress(struct fsg_common *common)
360{
361 return common->state > FSG_STATE_IDLE;
362}
363
364/* Make bulk-out requests be divisible by the maxpacket size */
365static void set_bulk_out_req_length(struct fsg_common *common,
366 struct fsg_buffhd *bh, unsigned int length)
367{
368 unsigned int rem;
369
370 bh->bulk_out_intended_length = length;
371 rem = length % common->bulk_out_maxpacket;
372 if (rem > 0)
373 length += common->bulk_out_maxpacket - rem;
374 bh->outreq->length = length;
375}
376
377
378/*-------------------------------------------------------------------------*/
379
380static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
381{
382 const char *name;
383
384 if (ep == fsg->bulk_in)
385 name = "bulk-in";
386 else if (ep == fsg->bulk_out)
387 name = "bulk-out";
388 else
389 name = ep->name;
390 DBG(fsg, "%s set halt\n", name);
391 return usb_ep_set_halt(ep);
392}
393
394
395/*-------------------------------------------------------------------------*/
396
397/* These routines may be called in process context or in_irq */
398
399/* Caller must hold fsg->lock */
400static void wakeup_thread(struct fsg_common *common)
401{
402 smp_wmb(); /* ensure the write of bh->state is complete */
403 /* Tell the main thread that something has happened */
404 common->thread_wakeup_needed = 1;
405 if (common->thread_task)
406 wake_up_process(common->thread_task);
407}
408
409static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
410{
411 unsigned long flags;
412
413 /*
414 * Do nothing if a higher-priority exception is already in progress.
415 * If a lower-or-equal priority exception is in progress, preempt it
416 * and notify the main thread by sending it a signal.
417 */
418 spin_lock_irqsave(&common->lock, flags);
419 if (common->state <= new_state) {
420 common->exception_req_tag = common->ep0_req_tag;
421 common->state = new_state;
422 if (common->thread_task)
423 send_sig_info(SIGUSR1, SEND_SIG_FORCED,
424 common->thread_task);
425 }
426 spin_unlock_irqrestore(&common->lock, flags);
427}
428
429
430/*-------------------------------------------------------------------------*/
431
432static int ep0_queue(struct fsg_common *common)
433{
434 int rc;
435
436 rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC);
437 common->ep0->driver_data = common;
438 if (rc != 0 && rc != -ESHUTDOWN) {
439 /* We can't do much more than wait for a reset */
440 WARNING(common, "error in submission: %s --> %d\n",
441 common->ep0->name, rc);
442 }
443 return rc;
444}
445
446
447/*-------------------------------------------------------------------------*/
448
449/* Completion handlers. These always run in_irq. */
450
451static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
452{
453 struct fsg_common *common = ep->driver_data;
454 struct fsg_buffhd *bh = req->context;
455
456 if (req->status || req->actual != req->length)
457 DBG(common, "%s --> %d, %u/%u\n", __func__,
458 req->status, req->actual, req->length);
459 if (req->status == -ECONNRESET) /* Request was cancelled */
460 usb_ep_fifo_flush(ep);
461
462 /* Hold the lock while we update the request and buffer states */
463 smp_wmb();
464 spin_lock(&common->lock);
465 bh->inreq_busy = 0;
466 bh->state = BUF_STATE_EMPTY;
467 wakeup_thread(common);
468 spin_unlock(&common->lock);
469}
470
471static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
472{
473 struct fsg_common *common = ep->driver_data;
474 struct fsg_buffhd *bh = req->context;
475
476 dump_msg(common, "bulk-out", req->buf, req->actual);
477 if (req->status || req->actual != bh->bulk_out_intended_length)
478 DBG(common, "%s --> %d, %u/%u\n", __func__,
479 req->status, req->actual, bh->bulk_out_intended_length);
480 if (req->status == -ECONNRESET) /* Request was cancelled */
481 usb_ep_fifo_flush(ep);
482
483 /* Hold the lock while we update the request and buffer states */
484 smp_wmb();
485 spin_lock(&common->lock);
486 bh->outreq_busy = 0;
487 bh->state = BUF_STATE_FULL;
488 wakeup_thread(common);
489 spin_unlock(&common->lock);
490}
491
492static int _fsg_common_get_max_lun(struct fsg_common *common)
493{
494 int i = ARRAY_SIZE(common->luns) - 1;
495
496 while (i >= 0 && !common->luns[i])
497 --i;
498
499 return i;
500}
501
502static int fsg_setup(struct usb_function *f,
503 const struct usb_ctrlrequest *ctrl)
504{
505 struct fsg_dev *fsg = fsg_from_func(f);
506 struct usb_request *req = fsg->common->ep0req;
507 u16 w_index = le16_to_cpu(ctrl->wIndex);
508 u16 w_value = le16_to_cpu(ctrl->wValue);
509 u16 w_length = le16_to_cpu(ctrl->wLength);
510
511 if (!fsg_is_set(fsg->common))
512 return -EOPNOTSUPP;
513
514 ++fsg->common->ep0_req_tag; /* Record arrival of a new request */
515 req->context = NULL;
516 req->length = 0;
517 dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
518
519 switch (ctrl->bRequest) {
520
521 case US_BULK_RESET_REQUEST:
522 if (ctrl->bRequestType !=
523 (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
524 break;
525 if (w_index != fsg->interface_number || w_value != 0 ||
526 w_length != 0)
527 return -EDOM;
528
529 /*
530 * Raise an exception to stop the current operation
531 * and reinitialize our state.
532 */
533 DBG(fsg, "bulk reset request\n");
534 raise_exception(fsg->common, FSG_STATE_RESET);
535 return USB_GADGET_DELAYED_STATUS;
536
537 case US_BULK_GET_MAX_LUN:
538 if (ctrl->bRequestType !=
539 (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
540 break;
541 if (w_index != fsg->interface_number || w_value != 0 ||
542 w_length != 1)
543 return -EDOM;
544 VDBG(fsg, "get max LUN\n");
545 *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
546
547 /* Respond with data/status */
548 req->length = min((u16)1, w_length);
549 return ep0_queue(fsg->common);
550 }
551
552 VDBG(fsg,
553 "unknown class-specific control req %02x.%02x v%04x i%04x l%u\n",
554 ctrl->bRequestType, ctrl->bRequest,
555 le16_to_cpu(ctrl->wValue), w_index, w_length);
556 return -EOPNOTSUPP;
557}
558
559
560/*-------------------------------------------------------------------------*/
561
562/* All the following routines run in process context */
563
564/* Use this for bulk or interrupt transfers, not ep0 */
565static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
566 struct usb_request *req, int *pbusy,
567 enum fsg_buffer_state *state)
568{
569 int rc;
570
571 if (ep == fsg->bulk_in)
572 dump_msg(fsg, "bulk-in", req->buf, req->length);
573
574 spin_lock_irq(&fsg->common->lock);
575 *pbusy = 1;
576 *state = BUF_STATE_BUSY;
577 spin_unlock_irq(&fsg->common->lock);
578
579 rc = usb_ep_queue(ep, req, GFP_KERNEL);
580 if (rc == 0)
581 return; /* All good, we're done */
582
583 *pbusy = 0;
584 *state = BUF_STATE_EMPTY;
585
586 /* We can't do much more than wait for a reset */
587
588 /*
589 * Note: currently the net2280 driver fails zero-length
590 * submissions if DMA is enabled.
591 */
592 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP && req->length == 0))
593 WARNING(fsg, "error in submission: %s --> %d\n", ep->name, rc);
594}
595
596static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
597{
598 if (!fsg_is_set(common))
599 return false;
600 start_transfer(common->fsg, common->fsg->bulk_in,
601 bh->inreq, &bh->inreq_busy, &bh->state);
602 return true;
603}
604
605static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
606{
607 if (!fsg_is_set(common))
608 return false;
609 start_transfer(common->fsg, common->fsg->bulk_out,
610 bh->outreq, &bh->outreq_busy, &bh->state);
611 return true;
612}
613
614static int sleep_thread(struct fsg_common *common, bool can_freeze)
615{
616 int rc = 0;
617
618 /* Wait until a signal arrives or we are woken up */
619 for (;;) {
620 if (can_freeze)
621 try_to_freeze();
622 set_current_state(TASK_INTERRUPTIBLE);
623 if (signal_pending(current)) {
624 rc = -EINTR;
625 break;
626 }
627 if (common->thread_wakeup_needed)
628 break;
629 schedule();
630 }
631 __set_current_state(TASK_RUNNING);
632 common->thread_wakeup_needed = 0;
633 smp_rmb(); /* ensure the latest bh->state is visible */
634 return rc;
635}
636
637
638/*-------------------------------------------------------------------------*/
639
640static int do_read(struct fsg_common *common)
641{
642 struct fsg_lun *curlun = common->curlun;
643 u32 lba;
644 struct fsg_buffhd *bh;
645 int rc;
646 u32 amount_left;
647 loff_t file_offset, file_offset_tmp;
648 unsigned int amount;
649 ssize_t nread;
650
651 /*
652 * Get the starting Logical Block Address and check that it's
653 * not too big.
654 */
655 if (common->cmnd[0] == READ_6)
656 lba = get_unaligned_be24(&common->cmnd[1]);
657 else {
658 lba = get_unaligned_be32(&common->cmnd[2]);
659
660 /*
661 * We allow DPO (Disable Page Out = don't save data in the
662 * cache) and FUA (Force Unit Access = don't read from the
663 * cache), but we don't implement them.
664 */
665 if ((common->cmnd[1] & ~0x18) != 0) {
666 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
667 return -EINVAL;
668 }
669 }
670 if (lba >= curlun->num_sectors) {
671 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
672 return -EINVAL;
673 }
674 file_offset = ((loff_t) lba) << curlun->blkbits;
675
676 /* Carry out the file reads */
677 amount_left = common->data_size_from_cmnd;
678 if (unlikely(amount_left == 0))
679 return -EIO; /* No default reply */
680
681 for (;;) {
682 /*
683 * Figure out how much we need to read:
684 * Try to read the remaining amount.
685 * But don't read more than the buffer size.
686 * And don't try to read past the end of the file.
687 */
688 amount = min(amount_left, FSG_BUFLEN);
689 amount = min((loff_t)amount,
690 curlun->file_length - file_offset);
691
692 /* Wait for the next buffer to become available */
693 bh = common->next_buffhd_to_fill;
694 while (bh->state != BUF_STATE_EMPTY) {
695 rc = sleep_thread(common, false);
696 if (rc)
697 return rc;
698 }
699
700 /*
701 * If we were asked to read past the end of file,
702 * end with an empty buffer.
703 */
704 if (amount == 0) {
705 curlun->sense_data =
706 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
707 curlun->sense_data_info =
708 file_offset >> curlun->blkbits;
709 curlun->info_valid = 1;
710 bh->inreq->length = 0;
711 bh->state = BUF_STATE_FULL;
712 break;
713 }
714
715 /* Perform the read */
716 file_offset_tmp = file_offset;
717 nread = vfs_read(curlun->filp,
718 (char __user *)bh->buf,
719 amount, &file_offset_tmp);
720 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
721 (unsigned long long)file_offset, (int)nread);
722 if (signal_pending(current))
723 return -EINTR;
724
725 if (nread < 0) {
726 LDBG(curlun, "error in file read: %d\n", (int)nread);
727 nread = 0;
728 } else if (nread < amount) {
729 LDBG(curlun, "partial file read: %d/%u\n",
730 (int)nread, amount);
731 nread = round_down(nread, curlun->blksize);
732 }
733 file_offset += nread;
734 amount_left -= nread;
735 common->residue -= nread;
736
737 /*
738 * Except at the end of the transfer, nread will be
739 * equal to the buffer size, which is divisible by the
740 * bulk-in maxpacket size.
741 */
742 bh->inreq->length = nread;
743 bh->state = BUF_STATE_FULL;
744
745 /* If an error occurred, report it and its position */
746 if (nread < amount) {
747 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
748 curlun->sense_data_info =
749 file_offset >> curlun->blkbits;
750 curlun->info_valid = 1;
751 break;
752 }
753
754 if (amount_left == 0)
755 break; /* No more left to read */
756
757 /* Send this buffer and go read some more */
758 bh->inreq->zero = 0;
759 if (!start_in_transfer(common, bh))
760 /* Don't know what to do if common->fsg is NULL */
761 return -EIO;
762 common->next_buffhd_to_fill = bh->next;
763 }
764
765 return -EIO; /* No default reply */
766}
767
768
769/*-------------------------------------------------------------------------*/
770
771static int do_write(struct fsg_common *common)
772{
773 struct fsg_lun *curlun = common->curlun;
774 u32 lba;
775 struct fsg_buffhd *bh;
776 int get_some_more;
777 u32 amount_left_to_req, amount_left_to_write;
778 loff_t usb_offset, file_offset, file_offset_tmp;
779 unsigned int amount;
780 ssize_t nwritten;
781 int rc;
782
783 if (curlun->ro) {
784 curlun->sense_data = SS_WRITE_PROTECTED;
785 return -EINVAL;
786 }
787 spin_lock(&curlun->filp->f_lock);
788 curlun->filp->f_flags &= ~O_SYNC; /* Default is not to wait */
789 spin_unlock(&curlun->filp->f_lock);
790
791 /*
792 * Get the starting Logical Block Address and check that it's
793 * not too big
794 */
795 if (common->cmnd[0] == WRITE_6)
796 lba = get_unaligned_be24(&common->cmnd[1]);
797 else {
798 lba = get_unaligned_be32(&common->cmnd[2]);
799
800 /*
801 * We allow DPO (Disable Page Out = don't save data in the
802 * cache) and FUA (Force Unit Access = write directly to the
803 * medium). We don't implement DPO; we implement FUA by
804 * performing synchronous output.
805 */
806 if (common->cmnd[1] & ~0x18) {
807 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
808 return -EINVAL;
809 }
810 if (!curlun->nofua && (common->cmnd[1] & 0x08)) { /* FUA */
811 spin_lock(&curlun->filp->f_lock);
812 curlun->filp->f_flags |= O_SYNC;
813 spin_unlock(&curlun->filp->f_lock);
814 }
815 }
816 if (lba >= curlun->num_sectors) {
817 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
818 return -EINVAL;
819 }
820
821 /* Carry out the file writes */
822 get_some_more = 1;
823 file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
824 amount_left_to_req = common->data_size_from_cmnd;
825 amount_left_to_write = common->data_size_from_cmnd;
826
827 while (amount_left_to_write > 0) {
828
829 /* Queue a request for more data from the host */
830 bh = common->next_buffhd_to_fill;
831 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
832
833 /*
834 * Figure out how much we want to get:
835 * Try to get the remaining amount,
836 * but not more than the buffer size.
837 */
838 amount = min(amount_left_to_req, FSG_BUFLEN);
839
840 /* Beyond the end of the backing file? */
841 if (usb_offset >= curlun->file_length) {
842 get_some_more = 0;
843 curlun->sense_data =
844 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
845 curlun->sense_data_info =
846 usb_offset >> curlun->blkbits;
847 curlun->info_valid = 1;
848 continue;
849 }
850
851 /* Get the next buffer */
852 usb_offset += amount;
853 common->usb_amount_left -= amount;
854 amount_left_to_req -= amount;
855 if (amount_left_to_req == 0)
856 get_some_more = 0;
857
858 /*
859 * Except at the end of the transfer, amount will be
860 * equal to the buffer size, which is divisible by
861 * the bulk-out maxpacket size.
862 */
863 set_bulk_out_req_length(common, bh, amount);
864 if (!start_out_transfer(common, bh))
865 /* Dunno what to do if common->fsg is NULL */
866 return -EIO;
867 common->next_buffhd_to_fill = bh->next;
868 continue;
869 }
870
871 /* Write the received data to the backing file */
872 bh = common->next_buffhd_to_drain;
873 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
874 break; /* We stopped early */
875 if (bh->state == BUF_STATE_FULL) {
876 smp_rmb();
877 common->next_buffhd_to_drain = bh->next;
878 bh->state = BUF_STATE_EMPTY;
879
880 /* Did something go wrong with the transfer? */
881 if (bh->outreq->status != 0) {
882 curlun->sense_data = SS_COMMUNICATION_FAILURE;
883 curlun->sense_data_info =
884 file_offset >> curlun->blkbits;
885 curlun->info_valid = 1;
886 break;
887 }
888
889 amount = bh->outreq->actual;
890 if (curlun->file_length - file_offset < amount) {
891 LERROR(curlun,
892 "write %u @ %llu beyond end %llu\n",
893 amount, (unsigned long long)file_offset,
894 (unsigned long long)curlun->file_length);
895 amount = curlun->file_length - file_offset;
896 }
897
898 /* Don't accept excess data. The spec doesn't say
899 * what to do in this case. We'll ignore the error.
900 */
901 amount = min(amount, bh->bulk_out_intended_length);
902
903 /* Don't write a partial block */
904 amount = round_down(amount, curlun->blksize);
905 if (amount == 0)
906 goto empty_write;
907
908 /* Perform the write */
909 file_offset_tmp = file_offset;
910 nwritten = vfs_write(curlun->filp,
911 (char __user *)bh->buf,
912 amount, &file_offset_tmp);
913 VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
914 (unsigned long long)file_offset, (int)nwritten);
915 if (signal_pending(current))
916 return -EINTR; /* Interrupted! */
917
918 if (nwritten < 0) {
919 LDBG(curlun, "error in file write: %d\n",
920 (int)nwritten);
921 nwritten = 0;
922 } else if (nwritten < amount) {
923 LDBG(curlun, "partial file write: %d/%u\n",
924 (int)nwritten, amount);
925 nwritten = round_down(nwritten, curlun->blksize);
926 }
927 file_offset += nwritten;
928 amount_left_to_write -= nwritten;
929 common->residue -= nwritten;
930
931 /* If an error occurred, report it and its position */
932 if (nwritten < amount) {
933 curlun->sense_data = SS_WRITE_ERROR;
934 curlun->sense_data_info =
935 file_offset >> curlun->blkbits;
936 curlun->info_valid = 1;
937 break;
938 }
939
940 empty_write:
941 /* Did the host decide to stop early? */
942 if (bh->outreq->actual < bh->bulk_out_intended_length) {
943 common->short_packet_received = 1;
944 break;
945 }
946 continue;
947 }
948
949 /* Wait for something to happen */
950 rc = sleep_thread(common, false);
951 if (rc)
952 return rc;
953 }
954
955 return -EIO; /* No default reply */
956}
957
958
959/*-------------------------------------------------------------------------*/
960
961static int do_synchronize_cache(struct fsg_common *common)
962{
963 struct fsg_lun *curlun = common->curlun;
964 int rc;
965
966 /* We ignore the requested LBA and write out all file's
967 * dirty data buffers. */
968 rc = fsg_lun_fsync_sub(curlun);
969 if (rc)
970 curlun->sense_data = SS_WRITE_ERROR;
971 return 0;
972}
973
974
975/*-------------------------------------------------------------------------*/
976
977static void invalidate_sub(struct fsg_lun *curlun)
978{
979 struct file *filp = curlun->filp;
980 struct inode *inode = file_inode(filp);
981 unsigned long rc;
982
983 rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
984 VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
985}
986
987static int do_verify(struct fsg_common *common)
988{
989 struct fsg_lun *curlun = common->curlun;
990 u32 lba;
991 u32 verification_length;
992 struct fsg_buffhd *bh = common->next_buffhd_to_fill;
993 loff_t file_offset, file_offset_tmp;
994 u32 amount_left;
995 unsigned int amount;
996 ssize_t nread;
997
998 /*
999 * Get the starting Logical Block Address and check that it's
1000 * not too big.
1001 */
1002 lba = get_unaligned_be32(&common->cmnd[2]);
1003 if (lba >= curlun->num_sectors) {
1004 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1005 return -EINVAL;
1006 }
1007
1008 /*
1009 * We allow DPO (Disable Page Out = don't save data in the
1010 * cache) but we don't implement it.
1011 */
1012 if (common->cmnd[1] & ~0x10) {
1013 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1014 return -EINVAL;
1015 }
1016
1017 verification_length = get_unaligned_be16(&common->cmnd[7]);
1018 if (unlikely(verification_length == 0))
1019 return -EIO; /* No default reply */
1020
1021 /* Prepare to carry out the file verify */
1022 amount_left = verification_length << curlun->blkbits;
1023 file_offset = ((loff_t) lba) << curlun->blkbits;
1024
1025 /* Write out all the dirty buffers before invalidating them */
1026 fsg_lun_fsync_sub(curlun);
1027 if (signal_pending(current))
1028 return -EINTR;
1029
1030 invalidate_sub(curlun);
1031 if (signal_pending(current))
1032 return -EINTR;
1033
1034 /* Just try to read the requested blocks */
1035 while (amount_left > 0) {
1036 /*
1037 * Figure out how much we need to read:
1038 * Try to read the remaining amount, but not more than
1039 * the buffer size.
1040 * And don't try to read past the end of the file.
1041 */
1042 amount = min(amount_left, FSG_BUFLEN);
1043 amount = min((loff_t)amount,
1044 curlun->file_length - file_offset);
1045 if (amount == 0) {
1046 curlun->sense_data =
1047 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1048 curlun->sense_data_info =
1049 file_offset >> curlun->blkbits;
1050 curlun->info_valid = 1;
1051 break;
1052 }
1053
1054 /* Perform the read */
1055 file_offset_tmp = file_offset;
1056 nread = vfs_read(curlun->filp,
1057 (char __user *) bh->buf,
1058 amount, &file_offset_tmp);
1059 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1060 (unsigned long long) file_offset,
1061 (int) nread);
1062 if (signal_pending(current))
1063 return -EINTR;
1064
1065 if (nread < 0) {
1066 LDBG(curlun, "error in file verify: %d\n", (int)nread);
1067 nread = 0;
1068 } else if (nread < amount) {
1069 LDBG(curlun, "partial file verify: %d/%u\n",
1070 (int)nread, amount);
1071 nread = round_down(nread, curlun->blksize);
1072 }
1073 if (nread == 0) {
1074 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1075 curlun->sense_data_info =
1076 file_offset >> curlun->blkbits;
1077 curlun->info_valid = 1;
1078 break;
1079 }
1080 file_offset += nread;
1081 amount_left -= nread;
1082 }
1083 return 0;
1084}
1085
1086
1087/*-------------------------------------------------------------------------*/
1088
1089static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
1090{
1091 struct fsg_lun *curlun = common->curlun;
1092 u8 *buf = (u8 *) bh->buf;
1093
1094 if (!curlun) { /* Unsupported LUNs are okay */
1095 common->bad_lun_okay = 1;
1096 memset(buf, 0, 36);
1097 buf[0] = TYPE_NO_LUN; /* Unsupported, no device-type */
1098 buf[4] = 31; /* Additional length */
1099 return 36;
1100 }
1101
1102 buf[0] = curlun->cdrom ? TYPE_ROM : TYPE_DISK;
1103 buf[1] = curlun->removable ? 0x80 : 0;
1104 buf[2] = 2; /* ANSI SCSI level 2 */
1105 buf[3] = 2; /* SCSI-2 INQUIRY data format */
1106 buf[4] = 31; /* Additional length */
1107 buf[5] = 0; /* No special options */
1108 buf[6] = 0;
1109 buf[7] = 0;
1110 memcpy(buf + 8, common->inquiry_string, sizeof common->inquiry_string);
1111 return 36;
1112}
1113
1114static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1115{
1116 struct fsg_lun *curlun = common->curlun;
1117 u8 *buf = (u8 *) bh->buf;
1118 u32 sd, sdinfo;
1119 int valid;
1120
1121 /*
1122 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1123 *
1124 * If a REQUEST SENSE command is received from an initiator
1125 * with a pending unit attention condition (before the target
1126 * generates the contingent allegiance condition), then the
1127 * target shall either:
1128 * a) report any pending sense data and preserve the unit
1129 * attention condition on the logical unit, or,
1130 * b) report the unit attention condition, may discard any
1131 * pending sense data, and clear the unit attention
1132 * condition on the logical unit for that initiator.
1133 *
1134 * FSG normally uses option a); enable this code to use option b).
1135 */
1136#if 0
1137 if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1138 curlun->sense_data = curlun->unit_attention_data;
1139 curlun->unit_attention_data = SS_NO_SENSE;
1140 }
1141#endif
1142
1143 if (!curlun) { /* Unsupported LUNs are okay */
1144 common->bad_lun_okay = 1;
1145 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1146 sdinfo = 0;
1147 valid = 0;
1148 } else {
1149 sd = curlun->sense_data;
1150 sdinfo = curlun->sense_data_info;
1151 valid = curlun->info_valid << 7;
1152 curlun->sense_data = SS_NO_SENSE;
1153 curlun->sense_data_info = 0;
1154 curlun->info_valid = 0;
1155 }
1156
1157 memset(buf, 0, 18);
1158 buf[0] = valid | 0x70; /* Valid, current error */
1159 buf[2] = SK(sd);
1160 put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
1161 buf[7] = 18 - 8; /* Additional sense length */
1162 buf[12] = ASC(sd);
1163 buf[13] = ASCQ(sd);
1164 return 18;
1165}
1166
1167static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
1168{
1169 struct fsg_lun *curlun = common->curlun;
1170 u32 lba = get_unaligned_be32(&common->cmnd[2]);
1171 int pmi = common->cmnd[8];
1172 u8 *buf = (u8 *)bh->buf;
1173
1174 /* Check the PMI and LBA fields */
1175 if (pmi > 1 || (pmi == 0 && lba != 0)) {
1176 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1177 return -EINVAL;
1178 }
1179
1180 put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1181 /* Max logical block */
1182 put_unaligned_be32(curlun->blksize, &buf[4]);/* Block length */
1183 return 8;
1184}
1185
1186static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
1187{
1188 struct fsg_lun *curlun = common->curlun;
1189 int msf = common->cmnd[1] & 0x02;
1190 u32 lba = get_unaligned_be32(&common->cmnd[2]);
1191 u8 *buf = (u8 *)bh->buf;
1192
1193 if (common->cmnd[1] & ~0x02) { /* Mask away MSF */
1194 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1195 return -EINVAL;
1196 }
1197 if (lba >= curlun->num_sectors) {
1198 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1199 return -EINVAL;
1200 }
1201
1202 memset(buf, 0, 8);
1203 buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
1204 store_cdrom_address(&buf[4], msf, lba);
1205 return 8;
1206}
1207
1208static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
1209{
1210 struct fsg_lun *curlun = common->curlun;
1211 int msf = common->cmnd[1] & 0x02;
1212 int start_track = common->cmnd[6];
1213 u8 *buf = (u8 *)bh->buf;
1214
1215 if ((common->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
1216 start_track > 1) {
1217 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1218 return -EINVAL;
1219 }
1220
1221 memset(buf, 0, 20);
1222 buf[1] = (20-2); /* TOC data length */
1223 buf[2] = 1; /* First track number */
1224 buf[3] = 1; /* Last track number */
1225 buf[5] = 0x16; /* Data track, copying allowed */
1226 buf[6] = 0x01; /* Only track is number 1 */
1227 store_cdrom_address(&buf[8], msf, 0);
1228
1229 buf[13] = 0x16; /* Lead-out track is data */
1230 buf[14] = 0xAA; /* Lead-out track number */
1231 store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1232 return 20;
1233}
1234
1235static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1236{
1237 struct fsg_lun *curlun = common->curlun;
1238 int mscmnd = common->cmnd[0];
1239 u8 *buf = (u8 *) bh->buf;
1240 u8 *buf0 = buf;
1241 int pc, page_code;
1242 int changeable_values, all_pages;
1243 int valid_page = 0;
1244 int len, limit;
1245
1246 if ((common->cmnd[1] & ~0x08) != 0) { /* Mask away DBD */
1247 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1248 return -EINVAL;
1249 }
1250 pc = common->cmnd[2] >> 6;
1251 page_code = common->cmnd[2] & 0x3f;
1252 if (pc == 3) {
1253 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1254 return -EINVAL;
1255 }
1256 changeable_values = (pc == 1);
1257 all_pages = (page_code == 0x3f);
1258
1259 /*
1260 * Write the mode parameter header. Fixed values are: default
1261 * medium type, no cache control (DPOFUA), and no block descriptors.
1262 * The only variable value is the WriteProtect bit. We will fill in
1263 * the mode data length later.
1264 */
1265 memset(buf, 0, 8);
1266 if (mscmnd == MODE_SENSE) {
1267 buf[2] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
1268 buf += 4;
1269 limit = 255;
1270 } else { /* MODE_SENSE_10 */
1271 buf[3] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
1272 buf += 8;
1273 limit = 65535; /* Should really be FSG_BUFLEN */
1274 }
1275
1276 /* No block descriptors */
1277
1278 /*
1279 * The mode pages, in numerical order. The only page we support
1280 * is the Caching page.
1281 */
1282 if (page_code == 0x08 || all_pages) {
1283 valid_page = 1;
1284 buf[0] = 0x08; /* Page code */
1285 buf[1] = 10; /* Page length */
1286 memset(buf+2, 0, 10); /* None of the fields are changeable */
1287
1288 if (!changeable_values) {
1289 buf[2] = 0x04; /* Write cache enable, */
1290 /* Read cache not disabled */
1291 /* No cache retention priorities */
1292 put_unaligned_be16(0xffff, &buf[4]);
1293 /* Don't disable prefetch */
1294 /* Minimum prefetch = 0 */
1295 put_unaligned_be16(0xffff, &buf[8]);
1296 /* Maximum prefetch */
1297 put_unaligned_be16(0xffff, &buf[10]);
1298 /* Maximum prefetch ceiling */
1299 }
1300 buf += 12;
1301 }
1302
1303 /*
1304 * Check that a valid page was requested and the mode data length
1305 * isn't too long.
1306 */
1307 len = buf - buf0;
1308 if (!valid_page || len > limit) {
1309 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1310 return -EINVAL;
1311 }
1312
1313 /* Store the mode data length */
1314 if (mscmnd == MODE_SENSE)
1315 buf0[0] = len - 1;
1316 else
1317 put_unaligned_be16(len - 2, buf0);
1318 return len;
1319}
1320
1321static int do_start_stop(struct fsg_common *common)
1322{
1323 struct fsg_lun *curlun = common->curlun;
1324 int loej, start;
1325
1326 if (!curlun) {
1327 return -EINVAL;
1328 } else if (!curlun->removable) {
1329 curlun->sense_data = SS_INVALID_COMMAND;
1330 return -EINVAL;
1331 } else if ((common->cmnd[1] & ~0x01) != 0 || /* Mask away Immed */
1332 (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */
1333 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1334 return -EINVAL;
1335 }
1336
1337 loej = common->cmnd[4] & 0x02;
1338 start = common->cmnd[4] & 0x01;
1339
1340 /*
1341 * Our emulation doesn't support mounting; the medium is
1342 * available for use as soon as it is loaded.
1343 */
1344 if (start) {
1345 if (!fsg_lun_is_open(curlun)) {
1346 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1347 return -EINVAL;
1348 }
1349 return 0;
1350 }
1351
1352 /* Are we allowed to unload the media? */
1353 if (curlun->prevent_medium_removal) {
1354 LDBG(curlun, "unload attempt prevented\n");
1355 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1356 return -EINVAL;
1357 }
1358
1359 if (!loej)
1360 return 0;
1361
1362 up_read(&common->filesem);
1363 down_write(&common->filesem);
1364 fsg_lun_close(curlun);
1365 up_write(&common->filesem);
1366 down_read(&common->filesem);
1367
1368 return 0;
1369}
1370
1371static int do_prevent_allow(struct fsg_common *common)
1372{
1373 struct fsg_lun *curlun = common->curlun;
1374 int prevent;
1375
1376 if (!common->curlun) {
1377 return -EINVAL;
1378 } else if (!common->curlun->removable) {
1379 common->curlun->sense_data = SS_INVALID_COMMAND;
1380 return -EINVAL;
1381 }
1382
1383 prevent = common->cmnd[4] & 0x01;
1384 if ((common->cmnd[4] & ~0x01) != 0) { /* Mask away Prevent */
1385 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1386 return -EINVAL;
1387 }
1388
1389 if (curlun->prevent_medium_removal && !prevent)
1390 fsg_lun_fsync_sub(curlun);
1391 curlun->prevent_medium_removal = prevent;
1392 return 0;
1393}
1394
1395static int do_read_format_capacities(struct fsg_common *common,
1396 struct fsg_buffhd *bh)
1397{
1398 struct fsg_lun *curlun = common->curlun;
1399 u8 *buf = (u8 *) bh->buf;
1400
1401 buf[0] = buf[1] = buf[2] = 0;
1402 buf[3] = 8; /* Only the Current/Maximum Capacity Descriptor */
1403 buf += 4;
1404
1405 put_unaligned_be32(curlun->num_sectors, &buf[0]);
1406 /* Number of blocks */
1407 put_unaligned_be32(curlun->blksize, &buf[4]);/* Block length */
1408 buf[4] = 0x02; /* Current capacity */
1409 return 12;
1410}
1411
1412static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
1413{
1414 struct fsg_lun *curlun = common->curlun;
1415
1416 /* We don't support MODE SELECT */
1417 if (curlun)
1418 curlun->sense_data = SS_INVALID_COMMAND;
1419 return -EINVAL;
1420}
1421
1422
1423/*-------------------------------------------------------------------------*/
1424
1425static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1426{
1427 int rc;
1428
1429 rc = fsg_set_halt(fsg, fsg->bulk_in);
1430 if (rc == -EAGAIN)
1431 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1432 while (rc != 0) {
1433 if (rc != -EAGAIN) {
1434 WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1435 rc = 0;
1436 break;
1437 }
1438
1439 /* Wait for a short time and then try again */
1440 if (msleep_interruptible(100) != 0)
1441 return -EINTR;
1442 rc = usb_ep_set_halt(fsg->bulk_in);
1443 }
1444 return rc;
1445}
1446
1447static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1448{
1449 int rc;
1450
1451 DBG(fsg, "bulk-in set wedge\n");
1452 rc = usb_ep_set_wedge(fsg->bulk_in);
1453 if (rc == -EAGAIN)
1454 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1455 while (rc != 0) {
1456 if (rc != -EAGAIN) {
1457 WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1458 rc = 0;
1459 break;
1460 }
1461
1462 /* Wait for a short time and then try again */
1463 if (msleep_interruptible(100) != 0)
1464 return -EINTR;
1465 rc = usb_ep_set_wedge(fsg->bulk_in);
1466 }
1467 return rc;
1468}
1469
1470static int throw_away_data(struct fsg_common *common)
1471{
1472 struct fsg_buffhd *bh;
1473 u32 amount;
1474 int rc;
1475
1476 for (bh = common->next_buffhd_to_drain;
1477 bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
1478 bh = common->next_buffhd_to_drain) {
1479
1480 /* Throw away the data in a filled buffer */
1481 if (bh->state == BUF_STATE_FULL) {
1482 smp_rmb();
1483 bh->state = BUF_STATE_EMPTY;
1484 common->next_buffhd_to_drain = bh->next;
1485
1486 /* A short packet or an error ends everything */
1487 if (bh->outreq->actual < bh->bulk_out_intended_length ||
1488 bh->outreq->status != 0) {
1489 raise_exception(common,
1490 FSG_STATE_ABORT_BULK_OUT);
1491 return -EINTR;
1492 }
1493 continue;
1494 }
1495
1496 /* Try to submit another request if we need one */
1497 bh = common->next_buffhd_to_fill;
1498 if (bh->state == BUF_STATE_EMPTY
1499 && common->usb_amount_left > 0) {
1500 amount = min(common->usb_amount_left, FSG_BUFLEN);
1501
1502 /*
1503 * Except at the end of the transfer, amount will be
1504 * equal to the buffer size, which is divisible by
1505 * the bulk-out maxpacket size.
1506 */
1507 set_bulk_out_req_length(common, bh, amount);
1508 if (!start_out_transfer(common, bh))
1509 /* Dunno what to do if common->fsg is NULL */
1510 return -EIO;
1511 common->next_buffhd_to_fill = bh->next;
1512 common->usb_amount_left -= amount;
1513 continue;
1514 }
1515
1516 /* Otherwise wait for something to happen */
1517 rc = sleep_thread(common, true);
1518 if (rc)
1519 return rc;
1520 }
1521 return 0;
1522}
1523
1524static int finish_reply(struct fsg_common *common)
1525{
1526 struct fsg_buffhd *bh = common->next_buffhd_to_fill;
1527 int rc = 0;
1528
1529 switch (common->data_dir) {
1530 case DATA_DIR_NONE:
1531 break; /* Nothing to send */
1532
1533 /*
1534 * If we don't know whether the host wants to read or write,
1535 * this must be CB or CBI with an unknown command. We mustn't
1536 * try to send or receive any data. So stall both bulk pipes
1537 * if we can and wait for a reset.
1538 */
1539 case DATA_DIR_UNKNOWN:
1540 if (!common->can_stall) {
1541 /* Nothing */
1542 } else if (fsg_is_set(common)) {
1543 fsg_set_halt(common->fsg, common->fsg->bulk_out);
1544 rc = halt_bulk_in_endpoint(common->fsg);
1545 } else {
1546 /* Don't know what to do if common->fsg is NULL */
1547 rc = -EIO;
1548 }
1549 break;
1550
1551 /* All but the last buffer of data must have already been sent */
1552 case DATA_DIR_TO_HOST:
1553 if (common->data_size == 0) {
1554 /* Nothing to send */
1555
1556 /* Don't know what to do if common->fsg is NULL */
1557 } else if (!fsg_is_set(common)) {
1558 rc = -EIO;
1559
1560 /* If there's no residue, simply send the last buffer */
1561 } else if (common->residue == 0) {
1562 bh->inreq->zero = 0;
1563 if (!start_in_transfer(common, bh))
1564 return -EIO;
1565 common->next_buffhd_to_fill = bh->next;
1566
1567 /*
1568 * For Bulk-only, mark the end of the data with a short
1569 * packet. If we are allowed to stall, halt the bulk-in
1570 * endpoint. (Note: This violates the Bulk-Only Transport
1571 * specification, which requires us to pad the data if we
1572 * don't halt the endpoint. Presumably nobody will mind.)
1573 */
1574 } else {
1575 bh->inreq->zero = 1;
1576 if (!start_in_transfer(common, bh))
1577 rc = -EIO;
1578 common->next_buffhd_to_fill = bh->next;
1579 if (common->can_stall)
1580 rc = halt_bulk_in_endpoint(common->fsg);
1581 }
1582 break;
1583
1584 /*
1585 * We have processed all we want from the data the host has sent.
1586 * There may still be outstanding bulk-out requests.
1587 */
1588 case DATA_DIR_FROM_HOST:
1589 if (common->residue == 0) {
1590 /* Nothing to receive */
1591
1592 /* Did the host stop sending unexpectedly early? */
1593 } else if (common->short_packet_received) {
1594 raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1595 rc = -EINTR;
1596
1597 /*
1598 * We haven't processed all the incoming data. Even though
1599 * we may be allowed to stall, doing so would cause a race.
1600 * The controller may already have ACK'ed all the remaining
1601 * bulk-out packets, in which case the host wouldn't see a
1602 * STALL. Not realizing the endpoint was halted, it wouldn't
1603 * clear the halt -- leading to problems later on.
1604 */
1605#if 0
1606 } else if (common->can_stall) {
1607 if (fsg_is_set(common))
1608 fsg_set_halt(common->fsg,
1609 common->fsg->bulk_out);
1610 raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1611 rc = -EINTR;
1612#endif
1613
1614 /*
1615 * We can't stall. Read in the excess data and throw it
1616 * all away.
1617 */
1618 } else {
1619 rc = throw_away_data(common);
1620 }
1621 break;
1622 }
1623 return rc;
1624}
1625
1626static int send_status(struct fsg_common *common)
1627{
1628 struct fsg_lun *curlun = common->curlun;
1629 struct fsg_buffhd *bh;
1630 struct bulk_cs_wrap *csw;
1631 int rc;
1632 u8 status = US_BULK_STAT_OK;
1633 u32 sd, sdinfo = 0;
1634
1635 /* Wait for the next buffer to become available */
1636 bh = common->next_buffhd_to_fill;
1637 while (bh->state != BUF_STATE_EMPTY) {
1638 rc = sleep_thread(common, true);
1639 if (rc)
1640 return rc;
1641 }
1642
1643 if (curlun) {
1644 sd = curlun->sense_data;
1645 sdinfo = curlun->sense_data_info;
1646 } else if (common->bad_lun_okay)
1647 sd = SS_NO_SENSE;
1648 else
1649 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1650
1651 if (common->phase_error) {
1652 DBG(common, "sending phase-error status\n");
1653 status = US_BULK_STAT_PHASE;
1654 sd = SS_INVALID_COMMAND;
1655 } else if (sd != SS_NO_SENSE) {
1656 DBG(common, "sending command-failure status\n");
1657 status = US_BULK_STAT_FAIL;
1658 VDBG(common, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
1659 " info x%x\n",
1660 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
1661 }
1662
1663 /* Store and send the Bulk-only CSW */
1664 csw = (void *)bh->buf;
1665
1666 csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
1667 csw->Tag = common->tag;
1668 csw->Residue = cpu_to_le32(common->residue);
1669 csw->Status = status;
1670
1671 bh->inreq->length = US_BULK_CS_WRAP_LEN;
1672 bh->inreq->zero = 0;
1673 if (!start_in_transfer(common, bh))
1674 /* Don't know what to do if common->fsg is NULL */
1675 return -EIO;
1676
1677 common->next_buffhd_to_fill = bh->next;
1678 return 0;
1679}
1680
1681
1682/*-------------------------------------------------------------------------*/
1683
1684/*
1685 * Check whether the command is properly formed and whether its data size
1686 * and direction agree with the values we already have.
1687 */
1688static int check_command(struct fsg_common *common, int cmnd_size,
1689 enum data_direction data_dir, unsigned int mask,
1690 int needs_medium, const char *name)
1691{
1692 int i;
1693 unsigned int lun = common->cmnd[1] >> 5;
1694 static const char dirletter[4] = {'u', 'o', 'i', 'n'};
1695 char hdlen[20];
1696 struct fsg_lun *curlun;
1697
1698 hdlen[0] = 0;
1699 if (common->data_dir != DATA_DIR_UNKNOWN)
1700 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
1701 common->data_size);
1702 VDBG(common, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
1703 name, cmnd_size, dirletter[(int) data_dir],
1704 common->data_size_from_cmnd, common->cmnd_size, hdlen);
1705
1706 /*
1707 * We can't reply at all until we know the correct data direction
1708 * and size.
1709 */
1710 if (common->data_size_from_cmnd == 0)
1711 data_dir = DATA_DIR_NONE;
1712 if (common->data_size < common->data_size_from_cmnd) {
1713 /*
1714 * Host data size < Device data size is a phase error.
1715 * Carry out the command, but only transfer as much as
1716 * we are allowed.
1717 */
1718 common->data_size_from_cmnd = common->data_size;
1719 common->phase_error = 1;
1720 }
1721 common->residue = common->data_size;
1722 common->usb_amount_left = common->data_size;
1723
1724 /* Conflicting data directions is a phase error */
1725 if (common->data_dir != data_dir && common->data_size_from_cmnd > 0) {
1726 common->phase_error = 1;
1727 return -EINVAL;
1728 }
1729
1730 /* Verify the length of the command itself */
1731 if (cmnd_size != common->cmnd_size) {
1732
1733 /*
1734 * Special case workaround: There are plenty of buggy SCSI
1735 * implementations. Many have issues with cbw->Length
1736 * field passing a wrong command size. For those cases we
1737 * always try to work around the problem by using the length
1738 * sent by the host side provided it is at least as large
1739 * as the correct command length.
1740 * Examples of such cases would be MS-Windows, which issues
1741 * REQUEST SENSE with cbw->Length == 12 where it should
1742 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
1743 * REQUEST SENSE with cbw->Length == 10 where it should
1744 * be 6 as well.
1745 */
1746 if (cmnd_size <= common->cmnd_size) {
1747 DBG(common, "%s is buggy! Expected length %d "
1748 "but we got %d\n", name,
1749 cmnd_size, common->cmnd_size);
1750 cmnd_size = common->cmnd_size;
1751 } else {
1752 common->phase_error = 1;
1753 return -EINVAL;
1754 }
1755 }
1756
1757 /* Check that the LUN values are consistent */
1758 if (common->lun != lun)
1759 DBG(common, "using LUN %u from CBW, not LUN %u from CDB\n",
1760 common->lun, lun);
1761
1762 /* Check the LUN */
1763 curlun = common->curlun;
1764 if (curlun) {
1765 if (common->cmnd[0] != REQUEST_SENSE) {
1766 curlun->sense_data = SS_NO_SENSE;
1767 curlun->sense_data_info = 0;
1768 curlun->info_valid = 0;
1769 }
1770 } else {
1771 common->bad_lun_okay = 0;
1772
1773 /*
1774 * INQUIRY and REQUEST SENSE commands are explicitly allowed
1775 * to use unsupported LUNs; all others may not.
1776 */
1777 if (common->cmnd[0] != INQUIRY &&
1778 common->cmnd[0] != REQUEST_SENSE) {
1779 DBG(common, "unsupported LUN %u\n", common->lun);
1780 return -EINVAL;
1781 }
1782 }
1783
1784 /*
1785 * If a unit attention condition exists, only INQUIRY and
1786 * REQUEST SENSE commands are allowed; anything else must fail.
1787 */
1788 if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
1789 common->cmnd[0] != INQUIRY &&
1790 common->cmnd[0] != REQUEST_SENSE) {
1791 curlun->sense_data = curlun->unit_attention_data;
1792 curlun->unit_attention_data = SS_NO_SENSE;
1793 return -EINVAL;
1794 }
1795
1796 /* Check that only command bytes listed in the mask are non-zero */
1797 common->cmnd[1] &= 0x1f; /* Mask away the LUN */
1798 for (i = 1; i < cmnd_size; ++i) {
1799 if (common->cmnd[i] && !(mask & (1 << i))) {
1800 if (curlun)
1801 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1802 return -EINVAL;
1803 }
1804 }
1805
1806 /* If the medium isn't mounted and the command needs to access
1807 * it, return an error. */
1808 if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
1809 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1810 return -EINVAL;
1811 }
1812
1813 return 0;
1814}
1815
1816/* wrapper of check_command for data size in blocks handling */
1817static int check_command_size_in_blocks(struct fsg_common *common,
1818 int cmnd_size, enum data_direction data_dir,
1819 unsigned int mask, int needs_medium, const char *name)
1820{
1821 if (common->curlun)
1822 common->data_size_from_cmnd <<= common->curlun->blkbits;
1823 return check_command(common, cmnd_size, data_dir,
1824 mask, needs_medium, name);
1825}
1826
1827static int do_scsi_command(struct fsg_common *common)
1828{
1829 struct fsg_buffhd *bh;
1830 int rc;
1831 int reply = -EINVAL;
1832 int i;
1833 static char unknown[16];
1834
1835 dump_cdb(common);
1836
1837 /* Wait for the next buffer to become available for data or status */
1838 bh = common->next_buffhd_to_fill;
1839 common->next_buffhd_to_drain = bh;
1840 while (bh->state != BUF_STATE_EMPTY) {
1841 rc = sleep_thread(common, true);
1842 if (rc)
1843 return rc;
1844 }
1845 common->phase_error = 0;
1846 common->short_packet_received = 0;
1847
1848 down_read(&common->filesem); /* We're using the backing file */
1849 switch (common->cmnd[0]) {
1850
1851 case INQUIRY:
1852 common->data_size_from_cmnd = common->cmnd[4];
1853 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1854 (1<<4), 0,
1855 "INQUIRY");
1856 if (reply == 0)
1857 reply = do_inquiry(common, bh);
1858 break;
1859
1860 case MODE_SELECT:
1861 common->data_size_from_cmnd = common->cmnd[4];
1862 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
1863 (1<<1) | (1<<4), 0,
1864 "MODE SELECT(6)");
1865 if (reply == 0)
1866 reply = do_mode_select(common, bh);
1867 break;
1868
1869 case MODE_SELECT_10:
1870 common->data_size_from_cmnd =
1871 get_unaligned_be16(&common->cmnd[7]);
1872 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
1873 (1<<1) | (3<<7), 0,
1874 "MODE SELECT(10)");
1875 if (reply == 0)
1876 reply = do_mode_select(common, bh);
1877 break;
1878
1879 case MODE_SENSE:
1880 common->data_size_from_cmnd = common->cmnd[4];
1881 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1882 (1<<1) | (1<<2) | (1<<4), 0,
1883 "MODE SENSE(6)");
1884 if (reply == 0)
1885 reply = do_mode_sense(common, bh);
1886 break;
1887
1888 case MODE_SENSE_10:
1889 common->data_size_from_cmnd =
1890 get_unaligned_be16(&common->cmnd[7]);
1891 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1892 (1<<1) | (1<<2) | (3<<7), 0,
1893 "MODE SENSE(10)");
1894 if (reply == 0)
1895 reply = do_mode_sense(common, bh);
1896 break;
1897
1898 case ALLOW_MEDIUM_REMOVAL:
1899 common->data_size_from_cmnd = 0;
1900 reply = check_command(common, 6, DATA_DIR_NONE,
1901 (1<<4), 0,
1902 "PREVENT-ALLOW MEDIUM REMOVAL");
1903 if (reply == 0)
1904 reply = do_prevent_allow(common);
1905 break;
1906
1907 case READ_6:
1908 i = common->cmnd[4];
1909 common->data_size_from_cmnd = (i == 0) ? 256 : i;
1910 reply = check_command_size_in_blocks(common, 6,
1911 DATA_DIR_TO_HOST,
1912 (7<<1) | (1<<4), 1,
1913 "READ(6)");
1914 if (reply == 0)
1915 reply = do_read(common);
1916 break;
1917
1918 case READ_10:
1919 common->data_size_from_cmnd =
1920 get_unaligned_be16(&common->cmnd[7]);
1921 reply = check_command_size_in_blocks(common, 10,
1922 DATA_DIR_TO_HOST,
1923 (1<<1) | (0xf<<2) | (3<<7), 1,
1924 "READ(10)");
1925 if (reply == 0)
1926 reply = do_read(common);
1927 break;
1928
1929 case READ_12:
1930 common->data_size_from_cmnd =
1931 get_unaligned_be32(&common->cmnd[6]);
1932 reply = check_command_size_in_blocks(common, 12,
1933 DATA_DIR_TO_HOST,
1934 (1<<1) | (0xf<<2) | (0xf<<6), 1,
1935 "READ(12)");
1936 if (reply == 0)
1937 reply = do_read(common);
1938 break;
1939
1940 case READ_CAPACITY:
1941 common->data_size_from_cmnd = 8;
1942 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1943 (0xf<<2) | (1<<8), 1,
1944 "READ CAPACITY");
1945 if (reply == 0)
1946 reply = do_read_capacity(common, bh);
1947 break;
1948
1949 case READ_HEADER:
1950 if (!common->curlun || !common->curlun->cdrom)
1951 goto unknown_cmnd;
1952 common->data_size_from_cmnd =
1953 get_unaligned_be16(&common->cmnd[7]);
1954 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1955 (3<<7) | (0x1f<<1), 1,
1956 "READ HEADER");
1957 if (reply == 0)
1958 reply = do_read_header(common, bh);
1959 break;
1960
1961 case READ_TOC:
1962 if (!common->curlun || !common->curlun->cdrom)
1963 goto unknown_cmnd;
1964 common->data_size_from_cmnd =
1965 get_unaligned_be16(&common->cmnd[7]);
1966 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1967 (7<<6) | (1<<1), 1,
1968 "READ TOC");
1969 if (reply == 0)
1970 reply = do_read_toc(common, bh);
1971 break;
1972
1973 case READ_FORMAT_CAPACITIES:
1974 common->data_size_from_cmnd =
1975 get_unaligned_be16(&common->cmnd[7]);
1976 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1977 (3<<7), 1,
1978 "READ FORMAT CAPACITIES");
1979 if (reply == 0)
1980 reply = do_read_format_capacities(common, bh);
1981 break;
1982
1983 case REQUEST_SENSE:
1984 common->data_size_from_cmnd = common->cmnd[4];
1985 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1986 (1<<4), 0,
1987 "REQUEST SENSE");
1988 if (reply == 0)
1989 reply = do_request_sense(common, bh);
1990 break;
1991
1992 case START_STOP:
1993 common->data_size_from_cmnd = 0;
1994 reply = check_command(common, 6, DATA_DIR_NONE,
1995 (1<<1) | (1<<4), 0,
1996 "START-STOP UNIT");
1997 if (reply == 0)
1998 reply = do_start_stop(common);
1999 break;
2000
2001 case SYNCHRONIZE_CACHE:
2002 common->data_size_from_cmnd = 0;
2003 reply = check_command(common, 10, DATA_DIR_NONE,
2004 (0xf<<2) | (3<<7), 1,
2005 "SYNCHRONIZE CACHE");
2006 if (reply == 0)
2007 reply = do_synchronize_cache(common);
2008 break;
2009
2010 case TEST_UNIT_READY:
2011 common->data_size_from_cmnd = 0;
2012 reply = check_command(common, 6, DATA_DIR_NONE,
2013 0, 1,
2014 "TEST UNIT READY");
2015 break;
2016
2017 /*
2018 * Although optional, this command is used by MS-Windows. We
2019 * support a minimal version: BytChk must be 0.
2020 */
2021 case VERIFY:
2022 common->data_size_from_cmnd = 0;
2023 reply = check_command(common, 10, DATA_DIR_NONE,
2024 (1<<1) | (0xf<<2) | (3<<7), 1,
2025 "VERIFY");
2026 if (reply == 0)
2027 reply = do_verify(common);
2028 break;
2029
2030 case WRITE_6:
2031 i = common->cmnd[4];
2032 common->data_size_from_cmnd = (i == 0) ? 256 : i;
2033 reply = check_command_size_in_blocks(common, 6,
2034 DATA_DIR_FROM_HOST,
2035 (7<<1) | (1<<4), 1,
2036 "WRITE(6)");
2037 if (reply == 0)
2038 reply = do_write(common);
2039 break;
2040
2041 case WRITE_10:
2042 common->data_size_from_cmnd =
2043 get_unaligned_be16(&common->cmnd[7]);
2044 reply = check_command_size_in_blocks(common, 10,
2045 DATA_DIR_FROM_HOST,
2046 (1<<1) | (0xf<<2) | (3<<7), 1,
2047 "WRITE(10)");
2048 if (reply == 0)
2049 reply = do_write(common);
2050 break;
2051
2052 case WRITE_12:
2053 common->data_size_from_cmnd =
2054 get_unaligned_be32(&common->cmnd[6]);
2055 reply = check_command_size_in_blocks(common, 12,
2056 DATA_DIR_FROM_HOST,
2057 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2058 "WRITE(12)");
2059 if (reply == 0)
2060 reply = do_write(common);
2061 break;
2062
2063 /*
2064 * Some mandatory commands that we recognize but don't implement.
2065 * They don't mean much in this setting. It's left as an exercise
2066 * for anyone interested to implement RESERVE and RELEASE in terms
2067 * of Posix locks.
2068 */
2069 case FORMAT_UNIT:
2070 case RELEASE:
2071 case RESERVE:
2072 case SEND_DIAGNOSTIC:
2073 /* Fall through */
2074
2075 default:
2076unknown_cmnd:
2077 common->data_size_from_cmnd = 0;
2078 sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
2079 reply = check_command(common, common->cmnd_size,
2080 DATA_DIR_UNKNOWN, ~0, 0, unknown);
2081 if (reply == 0) {
2082 common->curlun->sense_data = SS_INVALID_COMMAND;
2083 reply = -EINVAL;
2084 }
2085 break;
2086 }
2087 up_read(&common->filesem);
2088
2089 if (reply == -EINTR || signal_pending(current))
2090 return -EINTR;
2091
2092 /* Set up the single reply buffer for finish_reply() */
2093 if (reply == -EINVAL)
2094 reply = 0; /* Error reply length */
2095 if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
2096 reply = min((u32)reply, common->data_size_from_cmnd);
2097 bh->inreq->length = reply;
2098 bh->state = BUF_STATE_FULL;
2099 common->residue -= reply;
2100 } /* Otherwise it's already set */
2101
2102 return 0;
2103}
2104
2105
2106/*-------------------------------------------------------------------------*/
2107
2108static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2109{
2110 struct usb_request *req = bh->outreq;
2111 struct bulk_cb_wrap *cbw = req->buf;
2112 struct fsg_common *common = fsg->common;
2113
2114 /* Was this a real packet? Should it be ignored? */
2115 if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2116 return -EINVAL;
2117
2118 /* Is the CBW valid? */
2119 if (req->actual != US_BULK_CB_WRAP_LEN ||
2120 cbw->Signature != cpu_to_le32(
2121 US_BULK_CB_SIGN)) {
2122 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2123 req->actual,
2124 le32_to_cpu(cbw->Signature));
2125
2126 /*
2127 * The Bulk-only spec says we MUST stall the IN endpoint
2128 * (6.6.1), so it's unavoidable. It also says we must
2129 * retain this state until the next reset, but there's
2130 * no way to tell the controller driver it should ignore
2131 * Clear-Feature(HALT) requests.
2132 *
2133 * We aren't required to halt the OUT endpoint; instead
2134 * we can simply accept and discard any data received
2135 * until the next reset.
2136 */
2137 wedge_bulk_in_endpoint(fsg);
2138 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2139 return -EINVAL;
2140 }
2141
2142 /* Is the CBW meaningful? */
2143 if (cbw->Lun >= ARRAY_SIZE(common->luns) ||
2144 cbw->Flags & ~US_BULK_FLAG_IN || cbw->Length <= 0 ||
2145 cbw->Length > MAX_COMMAND_SIZE) {
2146 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2147 "cmdlen %u\n",
2148 cbw->Lun, cbw->Flags, cbw->Length);
2149
2150 /*
2151 * We can do anything we want here, so let's stall the
2152 * bulk pipes if we are allowed to.
2153 */
2154 if (common->can_stall) {
2155 fsg_set_halt(fsg, fsg->bulk_out);
2156 halt_bulk_in_endpoint(fsg);
2157 }
2158 return -EINVAL;
2159 }
2160
2161 /* Save the command for later */
2162 common->cmnd_size = cbw->Length;
2163 memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
2164 if (cbw->Flags & US_BULK_FLAG_IN)
2165 common->data_dir = DATA_DIR_TO_HOST;
2166 else
2167 common->data_dir = DATA_DIR_FROM_HOST;
2168 common->data_size = le32_to_cpu(cbw->DataTransferLength);
2169 if (common->data_size == 0)
2170 common->data_dir = DATA_DIR_NONE;
2171 common->lun = cbw->Lun;
2172 if (common->lun < ARRAY_SIZE(common->luns))
2173 common->curlun = common->luns[common->lun];
2174 else
2175 common->curlun = NULL;
2176 common->tag = cbw->Tag;
2177 return 0;
2178}
2179
2180static int get_next_command(struct fsg_common *common)
2181{
2182 struct fsg_buffhd *bh;
2183 int rc = 0;
2184
2185 /* Wait for the next buffer to become available */
2186 bh = common->next_buffhd_to_fill;
2187 while (bh->state != BUF_STATE_EMPTY) {
2188 rc = sleep_thread(common, true);
2189 if (rc)
2190 return rc;
2191 }
2192
2193 /* Queue a request to read a Bulk-only CBW */
2194 set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN);
2195 if (!start_out_transfer(common, bh))
2196 /* Don't know what to do if common->fsg is NULL */
2197 return -EIO;
2198
2199 /*
2200 * We will drain the buffer in software, which means we
2201 * can reuse it for the next filling. No need to advance
2202 * next_buffhd_to_fill.
2203 */
2204
2205 /* Wait for the CBW to arrive */
2206 while (bh->state != BUF_STATE_FULL) {
2207 rc = sleep_thread(common, true);
2208 if (rc)
2209 return rc;
2210 }
2211 smp_rmb();
2212 rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
2213 bh->state = BUF_STATE_EMPTY;
2214
2215 return rc;
2216}
2217
2218
2219/*-------------------------------------------------------------------------*/
2220
2221static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
2222 struct usb_request **preq)
2223{
2224 *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2225 if (*preq)
2226 return 0;
2227 ERROR(common, "can't allocate request for %s\n", ep->name);
2228 return -ENOMEM;
2229}
2230
2231/* Reset interface setting and re-init endpoint state (toggle etc). */
2232static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
2233{
2234 struct fsg_dev *fsg;
2235 int i, rc = 0;
2236
2237 if (common->running)
2238 DBG(common, "reset interface\n");
2239
2240reset:
2241 /* Deallocate the requests */
2242 if (common->fsg) {
2243 fsg = common->fsg;
2244
2245 for (i = 0; i < common->fsg_num_buffers; ++i) {
2246 struct fsg_buffhd *bh = &common->buffhds[i];
2247
2248 if (bh->inreq) {
2249 usb_ep_free_request(fsg->bulk_in, bh->inreq);
2250 bh->inreq = NULL;
2251 }
2252 if (bh->outreq) {
2253 usb_ep_free_request(fsg->bulk_out, bh->outreq);
2254 bh->outreq = NULL;
2255 }
2256 }
2257
2258 /* Disable the endpoints */
2259 if (fsg->bulk_in_enabled) {
2260 usb_ep_disable(fsg->bulk_in);
2261 fsg->bulk_in_enabled = 0;
2262 }
2263 if (fsg->bulk_out_enabled) {
2264 usb_ep_disable(fsg->bulk_out);
2265 fsg->bulk_out_enabled = 0;
2266 }
2267
2268 common->fsg = NULL;
2269 wake_up(&common->fsg_wait);
2270 }
2271
2272 common->running = 0;
2273 if (!new_fsg || rc)
2274 return rc;
2275
2276 common->fsg = new_fsg;
2277 fsg = common->fsg;
2278
2279 /* Enable the endpoints */
2280 rc = config_ep_by_speed(common->gadget, &(fsg->function), fsg->bulk_in);
2281 if (rc)
2282 goto reset;
2283 rc = usb_ep_enable(fsg->bulk_in);
2284 if (rc)
2285 goto reset;
2286 fsg->bulk_in->driver_data = common;
2287 fsg->bulk_in_enabled = 1;
2288
2289 rc = config_ep_by_speed(common->gadget, &(fsg->function),
2290 fsg->bulk_out);
2291 if (rc)
2292 goto reset;
2293 rc = usb_ep_enable(fsg->bulk_out);
2294 if (rc)
2295 goto reset;
2296 fsg->bulk_out->driver_data = common;
2297 fsg->bulk_out_enabled = 1;
2298 common->bulk_out_maxpacket = usb_endpoint_maxp(fsg->bulk_out->desc);
2299 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2300
2301 /* Allocate the requests */
2302 for (i = 0; i < common->fsg_num_buffers; ++i) {
2303 struct fsg_buffhd *bh = &common->buffhds[i];
2304
2305 rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
2306 if (rc)
2307 goto reset;
2308 rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
2309 if (rc)
2310 goto reset;
2311 bh->inreq->buf = bh->outreq->buf = bh->buf;
2312 bh->inreq->context = bh->outreq->context = bh;
2313 bh->inreq->complete = bulk_in_complete;
2314 bh->outreq->complete = bulk_out_complete;
2315 }
2316
2317 common->running = 1;
2318 for (i = 0; i < ARRAY_SIZE(common->luns); ++i)
2319 if (common->luns[i])
2320 common->luns[i]->unit_attention_data =
2321 SS_RESET_OCCURRED;
2322 return rc;
2323}
2324
2325
2326/****************************** ALT CONFIGS ******************************/
2327
2328static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2329{
2330 struct fsg_dev *fsg = fsg_from_func(f);
2331 fsg->common->new_fsg = fsg;
2332 raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2333 return USB_GADGET_DELAYED_STATUS;
2334}
2335
2336static void fsg_disable(struct usb_function *f)
2337{
2338 struct fsg_dev *fsg = fsg_from_func(f);
2339 fsg->common->new_fsg = NULL;
2340 raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2341}
2342
2343
2344/*-------------------------------------------------------------------------*/
2345
2346static void handle_exception(struct fsg_common *common)
2347{
2348 int i;
2349 struct fsg_buffhd *bh;
2350 enum fsg_state old_state;
2351 struct fsg_lun *curlun;
2352 unsigned int exception_req_tag;
2353
2354 /*
2355 * Clear the existing signals. Anything but SIGUSR1 is converted
2356 * into a high-priority EXIT exception.
2357 */
2358 for (;;) {
2359 int sig = kernel_dequeue_signal(NULL);
2360 if (!sig)
2361 break;
2362 if (sig != SIGUSR1) {
2363 if (common->state < FSG_STATE_EXIT)
2364 DBG(common, "Main thread exiting on signal\n");
2365 raise_exception(common, FSG_STATE_EXIT);
2366 }
2367 }
2368
2369 /* Cancel all the pending transfers */
2370 if (likely(common->fsg)) {
2371 for (i = 0; i < common->fsg_num_buffers; ++i) {
2372 bh = &common->buffhds[i];
2373 if (bh->inreq_busy)
2374 usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
2375 if (bh->outreq_busy)
2376 usb_ep_dequeue(common->fsg->bulk_out,
2377 bh->outreq);
2378 }
2379
2380 /* Wait until everything is idle */
2381 for (;;) {
2382 int num_active = 0;
2383 for (i = 0; i < common->fsg_num_buffers; ++i) {
2384 bh = &common->buffhds[i];
2385 num_active += bh->inreq_busy + bh->outreq_busy;
2386 }
2387 if (num_active == 0)
2388 break;
2389 if (sleep_thread(common, true))
2390 return;
2391 }
2392
2393 /* Clear out the controller's fifos */
2394 if (common->fsg->bulk_in_enabled)
2395 usb_ep_fifo_flush(common->fsg->bulk_in);
2396 if (common->fsg->bulk_out_enabled)
2397 usb_ep_fifo_flush(common->fsg->bulk_out);
2398 }
2399
2400 /*
2401 * Reset the I/O buffer states and pointers, the SCSI
2402 * state, and the exception. Then invoke the handler.
2403 */
2404 spin_lock_irq(&common->lock);
2405
2406 for (i = 0; i < common->fsg_num_buffers; ++i) {
2407 bh = &common->buffhds[i];
2408 bh->state = BUF_STATE_EMPTY;
2409 }
2410 common->next_buffhd_to_fill = &common->buffhds[0];
2411 common->next_buffhd_to_drain = &common->buffhds[0];
2412 exception_req_tag = common->exception_req_tag;
2413 old_state = common->state;
2414
2415 if (old_state == FSG_STATE_ABORT_BULK_OUT)
2416 common->state = FSG_STATE_STATUS_PHASE;
2417 else {
2418 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) {
2419 curlun = common->luns[i];
2420 if (!curlun)
2421 continue;
2422 curlun->prevent_medium_removal = 0;
2423 curlun->sense_data = SS_NO_SENSE;
2424 curlun->unit_attention_data = SS_NO_SENSE;
2425 curlun->sense_data_info = 0;
2426 curlun->info_valid = 0;
2427 }
2428 common->state = FSG_STATE_IDLE;
2429 }
2430 spin_unlock_irq(&common->lock);
2431
2432 /* Carry out any extra actions required for the exception */
2433 switch (old_state) {
2434 case FSG_STATE_ABORT_BULK_OUT:
2435 send_status(common);
2436 spin_lock_irq(&common->lock);
2437 if (common->state == FSG_STATE_STATUS_PHASE)
2438 common->state = FSG_STATE_IDLE;
2439 spin_unlock_irq(&common->lock);
2440 break;
2441
2442 case FSG_STATE_RESET:
2443 /*
2444 * In case we were forced against our will to halt a
2445 * bulk endpoint, clear the halt now. (The SuperH UDC
2446 * requires this.)
2447 */
2448 if (!fsg_is_set(common))
2449 break;
2450 if (test_and_clear_bit(IGNORE_BULK_OUT,
2451 &common->fsg->atomic_bitflags))
2452 usb_ep_clear_halt(common->fsg->bulk_in);
2453
2454 if (common->ep0_req_tag == exception_req_tag)
2455 ep0_queue(common); /* Complete the status stage */
2456
2457 /*
2458 * Technically this should go here, but it would only be
2459 * a waste of time. Ditto for the INTERFACE_CHANGE and
2460 * CONFIG_CHANGE cases.
2461 */
2462 /* for (i = 0; i < common->ARRAY_SIZE(common->luns); ++i) */
2463 /* if (common->luns[i]) */
2464 /* common->luns[i]->unit_attention_data = */
2465 /* SS_RESET_OCCURRED; */
2466 break;
2467
2468 case FSG_STATE_CONFIG_CHANGE:
2469 do_set_interface(common, common->new_fsg);
2470 if (common->new_fsg)
2471 usb_composite_setup_continue(common->cdev);
2472 break;
2473
2474 case FSG_STATE_EXIT:
2475 case FSG_STATE_TERMINATED:
2476 do_set_interface(common, NULL); /* Free resources */
2477 spin_lock_irq(&common->lock);
2478 common->state = FSG_STATE_TERMINATED; /* Stop the thread */
2479 spin_unlock_irq(&common->lock);
2480 break;
2481
2482 case FSG_STATE_INTERFACE_CHANGE:
2483 case FSG_STATE_DISCONNECT:
2484 case FSG_STATE_COMMAND_PHASE:
2485 case FSG_STATE_DATA_PHASE:
2486 case FSG_STATE_STATUS_PHASE:
2487 case FSG_STATE_IDLE:
2488 break;
2489 }
2490}
2491
2492
2493/*-------------------------------------------------------------------------*/
2494
2495static int fsg_main_thread(void *common_)
2496{
2497 struct fsg_common *common = common_;
2498
2499 /*
2500 * Allow the thread to be killed by a signal, but set the signal mask
2501 * to block everything but INT, TERM, KILL, and USR1.
2502 */
2503 allow_signal(SIGINT);
2504 allow_signal(SIGTERM);
2505 allow_signal(SIGKILL);
2506 allow_signal(SIGUSR1);
2507
2508 /* Allow the thread to be frozen */
2509 set_freezable();
2510
2511 /*
2512 * Arrange for userspace references to be interpreted as kernel
2513 * pointers. That way we can pass a kernel pointer to a routine
2514 * that expects a __user pointer and it will work okay.
2515 */
2516 set_fs(get_ds());
2517
2518 /* The main loop */
2519 while (common->state != FSG_STATE_TERMINATED) {
2520 if (exception_in_progress(common) || signal_pending(current)) {
2521 handle_exception(common);
2522 continue;
2523 }
2524
2525 if (!common->running) {
2526 sleep_thread(common, true);
2527 continue;
2528 }
2529
2530 if (get_next_command(common))
2531 continue;
2532
2533 spin_lock_irq(&common->lock);
2534 if (!exception_in_progress(common))
2535 common->state = FSG_STATE_DATA_PHASE;
2536 spin_unlock_irq(&common->lock);
2537
2538 if (do_scsi_command(common) || finish_reply(common))
2539 continue;
2540
2541 spin_lock_irq(&common->lock);
2542 if (!exception_in_progress(common))
2543 common->state = FSG_STATE_STATUS_PHASE;
2544 spin_unlock_irq(&common->lock);
2545
2546 if (send_status(common))
2547 continue;
2548
2549 spin_lock_irq(&common->lock);
2550 if (!exception_in_progress(common))
2551 common->state = FSG_STATE_IDLE;
2552 spin_unlock_irq(&common->lock);
2553 }
2554
2555 spin_lock_irq(&common->lock);
2556 common->thread_task = NULL;
2557 spin_unlock_irq(&common->lock);
2558
2559 if (!common->ops || !common->ops->thread_exits
2560 || common->ops->thread_exits(common) < 0) {
2561 int i;
2562
2563 down_write(&common->filesem);
2564 for (i = 0; i < ARRAY_SIZE(common->luns); --i) {
2565 struct fsg_lun *curlun = common->luns[i];
2566 if (!curlun || !fsg_lun_is_open(curlun))
2567 continue;
2568
2569 fsg_lun_close(curlun);
2570 curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
2571 }
2572 up_write(&common->filesem);
2573 }
2574
2575 /* Let fsg_unbind() know the thread has exited */
2576 complete_and_exit(&common->thread_notifier, 0);
2577}
2578
2579
2580/*************************** DEVICE ATTRIBUTES ***************************/
2581
2582static ssize_t ro_show(struct device *dev, struct device_attribute *attr, char *buf)
2583{
2584 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2585
2586 return fsg_show_ro(curlun, buf);
2587}
2588
2589static ssize_t nofua_show(struct device *dev, struct device_attribute *attr,
2590 char *buf)
2591{
2592 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2593
2594 return fsg_show_nofua(curlun, buf);
2595}
2596
2597static ssize_t file_show(struct device *dev, struct device_attribute *attr,
2598 char *buf)
2599{
2600 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2601 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2602
2603 return fsg_show_file(curlun, filesem, buf);
2604}
2605
2606static ssize_t ro_store(struct device *dev, struct device_attribute *attr,
2607 const char *buf, size_t count)
2608{
2609 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2610 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2611
2612 return fsg_store_ro(curlun, filesem, buf, count);
2613}
2614
2615static ssize_t nofua_store(struct device *dev, struct device_attribute *attr,
2616 const char *buf, size_t count)
2617{
2618 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2619
2620 return fsg_store_nofua(curlun, buf, count);
2621}
2622
2623static ssize_t file_store(struct device *dev, struct device_attribute *attr,
2624 const char *buf, size_t count)
2625{
2626 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2627 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2628
2629 return fsg_store_file(curlun, filesem, buf, count);
2630}
2631
2632static DEVICE_ATTR_RW(nofua);
2633/* mode wil be set in fsg_lun_attr_is_visible() */
2634static DEVICE_ATTR(ro, 0, ro_show, ro_store);
2635static DEVICE_ATTR(file, 0, file_show, file_store);
2636
2637/****************************** FSG COMMON ******************************/
2638
2639static void fsg_common_release(struct kref *ref);
2640
2641static void fsg_lun_release(struct device *dev)
2642{
2643 /* Nothing needs to be done */
2644}
2645
2646void fsg_common_get(struct fsg_common *common)
2647{
2648 kref_get(&common->ref);
2649}
2650EXPORT_SYMBOL_GPL(fsg_common_get);
2651
2652void fsg_common_put(struct fsg_common *common)
2653{
2654 kref_put(&common->ref, fsg_common_release);
2655}
2656EXPORT_SYMBOL_GPL(fsg_common_put);
2657
2658/* check if fsg_num_buffers is within a valid range */
2659static inline int fsg_num_buffers_validate(unsigned int fsg_num_buffers)
2660{
2661#define FSG_MAX_NUM_BUFFERS 32
2662
2663 if (fsg_num_buffers >= 2 && fsg_num_buffers <= FSG_MAX_NUM_BUFFERS)
2664 return 0;
2665 pr_err("fsg_num_buffers %u is out of range (%d to %d)\n",
2666 fsg_num_buffers, 2, FSG_MAX_NUM_BUFFERS);
2667 return -EINVAL;
2668}
2669
2670static struct fsg_common *fsg_common_setup(struct fsg_common *common)
2671{
2672 if (!common) {
2673 common = kzalloc(sizeof(*common), GFP_KERNEL);
2674 if (!common)
2675 return ERR_PTR(-ENOMEM);
2676 common->free_storage_on_release = 1;
2677 } else {
2678 common->free_storage_on_release = 0;
2679 }
2680 init_rwsem(&common->filesem);
2681 spin_lock_init(&common->lock);
2682 kref_init(&common->ref);
2683 init_completion(&common->thread_notifier);
2684 init_waitqueue_head(&common->fsg_wait);
2685 common->state = FSG_STATE_TERMINATED;
2686 memset(common->luns, 0, sizeof(common->luns));
2687
2688 return common;
2689}
2690
2691void fsg_common_set_sysfs(struct fsg_common *common, bool sysfs)
2692{
2693 common->sysfs = sysfs;
2694}
2695EXPORT_SYMBOL_GPL(fsg_common_set_sysfs);
2696
2697static void _fsg_common_free_buffers(struct fsg_buffhd *buffhds, unsigned n)
2698{
2699 if (buffhds) {
2700 struct fsg_buffhd *bh = buffhds;
2701 while (n--) {
2702 kfree(bh->buf);
2703 ++bh;
2704 }
2705 kfree(buffhds);
2706 }
2707}
2708
2709int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n)
2710{
2711 struct fsg_buffhd *bh, *buffhds;
2712 int i, rc;
2713
2714 rc = fsg_num_buffers_validate(n);
2715 if (rc != 0)
2716 return rc;
2717
2718 buffhds = kcalloc(n, sizeof(*buffhds), GFP_KERNEL);
2719 if (!buffhds)
2720 return -ENOMEM;
2721
2722 /* Data buffers cyclic list */
2723 bh = buffhds;
2724 i = n;
2725 goto buffhds_first_it;
2726 do {
2727 bh->next = bh + 1;
2728 ++bh;
2729buffhds_first_it:
2730 bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL);
2731 if (unlikely(!bh->buf))
2732 goto error_release;
2733 } while (--i);
2734 bh->next = buffhds;
2735
2736 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
2737 common->fsg_num_buffers = n;
2738 common->buffhds = buffhds;
2739
2740 return 0;
2741
2742error_release:
2743 /*
2744 * "buf"s pointed to by heads after n - i are NULL
2745 * so releasing them won't hurt
2746 */
2747 _fsg_common_free_buffers(buffhds, n);
2748
2749 return -ENOMEM;
2750}
2751EXPORT_SYMBOL_GPL(fsg_common_set_num_buffers);
2752
2753void fsg_common_remove_lun(struct fsg_lun *lun)
2754{
2755 if (device_is_registered(&lun->dev))
2756 device_unregister(&lun->dev);
2757 fsg_lun_close(lun);
2758 kfree(lun);
2759}
2760EXPORT_SYMBOL_GPL(fsg_common_remove_lun);
2761
2762static void _fsg_common_remove_luns(struct fsg_common *common, int n)
2763{
2764 int i;
2765
2766 for (i = 0; i < n; ++i)
2767 if (common->luns[i]) {
2768 fsg_common_remove_lun(common->luns[i]);
2769 common->luns[i] = NULL;
2770 }
2771}
2772
2773void fsg_common_remove_luns(struct fsg_common *common)
2774{
2775 _fsg_common_remove_luns(common, ARRAY_SIZE(common->luns));
2776}
2777EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
2778
2779void fsg_common_set_ops(struct fsg_common *common,
2780 const struct fsg_operations *ops)
2781{
2782 common->ops = ops;
2783}
2784EXPORT_SYMBOL_GPL(fsg_common_set_ops);
2785
2786void fsg_common_free_buffers(struct fsg_common *common)
2787{
2788 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
2789 common->buffhds = NULL;
2790}
2791EXPORT_SYMBOL_GPL(fsg_common_free_buffers);
2792
2793int fsg_common_set_cdev(struct fsg_common *common,
2794 struct usb_composite_dev *cdev, bool can_stall)
2795{
2796 struct usb_string *us;
2797
2798 common->gadget = cdev->gadget;
2799 common->ep0 = cdev->gadget->ep0;
2800 common->ep0req = cdev->req;
2801 common->cdev = cdev;
2802
2803 us = usb_gstrings_attach(cdev, fsg_strings_array,
2804 ARRAY_SIZE(fsg_strings));
2805 if (IS_ERR(us))
2806 return PTR_ERR(us);
2807
2808 fsg_intf_desc.iInterface = us[FSG_STRING_INTERFACE].id;
2809
2810 /*
2811 * Some peripheral controllers are known not to be able to
2812 * halt bulk endpoints correctly. If one of them is present,
2813 * disable stalls.
2814 */
2815 common->can_stall = can_stall &&
2816 gadget_is_stall_supported(common->gadget);
2817
2818 return 0;
2819}
2820EXPORT_SYMBOL_GPL(fsg_common_set_cdev);
2821
2822static struct attribute *fsg_lun_dev_attrs[] = {
2823 &dev_attr_ro.attr,
2824 &dev_attr_file.attr,
2825 &dev_attr_nofua.attr,
2826 NULL
2827};
2828
2829static umode_t fsg_lun_dev_is_visible(struct kobject *kobj,
2830 struct attribute *attr, int idx)
2831{
2832 struct device *dev = kobj_to_dev(kobj);
2833 struct fsg_lun *lun = fsg_lun_from_dev(dev);
2834
2835 if (attr == &dev_attr_ro.attr)
2836 return lun->cdrom ? S_IRUGO : (S_IWUSR | S_IRUGO);
2837 if (attr == &dev_attr_file.attr)
2838 return lun->removable ? (S_IWUSR | S_IRUGO) : S_IRUGO;
2839 return attr->mode;
2840}
2841
2842static const struct attribute_group fsg_lun_dev_group = {
2843 .attrs = fsg_lun_dev_attrs,
2844 .is_visible = fsg_lun_dev_is_visible,
2845};
2846
2847static const struct attribute_group *fsg_lun_dev_groups[] = {
2848 &fsg_lun_dev_group,
2849 NULL
2850};
2851
2852int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
2853 unsigned int id, const char *name,
2854 const char **name_pfx)
2855{
2856 struct fsg_lun *lun;
2857 char *pathbuf, *p;
2858 int rc = -ENOMEM;
2859
2860 if (id >= ARRAY_SIZE(common->luns))
2861 return -ENODEV;
2862
2863 if (common->luns[id])
2864 return -EBUSY;
2865
2866 if (!cfg->filename && !cfg->removable) {
2867 pr_err("no file given for LUN%d\n", id);
2868 return -EINVAL;
2869 }
2870
2871 lun = kzalloc(sizeof(*lun), GFP_KERNEL);
2872 if (!lun)
2873 return -ENOMEM;
2874
2875 lun->name_pfx = name_pfx;
2876
2877 lun->cdrom = !!cfg->cdrom;
2878 lun->ro = cfg->cdrom || cfg->ro;
2879 lun->initially_ro = lun->ro;
2880 lun->removable = !!cfg->removable;
2881
2882 if (!common->sysfs) {
2883 /* we DON'T own the name!*/
2884 lun->name = name;
2885 } else {
2886 lun->dev.release = fsg_lun_release;
2887 lun->dev.parent = &common->gadget->dev;
2888 lun->dev.groups = fsg_lun_dev_groups;
2889 dev_set_drvdata(&lun->dev, &common->filesem);
2890 dev_set_name(&lun->dev, "%s", name);
2891 lun->name = dev_name(&lun->dev);
2892
2893 rc = device_register(&lun->dev);
2894 if (rc) {
2895 pr_info("failed to register LUN%d: %d\n", id, rc);
2896 put_device(&lun->dev);
2897 goto error_sysfs;
2898 }
2899 }
2900
2901 common->luns[id] = lun;
2902
2903 if (cfg->filename) {
2904 rc = fsg_lun_open(lun, cfg->filename);
2905 if (rc)
2906 goto error_lun;
2907 }
2908
2909 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
2910 p = "(no medium)";
2911 if (fsg_lun_is_open(lun)) {
2912 p = "(error)";
2913 if (pathbuf) {
2914 p = file_path(lun->filp, pathbuf, PATH_MAX);
2915 if (IS_ERR(p))
2916 p = "(error)";
2917 }
2918 }
2919 pr_info("LUN: %s%s%sfile: %s\n",
2920 lun->removable ? "removable " : "",
2921 lun->ro ? "read only " : "",
2922 lun->cdrom ? "CD-ROM " : "",
2923 p);
2924 kfree(pathbuf);
2925
2926 return 0;
2927
2928error_lun:
2929 if (device_is_registered(&lun->dev))
2930 device_unregister(&lun->dev);
2931 fsg_lun_close(lun);
2932 common->luns[id] = NULL;
2933error_sysfs:
2934 kfree(lun);
2935 return rc;
2936}
2937EXPORT_SYMBOL_GPL(fsg_common_create_lun);
2938
2939int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg)
2940{
2941 char buf[8]; /* enough for 100000000 different numbers, decimal */
2942 int i, rc;
2943
2944 fsg_common_remove_luns(common);
2945
2946 for (i = 0; i < cfg->nluns; ++i) {
2947 snprintf(buf, sizeof(buf), "lun%d", i);
2948 rc = fsg_common_create_lun(common, &cfg->luns[i], i, buf, NULL);
2949 if (rc)
2950 goto fail;
2951 }
2952
2953 pr_info("Number of LUNs=%d\n", cfg->nluns);
2954
2955 return 0;
2956
2957fail:
2958 _fsg_common_remove_luns(common, i);
2959 return rc;
2960}
2961EXPORT_SYMBOL_GPL(fsg_common_create_luns);
2962
2963void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
2964 const char *pn)
2965{
2966 int i;
2967
2968 /* Prepare inquiryString */
2969 i = get_default_bcdDevice();
2970 snprintf(common->inquiry_string, sizeof(common->inquiry_string),
2971 "%-8s%-16s%04x", vn ?: "Linux",
2972 /* Assume product name dependent on the first LUN */
2973 pn ?: ((*common->luns)->cdrom
2974 ? "File-CD Gadget"
2975 : "File-Stor Gadget"),
2976 i);
2977}
2978EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string);
2979
2980int fsg_common_run_thread(struct fsg_common *common)
2981{
2982 common->state = FSG_STATE_IDLE;
2983 /* Tell the thread to start working */
2984 common->thread_task =
2985 kthread_create(fsg_main_thread, common, "file-storage");
2986 if (IS_ERR(common->thread_task)) {
2987 common->state = FSG_STATE_TERMINATED;
2988 return PTR_ERR(common->thread_task);
2989 }
2990
2991 DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
2992
2993 wake_up_process(common->thread_task);
2994
2995 return 0;
2996}
2997EXPORT_SYMBOL_GPL(fsg_common_run_thread);
2998
2999static void fsg_common_release(struct kref *ref)
3000{
3001 struct fsg_common *common = container_of(ref, struct fsg_common, ref);
3002 int i;
3003
3004 /* If the thread isn't already dead, tell it to exit now */
3005 if (common->state != FSG_STATE_TERMINATED) {
3006 raise_exception(common, FSG_STATE_EXIT);
3007 wait_for_completion(&common->thread_notifier);
3008 }
3009
3010 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) {
3011 struct fsg_lun *lun = common->luns[i];
3012 if (!lun)
3013 continue;
3014 fsg_lun_close(lun);
3015 if (device_is_registered(&lun->dev))
3016 device_unregister(&lun->dev);
3017 kfree(lun);
3018 }
3019
3020 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
3021 if (common->free_storage_on_release)
3022 kfree(common);
3023}
3024
3025
3026/*-------------------------------------------------------------------------*/
3027
3028static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
3029{
3030 struct fsg_dev *fsg = fsg_from_func(f);
3031 struct fsg_common *common = fsg->common;
3032 struct usb_gadget *gadget = c->cdev->gadget;
3033 int i;
3034 struct usb_ep *ep;
3035 unsigned max_burst;
3036 int ret;
3037 struct fsg_opts *opts;
3038
3039 /* Don't allow to bind if we don't have at least one LUN */
3040 ret = _fsg_common_get_max_lun(common);
3041 if (ret < 0) {
3042 pr_err("There should be at least one LUN.\n");
3043 return -EINVAL;
3044 }
3045
3046 opts = fsg_opts_from_func_inst(f->fi);
3047 if (!opts->no_configfs) {
3048 ret = fsg_common_set_cdev(fsg->common, c->cdev,
3049 fsg->common->can_stall);
3050 if (ret)
3051 return ret;
3052 fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
3053 ret = fsg_common_run_thread(fsg->common);
3054 if (ret)
3055 return ret;
3056 }
3057
3058 fsg->gadget = gadget;
3059
3060 /* New interface */
3061 i = usb_interface_id(c, f);
3062 if (i < 0)
3063 goto fail;
3064 fsg_intf_desc.bInterfaceNumber = i;
3065 fsg->interface_number = i;
3066
3067 /* Find all the endpoints we will use */
3068 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
3069 if (!ep)
3070 goto autoconf_fail;
3071 fsg->bulk_in = ep;
3072
3073 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
3074 if (!ep)
3075 goto autoconf_fail;
3076 fsg->bulk_out = ep;
3077
3078 /* Assume endpoint addresses are the same for both speeds */
3079 fsg_hs_bulk_in_desc.bEndpointAddress =
3080 fsg_fs_bulk_in_desc.bEndpointAddress;
3081 fsg_hs_bulk_out_desc.bEndpointAddress =
3082 fsg_fs_bulk_out_desc.bEndpointAddress;
3083
3084 /* Calculate bMaxBurst, we know packet size is 1024 */
3085 max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15);
3086
3087 fsg_ss_bulk_in_desc.bEndpointAddress =
3088 fsg_fs_bulk_in_desc.bEndpointAddress;
3089 fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
3090
3091 fsg_ss_bulk_out_desc.bEndpointAddress =
3092 fsg_fs_bulk_out_desc.bEndpointAddress;
3093 fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
3094
3095 ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function,
3096 fsg_ss_function, fsg_ss_function);
3097 if (ret)
3098 goto autoconf_fail;
3099
3100 return 0;
3101
3102autoconf_fail:
3103 ERROR(fsg, "unable to autoconfigure all endpoints\n");
3104 i = -ENOTSUPP;
3105fail:
3106 /* terminate the thread */
3107 if (fsg->common->state != FSG_STATE_TERMINATED) {
3108 raise_exception(fsg->common, FSG_STATE_EXIT);
3109 wait_for_completion(&fsg->common->thread_notifier);
3110 }
3111 return i;
3112}
3113
3114/****************************** ALLOCATE FUNCTION *************************/
3115
3116static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
3117{
3118 struct fsg_dev *fsg = fsg_from_func(f);
3119 struct fsg_common *common = fsg->common;
3120
3121 DBG(fsg, "unbind\n");
3122 if (fsg->common->fsg == fsg) {
3123 fsg->common->new_fsg = NULL;
3124 raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
3125 /* FIXME: make interruptible or killable somehow? */
3126 wait_event(common->fsg_wait, common->fsg != fsg);
3127 }
3128
3129 usb_free_all_descriptors(&fsg->function);
3130}
3131
3132static inline struct fsg_lun_opts *to_fsg_lun_opts(struct config_item *item)
3133{
3134 return container_of(to_config_group(item), struct fsg_lun_opts, group);
3135}
3136
3137static inline struct fsg_opts *to_fsg_opts(struct config_item *item)
3138{
3139 return container_of(to_config_group(item), struct fsg_opts,
3140 func_inst.group);
3141}
3142
3143static void fsg_lun_attr_release(struct config_item *item)
3144{
3145 struct fsg_lun_opts *lun_opts;
3146
3147 lun_opts = to_fsg_lun_opts(item);
3148 kfree(lun_opts);
3149}
3150
3151static struct configfs_item_operations fsg_lun_item_ops = {
3152 .release = fsg_lun_attr_release,
3153};
3154
3155static ssize_t fsg_lun_opts_file_show(struct config_item *item, char *page)
3156{
3157 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3158 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3159
3160 return fsg_show_file(opts->lun, &fsg_opts->common->filesem, page);
3161}
3162
3163static ssize_t fsg_lun_opts_file_store(struct config_item *item,
3164 const char *page, size_t len)
3165{
3166 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3167 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3168
3169 return fsg_store_file(opts->lun, &fsg_opts->common->filesem, page, len);
3170}
3171
3172CONFIGFS_ATTR(fsg_lun_opts_, file);
3173
3174static ssize_t fsg_lun_opts_ro_show(struct config_item *item, char *page)
3175{
3176 return fsg_show_ro(to_fsg_lun_opts(item)->lun, page);
3177}
3178
3179static ssize_t fsg_lun_opts_ro_store(struct config_item *item,
3180 const char *page, size_t len)
3181{
3182 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3183 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3184
3185 return fsg_store_ro(opts->lun, &fsg_opts->common->filesem, page, len);
3186}
3187
3188CONFIGFS_ATTR(fsg_lun_opts_, ro);
3189
3190static ssize_t fsg_lun_opts_removable_show(struct config_item *item,
3191 char *page)
3192{
3193 return fsg_show_removable(to_fsg_lun_opts(item)->lun, page);
3194}
3195
3196static ssize_t fsg_lun_opts_removable_store(struct config_item *item,
3197 const char *page, size_t len)
3198{
3199 return fsg_store_removable(to_fsg_lun_opts(item)->lun, page, len);
3200}
3201
3202CONFIGFS_ATTR(fsg_lun_opts_, removable);
3203
3204static ssize_t fsg_lun_opts_cdrom_show(struct config_item *item, char *page)
3205{
3206 return fsg_show_cdrom(to_fsg_lun_opts(item)->lun, page);
3207}
3208
3209static ssize_t fsg_lun_opts_cdrom_store(struct config_item *item,
3210 const char *page, size_t len)
3211{
3212 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3213 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3214
3215 return fsg_store_cdrom(opts->lun, &fsg_opts->common->filesem, page,
3216 len);
3217}
3218
3219CONFIGFS_ATTR(fsg_lun_opts_, cdrom);
3220
3221static ssize_t fsg_lun_opts_nofua_show(struct config_item *item, char *page)
3222{
3223 return fsg_show_nofua(to_fsg_lun_opts(item)->lun, page);
3224}
3225
3226static ssize_t fsg_lun_opts_nofua_store(struct config_item *item,
3227 const char *page, size_t len)
3228{
3229 return fsg_store_nofua(to_fsg_lun_opts(item)->lun, page, len);
3230}
3231
3232CONFIGFS_ATTR(fsg_lun_opts_, nofua);
3233
3234static struct configfs_attribute *fsg_lun_attrs[] = {
3235 &fsg_lun_opts_attr_file,
3236 &fsg_lun_opts_attr_ro,
3237 &fsg_lun_opts_attr_removable,
3238 &fsg_lun_opts_attr_cdrom,
3239 &fsg_lun_opts_attr_nofua,
3240 NULL,
3241};
3242
3243static struct config_item_type fsg_lun_type = {
3244 .ct_item_ops = &fsg_lun_item_ops,
3245 .ct_attrs = fsg_lun_attrs,
3246 .ct_owner = THIS_MODULE,
3247};
3248
3249static struct config_group *fsg_lun_make(struct config_group *group,
3250 const char *name)
3251{
3252 struct fsg_lun_opts *opts;
3253 struct fsg_opts *fsg_opts;
3254 struct fsg_lun_config config;
3255 char *num_str;
3256 u8 num;
3257 int ret;
3258
3259 num_str = strchr(name, '.');
3260 if (!num_str) {
3261 pr_err("Unable to locate . in LUN.NUMBER\n");
3262 return ERR_PTR(-EINVAL);
3263 }
3264 num_str++;
3265
3266 ret = kstrtou8(num_str, 0, &num);
3267 if (ret)
3268 return ERR_PTR(ret);
3269
3270 fsg_opts = to_fsg_opts(&group->cg_item);
3271 if (num >= FSG_MAX_LUNS)
3272 return ERR_PTR(-ERANGE);
3273
3274 mutex_lock(&fsg_opts->lock);
3275 if (fsg_opts->refcnt || fsg_opts->common->luns[num]) {
3276 ret = -EBUSY;
3277 goto out;
3278 }
3279
3280 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3281 if (!opts) {
3282 ret = -ENOMEM;
3283 goto out;
3284 }
3285
3286 memset(&config, 0, sizeof(config));
3287 config.removable = true;
3288
3289 ret = fsg_common_create_lun(fsg_opts->common, &config, num, name,
3290 (const char **)&group->cg_item.ci_name);
3291 if (ret) {
3292 kfree(opts);
3293 goto out;
3294 }
3295 opts->lun = fsg_opts->common->luns[num];
3296 opts->lun_id = num;
3297 mutex_unlock(&fsg_opts->lock);
3298
3299 config_group_init_type_name(&opts->group, name, &fsg_lun_type);
3300
3301 return &opts->group;
3302out:
3303 mutex_unlock(&fsg_opts->lock);
3304 return ERR_PTR(ret);
3305}
3306
3307static void fsg_lun_drop(struct config_group *group, struct config_item *item)
3308{
3309 struct fsg_lun_opts *lun_opts;
3310 struct fsg_opts *fsg_opts;
3311
3312 lun_opts = to_fsg_lun_opts(item);
3313 fsg_opts = to_fsg_opts(&group->cg_item);
3314
3315 mutex_lock(&fsg_opts->lock);
3316 if (fsg_opts->refcnt) {
3317 struct config_item *gadget;
3318
3319 gadget = group->cg_item.ci_parent->ci_parent;
3320 unregister_gadget_item(gadget);
3321 }
3322
3323 fsg_common_remove_lun(lun_opts->lun);
3324 fsg_opts->common->luns[lun_opts->lun_id] = NULL;
3325 lun_opts->lun_id = 0;
3326 mutex_unlock(&fsg_opts->lock);
3327
3328 config_item_put(item);
3329}
3330
3331static void fsg_attr_release(struct config_item *item)
3332{
3333 struct fsg_opts *opts = to_fsg_opts(item);
3334
3335 usb_put_function_instance(&opts->func_inst);
3336}
3337
3338static struct configfs_item_operations fsg_item_ops = {
3339 .release = fsg_attr_release,
3340};
3341
3342static ssize_t fsg_opts_stall_show(struct config_item *item, char *page)
3343{
3344 struct fsg_opts *opts = to_fsg_opts(item);
3345 int result;
3346
3347 mutex_lock(&opts->lock);
3348 result = sprintf(page, "%d", opts->common->can_stall);
3349 mutex_unlock(&opts->lock);
3350
3351 return result;
3352}
3353
3354static ssize_t fsg_opts_stall_store(struct config_item *item, const char *page,
3355 size_t len)
3356{
3357 struct fsg_opts *opts = to_fsg_opts(item);
3358 int ret;
3359 bool stall;
3360
3361 mutex_lock(&opts->lock);
3362
3363 if (opts->refcnt) {
3364 mutex_unlock(&opts->lock);
3365 return -EBUSY;
3366 }
3367
3368 ret = strtobool(page, &stall);
3369 if (!ret) {
3370 opts->common->can_stall = stall;
3371 ret = len;
3372 }
3373
3374 mutex_unlock(&opts->lock);
3375
3376 return ret;
3377}
3378
3379CONFIGFS_ATTR(fsg_opts_, stall);
3380
3381#ifdef CONFIG_USB_GADGET_DEBUG_FILES
3382static ssize_t fsg_opts_num_buffers_show(struct config_item *item, char *page)
3383{
3384 struct fsg_opts *opts = to_fsg_opts(item);
3385 int result;
3386
3387 mutex_lock(&opts->lock);
3388 result = sprintf(page, "%d", opts->common->fsg_num_buffers);
3389 mutex_unlock(&opts->lock);
3390
3391 return result;
3392}
3393
3394static ssize_t fsg_opts_num_buffers_store(struct config_item *item,
3395 const char *page, size_t len)
3396{
3397 struct fsg_opts *opts = to_fsg_opts(item);
3398 int ret;
3399 u8 num;
3400
3401 mutex_lock(&opts->lock);
3402 if (opts->refcnt) {
3403 ret = -EBUSY;
3404 goto end;
3405 }
3406 ret = kstrtou8(page, 0, &num);
3407 if (ret)
3408 goto end;
3409
3410 ret = fsg_num_buffers_validate(num);
3411 if (ret)
3412 goto end;
3413
3414 fsg_common_set_num_buffers(opts->common, num);
3415 ret = len;
3416
3417end:
3418 mutex_unlock(&opts->lock);
3419 return ret;
3420}
3421
3422CONFIGFS_ATTR(fsg_opts_, num_buffers);
3423#endif
3424
3425static struct configfs_attribute *fsg_attrs[] = {
3426 &fsg_opts_attr_stall,
3427#ifdef CONFIG_USB_GADGET_DEBUG_FILES
3428 &fsg_opts_attr_num_buffers,
3429#endif
3430 NULL,
3431};
3432
3433static struct configfs_group_operations fsg_group_ops = {
3434 .make_group = fsg_lun_make,
3435 .drop_item = fsg_lun_drop,
3436};
3437
3438static struct config_item_type fsg_func_type = {
3439 .ct_item_ops = &fsg_item_ops,
3440 .ct_group_ops = &fsg_group_ops,
3441 .ct_attrs = fsg_attrs,
3442 .ct_owner = THIS_MODULE,
3443};
3444
3445static void fsg_free_inst(struct usb_function_instance *fi)
3446{
3447 struct fsg_opts *opts;
3448
3449 opts = fsg_opts_from_func_inst(fi);
3450 fsg_common_put(opts->common);
3451 kfree(opts);
3452}
3453
3454static struct usb_function_instance *fsg_alloc_inst(void)
3455{
3456 struct fsg_opts *opts;
3457 struct fsg_lun_config config;
3458 int rc;
3459
3460 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3461 if (!opts)
3462 return ERR_PTR(-ENOMEM);
3463 mutex_init(&opts->lock);
3464 opts->func_inst.free_func_inst = fsg_free_inst;
3465 opts->common = fsg_common_setup(opts->common);
3466 if (IS_ERR(opts->common)) {
3467 rc = PTR_ERR(opts->common);
3468 goto release_opts;
3469 }
3470
3471 rc = fsg_common_set_num_buffers(opts->common,
3472 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS);
3473 if (rc)
3474 goto release_opts;
3475
3476 pr_info(FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
3477
3478 memset(&config, 0, sizeof(config));
3479 config.removable = true;
3480 rc = fsg_common_create_lun(opts->common, &config, 0, "lun.0",
3481 (const char **)&opts->func_inst.group.cg_item.ci_name);
3482 if (rc)
3483 goto release_buffers;
3484
3485 opts->lun0.lun = opts->common->luns[0];
3486 opts->lun0.lun_id = 0;
3487
3488 config_group_init_type_name(&opts->func_inst.group, "", &fsg_func_type);
3489
3490 config_group_init_type_name(&opts->lun0.group, "lun.0", &fsg_lun_type);
3491 configfs_add_default_group(&opts->lun0.group, &opts->func_inst.group);
3492
3493 return &opts->func_inst;
3494
3495release_buffers:
3496 fsg_common_free_buffers(opts->common);
3497release_opts:
3498 kfree(opts);
3499 return ERR_PTR(rc);
3500}
3501
3502static void fsg_free(struct usb_function *f)
3503{
3504 struct fsg_dev *fsg;
3505 struct fsg_opts *opts;
3506
3507 fsg = container_of(f, struct fsg_dev, function);
3508 opts = container_of(f->fi, struct fsg_opts, func_inst);
3509
3510 mutex_lock(&opts->lock);
3511 opts->refcnt--;
3512 mutex_unlock(&opts->lock);
3513
3514 kfree(fsg);
3515}
3516
3517static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
3518{
3519 struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
3520 struct fsg_common *common = opts->common;
3521 struct fsg_dev *fsg;
3522
3523 fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
3524 if (unlikely(!fsg))
3525 return ERR_PTR(-ENOMEM);
3526
3527 mutex_lock(&opts->lock);
3528 opts->refcnt++;
3529 mutex_unlock(&opts->lock);
3530
3531 fsg->function.name = FSG_DRIVER_DESC;
3532 fsg->function.bind = fsg_bind;
3533 fsg->function.unbind = fsg_unbind;
3534 fsg->function.setup = fsg_setup;
3535 fsg->function.set_alt = fsg_set_alt;
3536 fsg->function.disable = fsg_disable;
3537 fsg->function.free_func = fsg_free;
3538
3539 fsg->common = common;
3540
3541 return &fsg->function;
3542}
3543
3544DECLARE_USB_FUNCTION_INIT(mass_storage, fsg_alloc_inst, fsg_alloc);
3545MODULE_LICENSE("GPL");
3546MODULE_AUTHOR("Michal Nazarewicz");
3547
3548/************************* Module parameters *************************/
3549
3550
3551void fsg_config_from_params(struct fsg_config *cfg,
3552 const struct fsg_module_parameters *params,
3553 unsigned int fsg_num_buffers)
3554{
3555 struct fsg_lun_config *lun;
3556 unsigned i;
3557
3558 /* Configure LUNs */
3559 cfg->nluns =
3560 min(params->luns ?: (params->file_count ?: 1u),
3561 (unsigned)FSG_MAX_LUNS);
3562 for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) {
3563 lun->ro = !!params->ro[i];
3564 lun->cdrom = !!params->cdrom[i];
3565 lun->removable = !!params->removable[i];
3566 lun->filename =
3567 params->file_count > i && params->file[i][0]
3568 ? params->file[i]
3569 : NULL;
3570 }
3571
3572 /* Let MSF use defaults */
3573 cfg->vendor_name = NULL;
3574 cfg->product_name = NULL;
3575
3576 cfg->ops = NULL;
3577 cfg->private_data = NULL;
3578
3579 /* Finalise */
3580 cfg->can_stall = params->stall;
3581 cfg->fsg_num_buffers = fsg_num_buffers;
3582}
3583EXPORT_SYMBOL_GPL(fsg_config_from_params);
1// SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause)
2/*
3 * f_mass_storage.c -- Mass Storage USB Composite Function
4 *
5 * Copyright (C) 2003-2008 Alan Stern
6 * Copyright (C) 2009 Samsung Electronics
7 * Author: Michal Nazarewicz <mina86@mina86.com>
8 * All rights reserved.
9 */
10
11/*
12 * The Mass Storage Function acts as a USB Mass Storage device,
13 * appearing to the host as a disk drive or as a CD-ROM drive. In
14 * addition to providing an example of a genuinely useful composite
15 * function for a USB device, it also illustrates a technique of
16 * double-buffering for increased throughput.
17 *
18 * For more information about MSF and in particular its module
19 * parameters and sysfs interface read the
20 * <Documentation/usb/mass-storage.rst> file.
21 */
22
23/*
24 * MSF is configured by specifying a fsg_config structure. It has the
25 * following fields:
26 *
27 * nluns Number of LUNs function have (anywhere from 1
28 * to FSG_MAX_LUNS).
29 * luns An array of LUN configuration values. This
30 * should be filled for each LUN that
31 * function will include (ie. for "nluns"
32 * LUNs). Each element of the array has
33 * the following fields:
34 * ->filename The path to the backing file for the LUN.
35 * Required if LUN is not marked as
36 * removable.
37 * ->ro Flag specifying access to the LUN shall be
38 * read-only. This is implied if CD-ROM
39 * emulation is enabled as well as when
40 * it was impossible to open "filename"
41 * in R/W mode.
42 * ->removable Flag specifying that LUN shall be indicated as
43 * being removable.
44 * ->cdrom Flag specifying that LUN shall be reported as
45 * being a CD-ROM.
46 * ->nofua Flag specifying that FUA flag in SCSI WRITE(10,12)
47 * commands for this LUN shall be ignored.
48 *
49 * vendor_name
50 * product_name
51 * release Information used as a reply to INQUIRY
52 * request. To use default set to NULL,
53 * NULL, 0xffff respectively. The first
54 * field should be 8 and the second 16
55 * characters or less.
56 *
57 * can_stall Set to permit function to halt bulk endpoints.
58 * Disabled on some USB devices known not
59 * to work correctly. You should set it
60 * to true.
61 *
62 * If "removable" is not set for a LUN then a backing file must be
63 * specified. If it is set, then NULL filename means the LUN's medium
64 * is not loaded (an empty string as "filename" in the fsg_config
65 * structure causes error). The CD-ROM emulation includes a single
66 * data track and no audio tracks; hence there need be only one
67 * backing file per LUN.
68 *
69 * This function is heavily based on "File-backed Storage Gadget" by
70 * Alan Stern which in turn is heavily based on "Gadget Zero" by David
71 * Brownell. The driver's SCSI command interface was based on the
72 * "Information technology - Small Computer System Interface - 2"
73 * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
74 * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
75 * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
76 * was based on the "Universal Serial Bus Mass Storage Class UFI
77 * Command Specification" document, Revision 1.0, December 14, 1998,
78 * available at
79 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
80 */
81
82/*
83 * Driver Design
84 *
85 * The MSF is fairly straightforward. There is a main kernel
86 * thread that handles most of the work. Interrupt routines field
87 * callbacks from the controller driver: bulk- and interrupt-request
88 * completion notifications, endpoint-0 events, and disconnect events.
89 * Completion events are passed to the main thread by wakeup calls. Many
90 * ep0 requests are handled at interrupt time, but SetInterface,
91 * SetConfiguration, and device reset requests are forwarded to the
92 * thread in the form of "exceptions" using SIGUSR1 signals (since they
93 * should interrupt any ongoing file I/O operations).
94 *
95 * The thread's main routine implements the standard command/data/status
96 * parts of a SCSI interaction. It and its subroutines are full of tests
97 * for pending signals/exceptions -- all this polling is necessary since
98 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
99 * indication that the driver really wants to be running in userspace.)
100 * An important point is that so long as the thread is alive it keeps an
101 * open reference to the backing file. This will prevent unmounting
102 * the backing file's underlying filesystem and could cause problems
103 * during system shutdown, for example. To prevent such problems, the
104 * thread catches INT, TERM, and KILL signals and converts them into
105 * an EXIT exception.
106 *
107 * In normal operation the main thread is started during the gadget's
108 * fsg_bind() callback and stopped during fsg_unbind(). But it can
109 * also exit when it receives a signal, and there's no point leaving
110 * the gadget running when the thread is dead. As of this moment, MSF
111 * provides no way to deregister the gadget when thread dies -- maybe
112 * a callback functions is needed.
113 *
114 * To provide maximum throughput, the driver uses a circular pipeline of
115 * buffer heads (struct fsg_buffhd). In principle the pipeline can be
116 * arbitrarily long; in practice the benefits don't justify having more
117 * than 2 stages (i.e., double buffering). But it helps to think of the
118 * pipeline as being a long one. Each buffer head contains a bulk-in and
119 * a bulk-out request pointer (since the buffer can be used for both
120 * output and input -- directions always are given from the host's
121 * point of view) as well as a pointer to the buffer and various state
122 * variables.
123 *
124 * Use of the pipeline follows a simple protocol. There is a variable
125 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
126 * At any time that buffer head may still be in use from an earlier
127 * request, so each buffer head has a state variable indicating whether
128 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
129 * buffer head to be EMPTY, filling the buffer either by file I/O or by
130 * USB I/O (during which the buffer head is BUSY), and marking the buffer
131 * head FULL when the I/O is complete. Then the buffer will be emptied
132 * (again possibly by USB I/O, during which it is marked BUSY) and
133 * finally marked EMPTY again (possibly by a completion routine).
134 *
135 * A module parameter tells the driver to avoid stalling the bulk
136 * endpoints wherever the transport specification allows. This is
137 * necessary for some UDCs like the SuperH, which cannot reliably clear a
138 * halt on a bulk endpoint. However, under certain circumstances the
139 * Bulk-only specification requires a stall. In such cases the driver
140 * will halt the endpoint and set a flag indicating that it should clear
141 * the halt in software during the next device reset. Hopefully this
142 * will permit everything to work correctly. Furthermore, although the
143 * specification allows the bulk-out endpoint to halt when the host sends
144 * too much data, implementing this would cause an unavoidable race.
145 * The driver will always use the "no-stall" approach for OUT transfers.
146 *
147 * One subtle point concerns sending status-stage responses for ep0
148 * requests. Some of these requests, such as device reset, can involve
149 * interrupting an ongoing file I/O operation, which might take an
150 * arbitrarily long time. During that delay the host might give up on
151 * the original ep0 request and issue a new one. When that happens the
152 * driver should not notify the host about completion of the original
153 * request, as the host will no longer be waiting for it. So the driver
154 * assigns to each ep0 request a unique tag, and it keeps track of the
155 * tag value of the request associated with a long-running exception
156 * (device-reset, interface-change, or configuration-change). When the
157 * exception handler is finished, the status-stage response is submitted
158 * only if the current ep0 request tag is equal to the exception request
159 * tag. Thus only the most recently received ep0 request will get a
160 * status-stage response.
161 *
162 * Warning: This driver source file is too long. It ought to be split up
163 * into a header file plus about 3 separate .c files, to handle the details
164 * of the Gadget, USB Mass Storage, and SCSI protocols.
165 */
166
167
168/* #define VERBOSE_DEBUG */
169/* #define DUMP_MSGS */
170
171#include <linux/blkdev.h>
172#include <linux/completion.h>
173#include <linux/dcache.h>
174#include <linux/delay.h>
175#include <linux/device.h>
176#include <linux/fcntl.h>
177#include <linux/file.h>
178#include <linux/fs.h>
179#include <linux/kstrtox.h>
180#include <linux/kthread.h>
181#include <linux/sched/signal.h>
182#include <linux/limits.h>
183#include <linux/pagemap.h>
184#include <linux/rwsem.h>
185#include <linux/slab.h>
186#include <linux/spinlock.h>
187#include <linux/string.h>
188#include <linux/freezer.h>
189#include <linux/module.h>
190#include <linux/uaccess.h>
191#include <asm/unaligned.h>
192
193#include <linux/usb/ch9.h>
194#include <linux/usb/gadget.h>
195#include <linux/usb/composite.h>
196
197#include <linux/nospec.h>
198
199#include "configfs.h"
200
201
202/*------------------------------------------------------------------------*/
203
204#define FSG_DRIVER_DESC "Mass Storage Function"
205#define FSG_DRIVER_VERSION "2009/09/11"
206
207static const char fsg_string_interface[] = "Mass Storage";
208
209#include "storage_common.h"
210#include "f_mass_storage.h"
211
212/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
213static struct usb_string fsg_strings[] = {
214 {FSG_STRING_INTERFACE, fsg_string_interface},
215 {}
216};
217
218static struct usb_gadget_strings fsg_stringtab = {
219 .language = 0x0409, /* en-us */
220 .strings = fsg_strings,
221};
222
223static struct usb_gadget_strings *fsg_strings_array[] = {
224 &fsg_stringtab,
225 NULL,
226};
227
228/*-------------------------------------------------------------------------*/
229
230struct fsg_dev;
231struct fsg_common;
232
233/* Data shared by all the FSG instances. */
234struct fsg_common {
235 struct usb_gadget *gadget;
236 struct usb_composite_dev *cdev;
237 struct fsg_dev *fsg;
238 wait_queue_head_t io_wait;
239 wait_queue_head_t fsg_wait;
240
241 /* filesem protects: backing files in use */
242 struct rw_semaphore filesem;
243
244 /* lock protects: state and thread_task */
245 spinlock_t lock;
246
247 struct usb_ep *ep0; /* Copy of gadget->ep0 */
248 struct usb_request *ep0req; /* Copy of cdev->req */
249 unsigned int ep0_req_tag;
250
251 struct fsg_buffhd *next_buffhd_to_fill;
252 struct fsg_buffhd *next_buffhd_to_drain;
253 struct fsg_buffhd *buffhds;
254 unsigned int fsg_num_buffers;
255
256 int cmnd_size;
257 u8 cmnd[MAX_COMMAND_SIZE];
258
259 unsigned int lun;
260 struct fsg_lun *luns[FSG_MAX_LUNS];
261 struct fsg_lun *curlun;
262
263 unsigned int bulk_out_maxpacket;
264 enum fsg_state state; /* For exception handling */
265 unsigned int exception_req_tag;
266 void *exception_arg;
267
268 enum data_direction data_dir;
269 u32 data_size;
270 u32 data_size_from_cmnd;
271 u32 tag;
272 u32 residue;
273 u32 usb_amount_left;
274
275 unsigned int can_stall:1;
276 unsigned int free_storage_on_release:1;
277 unsigned int phase_error:1;
278 unsigned int short_packet_received:1;
279 unsigned int bad_lun_okay:1;
280 unsigned int running:1;
281 unsigned int sysfs:1;
282
283 struct completion thread_notifier;
284 struct task_struct *thread_task;
285
286 /* Gadget's private data. */
287 void *private_data;
288
289 char inquiry_string[INQUIRY_STRING_LEN];
290};
291
292struct fsg_dev {
293 struct usb_function function;
294 struct usb_gadget *gadget; /* Copy of cdev->gadget */
295 struct fsg_common *common;
296
297 u16 interface_number;
298
299 unsigned int bulk_in_enabled:1;
300 unsigned int bulk_out_enabled:1;
301
302 unsigned long atomic_bitflags;
303#define IGNORE_BULK_OUT 0
304
305 struct usb_ep *bulk_in;
306 struct usb_ep *bulk_out;
307};
308
309static inline int __fsg_is_set(struct fsg_common *common,
310 const char *func, unsigned line)
311{
312 if (common->fsg)
313 return 1;
314 ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
315 WARN_ON(1);
316 return 0;
317}
318
319#define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
320
321static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
322{
323 return container_of(f, struct fsg_dev, function);
324}
325
326static int exception_in_progress(struct fsg_common *common)
327{
328 return common->state > FSG_STATE_NORMAL;
329}
330
331/* Make bulk-out requests be divisible by the maxpacket size */
332static void set_bulk_out_req_length(struct fsg_common *common,
333 struct fsg_buffhd *bh, unsigned int length)
334{
335 unsigned int rem;
336
337 bh->bulk_out_intended_length = length;
338 rem = length % common->bulk_out_maxpacket;
339 if (rem > 0)
340 length += common->bulk_out_maxpacket - rem;
341 bh->outreq->length = length;
342}
343
344
345/*-------------------------------------------------------------------------*/
346
347static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
348{
349 const char *name;
350
351 if (ep == fsg->bulk_in)
352 name = "bulk-in";
353 else if (ep == fsg->bulk_out)
354 name = "bulk-out";
355 else
356 name = ep->name;
357 DBG(fsg, "%s set halt\n", name);
358 return usb_ep_set_halt(ep);
359}
360
361
362/*-------------------------------------------------------------------------*/
363
364/* These routines may be called in process context or in_irq */
365
366static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
367 void *arg)
368{
369 unsigned long flags;
370
371 /*
372 * Do nothing if a higher-priority exception is already in progress.
373 * If a lower-or-equal priority exception is in progress, preempt it
374 * and notify the main thread by sending it a signal.
375 */
376 spin_lock_irqsave(&common->lock, flags);
377 if (common->state <= new_state) {
378 common->exception_req_tag = common->ep0_req_tag;
379 common->state = new_state;
380 common->exception_arg = arg;
381 if (common->thread_task)
382 send_sig_info(SIGUSR1, SEND_SIG_PRIV,
383 common->thread_task);
384 }
385 spin_unlock_irqrestore(&common->lock, flags);
386}
387
388static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
389{
390 __raise_exception(common, new_state, NULL);
391}
392
393/*-------------------------------------------------------------------------*/
394
395static int ep0_queue(struct fsg_common *common)
396{
397 int rc;
398
399 rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC);
400 common->ep0->driver_data = common;
401 if (rc != 0 && rc != -ESHUTDOWN) {
402 /* We can't do much more than wait for a reset */
403 WARNING(common, "error in submission: %s --> %d\n",
404 common->ep0->name, rc);
405 }
406 return rc;
407}
408
409
410/*-------------------------------------------------------------------------*/
411
412/* Completion handlers. These always run in_irq. */
413
414static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
415{
416 struct fsg_common *common = ep->driver_data;
417 struct fsg_buffhd *bh = req->context;
418
419 if (req->status || req->actual != req->length)
420 DBG(common, "%s --> %d, %u/%u\n", __func__,
421 req->status, req->actual, req->length);
422 if (req->status == -ECONNRESET) /* Request was cancelled */
423 usb_ep_fifo_flush(ep);
424
425 /* Synchronize with the smp_load_acquire() in sleep_thread() */
426 smp_store_release(&bh->state, BUF_STATE_EMPTY);
427 wake_up(&common->io_wait);
428}
429
430static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
431{
432 struct fsg_common *common = ep->driver_data;
433 struct fsg_buffhd *bh = req->context;
434
435 dump_msg(common, "bulk-out", req->buf, req->actual);
436 if (req->status || req->actual != bh->bulk_out_intended_length)
437 DBG(common, "%s --> %d, %u/%u\n", __func__,
438 req->status, req->actual, bh->bulk_out_intended_length);
439 if (req->status == -ECONNRESET) /* Request was cancelled */
440 usb_ep_fifo_flush(ep);
441
442 /* Synchronize with the smp_load_acquire() in sleep_thread() */
443 smp_store_release(&bh->state, BUF_STATE_FULL);
444 wake_up(&common->io_wait);
445}
446
447static int _fsg_common_get_max_lun(struct fsg_common *common)
448{
449 int i = ARRAY_SIZE(common->luns) - 1;
450
451 while (i >= 0 && !common->luns[i])
452 --i;
453
454 return i;
455}
456
457static int fsg_setup(struct usb_function *f,
458 const struct usb_ctrlrequest *ctrl)
459{
460 struct fsg_dev *fsg = fsg_from_func(f);
461 struct usb_request *req = fsg->common->ep0req;
462 u16 w_index = le16_to_cpu(ctrl->wIndex);
463 u16 w_value = le16_to_cpu(ctrl->wValue);
464 u16 w_length = le16_to_cpu(ctrl->wLength);
465
466 if (!fsg_is_set(fsg->common))
467 return -EOPNOTSUPP;
468
469 ++fsg->common->ep0_req_tag; /* Record arrival of a new request */
470 req->context = NULL;
471 req->length = 0;
472 dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
473
474 switch (ctrl->bRequest) {
475
476 case US_BULK_RESET_REQUEST:
477 if (ctrl->bRequestType !=
478 (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
479 break;
480 if (w_index != fsg->interface_number || w_value != 0 ||
481 w_length != 0)
482 return -EDOM;
483
484 /*
485 * Raise an exception to stop the current operation
486 * and reinitialize our state.
487 */
488 DBG(fsg, "bulk reset request\n");
489 raise_exception(fsg->common, FSG_STATE_PROTOCOL_RESET);
490 return USB_GADGET_DELAYED_STATUS;
491
492 case US_BULK_GET_MAX_LUN:
493 if (ctrl->bRequestType !=
494 (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
495 break;
496 if (w_index != fsg->interface_number || w_value != 0 ||
497 w_length != 1)
498 return -EDOM;
499 VDBG(fsg, "get max LUN\n");
500 *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
501
502 /* Respond with data/status */
503 req->length = min((u16)1, w_length);
504 return ep0_queue(fsg->common);
505 }
506
507 VDBG(fsg,
508 "unknown class-specific control req %02x.%02x v%04x i%04x l%u\n",
509 ctrl->bRequestType, ctrl->bRequest,
510 le16_to_cpu(ctrl->wValue), w_index, w_length);
511 return -EOPNOTSUPP;
512}
513
514
515/*-------------------------------------------------------------------------*/
516
517/* All the following routines run in process context */
518
519/* Use this for bulk or interrupt transfers, not ep0 */
520static int start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
521 struct usb_request *req)
522{
523 int rc;
524
525 if (ep == fsg->bulk_in)
526 dump_msg(fsg, "bulk-in", req->buf, req->length);
527
528 rc = usb_ep_queue(ep, req, GFP_KERNEL);
529 if (rc) {
530
531 /* We can't do much more than wait for a reset */
532 req->status = rc;
533
534 /*
535 * Note: currently the net2280 driver fails zero-length
536 * submissions if DMA is enabled.
537 */
538 if (rc != -ESHUTDOWN &&
539 !(rc == -EOPNOTSUPP && req->length == 0))
540 WARNING(fsg, "error in submission: %s --> %d\n",
541 ep->name, rc);
542 }
543 return rc;
544}
545
546static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
547{
548 if (!fsg_is_set(common))
549 return false;
550 bh->state = BUF_STATE_SENDING;
551 if (start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq))
552 bh->state = BUF_STATE_EMPTY;
553 return true;
554}
555
556static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
557{
558 if (!fsg_is_set(common))
559 return false;
560 bh->state = BUF_STATE_RECEIVING;
561 if (start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq))
562 bh->state = BUF_STATE_FULL;
563 return true;
564}
565
566static int sleep_thread(struct fsg_common *common, bool can_freeze,
567 struct fsg_buffhd *bh)
568{
569 int rc;
570
571 /* Wait until a signal arrives or bh is no longer busy */
572 if (can_freeze)
573 /*
574 * synchronize with the smp_store_release(&bh->state) in
575 * bulk_in_complete() or bulk_out_complete()
576 */
577 rc = wait_event_freezable(common->io_wait,
578 bh && smp_load_acquire(&bh->state) >=
579 BUF_STATE_EMPTY);
580 else
581 rc = wait_event_interruptible(common->io_wait,
582 bh && smp_load_acquire(&bh->state) >=
583 BUF_STATE_EMPTY);
584 return rc ? -EINTR : 0;
585}
586
587
588/*-------------------------------------------------------------------------*/
589
590static int do_read(struct fsg_common *common)
591{
592 struct fsg_lun *curlun = common->curlun;
593 u64 lba;
594 struct fsg_buffhd *bh;
595 int rc;
596 u32 amount_left;
597 loff_t file_offset, file_offset_tmp;
598 unsigned int amount;
599 ssize_t nread;
600
601 /*
602 * Get the starting Logical Block Address and check that it's
603 * not too big.
604 */
605 if (common->cmnd[0] == READ_6)
606 lba = get_unaligned_be24(&common->cmnd[1]);
607 else {
608 if (common->cmnd[0] == READ_16)
609 lba = get_unaligned_be64(&common->cmnd[2]);
610 else /* READ_10 or READ_12 */
611 lba = get_unaligned_be32(&common->cmnd[2]);
612
613 /*
614 * We allow DPO (Disable Page Out = don't save data in the
615 * cache) and FUA (Force Unit Access = don't read from the
616 * cache), but we don't implement them.
617 */
618 if ((common->cmnd[1] & ~0x18) != 0) {
619 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
620 return -EINVAL;
621 }
622 }
623 if (lba >= curlun->num_sectors) {
624 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
625 return -EINVAL;
626 }
627 file_offset = ((loff_t) lba) << curlun->blkbits;
628
629 /* Carry out the file reads */
630 amount_left = common->data_size_from_cmnd;
631 if (unlikely(amount_left == 0))
632 return -EIO; /* No default reply */
633
634 for (;;) {
635 /*
636 * Figure out how much we need to read:
637 * Try to read the remaining amount.
638 * But don't read more than the buffer size.
639 * And don't try to read past the end of the file.
640 */
641 amount = min(amount_left, FSG_BUFLEN);
642 amount = min((loff_t)amount,
643 curlun->file_length - file_offset);
644
645 /* Wait for the next buffer to become available */
646 bh = common->next_buffhd_to_fill;
647 rc = sleep_thread(common, false, bh);
648 if (rc)
649 return rc;
650
651 /*
652 * If we were asked to read past the end of file,
653 * end with an empty buffer.
654 */
655 if (amount == 0) {
656 curlun->sense_data =
657 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
658 curlun->sense_data_info =
659 file_offset >> curlun->blkbits;
660 curlun->info_valid = 1;
661 bh->inreq->length = 0;
662 bh->state = BUF_STATE_FULL;
663 break;
664 }
665
666 /* Perform the read */
667 file_offset_tmp = file_offset;
668 nread = kernel_read(curlun->filp, bh->buf, amount,
669 &file_offset_tmp);
670 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
671 (unsigned long long)file_offset, (int)nread);
672 if (signal_pending(current))
673 return -EINTR;
674
675 if (nread < 0) {
676 LDBG(curlun, "error in file read: %d\n", (int)nread);
677 nread = 0;
678 } else if (nread < amount) {
679 LDBG(curlun, "partial file read: %d/%u\n",
680 (int)nread, amount);
681 nread = round_down(nread, curlun->blksize);
682 }
683 file_offset += nread;
684 amount_left -= nread;
685 common->residue -= nread;
686
687 /*
688 * Except at the end of the transfer, nread will be
689 * equal to the buffer size, which is divisible by the
690 * bulk-in maxpacket size.
691 */
692 bh->inreq->length = nread;
693 bh->state = BUF_STATE_FULL;
694
695 /* If an error occurred, report it and its position */
696 if (nread < amount) {
697 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
698 curlun->sense_data_info =
699 file_offset >> curlun->blkbits;
700 curlun->info_valid = 1;
701 break;
702 }
703
704 if (amount_left == 0)
705 break; /* No more left to read */
706
707 /* Send this buffer and go read some more */
708 bh->inreq->zero = 0;
709 if (!start_in_transfer(common, bh))
710 /* Don't know what to do if common->fsg is NULL */
711 return -EIO;
712 common->next_buffhd_to_fill = bh->next;
713 }
714
715 return -EIO; /* No default reply */
716}
717
718
719/*-------------------------------------------------------------------------*/
720
721static int do_write(struct fsg_common *common)
722{
723 struct fsg_lun *curlun = common->curlun;
724 u64 lba;
725 struct fsg_buffhd *bh;
726 int get_some_more;
727 u32 amount_left_to_req, amount_left_to_write;
728 loff_t usb_offset, file_offset, file_offset_tmp;
729 unsigned int amount;
730 ssize_t nwritten;
731 int rc;
732
733 if (curlun->ro) {
734 curlun->sense_data = SS_WRITE_PROTECTED;
735 return -EINVAL;
736 }
737 spin_lock(&curlun->filp->f_lock);
738 curlun->filp->f_flags &= ~O_SYNC; /* Default is not to wait */
739 spin_unlock(&curlun->filp->f_lock);
740
741 /*
742 * Get the starting Logical Block Address and check that it's
743 * not too big
744 */
745 if (common->cmnd[0] == WRITE_6)
746 lba = get_unaligned_be24(&common->cmnd[1]);
747 else {
748 if (common->cmnd[0] == WRITE_16)
749 lba = get_unaligned_be64(&common->cmnd[2]);
750 else /* WRITE_10 or WRITE_12 */
751 lba = get_unaligned_be32(&common->cmnd[2]);
752
753 /*
754 * We allow DPO (Disable Page Out = don't save data in the
755 * cache) and FUA (Force Unit Access = write directly to the
756 * medium). We don't implement DPO; we implement FUA by
757 * performing synchronous output.
758 */
759 if (common->cmnd[1] & ~0x18) {
760 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
761 return -EINVAL;
762 }
763 if (!curlun->nofua && (common->cmnd[1] & 0x08)) { /* FUA */
764 spin_lock(&curlun->filp->f_lock);
765 curlun->filp->f_flags |= O_SYNC;
766 spin_unlock(&curlun->filp->f_lock);
767 }
768 }
769 if (lba >= curlun->num_sectors) {
770 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
771 return -EINVAL;
772 }
773
774 /* Carry out the file writes */
775 get_some_more = 1;
776 file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
777 amount_left_to_req = common->data_size_from_cmnd;
778 amount_left_to_write = common->data_size_from_cmnd;
779
780 while (amount_left_to_write > 0) {
781
782 /* Queue a request for more data from the host */
783 bh = common->next_buffhd_to_fill;
784 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
785
786 /*
787 * Figure out how much we want to get:
788 * Try to get the remaining amount,
789 * but not more than the buffer size.
790 */
791 amount = min(amount_left_to_req, FSG_BUFLEN);
792
793 /* Beyond the end of the backing file? */
794 if (usb_offset >= curlun->file_length) {
795 get_some_more = 0;
796 curlun->sense_data =
797 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
798 curlun->sense_data_info =
799 usb_offset >> curlun->blkbits;
800 curlun->info_valid = 1;
801 continue;
802 }
803
804 /* Get the next buffer */
805 usb_offset += amount;
806 common->usb_amount_left -= amount;
807 amount_left_to_req -= amount;
808 if (amount_left_to_req == 0)
809 get_some_more = 0;
810
811 /*
812 * Except at the end of the transfer, amount will be
813 * equal to the buffer size, which is divisible by
814 * the bulk-out maxpacket size.
815 */
816 set_bulk_out_req_length(common, bh, amount);
817 if (!start_out_transfer(common, bh))
818 /* Dunno what to do if common->fsg is NULL */
819 return -EIO;
820 common->next_buffhd_to_fill = bh->next;
821 continue;
822 }
823
824 /* Write the received data to the backing file */
825 bh = common->next_buffhd_to_drain;
826 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
827 break; /* We stopped early */
828
829 /* Wait for the data to be received */
830 rc = sleep_thread(common, false, bh);
831 if (rc)
832 return rc;
833
834 common->next_buffhd_to_drain = bh->next;
835 bh->state = BUF_STATE_EMPTY;
836
837 /* Did something go wrong with the transfer? */
838 if (bh->outreq->status != 0) {
839 curlun->sense_data = SS_COMMUNICATION_FAILURE;
840 curlun->sense_data_info =
841 file_offset >> curlun->blkbits;
842 curlun->info_valid = 1;
843 break;
844 }
845
846 amount = bh->outreq->actual;
847 if (curlun->file_length - file_offset < amount) {
848 LERROR(curlun, "write %u @ %llu beyond end %llu\n",
849 amount, (unsigned long long)file_offset,
850 (unsigned long long)curlun->file_length);
851 amount = curlun->file_length - file_offset;
852 }
853
854 /*
855 * Don't accept excess data. The spec doesn't say
856 * what to do in this case. We'll ignore the error.
857 */
858 amount = min(amount, bh->bulk_out_intended_length);
859
860 /* Don't write a partial block */
861 amount = round_down(amount, curlun->blksize);
862 if (amount == 0)
863 goto empty_write;
864
865 /* Perform the write */
866 file_offset_tmp = file_offset;
867 nwritten = kernel_write(curlun->filp, bh->buf, amount,
868 &file_offset_tmp);
869 VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
870 (unsigned long long)file_offset, (int)nwritten);
871 if (signal_pending(current))
872 return -EINTR; /* Interrupted! */
873
874 if (nwritten < 0) {
875 LDBG(curlun, "error in file write: %d\n",
876 (int) nwritten);
877 nwritten = 0;
878 } else if (nwritten < amount) {
879 LDBG(curlun, "partial file write: %d/%u\n",
880 (int) nwritten, amount);
881 nwritten = round_down(nwritten, curlun->blksize);
882 }
883 file_offset += nwritten;
884 amount_left_to_write -= nwritten;
885 common->residue -= nwritten;
886
887 /* If an error occurred, report it and its position */
888 if (nwritten < amount) {
889 curlun->sense_data = SS_WRITE_ERROR;
890 curlun->sense_data_info =
891 file_offset >> curlun->blkbits;
892 curlun->info_valid = 1;
893 break;
894 }
895
896 empty_write:
897 /* Did the host decide to stop early? */
898 if (bh->outreq->actual < bh->bulk_out_intended_length) {
899 common->short_packet_received = 1;
900 break;
901 }
902 }
903
904 return -EIO; /* No default reply */
905}
906
907
908/*-------------------------------------------------------------------------*/
909
910static int do_synchronize_cache(struct fsg_common *common)
911{
912 struct fsg_lun *curlun = common->curlun;
913 int rc;
914
915 /* We ignore the requested LBA and write out all file's
916 * dirty data buffers. */
917 rc = fsg_lun_fsync_sub(curlun);
918 if (rc)
919 curlun->sense_data = SS_WRITE_ERROR;
920 return 0;
921}
922
923
924/*-------------------------------------------------------------------------*/
925
926static void invalidate_sub(struct fsg_lun *curlun)
927{
928 struct file *filp = curlun->filp;
929 struct inode *inode = file_inode(filp);
930 unsigned long rc;
931
932 rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
933 VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
934}
935
936static int do_verify(struct fsg_common *common)
937{
938 struct fsg_lun *curlun = common->curlun;
939 u32 lba;
940 u32 verification_length;
941 struct fsg_buffhd *bh = common->next_buffhd_to_fill;
942 loff_t file_offset, file_offset_tmp;
943 u32 amount_left;
944 unsigned int amount;
945 ssize_t nread;
946
947 /*
948 * Get the starting Logical Block Address and check that it's
949 * not too big.
950 */
951 lba = get_unaligned_be32(&common->cmnd[2]);
952 if (lba >= curlun->num_sectors) {
953 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
954 return -EINVAL;
955 }
956
957 /*
958 * We allow DPO (Disable Page Out = don't save data in the
959 * cache) but we don't implement it.
960 */
961 if (common->cmnd[1] & ~0x10) {
962 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
963 return -EINVAL;
964 }
965
966 verification_length = get_unaligned_be16(&common->cmnd[7]);
967 if (unlikely(verification_length == 0))
968 return -EIO; /* No default reply */
969
970 /* Prepare to carry out the file verify */
971 amount_left = verification_length << curlun->blkbits;
972 file_offset = ((loff_t) lba) << curlun->blkbits;
973
974 /* Write out all the dirty buffers before invalidating them */
975 fsg_lun_fsync_sub(curlun);
976 if (signal_pending(current))
977 return -EINTR;
978
979 invalidate_sub(curlun);
980 if (signal_pending(current))
981 return -EINTR;
982
983 /* Just try to read the requested blocks */
984 while (amount_left > 0) {
985 /*
986 * Figure out how much we need to read:
987 * Try to read the remaining amount, but not more than
988 * the buffer size.
989 * And don't try to read past the end of the file.
990 */
991 amount = min(amount_left, FSG_BUFLEN);
992 amount = min((loff_t)amount,
993 curlun->file_length - file_offset);
994 if (amount == 0) {
995 curlun->sense_data =
996 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
997 curlun->sense_data_info =
998 file_offset >> curlun->blkbits;
999 curlun->info_valid = 1;
1000 break;
1001 }
1002
1003 /* Perform the read */
1004 file_offset_tmp = file_offset;
1005 nread = kernel_read(curlun->filp, bh->buf, amount,
1006 &file_offset_tmp);
1007 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1008 (unsigned long long) file_offset,
1009 (int) nread);
1010 if (signal_pending(current))
1011 return -EINTR;
1012
1013 if (nread < 0) {
1014 LDBG(curlun, "error in file verify: %d\n", (int)nread);
1015 nread = 0;
1016 } else if (nread < amount) {
1017 LDBG(curlun, "partial file verify: %d/%u\n",
1018 (int)nread, amount);
1019 nread = round_down(nread, curlun->blksize);
1020 }
1021 if (nread == 0) {
1022 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1023 curlun->sense_data_info =
1024 file_offset >> curlun->blkbits;
1025 curlun->info_valid = 1;
1026 break;
1027 }
1028 file_offset += nread;
1029 amount_left -= nread;
1030 }
1031 return 0;
1032}
1033
1034
1035/*-------------------------------------------------------------------------*/
1036
1037static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
1038{
1039 struct fsg_lun *curlun = common->curlun;
1040 u8 *buf = (u8 *) bh->buf;
1041
1042 if (!curlun) { /* Unsupported LUNs are okay */
1043 common->bad_lun_okay = 1;
1044 memset(buf, 0, 36);
1045 buf[0] = TYPE_NO_LUN; /* Unsupported, no device-type */
1046 buf[4] = 31; /* Additional length */
1047 return 36;
1048 }
1049
1050 buf[0] = curlun->cdrom ? TYPE_ROM : TYPE_DISK;
1051 buf[1] = curlun->removable ? 0x80 : 0;
1052 buf[2] = 2; /* ANSI SCSI level 2 */
1053 buf[3] = 2; /* SCSI-2 INQUIRY data format */
1054 buf[4] = 31; /* Additional length */
1055 buf[5] = 0; /* No special options */
1056 buf[6] = 0;
1057 buf[7] = 0;
1058 if (curlun->inquiry_string[0])
1059 memcpy(buf + 8, curlun->inquiry_string,
1060 sizeof(curlun->inquiry_string));
1061 else
1062 memcpy(buf + 8, common->inquiry_string,
1063 sizeof(common->inquiry_string));
1064 return 36;
1065}
1066
1067static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1068{
1069 struct fsg_lun *curlun = common->curlun;
1070 u8 *buf = (u8 *) bh->buf;
1071 u32 sd, sdinfo;
1072 int valid;
1073
1074 /*
1075 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1076 *
1077 * If a REQUEST SENSE command is received from an initiator
1078 * with a pending unit attention condition (before the target
1079 * generates the contingent allegiance condition), then the
1080 * target shall either:
1081 * a) report any pending sense data and preserve the unit
1082 * attention condition on the logical unit, or,
1083 * b) report the unit attention condition, may discard any
1084 * pending sense data, and clear the unit attention
1085 * condition on the logical unit for that initiator.
1086 *
1087 * FSG normally uses option a); enable this code to use option b).
1088 */
1089#if 0
1090 if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1091 curlun->sense_data = curlun->unit_attention_data;
1092 curlun->unit_attention_data = SS_NO_SENSE;
1093 }
1094#endif
1095
1096 if (!curlun) { /* Unsupported LUNs are okay */
1097 common->bad_lun_okay = 1;
1098 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1099 sdinfo = 0;
1100 valid = 0;
1101 } else {
1102 sd = curlun->sense_data;
1103 sdinfo = curlun->sense_data_info;
1104 valid = curlun->info_valid << 7;
1105 curlun->sense_data = SS_NO_SENSE;
1106 curlun->sense_data_info = 0;
1107 curlun->info_valid = 0;
1108 }
1109
1110 memset(buf, 0, 18);
1111 buf[0] = valid | 0x70; /* Valid, current error */
1112 buf[2] = SK(sd);
1113 put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
1114 buf[7] = 18 - 8; /* Additional sense length */
1115 buf[12] = ASC(sd);
1116 buf[13] = ASCQ(sd);
1117 return 18;
1118}
1119
1120static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
1121{
1122 struct fsg_lun *curlun = common->curlun;
1123 u32 lba = get_unaligned_be32(&common->cmnd[2]);
1124 int pmi = common->cmnd[8];
1125 u8 *buf = (u8 *)bh->buf;
1126 u32 max_lba;
1127
1128 /* Check the PMI and LBA fields */
1129 if (pmi > 1 || (pmi == 0 && lba != 0)) {
1130 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1131 return -EINVAL;
1132 }
1133
1134 if (curlun->num_sectors < 0x100000000ULL)
1135 max_lba = curlun->num_sectors - 1;
1136 else
1137 max_lba = 0xffffffff;
1138 put_unaligned_be32(max_lba, &buf[0]); /* Max logical block */
1139 put_unaligned_be32(curlun->blksize, &buf[4]); /* Block length */
1140 return 8;
1141}
1142
1143static int do_read_capacity_16(struct fsg_common *common, struct fsg_buffhd *bh)
1144{
1145 struct fsg_lun *curlun = common->curlun;
1146 u64 lba = get_unaligned_be64(&common->cmnd[2]);
1147 int pmi = common->cmnd[14];
1148 u8 *buf = (u8 *)bh->buf;
1149
1150 /* Check the PMI and LBA fields */
1151 if (pmi > 1 || (pmi == 0 && lba != 0)) {
1152 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1153 return -EINVAL;
1154 }
1155
1156 put_unaligned_be64(curlun->num_sectors - 1, &buf[0]);
1157 /* Max logical block */
1158 put_unaligned_be32(curlun->blksize, &buf[8]); /* Block length */
1159
1160 /* It is safe to keep other fields zeroed */
1161 memset(&buf[12], 0, 32 - 12);
1162 return 32;
1163}
1164
1165static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
1166{
1167 struct fsg_lun *curlun = common->curlun;
1168 int msf = common->cmnd[1] & 0x02;
1169 u32 lba = get_unaligned_be32(&common->cmnd[2]);
1170 u8 *buf = (u8 *)bh->buf;
1171
1172 if (common->cmnd[1] & ~0x02) { /* Mask away MSF */
1173 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1174 return -EINVAL;
1175 }
1176 if (lba >= curlun->num_sectors) {
1177 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1178 return -EINVAL;
1179 }
1180
1181 memset(buf, 0, 8);
1182 buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
1183 store_cdrom_address(&buf[4], msf, lba);
1184 return 8;
1185}
1186
1187static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
1188{
1189 struct fsg_lun *curlun = common->curlun;
1190 int msf = common->cmnd[1] & 0x02;
1191 int start_track = common->cmnd[6];
1192 u8 *buf = (u8 *)bh->buf;
1193 u8 format;
1194 int i, len;
1195
1196 format = common->cmnd[2] & 0xf;
1197
1198 if ((common->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
1199 (start_track > 1 && format != 0x1)) {
1200 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1201 return -EINVAL;
1202 }
1203
1204 /*
1205 * Check if CDB is old style SFF-8020i
1206 * i.e. format is in 2 MSBs of byte 9
1207 * Mac OS-X host sends us this.
1208 */
1209 if (format == 0)
1210 format = (common->cmnd[9] >> 6) & 0x3;
1211
1212 switch (format) {
1213 case 0: /* Formatted TOC */
1214 case 1: /* Multi-session info */
1215 len = 4 + 2*8; /* 4 byte header + 2 descriptors */
1216 memset(buf, 0, len);
1217 buf[1] = len - 2; /* TOC Length excludes length field */
1218 buf[2] = 1; /* First track number */
1219 buf[3] = 1; /* Last track number */
1220 buf[5] = 0x16; /* Data track, copying allowed */
1221 buf[6] = 0x01; /* Only track is number 1 */
1222 store_cdrom_address(&buf[8], msf, 0);
1223
1224 buf[13] = 0x16; /* Lead-out track is data */
1225 buf[14] = 0xAA; /* Lead-out track number */
1226 store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1227 return len;
1228
1229 case 2:
1230 /* Raw TOC */
1231 len = 4 + 3*11; /* 4 byte header + 3 descriptors */
1232 memset(buf, 0, len); /* Header + A0, A1 & A2 descriptors */
1233 buf[1] = len - 2; /* TOC Length excludes length field */
1234 buf[2] = 1; /* First complete session */
1235 buf[3] = 1; /* Last complete session */
1236
1237 buf += 4;
1238 /* fill in A0, A1 and A2 points */
1239 for (i = 0; i < 3; i++) {
1240 buf[0] = 1; /* Session number */
1241 buf[1] = 0x16; /* Data track, copying allowed */
1242 /* 2 - Track number 0 -> TOC */
1243 buf[3] = 0xA0 + i; /* A0, A1, A2 point */
1244 /* 4, 5, 6 - Min, sec, frame is zero */
1245 buf[8] = 1; /* Pmin: last track number */
1246 buf += 11; /* go to next track descriptor */
1247 }
1248 buf -= 11; /* go back to A2 descriptor */
1249
1250 /* For A2, 7, 8, 9, 10 - zero, Pmin, Psec, Pframe of Lead out */
1251 store_cdrom_address(&buf[7], msf, curlun->num_sectors);
1252 return len;
1253
1254 default:
1255 /* PMA, ATIP, CD-TEXT not supported/required */
1256 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1257 return -EINVAL;
1258 }
1259}
1260
1261static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1262{
1263 struct fsg_lun *curlun = common->curlun;
1264 int mscmnd = common->cmnd[0];
1265 u8 *buf = (u8 *) bh->buf;
1266 u8 *buf0 = buf;
1267 int pc, page_code;
1268 int changeable_values, all_pages;
1269 int valid_page = 0;
1270 int len, limit;
1271
1272 if ((common->cmnd[1] & ~0x08) != 0) { /* Mask away DBD */
1273 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1274 return -EINVAL;
1275 }
1276 pc = common->cmnd[2] >> 6;
1277 page_code = common->cmnd[2] & 0x3f;
1278 if (pc == 3) {
1279 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1280 return -EINVAL;
1281 }
1282 changeable_values = (pc == 1);
1283 all_pages = (page_code == 0x3f);
1284
1285 /*
1286 * Write the mode parameter header. Fixed values are: default
1287 * medium type, no cache control (DPOFUA), and no block descriptors.
1288 * The only variable value is the WriteProtect bit. We will fill in
1289 * the mode data length later.
1290 */
1291 memset(buf, 0, 8);
1292 if (mscmnd == MODE_SENSE) {
1293 buf[2] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
1294 buf += 4;
1295 limit = 255;
1296 } else { /* MODE_SENSE_10 */
1297 buf[3] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
1298 buf += 8;
1299 limit = 65535; /* Should really be FSG_BUFLEN */
1300 }
1301
1302 /* No block descriptors */
1303
1304 /*
1305 * The mode pages, in numerical order. The only page we support
1306 * is the Caching page.
1307 */
1308 if (page_code == 0x08 || all_pages) {
1309 valid_page = 1;
1310 buf[0] = 0x08; /* Page code */
1311 buf[1] = 10; /* Page length */
1312 memset(buf+2, 0, 10); /* None of the fields are changeable */
1313
1314 if (!changeable_values) {
1315 buf[2] = 0x04; /* Write cache enable, */
1316 /* Read cache not disabled */
1317 /* No cache retention priorities */
1318 put_unaligned_be16(0xffff, &buf[4]);
1319 /* Don't disable prefetch */
1320 /* Minimum prefetch = 0 */
1321 put_unaligned_be16(0xffff, &buf[8]);
1322 /* Maximum prefetch */
1323 put_unaligned_be16(0xffff, &buf[10]);
1324 /* Maximum prefetch ceiling */
1325 }
1326 buf += 12;
1327 }
1328
1329 /*
1330 * Check that a valid page was requested and the mode data length
1331 * isn't too long.
1332 */
1333 len = buf - buf0;
1334 if (!valid_page || len > limit) {
1335 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1336 return -EINVAL;
1337 }
1338
1339 /* Store the mode data length */
1340 if (mscmnd == MODE_SENSE)
1341 buf0[0] = len - 1;
1342 else
1343 put_unaligned_be16(len - 2, buf0);
1344 return len;
1345}
1346
1347static int do_start_stop(struct fsg_common *common)
1348{
1349 struct fsg_lun *curlun = common->curlun;
1350 int loej, start;
1351
1352 if (!curlun) {
1353 return -EINVAL;
1354 } else if (!curlun->removable) {
1355 curlun->sense_data = SS_INVALID_COMMAND;
1356 return -EINVAL;
1357 } else if ((common->cmnd[1] & ~0x01) != 0 || /* Mask away Immed */
1358 (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */
1359 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1360 return -EINVAL;
1361 }
1362
1363 loej = common->cmnd[4] & 0x02;
1364 start = common->cmnd[4] & 0x01;
1365
1366 /*
1367 * Our emulation doesn't support mounting; the medium is
1368 * available for use as soon as it is loaded.
1369 */
1370 if (start) {
1371 if (!fsg_lun_is_open(curlun)) {
1372 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1373 return -EINVAL;
1374 }
1375 return 0;
1376 }
1377
1378 /* Are we allowed to unload the media? */
1379 if (curlun->prevent_medium_removal) {
1380 LDBG(curlun, "unload attempt prevented\n");
1381 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1382 return -EINVAL;
1383 }
1384
1385 if (!loej)
1386 return 0;
1387
1388 up_read(&common->filesem);
1389 down_write(&common->filesem);
1390 fsg_lun_close(curlun);
1391 up_write(&common->filesem);
1392 down_read(&common->filesem);
1393
1394 return 0;
1395}
1396
1397static int do_prevent_allow(struct fsg_common *common)
1398{
1399 struct fsg_lun *curlun = common->curlun;
1400 int prevent;
1401
1402 if (!common->curlun) {
1403 return -EINVAL;
1404 } else if (!common->curlun->removable) {
1405 common->curlun->sense_data = SS_INVALID_COMMAND;
1406 return -EINVAL;
1407 }
1408
1409 prevent = common->cmnd[4] & 0x01;
1410 if ((common->cmnd[4] & ~0x01) != 0) { /* Mask away Prevent */
1411 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1412 return -EINVAL;
1413 }
1414
1415 if (curlun->prevent_medium_removal && !prevent)
1416 fsg_lun_fsync_sub(curlun);
1417 curlun->prevent_medium_removal = prevent;
1418 return 0;
1419}
1420
1421static int do_read_format_capacities(struct fsg_common *common,
1422 struct fsg_buffhd *bh)
1423{
1424 struct fsg_lun *curlun = common->curlun;
1425 u8 *buf = (u8 *) bh->buf;
1426
1427 buf[0] = buf[1] = buf[2] = 0;
1428 buf[3] = 8; /* Only the Current/Maximum Capacity Descriptor */
1429 buf += 4;
1430
1431 put_unaligned_be32(curlun->num_sectors, &buf[0]);
1432 /* Number of blocks */
1433 put_unaligned_be32(curlun->blksize, &buf[4]);/* Block length */
1434 buf[4] = 0x02; /* Current capacity */
1435 return 12;
1436}
1437
1438static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
1439{
1440 struct fsg_lun *curlun = common->curlun;
1441
1442 /* We don't support MODE SELECT */
1443 if (curlun)
1444 curlun->sense_data = SS_INVALID_COMMAND;
1445 return -EINVAL;
1446}
1447
1448
1449/*-------------------------------------------------------------------------*/
1450
1451static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1452{
1453 int rc;
1454
1455 rc = fsg_set_halt(fsg, fsg->bulk_in);
1456 if (rc == -EAGAIN)
1457 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1458 while (rc != 0) {
1459 if (rc != -EAGAIN) {
1460 WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1461 rc = 0;
1462 break;
1463 }
1464
1465 /* Wait for a short time and then try again */
1466 if (msleep_interruptible(100) != 0)
1467 return -EINTR;
1468 rc = usb_ep_set_halt(fsg->bulk_in);
1469 }
1470 return rc;
1471}
1472
1473static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1474{
1475 int rc;
1476
1477 DBG(fsg, "bulk-in set wedge\n");
1478 rc = usb_ep_set_wedge(fsg->bulk_in);
1479 if (rc == -EAGAIN)
1480 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1481 while (rc != 0) {
1482 if (rc != -EAGAIN) {
1483 WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1484 rc = 0;
1485 break;
1486 }
1487
1488 /* Wait for a short time and then try again */
1489 if (msleep_interruptible(100) != 0)
1490 return -EINTR;
1491 rc = usb_ep_set_wedge(fsg->bulk_in);
1492 }
1493 return rc;
1494}
1495
1496static int throw_away_data(struct fsg_common *common)
1497{
1498 struct fsg_buffhd *bh, *bh2;
1499 u32 amount;
1500 int rc;
1501
1502 for (bh = common->next_buffhd_to_drain;
1503 bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
1504 bh = common->next_buffhd_to_drain) {
1505
1506 /* Try to submit another request if we need one */
1507 bh2 = common->next_buffhd_to_fill;
1508 if (bh2->state == BUF_STATE_EMPTY &&
1509 common->usb_amount_left > 0) {
1510 amount = min(common->usb_amount_left, FSG_BUFLEN);
1511
1512 /*
1513 * Except at the end of the transfer, amount will be
1514 * equal to the buffer size, which is divisible by
1515 * the bulk-out maxpacket size.
1516 */
1517 set_bulk_out_req_length(common, bh2, amount);
1518 if (!start_out_transfer(common, bh2))
1519 /* Dunno what to do if common->fsg is NULL */
1520 return -EIO;
1521 common->next_buffhd_to_fill = bh2->next;
1522 common->usb_amount_left -= amount;
1523 continue;
1524 }
1525
1526 /* Wait for the data to be received */
1527 rc = sleep_thread(common, false, bh);
1528 if (rc)
1529 return rc;
1530
1531 /* Throw away the data in a filled buffer */
1532 bh->state = BUF_STATE_EMPTY;
1533 common->next_buffhd_to_drain = bh->next;
1534
1535 /* A short packet or an error ends everything */
1536 if (bh->outreq->actual < bh->bulk_out_intended_length ||
1537 bh->outreq->status != 0) {
1538 raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1539 return -EINTR;
1540 }
1541 }
1542 return 0;
1543}
1544
1545static int finish_reply(struct fsg_common *common)
1546{
1547 struct fsg_buffhd *bh = common->next_buffhd_to_fill;
1548 int rc = 0;
1549
1550 switch (common->data_dir) {
1551 case DATA_DIR_NONE:
1552 break; /* Nothing to send */
1553
1554 /*
1555 * If we don't know whether the host wants to read or write,
1556 * this must be CB or CBI with an unknown command. We mustn't
1557 * try to send or receive any data. So stall both bulk pipes
1558 * if we can and wait for a reset.
1559 */
1560 case DATA_DIR_UNKNOWN:
1561 if (!common->can_stall) {
1562 /* Nothing */
1563 } else if (fsg_is_set(common)) {
1564 fsg_set_halt(common->fsg, common->fsg->bulk_out);
1565 rc = halt_bulk_in_endpoint(common->fsg);
1566 } else {
1567 /* Don't know what to do if common->fsg is NULL */
1568 rc = -EIO;
1569 }
1570 break;
1571
1572 /* All but the last buffer of data must have already been sent */
1573 case DATA_DIR_TO_HOST:
1574 if (common->data_size == 0) {
1575 /* Nothing to send */
1576
1577 /* Don't know what to do if common->fsg is NULL */
1578 } else if (!fsg_is_set(common)) {
1579 rc = -EIO;
1580
1581 /* If there's no residue, simply send the last buffer */
1582 } else if (common->residue == 0) {
1583 bh->inreq->zero = 0;
1584 if (!start_in_transfer(common, bh))
1585 return -EIO;
1586 common->next_buffhd_to_fill = bh->next;
1587
1588 /*
1589 * For Bulk-only, mark the end of the data with a short
1590 * packet. If we are allowed to stall, halt the bulk-in
1591 * endpoint. (Note: This violates the Bulk-Only Transport
1592 * specification, which requires us to pad the data if we
1593 * don't halt the endpoint. Presumably nobody will mind.)
1594 */
1595 } else {
1596 bh->inreq->zero = 1;
1597 if (!start_in_transfer(common, bh))
1598 rc = -EIO;
1599 common->next_buffhd_to_fill = bh->next;
1600 if (common->can_stall)
1601 rc = halt_bulk_in_endpoint(common->fsg);
1602 }
1603 break;
1604
1605 /*
1606 * We have processed all we want from the data the host has sent.
1607 * There may still be outstanding bulk-out requests.
1608 */
1609 case DATA_DIR_FROM_HOST:
1610 if (common->residue == 0) {
1611 /* Nothing to receive */
1612
1613 /* Did the host stop sending unexpectedly early? */
1614 } else if (common->short_packet_received) {
1615 raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1616 rc = -EINTR;
1617
1618 /*
1619 * We haven't processed all the incoming data. Even though
1620 * we may be allowed to stall, doing so would cause a race.
1621 * The controller may already have ACK'ed all the remaining
1622 * bulk-out packets, in which case the host wouldn't see a
1623 * STALL. Not realizing the endpoint was halted, it wouldn't
1624 * clear the halt -- leading to problems later on.
1625 */
1626#if 0
1627 } else if (common->can_stall) {
1628 if (fsg_is_set(common))
1629 fsg_set_halt(common->fsg,
1630 common->fsg->bulk_out);
1631 raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1632 rc = -EINTR;
1633#endif
1634
1635 /*
1636 * We can't stall. Read in the excess data and throw it
1637 * all away.
1638 */
1639 } else {
1640 rc = throw_away_data(common);
1641 }
1642 break;
1643 }
1644 return rc;
1645}
1646
1647static void send_status(struct fsg_common *common)
1648{
1649 struct fsg_lun *curlun = common->curlun;
1650 struct fsg_buffhd *bh;
1651 struct bulk_cs_wrap *csw;
1652 int rc;
1653 u8 status = US_BULK_STAT_OK;
1654 u32 sd, sdinfo = 0;
1655
1656 /* Wait for the next buffer to become available */
1657 bh = common->next_buffhd_to_fill;
1658 rc = sleep_thread(common, false, bh);
1659 if (rc)
1660 return;
1661
1662 if (curlun) {
1663 sd = curlun->sense_data;
1664 sdinfo = curlun->sense_data_info;
1665 } else if (common->bad_lun_okay)
1666 sd = SS_NO_SENSE;
1667 else
1668 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1669
1670 if (common->phase_error) {
1671 DBG(common, "sending phase-error status\n");
1672 status = US_BULK_STAT_PHASE;
1673 sd = SS_INVALID_COMMAND;
1674 } else if (sd != SS_NO_SENSE) {
1675 DBG(common, "sending command-failure status\n");
1676 status = US_BULK_STAT_FAIL;
1677 VDBG(common, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
1678 " info x%x\n",
1679 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
1680 }
1681
1682 /* Store and send the Bulk-only CSW */
1683 csw = (void *)bh->buf;
1684
1685 csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
1686 csw->Tag = common->tag;
1687 csw->Residue = cpu_to_le32(common->residue);
1688 csw->Status = status;
1689
1690 bh->inreq->length = US_BULK_CS_WRAP_LEN;
1691 bh->inreq->zero = 0;
1692 if (!start_in_transfer(common, bh))
1693 /* Don't know what to do if common->fsg is NULL */
1694 return;
1695
1696 common->next_buffhd_to_fill = bh->next;
1697 return;
1698}
1699
1700
1701/*-------------------------------------------------------------------------*/
1702
1703/*
1704 * Check whether the command is properly formed and whether its data size
1705 * and direction agree with the values we already have.
1706 */
1707static int check_command(struct fsg_common *common, int cmnd_size,
1708 enum data_direction data_dir, unsigned int mask,
1709 int needs_medium, const char *name)
1710{
1711 int i;
1712 unsigned int lun = common->cmnd[1] >> 5;
1713 static const char dirletter[4] = {'u', 'o', 'i', 'n'};
1714 char hdlen[20];
1715 struct fsg_lun *curlun;
1716
1717 hdlen[0] = 0;
1718 if (common->data_dir != DATA_DIR_UNKNOWN)
1719 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
1720 common->data_size);
1721 VDBG(common, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
1722 name, cmnd_size, dirletter[(int) data_dir],
1723 common->data_size_from_cmnd, common->cmnd_size, hdlen);
1724
1725 /*
1726 * We can't reply at all until we know the correct data direction
1727 * and size.
1728 */
1729 if (common->data_size_from_cmnd == 0)
1730 data_dir = DATA_DIR_NONE;
1731 if (common->data_size < common->data_size_from_cmnd) {
1732 /*
1733 * Host data size < Device data size is a phase error.
1734 * Carry out the command, but only transfer as much as
1735 * we are allowed.
1736 */
1737 common->data_size_from_cmnd = common->data_size;
1738 common->phase_error = 1;
1739 }
1740 common->residue = common->data_size;
1741 common->usb_amount_left = common->data_size;
1742
1743 /* Conflicting data directions is a phase error */
1744 if (common->data_dir != data_dir && common->data_size_from_cmnd > 0) {
1745 common->phase_error = 1;
1746 return -EINVAL;
1747 }
1748
1749 /* Verify the length of the command itself */
1750 if (cmnd_size != common->cmnd_size) {
1751
1752 /*
1753 * Special case workaround: There are plenty of buggy SCSI
1754 * implementations. Many have issues with cbw->Length
1755 * field passing a wrong command size. For those cases we
1756 * always try to work around the problem by using the length
1757 * sent by the host side provided it is at least as large
1758 * as the correct command length.
1759 * Examples of such cases would be MS-Windows, which issues
1760 * REQUEST SENSE with cbw->Length == 12 where it should
1761 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
1762 * REQUEST SENSE with cbw->Length == 10 where it should
1763 * be 6 as well.
1764 */
1765 if (cmnd_size <= common->cmnd_size) {
1766 DBG(common, "%s is buggy! Expected length %d "
1767 "but we got %d\n", name,
1768 cmnd_size, common->cmnd_size);
1769 cmnd_size = common->cmnd_size;
1770 } else {
1771 common->phase_error = 1;
1772 return -EINVAL;
1773 }
1774 }
1775
1776 /* Check that the LUN values are consistent */
1777 if (common->lun != lun)
1778 DBG(common, "using LUN %u from CBW, not LUN %u from CDB\n",
1779 common->lun, lun);
1780
1781 /* Check the LUN */
1782 curlun = common->curlun;
1783 if (curlun) {
1784 if (common->cmnd[0] != REQUEST_SENSE) {
1785 curlun->sense_data = SS_NO_SENSE;
1786 curlun->sense_data_info = 0;
1787 curlun->info_valid = 0;
1788 }
1789 } else {
1790 common->bad_lun_okay = 0;
1791
1792 /*
1793 * INQUIRY and REQUEST SENSE commands are explicitly allowed
1794 * to use unsupported LUNs; all others may not.
1795 */
1796 if (common->cmnd[0] != INQUIRY &&
1797 common->cmnd[0] != REQUEST_SENSE) {
1798 DBG(common, "unsupported LUN %u\n", common->lun);
1799 return -EINVAL;
1800 }
1801 }
1802
1803 /*
1804 * If a unit attention condition exists, only INQUIRY and
1805 * REQUEST SENSE commands are allowed; anything else must fail.
1806 */
1807 if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
1808 common->cmnd[0] != INQUIRY &&
1809 common->cmnd[0] != REQUEST_SENSE) {
1810 curlun->sense_data = curlun->unit_attention_data;
1811 curlun->unit_attention_data = SS_NO_SENSE;
1812 return -EINVAL;
1813 }
1814
1815 /* Check that only command bytes listed in the mask are non-zero */
1816 common->cmnd[1] &= 0x1f; /* Mask away the LUN */
1817 for (i = 1; i < cmnd_size; ++i) {
1818 if (common->cmnd[i] && !(mask & (1 << i))) {
1819 if (curlun)
1820 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1821 return -EINVAL;
1822 }
1823 }
1824
1825 /* If the medium isn't mounted and the command needs to access
1826 * it, return an error. */
1827 if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
1828 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1829 return -EINVAL;
1830 }
1831
1832 return 0;
1833}
1834
1835/* wrapper of check_command for data size in blocks handling */
1836static int check_command_size_in_blocks(struct fsg_common *common,
1837 int cmnd_size, enum data_direction data_dir,
1838 unsigned int mask, int needs_medium, const char *name)
1839{
1840 if (common->curlun)
1841 common->data_size_from_cmnd <<= common->curlun->blkbits;
1842 return check_command(common, cmnd_size, data_dir,
1843 mask, needs_medium, name);
1844}
1845
1846static int do_scsi_command(struct fsg_common *common)
1847{
1848 struct fsg_buffhd *bh;
1849 int rc;
1850 int reply = -EINVAL;
1851 int i;
1852 static char unknown[16];
1853
1854 dump_cdb(common);
1855
1856 /* Wait for the next buffer to become available for data or status */
1857 bh = common->next_buffhd_to_fill;
1858 common->next_buffhd_to_drain = bh;
1859 rc = sleep_thread(common, false, bh);
1860 if (rc)
1861 return rc;
1862
1863 common->phase_error = 0;
1864 common->short_packet_received = 0;
1865
1866 down_read(&common->filesem); /* We're using the backing file */
1867 switch (common->cmnd[0]) {
1868
1869 case INQUIRY:
1870 common->data_size_from_cmnd = common->cmnd[4];
1871 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1872 (1<<4), 0,
1873 "INQUIRY");
1874 if (reply == 0)
1875 reply = do_inquiry(common, bh);
1876 break;
1877
1878 case MODE_SELECT:
1879 common->data_size_from_cmnd = common->cmnd[4];
1880 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
1881 (1<<1) | (1<<4), 0,
1882 "MODE SELECT(6)");
1883 if (reply == 0)
1884 reply = do_mode_select(common, bh);
1885 break;
1886
1887 case MODE_SELECT_10:
1888 common->data_size_from_cmnd =
1889 get_unaligned_be16(&common->cmnd[7]);
1890 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
1891 (1<<1) | (3<<7), 0,
1892 "MODE SELECT(10)");
1893 if (reply == 0)
1894 reply = do_mode_select(common, bh);
1895 break;
1896
1897 case MODE_SENSE:
1898 common->data_size_from_cmnd = common->cmnd[4];
1899 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1900 (1<<1) | (1<<2) | (1<<4), 0,
1901 "MODE SENSE(6)");
1902 if (reply == 0)
1903 reply = do_mode_sense(common, bh);
1904 break;
1905
1906 case MODE_SENSE_10:
1907 common->data_size_from_cmnd =
1908 get_unaligned_be16(&common->cmnd[7]);
1909 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1910 (1<<1) | (1<<2) | (3<<7), 0,
1911 "MODE SENSE(10)");
1912 if (reply == 0)
1913 reply = do_mode_sense(common, bh);
1914 break;
1915
1916 case ALLOW_MEDIUM_REMOVAL:
1917 common->data_size_from_cmnd = 0;
1918 reply = check_command(common, 6, DATA_DIR_NONE,
1919 (1<<4), 0,
1920 "PREVENT-ALLOW MEDIUM REMOVAL");
1921 if (reply == 0)
1922 reply = do_prevent_allow(common);
1923 break;
1924
1925 case READ_6:
1926 i = common->cmnd[4];
1927 common->data_size_from_cmnd = (i == 0) ? 256 : i;
1928 reply = check_command_size_in_blocks(common, 6,
1929 DATA_DIR_TO_HOST,
1930 (7<<1) | (1<<4), 1,
1931 "READ(6)");
1932 if (reply == 0)
1933 reply = do_read(common);
1934 break;
1935
1936 case READ_10:
1937 common->data_size_from_cmnd =
1938 get_unaligned_be16(&common->cmnd[7]);
1939 reply = check_command_size_in_blocks(common, 10,
1940 DATA_DIR_TO_HOST,
1941 (1<<1) | (0xf<<2) | (3<<7), 1,
1942 "READ(10)");
1943 if (reply == 0)
1944 reply = do_read(common);
1945 break;
1946
1947 case READ_12:
1948 common->data_size_from_cmnd =
1949 get_unaligned_be32(&common->cmnd[6]);
1950 reply = check_command_size_in_blocks(common, 12,
1951 DATA_DIR_TO_HOST,
1952 (1<<1) | (0xf<<2) | (0xf<<6), 1,
1953 "READ(12)");
1954 if (reply == 0)
1955 reply = do_read(common);
1956 break;
1957
1958 case READ_16:
1959 common->data_size_from_cmnd =
1960 get_unaligned_be32(&common->cmnd[10]);
1961 reply = check_command_size_in_blocks(common, 16,
1962 DATA_DIR_TO_HOST,
1963 (1<<1) | (0xff<<2) | (0xf<<10), 1,
1964 "READ(16)");
1965 if (reply == 0)
1966 reply = do_read(common);
1967 break;
1968
1969 case READ_CAPACITY:
1970 common->data_size_from_cmnd = 8;
1971 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1972 (0xf<<2) | (1<<8), 1,
1973 "READ CAPACITY");
1974 if (reply == 0)
1975 reply = do_read_capacity(common, bh);
1976 break;
1977
1978 case READ_HEADER:
1979 if (!common->curlun || !common->curlun->cdrom)
1980 goto unknown_cmnd;
1981 common->data_size_from_cmnd =
1982 get_unaligned_be16(&common->cmnd[7]);
1983 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1984 (3<<7) | (0x1f<<1), 1,
1985 "READ HEADER");
1986 if (reply == 0)
1987 reply = do_read_header(common, bh);
1988 break;
1989
1990 case READ_TOC:
1991 if (!common->curlun || !common->curlun->cdrom)
1992 goto unknown_cmnd;
1993 common->data_size_from_cmnd =
1994 get_unaligned_be16(&common->cmnd[7]);
1995 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1996 (0xf<<6) | (3<<1), 1,
1997 "READ TOC");
1998 if (reply == 0)
1999 reply = do_read_toc(common, bh);
2000 break;
2001
2002 case READ_FORMAT_CAPACITIES:
2003 common->data_size_from_cmnd =
2004 get_unaligned_be16(&common->cmnd[7]);
2005 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2006 (3<<7), 1,
2007 "READ FORMAT CAPACITIES");
2008 if (reply == 0)
2009 reply = do_read_format_capacities(common, bh);
2010 break;
2011
2012 case REQUEST_SENSE:
2013 common->data_size_from_cmnd = common->cmnd[4];
2014 reply = check_command(common, 6, DATA_DIR_TO_HOST,
2015 (1<<4), 0,
2016 "REQUEST SENSE");
2017 if (reply == 0)
2018 reply = do_request_sense(common, bh);
2019 break;
2020
2021 case SERVICE_ACTION_IN_16:
2022 switch (common->cmnd[1] & 0x1f) {
2023
2024 case SAI_READ_CAPACITY_16:
2025 common->data_size_from_cmnd =
2026 get_unaligned_be32(&common->cmnd[10]);
2027 reply = check_command(common, 16, DATA_DIR_TO_HOST,
2028 (1<<1) | (0xff<<2) | (0xf<<10) |
2029 (1<<14), 1,
2030 "READ CAPACITY(16)");
2031 if (reply == 0)
2032 reply = do_read_capacity_16(common, bh);
2033 break;
2034
2035 default:
2036 goto unknown_cmnd;
2037 }
2038 break;
2039
2040 case START_STOP:
2041 common->data_size_from_cmnd = 0;
2042 reply = check_command(common, 6, DATA_DIR_NONE,
2043 (1<<1) | (1<<4), 0,
2044 "START-STOP UNIT");
2045 if (reply == 0)
2046 reply = do_start_stop(common);
2047 break;
2048
2049 case SYNCHRONIZE_CACHE:
2050 common->data_size_from_cmnd = 0;
2051 reply = check_command(common, 10, DATA_DIR_NONE,
2052 (0xf<<2) | (3<<7), 1,
2053 "SYNCHRONIZE CACHE");
2054 if (reply == 0)
2055 reply = do_synchronize_cache(common);
2056 break;
2057
2058 case TEST_UNIT_READY:
2059 common->data_size_from_cmnd = 0;
2060 reply = check_command(common, 6, DATA_DIR_NONE,
2061 0, 1,
2062 "TEST UNIT READY");
2063 break;
2064
2065 /*
2066 * Although optional, this command is used by MS-Windows. We
2067 * support a minimal version: BytChk must be 0.
2068 */
2069 case VERIFY:
2070 common->data_size_from_cmnd = 0;
2071 reply = check_command(common, 10, DATA_DIR_NONE,
2072 (1<<1) | (0xf<<2) | (3<<7), 1,
2073 "VERIFY");
2074 if (reply == 0)
2075 reply = do_verify(common);
2076 break;
2077
2078 case WRITE_6:
2079 i = common->cmnd[4];
2080 common->data_size_from_cmnd = (i == 0) ? 256 : i;
2081 reply = check_command_size_in_blocks(common, 6,
2082 DATA_DIR_FROM_HOST,
2083 (7<<1) | (1<<4), 1,
2084 "WRITE(6)");
2085 if (reply == 0)
2086 reply = do_write(common);
2087 break;
2088
2089 case WRITE_10:
2090 common->data_size_from_cmnd =
2091 get_unaligned_be16(&common->cmnd[7]);
2092 reply = check_command_size_in_blocks(common, 10,
2093 DATA_DIR_FROM_HOST,
2094 (1<<1) | (0xf<<2) | (3<<7), 1,
2095 "WRITE(10)");
2096 if (reply == 0)
2097 reply = do_write(common);
2098 break;
2099
2100 case WRITE_12:
2101 common->data_size_from_cmnd =
2102 get_unaligned_be32(&common->cmnd[6]);
2103 reply = check_command_size_in_blocks(common, 12,
2104 DATA_DIR_FROM_HOST,
2105 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2106 "WRITE(12)");
2107 if (reply == 0)
2108 reply = do_write(common);
2109 break;
2110
2111 case WRITE_16:
2112 common->data_size_from_cmnd =
2113 get_unaligned_be32(&common->cmnd[10]);
2114 reply = check_command_size_in_blocks(common, 16,
2115 DATA_DIR_FROM_HOST,
2116 (1<<1) | (0xff<<2) | (0xf<<10), 1,
2117 "WRITE(16)");
2118 if (reply == 0)
2119 reply = do_write(common);
2120 break;
2121
2122 /*
2123 * Some mandatory commands that we recognize but don't implement.
2124 * They don't mean much in this setting. It's left as an exercise
2125 * for anyone interested to implement RESERVE and RELEASE in terms
2126 * of Posix locks.
2127 */
2128 case FORMAT_UNIT:
2129 case RELEASE:
2130 case RESERVE:
2131 case SEND_DIAGNOSTIC:
2132
2133 default:
2134unknown_cmnd:
2135 common->data_size_from_cmnd = 0;
2136 sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
2137 reply = check_command(common, common->cmnd_size,
2138 DATA_DIR_UNKNOWN, ~0, 0, unknown);
2139 if (reply == 0) {
2140 common->curlun->sense_data = SS_INVALID_COMMAND;
2141 reply = -EINVAL;
2142 }
2143 break;
2144 }
2145 up_read(&common->filesem);
2146
2147 if (reply == -EINTR || signal_pending(current))
2148 return -EINTR;
2149
2150 /* Set up the single reply buffer for finish_reply() */
2151 if (reply == -EINVAL)
2152 reply = 0; /* Error reply length */
2153 if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
2154 reply = min((u32)reply, common->data_size_from_cmnd);
2155 bh->inreq->length = reply;
2156 bh->state = BUF_STATE_FULL;
2157 common->residue -= reply;
2158 } /* Otherwise it's already set */
2159
2160 return 0;
2161}
2162
2163
2164/*-------------------------------------------------------------------------*/
2165
2166static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2167{
2168 struct usb_request *req = bh->outreq;
2169 struct bulk_cb_wrap *cbw = req->buf;
2170 struct fsg_common *common = fsg->common;
2171
2172 /* Was this a real packet? Should it be ignored? */
2173 if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2174 return -EINVAL;
2175
2176 /* Is the CBW valid? */
2177 if (req->actual != US_BULK_CB_WRAP_LEN ||
2178 cbw->Signature != cpu_to_le32(
2179 US_BULK_CB_SIGN)) {
2180 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2181 req->actual,
2182 le32_to_cpu(cbw->Signature));
2183
2184 /*
2185 * The Bulk-only spec says we MUST stall the IN endpoint
2186 * (6.6.1), so it's unavoidable. It also says we must
2187 * retain this state until the next reset, but there's
2188 * no way to tell the controller driver it should ignore
2189 * Clear-Feature(HALT) requests.
2190 *
2191 * We aren't required to halt the OUT endpoint; instead
2192 * we can simply accept and discard any data received
2193 * until the next reset.
2194 */
2195 wedge_bulk_in_endpoint(fsg);
2196 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2197 return -EINVAL;
2198 }
2199
2200 /* Is the CBW meaningful? */
2201 if (cbw->Lun >= ARRAY_SIZE(common->luns) ||
2202 cbw->Flags & ~US_BULK_FLAG_IN || cbw->Length <= 0 ||
2203 cbw->Length > MAX_COMMAND_SIZE) {
2204 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2205 "cmdlen %u\n",
2206 cbw->Lun, cbw->Flags, cbw->Length);
2207
2208 /*
2209 * We can do anything we want here, so let's stall the
2210 * bulk pipes if we are allowed to.
2211 */
2212 if (common->can_stall) {
2213 fsg_set_halt(fsg, fsg->bulk_out);
2214 halt_bulk_in_endpoint(fsg);
2215 }
2216 return -EINVAL;
2217 }
2218
2219 /* Save the command for later */
2220 common->cmnd_size = cbw->Length;
2221 memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
2222 if (cbw->Flags & US_BULK_FLAG_IN)
2223 common->data_dir = DATA_DIR_TO_HOST;
2224 else
2225 common->data_dir = DATA_DIR_FROM_HOST;
2226 common->data_size = le32_to_cpu(cbw->DataTransferLength);
2227 if (common->data_size == 0)
2228 common->data_dir = DATA_DIR_NONE;
2229 common->lun = cbw->Lun;
2230 if (common->lun < ARRAY_SIZE(common->luns))
2231 common->curlun = common->luns[common->lun];
2232 else
2233 common->curlun = NULL;
2234 common->tag = cbw->Tag;
2235 return 0;
2236}
2237
2238static int get_next_command(struct fsg_common *common)
2239{
2240 struct fsg_buffhd *bh;
2241 int rc = 0;
2242
2243 /* Wait for the next buffer to become available */
2244 bh = common->next_buffhd_to_fill;
2245 rc = sleep_thread(common, true, bh);
2246 if (rc)
2247 return rc;
2248
2249 /* Queue a request to read a Bulk-only CBW */
2250 set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN);
2251 if (!start_out_transfer(common, bh))
2252 /* Don't know what to do if common->fsg is NULL */
2253 return -EIO;
2254
2255 /*
2256 * We will drain the buffer in software, which means we
2257 * can reuse it for the next filling. No need to advance
2258 * next_buffhd_to_fill.
2259 */
2260
2261 /* Wait for the CBW to arrive */
2262 rc = sleep_thread(common, true, bh);
2263 if (rc)
2264 return rc;
2265
2266 rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
2267 bh->state = BUF_STATE_EMPTY;
2268
2269 return rc;
2270}
2271
2272
2273/*-------------------------------------------------------------------------*/
2274
2275static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
2276 struct usb_request **preq)
2277{
2278 *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2279 if (*preq)
2280 return 0;
2281 ERROR(common, "can't allocate request for %s\n", ep->name);
2282 return -ENOMEM;
2283}
2284
2285/* Reset interface setting and re-init endpoint state (toggle etc). */
2286static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
2287{
2288 struct fsg_dev *fsg;
2289 int i, rc = 0;
2290
2291 if (common->running)
2292 DBG(common, "reset interface\n");
2293
2294reset:
2295 /* Deallocate the requests */
2296 if (common->fsg) {
2297 fsg = common->fsg;
2298
2299 for (i = 0; i < common->fsg_num_buffers; ++i) {
2300 struct fsg_buffhd *bh = &common->buffhds[i];
2301
2302 if (bh->inreq) {
2303 usb_ep_free_request(fsg->bulk_in, bh->inreq);
2304 bh->inreq = NULL;
2305 }
2306 if (bh->outreq) {
2307 usb_ep_free_request(fsg->bulk_out, bh->outreq);
2308 bh->outreq = NULL;
2309 }
2310 }
2311
2312 /* Disable the endpoints */
2313 if (fsg->bulk_in_enabled) {
2314 usb_ep_disable(fsg->bulk_in);
2315 fsg->bulk_in_enabled = 0;
2316 }
2317 if (fsg->bulk_out_enabled) {
2318 usb_ep_disable(fsg->bulk_out);
2319 fsg->bulk_out_enabled = 0;
2320 }
2321
2322 common->fsg = NULL;
2323 wake_up(&common->fsg_wait);
2324 }
2325
2326 common->running = 0;
2327 if (!new_fsg || rc)
2328 return rc;
2329
2330 common->fsg = new_fsg;
2331 fsg = common->fsg;
2332
2333 /* Enable the endpoints */
2334 rc = config_ep_by_speed(common->gadget, &(fsg->function), fsg->bulk_in);
2335 if (rc)
2336 goto reset;
2337 rc = usb_ep_enable(fsg->bulk_in);
2338 if (rc)
2339 goto reset;
2340 fsg->bulk_in->driver_data = common;
2341 fsg->bulk_in_enabled = 1;
2342
2343 rc = config_ep_by_speed(common->gadget, &(fsg->function),
2344 fsg->bulk_out);
2345 if (rc)
2346 goto reset;
2347 rc = usb_ep_enable(fsg->bulk_out);
2348 if (rc)
2349 goto reset;
2350 fsg->bulk_out->driver_data = common;
2351 fsg->bulk_out_enabled = 1;
2352 common->bulk_out_maxpacket = usb_endpoint_maxp(fsg->bulk_out->desc);
2353 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2354
2355 /* Allocate the requests */
2356 for (i = 0; i < common->fsg_num_buffers; ++i) {
2357 struct fsg_buffhd *bh = &common->buffhds[i];
2358
2359 rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
2360 if (rc)
2361 goto reset;
2362 rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
2363 if (rc)
2364 goto reset;
2365 bh->inreq->buf = bh->outreq->buf = bh->buf;
2366 bh->inreq->context = bh->outreq->context = bh;
2367 bh->inreq->complete = bulk_in_complete;
2368 bh->outreq->complete = bulk_out_complete;
2369 }
2370
2371 common->running = 1;
2372 for (i = 0; i < ARRAY_SIZE(common->luns); ++i)
2373 if (common->luns[i])
2374 common->luns[i]->unit_attention_data =
2375 SS_RESET_OCCURRED;
2376 return rc;
2377}
2378
2379
2380/****************************** ALT CONFIGS ******************************/
2381
2382static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2383{
2384 struct fsg_dev *fsg = fsg_from_func(f);
2385
2386 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
2387 return USB_GADGET_DELAYED_STATUS;
2388}
2389
2390static void fsg_disable(struct usb_function *f)
2391{
2392 struct fsg_dev *fsg = fsg_from_func(f);
2393
2394 /* Disable the endpoints */
2395 if (fsg->bulk_in_enabled) {
2396 usb_ep_disable(fsg->bulk_in);
2397 fsg->bulk_in_enabled = 0;
2398 }
2399 if (fsg->bulk_out_enabled) {
2400 usb_ep_disable(fsg->bulk_out);
2401 fsg->bulk_out_enabled = 0;
2402 }
2403
2404 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
2405}
2406
2407
2408/*-------------------------------------------------------------------------*/
2409
2410static void handle_exception(struct fsg_common *common)
2411{
2412 int i;
2413 struct fsg_buffhd *bh;
2414 enum fsg_state old_state;
2415 struct fsg_lun *curlun;
2416 unsigned int exception_req_tag;
2417 struct fsg_dev *new_fsg;
2418
2419 /*
2420 * Clear the existing signals. Anything but SIGUSR1 is converted
2421 * into a high-priority EXIT exception.
2422 */
2423 for (;;) {
2424 int sig = kernel_dequeue_signal();
2425 if (!sig)
2426 break;
2427 if (sig != SIGUSR1) {
2428 spin_lock_irq(&common->lock);
2429 if (common->state < FSG_STATE_EXIT)
2430 DBG(common, "Main thread exiting on signal\n");
2431 common->state = FSG_STATE_EXIT;
2432 spin_unlock_irq(&common->lock);
2433 }
2434 }
2435
2436 /* Cancel all the pending transfers */
2437 if (likely(common->fsg)) {
2438 for (i = 0; i < common->fsg_num_buffers; ++i) {
2439 bh = &common->buffhds[i];
2440 if (bh->state == BUF_STATE_SENDING)
2441 usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
2442 if (bh->state == BUF_STATE_RECEIVING)
2443 usb_ep_dequeue(common->fsg->bulk_out,
2444 bh->outreq);
2445
2446 /* Wait for a transfer to become idle */
2447 if (sleep_thread(common, false, bh))
2448 return;
2449 }
2450
2451 /* Clear out the controller's fifos */
2452 if (common->fsg->bulk_in_enabled)
2453 usb_ep_fifo_flush(common->fsg->bulk_in);
2454 if (common->fsg->bulk_out_enabled)
2455 usb_ep_fifo_flush(common->fsg->bulk_out);
2456 }
2457
2458 /*
2459 * Reset the I/O buffer states and pointers, the SCSI
2460 * state, and the exception. Then invoke the handler.
2461 */
2462 spin_lock_irq(&common->lock);
2463
2464 for (i = 0; i < common->fsg_num_buffers; ++i) {
2465 bh = &common->buffhds[i];
2466 bh->state = BUF_STATE_EMPTY;
2467 }
2468 common->next_buffhd_to_fill = &common->buffhds[0];
2469 common->next_buffhd_to_drain = &common->buffhds[0];
2470 exception_req_tag = common->exception_req_tag;
2471 new_fsg = common->exception_arg;
2472 old_state = common->state;
2473 common->state = FSG_STATE_NORMAL;
2474
2475 if (old_state != FSG_STATE_ABORT_BULK_OUT) {
2476 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) {
2477 curlun = common->luns[i];
2478 if (!curlun)
2479 continue;
2480 curlun->prevent_medium_removal = 0;
2481 curlun->sense_data = SS_NO_SENSE;
2482 curlun->unit_attention_data = SS_NO_SENSE;
2483 curlun->sense_data_info = 0;
2484 curlun->info_valid = 0;
2485 }
2486 }
2487 spin_unlock_irq(&common->lock);
2488
2489 /* Carry out any extra actions required for the exception */
2490 switch (old_state) {
2491 case FSG_STATE_NORMAL:
2492 break;
2493
2494 case FSG_STATE_ABORT_BULK_OUT:
2495 send_status(common);
2496 break;
2497
2498 case FSG_STATE_PROTOCOL_RESET:
2499 /*
2500 * In case we were forced against our will to halt a
2501 * bulk endpoint, clear the halt now. (The SuperH UDC
2502 * requires this.)
2503 */
2504 if (!fsg_is_set(common))
2505 break;
2506 if (test_and_clear_bit(IGNORE_BULK_OUT,
2507 &common->fsg->atomic_bitflags))
2508 usb_ep_clear_halt(common->fsg->bulk_in);
2509
2510 if (common->ep0_req_tag == exception_req_tag)
2511 ep0_queue(common); /* Complete the status stage */
2512
2513 /*
2514 * Technically this should go here, but it would only be
2515 * a waste of time. Ditto for the INTERFACE_CHANGE and
2516 * CONFIG_CHANGE cases.
2517 */
2518 /* for (i = 0; i < common->ARRAY_SIZE(common->luns); ++i) */
2519 /* if (common->luns[i]) */
2520 /* common->luns[i]->unit_attention_data = */
2521 /* SS_RESET_OCCURRED; */
2522 break;
2523
2524 case FSG_STATE_CONFIG_CHANGE:
2525 do_set_interface(common, new_fsg);
2526 if (new_fsg)
2527 usb_composite_setup_continue(common->cdev);
2528 break;
2529
2530 case FSG_STATE_EXIT:
2531 do_set_interface(common, NULL); /* Free resources */
2532 spin_lock_irq(&common->lock);
2533 common->state = FSG_STATE_TERMINATED; /* Stop the thread */
2534 spin_unlock_irq(&common->lock);
2535 break;
2536
2537 case FSG_STATE_TERMINATED:
2538 break;
2539 }
2540}
2541
2542
2543/*-------------------------------------------------------------------------*/
2544
2545static int fsg_main_thread(void *common_)
2546{
2547 struct fsg_common *common = common_;
2548 int i;
2549
2550 /*
2551 * Allow the thread to be killed by a signal, but set the signal mask
2552 * to block everything but INT, TERM, KILL, and USR1.
2553 */
2554 allow_signal(SIGINT);
2555 allow_signal(SIGTERM);
2556 allow_signal(SIGKILL);
2557 allow_signal(SIGUSR1);
2558
2559 /* Allow the thread to be frozen */
2560 set_freezable();
2561
2562 /* The main loop */
2563 while (common->state != FSG_STATE_TERMINATED) {
2564 if (exception_in_progress(common) || signal_pending(current)) {
2565 handle_exception(common);
2566 continue;
2567 }
2568
2569 if (!common->running) {
2570 sleep_thread(common, true, NULL);
2571 continue;
2572 }
2573
2574 if (get_next_command(common) || exception_in_progress(common))
2575 continue;
2576 if (do_scsi_command(common) || exception_in_progress(common))
2577 continue;
2578 if (finish_reply(common) || exception_in_progress(common))
2579 continue;
2580 send_status(common);
2581 }
2582
2583 spin_lock_irq(&common->lock);
2584 common->thread_task = NULL;
2585 spin_unlock_irq(&common->lock);
2586
2587 /* Eject media from all LUNs */
2588
2589 down_write(&common->filesem);
2590 for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
2591 struct fsg_lun *curlun = common->luns[i];
2592
2593 if (curlun && fsg_lun_is_open(curlun))
2594 fsg_lun_close(curlun);
2595 }
2596 up_write(&common->filesem);
2597
2598 /* Let fsg_unbind() know the thread has exited */
2599 kthread_complete_and_exit(&common->thread_notifier, 0);
2600}
2601
2602
2603/*************************** DEVICE ATTRIBUTES ***************************/
2604
2605static ssize_t ro_show(struct device *dev, struct device_attribute *attr, char *buf)
2606{
2607 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2608
2609 return fsg_show_ro(curlun, buf);
2610}
2611
2612static ssize_t nofua_show(struct device *dev, struct device_attribute *attr,
2613 char *buf)
2614{
2615 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2616
2617 return fsg_show_nofua(curlun, buf);
2618}
2619
2620static ssize_t file_show(struct device *dev, struct device_attribute *attr,
2621 char *buf)
2622{
2623 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2624 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2625
2626 return fsg_show_file(curlun, filesem, buf);
2627}
2628
2629static ssize_t ro_store(struct device *dev, struct device_attribute *attr,
2630 const char *buf, size_t count)
2631{
2632 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2633 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2634
2635 return fsg_store_ro(curlun, filesem, buf, count);
2636}
2637
2638static ssize_t nofua_store(struct device *dev, struct device_attribute *attr,
2639 const char *buf, size_t count)
2640{
2641 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2642
2643 return fsg_store_nofua(curlun, buf, count);
2644}
2645
2646static ssize_t file_store(struct device *dev, struct device_attribute *attr,
2647 const char *buf, size_t count)
2648{
2649 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2650 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2651
2652 return fsg_store_file(curlun, filesem, buf, count);
2653}
2654
2655static ssize_t forced_eject_store(struct device *dev,
2656 struct device_attribute *attr,
2657 const char *buf, size_t count)
2658{
2659 struct fsg_lun *curlun = fsg_lun_from_dev(dev);
2660 struct rw_semaphore *filesem = dev_get_drvdata(dev);
2661
2662 return fsg_store_forced_eject(curlun, filesem, buf, count);
2663}
2664
2665static DEVICE_ATTR_RW(nofua);
2666static DEVICE_ATTR_WO(forced_eject);
2667
2668/*
2669 * Mode of the ro and file attribute files will be overridden in
2670 * fsg_lun_dev_is_visible() depending on if this is a cdrom, or if it is a
2671 * removable device.
2672 */
2673static DEVICE_ATTR_RW(ro);
2674static DEVICE_ATTR_RW(file);
2675
2676/****************************** FSG COMMON ******************************/
2677
2678static void fsg_lun_release(struct device *dev)
2679{
2680 /* Nothing needs to be done */
2681}
2682
2683static struct fsg_common *fsg_common_setup(struct fsg_common *common)
2684{
2685 if (!common) {
2686 common = kzalloc(sizeof(*common), GFP_KERNEL);
2687 if (!common)
2688 return ERR_PTR(-ENOMEM);
2689 common->free_storage_on_release = 1;
2690 } else {
2691 common->free_storage_on_release = 0;
2692 }
2693 init_rwsem(&common->filesem);
2694 spin_lock_init(&common->lock);
2695 init_completion(&common->thread_notifier);
2696 init_waitqueue_head(&common->io_wait);
2697 init_waitqueue_head(&common->fsg_wait);
2698 common->state = FSG_STATE_TERMINATED;
2699 memset(common->luns, 0, sizeof(common->luns));
2700
2701 return common;
2702}
2703
2704void fsg_common_set_sysfs(struct fsg_common *common, bool sysfs)
2705{
2706 common->sysfs = sysfs;
2707}
2708EXPORT_SYMBOL_GPL(fsg_common_set_sysfs);
2709
2710static void _fsg_common_free_buffers(struct fsg_buffhd *buffhds, unsigned n)
2711{
2712 if (buffhds) {
2713 struct fsg_buffhd *bh = buffhds;
2714 while (n--) {
2715 kfree(bh->buf);
2716 ++bh;
2717 }
2718 kfree(buffhds);
2719 }
2720}
2721
2722int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n)
2723{
2724 struct fsg_buffhd *bh, *buffhds;
2725 int i;
2726
2727 buffhds = kcalloc(n, sizeof(*buffhds), GFP_KERNEL);
2728 if (!buffhds)
2729 return -ENOMEM;
2730
2731 /* Data buffers cyclic list */
2732 bh = buffhds;
2733 i = n;
2734 goto buffhds_first_it;
2735 do {
2736 bh->next = bh + 1;
2737 ++bh;
2738buffhds_first_it:
2739 bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL);
2740 if (unlikely(!bh->buf))
2741 goto error_release;
2742 } while (--i);
2743 bh->next = buffhds;
2744
2745 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
2746 common->fsg_num_buffers = n;
2747 common->buffhds = buffhds;
2748
2749 return 0;
2750
2751error_release:
2752 /*
2753 * "buf"s pointed to by heads after n - i are NULL
2754 * so releasing them won't hurt
2755 */
2756 _fsg_common_free_buffers(buffhds, n);
2757
2758 return -ENOMEM;
2759}
2760EXPORT_SYMBOL_GPL(fsg_common_set_num_buffers);
2761
2762void fsg_common_remove_lun(struct fsg_lun *lun)
2763{
2764 if (device_is_registered(&lun->dev))
2765 device_unregister(&lun->dev);
2766 fsg_lun_close(lun);
2767 kfree(lun);
2768}
2769EXPORT_SYMBOL_GPL(fsg_common_remove_lun);
2770
2771static void _fsg_common_remove_luns(struct fsg_common *common, int n)
2772{
2773 int i;
2774
2775 for (i = 0; i < n; ++i)
2776 if (common->luns[i]) {
2777 fsg_common_remove_lun(common->luns[i]);
2778 common->luns[i] = NULL;
2779 }
2780}
2781
2782void fsg_common_remove_luns(struct fsg_common *common)
2783{
2784 _fsg_common_remove_luns(common, ARRAY_SIZE(common->luns));
2785}
2786EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
2787
2788void fsg_common_free_buffers(struct fsg_common *common)
2789{
2790 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
2791 common->buffhds = NULL;
2792}
2793EXPORT_SYMBOL_GPL(fsg_common_free_buffers);
2794
2795int fsg_common_set_cdev(struct fsg_common *common,
2796 struct usb_composite_dev *cdev, bool can_stall)
2797{
2798 struct usb_string *us;
2799
2800 common->gadget = cdev->gadget;
2801 common->ep0 = cdev->gadget->ep0;
2802 common->ep0req = cdev->req;
2803 common->cdev = cdev;
2804
2805 us = usb_gstrings_attach(cdev, fsg_strings_array,
2806 ARRAY_SIZE(fsg_strings));
2807 if (IS_ERR(us))
2808 return PTR_ERR(us);
2809
2810 fsg_intf_desc.iInterface = us[FSG_STRING_INTERFACE].id;
2811
2812 /*
2813 * Some peripheral controllers are known not to be able to
2814 * halt bulk endpoints correctly. If one of them is present,
2815 * disable stalls.
2816 */
2817 common->can_stall = can_stall &&
2818 gadget_is_stall_supported(common->gadget);
2819
2820 return 0;
2821}
2822EXPORT_SYMBOL_GPL(fsg_common_set_cdev);
2823
2824static struct attribute *fsg_lun_dev_attrs[] = {
2825 &dev_attr_ro.attr,
2826 &dev_attr_file.attr,
2827 &dev_attr_nofua.attr,
2828 &dev_attr_forced_eject.attr,
2829 NULL
2830};
2831
2832static umode_t fsg_lun_dev_is_visible(struct kobject *kobj,
2833 struct attribute *attr, int idx)
2834{
2835 struct device *dev = kobj_to_dev(kobj);
2836 struct fsg_lun *lun = fsg_lun_from_dev(dev);
2837
2838 if (attr == &dev_attr_ro.attr)
2839 return lun->cdrom ? S_IRUGO : (S_IWUSR | S_IRUGO);
2840 if (attr == &dev_attr_file.attr)
2841 return lun->removable ? (S_IWUSR | S_IRUGO) : S_IRUGO;
2842 return attr->mode;
2843}
2844
2845static const struct attribute_group fsg_lun_dev_group = {
2846 .attrs = fsg_lun_dev_attrs,
2847 .is_visible = fsg_lun_dev_is_visible,
2848};
2849
2850static const struct attribute_group *fsg_lun_dev_groups[] = {
2851 &fsg_lun_dev_group,
2852 NULL
2853};
2854
2855int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
2856 unsigned int id, const char *name,
2857 const char **name_pfx)
2858{
2859 struct fsg_lun *lun;
2860 char *pathbuf, *p;
2861 int rc = -ENOMEM;
2862
2863 if (id >= ARRAY_SIZE(common->luns))
2864 return -ENODEV;
2865
2866 if (common->luns[id])
2867 return -EBUSY;
2868
2869 if (!cfg->filename && !cfg->removable) {
2870 pr_err("no file given for LUN%d\n", id);
2871 return -EINVAL;
2872 }
2873
2874 lun = kzalloc(sizeof(*lun), GFP_KERNEL);
2875 if (!lun)
2876 return -ENOMEM;
2877
2878 lun->name_pfx = name_pfx;
2879
2880 lun->cdrom = !!cfg->cdrom;
2881 lun->ro = cfg->cdrom || cfg->ro;
2882 lun->initially_ro = lun->ro;
2883 lun->removable = !!cfg->removable;
2884
2885 if (!common->sysfs) {
2886 /* we DON'T own the name!*/
2887 lun->name = name;
2888 } else {
2889 lun->dev.release = fsg_lun_release;
2890 lun->dev.parent = &common->gadget->dev;
2891 lun->dev.groups = fsg_lun_dev_groups;
2892 dev_set_drvdata(&lun->dev, &common->filesem);
2893 dev_set_name(&lun->dev, "%s", name);
2894 lun->name = dev_name(&lun->dev);
2895
2896 rc = device_register(&lun->dev);
2897 if (rc) {
2898 pr_info("failed to register LUN%d: %d\n", id, rc);
2899 put_device(&lun->dev);
2900 goto error_sysfs;
2901 }
2902 }
2903
2904 common->luns[id] = lun;
2905
2906 if (cfg->filename) {
2907 rc = fsg_lun_open(lun, cfg->filename);
2908 if (rc)
2909 goto error_lun;
2910 }
2911
2912 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
2913 p = "(no medium)";
2914 if (fsg_lun_is_open(lun)) {
2915 p = "(error)";
2916 if (pathbuf) {
2917 p = file_path(lun->filp, pathbuf, PATH_MAX);
2918 if (IS_ERR(p))
2919 p = "(error)";
2920 }
2921 }
2922 pr_info("LUN: %s%s%sfile: %s\n",
2923 lun->removable ? "removable " : "",
2924 lun->ro ? "read only " : "",
2925 lun->cdrom ? "CD-ROM " : "",
2926 p);
2927 kfree(pathbuf);
2928
2929 return 0;
2930
2931error_lun:
2932 if (device_is_registered(&lun->dev))
2933 device_unregister(&lun->dev);
2934 fsg_lun_close(lun);
2935 common->luns[id] = NULL;
2936error_sysfs:
2937 kfree(lun);
2938 return rc;
2939}
2940EXPORT_SYMBOL_GPL(fsg_common_create_lun);
2941
2942int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg)
2943{
2944 char buf[8]; /* enough for 100000000 different numbers, decimal */
2945 int i, rc;
2946
2947 fsg_common_remove_luns(common);
2948
2949 for (i = 0; i < cfg->nluns; ++i) {
2950 snprintf(buf, sizeof(buf), "lun%d", i);
2951 rc = fsg_common_create_lun(common, &cfg->luns[i], i, buf, NULL);
2952 if (rc)
2953 goto fail;
2954 }
2955
2956 pr_info("Number of LUNs=%d\n", cfg->nluns);
2957
2958 return 0;
2959
2960fail:
2961 _fsg_common_remove_luns(common, i);
2962 return rc;
2963}
2964EXPORT_SYMBOL_GPL(fsg_common_create_luns);
2965
2966void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
2967 const char *pn)
2968{
2969 int i;
2970
2971 /* Prepare inquiryString */
2972 i = get_default_bcdDevice();
2973 snprintf(common->inquiry_string, sizeof(common->inquiry_string),
2974 "%-8s%-16s%04x", vn ?: "Linux",
2975 /* Assume product name dependent on the first LUN */
2976 pn ?: ((*common->luns)->cdrom
2977 ? "File-CD Gadget"
2978 : "File-Stor Gadget"),
2979 i);
2980}
2981EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string);
2982
2983static void fsg_common_release(struct fsg_common *common)
2984{
2985 int i;
2986
2987 /* If the thread isn't already dead, tell it to exit now */
2988 if (common->state != FSG_STATE_TERMINATED) {
2989 raise_exception(common, FSG_STATE_EXIT);
2990 wait_for_completion(&common->thread_notifier);
2991 }
2992
2993 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) {
2994 struct fsg_lun *lun = common->luns[i];
2995 if (!lun)
2996 continue;
2997 fsg_lun_close(lun);
2998 if (device_is_registered(&lun->dev))
2999 device_unregister(&lun->dev);
3000 kfree(lun);
3001 }
3002
3003 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
3004 if (common->free_storage_on_release)
3005 kfree(common);
3006}
3007
3008
3009/*-------------------------------------------------------------------------*/
3010
3011static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
3012{
3013 struct fsg_dev *fsg = fsg_from_func(f);
3014 struct fsg_common *common = fsg->common;
3015 struct usb_gadget *gadget = c->cdev->gadget;
3016 int i;
3017 struct usb_ep *ep;
3018 unsigned max_burst;
3019 int ret;
3020 struct fsg_opts *opts;
3021
3022 /* Don't allow to bind if we don't have at least one LUN */
3023 ret = _fsg_common_get_max_lun(common);
3024 if (ret < 0) {
3025 pr_err("There should be at least one LUN.\n");
3026 return -EINVAL;
3027 }
3028
3029 opts = fsg_opts_from_func_inst(f->fi);
3030 if (!opts->no_configfs) {
3031 ret = fsg_common_set_cdev(fsg->common, c->cdev,
3032 fsg->common->can_stall);
3033 if (ret)
3034 return ret;
3035 fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
3036 }
3037
3038 if (!common->thread_task) {
3039 common->state = FSG_STATE_NORMAL;
3040 common->thread_task =
3041 kthread_create(fsg_main_thread, common, "file-storage");
3042 if (IS_ERR(common->thread_task)) {
3043 ret = PTR_ERR(common->thread_task);
3044 common->thread_task = NULL;
3045 common->state = FSG_STATE_TERMINATED;
3046 return ret;
3047 }
3048 DBG(common, "I/O thread pid: %d\n",
3049 task_pid_nr(common->thread_task));
3050 wake_up_process(common->thread_task);
3051 }
3052
3053 fsg->gadget = gadget;
3054
3055 /* New interface */
3056 i = usb_interface_id(c, f);
3057 if (i < 0)
3058 goto fail;
3059 fsg_intf_desc.bInterfaceNumber = i;
3060 fsg->interface_number = i;
3061
3062 /* Find all the endpoints we will use */
3063 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
3064 if (!ep)
3065 goto autoconf_fail;
3066 fsg->bulk_in = ep;
3067
3068 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
3069 if (!ep)
3070 goto autoconf_fail;
3071 fsg->bulk_out = ep;
3072
3073 /* Assume endpoint addresses are the same for both speeds */
3074 fsg_hs_bulk_in_desc.bEndpointAddress =
3075 fsg_fs_bulk_in_desc.bEndpointAddress;
3076 fsg_hs_bulk_out_desc.bEndpointAddress =
3077 fsg_fs_bulk_out_desc.bEndpointAddress;
3078
3079 /* Calculate bMaxBurst, we know packet size is 1024 */
3080 max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15);
3081
3082 fsg_ss_bulk_in_desc.bEndpointAddress =
3083 fsg_fs_bulk_in_desc.bEndpointAddress;
3084 fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
3085
3086 fsg_ss_bulk_out_desc.bEndpointAddress =
3087 fsg_fs_bulk_out_desc.bEndpointAddress;
3088 fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
3089
3090 ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function,
3091 fsg_ss_function, fsg_ss_function);
3092 if (ret)
3093 goto autoconf_fail;
3094
3095 return 0;
3096
3097autoconf_fail:
3098 ERROR(fsg, "unable to autoconfigure all endpoints\n");
3099 i = -ENOTSUPP;
3100fail:
3101 /* terminate the thread */
3102 if (fsg->common->state != FSG_STATE_TERMINATED) {
3103 raise_exception(fsg->common, FSG_STATE_EXIT);
3104 wait_for_completion(&fsg->common->thread_notifier);
3105 }
3106 return i;
3107}
3108
3109/****************************** ALLOCATE FUNCTION *************************/
3110
3111static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
3112{
3113 struct fsg_dev *fsg = fsg_from_func(f);
3114 struct fsg_common *common = fsg->common;
3115
3116 DBG(fsg, "unbind\n");
3117 if (fsg->common->fsg == fsg) {
3118 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
3119 /* FIXME: make interruptible or killable somehow? */
3120 wait_event(common->fsg_wait, common->fsg != fsg);
3121 }
3122
3123 usb_free_all_descriptors(&fsg->function);
3124}
3125
3126static inline struct fsg_lun_opts *to_fsg_lun_opts(struct config_item *item)
3127{
3128 return container_of(to_config_group(item), struct fsg_lun_opts, group);
3129}
3130
3131static inline struct fsg_opts *to_fsg_opts(struct config_item *item)
3132{
3133 return container_of(to_config_group(item), struct fsg_opts,
3134 func_inst.group);
3135}
3136
3137static void fsg_lun_attr_release(struct config_item *item)
3138{
3139 struct fsg_lun_opts *lun_opts;
3140
3141 lun_opts = to_fsg_lun_opts(item);
3142 kfree(lun_opts);
3143}
3144
3145static struct configfs_item_operations fsg_lun_item_ops = {
3146 .release = fsg_lun_attr_release,
3147};
3148
3149static ssize_t fsg_lun_opts_file_show(struct config_item *item, char *page)
3150{
3151 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3152 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3153
3154 return fsg_show_file(opts->lun, &fsg_opts->common->filesem, page);
3155}
3156
3157static ssize_t fsg_lun_opts_file_store(struct config_item *item,
3158 const char *page, size_t len)
3159{
3160 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3161 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3162
3163 return fsg_store_file(opts->lun, &fsg_opts->common->filesem, page, len);
3164}
3165
3166CONFIGFS_ATTR(fsg_lun_opts_, file);
3167
3168static ssize_t fsg_lun_opts_ro_show(struct config_item *item, char *page)
3169{
3170 return fsg_show_ro(to_fsg_lun_opts(item)->lun, page);
3171}
3172
3173static ssize_t fsg_lun_opts_ro_store(struct config_item *item,
3174 const char *page, size_t len)
3175{
3176 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3177 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3178
3179 return fsg_store_ro(opts->lun, &fsg_opts->common->filesem, page, len);
3180}
3181
3182CONFIGFS_ATTR(fsg_lun_opts_, ro);
3183
3184static ssize_t fsg_lun_opts_removable_show(struct config_item *item,
3185 char *page)
3186{
3187 return fsg_show_removable(to_fsg_lun_opts(item)->lun, page);
3188}
3189
3190static ssize_t fsg_lun_opts_removable_store(struct config_item *item,
3191 const char *page, size_t len)
3192{
3193 return fsg_store_removable(to_fsg_lun_opts(item)->lun, page, len);
3194}
3195
3196CONFIGFS_ATTR(fsg_lun_opts_, removable);
3197
3198static ssize_t fsg_lun_opts_cdrom_show(struct config_item *item, char *page)
3199{
3200 return fsg_show_cdrom(to_fsg_lun_opts(item)->lun, page);
3201}
3202
3203static ssize_t fsg_lun_opts_cdrom_store(struct config_item *item,
3204 const char *page, size_t len)
3205{
3206 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3207 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3208
3209 return fsg_store_cdrom(opts->lun, &fsg_opts->common->filesem, page,
3210 len);
3211}
3212
3213CONFIGFS_ATTR(fsg_lun_opts_, cdrom);
3214
3215static ssize_t fsg_lun_opts_nofua_show(struct config_item *item, char *page)
3216{
3217 return fsg_show_nofua(to_fsg_lun_opts(item)->lun, page);
3218}
3219
3220static ssize_t fsg_lun_opts_nofua_store(struct config_item *item,
3221 const char *page, size_t len)
3222{
3223 return fsg_store_nofua(to_fsg_lun_opts(item)->lun, page, len);
3224}
3225
3226CONFIGFS_ATTR(fsg_lun_opts_, nofua);
3227
3228static ssize_t fsg_lun_opts_inquiry_string_show(struct config_item *item,
3229 char *page)
3230{
3231 return fsg_show_inquiry_string(to_fsg_lun_opts(item)->lun, page);
3232}
3233
3234static ssize_t fsg_lun_opts_inquiry_string_store(struct config_item *item,
3235 const char *page, size_t len)
3236{
3237 return fsg_store_inquiry_string(to_fsg_lun_opts(item)->lun, page, len);
3238}
3239
3240CONFIGFS_ATTR(fsg_lun_opts_, inquiry_string);
3241
3242static ssize_t fsg_lun_opts_forced_eject_store(struct config_item *item,
3243 const char *page, size_t len)
3244{
3245 struct fsg_lun_opts *opts = to_fsg_lun_opts(item);
3246 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
3247
3248 return fsg_store_forced_eject(opts->lun, &fsg_opts->common->filesem,
3249 page, len);
3250}
3251
3252CONFIGFS_ATTR_WO(fsg_lun_opts_, forced_eject);
3253
3254static struct configfs_attribute *fsg_lun_attrs[] = {
3255 &fsg_lun_opts_attr_file,
3256 &fsg_lun_opts_attr_ro,
3257 &fsg_lun_opts_attr_removable,
3258 &fsg_lun_opts_attr_cdrom,
3259 &fsg_lun_opts_attr_nofua,
3260 &fsg_lun_opts_attr_inquiry_string,
3261 &fsg_lun_opts_attr_forced_eject,
3262 NULL,
3263};
3264
3265static const struct config_item_type fsg_lun_type = {
3266 .ct_item_ops = &fsg_lun_item_ops,
3267 .ct_attrs = fsg_lun_attrs,
3268 .ct_owner = THIS_MODULE,
3269};
3270
3271static struct config_group *fsg_lun_make(struct config_group *group,
3272 const char *name)
3273{
3274 struct fsg_lun_opts *opts;
3275 struct fsg_opts *fsg_opts;
3276 struct fsg_lun_config config;
3277 char *num_str;
3278 u8 num;
3279 int ret;
3280
3281 num_str = strchr(name, '.');
3282 if (!num_str) {
3283 pr_err("Unable to locate . in LUN.NUMBER\n");
3284 return ERR_PTR(-EINVAL);
3285 }
3286 num_str++;
3287
3288 ret = kstrtou8(num_str, 0, &num);
3289 if (ret)
3290 return ERR_PTR(ret);
3291
3292 fsg_opts = to_fsg_opts(&group->cg_item);
3293 if (num >= FSG_MAX_LUNS)
3294 return ERR_PTR(-ERANGE);
3295 num = array_index_nospec(num, FSG_MAX_LUNS);
3296
3297 mutex_lock(&fsg_opts->lock);
3298 if (fsg_opts->refcnt || fsg_opts->common->luns[num]) {
3299 ret = -EBUSY;
3300 goto out;
3301 }
3302
3303 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3304 if (!opts) {
3305 ret = -ENOMEM;
3306 goto out;
3307 }
3308
3309 memset(&config, 0, sizeof(config));
3310 config.removable = true;
3311
3312 ret = fsg_common_create_lun(fsg_opts->common, &config, num, name,
3313 (const char **)&group->cg_item.ci_name);
3314 if (ret) {
3315 kfree(opts);
3316 goto out;
3317 }
3318 opts->lun = fsg_opts->common->luns[num];
3319 opts->lun_id = num;
3320 mutex_unlock(&fsg_opts->lock);
3321
3322 config_group_init_type_name(&opts->group, name, &fsg_lun_type);
3323
3324 return &opts->group;
3325out:
3326 mutex_unlock(&fsg_opts->lock);
3327 return ERR_PTR(ret);
3328}
3329
3330static void fsg_lun_drop(struct config_group *group, struct config_item *item)
3331{
3332 struct fsg_lun_opts *lun_opts;
3333 struct fsg_opts *fsg_opts;
3334
3335 lun_opts = to_fsg_lun_opts(item);
3336 fsg_opts = to_fsg_opts(&group->cg_item);
3337
3338 mutex_lock(&fsg_opts->lock);
3339 if (fsg_opts->refcnt) {
3340 struct config_item *gadget;
3341
3342 gadget = group->cg_item.ci_parent->ci_parent;
3343 unregister_gadget_item(gadget);
3344 }
3345
3346 fsg_common_remove_lun(lun_opts->lun);
3347 fsg_opts->common->luns[lun_opts->lun_id] = NULL;
3348 lun_opts->lun_id = 0;
3349 mutex_unlock(&fsg_opts->lock);
3350
3351 config_item_put(item);
3352}
3353
3354static void fsg_attr_release(struct config_item *item)
3355{
3356 struct fsg_opts *opts = to_fsg_opts(item);
3357
3358 usb_put_function_instance(&opts->func_inst);
3359}
3360
3361static struct configfs_item_operations fsg_item_ops = {
3362 .release = fsg_attr_release,
3363};
3364
3365static ssize_t fsg_opts_stall_show(struct config_item *item, char *page)
3366{
3367 struct fsg_opts *opts = to_fsg_opts(item);
3368 int result;
3369
3370 mutex_lock(&opts->lock);
3371 result = sprintf(page, "%d", opts->common->can_stall);
3372 mutex_unlock(&opts->lock);
3373
3374 return result;
3375}
3376
3377static ssize_t fsg_opts_stall_store(struct config_item *item, const char *page,
3378 size_t len)
3379{
3380 struct fsg_opts *opts = to_fsg_opts(item);
3381 int ret;
3382 bool stall;
3383
3384 mutex_lock(&opts->lock);
3385
3386 if (opts->refcnt) {
3387 mutex_unlock(&opts->lock);
3388 return -EBUSY;
3389 }
3390
3391 ret = kstrtobool(page, &stall);
3392 if (!ret) {
3393 opts->common->can_stall = stall;
3394 ret = len;
3395 }
3396
3397 mutex_unlock(&opts->lock);
3398
3399 return ret;
3400}
3401
3402CONFIGFS_ATTR(fsg_opts_, stall);
3403
3404#ifdef CONFIG_USB_GADGET_DEBUG_FILES
3405static ssize_t fsg_opts_num_buffers_show(struct config_item *item, char *page)
3406{
3407 struct fsg_opts *opts = to_fsg_opts(item);
3408 int result;
3409
3410 mutex_lock(&opts->lock);
3411 result = sprintf(page, "%d", opts->common->fsg_num_buffers);
3412 mutex_unlock(&opts->lock);
3413
3414 return result;
3415}
3416
3417static ssize_t fsg_opts_num_buffers_store(struct config_item *item,
3418 const char *page, size_t len)
3419{
3420 struct fsg_opts *opts = to_fsg_opts(item);
3421 int ret;
3422 u8 num;
3423
3424 mutex_lock(&opts->lock);
3425 if (opts->refcnt) {
3426 ret = -EBUSY;
3427 goto end;
3428 }
3429 ret = kstrtou8(page, 0, &num);
3430 if (ret)
3431 goto end;
3432
3433 ret = fsg_common_set_num_buffers(opts->common, num);
3434 if (ret)
3435 goto end;
3436 ret = len;
3437
3438end:
3439 mutex_unlock(&opts->lock);
3440 return ret;
3441}
3442
3443CONFIGFS_ATTR(fsg_opts_, num_buffers);
3444#endif
3445
3446static struct configfs_attribute *fsg_attrs[] = {
3447 &fsg_opts_attr_stall,
3448#ifdef CONFIG_USB_GADGET_DEBUG_FILES
3449 &fsg_opts_attr_num_buffers,
3450#endif
3451 NULL,
3452};
3453
3454static struct configfs_group_operations fsg_group_ops = {
3455 .make_group = fsg_lun_make,
3456 .drop_item = fsg_lun_drop,
3457};
3458
3459static const struct config_item_type fsg_func_type = {
3460 .ct_item_ops = &fsg_item_ops,
3461 .ct_group_ops = &fsg_group_ops,
3462 .ct_attrs = fsg_attrs,
3463 .ct_owner = THIS_MODULE,
3464};
3465
3466static void fsg_free_inst(struct usb_function_instance *fi)
3467{
3468 struct fsg_opts *opts;
3469
3470 opts = fsg_opts_from_func_inst(fi);
3471 fsg_common_release(opts->common);
3472 kfree(opts);
3473}
3474
3475static struct usb_function_instance *fsg_alloc_inst(void)
3476{
3477 struct fsg_opts *opts;
3478 struct fsg_lun_config config;
3479 int rc;
3480
3481 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3482 if (!opts)
3483 return ERR_PTR(-ENOMEM);
3484 mutex_init(&opts->lock);
3485 opts->func_inst.free_func_inst = fsg_free_inst;
3486 opts->common = fsg_common_setup(opts->common);
3487 if (IS_ERR(opts->common)) {
3488 rc = PTR_ERR(opts->common);
3489 goto release_opts;
3490 }
3491
3492 rc = fsg_common_set_num_buffers(opts->common,
3493 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS);
3494 if (rc)
3495 goto release_common;
3496
3497 pr_info(FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
3498
3499 memset(&config, 0, sizeof(config));
3500 config.removable = true;
3501 rc = fsg_common_create_lun(opts->common, &config, 0, "lun.0",
3502 (const char **)&opts->func_inst.group.cg_item.ci_name);
3503 if (rc)
3504 goto release_buffers;
3505
3506 opts->lun0.lun = opts->common->luns[0];
3507 opts->lun0.lun_id = 0;
3508
3509 config_group_init_type_name(&opts->func_inst.group, "", &fsg_func_type);
3510
3511 config_group_init_type_name(&opts->lun0.group, "lun.0", &fsg_lun_type);
3512 configfs_add_default_group(&opts->lun0.group, &opts->func_inst.group);
3513
3514 return &opts->func_inst;
3515
3516release_buffers:
3517 fsg_common_free_buffers(opts->common);
3518release_common:
3519 kfree(opts->common);
3520release_opts:
3521 kfree(opts);
3522 return ERR_PTR(rc);
3523}
3524
3525static void fsg_free(struct usb_function *f)
3526{
3527 struct fsg_dev *fsg;
3528 struct fsg_opts *opts;
3529
3530 fsg = container_of(f, struct fsg_dev, function);
3531 opts = container_of(f->fi, struct fsg_opts, func_inst);
3532
3533 mutex_lock(&opts->lock);
3534 opts->refcnt--;
3535 mutex_unlock(&opts->lock);
3536
3537 kfree(fsg);
3538}
3539
3540static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
3541{
3542 struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
3543 struct fsg_common *common = opts->common;
3544 struct fsg_dev *fsg;
3545
3546 fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
3547 if (unlikely(!fsg))
3548 return ERR_PTR(-ENOMEM);
3549
3550 mutex_lock(&opts->lock);
3551 opts->refcnt++;
3552 mutex_unlock(&opts->lock);
3553
3554 fsg->function.name = FSG_DRIVER_DESC;
3555 fsg->function.bind = fsg_bind;
3556 fsg->function.unbind = fsg_unbind;
3557 fsg->function.setup = fsg_setup;
3558 fsg->function.set_alt = fsg_set_alt;
3559 fsg->function.disable = fsg_disable;
3560 fsg->function.free_func = fsg_free;
3561
3562 fsg->common = common;
3563
3564 return &fsg->function;
3565}
3566
3567DECLARE_USB_FUNCTION_INIT(mass_storage, fsg_alloc_inst, fsg_alloc);
3568MODULE_LICENSE("GPL");
3569MODULE_AUTHOR("Michal Nazarewicz");
3570
3571/************************* Module parameters *************************/
3572
3573
3574void fsg_config_from_params(struct fsg_config *cfg,
3575 const struct fsg_module_parameters *params,
3576 unsigned int fsg_num_buffers)
3577{
3578 struct fsg_lun_config *lun;
3579 unsigned i;
3580
3581 /* Configure LUNs */
3582 cfg->nluns =
3583 min(params->luns ?: (params->file_count ?: 1u),
3584 (unsigned)FSG_MAX_LUNS);
3585 for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) {
3586 lun->ro = !!params->ro[i];
3587 lun->cdrom = !!params->cdrom[i];
3588 lun->removable = !!params->removable[i];
3589 lun->filename =
3590 params->file_count > i && params->file[i][0]
3591 ? params->file[i]
3592 : NULL;
3593 }
3594
3595 /* Let MSF use defaults */
3596 cfg->vendor_name = NULL;
3597 cfg->product_name = NULL;
3598
3599 cfg->ops = NULL;
3600 cfg->private_data = NULL;
3601
3602 /* Finalise */
3603 cfg->can_stall = params->stall;
3604 cfg->fsg_num_buffers = fsg_num_buffers;
3605}
3606EXPORT_SYMBOL_GPL(fsg_config_from_params);