Loading...
Note: File does not exist in v6.8.
1/*
2 * file_storage.c -- File-backed USB Storage Gadget, for USB development
3 *
4 * Copyright (C) 2003-2008 Alan Stern
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions, and the following disclaimer,
12 * without modification.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. The names of the above-listed copyright holders may not be used
17 * to endorse or promote products derived from this software without
18 * specific prior written permission.
19 *
20 * ALTERNATIVELY, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") as published by the Free Software
22 * Foundation, either version 2 of that License or (at your option) any
23 * later version.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
26 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
27 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
29 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
30 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
31 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
32 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
34 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
35 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 */
37
38
39/*
40 * The File-backed Storage Gadget acts as a USB Mass Storage device,
41 * appearing to the host as a disk drive or as a CD-ROM drive. In addition
42 * to providing an example of a genuinely useful gadget driver for a USB
43 * device, it also illustrates a technique of double-buffering for increased
44 * throughput. Last but not least, it gives an easy way to probe the
45 * behavior of the Mass Storage drivers in a USB host.
46 *
47 * Backing storage is provided by a regular file or a block device, specified
48 * by the "file" module parameter. Access can be limited to read-only by
49 * setting the optional "ro" module parameter. (For CD-ROM emulation,
50 * access is always read-only.) The gadget will indicate that it has
51 * removable media if the optional "removable" module parameter is set.
52 *
53 * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
54 * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
55 * by the optional "transport" module parameter. It also supports the
56 * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
57 * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
58 * the optional "protocol" module parameter. In addition, the default
59 * Vendor ID, Product ID, release number and serial number can be overridden.
60 *
61 * There is support for multiple logical units (LUNs), each of which has
62 * its own backing file. The number of LUNs can be set using the optional
63 * "luns" module parameter (anywhere from 1 to 8), and the corresponding
64 * files are specified using comma-separated lists for "file" and "ro".
65 * The default number of LUNs is taken from the number of "file" elements;
66 * it is 1 if "file" is not given. If "removable" is not set then a backing
67 * file must be specified for each LUN. If it is set, then an unspecified
68 * or empty backing filename means the LUN's medium is not loaded. Ideally
69 * each LUN would be settable independently as a disk drive or a CD-ROM
70 * drive, but currently all LUNs have to be the same type. The CD-ROM
71 * emulation includes a single data track and no audio tracks; hence there
72 * need be only one backing file per LUN. Note also that the CD-ROM block
73 * length is set to 512 rather than the more common value 2048.
74 *
75 * Requirements are modest; only a bulk-in and a bulk-out endpoint are
76 * needed (an interrupt-out endpoint is also needed for CBI). The memory
77 * requirement amounts to two 16K buffers, size configurable by a parameter.
78 * Support is included for both full-speed and high-speed operation.
79 *
80 * Note that the driver is slightly non-portable in that it assumes a
81 * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
82 * interrupt-in endpoints. With most device controllers this isn't an
83 * issue, but there may be some with hardware restrictions that prevent
84 * a buffer from being used by more than one endpoint.
85 *
86 * Module options:
87 *
88 * file=filename[,filename...]
89 * Required if "removable" is not set, names of
90 * the files or block devices used for
91 * backing storage
92 * serial=HHHH... Required serial number (string of hex chars)
93 * ro=b[,b...] Default false, booleans for read-only access
94 * removable Default false, boolean for removable media
95 * luns=N Default N = number of filenames, number of
96 * LUNs to support
97 * nofua=b[,b...] Default false, booleans for ignore FUA flag
98 * in SCSI WRITE(10,12) commands
99 * stall Default determined according to the type of
100 * USB device controller (usually true),
101 * boolean to permit the driver to halt
102 * bulk endpoints
103 * cdrom Default false, boolean for whether to emulate
104 * a CD-ROM drive
105 * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
106 * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
107 * ATAPI, QIC, UFI, 8070, or SCSI;
108 * also 1 - 6)
109 * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
110 * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
111 * release=0xRRRR Override the USB release number (bcdDevice)
112 * buflen=N Default N=16384, buffer size used (will be
113 * rounded down to a multiple of
114 * PAGE_CACHE_SIZE)
115 *
116 * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
117 * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
118 * default values are used for everything else.
119 *
120 * The pathnames of the backing files and the ro settings are available in
121 * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
122 * the gadget's sysfs directory. If the "removable" option is set, writing to
123 * these files will simulate ejecting/loading the medium (writing an empty
124 * line means eject) and adjusting a write-enable tab. Changes to the ro
125 * setting are not allowed when the medium is loaded or if CD-ROM emulation
126 * is being used.
127 *
128 * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
129 * The driver's SCSI command interface was based on the "Information
130 * technology - Small Computer System Interface - 2" document from
131 * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
132 * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
133 * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
134 * "Universal Serial Bus Mass Storage Class UFI Command Specification"
135 * document, Revision 1.0, December 14, 1998, available at
136 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
137 */
138
139
140/*
141 * Driver Design
142 *
143 * The FSG driver is fairly straightforward. There is a main kernel
144 * thread that handles most of the work. Interrupt routines field
145 * callbacks from the controller driver: bulk- and interrupt-request
146 * completion notifications, endpoint-0 events, and disconnect events.
147 * Completion events are passed to the main thread by wakeup calls. Many
148 * ep0 requests are handled at interrupt time, but SetInterface,
149 * SetConfiguration, and device reset requests are forwarded to the
150 * thread in the form of "exceptions" using SIGUSR1 signals (since they
151 * should interrupt any ongoing file I/O operations).
152 *
153 * The thread's main routine implements the standard command/data/status
154 * parts of a SCSI interaction. It and its subroutines are full of tests
155 * for pending signals/exceptions -- all this polling is necessary since
156 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
157 * indication that the driver really wants to be running in userspace.)
158 * An important point is that so long as the thread is alive it keeps an
159 * open reference to the backing file. This will prevent unmounting
160 * the backing file's underlying filesystem and could cause problems
161 * during system shutdown, for example. To prevent such problems, the
162 * thread catches INT, TERM, and KILL signals and converts them into
163 * an EXIT exception.
164 *
165 * In normal operation the main thread is started during the gadget's
166 * fsg_bind() callback and stopped during fsg_unbind(). But it can also
167 * exit when it receives a signal, and there's no point leaving the
168 * gadget running when the thread is dead. So just before the thread
169 * exits, it deregisters the gadget driver. This makes things a little
170 * tricky: The driver is deregistered at two places, and the exiting
171 * thread can indirectly call fsg_unbind() which in turn can tell the
172 * thread to exit. The first problem is resolved through the use of the
173 * REGISTERED atomic bitflag; the driver will only be deregistered once.
174 * The second problem is resolved by having fsg_unbind() check
175 * fsg->state; it won't try to stop the thread if the state is already
176 * FSG_STATE_TERMINATED.
177 *
178 * To provide maximum throughput, the driver uses a circular pipeline of
179 * buffer heads (struct fsg_buffhd). In principle the pipeline can be
180 * arbitrarily long; in practice the benefits don't justify having more
181 * than 2 stages (i.e., double buffering). But it helps to think of the
182 * pipeline as being a long one. Each buffer head contains a bulk-in and
183 * a bulk-out request pointer (since the buffer can be used for both
184 * output and input -- directions always are given from the host's
185 * point of view) as well as a pointer to the buffer and various state
186 * variables.
187 *
188 * Use of the pipeline follows a simple protocol. There is a variable
189 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
190 * At any time that buffer head may still be in use from an earlier
191 * request, so each buffer head has a state variable indicating whether
192 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
193 * buffer head to be EMPTY, filling the buffer either by file I/O or by
194 * USB I/O (during which the buffer head is BUSY), and marking the buffer
195 * head FULL when the I/O is complete. Then the buffer will be emptied
196 * (again possibly by USB I/O, during which it is marked BUSY) and
197 * finally marked EMPTY again (possibly by a completion routine).
198 *
199 * A module parameter tells the driver to avoid stalling the bulk
200 * endpoints wherever the transport specification allows. This is
201 * necessary for some UDCs like the SuperH, which cannot reliably clear a
202 * halt on a bulk endpoint. However, under certain circumstances the
203 * Bulk-only specification requires a stall. In such cases the driver
204 * will halt the endpoint and set a flag indicating that it should clear
205 * the halt in software during the next device reset. Hopefully this
206 * will permit everything to work correctly. Furthermore, although the
207 * specification allows the bulk-out endpoint to halt when the host sends
208 * too much data, implementing this would cause an unavoidable race.
209 * The driver will always use the "no-stall" approach for OUT transfers.
210 *
211 * One subtle point concerns sending status-stage responses for ep0
212 * requests. Some of these requests, such as device reset, can involve
213 * interrupting an ongoing file I/O operation, which might take an
214 * arbitrarily long time. During that delay the host might give up on
215 * the original ep0 request and issue a new one. When that happens the
216 * driver should not notify the host about completion of the original
217 * request, as the host will no longer be waiting for it. So the driver
218 * assigns to each ep0 request a unique tag, and it keeps track of the
219 * tag value of the request associated with a long-running exception
220 * (device-reset, interface-change, or configuration-change). When the
221 * exception handler is finished, the status-stage response is submitted
222 * only if the current ep0 request tag is equal to the exception request
223 * tag. Thus only the most recently received ep0 request will get a
224 * status-stage response.
225 *
226 * Warning: This driver source file is too long. It ought to be split up
227 * into a header file plus about 3 separate .c files, to handle the details
228 * of the Gadget, USB Mass Storage, and SCSI protocols.
229 */
230
231
232/* #define VERBOSE_DEBUG */
233/* #define DUMP_MSGS */
234
235
236#include <linux/blkdev.h>
237#include <linux/completion.h>
238#include <linux/dcache.h>
239#include <linux/delay.h>
240#include <linux/device.h>
241#include <linux/fcntl.h>
242#include <linux/file.h>
243#include <linux/fs.h>
244#include <linux/kref.h>
245#include <linux/kthread.h>
246#include <linux/limits.h>
247#include <linux/rwsem.h>
248#include <linux/slab.h>
249#include <linux/spinlock.h>
250#include <linux/string.h>
251#include <linux/freezer.h>
252#include <linux/utsname.h>
253
254#include <linux/usb/ch9.h>
255#include <linux/usb/gadget.h>
256
257#include "gadget_chips.h"
258
259
260
261/*
262 * Kbuild is not very cooperative with respect to linking separately
263 * compiled library objects into one module. So for now we won't use
264 * separate compilation ... ensuring init/exit sections work to shrink
265 * the runtime footprint, and giving us at least some parts of what
266 * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
267 */
268#include "usbstring.c"
269#include "config.c"
270#include "epautoconf.c"
271
272/*-------------------------------------------------------------------------*/
273
274#define DRIVER_DESC "File-backed Storage Gadget"
275#define DRIVER_NAME "g_file_storage"
276#define DRIVER_VERSION "1 September 2010"
277
278static char fsg_string_manufacturer[64];
279static const char fsg_string_product[] = DRIVER_DESC;
280static const char fsg_string_config[] = "Self-powered";
281static const char fsg_string_interface[] = "Mass Storage";
282
283
284#include "storage_common.c"
285
286
287MODULE_DESCRIPTION(DRIVER_DESC);
288MODULE_AUTHOR("Alan Stern");
289MODULE_LICENSE("Dual BSD/GPL");
290
291/*
292 * This driver assumes self-powered hardware and has no way for users to
293 * trigger remote wakeup. It uses autoconfiguration to select endpoints
294 * and endpoint addresses.
295 */
296
297
298/*-------------------------------------------------------------------------*/
299
300
301/* Encapsulate the module parameter settings */
302
303static struct {
304 char *file[FSG_MAX_LUNS];
305 char *serial;
306 int ro[FSG_MAX_LUNS];
307 int nofua[FSG_MAX_LUNS];
308 unsigned int num_filenames;
309 unsigned int num_ros;
310 unsigned int num_nofuas;
311 unsigned int nluns;
312
313 int removable;
314 int can_stall;
315 int cdrom;
316
317 char *transport_parm;
318 char *protocol_parm;
319 unsigned short vendor;
320 unsigned short product;
321 unsigned short release;
322 unsigned int buflen;
323
324 int transport_type;
325 char *transport_name;
326 int protocol_type;
327 char *protocol_name;
328
329} mod_data = { // Default values
330 .transport_parm = "BBB",
331 .protocol_parm = "SCSI",
332 .removable = 0,
333 .can_stall = 1,
334 .cdrom = 0,
335 .vendor = FSG_VENDOR_ID,
336 .product = FSG_PRODUCT_ID,
337 .release = 0xffff, // Use controller chip type
338 .buflen = 16384,
339 };
340
341
342module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
343 S_IRUGO);
344MODULE_PARM_DESC(file, "names of backing files or devices");
345
346module_param_named(serial, mod_data.serial, charp, S_IRUGO);
347MODULE_PARM_DESC(serial, "USB serial number");
348
349module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
350MODULE_PARM_DESC(ro, "true to force read-only");
351
352module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
353 S_IRUGO);
354MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
355
356module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
357MODULE_PARM_DESC(luns, "number of LUNs");
358
359module_param_named(removable, mod_data.removable, bool, S_IRUGO);
360MODULE_PARM_DESC(removable, "true to simulate removable media");
361
362module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
363MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
364
365module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
366MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
367
368/* In the non-TEST version, only the module parameters listed above
369 * are available. */
370#ifdef CONFIG_USB_FILE_STORAGE_TEST
371
372module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
373MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
374
375module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
376MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
377 "8070, or SCSI)");
378
379module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
380MODULE_PARM_DESC(vendor, "USB Vendor ID");
381
382module_param_named(product, mod_data.product, ushort, S_IRUGO);
383MODULE_PARM_DESC(product, "USB Product ID");
384
385module_param_named(release, mod_data.release, ushort, S_IRUGO);
386MODULE_PARM_DESC(release, "USB release number");
387
388module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
389MODULE_PARM_DESC(buflen, "I/O buffer size");
390
391#endif /* CONFIG_USB_FILE_STORAGE_TEST */
392
393
394/*
395 * These definitions will permit the compiler to avoid generating code for
396 * parts of the driver that aren't used in the non-TEST version. Even gcc
397 * can recognize when a test of a constant expression yields a dead code
398 * path.
399 */
400
401#ifdef CONFIG_USB_FILE_STORAGE_TEST
402
403#define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
404#define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
405#define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
406
407#else
408
409#define transport_is_bbb() 1
410#define transport_is_cbi() 0
411#define protocol_is_scsi() 1
412
413#endif /* CONFIG_USB_FILE_STORAGE_TEST */
414
415
416/*-------------------------------------------------------------------------*/
417
418
419struct fsg_dev {
420 /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
421 spinlock_t lock;
422 struct usb_gadget *gadget;
423
424 /* filesem protects: backing files in use */
425 struct rw_semaphore filesem;
426
427 /* reference counting: wait until all LUNs are released */
428 struct kref ref;
429
430 struct usb_ep *ep0; // Handy copy of gadget->ep0
431 struct usb_request *ep0req; // For control responses
432 unsigned int ep0_req_tag;
433 const char *ep0req_name;
434
435 struct usb_request *intreq; // For interrupt responses
436 int intreq_busy;
437 struct fsg_buffhd *intr_buffhd;
438
439 unsigned int bulk_out_maxpacket;
440 enum fsg_state state; // For exception handling
441 unsigned int exception_req_tag;
442
443 u8 config, new_config;
444
445 unsigned int running : 1;
446 unsigned int bulk_in_enabled : 1;
447 unsigned int bulk_out_enabled : 1;
448 unsigned int intr_in_enabled : 1;
449 unsigned int phase_error : 1;
450 unsigned int short_packet_received : 1;
451 unsigned int bad_lun_okay : 1;
452
453 unsigned long atomic_bitflags;
454#define REGISTERED 0
455#define IGNORE_BULK_OUT 1
456#define SUSPENDED 2
457
458 struct usb_ep *bulk_in;
459 struct usb_ep *bulk_out;
460 struct usb_ep *intr_in;
461
462 struct fsg_buffhd *next_buffhd_to_fill;
463 struct fsg_buffhd *next_buffhd_to_drain;
464 struct fsg_buffhd buffhds[FSG_NUM_BUFFERS];
465
466 int thread_wakeup_needed;
467 struct completion thread_notifier;
468 struct task_struct *thread_task;
469
470 int cmnd_size;
471 u8 cmnd[MAX_COMMAND_SIZE];
472 enum data_direction data_dir;
473 u32 data_size;
474 u32 data_size_from_cmnd;
475 u32 tag;
476 unsigned int lun;
477 u32 residue;
478 u32 usb_amount_left;
479
480 /* The CB protocol offers no way for a host to know when a command
481 * has completed. As a result the next command may arrive early,
482 * and we will still have to handle it. For that reason we need
483 * a buffer to store new commands when using CB (or CBI, which
484 * does not oblige a host to wait for command completion either). */
485 int cbbuf_cmnd_size;
486 u8 cbbuf_cmnd[MAX_COMMAND_SIZE];
487
488 unsigned int nluns;
489 struct fsg_lun *luns;
490 struct fsg_lun *curlun;
491};
492
493typedef void (*fsg_routine_t)(struct fsg_dev *);
494
495static int exception_in_progress(struct fsg_dev *fsg)
496{
497 return (fsg->state > FSG_STATE_IDLE);
498}
499
500/* Make bulk-out requests be divisible by the maxpacket size */
501static void set_bulk_out_req_length(struct fsg_dev *fsg,
502 struct fsg_buffhd *bh, unsigned int length)
503{
504 unsigned int rem;
505
506 bh->bulk_out_intended_length = length;
507 rem = length % fsg->bulk_out_maxpacket;
508 if (rem > 0)
509 length += fsg->bulk_out_maxpacket - rem;
510 bh->outreq->length = length;
511}
512
513static struct fsg_dev *the_fsg;
514static struct usb_gadget_driver fsg_driver;
515
516
517/*-------------------------------------------------------------------------*/
518
519static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
520{
521 const char *name;
522
523 if (ep == fsg->bulk_in)
524 name = "bulk-in";
525 else if (ep == fsg->bulk_out)
526 name = "bulk-out";
527 else
528 name = ep->name;
529 DBG(fsg, "%s set halt\n", name);
530 return usb_ep_set_halt(ep);
531}
532
533
534/*-------------------------------------------------------------------------*/
535
536/*
537 * DESCRIPTORS ... most are static, but strings and (full) configuration
538 * descriptors are built on demand. Also the (static) config and interface
539 * descriptors are adjusted during fsg_bind().
540 */
541
542/* There is only one configuration. */
543#define CONFIG_VALUE 1
544
545static struct usb_device_descriptor
546device_desc = {
547 .bLength = sizeof device_desc,
548 .bDescriptorType = USB_DT_DEVICE,
549
550 .bcdUSB = cpu_to_le16(0x0200),
551 .bDeviceClass = USB_CLASS_PER_INTERFACE,
552
553 /* The next three values can be overridden by module parameters */
554 .idVendor = cpu_to_le16(FSG_VENDOR_ID),
555 .idProduct = cpu_to_le16(FSG_PRODUCT_ID),
556 .bcdDevice = cpu_to_le16(0xffff),
557
558 .iManufacturer = FSG_STRING_MANUFACTURER,
559 .iProduct = FSG_STRING_PRODUCT,
560 .iSerialNumber = FSG_STRING_SERIAL,
561 .bNumConfigurations = 1,
562};
563
564static struct usb_config_descriptor
565config_desc = {
566 .bLength = sizeof config_desc,
567 .bDescriptorType = USB_DT_CONFIG,
568
569 /* wTotalLength computed by usb_gadget_config_buf() */
570 .bNumInterfaces = 1,
571 .bConfigurationValue = CONFIG_VALUE,
572 .iConfiguration = FSG_STRING_CONFIG,
573 .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
574 .bMaxPower = CONFIG_USB_GADGET_VBUS_DRAW / 2,
575};
576
577
578static struct usb_qualifier_descriptor
579dev_qualifier = {
580 .bLength = sizeof dev_qualifier,
581 .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
582
583 .bcdUSB = cpu_to_le16(0x0200),
584 .bDeviceClass = USB_CLASS_PER_INTERFACE,
585
586 .bNumConfigurations = 1,
587};
588
589
590
591/*
592 * Config descriptors must agree with the code that sets configurations
593 * and with code managing interfaces and their altsettings. They must
594 * also handle different speeds and other-speed requests.
595 */
596static int populate_config_buf(struct usb_gadget *gadget,
597 u8 *buf, u8 type, unsigned index)
598{
599 enum usb_device_speed speed = gadget->speed;
600 int len;
601 const struct usb_descriptor_header **function;
602
603 if (index > 0)
604 return -EINVAL;
605
606 if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
607 speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
608 function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
609 ? (const struct usb_descriptor_header **)fsg_hs_function
610 : (const struct usb_descriptor_header **)fsg_fs_function;
611
612 /* for now, don't advertise srp-only devices */
613 if (!gadget_is_otg(gadget))
614 function++;
615
616 len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
617 ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
618 return len;
619}
620
621
622/*-------------------------------------------------------------------------*/
623
624/* These routines may be called in process context or in_irq */
625
626/* Caller must hold fsg->lock */
627static void wakeup_thread(struct fsg_dev *fsg)
628{
629 /* Tell the main thread that something has happened */
630 fsg->thread_wakeup_needed = 1;
631 if (fsg->thread_task)
632 wake_up_process(fsg->thread_task);
633}
634
635
636static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
637{
638 unsigned long flags;
639
640 /* Do nothing if a higher-priority exception is already in progress.
641 * If a lower-or-equal priority exception is in progress, preempt it
642 * and notify the main thread by sending it a signal. */
643 spin_lock_irqsave(&fsg->lock, flags);
644 if (fsg->state <= new_state) {
645 fsg->exception_req_tag = fsg->ep0_req_tag;
646 fsg->state = new_state;
647 if (fsg->thread_task)
648 send_sig_info(SIGUSR1, SEND_SIG_FORCED,
649 fsg->thread_task);
650 }
651 spin_unlock_irqrestore(&fsg->lock, flags);
652}
653
654
655/*-------------------------------------------------------------------------*/
656
657/* The disconnect callback and ep0 routines. These always run in_irq,
658 * except that ep0_queue() is called in the main thread to acknowledge
659 * completion of various requests: set config, set interface, and
660 * Bulk-only device reset. */
661
662static void fsg_disconnect(struct usb_gadget *gadget)
663{
664 struct fsg_dev *fsg = get_gadget_data(gadget);
665
666 DBG(fsg, "disconnect or port reset\n");
667 raise_exception(fsg, FSG_STATE_DISCONNECT);
668}
669
670
671static int ep0_queue(struct fsg_dev *fsg)
672{
673 int rc;
674
675 rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
676 if (rc != 0 && rc != -ESHUTDOWN) {
677
678 /* We can't do much more than wait for a reset */
679 WARNING(fsg, "error in submission: %s --> %d\n",
680 fsg->ep0->name, rc);
681 }
682 return rc;
683}
684
685static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
686{
687 struct fsg_dev *fsg = ep->driver_data;
688
689 if (req->actual > 0)
690 dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
691 if (req->status || req->actual != req->length)
692 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
693 req->status, req->actual, req->length);
694 if (req->status == -ECONNRESET) // Request was cancelled
695 usb_ep_fifo_flush(ep);
696
697 if (req->status == 0 && req->context)
698 ((fsg_routine_t) (req->context))(fsg);
699}
700
701
702/*-------------------------------------------------------------------------*/
703
704/* Bulk and interrupt endpoint completion handlers.
705 * These always run in_irq. */
706
707static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
708{
709 struct fsg_dev *fsg = ep->driver_data;
710 struct fsg_buffhd *bh = req->context;
711
712 if (req->status || req->actual != req->length)
713 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
714 req->status, req->actual, req->length);
715 if (req->status == -ECONNRESET) // Request was cancelled
716 usb_ep_fifo_flush(ep);
717
718 /* Hold the lock while we update the request and buffer states */
719 smp_wmb();
720 spin_lock(&fsg->lock);
721 bh->inreq_busy = 0;
722 bh->state = BUF_STATE_EMPTY;
723 wakeup_thread(fsg);
724 spin_unlock(&fsg->lock);
725}
726
727static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
728{
729 struct fsg_dev *fsg = ep->driver_data;
730 struct fsg_buffhd *bh = req->context;
731
732 dump_msg(fsg, "bulk-out", req->buf, req->actual);
733 if (req->status || req->actual != bh->bulk_out_intended_length)
734 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
735 req->status, req->actual,
736 bh->bulk_out_intended_length);
737 if (req->status == -ECONNRESET) // Request was cancelled
738 usb_ep_fifo_flush(ep);
739
740 /* Hold the lock while we update the request and buffer states */
741 smp_wmb();
742 spin_lock(&fsg->lock);
743 bh->outreq_busy = 0;
744 bh->state = BUF_STATE_FULL;
745 wakeup_thread(fsg);
746 spin_unlock(&fsg->lock);
747}
748
749
750#ifdef CONFIG_USB_FILE_STORAGE_TEST
751static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
752{
753 struct fsg_dev *fsg = ep->driver_data;
754 struct fsg_buffhd *bh = req->context;
755
756 if (req->status || req->actual != req->length)
757 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
758 req->status, req->actual, req->length);
759 if (req->status == -ECONNRESET) // Request was cancelled
760 usb_ep_fifo_flush(ep);
761
762 /* Hold the lock while we update the request and buffer states */
763 smp_wmb();
764 spin_lock(&fsg->lock);
765 fsg->intreq_busy = 0;
766 bh->state = BUF_STATE_EMPTY;
767 wakeup_thread(fsg);
768 spin_unlock(&fsg->lock);
769}
770
771#else
772static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
773{}
774#endif /* CONFIG_USB_FILE_STORAGE_TEST */
775
776
777/*-------------------------------------------------------------------------*/
778
779/* Ep0 class-specific handlers. These always run in_irq. */
780
781#ifdef CONFIG_USB_FILE_STORAGE_TEST
782static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
783{
784 struct usb_request *req = fsg->ep0req;
785 static u8 cbi_reset_cmnd[6] = {
786 SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
787
788 /* Error in command transfer? */
789 if (req->status || req->length != req->actual ||
790 req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
791
792 /* Not all controllers allow a protocol stall after
793 * receiving control-out data, but we'll try anyway. */
794 fsg_set_halt(fsg, fsg->ep0);
795 return; // Wait for reset
796 }
797
798 /* Is it the special reset command? */
799 if (req->actual >= sizeof cbi_reset_cmnd &&
800 memcmp(req->buf, cbi_reset_cmnd,
801 sizeof cbi_reset_cmnd) == 0) {
802
803 /* Raise an exception to stop the current operation
804 * and reinitialize our state. */
805 DBG(fsg, "cbi reset request\n");
806 raise_exception(fsg, FSG_STATE_RESET);
807 return;
808 }
809
810 VDBG(fsg, "CB[I] accept device-specific command\n");
811 spin_lock(&fsg->lock);
812
813 /* Save the command for later */
814 if (fsg->cbbuf_cmnd_size)
815 WARNING(fsg, "CB[I] overwriting previous command\n");
816 fsg->cbbuf_cmnd_size = req->actual;
817 memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
818
819 wakeup_thread(fsg);
820 spin_unlock(&fsg->lock);
821}
822
823#else
824static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
825{}
826#endif /* CONFIG_USB_FILE_STORAGE_TEST */
827
828
829static int class_setup_req(struct fsg_dev *fsg,
830 const struct usb_ctrlrequest *ctrl)
831{
832 struct usb_request *req = fsg->ep0req;
833 int value = -EOPNOTSUPP;
834 u16 w_index = le16_to_cpu(ctrl->wIndex);
835 u16 w_value = le16_to_cpu(ctrl->wValue);
836 u16 w_length = le16_to_cpu(ctrl->wLength);
837
838 if (!fsg->config)
839 return value;
840
841 /* Handle Bulk-only class-specific requests */
842 if (transport_is_bbb()) {
843 switch (ctrl->bRequest) {
844
845 case USB_BULK_RESET_REQUEST:
846 if (ctrl->bRequestType != (USB_DIR_OUT |
847 USB_TYPE_CLASS | USB_RECIP_INTERFACE))
848 break;
849 if (w_index != 0 || w_value != 0) {
850 value = -EDOM;
851 break;
852 }
853
854 /* Raise an exception to stop the current operation
855 * and reinitialize our state. */
856 DBG(fsg, "bulk reset request\n");
857 raise_exception(fsg, FSG_STATE_RESET);
858 value = DELAYED_STATUS;
859 break;
860
861 case USB_BULK_GET_MAX_LUN_REQUEST:
862 if (ctrl->bRequestType != (USB_DIR_IN |
863 USB_TYPE_CLASS | USB_RECIP_INTERFACE))
864 break;
865 if (w_index != 0 || w_value != 0) {
866 value = -EDOM;
867 break;
868 }
869 VDBG(fsg, "get max LUN\n");
870 *(u8 *) req->buf = fsg->nluns - 1;
871 value = 1;
872 break;
873 }
874 }
875
876 /* Handle CBI class-specific requests */
877 else {
878 switch (ctrl->bRequest) {
879
880 case USB_CBI_ADSC_REQUEST:
881 if (ctrl->bRequestType != (USB_DIR_OUT |
882 USB_TYPE_CLASS | USB_RECIP_INTERFACE))
883 break;
884 if (w_index != 0 || w_value != 0) {
885 value = -EDOM;
886 break;
887 }
888 if (w_length > MAX_COMMAND_SIZE) {
889 value = -EOVERFLOW;
890 break;
891 }
892 value = w_length;
893 fsg->ep0req->context = received_cbi_adsc;
894 break;
895 }
896 }
897
898 if (value == -EOPNOTSUPP)
899 VDBG(fsg,
900 "unknown class-specific control req "
901 "%02x.%02x v%04x i%04x l%u\n",
902 ctrl->bRequestType, ctrl->bRequest,
903 le16_to_cpu(ctrl->wValue), w_index, w_length);
904 return value;
905}
906
907
908/*-------------------------------------------------------------------------*/
909
910/* Ep0 standard request handlers. These always run in_irq. */
911
912static int standard_setup_req(struct fsg_dev *fsg,
913 const struct usb_ctrlrequest *ctrl)
914{
915 struct usb_request *req = fsg->ep0req;
916 int value = -EOPNOTSUPP;
917 u16 w_index = le16_to_cpu(ctrl->wIndex);
918 u16 w_value = le16_to_cpu(ctrl->wValue);
919
920 /* Usually this just stores reply data in the pre-allocated ep0 buffer,
921 * but config change events will also reconfigure hardware. */
922 switch (ctrl->bRequest) {
923
924 case USB_REQ_GET_DESCRIPTOR:
925 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
926 USB_RECIP_DEVICE))
927 break;
928 switch (w_value >> 8) {
929
930 case USB_DT_DEVICE:
931 VDBG(fsg, "get device descriptor\n");
932 device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
933 value = sizeof device_desc;
934 memcpy(req->buf, &device_desc, value);
935 break;
936 case USB_DT_DEVICE_QUALIFIER:
937 VDBG(fsg, "get device qualifier\n");
938 if (!gadget_is_dualspeed(fsg->gadget))
939 break;
940 /*
941 * Assume ep0 uses the same maxpacket value for both
942 * speeds
943 */
944 dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
945 value = sizeof dev_qualifier;
946 memcpy(req->buf, &dev_qualifier, value);
947 break;
948
949 case USB_DT_OTHER_SPEED_CONFIG:
950 VDBG(fsg, "get other-speed config descriptor\n");
951 if (!gadget_is_dualspeed(fsg->gadget))
952 break;
953 goto get_config;
954 case USB_DT_CONFIG:
955 VDBG(fsg, "get configuration descriptor\n");
956get_config:
957 value = populate_config_buf(fsg->gadget,
958 req->buf,
959 w_value >> 8,
960 w_value & 0xff);
961 break;
962
963 case USB_DT_STRING:
964 VDBG(fsg, "get string descriptor\n");
965
966 /* wIndex == language code */
967 value = usb_gadget_get_string(&fsg_stringtab,
968 w_value & 0xff, req->buf);
969 break;
970 }
971 break;
972
973 /* One config, two speeds */
974 case USB_REQ_SET_CONFIGURATION:
975 if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
976 USB_RECIP_DEVICE))
977 break;
978 VDBG(fsg, "set configuration\n");
979 if (w_value == CONFIG_VALUE || w_value == 0) {
980 fsg->new_config = w_value;
981
982 /* Raise an exception to wipe out previous transaction
983 * state (queued bufs, etc) and set the new config. */
984 raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
985 value = DELAYED_STATUS;
986 }
987 break;
988 case USB_REQ_GET_CONFIGURATION:
989 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
990 USB_RECIP_DEVICE))
991 break;
992 VDBG(fsg, "get configuration\n");
993 *(u8 *) req->buf = fsg->config;
994 value = 1;
995 break;
996
997 case USB_REQ_SET_INTERFACE:
998 if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
999 USB_RECIP_INTERFACE))
1000 break;
1001 if (fsg->config && w_index == 0) {
1002
1003 /* Raise an exception to wipe out previous transaction
1004 * state (queued bufs, etc) and install the new
1005 * interface altsetting. */
1006 raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
1007 value = DELAYED_STATUS;
1008 }
1009 break;
1010 case USB_REQ_GET_INTERFACE:
1011 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1012 USB_RECIP_INTERFACE))
1013 break;
1014 if (!fsg->config)
1015 break;
1016 if (w_index != 0) {
1017 value = -EDOM;
1018 break;
1019 }
1020 VDBG(fsg, "get interface\n");
1021 *(u8 *) req->buf = 0;
1022 value = 1;
1023 break;
1024
1025 default:
1026 VDBG(fsg,
1027 "unknown control req %02x.%02x v%04x i%04x l%u\n",
1028 ctrl->bRequestType, ctrl->bRequest,
1029 w_value, w_index, le16_to_cpu(ctrl->wLength));
1030 }
1031
1032 return value;
1033}
1034
1035
1036static int fsg_setup(struct usb_gadget *gadget,
1037 const struct usb_ctrlrequest *ctrl)
1038{
1039 struct fsg_dev *fsg = get_gadget_data(gadget);
1040 int rc;
1041 int w_length = le16_to_cpu(ctrl->wLength);
1042
1043 ++fsg->ep0_req_tag; // Record arrival of a new request
1044 fsg->ep0req->context = NULL;
1045 fsg->ep0req->length = 0;
1046 dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
1047
1048 if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
1049 rc = class_setup_req(fsg, ctrl);
1050 else
1051 rc = standard_setup_req(fsg, ctrl);
1052
1053 /* Respond with data/status or defer until later? */
1054 if (rc >= 0 && rc != DELAYED_STATUS) {
1055 rc = min(rc, w_length);
1056 fsg->ep0req->length = rc;
1057 fsg->ep0req->zero = rc < w_length;
1058 fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
1059 "ep0-in" : "ep0-out");
1060 rc = ep0_queue(fsg);
1061 }
1062
1063 /* Device either stalls (rc < 0) or reports success */
1064 return rc;
1065}
1066
1067
1068/*-------------------------------------------------------------------------*/
1069
1070/* All the following routines run in process context */
1071
1072
1073/* Use this for bulk or interrupt transfers, not ep0 */
1074static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
1075 struct usb_request *req, int *pbusy,
1076 enum fsg_buffer_state *state)
1077{
1078 int rc;
1079
1080 if (ep == fsg->bulk_in)
1081 dump_msg(fsg, "bulk-in", req->buf, req->length);
1082 else if (ep == fsg->intr_in)
1083 dump_msg(fsg, "intr-in", req->buf, req->length);
1084
1085 spin_lock_irq(&fsg->lock);
1086 *pbusy = 1;
1087 *state = BUF_STATE_BUSY;
1088 spin_unlock_irq(&fsg->lock);
1089 rc = usb_ep_queue(ep, req, GFP_KERNEL);
1090 if (rc != 0) {
1091 *pbusy = 0;
1092 *state = BUF_STATE_EMPTY;
1093
1094 /* We can't do much more than wait for a reset */
1095
1096 /* Note: currently the net2280 driver fails zero-length
1097 * submissions if DMA is enabled. */
1098 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
1099 req->length == 0))
1100 WARNING(fsg, "error in submission: %s --> %d\n",
1101 ep->name, rc);
1102 }
1103}
1104
1105
1106static int sleep_thread(struct fsg_dev *fsg)
1107{
1108 int rc = 0;
1109
1110 /* Wait until a signal arrives or we are woken up */
1111 for (;;) {
1112 try_to_freeze();
1113 set_current_state(TASK_INTERRUPTIBLE);
1114 if (signal_pending(current)) {
1115 rc = -EINTR;
1116 break;
1117 }
1118 if (fsg->thread_wakeup_needed)
1119 break;
1120 schedule();
1121 }
1122 __set_current_state(TASK_RUNNING);
1123 fsg->thread_wakeup_needed = 0;
1124 return rc;
1125}
1126
1127
1128/*-------------------------------------------------------------------------*/
1129
1130static int do_read(struct fsg_dev *fsg)
1131{
1132 struct fsg_lun *curlun = fsg->curlun;
1133 u32 lba;
1134 struct fsg_buffhd *bh;
1135 int rc;
1136 u32 amount_left;
1137 loff_t file_offset, file_offset_tmp;
1138 unsigned int amount;
1139 unsigned int partial_page;
1140 ssize_t nread;
1141
1142 /* Get the starting Logical Block Address and check that it's
1143 * not too big */
1144 if (fsg->cmnd[0] == READ_6)
1145 lba = get_unaligned_be24(&fsg->cmnd[1]);
1146 else {
1147 lba = get_unaligned_be32(&fsg->cmnd[2]);
1148
1149 /* We allow DPO (Disable Page Out = don't save data in the
1150 * cache) and FUA (Force Unit Access = don't read from the
1151 * cache), but we don't implement them. */
1152 if ((fsg->cmnd[1] & ~0x18) != 0) {
1153 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1154 return -EINVAL;
1155 }
1156 }
1157 if (lba >= curlun->num_sectors) {
1158 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1159 return -EINVAL;
1160 }
1161 file_offset = ((loff_t) lba) << 9;
1162
1163 /* Carry out the file reads */
1164 amount_left = fsg->data_size_from_cmnd;
1165 if (unlikely(amount_left == 0))
1166 return -EIO; // No default reply
1167
1168 for (;;) {
1169
1170 /* Figure out how much we need to read:
1171 * Try to read the remaining amount.
1172 * But don't read more than the buffer size.
1173 * And don't try to read past the end of the file.
1174 * Finally, if we're not at a page boundary, don't read past
1175 * the next page.
1176 * If this means reading 0 then we were asked to read past
1177 * the end of file. */
1178 amount = min((unsigned int) amount_left, mod_data.buflen);
1179 amount = min((loff_t) amount,
1180 curlun->file_length - file_offset);
1181 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
1182 if (partial_page > 0)
1183 amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
1184 partial_page);
1185
1186 /* Wait for the next buffer to become available */
1187 bh = fsg->next_buffhd_to_fill;
1188 while (bh->state != BUF_STATE_EMPTY) {
1189 rc = sleep_thread(fsg);
1190 if (rc)
1191 return rc;
1192 }
1193
1194 /* If we were asked to read past the end of file,
1195 * end with an empty buffer. */
1196 if (amount == 0) {
1197 curlun->sense_data =
1198 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1199 curlun->sense_data_info = file_offset >> 9;
1200 curlun->info_valid = 1;
1201 bh->inreq->length = 0;
1202 bh->state = BUF_STATE_FULL;
1203 break;
1204 }
1205
1206 /* Perform the read */
1207 file_offset_tmp = file_offset;
1208 nread = vfs_read(curlun->filp,
1209 (char __user *) bh->buf,
1210 amount, &file_offset_tmp);
1211 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1212 (unsigned long long) file_offset,
1213 (int) nread);
1214 if (signal_pending(current))
1215 return -EINTR;
1216
1217 if (nread < 0) {
1218 LDBG(curlun, "error in file read: %d\n",
1219 (int) nread);
1220 nread = 0;
1221 } else if (nread < amount) {
1222 LDBG(curlun, "partial file read: %d/%u\n",
1223 (int) nread, amount);
1224 nread -= (nread & 511); // Round down to a block
1225 }
1226 file_offset += nread;
1227 amount_left -= nread;
1228 fsg->residue -= nread;
1229 bh->inreq->length = nread;
1230 bh->state = BUF_STATE_FULL;
1231
1232 /* If an error occurred, report it and its position */
1233 if (nread < amount) {
1234 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1235 curlun->sense_data_info = file_offset >> 9;
1236 curlun->info_valid = 1;
1237 break;
1238 }
1239
1240 if (amount_left == 0)
1241 break; // No more left to read
1242
1243 /* Send this buffer and go read some more */
1244 bh->inreq->zero = 0;
1245 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1246 &bh->inreq_busy, &bh->state);
1247 fsg->next_buffhd_to_fill = bh->next;
1248 }
1249
1250 return -EIO; // No default reply
1251}
1252
1253
1254/*-------------------------------------------------------------------------*/
1255
1256static int do_write(struct fsg_dev *fsg)
1257{
1258 struct fsg_lun *curlun = fsg->curlun;
1259 u32 lba;
1260 struct fsg_buffhd *bh;
1261 int get_some_more;
1262 u32 amount_left_to_req, amount_left_to_write;
1263 loff_t usb_offset, file_offset, file_offset_tmp;
1264 unsigned int amount;
1265 unsigned int partial_page;
1266 ssize_t nwritten;
1267 int rc;
1268
1269 if (curlun->ro) {
1270 curlun->sense_data = SS_WRITE_PROTECTED;
1271 return -EINVAL;
1272 }
1273 spin_lock(&curlun->filp->f_lock);
1274 curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait
1275 spin_unlock(&curlun->filp->f_lock);
1276
1277 /* Get the starting Logical Block Address and check that it's
1278 * not too big */
1279 if (fsg->cmnd[0] == WRITE_6)
1280 lba = get_unaligned_be24(&fsg->cmnd[1]);
1281 else {
1282 lba = get_unaligned_be32(&fsg->cmnd[2]);
1283
1284 /* We allow DPO (Disable Page Out = don't save data in the
1285 * cache) and FUA (Force Unit Access = write directly to the
1286 * medium). We don't implement DPO; we implement FUA by
1287 * performing synchronous output. */
1288 if ((fsg->cmnd[1] & ~0x18) != 0) {
1289 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1290 return -EINVAL;
1291 }
1292 /* FUA */
1293 if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
1294 spin_lock(&curlun->filp->f_lock);
1295 curlun->filp->f_flags |= O_DSYNC;
1296 spin_unlock(&curlun->filp->f_lock);
1297 }
1298 }
1299 if (lba >= curlun->num_sectors) {
1300 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1301 return -EINVAL;
1302 }
1303
1304 /* Carry out the file writes */
1305 get_some_more = 1;
1306 file_offset = usb_offset = ((loff_t) lba) << 9;
1307 amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
1308
1309 while (amount_left_to_write > 0) {
1310
1311 /* Queue a request for more data from the host */
1312 bh = fsg->next_buffhd_to_fill;
1313 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
1314
1315 /* Figure out how much we want to get:
1316 * Try to get the remaining amount.
1317 * But don't get more than the buffer size.
1318 * And don't try to go past the end of the file.
1319 * If we're not at a page boundary,
1320 * don't go past the next page.
1321 * If this means getting 0, then we were asked
1322 * to write past the end of file.
1323 * Finally, round down to a block boundary. */
1324 amount = min(amount_left_to_req, mod_data.buflen);
1325 amount = min((loff_t) amount, curlun->file_length -
1326 usb_offset);
1327 partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
1328 if (partial_page > 0)
1329 amount = min(amount,
1330 (unsigned int) PAGE_CACHE_SIZE - partial_page);
1331
1332 if (amount == 0) {
1333 get_some_more = 0;
1334 curlun->sense_data =
1335 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1336 curlun->sense_data_info = usb_offset >> 9;
1337 curlun->info_valid = 1;
1338 continue;
1339 }
1340 amount -= (amount & 511);
1341 if (amount == 0) {
1342
1343 /* Why were we were asked to transfer a
1344 * partial block? */
1345 get_some_more = 0;
1346 continue;
1347 }
1348
1349 /* Get the next buffer */
1350 usb_offset += amount;
1351 fsg->usb_amount_left -= amount;
1352 amount_left_to_req -= amount;
1353 if (amount_left_to_req == 0)
1354 get_some_more = 0;
1355
1356 /* amount is always divisible by 512, hence by
1357 * the bulk-out maxpacket size */
1358 bh->outreq->length = bh->bulk_out_intended_length =
1359 amount;
1360 bh->outreq->short_not_ok = 1;
1361 start_transfer(fsg, fsg->bulk_out, bh->outreq,
1362 &bh->outreq_busy, &bh->state);
1363 fsg->next_buffhd_to_fill = bh->next;
1364 continue;
1365 }
1366
1367 /* Write the received data to the backing file */
1368 bh = fsg->next_buffhd_to_drain;
1369 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
1370 break; // We stopped early
1371 if (bh->state == BUF_STATE_FULL) {
1372 smp_rmb();
1373 fsg->next_buffhd_to_drain = bh->next;
1374 bh->state = BUF_STATE_EMPTY;
1375
1376 /* Did something go wrong with the transfer? */
1377 if (bh->outreq->status != 0) {
1378 curlun->sense_data = SS_COMMUNICATION_FAILURE;
1379 curlun->sense_data_info = file_offset >> 9;
1380 curlun->info_valid = 1;
1381 break;
1382 }
1383
1384 amount = bh->outreq->actual;
1385 if (curlun->file_length - file_offset < amount) {
1386 LERROR(curlun,
1387 "write %u @ %llu beyond end %llu\n",
1388 amount, (unsigned long long) file_offset,
1389 (unsigned long long) curlun->file_length);
1390 amount = curlun->file_length - file_offset;
1391 }
1392
1393 /* Perform the write */
1394 file_offset_tmp = file_offset;
1395 nwritten = vfs_write(curlun->filp,
1396 (char __user *) bh->buf,
1397 amount, &file_offset_tmp);
1398 VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
1399 (unsigned long long) file_offset,
1400 (int) nwritten);
1401 if (signal_pending(current))
1402 return -EINTR; // Interrupted!
1403
1404 if (nwritten < 0) {
1405 LDBG(curlun, "error in file write: %d\n",
1406 (int) nwritten);
1407 nwritten = 0;
1408 } else if (nwritten < amount) {
1409 LDBG(curlun, "partial file write: %d/%u\n",
1410 (int) nwritten, amount);
1411 nwritten -= (nwritten & 511);
1412 // Round down to a block
1413 }
1414 file_offset += nwritten;
1415 amount_left_to_write -= nwritten;
1416 fsg->residue -= nwritten;
1417
1418 /* If an error occurred, report it and its position */
1419 if (nwritten < amount) {
1420 curlun->sense_data = SS_WRITE_ERROR;
1421 curlun->sense_data_info = file_offset >> 9;
1422 curlun->info_valid = 1;
1423 break;
1424 }
1425
1426 /* Did the host decide to stop early? */
1427 if (bh->outreq->actual != bh->outreq->length) {
1428 fsg->short_packet_received = 1;
1429 break;
1430 }
1431 continue;
1432 }
1433
1434 /* Wait for something to happen */
1435 rc = sleep_thread(fsg);
1436 if (rc)
1437 return rc;
1438 }
1439
1440 return -EIO; // No default reply
1441}
1442
1443
1444/*-------------------------------------------------------------------------*/
1445
1446static int do_synchronize_cache(struct fsg_dev *fsg)
1447{
1448 struct fsg_lun *curlun = fsg->curlun;
1449 int rc;
1450
1451 /* We ignore the requested LBA and write out all file's
1452 * dirty data buffers. */
1453 rc = fsg_lun_fsync_sub(curlun);
1454 if (rc)
1455 curlun->sense_data = SS_WRITE_ERROR;
1456 return 0;
1457}
1458
1459
1460/*-------------------------------------------------------------------------*/
1461
1462static void invalidate_sub(struct fsg_lun *curlun)
1463{
1464 struct file *filp = curlun->filp;
1465 struct inode *inode = filp->f_path.dentry->d_inode;
1466 unsigned long rc;
1467
1468 rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
1469 VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
1470}
1471
1472static int do_verify(struct fsg_dev *fsg)
1473{
1474 struct fsg_lun *curlun = fsg->curlun;
1475 u32 lba;
1476 u32 verification_length;
1477 struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
1478 loff_t file_offset, file_offset_tmp;
1479 u32 amount_left;
1480 unsigned int amount;
1481 ssize_t nread;
1482
1483 /* Get the starting Logical Block Address and check that it's
1484 * not too big */
1485 lba = get_unaligned_be32(&fsg->cmnd[2]);
1486 if (lba >= curlun->num_sectors) {
1487 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1488 return -EINVAL;
1489 }
1490
1491 /* We allow DPO (Disable Page Out = don't save data in the
1492 * cache) but we don't implement it. */
1493 if ((fsg->cmnd[1] & ~0x10) != 0) {
1494 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1495 return -EINVAL;
1496 }
1497
1498 verification_length = get_unaligned_be16(&fsg->cmnd[7]);
1499 if (unlikely(verification_length == 0))
1500 return -EIO; // No default reply
1501
1502 /* Prepare to carry out the file verify */
1503 amount_left = verification_length << 9;
1504 file_offset = ((loff_t) lba) << 9;
1505
1506 /* Write out all the dirty buffers before invalidating them */
1507 fsg_lun_fsync_sub(curlun);
1508 if (signal_pending(current))
1509 return -EINTR;
1510
1511 invalidate_sub(curlun);
1512 if (signal_pending(current))
1513 return -EINTR;
1514
1515 /* Just try to read the requested blocks */
1516 while (amount_left > 0) {
1517
1518 /* Figure out how much we need to read:
1519 * Try to read the remaining amount, but not more than
1520 * the buffer size.
1521 * And don't try to read past the end of the file.
1522 * If this means reading 0 then we were asked to read
1523 * past the end of file. */
1524 amount = min((unsigned int) amount_left, mod_data.buflen);
1525 amount = min((loff_t) amount,
1526 curlun->file_length - file_offset);
1527 if (amount == 0) {
1528 curlun->sense_data =
1529 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1530 curlun->sense_data_info = file_offset >> 9;
1531 curlun->info_valid = 1;
1532 break;
1533 }
1534
1535 /* Perform the read */
1536 file_offset_tmp = file_offset;
1537 nread = vfs_read(curlun->filp,
1538 (char __user *) bh->buf,
1539 amount, &file_offset_tmp);
1540 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1541 (unsigned long long) file_offset,
1542 (int) nread);
1543 if (signal_pending(current))
1544 return -EINTR;
1545
1546 if (nread < 0) {
1547 LDBG(curlun, "error in file verify: %d\n",
1548 (int) nread);
1549 nread = 0;
1550 } else if (nread < amount) {
1551 LDBG(curlun, "partial file verify: %d/%u\n",
1552 (int) nread, amount);
1553 nread -= (nread & 511); // Round down to a sector
1554 }
1555 if (nread == 0) {
1556 curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1557 curlun->sense_data_info = file_offset >> 9;
1558 curlun->info_valid = 1;
1559 break;
1560 }
1561 file_offset += nread;
1562 amount_left -= nread;
1563 }
1564 return 0;
1565}
1566
1567
1568/*-------------------------------------------------------------------------*/
1569
1570static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1571{
1572 u8 *buf = (u8 *) bh->buf;
1573
1574 static char vendor_id[] = "Linux ";
1575 static char product_disk_id[] = "File-Stor Gadget";
1576 static char product_cdrom_id[] = "File-CD Gadget ";
1577
1578 if (!fsg->curlun) { // Unsupported LUNs are okay
1579 fsg->bad_lun_okay = 1;
1580 memset(buf, 0, 36);
1581 buf[0] = 0x7f; // Unsupported, no device-type
1582 buf[4] = 31; // Additional length
1583 return 36;
1584 }
1585
1586 memset(buf, 0, 8);
1587 buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
1588 if (mod_data.removable)
1589 buf[1] = 0x80;
1590 buf[2] = 2; // ANSI SCSI level 2
1591 buf[3] = 2; // SCSI-2 INQUIRY data format
1592 buf[4] = 31; // Additional length
1593 // No special options
1594 sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
1595 (mod_data.cdrom ? product_cdrom_id :
1596 product_disk_id),
1597 mod_data.release);
1598 return 36;
1599}
1600
1601
1602static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1603{
1604 struct fsg_lun *curlun = fsg->curlun;
1605 u8 *buf = (u8 *) bh->buf;
1606 u32 sd, sdinfo;
1607 int valid;
1608
1609 /*
1610 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1611 *
1612 * If a REQUEST SENSE command is received from an initiator
1613 * with a pending unit attention condition (before the target
1614 * generates the contingent allegiance condition), then the
1615 * target shall either:
1616 * a) report any pending sense data and preserve the unit
1617 * attention condition on the logical unit, or,
1618 * b) report the unit attention condition, may discard any
1619 * pending sense data, and clear the unit attention
1620 * condition on the logical unit for that initiator.
1621 *
1622 * FSG normally uses option a); enable this code to use option b).
1623 */
1624#if 0
1625 if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1626 curlun->sense_data = curlun->unit_attention_data;
1627 curlun->unit_attention_data = SS_NO_SENSE;
1628 }
1629#endif
1630
1631 if (!curlun) { // Unsupported LUNs are okay
1632 fsg->bad_lun_okay = 1;
1633 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1634 sdinfo = 0;
1635 valid = 0;
1636 } else {
1637 sd = curlun->sense_data;
1638 sdinfo = curlun->sense_data_info;
1639 valid = curlun->info_valid << 7;
1640 curlun->sense_data = SS_NO_SENSE;
1641 curlun->sense_data_info = 0;
1642 curlun->info_valid = 0;
1643 }
1644
1645 memset(buf, 0, 18);
1646 buf[0] = valid | 0x70; // Valid, current error
1647 buf[2] = SK(sd);
1648 put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
1649 buf[7] = 18 - 8; // Additional sense length
1650 buf[12] = ASC(sd);
1651 buf[13] = ASCQ(sd);
1652 return 18;
1653}
1654
1655
1656static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1657{
1658 struct fsg_lun *curlun = fsg->curlun;
1659 u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
1660 int pmi = fsg->cmnd[8];
1661 u8 *buf = (u8 *) bh->buf;
1662
1663 /* Check the PMI and LBA fields */
1664 if (pmi > 1 || (pmi == 0 && lba != 0)) {
1665 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1666 return -EINVAL;
1667 }
1668
1669 put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1670 /* Max logical block */
1671 put_unaligned_be32(512, &buf[4]); /* Block length */
1672 return 8;
1673}
1674
1675
1676static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1677{
1678 struct fsg_lun *curlun = fsg->curlun;
1679 int msf = fsg->cmnd[1] & 0x02;
1680 u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
1681 u8 *buf = (u8 *) bh->buf;
1682
1683 if ((fsg->cmnd[1] & ~0x02) != 0) { /* Mask away MSF */
1684 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1685 return -EINVAL;
1686 }
1687 if (lba >= curlun->num_sectors) {
1688 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1689 return -EINVAL;
1690 }
1691
1692 memset(buf, 0, 8);
1693 buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
1694 store_cdrom_address(&buf[4], msf, lba);
1695 return 8;
1696}
1697
1698
1699static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1700{
1701 struct fsg_lun *curlun = fsg->curlun;
1702 int msf = fsg->cmnd[1] & 0x02;
1703 int start_track = fsg->cmnd[6];
1704 u8 *buf = (u8 *) bh->buf;
1705
1706 if ((fsg->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
1707 start_track > 1) {
1708 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1709 return -EINVAL;
1710 }
1711
1712 memset(buf, 0, 20);
1713 buf[1] = (20-2); /* TOC data length */
1714 buf[2] = 1; /* First track number */
1715 buf[3] = 1; /* Last track number */
1716 buf[5] = 0x16; /* Data track, copying allowed */
1717 buf[6] = 0x01; /* Only track is number 1 */
1718 store_cdrom_address(&buf[8], msf, 0);
1719
1720 buf[13] = 0x16; /* Lead-out track is data */
1721 buf[14] = 0xAA; /* Lead-out track number */
1722 store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1723 return 20;
1724}
1725
1726
1727static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1728{
1729 struct fsg_lun *curlun = fsg->curlun;
1730 int mscmnd = fsg->cmnd[0];
1731 u8 *buf = (u8 *) bh->buf;
1732 u8 *buf0 = buf;
1733 int pc, page_code;
1734 int changeable_values, all_pages;
1735 int valid_page = 0;
1736 int len, limit;
1737
1738 if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD
1739 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1740 return -EINVAL;
1741 }
1742 pc = fsg->cmnd[2] >> 6;
1743 page_code = fsg->cmnd[2] & 0x3f;
1744 if (pc == 3) {
1745 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1746 return -EINVAL;
1747 }
1748 changeable_values = (pc == 1);
1749 all_pages = (page_code == 0x3f);
1750
1751 /* Write the mode parameter header. Fixed values are: default
1752 * medium type, no cache control (DPOFUA), and no block descriptors.
1753 * The only variable value is the WriteProtect bit. We will fill in
1754 * the mode data length later. */
1755 memset(buf, 0, 8);
1756 if (mscmnd == MODE_SENSE) {
1757 buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
1758 buf += 4;
1759 limit = 255;
1760 } else { // MODE_SENSE_10
1761 buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
1762 buf += 8;
1763 limit = 65535; // Should really be mod_data.buflen
1764 }
1765
1766 /* No block descriptors */
1767
1768 /* The mode pages, in numerical order. The only page we support
1769 * is the Caching page. */
1770 if (page_code == 0x08 || all_pages) {
1771 valid_page = 1;
1772 buf[0] = 0x08; // Page code
1773 buf[1] = 10; // Page length
1774 memset(buf+2, 0, 10); // None of the fields are changeable
1775
1776 if (!changeable_values) {
1777 buf[2] = 0x04; // Write cache enable,
1778 // Read cache not disabled
1779 // No cache retention priorities
1780 put_unaligned_be16(0xffff, &buf[4]);
1781 /* Don't disable prefetch */
1782 /* Minimum prefetch = 0 */
1783 put_unaligned_be16(0xffff, &buf[8]);
1784 /* Maximum prefetch */
1785 put_unaligned_be16(0xffff, &buf[10]);
1786 /* Maximum prefetch ceiling */
1787 }
1788 buf += 12;
1789 }
1790
1791 /* Check that a valid page was requested and the mode data length
1792 * isn't too long. */
1793 len = buf - buf0;
1794 if (!valid_page || len > limit) {
1795 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1796 return -EINVAL;
1797 }
1798
1799 /* Store the mode data length */
1800 if (mscmnd == MODE_SENSE)
1801 buf0[0] = len - 1;
1802 else
1803 put_unaligned_be16(len - 2, buf0);
1804 return len;
1805}
1806
1807
1808static int do_start_stop(struct fsg_dev *fsg)
1809{
1810 struct fsg_lun *curlun = fsg->curlun;
1811 int loej, start;
1812
1813 if (!mod_data.removable) {
1814 curlun->sense_data = SS_INVALID_COMMAND;
1815 return -EINVAL;
1816 }
1817
1818 // int immed = fsg->cmnd[1] & 0x01;
1819 loej = fsg->cmnd[4] & 0x02;
1820 start = fsg->cmnd[4] & 0x01;
1821
1822#ifdef CONFIG_USB_FILE_STORAGE_TEST
1823 if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed
1824 (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start
1825 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1826 return -EINVAL;
1827 }
1828
1829 if (!start) {
1830
1831 /* Are we allowed to unload the media? */
1832 if (curlun->prevent_medium_removal) {
1833 LDBG(curlun, "unload attempt prevented\n");
1834 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1835 return -EINVAL;
1836 }
1837 if (loej) { // Simulate an unload/eject
1838 up_read(&fsg->filesem);
1839 down_write(&fsg->filesem);
1840 fsg_lun_close(curlun);
1841 up_write(&fsg->filesem);
1842 down_read(&fsg->filesem);
1843 }
1844 } else {
1845
1846 /* Our emulation doesn't support mounting; the medium is
1847 * available for use as soon as it is loaded. */
1848 if (!fsg_lun_is_open(curlun)) {
1849 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1850 return -EINVAL;
1851 }
1852 }
1853#endif
1854 return 0;
1855}
1856
1857
1858static int do_prevent_allow(struct fsg_dev *fsg)
1859{
1860 struct fsg_lun *curlun = fsg->curlun;
1861 int prevent;
1862
1863 if (!mod_data.removable) {
1864 curlun->sense_data = SS_INVALID_COMMAND;
1865 return -EINVAL;
1866 }
1867
1868 prevent = fsg->cmnd[4] & 0x01;
1869 if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent
1870 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1871 return -EINVAL;
1872 }
1873
1874 if (curlun->prevent_medium_removal && !prevent)
1875 fsg_lun_fsync_sub(curlun);
1876 curlun->prevent_medium_removal = prevent;
1877 return 0;
1878}
1879
1880
1881static int do_read_format_capacities(struct fsg_dev *fsg,
1882 struct fsg_buffhd *bh)
1883{
1884 struct fsg_lun *curlun = fsg->curlun;
1885 u8 *buf = (u8 *) bh->buf;
1886
1887 buf[0] = buf[1] = buf[2] = 0;
1888 buf[3] = 8; // Only the Current/Maximum Capacity Descriptor
1889 buf += 4;
1890
1891 put_unaligned_be32(curlun->num_sectors, &buf[0]);
1892 /* Number of blocks */
1893 put_unaligned_be32(512, &buf[4]); /* Block length */
1894 buf[4] = 0x02; /* Current capacity */
1895 return 12;
1896}
1897
1898
1899static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1900{
1901 struct fsg_lun *curlun = fsg->curlun;
1902
1903 /* We don't support MODE SELECT */
1904 curlun->sense_data = SS_INVALID_COMMAND;
1905 return -EINVAL;
1906}
1907
1908
1909/*-------------------------------------------------------------------------*/
1910
1911static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1912{
1913 int rc;
1914
1915 rc = fsg_set_halt(fsg, fsg->bulk_in);
1916 if (rc == -EAGAIN)
1917 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1918 while (rc != 0) {
1919 if (rc != -EAGAIN) {
1920 WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1921 rc = 0;
1922 break;
1923 }
1924
1925 /* Wait for a short time and then try again */
1926 if (msleep_interruptible(100) != 0)
1927 return -EINTR;
1928 rc = usb_ep_set_halt(fsg->bulk_in);
1929 }
1930 return rc;
1931}
1932
1933static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1934{
1935 int rc;
1936
1937 DBG(fsg, "bulk-in set wedge\n");
1938 rc = usb_ep_set_wedge(fsg->bulk_in);
1939 if (rc == -EAGAIN)
1940 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1941 while (rc != 0) {
1942 if (rc != -EAGAIN) {
1943 WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1944 rc = 0;
1945 break;
1946 }
1947
1948 /* Wait for a short time and then try again */
1949 if (msleep_interruptible(100) != 0)
1950 return -EINTR;
1951 rc = usb_ep_set_wedge(fsg->bulk_in);
1952 }
1953 return rc;
1954}
1955
1956static int throw_away_data(struct fsg_dev *fsg)
1957{
1958 struct fsg_buffhd *bh;
1959 u32 amount;
1960 int rc;
1961
1962 while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
1963 fsg->usb_amount_left > 0) {
1964
1965 /* Throw away the data in a filled buffer */
1966 if (bh->state == BUF_STATE_FULL) {
1967 smp_rmb();
1968 bh->state = BUF_STATE_EMPTY;
1969 fsg->next_buffhd_to_drain = bh->next;
1970
1971 /* A short packet or an error ends everything */
1972 if (bh->outreq->actual != bh->outreq->length ||
1973 bh->outreq->status != 0) {
1974 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
1975 return -EINTR;
1976 }
1977 continue;
1978 }
1979
1980 /* Try to submit another request if we need one */
1981 bh = fsg->next_buffhd_to_fill;
1982 if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
1983 amount = min(fsg->usb_amount_left,
1984 (u32) mod_data.buflen);
1985
1986 /* amount is always divisible by 512, hence by
1987 * the bulk-out maxpacket size */
1988 bh->outreq->length = bh->bulk_out_intended_length =
1989 amount;
1990 bh->outreq->short_not_ok = 1;
1991 start_transfer(fsg, fsg->bulk_out, bh->outreq,
1992 &bh->outreq_busy, &bh->state);
1993 fsg->next_buffhd_to_fill = bh->next;
1994 fsg->usb_amount_left -= amount;
1995 continue;
1996 }
1997
1998 /* Otherwise wait for something to happen */
1999 rc = sleep_thread(fsg);
2000 if (rc)
2001 return rc;
2002 }
2003 return 0;
2004}
2005
2006
2007static int finish_reply(struct fsg_dev *fsg)
2008{
2009 struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
2010 int rc = 0;
2011
2012 switch (fsg->data_dir) {
2013 case DATA_DIR_NONE:
2014 break; // Nothing to send
2015
2016 /* If we don't know whether the host wants to read or write,
2017 * this must be CB or CBI with an unknown command. We mustn't
2018 * try to send or receive any data. So stall both bulk pipes
2019 * if we can and wait for a reset. */
2020 case DATA_DIR_UNKNOWN:
2021 if (mod_data.can_stall) {
2022 fsg_set_halt(fsg, fsg->bulk_out);
2023 rc = halt_bulk_in_endpoint(fsg);
2024 }
2025 break;
2026
2027 /* All but the last buffer of data must have already been sent */
2028 case DATA_DIR_TO_HOST:
2029 if (fsg->data_size == 0)
2030 ; // Nothing to send
2031
2032 /* If there's no residue, simply send the last buffer */
2033 else if (fsg->residue == 0) {
2034 bh->inreq->zero = 0;
2035 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2036 &bh->inreq_busy, &bh->state);
2037 fsg->next_buffhd_to_fill = bh->next;
2038 }
2039
2040 /* There is a residue. For CB and CBI, simply mark the end
2041 * of the data with a short packet. However, if we are
2042 * allowed to stall, there was no data at all (residue ==
2043 * data_size), and the command failed (invalid LUN or
2044 * sense data is set), then halt the bulk-in endpoint
2045 * instead. */
2046 else if (!transport_is_bbb()) {
2047 if (mod_data.can_stall &&
2048 fsg->residue == fsg->data_size &&
2049 (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
2050 bh->state = BUF_STATE_EMPTY;
2051 rc = halt_bulk_in_endpoint(fsg);
2052 } else {
2053 bh->inreq->zero = 1;
2054 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2055 &bh->inreq_busy, &bh->state);
2056 fsg->next_buffhd_to_fill = bh->next;
2057 }
2058 }
2059
2060 /*
2061 * For Bulk-only, mark the end of the data with a short
2062 * packet. If we are allowed to stall, halt the bulk-in
2063 * endpoint. (Note: This violates the Bulk-Only Transport
2064 * specification, which requires us to pad the data if we
2065 * don't halt the endpoint. Presumably nobody will mind.)
2066 */
2067 else {
2068 bh->inreq->zero = 1;
2069 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2070 &bh->inreq_busy, &bh->state);
2071 fsg->next_buffhd_to_fill = bh->next;
2072 if (mod_data.can_stall)
2073 rc = halt_bulk_in_endpoint(fsg);
2074 }
2075 break;
2076
2077 /* We have processed all we want from the data the host has sent.
2078 * There may still be outstanding bulk-out requests. */
2079 case DATA_DIR_FROM_HOST:
2080 if (fsg->residue == 0)
2081 ; // Nothing to receive
2082
2083 /* Did the host stop sending unexpectedly early? */
2084 else if (fsg->short_packet_received) {
2085 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2086 rc = -EINTR;
2087 }
2088
2089 /* We haven't processed all the incoming data. Even though
2090 * we may be allowed to stall, doing so would cause a race.
2091 * The controller may already have ACK'ed all the remaining
2092 * bulk-out packets, in which case the host wouldn't see a
2093 * STALL. Not realizing the endpoint was halted, it wouldn't
2094 * clear the halt -- leading to problems later on. */
2095#if 0
2096 else if (mod_data.can_stall) {
2097 fsg_set_halt(fsg, fsg->bulk_out);
2098 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2099 rc = -EINTR;
2100 }
2101#endif
2102
2103 /* We can't stall. Read in the excess data and throw it
2104 * all away. */
2105 else
2106 rc = throw_away_data(fsg);
2107 break;
2108 }
2109 return rc;
2110}
2111
2112
2113static int send_status(struct fsg_dev *fsg)
2114{
2115 struct fsg_lun *curlun = fsg->curlun;
2116 struct fsg_buffhd *bh;
2117 int rc;
2118 u8 status = USB_STATUS_PASS;
2119 u32 sd, sdinfo = 0;
2120
2121 /* Wait for the next buffer to become available */
2122 bh = fsg->next_buffhd_to_fill;
2123 while (bh->state != BUF_STATE_EMPTY) {
2124 rc = sleep_thread(fsg);
2125 if (rc)
2126 return rc;
2127 }
2128
2129 if (curlun) {
2130 sd = curlun->sense_data;
2131 sdinfo = curlun->sense_data_info;
2132 } else if (fsg->bad_lun_okay)
2133 sd = SS_NO_SENSE;
2134 else
2135 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2136
2137 if (fsg->phase_error) {
2138 DBG(fsg, "sending phase-error status\n");
2139 status = USB_STATUS_PHASE_ERROR;
2140 sd = SS_INVALID_COMMAND;
2141 } else if (sd != SS_NO_SENSE) {
2142 DBG(fsg, "sending command-failure status\n");
2143 status = USB_STATUS_FAIL;
2144 VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2145 " info x%x\n",
2146 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
2147 }
2148
2149 if (transport_is_bbb()) {
2150 struct bulk_cs_wrap *csw = bh->buf;
2151
2152 /* Store and send the Bulk-only CSW */
2153 csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
2154 csw->Tag = fsg->tag;
2155 csw->Residue = cpu_to_le32(fsg->residue);
2156 csw->Status = status;
2157
2158 bh->inreq->length = USB_BULK_CS_WRAP_LEN;
2159 bh->inreq->zero = 0;
2160 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2161 &bh->inreq_busy, &bh->state);
2162
2163 } else if (mod_data.transport_type == USB_PR_CB) {
2164
2165 /* Control-Bulk transport has no status phase! */
2166 return 0;
2167
2168 } else { // USB_PR_CBI
2169 struct interrupt_data *buf = bh->buf;
2170
2171 /* Store and send the Interrupt data. UFI sends the ASC
2172 * and ASCQ bytes. Everything else sends a Type (which
2173 * is always 0) and the status Value. */
2174 if (mod_data.protocol_type == USB_SC_UFI) {
2175 buf->bType = ASC(sd);
2176 buf->bValue = ASCQ(sd);
2177 } else {
2178 buf->bType = 0;
2179 buf->bValue = status;
2180 }
2181 fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
2182
2183 fsg->intr_buffhd = bh; // Point to the right buffhd
2184 fsg->intreq->buf = bh->inreq->buf;
2185 fsg->intreq->context = bh;
2186 start_transfer(fsg, fsg->intr_in, fsg->intreq,
2187 &fsg->intreq_busy, &bh->state);
2188 }
2189
2190 fsg->next_buffhd_to_fill = bh->next;
2191 return 0;
2192}
2193
2194
2195/*-------------------------------------------------------------------------*/
2196
2197/* Check whether the command is properly formed and whether its data size
2198 * and direction agree with the values we already have. */
2199static int check_command(struct fsg_dev *fsg, int cmnd_size,
2200 enum data_direction data_dir, unsigned int mask,
2201 int needs_medium, const char *name)
2202{
2203 int i;
2204 int lun = fsg->cmnd[1] >> 5;
2205 static const char dirletter[4] = {'u', 'o', 'i', 'n'};
2206 char hdlen[20];
2207 struct fsg_lun *curlun;
2208
2209 /* Adjust the expected cmnd_size for protocol encapsulation padding.
2210 * Transparent SCSI doesn't pad. */
2211 if (protocol_is_scsi())
2212 ;
2213
2214 /* There's some disagreement as to whether RBC pads commands or not.
2215 * We'll play it safe and accept either form. */
2216 else if (mod_data.protocol_type == USB_SC_RBC) {
2217 if (fsg->cmnd_size == 12)
2218 cmnd_size = 12;
2219
2220 /* All the other protocols pad to 12 bytes */
2221 } else
2222 cmnd_size = 12;
2223
2224 hdlen[0] = 0;
2225 if (fsg->data_dir != DATA_DIR_UNKNOWN)
2226 sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
2227 fsg->data_size);
2228 VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
2229 name, cmnd_size, dirletter[(int) data_dir],
2230 fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
2231
2232 /* We can't reply at all until we know the correct data direction
2233 * and size. */
2234 if (fsg->data_size_from_cmnd == 0)
2235 data_dir = DATA_DIR_NONE;
2236 if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI
2237 fsg->data_dir = data_dir;
2238 fsg->data_size = fsg->data_size_from_cmnd;
2239
2240 } else { // Bulk-only
2241 if (fsg->data_size < fsg->data_size_from_cmnd) {
2242
2243 /* Host data size < Device data size is a phase error.
2244 * Carry out the command, but only transfer as much
2245 * as we are allowed. */
2246 fsg->data_size_from_cmnd = fsg->data_size;
2247 fsg->phase_error = 1;
2248 }
2249 }
2250 fsg->residue = fsg->usb_amount_left = fsg->data_size;
2251
2252 /* Conflicting data directions is a phase error */
2253 if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
2254 fsg->phase_error = 1;
2255 return -EINVAL;
2256 }
2257
2258 /* Verify the length of the command itself */
2259 if (cmnd_size != fsg->cmnd_size) {
2260
2261 /* Special case workaround: There are plenty of buggy SCSI
2262 * implementations. Many have issues with cbw->Length
2263 * field passing a wrong command size. For those cases we
2264 * always try to work around the problem by using the length
2265 * sent by the host side provided it is at least as large
2266 * as the correct command length.
2267 * Examples of such cases would be MS-Windows, which issues
2268 * REQUEST SENSE with cbw->Length == 12 where it should
2269 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
2270 * REQUEST SENSE with cbw->Length == 10 where it should
2271 * be 6 as well.
2272 */
2273 if (cmnd_size <= fsg->cmnd_size) {
2274 DBG(fsg, "%s is buggy! Expected length %d "
2275 "but we got %d\n", name,
2276 cmnd_size, fsg->cmnd_size);
2277 cmnd_size = fsg->cmnd_size;
2278 } else {
2279 fsg->phase_error = 1;
2280 return -EINVAL;
2281 }
2282 }
2283
2284 /* Check that the LUN values are consistent */
2285 if (transport_is_bbb()) {
2286 if (fsg->lun != lun)
2287 DBG(fsg, "using LUN %d from CBW, "
2288 "not LUN %d from CDB\n",
2289 fsg->lun, lun);
2290 } else
2291 fsg->lun = lun; // Use LUN from the command
2292
2293 /* Check the LUN */
2294 if (fsg->lun < fsg->nluns) {
2295 fsg->curlun = curlun = &fsg->luns[fsg->lun];
2296 if (fsg->cmnd[0] != REQUEST_SENSE) {
2297 curlun->sense_data = SS_NO_SENSE;
2298 curlun->sense_data_info = 0;
2299 curlun->info_valid = 0;
2300 }
2301 } else {
2302 fsg->curlun = curlun = NULL;
2303 fsg->bad_lun_okay = 0;
2304
2305 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2306 * to use unsupported LUNs; all others may not. */
2307 if (fsg->cmnd[0] != INQUIRY &&
2308 fsg->cmnd[0] != REQUEST_SENSE) {
2309 DBG(fsg, "unsupported LUN %d\n", fsg->lun);
2310 return -EINVAL;
2311 }
2312 }
2313
2314 /* If a unit attention condition exists, only INQUIRY and
2315 * REQUEST SENSE commands are allowed; anything else must fail. */
2316 if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
2317 fsg->cmnd[0] != INQUIRY &&
2318 fsg->cmnd[0] != REQUEST_SENSE) {
2319 curlun->sense_data = curlun->unit_attention_data;
2320 curlun->unit_attention_data = SS_NO_SENSE;
2321 return -EINVAL;
2322 }
2323
2324 /* Check that only command bytes listed in the mask are non-zero */
2325 fsg->cmnd[1] &= 0x1f; // Mask away the LUN
2326 for (i = 1; i < cmnd_size; ++i) {
2327 if (fsg->cmnd[i] && !(mask & (1 << i))) {
2328 if (curlun)
2329 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2330 return -EINVAL;
2331 }
2332 }
2333
2334 /* If the medium isn't mounted and the command needs to access
2335 * it, return an error. */
2336 if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
2337 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2338 return -EINVAL;
2339 }
2340
2341 return 0;
2342}
2343
2344
2345static int do_scsi_command(struct fsg_dev *fsg)
2346{
2347 struct fsg_buffhd *bh;
2348 int rc;
2349 int reply = -EINVAL;
2350 int i;
2351 static char unknown[16];
2352
2353 dump_cdb(fsg);
2354
2355 /* Wait for the next buffer to become available for data or status */
2356 bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
2357 while (bh->state != BUF_STATE_EMPTY) {
2358 rc = sleep_thread(fsg);
2359 if (rc)
2360 return rc;
2361 }
2362 fsg->phase_error = 0;
2363 fsg->short_packet_received = 0;
2364
2365 down_read(&fsg->filesem); // We're using the backing file
2366 switch (fsg->cmnd[0]) {
2367
2368 case INQUIRY:
2369 fsg->data_size_from_cmnd = fsg->cmnd[4];
2370 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2371 (1<<4), 0,
2372 "INQUIRY")) == 0)
2373 reply = do_inquiry(fsg, bh);
2374 break;
2375
2376 case MODE_SELECT:
2377 fsg->data_size_from_cmnd = fsg->cmnd[4];
2378 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2379 (1<<1) | (1<<4), 0,
2380 "MODE SELECT(6)")) == 0)
2381 reply = do_mode_select(fsg, bh);
2382 break;
2383
2384 case MODE_SELECT_10:
2385 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2386 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2387 (1<<1) | (3<<7), 0,
2388 "MODE SELECT(10)")) == 0)
2389 reply = do_mode_select(fsg, bh);
2390 break;
2391
2392 case MODE_SENSE:
2393 fsg->data_size_from_cmnd = fsg->cmnd[4];
2394 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2395 (1<<1) | (1<<2) | (1<<4), 0,
2396 "MODE SENSE(6)")) == 0)
2397 reply = do_mode_sense(fsg, bh);
2398 break;
2399
2400 case MODE_SENSE_10:
2401 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2402 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2403 (1<<1) | (1<<2) | (3<<7), 0,
2404 "MODE SENSE(10)")) == 0)
2405 reply = do_mode_sense(fsg, bh);
2406 break;
2407
2408 case ALLOW_MEDIUM_REMOVAL:
2409 fsg->data_size_from_cmnd = 0;
2410 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2411 (1<<4), 0,
2412 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2413 reply = do_prevent_allow(fsg);
2414 break;
2415
2416 case READ_6:
2417 i = fsg->cmnd[4];
2418 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2419 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2420 (7<<1) | (1<<4), 1,
2421 "READ(6)")) == 0)
2422 reply = do_read(fsg);
2423 break;
2424
2425 case READ_10:
2426 fsg->data_size_from_cmnd =
2427 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2428 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2429 (1<<1) | (0xf<<2) | (3<<7), 1,
2430 "READ(10)")) == 0)
2431 reply = do_read(fsg);
2432 break;
2433
2434 case READ_12:
2435 fsg->data_size_from_cmnd =
2436 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2437 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
2438 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2439 "READ(12)")) == 0)
2440 reply = do_read(fsg);
2441 break;
2442
2443 case READ_CAPACITY:
2444 fsg->data_size_from_cmnd = 8;
2445 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2446 (0xf<<2) | (1<<8), 1,
2447 "READ CAPACITY")) == 0)
2448 reply = do_read_capacity(fsg, bh);
2449 break;
2450
2451 case READ_HEADER:
2452 if (!mod_data.cdrom)
2453 goto unknown_cmnd;
2454 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2455 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2456 (3<<7) | (0x1f<<1), 1,
2457 "READ HEADER")) == 0)
2458 reply = do_read_header(fsg, bh);
2459 break;
2460
2461 case READ_TOC:
2462 if (!mod_data.cdrom)
2463 goto unknown_cmnd;
2464 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2465 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2466 (7<<6) | (1<<1), 1,
2467 "READ TOC")) == 0)
2468 reply = do_read_toc(fsg, bh);
2469 break;
2470
2471 case READ_FORMAT_CAPACITIES:
2472 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2473 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2474 (3<<7), 1,
2475 "READ FORMAT CAPACITIES")) == 0)
2476 reply = do_read_format_capacities(fsg, bh);
2477 break;
2478
2479 case REQUEST_SENSE:
2480 fsg->data_size_from_cmnd = fsg->cmnd[4];
2481 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2482 (1<<4), 0,
2483 "REQUEST SENSE")) == 0)
2484 reply = do_request_sense(fsg, bh);
2485 break;
2486
2487 case START_STOP:
2488 fsg->data_size_from_cmnd = 0;
2489 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2490 (1<<1) | (1<<4), 0,
2491 "START-STOP UNIT")) == 0)
2492 reply = do_start_stop(fsg);
2493 break;
2494
2495 case SYNCHRONIZE_CACHE:
2496 fsg->data_size_from_cmnd = 0;
2497 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2498 (0xf<<2) | (3<<7), 1,
2499 "SYNCHRONIZE CACHE")) == 0)
2500 reply = do_synchronize_cache(fsg);
2501 break;
2502
2503 case TEST_UNIT_READY:
2504 fsg->data_size_from_cmnd = 0;
2505 reply = check_command(fsg, 6, DATA_DIR_NONE,
2506 0, 1,
2507 "TEST UNIT READY");
2508 break;
2509
2510 /* Although optional, this command is used by MS-Windows. We
2511 * support a minimal version: BytChk must be 0. */
2512 case VERIFY:
2513 fsg->data_size_from_cmnd = 0;
2514 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2515 (1<<1) | (0xf<<2) | (3<<7), 1,
2516 "VERIFY")) == 0)
2517 reply = do_verify(fsg);
2518 break;
2519
2520 case WRITE_6:
2521 i = fsg->cmnd[4];
2522 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2523 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2524 (7<<1) | (1<<4), 1,
2525 "WRITE(6)")) == 0)
2526 reply = do_write(fsg);
2527 break;
2528
2529 case WRITE_10:
2530 fsg->data_size_from_cmnd =
2531 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2532 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2533 (1<<1) | (0xf<<2) | (3<<7), 1,
2534 "WRITE(10)")) == 0)
2535 reply = do_write(fsg);
2536 break;
2537
2538 case WRITE_12:
2539 fsg->data_size_from_cmnd =
2540 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2541 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
2542 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2543 "WRITE(12)")) == 0)
2544 reply = do_write(fsg);
2545 break;
2546
2547 /* Some mandatory commands that we recognize but don't implement.
2548 * They don't mean much in this setting. It's left as an exercise
2549 * for anyone interested to implement RESERVE and RELEASE in terms
2550 * of Posix locks. */
2551 case FORMAT_UNIT:
2552 case RELEASE:
2553 case RESERVE:
2554 case SEND_DIAGNOSTIC:
2555 // Fall through
2556
2557 default:
2558 unknown_cmnd:
2559 fsg->data_size_from_cmnd = 0;
2560 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
2561 if ((reply = check_command(fsg, fsg->cmnd_size,
2562 DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
2563 fsg->curlun->sense_data = SS_INVALID_COMMAND;
2564 reply = -EINVAL;
2565 }
2566 break;
2567 }
2568 up_read(&fsg->filesem);
2569
2570 if (reply == -EINTR || signal_pending(current))
2571 return -EINTR;
2572
2573 /* Set up the single reply buffer for finish_reply() */
2574 if (reply == -EINVAL)
2575 reply = 0; // Error reply length
2576 if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
2577 reply = min((u32) reply, fsg->data_size_from_cmnd);
2578 bh->inreq->length = reply;
2579 bh->state = BUF_STATE_FULL;
2580 fsg->residue -= reply;
2581 } // Otherwise it's already set
2582
2583 return 0;
2584}
2585
2586
2587/*-------------------------------------------------------------------------*/
2588
2589static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2590{
2591 struct usb_request *req = bh->outreq;
2592 struct fsg_bulk_cb_wrap *cbw = req->buf;
2593
2594 /* Was this a real packet? Should it be ignored? */
2595 if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2596 return -EINVAL;
2597
2598 /* Is the CBW valid? */
2599 if (req->actual != USB_BULK_CB_WRAP_LEN ||
2600 cbw->Signature != cpu_to_le32(
2601 USB_BULK_CB_SIG)) {
2602 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2603 req->actual,
2604 le32_to_cpu(cbw->Signature));
2605
2606 /* The Bulk-only spec says we MUST stall the IN endpoint
2607 * (6.6.1), so it's unavoidable. It also says we must
2608 * retain this state until the next reset, but there's
2609 * no way to tell the controller driver it should ignore
2610 * Clear-Feature(HALT) requests.
2611 *
2612 * We aren't required to halt the OUT endpoint; instead
2613 * we can simply accept and discard any data received
2614 * until the next reset. */
2615 wedge_bulk_in_endpoint(fsg);
2616 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2617 return -EINVAL;
2618 }
2619
2620 /* Is the CBW meaningful? */
2621 if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2622 cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
2623 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2624 "cmdlen %u\n",
2625 cbw->Lun, cbw->Flags, cbw->Length);
2626
2627 /* We can do anything we want here, so let's stall the
2628 * bulk pipes if we are allowed to. */
2629 if (mod_data.can_stall) {
2630 fsg_set_halt(fsg, fsg->bulk_out);
2631 halt_bulk_in_endpoint(fsg);
2632 }
2633 return -EINVAL;
2634 }
2635
2636 /* Save the command for later */
2637 fsg->cmnd_size = cbw->Length;
2638 memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
2639 if (cbw->Flags & USB_BULK_IN_FLAG)
2640 fsg->data_dir = DATA_DIR_TO_HOST;
2641 else
2642 fsg->data_dir = DATA_DIR_FROM_HOST;
2643 fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
2644 if (fsg->data_size == 0)
2645 fsg->data_dir = DATA_DIR_NONE;
2646 fsg->lun = cbw->Lun;
2647 fsg->tag = cbw->Tag;
2648 return 0;
2649}
2650
2651
2652static int get_next_command(struct fsg_dev *fsg)
2653{
2654 struct fsg_buffhd *bh;
2655 int rc = 0;
2656
2657 if (transport_is_bbb()) {
2658
2659 /* Wait for the next buffer to become available */
2660 bh = fsg->next_buffhd_to_fill;
2661 while (bh->state != BUF_STATE_EMPTY) {
2662 rc = sleep_thread(fsg);
2663 if (rc)
2664 return rc;
2665 }
2666
2667 /* Queue a request to read a Bulk-only CBW */
2668 set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
2669 bh->outreq->short_not_ok = 1;
2670 start_transfer(fsg, fsg->bulk_out, bh->outreq,
2671 &bh->outreq_busy, &bh->state);
2672
2673 /* We will drain the buffer in software, which means we
2674 * can reuse it for the next filling. No need to advance
2675 * next_buffhd_to_fill. */
2676
2677 /* Wait for the CBW to arrive */
2678 while (bh->state != BUF_STATE_FULL) {
2679 rc = sleep_thread(fsg);
2680 if (rc)
2681 return rc;
2682 }
2683 smp_rmb();
2684 rc = received_cbw(fsg, bh);
2685 bh->state = BUF_STATE_EMPTY;
2686
2687 } else { // USB_PR_CB or USB_PR_CBI
2688
2689 /* Wait for the next command to arrive */
2690 while (fsg->cbbuf_cmnd_size == 0) {
2691 rc = sleep_thread(fsg);
2692 if (rc)
2693 return rc;
2694 }
2695
2696 /* Is the previous status interrupt request still busy?
2697 * The host is allowed to skip reading the status,
2698 * so we must cancel it. */
2699 if (fsg->intreq_busy)
2700 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2701
2702 /* Copy the command and mark the buffer empty */
2703 fsg->data_dir = DATA_DIR_UNKNOWN;
2704 spin_lock_irq(&fsg->lock);
2705 fsg->cmnd_size = fsg->cbbuf_cmnd_size;
2706 memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
2707 fsg->cbbuf_cmnd_size = 0;
2708 spin_unlock_irq(&fsg->lock);
2709 }
2710 return rc;
2711}
2712
2713
2714/*-------------------------------------------------------------------------*/
2715
2716static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
2717 const struct usb_endpoint_descriptor *d)
2718{
2719 int rc;
2720
2721 ep->driver_data = fsg;
2722 ep->desc = d;
2723 rc = usb_ep_enable(ep);
2724 if (rc)
2725 ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
2726 return rc;
2727}
2728
2729static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
2730 struct usb_request **preq)
2731{
2732 *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2733 if (*preq)
2734 return 0;
2735 ERROR(fsg, "can't allocate request for %s\n", ep->name);
2736 return -ENOMEM;
2737}
2738
2739/*
2740 * Reset interface setting and re-init endpoint state (toggle etc).
2741 * Call with altsetting < 0 to disable the interface. The only other
2742 * available altsetting is 0, which enables the interface.
2743 */
2744static int do_set_interface(struct fsg_dev *fsg, int altsetting)
2745{
2746 int rc = 0;
2747 int i;
2748 const struct usb_endpoint_descriptor *d;
2749
2750 if (fsg->running)
2751 DBG(fsg, "reset interface\n");
2752
2753reset:
2754 /* Deallocate the requests */
2755 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2756 struct fsg_buffhd *bh = &fsg->buffhds[i];
2757
2758 if (bh->inreq) {
2759 usb_ep_free_request(fsg->bulk_in, bh->inreq);
2760 bh->inreq = NULL;
2761 }
2762 if (bh->outreq) {
2763 usb_ep_free_request(fsg->bulk_out, bh->outreq);
2764 bh->outreq = NULL;
2765 }
2766 }
2767 if (fsg->intreq) {
2768 usb_ep_free_request(fsg->intr_in, fsg->intreq);
2769 fsg->intreq = NULL;
2770 }
2771
2772 /* Disable the endpoints */
2773 if (fsg->bulk_in_enabled) {
2774 usb_ep_disable(fsg->bulk_in);
2775 fsg->bulk_in_enabled = 0;
2776 }
2777 if (fsg->bulk_out_enabled) {
2778 usb_ep_disable(fsg->bulk_out);
2779 fsg->bulk_out_enabled = 0;
2780 }
2781 if (fsg->intr_in_enabled) {
2782 usb_ep_disable(fsg->intr_in);
2783 fsg->intr_in_enabled = 0;
2784 }
2785
2786 fsg->running = 0;
2787 if (altsetting < 0 || rc != 0)
2788 return rc;
2789
2790 DBG(fsg, "set interface %d\n", altsetting);
2791
2792 /* Enable the endpoints */
2793 d = fsg_ep_desc(fsg->gadget,
2794 &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
2795 if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
2796 goto reset;
2797 fsg->bulk_in_enabled = 1;
2798
2799 d = fsg_ep_desc(fsg->gadget,
2800 &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
2801 if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
2802 goto reset;
2803 fsg->bulk_out_enabled = 1;
2804 fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
2805 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2806
2807 if (transport_is_cbi()) {
2808 d = fsg_ep_desc(fsg->gadget,
2809 &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc);
2810 if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
2811 goto reset;
2812 fsg->intr_in_enabled = 1;
2813 }
2814
2815 /* Allocate the requests */
2816 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2817 struct fsg_buffhd *bh = &fsg->buffhds[i];
2818
2819 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
2820 goto reset;
2821 if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
2822 goto reset;
2823 bh->inreq->buf = bh->outreq->buf = bh->buf;
2824 bh->inreq->context = bh->outreq->context = bh;
2825 bh->inreq->complete = bulk_in_complete;
2826 bh->outreq->complete = bulk_out_complete;
2827 }
2828 if (transport_is_cbi()) {
2829 if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
2830 goto reset;
2831 fsg->intreq->complete = intr_in_complete;
2832 }
2833
2834 fsg->running = 1;
2835 for (i = 0; i < fsg->nluns; ++i)
2836 fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
2837 return rc;
2838}
2839
2840
2841/*
2842 * Change our operational configuration. This code must agree with the code
2843 * that returns config descriptors, and with interface altsetting code.
2844 *
2845 * It's also responsible for power management interactions. Some
2846 * configurations might not work with our current power sources.
2847 * For now we just assume the gadget is always self-powered.
2848 */
2849static int do_set_config(struct fsg_dev *fsg, u8 new_config)
2850{
2851 int rc = 0;
2852
2853 /* Disable the single interface */
2854 if (fsg->config != 0) {
2855 DBG(fsg, "reset config\n");
2856 fsg->config = 0;
2857 rc = do_set_interface(fsg, -1);
2858 }
2859
2860 /* Enable the interface */
2861 if (new_config != 0) {
2862 fsg->config = new_config;
2863 if ((rc = do_set_interface(fsg, 0)) != 0)
2864 fsg->config = 0; // Reset on errors
2865 else {
2866 char *speed;
2867
2868 switch (fsg->gadget->speed) {
2869 case USB_SPEED_LOW: speed = "low"; break;
2870 case USB_SPEED_FULL: speed = "full"; break;
2871 case USB_SPEED_HIGH: speed = "high"; break;
2872 default: speed = "?"; break;
2873 }
2874 INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
2875 }
2876 }
2877 return rc;
2878}
2879
2880
2881/*-------------------------------------------------------------------------*/
2882
2883static void handle_exception(struct fsg_dev *fsg)
2884{
2885 siginfo_t info;
2886 int sig;
2887 int i;
2888 int num_active;
2889 struct fsg_buffhd *bh;
2890 enum fsg_state old_state;
2891 u8 new_config;
2892 struct fsg_lun *curlun;
2893 unsigned int exception_req_tag;
2894 int rc;
2895
2896 /* Clear the existing signals. Anything but SIGUSR1 is converted
2897 * into a high-priority EXIT exception. */
2898 for (;;) {
2899 sig = dequeue_signal_lock(current, ¤t->blocked, &info);
2900 if (!sig)
2901 break;
2902 if (sig != SIGUSR1) {
2903 if (fsg->state < FSG_STATE_EXIT)
2904 DBG(fsg, "Main thread exiting on signal\n");
2905 raise_exception(fsg, FSG_STATE_EXIT);
2906 }
2907 }
2908
2909 /* Cancel all the pending transfers */
2910 if (fsg->intreq_busy)
2911 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2912 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2913 bh = &fsg->buffhds[i];
2914 if (bh->inreq_busy)
2915 usb_ep_dequeue(fsg->bulk_in, bh->inreq);
2916 if (bh->outreq_busy)
2917 usb_ep_dequeue(fsg->bulk_out, bh->outreq);
2918 }
2919
2920 /* Wait until everything is idle */
2921 for (;;) {
2922 num_active = fsg->intreq_busy;
2923 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2924 bh = &fsg->buffhds[i];
2925 num_active += bh->inreq_busy + bh->outreq_busy;
2926 }
2927 if (num_active == 0)
2928 break;
2929 if (sleep_thread(fsg))
2930 return;
2931 }
2932
2933 /* Clear out the controller's fifos */
2934 if (fsg->bulk_in_enabled)
2935 usb_ep_fifo_flush(fsg->bulk_in);
2936 if (fsg->bulk_out_enabled)
2937 usb_ep_fifo_flush(fsg->bulk_out);
2938 if (fsg->intr_in_enabled)
2939 usb_ep_fifo_flush(fsg->intr_in);
2940
2941 /* Reset the I/O buffer states and pointers, the SCSI
2942 * state, and the exception. Then invoke the handler. */
2943 spin_lock_irq(&fsg->lock);
2944
2945 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2946 bh = &fsg->buffhds[i];
2947 bh->state = BUF_STATE_EMPTY;
2948 }
2949 fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
2950 &fsg->buffhds[0];
2951
2952 exception_req_tag = fsg->exception_req_tag;
2953 new_config = fsg->new_config;
2954 old_state = fsg->state;
2955
2956 if (old_state == FSG_STATE_ABORT_BULK_OUT)
2957 fsg->state = FSG_STATE_STATUS_PHASE;
2958 else {
2959 for (i = 0; i < fsg->nluns; ++i) {
2960 curlun = &fsg->luns[i];
2961 curlun->prevent_medium_removal = 0;
2962 curlun->sense_data = curlun->unit_attention_data =
2963 SS_NO_SENSE;
2964 curlun->sense_data_info = 0;
2965 curlun->info_valid = 0;
2966 }
2967 fsg->state = FSG_STATE_IDLE;
2968 }
2969 spin_unlock_irq(&fsg->lock);
2970
2971 /* Carry out any extra actions required for the exception */
2972 switch (old_state) {
2973 default:
2974 break;
2975
2976 case FSG_STATE_ABORT_BULK_OUT:
2977 send_status(fsg);
2978 spin_lock_irq(&fsg->lock);
2979 if (fsg->state == FSG_STATE_STATUS_PHASE)
2980 fsg->state = FSG_STATE_IDLE;
2981 spin_unlock_irq(&fsg->lock);
2982 break;
2983
2984 case FSG_STATE_RESET:
2985 /* In case we were forced against our will to halt a
2986 * bulk endpoint, clear the halt now. (The SuperH UDC
2987 * requires this.) */
2988 if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2989 usb_ep_clear_halt(fsg->bulk_in);
2990
2991 if (transport_is_bbb()) {
2992 if (fsg->ep0_req_tag == exception_req_tag)
2993 ep0_queue(fsg); // Complete the status stage
2994
2995 } else if (transport_is_cbi())
2996 send_status(fsg); // Status by interrupt pipe
2997
2998 /* Technically this should go here, but it would only be
2999 * a waste of time. Ditto for the INTERFACE_CHANGE and
3000 * CONFIG_CHANGE cases. */
3001 // for (i = 0; i < fsg->nluns; ++i)
3002 // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3003 break;
3004
3005 case FSG_STATE_INTERFACE_CHANGE:
3006 rc = do_set_interface(fsg, 0);
3007 if (fsg->ep0_req_tag != exception_req_tag)
3008 break;
3009 if (rc != 0) // STALL on errors
3010 fsg_set_halt(fsg, fsg->ep0);
3011 else // Complete the status stage
3012 ep0_queue(fsg);
3013 break;
3014
3015 case FSG_STATE_CONFIG_CHANGE:
3016 rc = do_set_config(fsg, new_config);
3017 if (fsg->ep0_req_tag != exception_req_tag)
3018 break;
3019 if (rc != 0) // STALL on errors
3020 fsg_set_halt(fsg, fsg->ep0);
3021 else // Complete the status stage
3022 ep0_queue(fsg);
3023 break;
3024
3025 case FSG_STATE_DISCONNECT:
3026 for (i = 0; i < fsg->nluns; ++i)
3027 fsg_lun_fsync_sub(fsg->luns + i);
3028 do_set_config(fsg, 0); // Unconfigured state
3029 break;
3030
3031 case FSG_STATE_EXIT:
3032 case FSG_STATE_TERMINATED:
3033 do_set_config(fsg, 0); // Free resources
3034 spin_lock_irq(&fsg->lock);
3035 fsg->state = FSG_STATE_TERMINATED; // Stop the thread
3036 spin_unlock_irq(&fsg->lock);
3037 break;
3038 }
3039}
3040
3041
3042/*-------------------------------------------------------------------------*/
3043
3044static int fsg_main_thread(void *fsg_)
3045{
3046 struct fsg_dev *fsg = fsg_;
3047
3048 /* Allow the thread to be killed by a signal, but set the signal mask
3049 * to block everything but INT, TERM, KILL, and USR1. */
3050 allow_signal(SIGINT);
3051 allow_signal(SIGTERM);
3052 allow_signal(SIGKILL);
3053 allow_signal(SIGUSR1);
3054
3055 /* Allow the thread to be frozen */
3056 set_freezable();
3057
3058 /* Arrange for userspace references to be interpreted as kernel
3059 * pointers. That way we can pass a kernel pointer to a routine
3060 * that expects a __user pointer and it will work okay. */
3061 set_fs(get_ds());
3062
3063 /* The main loop */
3064 while (fsg->state != FSG_STATE_TERMINATED) {
3065 if (exception_in_progress(fsg) || signal_pending(current)) {
3066 handle_exception(fsg);
3067 continue;
3068 }
3069
3070 if (!fsg->running) {
3071 sleep_thread(fsg);
3072 continue;
3073 }
3074
3075 if (get_next_command(fsg))
3076 continue;
3077
3078 spin_lock_irq(&fsg->lock);
3079 if (!exception_in_progress(fsg))
3080 fsg->state = FSG_STATE_DATA_PHASE;
3081 spin_unlock_irq(&fsg->lock);
3082
3083 if (do_scsi_command(fsg) || finish_reply(fsg))
3084 continue;
3085
3086 spin_lock_irq(&fsg->lock);
3087 if (!exception_in_progress(fsg))
3088 fsg->state = FSG_STATE_STATUS_PHASE;
3089 spin_unlock_irq(&fsg->lock);
3090
3091 if (send_status(fsg))
3092 continue;
3093
3094 spin_lock_irq(&fsg->lock);
3095 if (!exception_in_progress(fsg))
3096 fsg->state = FSG_STATE_IDLE;
3097 spin_unlock_irq(&fsg->lock);
3098 }
3099
3100 spin_lock_irq(&fsg->lock);
3101 fsg->thread_task = NULL;
3102 spin_unlock_irq(&fsg->lock);
3103
3104 /* If we are exiting because of a signal, unregister the
3105 * gadget driver. */
3106 if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
3107 usb_gadget_unregister_driver(&fsg_driver);
3108
3109 /* Let the unbind and cleanup routines know the thread has exited */
3110 complete_and_exit(&fsg->thread_notifier, 0);
3111}
3112
3113
3114/*-------------------------------------------------------------------------*/
3115
3116
3117/* The write permissions and store_xxx pointers are set in fsg_bind() */
3118static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
3119static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
3120static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
3121
3122
3123/*-------------------------------------------------------------------------*/
3124
3125static void fsg_release(struct kref *ref)
3126{
3127 struct fsg_dev *fsg = container_of(ref, struct fsg_dev, ref);
3128
3129 kfree(fsg->luns);
3130 kfree(fsg);
3131}
3132
3133static void lun_release(struct device *dev)
3134{
3135 struct rw_semaphore *filesem = dev_get_drvdata(dev);
3136 struct fsg_dev *fsg =
3137 container_of(filesem, struct fsg_dev, filesem);
3138
3139 kref_put(&fsg->ref, fsg_release);
3140}
3141
3142static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
3143{
3144 struct fsg_dev *fsg = get_gadget_data(gadget);
3145 int i;
3146 struct fsg_lun *curlun;
3147 struct usb_request *req = fsg->ep0req;
3148
3149 DBG(fsg, "unbind\n");
3150 clear_bit(REGISTERED, &fsg->atomic_bitflags);
3151
3152 /* Unregister the sysfs attribute files and the LUNs */
3153 for (i = 0; i < fsg->nluns; ++i) {
3154 curlun = &fsg->luns[i];
3155 if (curlun->registered) {
3156 device_remove_file(&curlun->dev, &dev_attr_nofua);
3157 device_remove_file(&curlun->dev, &dev_attr_ro);
3158 device_remove_file(&curlun->dev, &dev_attr_file);
3159 fsg_lun_close(curlun);
3160 device_unregister(&curlun->dev);
3161 curlun->registered = 0;
3162 }
3163 }
3164
3165 /* If the thread isn't already dead, tell it to exit now */
3166 if (fsg->state != FSG_STATE_TERMINATED) {
3167 raise_exception(fsg, FSG_STATE_EXIT);
3168 wait_for_completion(&fsg->thread_notifier);
3169
3170 /* The cleanup routine waits for this completion also */
3171 complete(&fsg->thread_notifier);
3172 }
3173
3174 /* Free the data buffers */
3175 for (i = 0; i < FSG_NUM_BUFFERS; ++i)
3176 kfree(fsg->buffhds[i].buf);
3177
3178 /* Free the request and buffer for endpoint 0 */
3179 if (req) {
3180 kfree(req->buf);
3181 usb_ep_free_request(fsg->ep0, req);
3182 }
3183
3184 set_gadget_data(gadget, NULL);
3185}
3186
3187
3188static int __init check_parameters(struct fsg_dev *fsg)
3189{
3190 int prot;
3191 int gcnum;
3192
3193 /* Store the default values */
3194 mod_data.transport_type = USB_PR_BULK;
3195 mod_data.transport_name = "Bulk-only";
3196 mod_data.protocol_type = USB_SC_SCSI;
3197 mod_data.protocol_name = "Transparent SCSI";
3198
3199 /* Some peripheral controllers are known not to be able to
3200 * halt bulk endpoints correctly. If one of them is present,
3201 * disable stalls.
3202 */
3203 if (gadget_is_at91(fsg->gadget))
3204 mod_data.can_stall = 0;
3205
3206 if (mod_data.release == 0xffff) { // Parameter wasn't set
3207 gcnum = usb_gadget_controller_number(fsg->gadget);
3208 if (gcnum >= 0)
3209 mod_data.release = 0x0300 + gcnum;
3210 else {
3211 WARNING(fsg, "controller '%s' not recognized\n",
3212 fsg->gadget->name);
3213 mod_data.release = 0x0399;
3214 }
3215 }
3216
3217 prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
3218
3219#ifdef CONFIG_USB_FILE_STORAGE_TEST
3220 if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
3221 ; // Use default setting
3222 } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
3223 mod_data.transport_type = USB_PR_CB;
3224 mod_data.transport_name = "Control-Bulk";
3225 } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
3226 mod_data.transport_type = USB_PR_CBI;
3227 mod_data.transport_name = "Control-Bulk-Interrupt";
3228 } else {
3229 ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
3230 return -EINVAL;
3231 }
3232
3233 if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
3234 prot == USB_SC_SCSI) {
3235 ; // Use default setting
3236 } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
3237 prot == USB_SC_RBC) {
3238 mod_data.protocol_type = USB_SC_RBC;
3239 mod_data.protocol_name = "RBC";
3240 } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
3241 strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
3242 prot == USB_SC_8020) {
3243 mod_data.protocol_type = USB_SC_8020;
3244 mod_data.protocol_name = "8020i (ATAPI)";
3245 } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
3246 prot == USB_SC_QIC) {
3247 mod_data.protocol_type = USB_SC_QIC;
3248 mod_data.protocol_name = "QIC-157";
3249 } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
3250 prot == USB_SC_UFI) {
3251 mod_data.protocol_type = USB_SC_UFI;
3252 mod_data.protocol_name = "UFI";
3253 } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
3254 prot == USB_SC_8070) {
3255 mod_data.protocol_type = USB_SC_8070;
3256 mod_data.protocol_name = "8070i";
3257 } else {
3258 ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
3259 return -EINVAL;
3260 }
3261
3262 mod_data.buflen &= PAGE_CACHE_MASK;
3263 if (mod_data.buflen <= 0) {
3264 ERROR(fsg, "invalid buflen\n");
3265 return -ETOOSMALL;
3266 }
3267
3268#endif /* CONFIG_USB_FILE_STORAGE_TEST */
3269
3270 /* Serial string handling.
3271 * On a real device, the serial string would be loaded
3272 * from permanent storage. */
3273 if (mod_data.serial) {
3274 const char *ch;
3275 unsigned len = 0;
3276
3277 /* Sanity check :
3278 * The CB[I] specification limits the serial string to
3279 * 12 uppercase hexadecimal characters.
3280 * BBB need at least 12 uppercase hexadecimal characters,
3281 * with a maximum of 126. */
3282 for (ch = mod_data.serial; *ch; ++ch) {
3283 ++len;
3284 if ((*ch < '0' || *ch > '9') &&
3285 (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
3286 WARNING(fsg,
3287 "Invalid serial string character: %c\n",
3288 *ch);
3289 goto no_serial;
3290 }
3291 }
3292 if (len > 126 ||
3293 (mod_data.transport_type == USB_PR_BULK && len < 12) ||
3294 (mod_data.transport_type != USB_PR_BULK && len > 12)) {
3295 WARNING(fsg, "Invalid serial string length!\n");
3296 goto no_serial;
3297 }
3298 fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
3299 } else {
3300 WARNING(fsg, "No serial-number string provided!\n");
3301 no_serial:
3302 device_desc.iSerialNumber = 0;
3303 }
3304
3305 return 0;
3306}
3307
3308
3309static int __init fsg_bind(struct usb_gadget *gadget)
3310{
3311 struct fsg_dev *fsg = the_fsg;
3312 int rc;
3313 int i;
3314 struct fsg_lun *curlun;
3315 struct usb_ep *ep;
3316 struct usb_request *req;
3317 char *pathbuf, *p;
3318
3319 fsg->gadget = gadget;
3320 set_gadget_data(gadget, fsg);
3321 fsg->ep0 = gadget->ep0;
3322 fsg->ep0->driver_data = fsg;
3323
3324 if ((rc = check_parameters(fsg)) != 0)
3325 goto out;
3326
3327 if (mod_data.removable) { // Enable the store_xxx attributes
3328 dev_attr_file.attr.mode = 0644;
3329 dev_attr_file.store = fsg_store_file;
3330 if (!mod_data.cdrom) {
3331 dev_attr_ro.attr.mode = 0644;
3332 dev_attr_ro.store = fsg_store_ro;
3333 }
3334 }
3335
3336 /* Only for removable media? */
3337 dev_attr_nofua.attr.mode = 0644;
3338 dev_attr_nofua.store = fsg_store_nofua;
3339
3340 /* Find out how many LUNs there should be */
3341 i = mod_data.nluns;
3342 if (i == 0)
3343 i = max(mod_data.num_filenames, 1u);
3344 if (i > FSG_MAX_LUNS) {
3345 ERROR(fsg, "invalid number of LUNs: %d\n", i);
3346 rc = -EINVAL;
3347 goto out;
3348 }
3349
3350 /* Create the LUNs, open their backing files, and register the
3351 * LUN devices in sysfs. */
3352 fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
3353 if (!fsg->luns) {
3354 rc = -ENOMEM;
3355 goto out;
3356 }
3357 fsg->nluns = i;
3358
3359 for (i = 0; i < fsg->nluns; ++i) {
3360 curlun = &fsg->luns[i];
3361 curlun->cdrom = !!mod_data.cdrom;
3362 curlun->ro = mod_data.cdrom || mod_data.ro[i];
3363 curlun->initially_ro = curlun->ro;
3364 curlun->removable = mod_data.removable;
3365 curlun->nofua = mod_data.nofua[i];
3366 curlun->dev.release = lun_release;
3367 curlun->dev.parent = &gadget->dev;
3368 curlun->dev.driver = &fsg_driver.driver;
3369 dev_set_drvdata(&curlun->dev, &fsg->filesem);
3370 dev_set_name(&curlun->dev,"%s-lun%d",
3371 dev_name(&gadget->dev), i);
3372
3373 kref_get(&fsg->ref);
3374 rc = device_register(&curlun->dev);
3375 if (rc) {
3376 INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
3377 put_device(&curlun->dev);
3378 goto out;
3379 }
3380 curlun->registered = 1;
3381
3382 rc = device_create_file(&curlun->dev, &dev_attr_ro);
3383 if (rc)
3384 goto out;
3385 rc = device_create_file(&curlun->dev, &dev_attr_nofua);
3386 if (rc)
3387 goto out;
3388 rc = device_create_file(&curlun->dev, &dev_attr_file);
3389 if (rc)
3390 goto out;
3391
3392 if (mod_data.file[i] && *mod_data.file[i]) {
3393 rc = fsg_lun_open(curlun, mod_data.file[i]);
3394 if (rc)
3395 goto out;
3396 } else if (!mod_data.removable) {
3397 ERROR(fsg, "no file given for LUN%d\n", i);
3398 rc = -EINVAL;
3399 goto out;
3400 }
3401 }
3402
3403 /* Find all the endpoints we will use */
3404 usb_ep_autoconfig_reset(gadget);
3405 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
3406 if (!ep)
3407 goto autoconf_fail;
3408 ep->driver_data = fsg; // claim the endpoint
3409 fsg->bulk_in = ep;
3410
3411 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
3412 if (!ep)
3413 goto autoconf_fail;
3414 ep->driver_data = fsg; // claim the endpoint
3415 fsg->bulk_out = ep;
3416
3417 if (transport_is_cbi()) {
3418 ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
3419 if (!ep)
3420 goto autoconf_fail;
3421 ep->driver_data = fsg; // claim the endpoint
3422 fsg->intr_in = ep;
3423 }
3424
3425 /* Fix up the descriptors */
3426 device_desc.idVendor = cpu_to_le16(mod_data.vendor);
3427 device_desc.idProduct = cpu_to_le16(mod_data.product);
3428 device_desc.bcdDevice = cpu_to_le16(mod_data.release);
3429
3430 i = (transport_is_cbi() ? 3 : 2); // Number of endpoints
3431 fsg_intf_desc.bNumEndpoints = i;
3432 fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
3433 fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
3434 fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
3435
3436 if (gadget_is_dualspeed(gadget)) {
3437 fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
3438
3439 /* Assume endpoint addresses are the same for both speeds */
3440 fsg_hs_bulk_in_desc.bEndpointAddress =
3441 fsg_fs_bulk_in_desc.bEndpointAddress;
3442 fsg_hs_bulk_out_desc.bEndpointAddress =
3443 fsg_fs_bulk_out_desc.bEndpointAddress;
3444 fsg_hs_intr_in_desc.bEndpointAddress =
3445 fsg_fs_intr_in_desc.bEndpointAddress;
3446 }
3447
3448 if (gadget_is_otg(gadget))
3449 fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
3450
3451 rc = -ENOMEM;
3452
3453 /* Allocate the request and buffer for endpoint 0 */
3454 fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
3455 if (!req)
3456 goto out;
3457 req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
3458 if (!req->buf)
3459 goto out;
3460 req->complete = ep0_complete;
3461
3462 /* Allocate the data buffers */
3463 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
3464 struct fsg_buffhd *bh = &fsg->buffhds[i];
3465
3466 /* Allocate for the bulk-in endpoint. We assume that
3467 * the buffer will also work with the bulk-out (and
3468 * interrupt-in) endpoint. */
3469 bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
3470 if (!bh->buf)
3471 goto out;
3472 bh->next = bh + 1;
3473 }
3474 fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0];
3475
3476 /* This should reflect the actual gadget power source */
3477 usb_gadget_set_selfpowered(gadget);
3478
3479 snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
3480 "%s %s with %s",
3481 init_utsname()->sysname, init_utsname()->release,
3482 gadget->name);
3483
3484 fsg->thread_task = kthread_create(fsg_main_thread, fsg,
3485 "file-storage-gadget");
3486 if (IS_ERR(fsg->thread_task)) {
3487 rc = PTR_ERR(fsg->thread_task);
3488 goto out;
3489 }
3490
3491 INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
3492 INFO(fsg, "NOTE: This driver is deprecated. "
3493 "Consider using g_mass_storage instead.\n");
3494 INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
3495
3496 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
3497 for (i = 0; i < fsg->nluns; ++i) {
3498 curlun = &fsg->luns[i];
3499 if (fsg_lun_is_open(curlun)) {
3500 p = NULL;
3501 if (pathbuf) {
3502 p = d_path(&curlun->filp->f_path,
3503 pathbuf, PATH_MAX);
3504 if (IS_ERR(p))
3505 p = NULL;
3506 }
3507 LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
3508 curlun->ro, curlun->nofua, (p ? p : "(error)"));
3509 }
3510 }
3511 kfree(pathbuf);
3512
3513 DBG(fsg, "transport=%s (x%02x)\n",
3514 mod_data.transport_name, mod_data.transport_type);
3515 DBG(fsg, "protocol=%s (x%02x)\n",
3516 mod_data.protocol_name, mod_data.protocol_type);
3517 DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
3518 mod_data.vendor, mod_data.product, mod_data.release);
3519 DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
3520 mod_data.removable, mod_data.can_stall,
3521 mod_data.cdrom, mod_data.buflen);
3522 DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
3523
3524 set_bit(REGISTERED, &fsg->atomic_bitflags);
3525
3526 /* Tell the thread to start working */
3527 wake_up_process(fsg->thread_task);
3528 return 0;
3529
3530autoconf_fail:
3531 ERROR(fsg, "unable to autoconfigure all endpoints\n");
3532 rc = -ENOTSUPP;
3533
3534out:
3535 fsg->state = FSG_STATE_TERMINATED; // The thread is dead
3536 fsg_unbind(gadget);
3537 complete(&fsg->thread_notifier);
3538 return rc;
3539}
3540
3541
3542/*-------------------------------------------------------------------------*/
3543
3544static void fsg_suspend(struct usb_gadget *gadget)
3545{
3546 struct fsg_dev *fsg = get_gadget_data(gadget);
3547
3548 DBG(fsg, "suspend\n");
3549 set_bit(SUSPENDED, &fsg->atomic_bitflags);
3550}
3551
3552static void fsg_resume(struct usb_gadget *gadget)
3553{
3554 struct fsg_dev *fsg = get_gadget_data(gadget);
3555
3556 DBG(fsg, "resume\n");
3557 clear_bit(SUSPENDED, &fsg->atomic_bitflags);
3558}
3559
3560
3561/*-------------------------------------------------------------------------*/
3562
3563static struct usb_gadget_driver fsg_driver = {
3564#ifdef CONFIG_USB_GADGET_DUALSPEED
3565 .speed = USB_SPEED_HIGH,
3566#else
3567 .speed = USB_SPEED_FULL,
3568#endif
3569 .function = (char *) fsg_string_product,
3570 .unbind = fsg_unbind,
3571 .disconnect = fsg_disconnect,
3572 .setup = fsg_setup,
3573 .suspend = fsg_suspend,
3574 .resume = fsg_resume,
3575
3576 .driver = {
3577 .name = DRIVER_NAME,
3578 .owner = THIS_MODULE,
3579 // .release = ...
3580 // .suspend = ...
3581 // .resume = ...
3582 },
3583};
3584
3585
3586static int __init fsg_alloc(void)
3587{
3588 struct fsg_dev *fsg;
3589
3590 fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
3591 if (!fsg)
3592 return -ENOMEM;
3593 spin_lock_init(&fsg->lock);
3594 init_rwsem(&fsg->filesem);
3595 kref_init(&fsg->ref);
3596 init_completion(&fsg->thread_notifier);
3597
3598 the_fsg = fsg;
3599 return 0;
3600}
3601
3602
3603static int __init fsg_init(void)
3604{
3605 int rc;
3606 struct fsg_dev *fsg;
3607
3608 if ((rc = fsg_alloc()) != 0)
3609 return rc;
3610 fsg = the_fsg;
3611 if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
3612 kref_put(&fsg->ref, fsg_release);
3613 return rc;
3614}
3615module_init(fsg_init);
3616
3617
3618static void __exit fsg_cleanup(void)
3619{
3620 struct fsg_dev *fsg = the_fsg;
3621
3622 /* Unregister the driver iff the thread hasn't already done so */
3623 if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
3624 usb_gadget_unregister_driver(&fsg_driver);
3625
3626 /* Wait for the thread to finish up */
3627 wait_for_completion(&fsg->thread_notifier);
3628
3629 kref_put(&fsg->ref, fsg_release);
3630}
3631module_exit(fsg_cleanup);