file_storage.c 116 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215
  1. /*
  2. * file_storage.c -- File-backed USB Storage Gadget, for USB development
  3. *
  4. * Copyright (C) 2003-2005 Alan Stern
  5. * All rights reserved.
  6. *
  7. * Redistribution and use in source and binary forms, with or without
  8. * modification, are permitted provided that the following conditions
  9. * are met:
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions, and the following disclaimer,
  12. * without modification.
  13. * 2. Redistributions in binary form must reproduce the above copyright
  14. * notice, this list of conditions and the following disclaimer in the
  15. * documentation and/or other materials provided with the distribution.
  16. * 3. The names of the above-listed copyright holders may not be used
  17. * to endorse or promote products derived from this software without
  18. * specific prior written permission.
  19. *
  20. * ALTERNATIVELY, this software may be distributed under the terms of the
  21. * GNU General Public License ("GPL") as published by the Free Software
  22. * Foundation, either version 2 of that License or (at your option) any
  23. * later version.
  24. *
  25. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
  26. * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  27. * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  29. * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  30. * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  31. * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  32. * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  33. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  34. * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  35. * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  36. */
  37. /*
  38. * The File-backed Storage Gadget acts as a USB Mass Storage device,
  39. * appearing to the host as a disk drive. In addition to providing an
  40. * example of a genuinely useful gadget driver for a USB device, it also
  41. * illustrates a technique of double-buffering for increased throughput.
  42. * Last but not least, it gives an easy way to probe the behavior of the
  43. * Mass Storage drivers in a USB host.
  44. *
  45. * Backing storage is provided by a regular file or a block device, specified
  46. * by the "file" module parameter. Access can be limited to read-only by
  47. * setting the optional "ro" module parameter. The gadget will indicate that
  48. * it has removable media if the optional "removable" module parameter is set.
  49. *
  50. * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
  51. * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
  52. * by the optional "transport" module parameter. It also supports the
  53. * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
  54. * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
  55. * the optional "protocol" module parameter. In addition, the default
  56. * Vendor ID, Product ID, and release number can be overridden.
  57. *
  58. * There is support for multiple logical units (LUNs), each of which has
  59. * its own backing file. The number of LUNs can be set using the optional
  60. * "luns" module parameter (anywhere from 1 to 8), and the corresponding
  61. * files are specified using comma-separated lists for "file" and "ro".
  62. * The default number of LUNs is taken from the number of "file" elements;
  63. * it is 1 if "file" is not given. If "removable" is not set then a backing
  64. * file must be specified for each LUN. If it is set, then an unspecified
  65. * or empty backing filename means the LUN's medium is not loaded.
  66. *
  67. * Requirements are modest; only a bulk-in and a bulk-out endpoint are
  68. * needed (an interrupt-out endpoint is also needed for CBI). The memory
  69. * requirement amounts to two 16K buffers, size configurable by a parameter.
  70. * Support is included for both full-speed and high-speed operation.
  71. *
  72. * Note that the driver is slightly non-portable in that it assumes a
  73. * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
  74. * interrupt-in endpoints. With most device controllers this isn't an
  75. * issue, but there may be some with hardware restrictions that prevent
  76. * a buffer from being used by more than one endpoint.
  77. *
  78. * Module options:
  79. *
  80. * file=filename[,filename...]
  81. * Required if "removable" is not set, names of
  82. * the files or block devices used for
  83. * backing storage
  84. * ro=b[,b...] Default false, booleans for read-only access
  85. * removable Default false, boolean for removable media
  86. * luns=N Default N = number of filenames, number of
  87. * LUNs to support
  88. * stall Default determined according to the type of
  89. * USB device controller (usually true),
  90. * boolean to permit the driver to halt
  91. * bulk endpoints
  92. * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
  93. * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
  94. * ATAPI, QIC, UFI, 8070, or SCSI;
  95. * also 1 - 6)
  96. * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
  97. * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
  98. * release=0xRRRR Override the USB release number (bcdDevice)
  99. * buflen=N Default N=16384, buffer size used (will be
  100. * rounded down to a multiple of
  101. * PAGE_CACHE_SIZE)
  102. *
  103. * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
  104. * "removable", "luns", and "stall" options are available; default values
  105. * are used for everything else.
  106. *
  107. * The pathnames of the backing files and the ro settings are available in
  108. * the attribute files "file" and "ro" in the lun<n> subdirectory of the
  109. * gadget's sysfs directory. If the "removable" option is set, writing to
  110. * these files will simulate ejecting/loading the medium (writing an empty
  111. * line means eject) and adjusting a write-enable tab. Changes to the ro
  112. * setting are not allowed when the medium is loaded.
  113. *
  114. * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
  115. * The driver's SCSI command interface was based on the "Information
  116. * technology - Small Computer System Interface - 2" document from
  117. * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
  118. * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
  119. * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
  120. * "Universal Serial Bus Mass Storage Class UFI Command Specification"
  121. * document, Revision 1.0, December 14, 1998, available at
  122. * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
  123. */
  124. /*
  125. * Driver Design
  126. *
  127. * The FSG driver is fairly straightforward. There is a main kernel
  128. * thread that handles most of the work. Interrupt routines field
  129. * callbacks from the controller driver: bulk- and interrupt-request
  130. * completion notifications, endpoint-0 events, and disconnect events.
  131. * Completion events are passed to the main thread by wakeup calls. Many
  132. * ep0 requests are handled at interrupt time, but SetInterface,
  133. * SetConfiguration, and device reset requests are forwarded to the
  134. * thread in the form of "exceptions" using SIGUSR1 signals (since they
  135. * should interrupt any ongoing file I/O operations).
  136. *
  137. * The thread's main routine implements the standard command/data/status
  138. * parts of a SCSI interaction. It and its subroutines are full of tests
  139. * for pending signals/exceptions -- all this polling is necessary since
  140. * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
  141. * indication that the driver really wants to be running in userspace.)
  142. * An important point is that so long as the thread is alive it keeps an
  143. * open reference to the backing file. This will prevent unmounting
  144. * the backing file's underlying filesystem and could cause problems
  145. * during system shutdown, for example. To prevent such problems, the
  146. * thread catches INT, TERM, and KILL signals and converts them into
  147. * an EXIT exception.
  148. *
  149. * In normal operation the main thread is started during the gadget's
  150. * fsg_bind() callback and stopped during fsg_unbind(). But it can also
  151. * exit when it receives a signal, and there's no point leaving the
  152. * gadget running when the thread is dead. So just before the thread
  153. * exits, it deregisters the gadget driver. This makes things a little
  154. * tricky: The driver is deregistered at two places, and the exiting
  155. * thread can indirectly call fsg_unbind() which in turn can tell the
  156. * thread to exit. The first problem is resolved through the use of the
  157. * REGISTERED atomic bitflag; the driver will only be deregistered once.
  158. * The second problem is resolved by having fsg_unbind() check
  159. * fsg->state; it won't try to stop the thread if the state is already
  160. * FSG_STATE_TERMINATED.
  161. *
  162. * To provide maximum throughput, the driver uses a circular pipeline of
  163. * buffer heads (struct fsg_buffhd). In principle the pipeline can be
  164. * arbitrarily long; in practice the benefits don't justify having more
  165. * than 2 stages (i.e., double buffering). But it helps to think of the
  166. * pipeline as being a long one. Each buffer head contains a bulk-in and
  167. * a bulk-out request pointer (since the buffer can be used for both
  168. * output and input -- directions always are given from the host's
  169. * point of view) as well as a pointer to the buffer and various state
  170. * variables.
  171. *
  172. * Use of the pipeline follows a simple protocol. There is a variable
  173. * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
  174. * At any time that buffer head may still be in use from an earlier
  175. * request, so each buffer head has a state variable indicating whether
  176. * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
  177. * buffer head to be EMPTY, filling the buffer either by file I/O or by
  178. * USB I/O (during which the buffer head is BUSY), and marking the buffer
  179. * head FULL when the I/O is complete. Then the buffer will be emptied
  180. * (again possibly by USB I/O, during which it is marked BUSY) and
  181. * finally marked EMPTY again (possibly by a completion routine).
  182. *
  183. * A module parameter tells the driver to avoid stalling the bulk
  184. * endpoints wherever the transport specification allows. This is
  185. * necessary for some UDCs like the SuperH, which cannot reliably clear a
  186. * halt on a bulk endpoint. However, under certain circumstances the
  187. * Bulk-only specification requires a stall. In such cases the driver
  188. * will halt the endpoint and set a flag indicating that it should clear
  189. * the halt in software during the next device reset. Hopefully this
  190. * will permit everything to work correctly. Furthermore, although the
  191. * specification allows the bulk-out endpoint to halt when the host sends
  192. * too much data, implementing this would cause an unavoidable race.
  193. * The driver will always use the "no-stall" approach for OUT transfers.
  194. *
  195. * One subtle point concerns sending status-stage responses for ep0
  196. * requests. Some of these requests, such as device reset, can involve
  197. * interrupting an ongoing file I/O operation, which might take an
  198. * arbitrarily long time. During that delay the host might give up on
  199. * the original ep0 request and issue a new one. When that happens the
  200. * driver should not notify the host about completion of the original
  201. * request, as the host will no longer be waiting for it. So the driver
  202. * assigns to each ep0 request a unique tag, and it keeps track of the
  203. * tag value of the request associated with a long-running exception
  204. * (device-reset, interface-change, or configuration-change). When the
  205. * exception handler is finished, the status-stage response is submitted
  206. * only if the current ep0 request tag is equal to the exception request
  207. * tag. Thus only the most recently received ep0 request will get a
  208. * status-stage response.
  209. *
  210. * Warning: This driver source file is too long. It ought to be split up
  211. * into a header file plus about 3 separate .c files, to handle the details
  212. * of the Gadget, USB Mass Storage, and SCSI protocols.
  213. */
  214. #undef DEBUG
  215. #undef VERBOSE
  216. #undef DUMP_MSGS
  217. #include <asm/system.h>
  218. #include <asm/uaccess.h>
  219. #include <linux/bitops.h>
  220. #include <linux/blkdev.h>
  221. #include <linux/compiler.h>
  222. #include <linux/completion.h>
  223. #include <linux/dcache.h>
  224. #include <linux/delay.h>
  225. #include <linux/device.h>
  226. #include <linux/fcntl.h>
  227. #include <linux/file.h>
  228. #include <linux/fs.h>
  229. #include <linux/init.h>
  230. #include <linux/kernel.h>
  231. #include <linux/kref.h>
  232. #include <linux/kthread.h>
  233. #include <linux/limits.h>
  234. #include <linux/list.h>
  235. #include <linux/module.h>
  236. #include <linux/moduleparam.h>
  237. #include <linux/pagemap.h>
  238. #include <linux/rwsem.h>
  239. #include <linux/sched.h>
  240. #include <linux/signal.h>
  241. #include <linux/slab.h>
  242. #include <linux/spinlock.h>
  243. #include <linux/string.h>
  244. #include <linux/freezer.h>
  245. #include <linux/utsname.h>
  246. #include <linux/usb/ch9.h>
  247. #include <linux/usb_gadget.h>
  248. #include "gadget_chips.h"
  249. /*-------------------------------------------------------------------------*/
  250. #define DRIVER_DESC "File-backed Storage Gadget"
  251. #define DRIVER_NAME "g_file_storage"
  252. #define DRIVER_VERSION "28 November 2005"
  253. static const char longname[] = DRIVER_DESC;
  254. static const char shortname[] = DRIVER_NAME;
  255. MODULE_DESCRIPTION(DRIVER_DESC);
  256. MODULE_AUTHOR("Alan Stern");
  257. MODULE_LICENSE("Dual BSD/GPL");
  258. /* Thanks to NetChip Technologies for donating this product ID.
  259. *
  260. * DO NOT REUSE THESE IDs with any other driver!! Ever!!
  261. * Instead: allocate your own, using normal USB-IF procedures. */
  262. #define DRIVER_VENDOR_ID 0x0525 // NetChip
  263. #define DRIVER_PRODUCT_ID 0xa4a5 // Linux-USB File-backed Storage Gadget
  264. /*
  265. * This driver assumes self-powered hardware and has no way for users to
  266. * trigger remote wakeup. It uses autoconfiguration to select endpoints
  267. * and endpoint addresses.
  268. */
  269. //#define DEBUG
  270. //#define VERBOSE
  271. /*-------------------------------------------------------------------------*/
  272. #if 0
  273. #undef dev_printk
  274. #define dev_printk(level, l, fmt, args...) \
  275. printk(KERN_DEBUG DRIVER_NAME ": " fmt, ## args)
  276. #endif
  277. #define xprintk(f,level,fmt,args...) \
  278. dev_printk(level , &(f)->gadget->dev , fmt , ## args)
  279. #define yprintk(l,level,fmt,args...) \
  280. dev_printk(level , &(l)->dev , fmt , ## args)
  281. #ifdef DEBUG
  282. #define DBG(fsg,fmt,args...) \
  283. xprintk(fsg , KERN_DEBUG , fmt , ## args)
  284. #define LDBG(lun,fmt,args...) \
  285. yprintk(lun , KERN_DEBUG , fmt , ## args)
  286. #define MDBG(fmt,args...) \
  287. printk(KERN_DEBUG DRIVER_NAME ": " fmt , ## args)
  288. #else
  289. #define DBG(fsg,fmt,args...) \
  290. do { } while (0)
  291. #define LDBG(lun,fmt,args...) \
  292. do { } while (0)
  293. #define MDBG(fmt,args...) \
  294. do { } while (0)
  295. #undef VERBOSE
  296. #undef DUMP_MSGS
  297. #endif /* DEBUG */
  298. #ifdef VERBOSE
  299. #define VDBG DBG
  300. #define VLDBG LDBG
  301. #else
  302. #define VDBG(fsg,fmt,args...) \
  303. do { } while (0)
  304. #define VLDBG(lun,fmt,args...) \
  305. do { } while (0)
  306. #endif /* VERBOSE */
  307. #define ERROR(fsg,fmt,args...) \
  308. xprintk(fsg , KERN_ERR , fmt , ## args)
  309. #define LERROR(lun,fmt,args...) \
  310. yprintk(lun , KERN_ERR , fmt , ## args)
  311. #define WARN(fsg,fmt,args...) \
  312. xprintk(fsg , KERN_WARNING , fmt , ## args)
  313. #define LWARN(lun,fmt,args...) \
  314. yprintk(lun , KERN_WARNING , fmt , ## args)
  315. #define INFO(fsg,fmt,args...) \
  316. xprintk(fsg , KERN_INFO , fmt , ## args)
  317. #define LINFO(lun,fmt,args...) \
  318. yprintk(lun , KERN_INFO , fmt , ## args)
  319. #define MINFO(fmt,args...) \
  320. printk(KERN_INFO DRIVER_NAME ": " fmt , ## args)
  321. /*-------------------------------------------------------------------------*/
  322. /* Encapsulate the module parameter settings */
  323. #define MAX_LUNS 8
  324. static struct {
  325. char *file[MAX_LUNS];
  326. int ro[MAX_LUNS];
  327. int status[MAX_LUNS];
  328. int num_filenames;
  329. int num_ros;
  330. int num_status;
  331. unsigned int nluns;
  332. int removable;
  333. int can_stall;
  334. int hw_disk_status;
  335. char *transport_parm;
  336. char *protocol_parm;
  337. unsigned short vendor;
  338. unsigned short product;
  339. unsigned short release;
  340. char serial[12];
  341. unsigned int buflen;
  342. int transport_type;
  343. char *transport_name;
  344. int protocol_type;
  345. char *protocol_name;
  346. } mod_data = { // Default values
  347. .transport_parm = "BBB",
  348. .protocol_parm = "SCSI",
  349. .removable = 0,
  350. .can_stall = 1,
  351. .vendor = DRIVER_VENDOR_ID,
  352. .product = DRIVER_PRODUCT_ID,
  353. .release = 0xffff, // Use controller chip type
  354. .buflen = 16384,
  355. .serial = "CYBOR10",
  356. };
  357. #undef S_IRUGO
  358. #define S_IRUGO (0644)
  359. module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
  360. S_IRUGO);
  361. MODULE_PARM_DESC(file, "names of backing files or devices");
  362. module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
  363. MODULE_PARM_DESC(ro, "true to force read-only");
  364. module_param_array_named(status, mod_data.status, int, &mod_data.num_status, S_IRUGO);
  365. MODULE_PARM_DESC(status, "get lun(s) status");
  366. module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
  367. MODULE_PARM_DESC(luns, "number of LUNs");
  368. module_param_named(removable, mod_data.removable, bool, S_IRUGO);
  369. MODULE_PARM_DESC(removable, "true to simulate removable media");
  370. module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
  371. MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
  372. module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
  373. MODULE_PARM_DESC(vendor, "USB Vendor ID");
  374. module_param_named(product, mod_data.product, ushort, S_IRUGO);
  375. MODULE_PARM_DESC(product, "USB Product ID");
  376. module_param_named(serial, mod_data.serial, charp, S_IRUGO);
  377. MODULE_PARM_DESC(serial, "Device serial number");
  378. /* In the non-TEST version, only the module parameters listed above
  379. * are available. */
  380. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  381. module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
  382. MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
  383. module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
  384. MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
  385. "8070, or SCSI)");
  386. module_param_named(release, mod_data.release, ushort, S_IRUGO);
  387. MODULE_PARM_DESC(release, "USB release number");
  388. module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
  389. MODULE_PARM_DESC(buflen, "I/O buffer size");
  390. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  391. /*-------------------------------------------------------------------------*/
  392. /* USB protocol value = the transport method */
  393. #define USB_PR_CBI 0x00 // Control/Bulk/Interrupt
  394. #define USB_PR_CB 0x01 // Control/Bulk w/o interrupt
  395. #define USB_PR_BULK 0x50 // Bulk-only
  396. /* USB subclass value = the protocol encapsulation */
  397. #define USB_SC_RBC 0x01 // Reduced Block Commands (flash)
  398. #define USB_SC_8020 0x02 // SFF-8020i, MMC-2, ATAPI (CD-ROM)
  399. #define USB_SC_QIC 0x03 // QIC-157 (tape)
  400. #define USB_SC_UFI 0x04 // UFI (floppy)
  401. #define USB_SC_8070 0x05 // SFF-8070i (removable)
  402. #define USB_SC_SCSI 0x06 // Transparent SCSI
  403. /* Bulk-only data structures */
  404. /* Command Block Wrapper */
  405. struct bulk_cb_wrap {
  406. __le32 Signature; // Contains 'USBC'
  407. u32 Tag; // Unique per command id
  408. __le32 DataTransferLength; // Size of the data
  409. u8 Flags; // Direction in bit 7
  410. u8 Lun; // LUN (normally 0)
  411. u8 Length; // Of the CDB, <= MAX_COMMAND_SIZE
  412. u8 CDB[16]; // Command Data Block
  413. };
  414. #define USB_BULK_CB_WRAP_LEN 31
  415. #define USB_BULK_CB_SIG 0x43425355 // Spells out USBC
  416. #define USB_BULK_IN_FLAG 0x80
  417. /* Command Status Wrapper */
  418. struct bulk_cs_wrap {
  419. __le32 Signature; // Should = 'USBS'
  420. u32 Tag; // Same as original command
  421. __le32 Residue; // Amount not transferred
  422. u8 Status; // See below
  423. };
  424. #define USB_BULK_CS_WRAP_LEN 13
  425. #define USB_BULK_CS_SIG 0x53425355 // Spells out 'USBS'
  426. #define USB_STATUS_PASS 0
  427. #define USB_STATUS_FAIL 1
  428. #define USB_STATUS_PHASE_ERROR 2
  429. /* Bulk-only class specific requests */
  430. #define USB_BULK_RESET_REQUEST 0xff
  431. #define USB_BULK_GET_MAX_LUN_REQUEST 0xfe
  432. /* CBI Interrupt data structure */
  433. struct interrupt_data {
  434. u8 bType;
  435. u8 bValue;
  436. };
  437. #define CBI_INTERRUPT_DATA_LEN 2
  438. /* CBI Accept Device-Specific Command request */
  439. #define USB_CBI_ADSC_REQUEST 0x00
  440. #define MAX_COMMAND_SIZE 16 // Length of a SCSI Command Data Block
  441. /* SCSI commands that we recognize */
  442. #define SC_FORMAT_UNIT 0x04
  443. #define SC_INQUIRY 0x12
  444. #define SC_MODE_SELECT_6 0x15
  445. #define SC_MODE_SELECT_10 0x55
  446. #define SC_MODE_SENSE_6 0x1a
  447. #define SC_MODE_SENSE_10 0x5a
  448. #define SC_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
  449. #define SC_READ_6 0x08
  450. #define SC_READ_10 0x28
  451. #define SC_READ_12 0xa8
  452. #define SC_READ_CAPACITY 0x25
  453. #define SC_READ_FORMAT_CAPACITIES 0x23
  454. #define SC_RELEASE 0x17
  455. #define SC_REQUEST_SENSE 0x03
  456. #define SC_RESERVE 0x16
  457. #define SC_SEND_DIAGNOSTIC 0x1d
  458. #define SC_START_STOP_UNIT 0x1b
  459. #define SC_SYNCHRONIZE_CACHE 0x35
  460. #define SC_TEST_UNIT_READY 0x00
  461. #define SC_VERIFY 0x2f
  462. #define SC_WRITE_6 0x0a
  463. #define SC_WRITE_10 0x2a
  464. #define SC_WRITE_12 0xaa
  465. /* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
  466. #define SS_NO_SENSE 0
  467. #define SS_COMMUNICATION_FAILURE 0x040800
  468. #define SS_INVALID_COMMAND 0x052000
  469. #define SS_INVALID_FIELD_IN_CDB 0x052400
  470. #define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE 0x052100
  471. #define SS_LOGICAL_UNIT_NOT_SUPPORTED 0x052500
  472. #define SS_MEDIUM_NOT_PRESENT 0x023a00
  473. #define SS_MEDIUM_REMOVAL_PREVENTED 0x055302
  474. #define SS_NOT_READY_TO_READY_TRANSITION 0x062800
  475. #define SS_RESET_OCCURRED 0x062900
  476. #define SS_SAVING_PARAMETERS_NOT_SUPPORTED 0x053900
  477. #define SS_UNRECOVERED_READ_ERROR 0x031100
  478. #define SS_WRITE_ERROR 0x030c02
  479. #define SS_WRITE_PROTECTED 0x072700
  480. #define SK(x) ((u8) ((x) >> 16)) // Sense Key byte, etc.
  481. #define ASC(x) ((u8) ((x) >> 8))
  482. #define ASCQ(x) ((u8) (x))
  483. /*-------------------------------------------------------------------------*/
  484. /*
  485. * These definitions will permit the compiler to avoid generating code for
  486. * parts of the driver that aren't used in the non-TEST version. Even gcc
  487. * can recognize when a test of a constant expression yields a dead code
  488. * path.
  489. */
  490. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  491. #define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
  492. #define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
  493. #define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
  494. #else
  495. #define transport_is_bbb() 1
  496. #define transport_is_cbi() 0
  497. #define protocol_is_scsi() 1
  498. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  499. struct lun {
  500. u8 id;
  501. struct file *filp;
  502. loff_t file_length;
  503. loff_t num_sectors;
  504. unsigned int ro : 1;
  505. unsigned int prevent_medium_removal : 1;
  506. unsigned int registered : 1;
  507. unsigned int info_valid : 1;
  508. unsigned int status : 1;
  509. u32 sense_data;
  510. u32 sense_data_info;
  511. u32 unit_attention_data;
  512. struct device dev;
  513. };
  514. #define backing_file_is_open(curlun) ((curlun)->filp != NULL)
  515. static inline struct lun *dev_to_lun(struct device *dev)
  516. {
  517. return container_of(dev, struct lun, dev);
  518. }
  519. /* Big enough to hold our biggest descriptor */
  520. #define EP0_BUFSIZE 256
  521. #define DELAYED_STATUS (EP0_BUFSIZE + 999) // An impossibly large value
  522. /* Number of buffers we will use. 2 is enough for double-buffering */
  523. #define NUM_BUFFERS 2
  524. enum fsg_buffer_state {
  525. BUF_STATE_EMPTY = 0,
  526. BUF_STATE_FULL,
  527. BUF_STATE_BUSY
  528. };
  529. struct fsg_buffhd {
  530. void *buf;
  531. dma_addr_t dma;
  532. enum fsg_buffer_state state;
  533. struct fsg_buffhd *next;
  534. /* The NetChip 2280 is faster, and handles some protocol faults
  535. * better, if we don't submit any short bulk-out read requests.
  536. * So we will record the intended request length here. */
  537. unsigned int bulk_out_intended_length;
  538. struct usb_request *inreq;
  539. int inreq_busy;
  540. struct usb_request *outreq;
  541. int outreq_busy;
  542. };
  543. enum fsg_state {
  544. FSG_STATE_COMMAND_PHASE = -10, // This one isn't used anywhere
  545. FSG_STATE_DATA_PHASE,
  546. FSG_STATE_STATUS_PHASE,
  547. FSG_STATE_IDLE = 0,
  548. FSG_STATE_ABORT_BULK_OUT,
  549. FSG_STATE_RESET,
  550. FSG_STATE_INTERFACE_CHANGE,
  551. FSG_STATE_CONFIG_CHANGE,
  552. FSG_STATE_DISCONNECT,
  553. FSG_STATE_EXIT,
  554. FSG_STATE_TERMINATED
  555. };
  556. enum data_direction {
  557. DATA_DIR_UNKNOWN = 0,
  558. DATA_DIR_FROM_HOST,
  559. DATA_DIR_TO_HOST,
  560. DATA_DIR_NONE
  561. };
  562. struct fsg_dev {
  563. /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
  564. spinlock_t lock;
  565. struct usb_gadget *gadget;
  566. /* filesem protects: backing files in use */
  567. struct rw_semaphore filesem;
  568. /* reference counting: wait until all LUNs are released */
  569. struct kref ref;
  570. struct usb_ep *ep0; // Handy copy of gadget->ep0
  571. struct usb_request *ep0req; // For control responses
  572. unsigned int ep0_req_tag;
  573. const char *ep0req_name;
  574. struct usb_request *intreq; // For interrupt responses
  575. int intreq_busy;
  576. struct fsg_buffhd *intr_buffhd;
  577. unsigned int bulk_out_maxpacket;
  578. enum fsg_state state; // For exception handling
  579. unsigned int exception_req_tag;
  580. u8 config, new_config;
  581. unsigned int running : 1;
  582. unsigned int bulk_in_enabled : 1;
  583. unsigned int bulk_out_enabled : 1;
  584. unsigned int intr_in_enabled : 1;
  585. unsigned int phase_error : 1;
  586. unsigned int short_packet_received : 1;
  587. unsigned int bad_lun_okay : 1;
  588. unsigned long atomic_bitflags;
  589. #define REGISTERED 0
  590. #define CLEAR_BULK_HALTS 1
  591. #define SUSPENDED 2
  592. struct usb_ep *bulk_in;
  593. struct usb_ep *bulk_out;
  594. struct usb_ep *intr_in;
  595. struct fsg_buffhd *next_buffhd_to_fill;
  596. struct fsg_buffhd *next_buffhd_to_drain;
  597. struct fsg_buffhd buffhds[NUM_BUFFERS];
  598. int thread_wakeup_needed;
  599. struct completion thread_notifier;
  600. struct task_struct *thread_task;
  601. sigset_t thread_signal_mask;
  602. int cmnd_size;
  603. u8 cmnd[MAX_COMMAND_SIZE];
  604. enum data_direction data_dir;
  605. u32 data_size;
  606. u32 data_size_from_cmnd;
  607. u32 tag;
  608. unsigned int lun;
  609. u32 residue;
  610. u32 usb_amount_left;
  611. /* The CB protocol offers no way for a host to know when a command
  612. * has completed. As a result the next command may arrive early,
  613. * and we will still have to handle it. For that reason we need
  614. * a buffer to store new commands when using CB (or CBI, which
  615. * does not oblige a host to wait for command completion either). */
  616. int cbbuf_cmnd_size;
  617. u8 cbbuf_cmnd[MAX_COMMAND_SIZE];
  618. unsigned int nluns;
  619. struct lun *luns;
  620. struct lun *curlun;
  621. };
  622. typedef void (*fsg_routine_t)(struct fsg_dev *);
  623. static int inline exception_in_progress(struct fsg_dev *fsg)
  624. {
  625. return (fsg->state > FSG_STATE_IDLE);
  626. }
  627. /* Make bulk-out requests be divisible by the maxpacket size */
  628. static void inline set_bulk_out_req_length(struct fsg_dev *fsg,
  629. struct fsg_buffhd *bh, unsigned int length)
  630. {
  631. unsigned int rem;
  632. bh->bulk_out_intended_length = length;
  633. rem = length % fsg->bulk_out_maxpacket;
  634. if (rem > 0)
  635. length += fsg->bulk_out_maxpacket - rem;
  636. bh->outreq->length = length;
  637. }
  638. static struct fsg_dev *the_fsg;
  639. static struct usb_gadget_driver fsg_driver;
  640. static void close_backing_file(struct lun *curlun);
  641. static void close_all_backing_files(struct fsg_dev *fsg);
  642. /*-------------------------------------------------------------------------*/
  643. #ifdef DUMP_MSGS
  644. static void dump_msg(struct fsg_dev *fsg, const char *label,
  645. const u8 *buf, unsigned int length)
  646. {
  647. unsigned int start, num, i;
  648. char line[52], *p;
  649. if (length >= 512)
  650. return;
  651. DBG(fsg, "%s, length %u:\n", label, length);
  652. start = 0;
  653. while (length > 0) {
  654. num = min(length, 16u);
  655. p = line;
  656. for (i = 0; i < num; ++i) {
  657. if (i == 8)
  658. *p++ = ' ';
  659. sprintf(p, " %02x", buf[i]);
  660. p += 3;
  661. }
  662. *p = 0;
  663. printk(KERN_DEBUG "%6x: %s\n", start, line);
  664. buf += num;
  665. start += num;
  666. length -= num;
  667. }
  668. }
  669. static void inline dump_cdb(struct fsg_dev *fsg)
  670. {}
  671. #else
  672. static void inline dump_msg(struct fsg_dev *fsg, const char *label,
  673. const u8 *buf, unsigned int length)
  674. {}
  675. static void inline dump_cdb(struct fsg_dev *fsg)
  676. {
  677. int i;
  678. char cmdbuf[3*MAX_COMMAND_SIZE + 1];
  679. for (i = 0; i < fsg->cmnd_size; ++i)
  680. sprintf(cmdbuf + i*3, " %02x", fsg->cmnd[i]);
  681. VDBG(fsg, "SCSI CDB: %s\n", cmdbuf);
  682. }
  683. #endif /* DUMP_MSGS */
  684. static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
  685. {
  686. const char *name;
  687. if (ep == fsg->bulk_in)
  688. name = "bulk-in";
  689. else if (ep == fsg->bulk_out)
  690. name = "bulk-out";
  691. else
  692. name = ep->name;
  693. DBG(fsg, "%s set halt\n", name);
  694. return usb_ep_set_halt(ep);
  695. }
  696. /*-------------------------------------------------------------------------*/
  697. /* Routines for unaligned data access */
  698. static u16 inline get_be16(u8 *buf)
  699. {
  700. return ((u16) buf[0] << 8) | ((u16) buf[1]);
  701. }
  702. static u32 inline get_be32(u8 *buf)
  703. {
  704. return ((u32) buf[0] << 24) | ((u32) buf[1] << 16) |
  705. ((u32) buf[2] << 8) | ((u32) buf[3]);
  706. }
  707. static void inline put_be16(u8 *buf, u16 val)
  708. {
  709. buf[0] = val >> 8;
  710. buf[1] = val;
  711. }
  712. static void inline put_be32(u8 *buf, u32 val)
  713. {
  714. buf[0] = val >> 24;
  715. buf[1] = val >> 16;
  716. buf[2] = val >> 8;
  717. buf[3] = val & 0xff;
  718. }
  719. /*-------------------------------------------------------------------------*/
  720. /*
  721. * DESCRIPTORS ... most are static, but strings and (full) configuration
  722. * descriptors are built on demand. Also the (static) config and interface
  723. * descriptors are adjusted during fsg_bind().
  724. */
  725. #define STRING_MANUFACTURER 1
  726. #define STRING_PRODUCT 2
  727. #define STRING_SERIAL 3
  728. #define STRING_CONFIG 4
  729. #define STRING_INTERFACE 5
  730. /* There is only one configuration. */
  731. #define CONFIG_VALUE 1
  732. static struct usb_device_descriptor
  733. device_desc = {
  734. .bLength = sizeof device_desc,
  735. .bDescriptorType = USB_DT_DEVICE,
  736. .bcdUSB = __constant_cpu_to_le16(0x0200),
  737. .bDeviceClass = USB_CLASS_PER_INTERFACE,
  738. /* The next three values can be overridden by module parameters */
  739. .idVendor = __constant_cpu_to_le16(DRIVER_VENDOR_ID),
  740. .idProduct = __constant_cpu_to_le16(DRIVER_PRODUCT_ID),
  741. .bcdDevice = __constant_cpu_to_le16(0xffff),
  742. .iManufacturer = STRING_MANUFACTURER,
  743. .iProduct = STRING_PRODUCT,
  744. .iSerialNumber = STRING_SERIAL,
  745. .bNumConfigurations = 1,
  746. };
  747. static struct usb_config_descriptor
  748. config_desc = {
  749. .bLength = sizeof config_desc,
  750. .bDescriptorType = USB_DT_CONFIG,
  751. /* wTotalLength computed by usb_gadget_config_buf() */
  752. .bNumInterfaces = 1,
  753. .bConfigurationValue = CONFIG_VALUE,
  754. .iConfiguration = STRING_CONFIG,
  755. .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
  756. .bMaxPower = 1, // self-powered
  757. };
  758. static struct usb_otg_descriptor
  759. otg_desc = {
  760. .bLength = sizeof(otg_desc),
  761. .bDescriptorType = USB_DT_OTG,
  762. .bmAttributes = USB_OTG_SRP,
  763. };
  764. /* There is only one interface. */
  765. static struct usb_interface_descriptor
  766. intf_desc = {
  767. .bLength = sizeof intf_desc,
  768. .bDescriptorType = USB_DT_INTERFACE,
  769. .bNumEndpoints = 2, // Adjusted during fsg_bind()
  770. .bInterfaceClass = USB_CLASS_MASS_STORAGE,
  771. .bInterfaceSubClass = USB_SC_SCSI, // Adjusted during fsg_bind()
  772. .bInterfaceProtocol = USB_PR_BULK, // Adjusted during fsg_bind()
  773. .iInterface = STRING_INTERFACE,
  774. };
  775. /* Three full-speed endpoint descriptors: bulk-in, bulk-out,
  776. * and interrupt-in. */
  777. static struct usb_endpoint_descriptor
  778. fs_bulk_in_desc = {
  779. .bLength = USB_DT_ENDPOINT_SIZE,
  780. .bDescriptorType = USB_DT_ENDPOINT,
  781. .bEndpointAddress = USB_DIR_IN,
  782. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  783. /* wMaxPacketSize set by autoconfiguration */
  784. };
  785. static struct usb_endpoint_descriptor
  786. fs_bulk_out_desc = {
  787. .bLength = USB_DT_ENDPOINT_SIZE,
  788. .bDescriptorType = USB_DT_ENDPOINT,
  789. .bEndpointAddress = USB_DIR_OUT,
  790. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  791. /* wMaxPacketSize set by autoconfiguration */
  792. };
  793. static struct usb_endpoint_descriptor
  794. fs_intr_in_desc = {
  795. .bLength = USB_DT_ENDPOINT_SIZE,
  796. .bDescriptorType = USB_DT_ENDPOINT,
  797. .bEndpointAddress = USB_DIR_IN,
  798. .bmAttributes = USB_ENDPOINT_XFER_INT,
  799. .wMaxPacketSize = __constant_cpu_to_le16(2),
  800. .bInterval = 32, // frames -> 32 ms
  801. };
  802. static const struct usb_descriptor_header *fs_function[] = {
  803. (struct usb_descriptor_header *) &otg_desc,
  804. (struct usb_descriptor_header *) &intf_desc,
  805. (struct usb_descriptor_header *) &fs_bulk_in_desc,
  806. (struct usb_descriptor_header *) &fs_bulk_out_desc,
  807. (struct usb_descriptor_header *) &fs_intr_in_desc,
  808. NULL,
  809. };
  810. #define FS_FUNCTION_PRE_EP_ENTRIES 2
  811. #ifdef CONFIG_USB_GADGET_DUALSPEED
  812. /*
  813. * USB 2.0 devices need to expose both high speed and full speed
  814. * descriptors, unless they only run at full speed.
  815. *
  816. * That means alternate endpoint descriptors (bigger packets)
  817. * and a "device qualifier" ... plus more construction options
  818. * for the config descriptor.
  819. */
  820. static struct usb_qualifier_descriptor
  821. dev_qualifier = {
  822. .bLength = sizeof dev_qualifier,
  823. .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
  824. .bcdUSB = __constant_cpu_to_le16(0x0200),
  825. .bDeviceClass = USB_CLASS_PER_INTERFACE,
  826. .bNumConfigurations = 1,
  827. };
  828. static struct usb_endpoint_descriptor
  829. hs_bulk_in_desc = {
  830. .bLength = USB_DT_ENDPOINT_SIZE,
  831. .bDescriptorType = USB_DT_ENDPOINT,
  832. /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
  833. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  834. .wMaxPacketSize = __constant_cpu_to_le16(512),
  835. };
  836. static struct usb_endpoint_descriptor
  837. hs_bulk_out_desc = {
  838. .bLength = USB_DT_ENDPOINT_SIZE,
  839. .bDescriptorType = USB_DT_ENDPOINT,
  840. /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
  841. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  842. .wMaxPacketSize = __constant_cpu_to_le16(512),
  843. .bInterval = 1, // NAK every 1 uframe
  844. };
  845. static struct usb_endpoint_descriptor
  846. hs_intr_in_desc = {
  847. .bLength = USB_DT_ENDPOINT_SIZE,
  848. .bDescriptorType = USB_DT_ENDPOINT,
  849. /* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
  850. .bmAttributes = USB_ENDPOINT_XFER_INT,
  851. .wMaxPacketSize = __constant_cpu_to_le16(2),
  852. .bInterval = 9, // 2**(9-1) = 256 uframes -> 32 ms
  853. };
  854. static const struct usb_descriptor_header *hs_function[] = {
  855. (struct usb_descriptor_header *) &otg_desc,
  856. (struct usb_descriptor_header *) &intf_desc,
  857. (struct usb_descriptor_header *) &hs_bulk_in_desc,
  858. (struct usb_descriptor_header *) &hs_bulk_out_desc,
  859. (struct usb_descriptor_header *) &hs_intr_in_desc,
  860. NULL,
  861. };
  862. #define HS_FUNCTION_PRE_EP_ENTRIES 2
  863. /* Maxpacket and other transfer characteristics vary by speed. */
  864. #define ep_desc(g,fs,hs) (((g)->speed==USB_SPEED_HIGH) ? (hs) : (fs))
  865. #else
  866. /* If there's no high speed support, always use the full-speed descriptor. */
  867. #define ep_desc(g,fs,hs) fs
  868. #endif /* !CONFIG_USB_GADGET_DUALSPEED */
  869. /* The CBI specification limits the serial string to 12 uppercase hexadecimal
  870. * characters. */
  871. static char manufacturer[64];
  872. static char serial[13];
  873. /* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
  874. static struct usb_string strings[] = {
  875. {STRING_MANUFACTURER, manufacturer},
  876. {STRING_PRODUCT, longname},
  877. {STRING_SERIAL, serial},
  878. {STRING_CONFIG, "Self-powered"},
  879. {STRING_INTERFACE, "Mass Storage"},
  880. {}
  881. };
  882. static struct usb_gadget_strings stringtab = {
  883. .language = 0x0409, // en-us
  884. .strings = strings,
  885. };
  886. /*
  887. * Config descriptors must agree with the code that sets configurations
  888. * and with code managing interfaces and their altsettings. They must
  889. * also handle different speeds and other-speed requests.
  890. */
  891. static int populate_config_buf(struct usb_gadget *gadget,
  892. u8 *buf, u8 type, unsigned index)
  893. {
  894. #ifdef CONFIG_USB_GADGET_DUALSPEED
  895. enum usb_device_speed speed = gadget->speed;
  896. #endif
  897. int len;
  898. const struct usb_descriptor_header **function;
  899. if (index > 0)
  900. return -EINVAL;
  901. #ifdef CONFIG_USB_GADGET_DUALSPEED
  902. if (type == USB_DT_OTHER_SPEED_CONFIG)
  903. speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
  904. if (speed == USB_SPEED_HIGH)
  905. function = hs_function;
  906. else
  907. #endif
  908. function = fs_function;
  909. /* for now, don't advertise srp-only devices */
  910. if (!gadget->is_otg)
  911. function++;
  912. len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
  913. ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
  914. return len;
  915. }
  916. /*-------------------------------------------------------------------------*/
  917. /* These routines may be called in process context or in_irq */
  918. /* Caller must hold fsg->lock */
  919. static void wakeup_thread(struct fsg_dev *fsg)
  920. {
  921. /* Tell the main thread that something has happened */
  922. fsg->thread_wakeup_needed = 1;
  923. if (fsg->thread_task)
  924. wake_up_process(fsg->thread_task);
  925. }
  926. static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
  927. {
  928. unsigned long flags;
  929. /* Do nothing if a higher-priority exception is already in progress.
  930. * If a lower-or-equal priority exception is in progress, preempt it
  931. * and notify the main thread by sending it a signal. */
  932. spin_lock_irqsave(&fsg->lock, flags);
  933. if (fsg->state <= new_state) {
  934. fsg->exception_req_tag = fsg->ep0_req_tag;
  935. fsg->state = new_state;
  936. if (fsg->thread_task)
  937. send_sig_info(SIGUSR1, SEND_SIG_FORCED,
  938. fsg->thread_task);
  939. }
  940. spin_unlock_irqrestore(&fsg->lock, flags);
  941. }
  942. /*-------------------------------------------------------------------------*/
  943. /* The disconnect callback and ep0 routines. These always run in_irq,
  944. * except that ep0_queue() is called in the main thread to acknowledge
  945. * completion of various requests: set config, set interface, and
  946. * Bulk-only device reset. */
  947. static void fsg_disconnect(struct usb_gadget *gadget)
  948. {
  949. struct fsg_dev *fsg = get_gadget_data(gadget);
  950. DBG(fsg, "disconnect or port reset\n");
  951. raise_exception(fsg, FSG_STATE_DISCONNECT);
  952. }
  953. static int ep0_queue(struct fsg_dev *fsg)
  954. {
  955. int rc;
  956. rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
  957. if (rc != 0 && rc != -ESHUTDOWN) {
  958. /* We can't do much more than wait for a reset */
  959. WARN(fsg, "error in submission: %s --> %d\n",
  960. fsg->ep0->name, rc);
  961. }
  962. return rc;
  963. }
  964. static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
  965. {
  966. struct fsg_dev *fsg = ep->driver_data;
  967. if (req->actual > 0)
  968. dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
  969. if (req->status || req->actual != req->length)
  970. DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
  971. req->status, req->actual, req->length);
  972. if (req->status == -ECONNRESET) // Request was cancelled
  973. usb_ep_fifo_flush(ep);
  974. if (req->status == 0 && req->context)
  975. ((fsg_routine_t) (req->context))(fsg);
  976. }
  977. /*-------------------------------------------------------------------------*/
  978. /* Bulk and interrupt endpoint completion handlers.
  979. * These always run in_irq. */
  980. static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
  981. {
  982. struct fsg_dev *fsg = ep->driver_data;
  983. struct fsg_buffhd *bh = req->context;
  984. if (req->status || req->actual != req->length)
  985. DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
  986. req->status, req->actual, req->length);
  987. if (req->status == -ECONNRESET) // Request was cancelled
  988. usb_ep_fifo_flush(ep);
  989. /* Hold the lock while we update the request and buffer states */
  990. smp_wmb();
  991. spin_lock(&fsg->lock);
  992. bh->inreq_busy = 0;
  993. bh->state = BUF_STATE_EMPTY;
  994. wakeup_thread(fsg);
  995. spin_unlock(&fsg->lock);
  996. }
  997. static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
  998. {
  999. struct fsg_dev *fsg = ep->driver_data;
  1000. struct fsg_buffhd *bh = req->context;
  1001. dump_msg(fsg, "bulk-out", req->buf, req->actual);
  1002. if (req->status || req->actual != bh->bulk_out_intended_length)
  1003. DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
  1004. req->status, req->actual,
  1005. bh->bulk_out_intended_length);
  1006. if (req->status == -ECONNRESET) // Request was cancelled
  1007. usb_ep_fifo_flush(ep);
  1008. /* Hold the lock while we update the request and buffer states */
  1009. smp_wmb();
  1010. spin_lock(&fsg->lock);
  1011. bh->outreq_busy = 0;
  1012. bh->state = BUF_STATE_FULL;
  1013. wakeup_thread(fsg);
  1014. spin_unlock(&fsg->lock);
  1015. }
  1016. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  1017. static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
  1018. {
  1019. struct fsg_dev *fsg = ep->driver_data;
  1020. struct fsg_buffhd *bh = req->context;
  1021. if (req->status || req->actual != req->length)
  1022. DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
  1023. req->status, req->actual, req->length);
  1024. if (req->status == -ECONNRESET) // Request was cancelled
  1025. usb_ep_fifo_flush(ep);
  1026. /* Hold the lock while we update the request and buffer states */
  1027. smp_wmb();
  1028. spin_lock(&fsg->lock);
  1029. fsg->intreq_busy = 0;
  1030. bh->state = BUF_STATE_EMPTY;
  1031. wakeup_thread(fsg);
  1032. spin_unlock(&fsg->lock);
  1033. }
  1034. #else
  1035. static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
  1036. {}
  1037. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  1038. /*-------------------------------------------------------------------------*/
  1039. /* Ep0 class-specific handlers. These always run in_irq. */
  1040. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  1041. static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1042. {
  1043. struct usb_request *req = fsg->ep0req;
  1044. static u8 cbi_reset_cmnd[6] = {
  1045. SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
  1046. /* Error in command transfer? */
  1047. if (req->status || req->length != req->actual ||
  1048. req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
  1049. /* Not all controllers allow a protocol stall after
  1050. * receiving control-out data, but we'll try anyway. */
  1051. fsg_set_halt(fsg, fsg->ep0);
  1052. return; // Wait for reset
  1053. }
  1054. /* Is it the special reset command? */
  1055. if (req->actual >= sizeof cbi_reset_cmnd &&
  1056. memcmp(req->buf, cbi_reset_cmnd,
  1057. sizeof cbi_reset_cmnd) == 0) {
  1058. /* Raise an exception to stop the current operation
  1059. * and reinitialize our state. */
  1060. DBG(fsg, "cbi reset request\n");
  1061. raise_exception(fsg, FSG_STATE_RESET);
  1062. return;
  1063. }
  1064. VDBG(fsg, "CB[I] accept device-specific command\n");
  1065. spin_lock(&fsg->lock);
  1066. /* Save the command for later */
  1067. if (fsg->cbbuf_cmnd_size)
  1068. WARN(fsg, "CB[I] overwriting previous command\n");
  1069. fsg->cbbuf_cmnd_size = req->actual;
  1070. memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
  1071. wakeup_thread(fsg);
  1072. spin_unlock(&fsg->lock);
  1073. }
  1074. #else
  1075. static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1076. {}
  1077. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  1078. static int class_setup_req(struct fsg_dev *fsg,
  1079. const struct usb_ctrlrequest *ctrl)
  1080. {
  1081. struct usb_request *req = fsg->ep0req;
  1082. int value = -EOPNOTSUPP;
  1083. u16 w_index = le16_to_cpu(ctrl->wIndex);
  1084. u16 w_length = le16_to_cpu(ctrl->wLength);
  1085. if (!fsg->config)
  1086. return value;
  1087. /* Handle Bulk-only class-specific requests */
  1088. if (transport_is_bbb()) {
  1089. switch (ctrl->bRequest) {
  1090. case USB_BULK_RESET_REQUEST:
  1091. if (ctrl->bRequestType != (USB_DIR_OUT |
  1092. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1093. break;
  1094. if (w_index != 0) {
  1095. value = -EDOM;
  1096. break;
  1097. }
  1098. /* Raise an exception to stop the current operation
  1099. * and reinitialize our state. */
  1100. DBG(fsg, "bulk reset request\n");
  1101. raise_exception(fsg, FSG_STATE_RESET);
  1102. value = DELAYED_STATUS;
  1103. break;
  1104. case USB_BULK_GET_MAX_LUN_REQUEST:
  1105. if (ctrl->bRequestType != (USB_DIR_IN |
  1106. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1107. break;
  1108. if (w_index != 0) {
  1109. value = -EDOM;
  1110. break;
  1111. }
  1112. VDBG(fsg, "get max LUN\n");
  1113. *(u8 *) req->buf = fsg->nluns - 1;
  1114. value = 1;
  1115. break;
  1116. }
  1117. }
  1118. /* Handle CBI class-specific requests */
  1119. else {
  1120. switch (ctrl->bRequest) {
  1121. case USB_CBI_ADSC_REQUEST:
  1122. if (ctrl->bRequestType != (USB_DIR_OUT |
  1123. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1124. break;
  1125. if (w_index != 0) {
  1126. value = -EDOM;
  1127. break;
  1128. }
  1129. if (w_length > MAX_COMMAND_SIZE) {
  1130. value = -EOVERFLOW;
  1131. break;
  1132. }
  1133. value = w_length;
  1134. fsg->ep0req->context = received_cbi_adsc;
  1135. break;
  1136. }
  1137. }
  1138. if (value == -EOPNOTSUPP)
  1139. VDBG(fsg,
  1140. "unknown class-specific control req "
  1141. "%02x.%02x v%04x i%04x l%u\n",
  1142. ctrl->bRequestType, ctrl->bRequest,
  1143. le16_to_cpu(ctrl->wValue), w_index, w_length);
  1144. return value;
  1145. }
  1146. /*-------------------------------------------------------------------------*/
  1147. /* Ep0 standard request handlers. These always run in_irq. */
  1148. static int standard_setup_req(struct fsg_dev *fsg,
  1149. const struct usb_ctrlrequest *ctrl)
  1150. {
  1151. struct usb_request *req = fsg->ep0req;
  1152. int value = -EOPNOTSUPP;
  1153. u16 w_index = le16_to_cpu(ctrl->wIndex);
  1154. u16 w_value = le16_to_cpu(ctrl->wValue);
  1155. /* Usually this just stores reply data in the pre-allocated ep0 buffer,
  1156. * but config change events will also reconfigure hardware. */
  1157. switch (ctrl->bRequest) {
  1158. case USB_REQ_GET_DESCRIPTOR:
  1159. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1160. USB_RECIP_DEVICE))
  1161. break;
  1162. switch (w_value >> 8) {
  1163. case USB_DT_DEVICE:
  1164. VDBG(fsg, "get device descriptor\n");
  1165. value = sizeof device_desc;
  1166. memcpy(req->buf, &device_desc, value);
  1167. break;
  1168. #ifdef CONFIG_USB_GADGET_DUALSPEED
  1169. case USB_DT_DEVICE_QUALIFIER:
  1170. VDBG(fsg, "get device qualifier\n");
  1171. if (!fsg->gadget->is_dualspeed)
  1172. break;
  1173. value = sizeof dev_qualifier;
  1174. memcpy(req->buf, &dev_qualifier, value);
  1175. break;
  1176. case USB_DT_OTHER_SPEED_CONFIG:
  1177. VDBG(fsg, "get other-speed config descriptor\n");
  1178. if (!fsg->gadget->is_dualspeed)
  1179. break;
  1180. goto get_config;
  1181. #endif
  1182. case USB_DT_CONFIG:
  1183. VDBG(fsg, "get configuration descriptor\n");
  1184. #ifdef CONFIG_USB_GADGET_DUALSPEED
  1185. get_config:
  1186. #endif
  1187. value = populate_config_buf(fsg->gadget,
  1188. req->buf,
  1189. w_value >> 8,
  1190. w_value & 0xff);
  1191. break;
  1192. case USB_DT_STRING:
  1193. VDBG(fsg, "get string descriptor\n");
  1194. /* wIndex == language code */
  1195. value = usb_gadget_get_string(&stringtab,
  1196. w_value & 0xff, req->buf);
  1197. break;
  1198. }
  1199. break;
  1200. /* One config, two speeds */
  1201. case USB_REQ_SET_CONFIGURATION:
  1202. if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
  1203. USB_RECIP_DEVICE))
  1204. break;
  1205. VDBG(fsg, "set configuration\n");
  1206. if (w_value == CONFIG_VALUE || w_value == 0) {
  1207. fsg->new_config = w_value;
  1208. /* Raise an exception to wipe out previous transaction
  1209. * state (queued bufs, etc) and set the new config. */
  1210. raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
  1211. value = DELAYED_STATUS;
  1212. }
  1213. break;
  1214. case USB_REQ_GET_CONFIGURATION:
  1215. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1216. USB_RECIP_DEVICE))
  1217. break;
  1218. VDBG(fsg, "get configuration\n");
  1219. *(u8 *) req->buf = fsg->config;
  1220. value = 1;
  1221. break;
  1222. case USB_REQ_SET_INTERFACE:
  1223. if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
  1224. USB_RECIP_INTERFACE))
  1225. break;
  1226. if (fsg->config && w_index == 0) {
  1227. /* Raise an exception to wipe out previous transaction
  1228. * state (queued bufs, etc) and install the new
  1229. * interface altsetting. */
  1230. raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
  1231. value = DELAYED_STATUS;
  1232. }
  1233. break;
  1234. case USB_REQ_GET_INTERFACE:
  1235. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1236. USB_RECIP_INTERFACE))
  1237. break;
  1238. if (!fsg->config)
  1239. break;
  1240. if (w_index != 0) {
  1241. value = -EDOM;
  1242. break;
  1243. }
  1244. VDBG(fsg, "get interface\n");
  1245. *(u8 *) req->buf = 0;
  1246. value = 1;
  1247. break;
  1248. default:
  1249. VDBG(fsg,
  1250. "unknown control req %02x.%02x v%04x i%04x l%u\n",
  1251. ctrl->bRequestType, ctrl->bRequest,
  1252. w_value, w_index, le16_to_cpu(ctrl->wLength));
  1253. }
  1254. return value;
  1255. }
  1256. static int fsg_setup(struct usb_gadget *gadget,
  1257. const struct usb_ctrlrequest *ctrl)
  1258. {
  1259. struct fsg_dev *fsg = get_gadget_data(gadget);
  1260. int rc;
  1261. int w_length = le16_to_cpu(ctrl->wLength);
  1262. ++fsg->ep0_req_tag; // Record arrival of a new request
  1263. fsg->ep0req->context = NULL;
  1264. fsg->ep0req->length = 0;
  1265. dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
  1266. if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
  1267. rc = class_setup_req(fsg, ctrl);
  1268. else
  1269. rc = standard_setup_req(fsg, ctrl);
  1270. /* Respond with data/status or defer until later? */
  1271. if (rc >= 0 && rc != DELAYED_STATUS) {
  1272. rc = min(rc, w_length);
  1273. fsg->ep0req->length = rc;
  1274. fsg->ep0req->zero = rc < w_length;
  1275. fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
  1276. "ep0-in" : "ep0-out");
  1277. rc = ep0_queue(fsg);
  1278. }
  1279. /* Device either stalls (rc < 0) or reports success */
  1280. return rc;
  1281. }
  1282. /*-------------------------------------------------------------------------*/
  1283. /* All the following routines run in process context */
  1284. /* Use this for bulk or interrupt transfers, not ep0 */
  1285. static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
  1286. struct usb_request *req, int *pbusy,
  1287. enum fsg_buffer_state *state)
  1288. {
  1289. int rc;
  1290. if (ep == fsg->bulk_in)
  1291. dump_msg(fsg, "bulk-in", req->buf, req->length);
  1292. else if (ep == fsg->intr_in)
  1293. dump_msg(fsg, "intr-in", req->buf, req->length);
  1294. spin_lock_irq(&fsg->lock);
  1295. *pbusy = 1;
  1296. *state = BUF_STATE_BUSY;
  1297. spin_unlock_irq(&fsg->lock);
  1298. rc = usb_ep_queue(ep, req, GFP_KERNEL);
  1299. if (rc != 0) {
  1300. *pbusy = 0;
  1301. *state = BUF_STATE_EMPTY;
  1302. /* We can't do much more than wait for a reset */
  1303. /* Note: currently the net2280 driver fails zero-length
  1304. * submissions if DMA is enabled. */
  1305. if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
  1306. req->length == 0))
  1307. WARN(fsg, "error in submission: %s --> %d\n",
  1308. ep->name, rc);
  1309. }
  1310. }
  1311. static int sleep_thread(struct fsg_dev *fsg)
  1312. {
  1313. int rc = 0;
  1314. /* Wait until a signal arrives or we are woken up */
  1315. for (;;) {
  1316. try_to_freeze();
  1317. set_current_state(TASK_INTERRUPTIBLE);
  1318. if (signal_pending(current)) {
  1319. rc = -EINTR;
  1320. break;
  1321. }
  1322. if (fsg->thread_wakeup_needed)
  1323. break;
  1324. schedule();
  1325. }
  1326. __set_current_state(TASK_RUNNING);
  1327. fsg->thread_wakeup_needed = 0;
  1328. return rc;
  1329. }
  1330. /*-------------------------------------------------------------------------*/
  1331. static int do_read(struct fsg_dev *fsg)
  1332. {
  1333. struct lun *curlun = fsg->curlun;
  1334. u32 lba;
  1335. struct fsg_buffhd *bh;
  1336. int rc;
  1337. u32 amount_left;
  1338. loff_t file_offset, file_offset_tmp;
  1339. unsigned int amount;
  1340. unsigned int partial_page;
  1341. ssize_t nread;
  1342. /* Get the starting Logical Block Address and check that it's
  1343. * not too big */
  1344. if (fsg->cmnd[0] == SC_READ_6)
  1345. lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
  1346. else {
  1347. lba = get_be32(&fsg->cmnd[2]);
  1348. /* We allow DPO (Disable Page Out = don't save data in the
  1349. * cache) and FUA (Force Unit Access = don't read from the
  1350. * cache), but we don't implement them. */
  1351. if ((fsg->cmnd[1] & ~0x18) != 0) {
  1352. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1353. return -EINVAL;
  1354. }
  1355. }
  1356. if (lba >= curlun->num_sectors) {
  1357. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1358. return -EINVAL;
  1359. }
  1360. file_offset = ((loff_t) lba) << 9;
  1361. /* Carry out the file reads */
  1362. amount_left = fsg->data_size_from_cmnd;
  1363. if (unlikely(amount_left == 0))
  1364. return -EIO; // No default reply
  1365. for (;;) {
  1366. /* Figure out how much we need to read:
  1367. * Try to read the remaining amount.
  1368. * But don't read more than the buffer size.
  1369. * And don't try to read past the end of the file.
  1370. * Finally, if we're not at a page boundary, don't read past
  1371. * the next page.
  1372. * If this means reading 0 then we were asked to read past
  1373. * the end of file. */
  1374. amount = min((unsigned int) amount_left, mod_data.buflen);
  1375. amount = min((loff_t) amount,
  1376. curlun->file_length - file_offset);
  1377. partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
  1378. if (partial_page > 0)
  1379. amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
  1380. partial_page);
  1381. /* Wait for the next buffer to become available */
  1382. bh = fsg->next_buffhd_to_fill;
  1383. while (bh->state != BUF_STATE_EMPTY) {
  1384. if ((rc = sleep_thread(fsg)) != 0)
  1385. return rc;
  1386. }
  1387. /* If we were asked to read past the end of file,
  1388. * end with an empty buffer. */
  1389. if (amount == 0) {
  1390. curlun->sense_data =
  1391. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1392. curlun->sense_data_info = file_offset >> 9;
  1393. curlun->info_valid = 1;
  1394. bh->inreq->length = 0;
  1395. bh->state = BUF_STATE_FULL;
  1396. break;
  1397. }
  1398. /* Perform the read */
  1399. file_offset_tmp = file_offset;
  1400. nread = vfs_read(curlun->filp,
  1401. (char __user *) bh->buf,
  1402. amount, &file_offset_tmp);
  1403. VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
  1404. (unsigned long long) file_offset,
  1405. (int) nread);
  1406. if (signal_pending(current))
  1407. return -EINTR;
  1408. if (nread < 0) {
  1409. LDBG(curlun, "error in file read: %d\n",
  1410. (int) nread);
  1411. nread = 0;
  1412. } else if (nread < amount) {
  1413. LDBG(curlun, "partial file read: %d/%u\n",
  1414. (int) nread, amount);
  1415. nread -= (nread & 511); // Round down to a block
  1416. }
  1417. file_offset += nread;
  1418. amount_left -= nread;
  1419. fsg->residue -= nread;
  1420. bh->inreq->length = nread;
  1421. bh->state = BUF_STATE_FULL;
  1422. /* If an error occurred, report it and its position */
  1423. if (nread < amount) {
  1424. curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
  1425. curlun->sense_data_info = file_offset >> 9;
  1426. curlun->info_valid = 1;
  1427. break;
  1428. }
  1429. if (amount_left == 0)
  1430. break; // No more left to read
  1431. /* Send this buffer and go read some more */
  1432. bh->inreq->zero = 0;
  1433. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  1434. &bh->inreq_busy, &bh->state);
  1435. fsg->next_buffhd_to_fill = bh->next;
  1436. }
  1437. return -EIO; // No default reply
  1438. }
  1439. /*-------------------------------------------------------------------------*/
  1440. static int do_write(struct fsg_dev *fsg)
  1441. {
  1442. struct lun *curlun = fsg->curlun;
  1443. u32 lba;
  1444. struct fsg_buffhd *bh;
  1445. int get_some_more;
  1446. u32 amount_left_to_req, amount_left_to_write;
  1447. loff_t usb_offset, file_offset, file_offset_tmp;
  1448. unsigned int amount;
  1449. unsigned int partial_page;
  1450. ssize_t nwritten;
  1451. int rc;
  1452. if (curlun->ro) {
  1453. curlun->sense_data = SS_WRITE_PROTECTED;
  1454. return -EINVAL;
  1455. }
  1456. curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait
  1457. /* Get the starting Logical Block Address and check that it's
  1458. * not too big */
  1459. if (fsg->cmnd[0] == SC_WRITE_6)
  1460. lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
  1461. else {
  1462. lba = get_be32(&fsg->cmnd[2]);
  1463. /* We allow DPO (Disable Page Out = don't save data in the
  1464. * cache) and FUA (Force Unit Access = write directly to the
  1465. * medium). We don't implement DPO; we implement FUA by
  1466. * performing synchronous output. */
  1467. if ((fsg->cmnd[1] & ~0x18) != 0) {
  1468. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1469. return -EINVAL;
  1470. }
  1471. if (fsg->cmnd[1] & 0x08) // FUA
  1472. curlun->filp->f_flags |= O_SYNC;
  1473. }
  1474. if (lba >= curlun->num_sectors) {
  1475. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1476. return -EINVAL;
  1477. }
  1478. /* Carry out the file writes */
  1479. get_some_more = 1;
  1480. file_offset = usb_offset = ((loff_t) lba) << 9;
  1481. amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
  1482. while (amount_left_to_write > 0) {
  1483. /* Queue a request for more data from the host */
  1484. bh = fsg->next_buffhd_to_fill;
  1485. if (bh->state == BUF_STATE_EMPTY && get_some_more) {
  1486. /* Figure out how much we want to get:
  1487. * Try to get the remaining amount.
  1488. * But don't get more than the buffer size.
  1489. * And don't try to go past the end of the file.
  1490. * If we're not at a page boundary,
  1491. * don't go past the next page.
  1492. * If this means getting 0, then we were asked
  1493. * to write past the end of file.
  1494. * Finally, round down to a block boundary. */
  1495. amount = min(amount_left_to_req, mod_data.buflen);
  1496. amount = min((loff_t) amount, curlun->file_length -
  1497. usb_offset);
  1498. partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
  1499. if (partial_page > 0)
  1500. amount = min(amount,
  1501. (unsigned int) PAGE_CACHE_SIZE - partial_page);
  1502. if (amount == 0) {
  1503. get_some_more = 0;
  1504. curlun->sense_data =
  1505. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1506. curlun->sense_data_info = usb_offset >> 9;
  1507. curlun->info_valid = 1;
  1508. continue;
  1509. }
  1510. amount -= (amount & 511);
  1511. if (amount == 0) {
  1512. /* Why were we were asked to transfer a
  1513. * partial block? */
  1514. get_some_more = 0;
  1515. continue;
  1516. }
  1517. /* Get the next buffer */
  1518. usb_offset += amount;
  1519. fsg->usb_amount_left -= amount;
  1520. amount_left_to_req -= amount;
  1521. if (amount_left_to_req == 0)
  1522. get_some_more = 0;
  1523. /* amount is always divisible by 512, hence by
  1524. * the bulk-out maxpacket size */
  1525. bh->outreq->length = bh->bulk_out_intended_length =
  1526. amount;
  1527. bh->outreq->short_not_ok = 1;
  1528. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  1529. &bh->outreq_busy, &bh->state);
  1530. fsg->next_buffhd_to_fill = bh->next;
  1531. continue;
  1532. }
  1533. /* Write the received data to the backing file */
  1534. bh = fsg->next_buffhd_to_drain;
  1535. if (bh->state == BUF_STATE_EMPTY && !get_some_more)
  1536. break; // We stopped early
  1537. if (bh->state == BUF_STATE_FULL) {
  1538. smp_rmb();
  1539. fsg->next_buffhd_to_drain = bh->next;
  1540. bh->state = BUF_STATE_EMPTY;
  1541. /* Did something go wrong with the transfer? */
  1542. if (bh->outreq->status != 0) {
  1543. curlun->sense_data = SS_COMMUNICATION_FAILURE;
  1544. curlun->sense_data_info = file_offset >> 9;
  1545. curlun->info_valid = 1;
  1546. break;
  1547. }
  1548. amount = bh->outreq->actual;
  1549. if (curlun->file_length - file_offset < amount) {
  1550. LERROR(curlun,
  1551. "write %u @ %llu beyond end %llu\n",
  1552. amount, (unsigned long long) file_offset,
  1553. (unsigned long long) curlun->file_length);
  1554. amount = curlun->file_length - file_offset;
  1555. }
  1556. /* Perform the write */
  1557. file_offset_tmp = file_offset;
  1558. nwritten = vfs_write(curlun->filp,
  1559. (char __user *) bh->buf,
  1560. amount, &file_offset_tmp);
  1561. VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
  1562. (unsigned long long) file_offset,
  1563. (int) nwritten);
  1564. if (signal_pending(current))
  1565. return -EINTR; // Interrupted!
  1566. if (nwritten < 0) {
  1567. LDBG(curlun, "error in file write: %d\n",
  1568. (int) nwritten);
  1569. nwritten = 0;
  1570. } else if (nwritten < amount) {
  1571. LDBG(curlun, "partial file write: %d/%u\n",
  1572. (int) nwritten, amount);
  1573. nwritten -= (nwritten & 511);
  1574. // Round down to a block
  1575. }
  1576. file_offset += nwritten;
  1577. amount_left_to_write -= nwritten;
  1578. fsg->residue -= nwritten;
  1579. /* If an error occurred, report it and its position */
  1580. if (nwritten < amount) {
  1581. curlun->sense_data = SS_WRITE_ERROR;
  1582. curlun->sense_data_info = file_offset >> 9;
  1583. curlun->info_valid = 1;
  1584. break;
  1585. }
  1586. /* Did the host decide to stop early? */
  1587. if (bh->outreq->actual != bh->outreq->length) {
  1588. fsg->short_packet_received = 1;
  1589. break;
  1590. }
  1591. continue;
  1592. }
  1593. /* Wait for something to happen */
  1594. if ((rc = sleep_thread(fsg)) != 0)
  1595. return rc;
  1596. }
  1597. return -EIO; // No default reply
  1598. }
  1599. /*-------------------------------------------------------------------------*/
  1600. /* Sync the file data, don't bother with the metadata.
  1601. * This code was copied from fs/buffer.c:sys_fdatasync(). */
  1602. static int fsync_sub(struct lun *curlun)
  1603. {
  1604. struct file *filp = curlun->filp;
  1605. struct inode *inode;
  1606. int rc, err;
  1607. if (curlun->ro || !filp)
  1608. return 0;
  1609. if (!filp->f_op->fsync)
  1610. return -EINVAL;
  1611. inode = filp->f_path.dentry->d_inode;
  1612. mutex_lock(&inode->i_mutex);
  1613. rc = filemap_fdatawrite(inode->i_mapping);
  1614. err = filp->f_op->fsync(filp, filp->f_path.dentry, 1);
  1615. if (!rc)
  1616. rc = err;
  1617. err = filemap_fdatawait(inode->i_mapping);
  1618. if (!rc)
  1619. rc = err;
  1620. mutex_unlock(&inode->i_mutex);
  1621. VLDBG(curlun, "fdatasync -> %d\n", rc);
  1622. return rc;
  1623. }
  1624. static void fsync_all(struct fsg_dev *fsg)
  1625. {
  1626. int i;
  1627. for (i = 0; i < fsg->nluns; ++i)
  1628. fsync_sub(&fsg->luns[i]);
  1629. }
  1630. static int do_synchronize_cache(struct fsg_dev *fsg)
  1631. {
  1632. struct lun *curlun = fsg->curlun;
  1633. int rc;
  1634. /* We ignore the requested LBA and write out all file's
  1635. * dirty data buffers. */
  1636. rc = fsync_sub(curlun);
  1637. if (rc)
  1638. curlun->sense_data = SS_WRITE_ERROR;
  1639. return 0;
  1640. }
  1641. /*-------------------------------------------------------------------------*/
  1642. static void invalidate_sub(struct lun *curlun)
  1643. {
  1644. struct file *filp = curlun->filp;
  1645. struct inode *inode = filp->f_path.dentry->d_inode;
  1646. unsigned long rc;
  1647. rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
  1648. VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
  1649. }
  1650. static int do_verify(struct fsg_dev *fsg)
  1651. {
  1652. struct lun *curlun = fsg->curlun;
  1653. u32 lba;
  1654. u32 verification_length;
  1655. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  1656. loff_t file_offset, file_offset_tmp;
  1657. u32 amount_left;
  1658. unsigned int amount;
  1659. ssize_t nread;
  1660. /* Get the starting Logical Block Address and check that it's
  1661. * not too big */
  1662. lba = get_be32(&fsg->cmnd[2]);
  1663. if (lba >= curlun->num_sectors) {
  1664. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1665. return -EINVAL;
  1666. }
  1667. /* We allow DPO (Disable Page Out = don't save data in the
  1668. * cache) but we don't implement it. */
  1669. if ((fsg->cmnd[1] & ~0x10) != 0) {
  1670. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1671. return -EINVAL;
  1672. }
  1673. verification_length = get_be16(&fsg->cmnd[7]);
  1674. if (unlikely(verification_length == 0))
  1675. return -EIO; // No default reply
  1676. /* Prepare to carry out the file verify */
  1677. amount_left = verification_length << 9;
  1678. file_offset = ((loff_t) lba) << 9;
  1679. /* Write out all the dirty buffers before invalidating them */
  1680. fsync_sub(curlun);
  1681. if (signal_pending(current))
  1682. return -EINTR;
  1683. invalidate_sub(curlun);
  1684. if (signal_pending(current))
  1685. return -EINTR;
  1686. /* Just try to read the requested blocks */
  1687. while (amount_left > 0) {
  1688. /* Figure out how much we need to read:
  1689. * Try to read the remaining amount, but not more than
  1690. * the buffer size.
  1691. * And don't try to read past the end of the file.
  1692. * If this means reading 0 then we were asked to read
  1693. * past the end of file. */
  1694. amount = min((unsigned int) amount_left, mod_data.buflen);
  1695. amount = min((loff_t) amount,
  1696. curlun->file_length - file_offset);
  1697. if (amount == 0) {
  1698. curlun->sense_data =
  1699. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1700. curlun->sense_data_info = file_offset >> 9;
  1701. curlun->info_valid = 1;
  1702. break;
  1703. }
  1704. /* Perform the read */
  1705. file_offset_tmp = file_offset;
  1706. nread = vfs_read(curlun->filp,
  1707. (char __user *) bh->buf,
  1708. amount, &file_offset_tmp);
  1709. VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
  1710. (unsigned long long) file_offset,
  1711. (int) nread);
  1712. if (signal_pending(current))
  1713. return -EINTR;
  1714. if (nread < 0) {
  1715. LDBG(curlun, "error in file verify: %d\n",
  1716. (int) nread);
  1717. nread = 0;
  1718. } else if (nread < amount) {
  1719. LDBG(curlun, "partial file verify: %d/%u\n",
  1720. (int) nread, amount);
  1721. nread -= (nread & 511); // Round down to a sector
  1722. }
  1723. if (nread == 0) {
  1724. curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
  1725. curlun->sense_data_info = file_offset >> 9;
  1726. curlun->info_valid = 1;
  1727. break;
  1728. }
  1729. file_offset += nread;
  1730. amount_left -= nread;
  1731. }
  1732. return 0;
  1733. }
  1734. /*-------------------------------------------------------------------------*/
  1735. static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1736. {
  1737. u8 *buf = (u8 *) bh->buf;
  1738. static char vendor_id[] = "Bookeen ";
  1739. static char product_id[] = "Cybook Orizon";
  1740. if (!fsg->curlun) { // Unsupported LUNs are okay
  1741. fsg->bad_lun_okay = 1;
  1742. memset(buf, 0, 36);
  1743. buf[0] = 0x7f; // Unsupported, no device-type
  1744. return 36;
  1745. }
  1746. memset(buf, 0, 8); // Non-removable, direct-access device
  1747. if (mod_data.removable)
  1748. buf[1] = 0x80;
  1749. buf[2] = 2; // ANSI SCSI level 2
  1750. buf[3] = 2; // SCSI-2 INQUIRY data format
  1751. buf[4] = 31; // Additional length
  1752. // No special options
  1753. sprintf(buf + 8, "%-8s%-13s-%-2s%04x", vendor_id, product_id, (fsg->curlun->id==1)?"FD":"SD",
  1754. mod_data.release);
  1755. return 36;
  1756. }
  1757. static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1758. {
  1759. struct lun *curlun = fsg->curlun;
  1760. u8 *buf = (u8 *) bh->buf;
  1761. u32 sd, sdinfo;
  1762. int valid;
  1763. /*
  1764. * From the SCSI-2 spec., section 7.9 (Unit attention condition):
  1765. *
  1766. * If a REQUEST SENSE command is received from an initiator
  1767. * with a pending unit attention condition (before the target
  1768. * generates the contingent allegiance condition), then the
  1769. * target shall either:
  1770. * a) report any pending sense data and preserve the unit
  1771. * attention condition on the logical unit, or,
  1772. * b) report the unit attention condition, may discard any
  1773. * pending sense data, and clear the unit attention
  1774. * condition on the logical unit for that initiator.
  1775. *
  1776. * FSG normally uses option a); enable this code to use option b).
  1777. */
  1778. #if 0
  1779. if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
  1780. curlun->sense_data = curlun->unit_attention_data;
  1781. curlun->unit_attention_data = SS_NO_SENSE;
  1782. }
  1783. #endif
  1784. if (!curlun) { // Unsupported LUNs are okay
  1785. fsg->bad_lun_okay = 1;
  1786. sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
  1787. sdinfo = 0;
  1788. valid = 0;
  1789. } else {
  1790. sd = curlun->sense_data;
  1791. sdinfo = curlun->sense_data_info;
  1792. valid = curlun->info_valid << 7;
  1793. curlun->sense_data = SS_NO_SENSE;
  1794. curlun->sense_data_info = 0;
  1795. curlun->info_valid = 0;
  1796. }
  1797. memset(buf, 0, 18);
  1798. buf[0] = valid | 0x70; // Valid, current error
  1799. buf[2] = SK(sd);
  1800. put_be32(&buf[3], sdinfo); // Sense information
  1801. buf[7] = 18 - 8; // Additional sense length
  1802. buf[12] = ASC(sd);
  1803. buf[13] = ASCQ(sd);
  1804. return 18;
  1805. }
  1806. static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1807. {
  1808. struct lun *curlun = fsg->curlun;
  1809. u32 lba = get_be32(&fsg->cmnd[2]);
  1810. int pmi = fsg->cmnd[8];
  1811. u8 *buf = (u8 *) bh->buf;
  1812. /* Check the PMI and LBA fields */
  1813. if (pmi > 1 || (pmi == 0 && lba != 0)) {
  1814. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1815. return -EINVAL;
  1816. }
  1817. put_be32(&buf[0], curlun->num_sectors - 1); // Max logical block
  1818. put_be32(&buf[4], 512); // Block length
  1819. return 8;
  1820. }
  1821. static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1822. {
  1823. struct lun *curlun = fsg->curlun;
  1824. int mscmnd = fsg->cmnd[0];
  1825. u8 *buf = (u8 *) bh->buf;
  1826. u8 *buf0 = buf;
  1827. int pc, page_code;
  1828. int changeable_values, all_pages;
  1829. int valid_page = 0;
  1830. int len, limit;
  1831. if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD
  1832. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1833. return -EINVAL;
  1834. }
  1835. pc = fsg->cmnd[2] >> 6;
  1836. page_code = fsg->cmnd[2] & 0x3f;
  1837. if (pc == 3) {
  1838. curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
  1839. return -EINVAL;
  1840. }
  1841. changeable_values = (pc == 1);
  1842. all_pages = (page_code == 0x3f);
  1843. /* Write the mode parameter header. Fixed values are: default
  1844. * medium type, no cache control (DPOFUA), and no block descriptors.
  1845. * The only variable value is the WriteProtect bit. We will fill in
  1846. * the mode data length later. */
  1847. memset(buf, 0, 8);
  1848. if (mscmnd == SC_MODE_SENSE_6) {
  1849. buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
  1850. buf += 4;
  1851. limit = 255;
  1852. } else { // SC_MODE_SENSE_10
  1853. buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
  1854. buf += 8;
  1855. limit = 65535; // Should really be mod_data.buflen
  1856. }
  1857. /* No block descriptors */
  1858. /* The mode pages, in numerical order. The only page we support
  1859. * is the Caching page. */
  1860. if (page_code == 0x08 || all_pages) {
  1861. valid_page = 1;
  1862. buf[0] = 0x08; // Page code
  1863. buf[1] = 10; // Page length
  1864. memset(buf+2, 0, 10); // None of the fields are changeable
  1865. if (!changeable_values) {
  1866. buf[2] = 0x04; // Write cache enable,
  1867. // Read cache not disabled
  1868. // No cache retention priorities
  1869. put_be16(&buf[4], 0xffff); // Don't disable prefetch
  1870. // Minimum prefetch = 0
  1871. put_be16(&buf[8], 0xffff); // Maximum prefetch
  1872. put_be16(&buf[10], 0xffff); // Maximum prefetch ceiling
  1873. }
  1874. buf += 12;
  1875. }
  1876. /* Check that a valid page was requested and the mode data length
  1877. * isn't too long. */
  1878. len = buf - buf0;
  1879. if (!valid_page || len > limit) {
  1880. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1881. return -EINVAL;
  1882. }
  1883. /* Store the mode data length */
  1884. if (mscmnd == SC_MODE_SENSE_6)
  1885. buf0[0] = len - 1;
  1886. else
  1887. put_be16(buf0, len - 2);
  1888. return len;
  1889. }
  1890. static int do_start_stop(struct fsg_dev *fsg)
  1891. {
  1892. struct lun *curlun = fsg->curlun;
  1893. int loej, start;
  1894. if (!mod_data.removable) {
  1895. curlun->sense_data = SS_INVALID_COMMAND;
  1896. return -EINVAL;
  1897. }
  1898. // int immed = fsg->cmnd[1] & 0x01;
  1899. loej = fsg->cmnd[4] & 0x02;
  1900. start = fsg->cmnd[4] & 0x01;
  1901. if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed
  1902. (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start
  1903. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1904. return -EINVAL;
  1905. }
  1906. if (!start) {
  1907. /* Are we allowed to unload the media? */
  1908. #if 0 /* We can't prevent hardware removal */
  1909. if (curlun->prevent_medium_removal) {
  1910. LDBG(curlun, "unload attempt prevented\n");
  1911. curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
  1912. return -EINVAL;
  1913. }
  1914. #endif
  1915. if (loej) { // Simulate an unload/eject
  1916. up_read(&fsg->filesem);
  1917. down_write(&fsg->filesem);
  1918. close_backing_file(curlun);
  1919. up_write(&fsg->filesem);
  1920. down_read(&fsg->filesem);
  1921. }
  1922. } else {
  1923. /* Our emulation doesn't support mounting; the medium is
  1924. * available for use as soon as it is loaded. */
  1925. if (!backing_file_is_open(curlun)) {
  1926. curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
  1927. return -EINVAL;
  1928. }
  1929. }
  1930. return 0;
  1931. }
  1932. static int do_prevent_allow(struct fsg_dev *fsg)
  1933. {
  1934. struct lun *curlun = fsg->curlun;
  1935. int prevent;
  1936. if (!mod_data.removable) {
  1937. curlun->sense_data = SS_INVALID_COMMAND;
  1938. return -EINVAL;
  1939. }
  1940. prevent = fsg->cmnd[4] & 0x01;
  1941. if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent
  1942. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1943. return -EINVAL;
  1944. }
  1945. if (curlun->prevent_medium_removal && !prevent)
  1946. fsync_sub(curlun);
  1947. curlun->prevent_medium_removal = prevent;
  1948. return 0;
  1949. }
  1950. static int do_read_format_capacities(struct fsg_dev *fsg,
  1951. struct fsg_buffhd *bh)
  1952. {
  1953. struct lun *curlun = fsg->curlun;
  1954. u8 *buf = (u8 *) bh->buf;
  1955. buf[0] = buf[1] = buf[2] = 0;
  1956. buf[3] = 8; // Only the Current/Maximum Capacity Descriptor
  1957. buf += 4;
  1958. put_be32(&buf[0], curlun->num_sectors); // Number of blocks
  1959. put_be32(&buf[4], 512); // Block length
  1960. buf[4] = 0x02; // Current capacity
  1961. return 12;
  1962. }
  1963. static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1964. {
  1965. struct lun *curlun = fsg->curlun;
  1966. /* We don't support MODE SELECT */
  1967. curlun->sense_data = SS_INVALID_COMMAND;
  1968. return -EINVAL;
  1969. }
  1970. /*-------------------------------------------------------------------------*/
  1971. static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
  1972. {
  1973. int rc;
  1974. rc = fsg_set_halt(fsg, fsg->bulk_in);
  1975. if (rc == -EAGAIN)
  1976. VDBG(fsg, "delayed bulk-in endpoint halt\n");
  1977. while (rc != 0) {
  1978. if (rc != -EAGAIN) {
  1979. WARN(fsg, "usb_ep_set_halt -> %d\n", rc);
  1980. rc = 0;
  1981. break;
  1982. }
  1983. /* Wait for a short time and then try again */
  1984. if (msleep_interruptible(100) != 0)
  1985. return -EINTR;
  1986. rc = usb_ep_set_halt(fsg->bulk_in);
  1987. }
  1988. return rc;
  1989. }
  1990. static int pad_with_zeros(struct fsg_dev *fsg)
  1991. {
  1992. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  1993. u32 nkeep = bh->inreq->length;
  1994. u32 nsend;
  1995. int rc;
  1996. bh->state = BUF_STATE_EMPTY; // For the first iteration
  1997. fsg->usb_amount_left = nkeep + fsg->residue;
  1998. while (fsg->usb_amount_left > 0) {
  1999. /* Wait for the next buffer to be free */
  2000. while (bh->state != BUF_STATE_EMPTY) {
  2001. if ((rc = sleep_thread(fsg)) != 0)
  2002. return rc;
  2003. }
  2004. nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
  2005. memset(bh->buf + nkeep, 0, nsend - nkeep);
  2006. bh->inreq->length = nsend;
  2007. bh->inreq->zero = 0;
  2008. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2009. &bh->inreq_busy, &bh->state);
  2010. bh = fsg->next_buffhd_to_fill = bh->next;
  2011. fsg->usb_amount_left -= nsend;
  2012. nkeep = 0;
  2013. }
  2014. return 0;
  2015. }
  2016. static int throw_away_data(struct fsg_dev *fsg)
  2017. {
  2018. struct fsg_buffhd *bh;
  2019. u32 amount;
  2020. int rc;
  2021. while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
  2022. fsg->usb_amount_left > 0) {
  2023. /* Throw away the data in a filled buffer */
  2024. if (bh->state == BUF_STATE_FULL) {
  2025. smp_rmb();
  2026. bh->state = BUF_STATE_EMPTY;
  2027. fsg->next_buffhd_to_drain = bh->next;
  2028. /* A short packet or an error ends everything */
  2029. if (bh->outreq->actual != bh->outreq->length ||
  2030. bh->outreq->status != 0) {
  2031. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  2032. return -EINTR;
  2033. }
  2034. continue;
  2035. }
  2036. /* Try to submit another request if we need one */
  2037. bh = fsg->next_buffhd_to_fill;
  2038. if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
  2039. amount = min(fsg->usb_amount_left,
  2040. (u32) mod_data.buflen);
  2041. /* amount is always divisible by 512, hence by
  2042. * the bulk-out maxpacket size */
  2043. bh->outreq->length = bh->bulk_out_intended_length =
  2044. amount;
  2045. bh->outreq->short_not_ok = 1;
  2046. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  2047. &bh->outreq_busy, &bh->state);
  2048. fsg->next_buffhd_to_fill = bh->next;
  2049. fsg->usb_amount_left -= amount;
  2050. continue;
  2051. }
  2052. /* Otherwise wait for something to happen */
  2053. if ((rc = sleep_thread(fsg)) != 0)
  2054. return rc;
  2055. }
  2056. return 0;
  2057. }
  2058. static int finish_reply(struct fsg_dev *fsg)
  2059. {
  2060. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  2061. int rc = 0;
  2062. switch (fsg->data_dir) {
  2063. case DATA_DIR_NONE:
  2064. break; // Nothing to send
  2065. /* If we don't know whether the host wants to read or write,
  2066. * this must be CB or CBI with an unknown command. We mustn't
  2067. * try to send or receive any data. So stall both bulk pipes
  2068. * if we can and wait for a reset. */
  2069. case DATA_DIR_UNKNOWN:
  2070. if (mod_data.can_stall) {
  2071. fsg_set_halt(fsg, fsg->bulk_out);
  2072. rc = halt_bulk_in_endpoint(fsg);
  2073. }
  2074. break;
  2075. /* All but the last buffer of data must have already been sent */
  2076. case DATA_DIR_TO_HOST:
  2077. if (fsg->data_size == 0)
  2078. ; // Nothing to send
  2079. /* If there's no residue, simply send the last buffer */
  2080. else if (fsg->residue == 0) {
  2081. bh->inreq->zero = 0;
  2082. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2083. &bh->inreq_busy, &bh->state);
  2084. fsg->next_buffhd_to_fill = bh->next;
  2085. }
  2086. /* There is a residue. For CB and CBI, simply mark the end
  2087. * of the data with a short packet. However, if we are
  2088. * allowed to stall, there was no data at all (residue ==
  2089. * data_size), and the command failed (invalid LUN or
  2090. * sense data is set), then halt the bulk-in endpoint
  2091. * instead. */
  2092. else if (!transport_is_bbb()) {
  2093. if (mod_data.can_stall &&
  2094. fsg->residue == fsg->data_size &&
  2095. (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
  2096. bh->state = BUF_STATE_EMPTY;
  2097. rc = halt_bulk_in_endpoint(fsg);
  2098. } else {
  2099. bh->inreq->zero = 1;
  2100. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2101. &bh->inreq_busy, &bh->state);
  2102. fsg->next_buffhd_to_fill = bh->next;
  2103. }
  2104. }
  2105. /* For Bulk-only, if we're allowed to stall then send the
  2106. * short packet and halt the bulk-in endpoint. If we can't
  2107. * stall, pad out the remaining data with 0's. */
  2108. else {
  2109. if (mod_data.can_stall) {
  2110. bh->inreq->zero = 1;
  2111. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2112. &bh->inreq_busy, &bh->state);
  2113. fsg->next_buffhd_to_fill = bh->next;
  2114. rc = halt_bulk_in_endpoint(fsg);
  2115. } else
  2116. rc = pad_with_zeros(fsg);
  2117. }
  2118. break;
  2119. /* We have processed all we want from the data the host has sent.
  2120. * There may still be outstanding bulk-out requests. */
  2121. case DATA_DIR_FROM_HOST:
  2122. if (fsg->residue == 0)
  2123. ; // Nothing to receive
  2124. /* Did the host stop sending unexpectedly early? */
  2125. else if (fsg->short_packet_received) {
  2126. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  2127. rc = -EINTR;
  2128. }
  2129. /* We haven't processed all the incoming data. Even though
  2130. * we may be allowed to stall, doing so would cause a race.
  2131. * The controller may already have ACK'ed all the remaining
  2132. * bulk-out packets, in which case the host wouldn't see a
  2133. * STALL. Not realizing the endpoint was halted, it wouldn't
  2134. * clear the halt -- leading to problems later on. */
  2135. #if 0
  2136. else if (mod_data.can_stall) {
  2137. fsg_set_halt(fsg, fsg->bulk_out);
  2138. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  2139. rc = -EINTR;
  2140. }
  2141. #endif
  2142. /* We can't stall. Read in the excess data and throw it
  2143. * all away. */
  2144. else
  2145. rc = throw_away_data(fsg);
  2146. break;
  2147. }
  2148. return rc;
  2149. }
  2150. static int send_status(struct fsg_dev *fsg)
  2151. {
  2152. struct lun *curlun = fsg->curlun;
  2153. struct fsg_buffhd *bh;
  2154. int rc;
  2155. u8 status = USB_STATUS_PASS;
  2156. u32 sd, sdinfo = 0;
  2157. /* Wait for the next buffer to become available */
  2158. bh = fsg->next_buffhd_to_fill;
  2159. while (bh->state != BUF_STATE_EMPTY) {
  2160. if ((rc = sleep_thread(fsg)) != 0)
  2161. return rc;
  2162. }
  2163. if (curlun) {
  2164. sd = curlun->sense_data;
  2165. sdinfo = curlun->sense_data_info;
  2166. } else if (fsg->bad_lun_okay)
  2167. sd = SS_NO_SENSE;
  2168. else
  2169. sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
  2170. if (fsg->phase_error) {
  2171. DBG(fsg, "sending phase-error status\n");
  2172. status = USB_STATUS_PHASE_ERROR;
  2173. sd = SS_INVALID_COMMAND;
  2174. } else if (sd != SS_NO_SENSE) {
  2175. DBG(fsg, "sending command-failure status\n");
  2176. status = USB_STATUS_FAIL;
  2177. VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
  2178. " info x%x\n",
  2179. SK(sd), ASC(sd), ASCQ(sd), sdinfo);
  2180. }
  2181. if (transport_is_bbb()) {
  2182. struct bulk_cs_wrap *csw = bh->buf;
  2183. /* Store and send the Bulk-only CSW */
  2184. csw->Signature = __constant_cpu_to_le32(USB_BULK_CS_SIG);
  2185. csw->Tag = fsg->tag;
  2186. csw->Residue = cpu_to_le32(fsg->residue);
  2187. csw->Status = status;
  2188. bh->inreq->length = USB_BULK_CS_WRAP_LEN;
  2189. bh->inreq->zero = 0;
  2190. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2191. &bh->inreq_busy, &bh->state);
  2192. } else if (mod_data.transport_type == USB_PR_CB) {
  2193. /* Control-Bulk transport has no status phase! */
  2194. return 0;
  2195. } else { // USB_PR_CBI
  2196. struct interrupt_data *buf = bh->buf;
  2197. /* Store and send the Interrupt data. UFI sends the ASC
  2198. * and ASCQ bytes. Everything else sends a Type (which
  2199. * is always 0) and the status Value. */
  2200. if (mod_data.protocol_type == USB_SC_UFI) {
  2201. buf->bType = ASC(sd);
  2202. buf->bValue = ASCQ(sd);
  2203. } else {
  2204. buf->bType = 0;
  2205. buf->bValue = status;
  2206. }
  2207. fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
  2208. fsg->intr_buffhd = bh; // Point to the right buffhd
  2209. fsg->intreq->buf = bh->inreq->buf;
  2210. fsg->intreq->dma = bh->inreq->dma;
  2211. fsg->intreq->context = bh;
  2212. start_transfer(fsg, fsg->intr_in, fsg->intreq,
  2213. &fsg->intreq_busy, &bh->state);
  2214. }
  2215. fsg->next_buffhd_to_fill = bh->next;
  2216. return 0;
  2217. }
  2218. /*-------------------------------------------------------------------------*/
  2219. /* Check whether the command is properly formed and whether its data size
  2220. * and direction agree with the values we already have. */
  2221. static int check_command(struct fsg_dev *fsg, int cmnd_size,
  2222. enum data_direction data_dir, unsigned int mask,
  2223. int needs_medium, const char *name)
  2224. {
  2225. int i;
  2226. int lun = fsg->cmnd[1] >> 5;
  2227. static const char dirletter[4] = {'u', 'o', 'i', 'n'};
  2228. char hdlen[20];
  2229. struct lun *curlun;
  2230. /* Adjust the expected cmnd_size for protocol encapsulation padding.
  2231. * Transparent SCSI doesn't pad. */
  2232. if (protocol_is_scsi())
  2233. ;
  2234. /* There's some disagreement as to whether RBC pads commands or not.
  2235. * We'll play it safe and accept either form. */
  2236. else if (mod_data.protocol_type == USB_SC_RBC) {
  2237. if (fsg->cmnd_size == 12)
  2238. cmnd_size = 12;
  2239. /* All the other protocols pad to 12 bytes */
  2240. } else
  2241. cmnd_size = 12;
  2242. hdlen[0] = 0;
  2243. if (fsg->data_dir != DATA_DIR_UNKNOWN)
  2244. sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
  2245. fsg->data_size);
  2246. VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
  2247. name, cmnd_size, dirletter[(int) data_dir],
  2248. fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
  2249. /* We can't reply at all until we know the correct data direction
  2250. * and size. */
  2251. if (fsg->data_size_from_cmnd == 0)
  2252. data_dir = DATA_DIR_NONE;
  2253. if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI
  2254. fsg->data_dir = data_dir;
  2255. fsg->data_size = fsg->data_size_from_cmnd;
  2256. } else { // Bulk-only
  2257. if (fsg->data_size < fsg->data_size_from_cmnd) {
  2258. /* Host data size < Device data size is a phase error.
  2259. * Carry out the command, but only transfer as much
  2260. * as we are allowed. */
  2261. fsg->data_size_from_cmnd = fsg->data_size;
  2262. fsg->phase_error = 1;
  2263. }
  2264. }
  2265. fsg->residue = fsg->usb_amount_left = fsg->data_size;
  2266. /* Conflicting data directions is a phase error */
  2267. if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
  2268. fsg->phase_error = 1;
  2269. return -EINVAL;
  2270. }
  2271. /* Verify the length of the command itself */
  2272. if (cmnd_size != fsg->cmnd_size) {
  2273. /* Special case workaround: MS-Windows issues REQUEST SENSE
  2274. * with cbw->Length == 12 (it should be 6). */
  2275. if (fsg->cmnd[0] == SC_REQUEST_SENSE && fsg->cmnd_size == 12)
  2276. cmnd_size = fsg->cmnd_size;
  2277. else {
  2278. fsg->phase_error = 1;
  2279. return -EINVAL;
  2280. }
  2281. }
  2282. /* Check that the LUN values are consistent */
  2283. if (transport_is_bbb()) {
  2284. if (fsg->lun != lun)
  2285. DBG(fsg, "using LUN %d from CBW, "
  2286. "not LUN %d from CDB\n",
  2287. fsg->lun, lun);
  2288. } else
  2289. fsg->lun = lun; // Use LUN from the command
  2290. /* Check the LUN */
  2291. if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
  2292. fsg->curlun = curlun = &fsg->luns[fsg->lun];
  2293. if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2294. curlun->sense_data = SS_NO_SENSE;
  2295. curlun->sense_data_info = 0;
  2296. curlun->info_valid = 0;
  2297. }
  2298. } else {
  2299. fsg->curlun = curlun = NULL;
  2300. fsg->bad_lun_okay = 0;
  2301. /* INQUIRY and REQUEST SENSE commands are explicitly allowed
  2302. * to use unsupported LUNs; all others may not. */
  2303. if (fsg->cmnd[0] != SC_INQUIRY &&
  2304. fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2305. DBG(fsg, "unsupported LUN %d\n", fsg->lun);
  2306. return -EINVAL;
  2307. }
  2308. }
  2309. /* If a unit attention condition exists, only INQUIRY and
  2310. * REQUEST SENSE commands are allowed; anything else must fail. */
  2311. if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
  2312. fsg->cmnd[0] != SC_INQUIRY &&
  2313. fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2314. curlun->sense_data = curlun->unit_attention_data;
  2315. curlun->unit_attention_data = SS_NO_SENSE;
  2316. return -EINVAL;
  2317. }
  2318. /* Check that only command bytes listed in the mask are non-zero */
  2319. fsg->cmnd[1] &= 0x1f; // Mask away the LUN
  2320. for (i = 1; i < cmnd_size; ++i) {
  2321. if (fsg->cmnd[i] && !(mask & (1 << i))) {
  2322. if (curlun)
  2323. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  2324. return -EINVAL;
  2325. }
  2326. }
  2327. /* If the medium isn't mounted and the command needs to access
  2328. * it, return an error. */
  2329. if (curlun && !backing_file_is_open(curlun) && needs_medium) {
  2330. curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
  2331. return -EINVAL;
  2332. }
  2333. return 0;
  2334. }
  2335. static int do_scsi_command(struct fsg_dev *fsg)
  2336. {
  2337. struct fsg_buffhd *bh;
  2338. int rc;
  2339. int reply = -EINVAL;
  2340. int i;
  2341. static char unknown[16];
  2342. dump_cdb(fsg);
  2343. /* Wait for the next buffer to become available for data or status */
  2344. bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
  2345. while (bh->state != BUF_STATE_EMPTY) {
  2346. if ((rc = sleep_thread(fsg)) != 0)
  2347. return rc;
  2348. }
  2349. fsg->phase_error = 0;
  2350. fsg->short_packet_received = 0;
  2351. down_read(&fsg->filesem); // We're using the backing file
  2352. switch (fsg->cmnd[0]) {
  2353. case SC_INQUIRY:
  2354. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2355. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2356. (1<<4), 0,
  2357. "INQUIRY")) == 0)
  2358. reply = do_inquiry(fsg, bh);
  2359. break;
  2360. case SC_MODE_SELECT_6:
  2361. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2362. if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
  2363. (1<<1) | (1<<4), 0,
  2364. "MODE SELECT(6)")) == 0)
  2365. reply = do_mode_select(fsg, bh);
  2366. break;
  2367. case SC_MODE_SELECT_10:
  2368. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2369. if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
  2370. (1<<1) | (3<<7), 0,
  2371. "MODE SELECT(10)")) == 0)
  2372. reply = do_mode_select(fsg, bh);
  2373. break;
  2374. case SC_MODE_SENSE_6:
  2375. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2376. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2377. (1<<1) | (1<<2) | (1<<4), 0,
  2378. "MODE SENSE(6)")) == 0)
  2379. reply = do_mode_sense(fsg, bh);
  2380. break;
  2381. case SC_MODE_SENSE_10:
  2382. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2383. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2384. (1<<1) | (1<<2) | (3<<7), 0,
  2385. "MODE SENSE(10)")) == 0)
  2386. reply = do_mode_sense(fsg, bh);
  2387. break;
  2388. case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
  2389. fsg->data_size_from_cmnd = 0;
  2390. if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
  2391. (1<<4), 0,
  2392. "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
  2393. reply = do_prevent_allow(fsg);
  2394. break;
  2395. case SC_READ_6:
  2396. i = fsg->cmnd[4];
  2397. fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
  2398. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2399. (7<<1) | (1<<4), 1,
  2400. "READ(6)")) == 0)
  2401. reply = do_read(fsg);
  2402. break;
  2403. case SC_READ_10:
  2404. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
  2405. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2406. (1<<1) | (0xf<<2) | (3<<7), 1,
  2407. "READ(10)")) == 0)
  2408. reply = do_read(fsg);
  2409. break;
  2410. case SC_READ_12:
  2411. fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
  2412. if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
  2413. (1<<1) | (0xf<<2) | (0xf<<6), 1,
  2414. "READ(12)")) == 0)
  2415. reply = do_read(fsg);
  2416. break;
  2417. case SC_READ_CAPACITY:
  2418. fsg->data_size_from_cmnd = 8;
  2419. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2420. (0xf<<2) | (1<<8), 1,
  2421. "READ CAPACITY")) == 0)
  2422. reply = do_read_capacity(fsg, bh);
  2423. break;
  2424. case SC_READ_FORMAT_CAPACITIES:
  2425. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2426. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2427. (3<<7), 1,
  2428. "READ FORMAT CAPACITIES")) == 0)
  2429. reply = do_read_format_capacities(fsg, bh);
  2430. break;
  2431. case SC_REQUEST_SENSE:
  2432. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2433. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2434. (1<<4), 0,
  2435. "REQUEST SENSE")) == 0)
  2436. reply = do_request_sense(fsg, bh);
  2437. break;
  2438. case SC_START_STOP_UNIT:
  2439. fsg->data_size_from_cmnd = 0;
  2440. if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
  2441. (1<<1) | (1<<4), 0,
  2442. "START-STOP UNIT")) == 0)
  2443. reply = do_start_stop(fsg);
  2444. break;
  2445. case SC_SYNCHRONIZE_CACHE:
  2446. fsg->data_size_from_cmnd = 0;
  2447. if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
  2448. (0xf<<2) | (3<<7), 1,
  2449. "SYNCHRONIZE CACHE")) == 0)
  2450. reply = do_synchronize_cache(fsg);
  2451. break;
  2452. case SC_TEST_UNIT_READY:
  2453. fsg->data_size_from_cmnd = 0;
  2454. reply = check_command(fsg, 6, DATA_DIR_NONE,
  2455. 0, 1,
  2456. "TEST UNIT READY");
  2457. break;
  2458. /* Although optional, this command is used by MS-Windows. We
  2459. * support a minimal version: BytChk must be 0. */
  2460. case SC_VERIFY:
  2461. fsg->data_size_from_cmnd = 0;
  2462. if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
  2463. (1<<1) | (0xf<<2) | (3<<7), 1,
  2464. "VERIFY")) == 0)
  2465. reply = do_verify(fsg);
  2466. break;
  2467. case SC_WRITE_6:
  2468. i = fsg->cmnd[4];
  2469. fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
  2470. if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
  2471. (7<<1) | (1<<4), 1,
  2472. "WRITE(6)")) == 0)
  2473. reply = do_write(fsg);
  2474. break;
  2475. case SC_WRITE_10:
  2476. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
  2477. if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
  2478. (1<<1) | (0xf<<2) | (3<<7), 1,
  2479. "WRITE(10)")) == 0)
  2480. reply = do_write(fsg);
  2481. break;
  2482. case SC_WRITE_12:
  2483. fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
  2484. if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
  2485. (1<<1) | (0xf<<2) | (0xf<<6), 1,
  2486. "WRITE(12)")) == 0)
  2487. reply = do_write(fsg);
  2488. break;
  2489. /* Some mandatory commands that we recognize but don't implement.
  2490. * They don't mean much in this setting. It's left as an exercise
  2491. * for anyone interested to implement RESERVE and RELEASE in terms
  2492. * of Posix locks. */
  2493. case SC_FORMAT_UNIT:
  2494. case SC_RELEASE:
  2495. case SC_RESERVE:
  2496. case SC_SEND_DIAGNOSTIC:
  2497. // Fall through
  2498. default:
  2499. fsg->data_size_from_cmnd = 0;
  2500. sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
  2501. if ((reply = check_command(fsg, fsg->cmnd_size,
  2502. DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
  2503. fsg->curlun->sense_data = SS_INVALID_COMMAND;
  2504. reply = -EINVAL;
  2505. }
  2506. break;
  2507. }
  2508. up_read(&fsg->filesem);
  2509. if (reply == -EINTR || signal_pending(current))
  2510. return -EINTR;
  2511. /* Set up the single reply buffer for finish_reply() */
  2512. if (reply == -EINVAL)
  2513. reply = 0; // Error reply length
  2514. if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
  2515. reply = min((u32) reply, fsg->data_size_from_cmnd);
  2516. bh->inreq->length = reply;
  2517. bh->state = BUF_STATE_FULL;
  2518. fsg->residue -= reply;
  2519. } // Otherwise it's already set
  2520. return 0;
  2521. }
  2522. /*-------------------------------------------------------------------------*/
  2523. static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  2524. {
  2525. struct usb_request *req = bh->outreq;
  2526. struct bulk_cb_wrap *cbw = req->buf;
  2527. /* Was this a real packet? */
  2528. if (req->status)
  2529. return -EINVAL;
  2530. /* Is the CBW valid? */
  2531. if (req->actual != USB_BULK_CB_WRAP_LEN ||
  2532. cbw->Signature != __constant_cpu_to_le32(
  2533. USB_BULK_CB_SIG)) {
  2534. DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
  2535. req->actual,
  2536. le32_to_cpu(cbw->Signature));
  2537. /* The Bulk-only spec says we MUST stall the bulk pipes!
  2538. * If we want to avoid stalls, set a flag so that we will
  2539. * clear the endpoint halts at the next reset. */
  2540. if (!mod_data.can_stall)
  2541. set_bit(CLEAR_BULK_HALTS, &fsg->atomic_bitflags);
  2542. fsg_set_halt(fsg, fsg->bulk_out);
  2543. halt_bulk_in_endpoint(fsg);
  2544. return -EINVAL;
  2545. }
  2546. /* Is the CBW meaningful? */
  2547. if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
  2548. cbw->Length < 6 || cbw->Length > MAX_COMMAND_SIZE) {
  2549. DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
  2550. "cmdlen %u\n",
  2551. cbw->Lun, cbw->Flags, cbw->Length);
  2552. /* We can do anything we want here, so let's stall the
  2553. * bulk pipes if we are allowed to. */
  2554. if (mod_data.can_stall) {
  2555. fsg_set_halt(fsg, fsg->bulk_out);
  2556. halt_bulk_in_endpoint(fsg);
  2557. }
  2558. return -EINVAL;
  2559. }
  2560. /* Save the command for later */
  2561. fsg->cmnd_size = cbw->Length;
  2562. memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
  2563. if (cbw->Flags & USB_BULK_IN_FLAG)
  2564. fsg->data_dir = DATA_DIR_TO_HOST;
  2565. else
  2566. fsg->data_dir = DATA_DIR_FROM_HOST;
  2567. fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
  2568. if (fsg->data_size == 0)
  2569. fsg->data_dir = DATA_DIR_NONE;
  2570. fsg->lun = cbw->Lun;
  2571. fsg->tag = cbw->Tag;
  2572. return 0;
  2573. }
  2574. static int get_next_command(struct fsg_dev *fsg)
  2575. {
  2576. struct fsg_buffhd *bh;
  2577. int rc = 0;
  2578. if (transport_is_bbb()) {
  2579. /* Wait for the next buffer to become available */
  2580. bh = fsg->next_buffhd_to_fill;
  2581. while (bh->state != BUF_STATE_EMPTY) {
  2582. if ((rc = sleep_thread(fsg)) != 0)
  2583. return rc;
  2584. }
  2585. /* Queue a request to read a Bulk-only CBW */
  2586. set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
  2587. bh->outreq->short_not_ok = 1;
  2588. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  2589. &bh->outreq_busy, &bh->state);
  2590. /* We will drain the buffer in software, which means we
  2591. * can reuse it for the next filling. No need to advance
  2592. * next_buffhd_to_fill. */
  2593. /* Wait for the CBW to arrive */
  2594. while (bh->state != BUF_STATE_FULL) {
  2595. if ((rc = sleep_thread(fsg)) != 0)
  2596. return rc;
  2597. }
  2598. smp_rmb();
  2599. rc = received_cbw(fsg, bh);
  2600. bh->state = BUF_STATE_EMPTY;
  2601. } else { // USB_PR_CB or USB_PR_CBI
  2602. /* Wait for the next command to arrive */
  2603. while (fsg->cbbuf_cmnd_size == 0) {
  2604. if ((rc = sleep_thread(fsg)) != 0)
  2605. return rc;
  2606. }
  2607. /* Is the previous status interrupt request still busy?
  2608. * The host is allowed to skip reading the status,
  2609. * so we must cancel it. */
  2610. if (fsg->intreq_busy)
  2611. usb_ep_dequeue(fsg->intr_in, fsg->intreq);
  2612. /* Copy the command and mark the buffer empty */
  2613. fsg->data_dir = DATA_DIR_UNKNOWN;
  2614. spin_lock_irq(&fsg->lock);
  2615. fsg->cmnd_size = fsg->cbbuf_cmnd_size;
  2616. memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
  2617. fsg->cbbuf_cmnd_size = 0;
  2618. spin_unlock_irq(&fsg->lock);
  2619. }
  2620. return rc;
  2621. }
  2622. /*-------------------------------------------------------------------------*/
  2623. static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
  2624. const struct usb_endpoint_descriptor *d)
  2625. {
  2626. int rc;
  2627. ep->driver_data = fsg;
  2628. rc = usb_ep_enable(ep, d);
  2629. if (rc)
  2630. ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
  2631. return rc;
  2632. }
  2633. static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
  2634. struct usb_request **preq)
  2635. {
  2636. *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
  2637. if (*preq)
  2638. return 0;
  2639. ERROR(fsg, "can't allocate request for %s\n", ep->name);
  2640. return -ENOMEM;
  2641. }
  2642. /*
  2643. * Reset interface setting and re-init endpoint state (toggle etc).
  2644. * Call with altsetting < 0 to disable the interface. The only other
  2645. * available altsetting is 0, which enables the interface.
  2646. */
  2647. static int do_set_interface(struct fsg_dev *fsg, int altsetting)
  2648. {
  2649. int rc = 0;
  2650. int i;
  2651. const struct usb_endpoint_descriptor *d;
  2652. if (fsg->running)
  2653. DBG(fsg, "reset interface\n");
  2654. reset:
  2655. /* Deallocate the requests */
  2656. for (i = 0; i < NUM_BUFFERS; ++i) {
  2657. struct fsg_buffhd *bh = &fsg->buffhds[i];
  2658. if (bh->inreq) {
  2659. usb_ep_free_request(fsg->bulk_in, bh->inreq);
  2660. bh->inreq = NULL;
  2661. }
  2662. if (bh->outreq) {
  2663. usb_ep_free_request(fsg->bulk_out, bh->outreq);
  2664. bh->outreq = NULL;
  2665. }
  2666. }
  2667. if (fsg->intreq) {
  2668. usb_ep_free_request(fsg->intr_in, fsg->intreq);
  2669. fsg->intreq = NULL;
  2670. }
  2671. /* Disable the endpoints */
  2672. if (fsg->bulk_in_enabled) {
  2673. usb_ep_disable(fsg->bulk_in);
  2674. fsg->bulk_in_enabled = 0;
  2675. }
  2676. if (fsg->bulk_out_enabled) {
  2677. usb_ep_disable(fsg->bulk_out);
  2678. fsg->bulk_out_enabled = 0;
  2679. }
  2680. if (fsg->intr_in_enabled) {
  2681. usb_ep_disable(fsg->intr_in);
  2682. fsg->intr_in_enabled = 0;
  2683. }
  2684. fsg->running = 0;
  2685. if (altsetting < 0 || rc != 0)
  2686. return rc;
  2687. DBG(fsg, "set interface %d\n", altsetting);
  2688. /* Enable the endpoints */
  2689. d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
  2690. if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
  2691. goto reset;
  2692. fsg->bulk_in_enabled = 1;
  2693. d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
  2694. if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
  2695. goto reset;
  2696. fsg->bulk_out_enabled = 1;
  2697. fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
  2698. if (transport_is_cbi()) {
  2699. d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
  2700. if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
  2701. goto reset;
  2702. fsg->intr_in_enabled = 1;
  2703. }
  2704. /* Allocate the requests */
  2705. for (i = 0; i < NUM_BUFFERS; ++i) {
  2706. struct fsg_buffhd *bh = &fsg->buffhds[i];
  2707. if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
  2708. goto reset;
  2709. if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
  2710. goto reset;
  2711. bh->inreq->buf = bh->outreq->buf = bh->buf;
  2712. bh->inreq->dma = bh->outreq->dma = bh->dma;
  2713. bh->inreq->context = bh->outreq->context = bh;
  2714. bh->inreq->complete = bulk_in_complete;
  2715. bh->outreq->complete = bulk_out_complete;
  2716. }
  2717. if (transport_is_cbi()) {
  2718. if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
  2719. goto reset;
  2720. fsg->intreq->complete = intr_in_complete;
  2721. }
  2722. fsg->running = 1;
  2723. for (i = 0; i < fsg->nluns; ++i)
  2724. fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
  2725. return rc;
  2726. }
  2727. /*
  2728. * Change our operational configuration. This code must agree with the code
  2729. * that returns config descriptors, and with interface altsetting code.
  2730. *
  2731. * It's also responsible for power management interactions. Some
  2732. * configurations might not work with our current power sources.
  2733. * For now we just assume the gadget is always self-powered.
  2734. */
  2735. static int do_set_config(struct fsg_dev *fsg, u8 new_config)
  2736. {
  2737. int rc = 0;
  2738. /* Disable the single interface */
  2739. if (fsg->config != 0) {
  2740. DBG(fsg, "reset config\n");
  2741. fsg->config = 0;
  2742. rc = do_set_interface(fsg, -1);
  2743. }
  2744. /* Enable the interface */
  2745. if (new_config != 0) {
  2746. fsg->config = new_config;
  2747. if ((rc = do_set_interface(fsg, 0)) != 0)
  2748. fsg->config = 0; // Reset on errors
  2749. else {
  2750. char *speed;
  2751. switch (fsg->gadget->speed) {
  2752. case USB_SPEED_LOW: speed = "low"; break;
  2753. case USB_SPEED_FULL: speed = "full"; break;
  2754. case USB_SPEED_HIGH: speed = "high"; break;
  2755. default: speed = "?"; break;
  2756. }
  2757. INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
  2758. }
  2759. }
  2760. return rc;
  2761. }
  2762. /*-------------------------------------------------------------------------*/
  2763. static void handle_exception(struct fsg_dev *fsg)
  2764. {
  2765. siginfo_t info;
  2766. int sig;
  2767. int i;
  2768. int num_active;
  2769. struct fsg_buffhd *bh;
  2770. enum fsg_state old_state;
  2771. u8 new_config;
  2772. struct lun *curlun;
  2773. unsigned int exception_req_tag;
  2774. int rc;
  2775. /* Clear the existing signals. Anything but SIGUSR1 is converted
  2776. * into a high-priority EXIT exception. */
  2777. for (;;) {
  2778. sig = dequeue_signal_lock(current, &fsg->thread_signal_mask,
  2779. &info);
  2780. if (!sig)
  2781. break;
  2782. if (sig != SIGUSR1) {
  2783. if (fsg->state < FSG_STATE_EXIT)
  2784. DBG(fsg, "Main thread exiting on signal\n");
  2785. raise_exception(fsg, FSG_STATE_EXIT);
  2786. }
  2787. }
  2788. /* Cancel all the pending transfers */
  2789. if (fsg->intreq_busy)
  2790. usb_ep_dequeue(fsg->intr_in, fsg->intreq);
  2791. for (i = 0; i < NUM_BUFFERS; ++i) {
  2792. bh = &fsg->buffhds[i];
  2793. if (bh->inreq_busy)
  2794. usb_ep_dequeue(fsg->bulk_in, bh->inreq);
  2795. if (bh->outreq_busy)
  2796. usb_ep_dequeue(fsg->bulk_out, bh->outreq);
  2797. }
  2798. /* Wait until everything is idle */
  2799. for (;;) {
  2800. num_active = fsg->intreq_busy;
  2801. for (i = 0; i < NUM_BUFFERS; ++i) {
  2802. bh = &fsg->buffhds[i];
  2803. num_active += bh->inreq_busy + bh->outreq_busy;
  2804. }
  2805. if (num_active == 0)
  2806. break;
  2807. if (sleep_thread(fsg))
  2808. return;
  2809. }
  2810. /* Clear out the controller's fifos */
  2811. if (fsg->bulk_in_enabled)
  2812. usb_ep_fifo_flush(fsg->bulk_in);
  2813. if (fsg->bulk_out_enabled)
  2814. usb_ep_fifo_flush(fsg->bulk_out);
  2815. if (fsg->intr_in_enabled)
  2816. usb_ep_fifo_flush(fsg->intr_in);
  2817. /* Reset the I/O buffer states and pointers, the SCSI
  2818. * state, and the exception. Then invoke the handler. */
  2819. spin_lock_irq(&fsg->lock);
  2820. for (i = 0; i < NUM_BUFFERS; ++i) {
  2821. bh = &fsg->buffhds[i];
  2822. bh->state = BUF_STATE_EMPTY;
  2823. }
  2824. fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
  2825. &fsg->buffhds[0];
  2826. exception_req_tag = fsg->exception_req_tag;
  2827. new_config = fsg->new_config;
  2828. old_state = fsg->state;
  2829. if (old_state == FSG_STATE_ABORT_BULK_OUT)
  2830. fsg->state = FSG_STATE_STATUS_PHASE;
  2831. else {
  2832. for (i = 0; i < fsg->nluns; ++i) {
  2833. curlun = &fsg->luns[i];
  2834. curlun->prevent_medium_removal = 0;
  2835. curlun->sense_data = curlun->unit_attention_data =
  2836. SS_NO_SENSE;
  2837. curlun->sense_data_info = 0;
  2838. curlun->info_valid = 0;
  2839. }
  2840. fsg->state = FSG_STATE_IDLE;
  2841. }
  2842. spin_unlock_irq(&fsg->lock);
  2843. /* Carry out any extra actions required for the exception */
  2844. switch (old_state) {
  2845. default:
  2846. break;
  2847. case FSG_STATE_ABORT_BULK_OUT:
  2848. send_status(fsg);
  2849. spin_lock_irq(&fsg->lock);
  2850. if (fsg->state == FSG_STATE_STATUS_PHASE)
  2851. fsg->state = FSG_STATE_IDLE;
  2852. spin_unlock_irq(&fsg->lock);
  2853. break;
  2854. case FSG_STATE_RESET:
  2855. /* In case we were forced against our will to halt a
  2856. * bulk endpoint, clear the halt now. (The SuperH UDC
  2857. * requires this.) */
  2858. if (test_and_clear_bit(CLEAR_BULK_HALTS,
  2859. &fsg->atomic_bitflags)) {
  2860. usb_ep_clear_halt(fsg->bulk_in);
  2861. usb_ep_clear_halt(fsg->bulk_out);
  2862. }
  2863. if (transport_is_bbb()) {
  2864. if (fsg->ep0_req_tag == exception_req_tag)
  2865. ep0_queue(fsg); // Complete the status stage
  2866. } else if (transport_is_cbi())
  2867. send_status(fsg); // Status by interrupt pipe
  2868. /* Technically this should go here, but it would only be
  2869. * a waste of time. Ditto for the INTERFACE_CHANGE and
  2870. * CONFIG_CHANGE cases. */
  2871. // for (i = 0; i < fsg->nluns; ++i)
  2872. // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
  2873. break;
  2874. case FSG_STATE_INTERFACE_CHANGE:
  2875. rc = do_set_interface(fsg, 0);
  2876. if (fsg->ep0_req_tag != exception_req_tag)
  2877. break;
  2878. if (rc != 0) // STALL on errors
  2879. fsg_set_halt(fsg, fsg->ep0);
  2880. else // Complete the status stage
  2881. ep0_queue(fsg);
  2882. break;
  2883. case FSG_STATE_CONFIG_CHANGE:
  2884. rc = do_set_config(fsg, new_config);
  2885. if (fsg->ep0_req_tag != exception_req_tag)
  2886. break;
  2887. if (rc != 0) // STALL on errors
  2888. fsg_set_halt(fsg, fsg->ep0);
  2889. else // Complete the status stage
  2890. ep0_queue(fsg);
  2891. break;
  2892. case FSG_STATE_DISCONNECT:
  2893. fsync_all(fsg);
  2894. do_set_config(fsg, 0); // Unconfigured state
  2895. break;
  2896. case FSG_STATE_EXIT:
  2897. case FSG_STATE_TERMINATED:
  2898. do_set_config(fsg, 0); // Free resources
  2899. spin_lock_irq(&fsg->lock);
  2900. fsg->state = FSG_STATE_TERMINATED; // Stop the thread
  2901. spin_unlock_irq(&fsg->lock);
  2902. break;
  2903. }
  2904. }
  2905. /*-------------------------------------------------------------------------*/
  2906. static int fsg_main_thread(void *fsg_)
  2907. {
  2908. struct fsg_dev *fsg = fsg_;
  2909. /* Allow the thread to be killed by a signal, but set the signal mask
  2910. * to block everything but INT, TERM, KILL, and USR1. */
  2911. siginitsetinv(&fsg->thread_signal_mask, sigmask(SIGINT) |
  2912. sigmask(SIGTERM) | sigmask(SIGKILL) |
  2913. sigmask(SIGUSR1));
  2914. sigprocmask(SIG_SETMASK, &fsg->thread_signal_mask, NULL);
  2915. /* Arrange for userspace references to be interpreted as kernel
  2916. * pointers. That way we can pass a kernel pointer to a routine
  2917. * that expects a __user pointer and it will work okay. */
  2918. set_fs(get_ds());
  2919. /* The main loop */
  2920. while (fsg->state != FSG_STATE_TERMINATED) {
  2921. if (exception_in_progress(fsg) || signal_pending(current)) {
  2922. handle_exception(fsg);
  2923. continue;
  2924. }
  2925. if (!fsg->running) {
  2926. sleep_thread(fsg);
  2927. continue;
  2928. }
  2929. if (get_next_command(fsg))
  2930. continue;
  2931. spin_lock_irq(&fsg->lock);
  2932. if (!exception_in_progress(fsg))
  2933. fsg->state = FSG_STATE_DATA_PHASE;
  2934. spin_unlock_irq(&fsg->lock);
  2935. if (do_scsi_command(fsg) || finish_reply(fsg))
  2936. continue;
  2937. spin_lock_irq(&fsg->lock);
  2938. if (!exception_in_progress(fsg))
  2939. fsg->state = FSG_STATE_STATUS_PHASE;
  2940. spin_unlock_irq(&fsg->lock);
  2941. if (send_status(fsg))
  2942. continue;
  2943. spin_lock_irq(&fsg->lock);
  2944. if (!exception_in_progress(fsg))
  2945. fsg->state = FSG_STATE_IDLE;
  2946. spin_unlock_irq(&fsg->lock);
  2947. }
  2948. spin_lock_irq(&fsg->lock);
  2949. fsg->thread_task = NULL;
  2950. spin_unlock_irq(&fsg->lock);
  2951. /* In case we are exiting because of a signal, unregister the
  2952. * gadget driver and close the backing file. */
  2953. if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) {
  2954. usb_gadget_unregister_driver(&fsg_driver);
  2955. close_all_backing_files(fsg);
  2956. }
  2957. /* Let the unbind and cleanup routines know the thread has exited */
  2958. complete_and_exit(&fsg->thread_notifier, 0);
  2959. }
  2960. /*-------------------------------------------------------------------------*/
  2961. /* If the next two routines are called while the gadget is registered,
  2962. * the caller must own fsg->filesem for writing. */
  2963. static int open_backing_file(struct lun *curlun, const char *filename)
  2964. {
  2965. int ro;
  2966. struct file *filp = NULL;
  2967. int rc = -EINVAL;
  2968. struct inode *inode = NULL;
  2969. loff_t size;
  2970. loff_t num_sectors;
  2971. /* R/W if we can, R/O if we must */
  2972. ro = curlun->ro;
  2973. if (!ro) {
  2974. filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
  2975. if (-EROFS == PTR_ERR(filp))
  2976. ro = 1;
  2977. }
  2978. if (ro)
  2979. filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
  2980. if (IS_ERR(filp)) {
  2981. LINFO(curlun, "unable to open backing file: %s\n", filename);
  2982. return PTR_ERR(filp);
  2983. }
  2984. if (!(filp->f_mode & FMODE_WRITE))
  2985. ro = 1;
  2986. if (filp->f_path.dentry)
  2987. inode = filp->f_path.dentry->d_inode;
  2988. if (inode && S_ISBLK(inode->i_mode)) {
  2989. if (bdev_read_only(inode->i_bdev))
  2990. ro = 1;
  2991. } else if (!inode || !S_ISREG(inode->i_mode)) {
  2992. LINFO(curlun, "invalid file type: %s\n", filename);
  2993. goto out;
  2994. }
  2995. /* If we can't read the file, it's no good.
  2996. * If we can't write the file, use it read-only. */
  2997. if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
  2998. LINFO(curlun, "file not readable: %s\n", filename);
  2999. goto out;
  3000. }
  3001. if (!(filp->f_op->write || filp->f_op->aio_write))
  3002. ro = 1;
  3003. size = i_size_read(inode->i_mapping->host);
  3004. if (size < 0) {
  3005. LINFO(curlun, "unable to find file size: %s\n", filename);
  3006. rc = (int) size;
  3007. goto out;
  3008. }
  3009. num_sectors = size >> 9; // File size in 512-byte sectors
  3010. if (num_sectors == 0) {
  3011. LINFO(curlun, "file too small: %s\n", filename);
  3012. rc = -ETOOSMALL;
  3013. goto out;
  3014. }
  3015. get_file(filp);
  3016. curlun->ro = ro;
  3017. curlun->filp = filp;
  3018. curlun->file_length = size;
  3019. curlun->num_sectors = num_sectors;
  3020. LDBG(curlun, "open backing file: %s\n", filename);
  3021. rc = 0;
  3022. out:
  3023. filp_close(filp, current->files);
  3024. return rc;
  3025. }
  3026. static void close_backing_file(struct lun *curlun)
  3027. {
  3028. if (curlun->filp) {
  3029. LDBG(curlun, "close backing file\n");
  3030. fput(curlun->filp);
  3031. curlun->filp = NULL;
  3032. }
  3033. }
  3034. static void close_all_backing_files(struct fsg_dev *fsg)
  3035. {
  3036. int i;
  3037. for (i = 0; i < fsg->nluns; ++i)
  3038. close_backing_file(&fsg->luns[i]);
  3039. }
  3040. static ssize_t show_ro(struct device *dev, struct device_attribute *attr, char *buf)
  3041. {
  3042. struct lun *curlun = dev_to_lun(dev);
  3043. return sprintf(buf, "%d\n", curlun->ro);
  3044. }
  3045. static ssize_t show_file(struct device *dev, struct device_attribute *attr, char *buf)
  3046. {
  3047. struct lun *curlun = dev_to_lun(dev);
  3048. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3049. char *p;
  3050. ssize_t rc;
  3051. down_read(&fsg->filesem);
  3052. if (backing_file_is_open(curlun)) { // Get the complete pathname
  3053. p = d_path(curlun->filp->f_path.dentry, curlun->filp->f_path.mnt,
  3054. buf, PAGE_SIZE - 1);
  3055. if (IS_ERR(p))
  3056. rc = PTR_ERR(p);
  3057. else {
  3058. rc = strlen(p);
  3059. memmove(buf, p, rc);
  3060. buf[rc] = '\n'; // Add a newline
  3061. buf[++rc] = 0;
  3062. }
  3063. } else { // No file, return 0 bytes
  3064. *buf = 0;
  3065. rc = 0;
  3066. }
  3067. up_read(&fsg->filesem);
  3068. return rc;
  3069. }
  3070. static ssize_t show_status(struct device *dev, struct device_attribute *attr, char *buf)
  3071. {
  3072. struct lun *curlun = dev_to_lun(dev);
  3073. return sprintf(buf, "%d\n", curlun->status);
  3074. }
  3075. static ssize_t store_ro(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
  3076. {
  3077. ssize_t rc = count;
  3078. struct lun *curlun = dev_to_lun(dev);
  3079. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3080. int i;
  3081. if (sscanf(buf, "%d", &i) != 1)
  3082. return -EINVAL;
  3083. /* Allow the write-enable status to change only while the backing file
  3084. * is closed. */
  3085. down_read(&fsg->filesem);
  3086. if (backing_file_is_open(curlun)) {
  3087. LDBG(curlun, "read-only status change prevented\n");
  3088. rc = -EBUSY;
  3089. } else {
  3090. curlun->ro = !!i;
  3091. LDBG(curlun, "read-only status set to %d\n", curlun->ro);
  3092. }
  3093. up_read(&fsg->filesem);
  3094. return rc;
  3095. }
  3096. static ssize_t store_status(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
  3097. {
  3098. return 0;
  3099. }
  3100. static ssize_t store_file(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
  3101. {
  3102. struct lun *curlun = dev_to_lun(dev);
  3103. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3104. int rc = 0;
  3105. #if 0 /* Current hardware can't prevent remove */
  3106. if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
  3107. LDBG(curlun, "eject attempt prevented\n");
  3108. return -EBUSY; // "Door is locked"
  3109. } /* If file[] is NULL, then the media has been physically removed, we can't allow access to it */
  3110. #endif
  3111. LDBG(curlun, "Will try to mount floppy [%p] '%s'\n", buf, buf);
  3112. /* Remove a trailing newline */
  3113. if (count > 0 && buf[count-1] == '\n')
  3114. ((char *) buf)[count-1] = 0; // Ugh!
  3115. /* Eject current medium */
  3116. down_write(&fsg->filesem);
  3117. if (backing_file_is_open(curlun)) {
  3118. LDBG(curlun, "There is currently a floppy.. Eject it before...\n");
  3119. close_backing_file(curlun);
  3120. curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
  3121. }
  3122. /* Load new medium */
  3123. if (count > 0 && buf[0]) {
  3124. LDBG(curlun, "File name is valide, now insert floppy...\n");
  3125. rc = open_backing_file(curlun, buf);
  3126. if (rc == 0)
  3127. curlun->unit_attention_data =
  3128. SS_NOT_READY_TO_READY_TRANSITION;
  3129. }
  3130. up_write(&fsg->filesem);
  3131. return (rc < 0 ? rc : count);
  3132. }
  3133. /* The write permissions and store_xxx pointers are set in fsg_bind() */
  3134. static DEVICE_ATTR(ro, 0444, show_ro, NULL);
  3135. static DEVICE_ATTR(file, 0444, show_file, NULL);
  3136. static DEVICE_ATTR(status, 0444, show_status, NULL);
  3137. /*-------------------------------------------------------------------------*/
  3138. static void fsg_release(struct kref *ref)
  3139. {
  3140. struct fsg_dev *fsg = container_of(ref, struct fsg_dev, ref);
  3141. kfree(fsg->luns);
  3142. kfree(fsg);
  3143. }
  3144. static void lun_release(struct device *dev)
  3145. {
  3146. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3147. kref_put(&fsg->ref, fsg_release);
  3148. }
  3149. static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
  3150. {
  3151. struct fsg_dev *fsg = get_gadget_data(gadget);
  3152. int i;
  3153. struct lun *curlun;
  3154. struct usb_request *req = fsg->ep0req;
  3155. DBG(fsg, "unbind\n");
  3156. clear_bit(REGISTERED, &fsg->atomic_bitflags);
  3157. /* Unregister the sysfs attribute files and the LUNs */
  3158. for (i = 0; i < fsg->nluns; ++i) {
  3159. curlun = &fsg->luns[i];
  3160. if (curlun->registered) {
  3161. device_remove_file(&curlun->dev, &dev_attr_ro);
  3162. device_remove_file(&curlun->dev, &dev_attr_file);
  3163. device_remove_file(&curlun->dev, &dev_attr_status);
  3164. device_unregister(&curlun->dev);
  3165. curlun->registered = 0;
  3166. }
  3167. }
  3168. /* If the thread isn't already dead, tell it to exit now */
  3169. if (fsg->state != FSG_STATE_TERMINATED) {
  3170. raise_exception(fsg, FSG_STATE_EXIT);
  3171. wait_for_completion(&fsg->thread_notifier);
  3172. /* The cleanup routine waits for this completion also */
  3173. complete(&fsg->thread_notifier);
  3174. }
  3175. /* Free the data buffers */
  3176. for (i = 0; i < NUM_BUFFERS; ++i) {
  3177. struct fsg_buffhd *bh = &fsg->buffhds[i];
  3178. if (bh->buf)
  3179. usb_ep_free_buffer(fsg->bulk_in, bh->buf, bh->dma,
  3180. mod_data.buflen);
  3181. }
  3182. /* Free the request and buffer for endpoint 0 */
  3183. if (req) {
  3184. if (req->buf)
  3185. usb_ep_free_buffer(fsg->ep0, req->buf,
  3186. req->dma, EP0_BUFSIZE);
  3187. usb_ep_free_request(fsg->ep0, req);
  3188. }
  3189. set_gadget_data(gadget, NULL);
  3190. }
  3191. static int __init check_parameters(struct fsg_dev *fsg)
  3192. {
  3193. int prot;
  3194. int gcnum;
  3195. /* Store the default values */
  3196. mod_data.transport_type = USB_PR_BULK;
  3197. mod_data.transport_name = "Bulk-only";
  3198. mod_data.protocol_type = USB_SC_SCSI;
  3199. mod_data.protocol_name = "Transparent SCSI";
  3200. if (gadget_is_sh(fsg->gadget))
  3201. mod_data.can_stall = 0;
  3202. if (mod_data.release == 0xffff) { // Parameter wasn't set
  3203. /* The sa1100 controller is not supported */
  3204. if (gadget_is_sa1100(fsg->gadget))
  3205. gcnum = -1;
  3206. else
  3207. gcnum = usb_gadget_controller_number(fsg->gadget);
  3208. if (gcnum >= 0)
  3209. mod_data.release = 0x0300 + gcnum;
  3210. else {
  3211. WARN(fsg, "controller '%s' not recognized\n",
  3212. fsg->gadget->name);
  3213. mod_data.release = 0x0399;
  3214. }
  3215. }
  3216. prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
  3217. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  3218. if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
  3219. ; // Use default setting
  3220. } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
  3221. mod_data.transport_type = USB_PR_CB;
  3222. mod_data.transport_name = "Control-Bulk";
  3223. } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
  3224. mod_data.transport_type = USB_PR_CBI;
  3225. mod_data.transport_name = "Control-Bulk-Interrupt";
  3226. } else {
  3227. ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
  3228. return -EINVAL;
  3229. }
  3230. if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
  3231. prot == USB_SC_SCSI) {
  3232. ; // Use default setting
  3233. } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
  3234. prot == USB_SC_RBC) {
  3235. mod_data.protocol_type = USB_SC_RBC;
  3236. mod_data.protocol_name = "RBC";
  3237. } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
  3238. strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
  3239. prot == USB_SC_8020) {
  3240. mod_data.protocol_type = USB_SC_8020;
  3241. mod_data.protocol_name = "8020i (ATAPI)";
  3242. } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
  3243. prot == USB_SC_QIC) {
  3244. mod_data.protocol_type = USB_SC_QIC;
  3245. mod_data.protocol_name = "QIC-157";
  3246. } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
  3247. prot == USB_SC_UFI) {
  3248. mod_data.protocol_type = USB_SC_UFI;
  3249. mod_data.protocol_name = "UFI";
  3250. } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
  3251. prot == USB_SC_8070) {
  3252. mod_data.protocol_type = USB_SC_8070;
  3253. mod_data.protocol_name = "8070i";
  3254. } else {
  3255. ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
  3256. return -EINVAL;
  3257. }
  3258. mod_data.buflen &= PAGE_CACHE_MASK;
  3259. if (mod_data.buflen <= 0) {
  3260. ERROR(fsg, "invalid buflen\n");
  3261. return -ETOOSMALL;
  3262. }
  3263. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  3264. return 0;
  3265. }
  3266. static int __init fsg_bind(struct usb_gadget *gadget)
  3267. {
  3268. struct fsg_dev *fsg = the_fsg;
  3269. int rc;
  3270. int i;
  3271. struct lun *curlun;
  3272. struct usb_ep *ep;
  3273. struct usb_request *req;
  3274. char *pathbuf, *p;
  3275. fsg->gadget = gadget;
  3276. set_gadget_data(gadget, fsg);
  3277. fsg->ep0 = gadget->ep0;
  3278. fsg->ep0->driver_data = fsg;
  3279. if ((rc = check_parameters(fsg)) != 0)
  3280. goto out;
  3281. if (mod_data.removable) { // Enable the store_xxx attributes
  3282. dev_attr_ro.attr.mode = dev_attr_file.attr.mode = 0664;
  3283. dev_attr_status.attr.mode = 0444;
  3284. dev_attr_ro.store = store_ro;
  3285. dev_attr_file.store = store_file;
  3286. dev_attr_status.store = store_status;
  3287. }
  3288. /* Find out how many LUNs there should be */
  3289. i = mod_data.nluns;
  3290. if (i == 0)
  3291. i = max(mod_data.num_filenames, 1);
  3292. if (i > MAX_LUNS) {
  3293. ERROR(fsg, "invalid number of LUNs: %d\n", i);
  3294. rc = -EINVAL;
  3295. goto out;
  3296. }
  3297. /* Create the LUNs, open their backing files, and register the
  3298. * LUN devices in sysfs. */
  3299. fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
  3300. if (!fsg->luns) {
  3301. rc = -ENOMEM;
  3302. goto out;
  3303. }
  3304. fsg->nluns = i;
  3305. for (i = 0; i < fsg->nluns; ++i) {
  3306. curlun = &fsg->luns[i];
  3307. curlun->ro = mod_data.ro[i];
  3308. curlun->dev.release = lun_release;
  3309. curlun->dev.parent = &gadget->dev;
  3310. curlun->dev.driver = &fsg_driver.driver;
  3311. dev_set_drvdata(&curlun->dev, fsg);
  3312. snprintf(curlun->dev.bus_id, BUS_ID_SIZE,
  3313. "%s-lun%d", gadget->dev.bus_id, i);
  3314. if ((rc = device_register(&curlun->dev)) != 0) {
  3315. INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
  3316. goto out;
  3317. }
  3318. if ((rc = device_create_file(&curlun->dev,
  3319. &dev_attr_ro)) != 0 ||
  3320. (rc = device_create_file(&curlun->dev,
  3321. &dev_attr_file)) != 0 ||
  3322. (rc = device_create_file(&curlun->dev,
  3323. &dev_attr_status)) != 0) {
  3324. device_unregister(&curlun->dev);
  3325. goto out;
  3326. }
  3327. curlun->id = i;
  3328. curlun->registered = 1;
  3329. kref_get(&fsg->ref);
  3330. if (mod_data.file[i] && *mod_data.file[i]) {
  3331. if ((rc = open_backing_file(curlun,
  3332. mod_data.file[i])) != 0)
  3333. goto out;
  3334. } else if (!mod_data.removable) {
  3335. ERROR(fsg, "no file given for LUN%d\n", i);
  3336. rc = -EINVAL;
  3337. goto out;
  3338. }
  3339. }
  3340. /* Find all the endpoints we will use */
  3341. usb_ep_autoconfig_reset(gadget);
  3342. ep = usb_ep_autoconfig(gadget, &fs_bulk_in_desc);
  3343. if (!ep)
  3344. goto autoconf_fail;
  3345. ep->driver_data = fsg; // claim the endpoint
  3346. fsg->bulk_in = ep;
  3347. ep = usb_ep_autoconfig(gadget, &fs_bulk_out_desc);
  3348. if (!ep)
  3349. goto autoconf_fail;
  3350. ep->driver_data = fsg; // claim the endpoint
  3351. fsg->bulk_out = ep;
  3352. if (transport_is_cbi()) {
  3353. ep = usb_ep_autoconfig(gadget, &fs_intr_in_desc);
  3354. if (!ep)
  3355. goto autoconf_fail;
  3356. ep->driver_data = fsg; // claim the endpoint
  3357. fsg->intr_in = ep;
  3358. }
  3359. /* Fix up the descriptors */
  3360. device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
  3361. device_desc.idVendor = cpu_to_le16(mod_data.vendor);
  3362. device_desc.idProduct = cpu_to_le16(mod_data.product);
  3363. device_desc.bcdDevice = cpu_to_le16(mod_data.release);
  3364. i = (transport_is_cbi() ? 3 : 2); // Number of endpoints
  3365. intf_desc.bNumEndpoints = i;
  3366. intf_desc.bInterfaceSubClass = mod_data.protocol_type;
  3367. intf_desc.bInterfaceProtocol = mod_data.transport_type;
  3368. fs_function[i + FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
  3369. #ifdef CONFIG_USB_GADGET_DUALSPEED
  3370. hs_function[i + HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
  3371. /* Assume ep0 uses the same maxpacket value for both speeds */
  3372. dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
  3373. /* Assume that all endpoint addresses are the same for both speeds */
  3374. hs_bulk_in_desc.bEndpointAddress = fs_bulk_in_desc.bEndpointAddress;
  3375. hs_bulk_out_desc.bEndpointAddress = fs_bulk_out_desc.bEndpointAddress;
  3376. hs_intr_in_desc.bEndpointAddress = fs_intr_in_desc.bEndpointAddress;
  3377. #endif
  3378. if (gadget->is_otg) {
  3379. otg_desc.bmAttributes |= USB_OTG_HNP,
  3380. config_desc.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
  3381. }
  3382. rc = -ENOMEM;
  3383. /* Allocate the request and buffer for endpoint 0 */
  3384. fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
  3385. if (!req)
  3386. goto out;
  3387. req->buf = usb_ep_alloc_buffer(fsg->ep0, EP0_BUFSIZE,
  3388. &req->dma, GFP_KERNEL);
  3389. if (!req->buf)
  3390. goto out;
  3391. req->complete = ep0_complete;
  3392. /* Allocate the data buffers */
  3393. for (i = 0; i < NUM_BUFFERS; ++i) {
  3394. struct fsg_buffhd *bh = &fsg->buffhds[i];
  3395. /* Allocate for the bulk-in endpoint. We assume that
  3396. * the buffer will also work with the bulk-out (and
  3397. * interrupt-in) endpoint. */
  3398. bh->buf = usb_ep_alloc_buffer(fsg->bulk_in, mod_data.buflen,
  3399. &bh->dma, GFP_KERNEL);
  3400. if (!bh->buf)
  3401. goto out;
  3402. bh->next = bh + 1;
  3403. }
  3404. fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
  3405. /* This should reflect the actual gadget power source */
  3406. usb_gadget_set_selfpowered(gadget);
  3407. #if 0
  3408. snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
  3409. init_utsname()->sysname, init_utsname()->release,
  3410. gadget->name);
  3411. #else
  3412. snprintf(manufacturer, sizeof manufacturer, "Bookeen");
  3413. #endif
  3414. /* On a real device, serial[] would be loaded from permanent
  3415. * storage. We just encode it from the driver version string. */
  3416. for (i = 0; i < sizeof(serial) - 2; i += 2) {
  3417. #if 0
  3418. unsigned char c = DRIVER_VERSION[i / 2];
  3419. #else
  3420. unsigned char c = mod_data.serial[i / 2];
  3421. #endif
  3422. if (!c)
  3423. break;
  3424. sprintf(&serial[i], "%02X", c);
  3425. }
  3426. fsg->thread_task = kthread_create(fsg_main_thread, fsg,
  3427. "file-storage-gadget");
  3428. if (IS_ERR(fsg->thread_task)) {
  3429. rc = PTR_ERR(fsg->thread_task);
  3430. goto out;
  3431. }
  3432. INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
  3433. INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
  3434. pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
  3435. for (i = 0; i < fsg->nluns; ++i) {
  3436. curlun = &fsg->luns[i];
  3437. if (backing_file_is_open(curlun)) {
  3438. p = NULL;
  3439. if (pathbuf) {
  3440. p = d_path(curlun->filp->f_path.dentry,
  3441. curlun->filp->f_path.mnt,
  3442. pathbuf, PATH_MAX);
  3443. if (IS_ERR(p))
  3444. p = NULL;
  3445. }
  3446. LINFO(curlun, "ro=%d, file: %s\n",
  3447. curlun->ro, (p ? p : "(error)"));
  3448. }
  3449. }
  3450. kfree(pathbuf);
  3451. DBG(fsg, "transport=%s (x%02x)\n",
  3452. mod_data.transport_name, mod_data.transport_type);
  3453. DBG(fsg, "protocol=%s (x%02x)\n",
  3454. mod_data.protocol_name, mod_data.protocol_type);
  3455. DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
  3456. mod_data.vendor, mod_data.product, mod_data.release);
  3457. DBG(fsg, "removable=%d, stall=%d, buflen=%u\n",
  3458. mod_data.removable, mod_data.can_stall,
  3459. mod_data.buflen);
  3460. DBG(fsg, "I/O thread pid: %d\n", fsg->thread_task->pid);
  3461. set_bit(REGISTERED, &fsg->atomic_bitflags);
  3462. /* Tell the thread to start working */
  3463. wake_up_process(fsg->thread_task);
  3464. return 0;
  3465. autoconf_fail:
  3466. ERROR(fsg, "unable to autoconfigure all endpoints\n");
  3467. rc = -ENOTSUPP;
  3468. out:
  3469. fsg->state = FSG_STATE_TERMINATED; // The thread is dead
  3470. fsg_unbind(gadget);
  3471. close_all_backing_files(fsg);
  3472. return rc;
  3473. }
  3474. /*-------------------------------------------------------------------------*/
  3475. static void fsg_suspend(struct usb_gadget *gadget)
  3476. {
  3477. struct fsg_dev *fsg = get_gadget_data(gadget);
  3478. DBG(fsg, "suspend\n");
  3479. set_bit(SUSPENDED, &fsg->atomic_bitflags);
  3480. }
  3481. static void fsg_resume(struct usb_gadget *gadget)
  3482. {
  3483. struct fsg_dev *fsg = get_gadget_data(gadget);
  3484. DBG(fsg, "resume\n");
  3485. clear_bit(SUSPENDED, &fsg->atomic_bitflags);
  3486. }
  3487. /*-------------------------------------------------------------------------*/
  3488. static struct usb_gadget_driver fsg_driver = {
  3489. #ifdef CONFIG_USB_GADGET_DUALSPEED
  3490. .speed = USB_SPEED_HIGH,
  3491. #else
  3492. .speed = USB_SPEED_FULL,
  3493. #endif
  3494. .function = (char *) longname,
  3495. .bind = fsg_bind,
  3496. .unbind = fsg_unbind,
  3497. .disconnect = fsg_disconnect,
  3498. .setup = fsg_setup,
  3499. .suspend = fsg_suspend,
  3500. .resume = fsg_resume,
  3501. .driver = {
  3502. .name = (char *) shortname,
  3503. .owner = THIS_MODULE,
  3504. // .release = ...
  3505. // .suspend = ...
  3506. // .resume = ...
  3507. },
  3508. };
  3509. static int __init fsg_alloc(void)
  3510. {
  3511. struct fsg_dev *fsg;
  3512. fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
  3513. if (!fsg)
  3514. return -ENOMEM;
  3515. spin_lock_init(&fsg->lock);
  3516. init_rwsem(&fsg->filesem);
  3517. kref_init(&fsg->ref);
  3518. init_completion(&fsg->thread_notifier);
  3519. the_fsg = fsg;
  3520. return 0;
  3521. }
  3522. static int __init fsg_init(void)
  3523. {
  3524. int rc;
  3525. struct fsg_dev *fsg;
  3526. if ((rc = fsg_alloc()) != 0)
  3527. return rc;
  3528. fsg = the_fsg;
  3529. if ((rc = usb_gadget_register_driver(&fsg_driver)) != 0)
  3530. kref_put(&fsg->ref, fsg_release);
  3531. return rc;
  3532. }
  3533. module_init(fsg_init);
  3534. static void __exit fsg_cleanup(void)
  3535. {
  3536. struct fsg_dev *fsg = the_fsg;
  3537. /* Unregister the driver iff the thread hasn't already done so */
  3538. if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
  3539. usb_gadget_unregister_driver(&fsg_driver);
  3540. /* Wait for the thread to finish up */
  3541. wait_for_completion(&fsg->thread_notifier);
  3542. close_all_backing_files(fsg);
  3543. kref_put(&fsg->ref, fsg_release);
  3544. }
  3545. module_exit(fsg_cleanup);