file_storage.c 114 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151
  1. /*
  2. * file_storage.c -- File-backed USB Storage Gadget, for USB development
  3. *
  4. * Copyright (C) 2003-2007 Alan Stern
  5. * All rights reserved.
  6. *
  7. * Redistribution and use in source and binary forms, with or without
  8. * modification, are permitted provided that the following conditions
  9. * are met:
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions, and the following disclaimer,
  12. * without modification.
  13. * 2. Redistributions in binary form must reproduce the above copyright
  14. * notice, this list of conditions and the following disclaimer in the
  15. * documentation and/or other materials provided with the distribution.
  16. * 3. The names of the above-listed copyright holders may not be used
  17. * to endorse or promote products derived from this software without
  18. * specific prior written permission.
  19. *
  20. * ALTERNATIVELY, this software may be distributed under the terms of the
  21. * GNU General Public License ("GPL") as published by the Free Software
  22. * Foundation, either version 2 of that License or (at your option) any
  23. * later version.
  24. *
  25. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
  26. * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  27. * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  29. * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  30. * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  31. * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  32. * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  33. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  34. * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  35. * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  36. */
  37. /*
  38. * The File-backed Storage Gadget acts as a USB Mass Storage device,
  39. * appearing to the host as a disk drive. In addition to providing an
  40. * example of a genuinely useful gadget driver for a USB device, it also
  41. * illustrates a technique of double-buffering for increased throughput.
  42. * Last but not least, it gives an easy way to probe the behavior of the
  43. * Mass Storage drivers in a USB host.
  44. *
  45. * Backing storage is provided by a regular file or a block device, specified
  46. * by the "file" module parameter. Access can be limited to read-only by
  47. * setting the optional "ro" module parameter. The gadget will indicate that
  48. * it has removable media if the optional "removable" module parameter is set.
  49. *
  50. * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
  51. * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
  52. * by the optional "transport" module parameter. It also supports the
  53. * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
  54. * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
  55. * the optional "protocol" module parameter. In addition, the default
  56. * Vendor ID, Product ID, and release number can be overridden.
  57. *
  58. * There is support for multiple logical units (LUNs), each of which has
  59. * its own backing file. The number of LUNs can be set using the optional
  60. * "luns" module parameter (anywhere from 1 to 8), and the corresponding
  61. * files are specified using comma-separated lists for "file" and "ro".
  62. * The default number of LUNs is taken from the number of "file" elements;
  63. * it is 1 if "file" is not given. If "removable" is not set then a backing
  64. * file must be specified for each LUN. If it is set, then an unspecified
  65. * or empty backing filename means the LUN's medium is not loaded.
  66. *
  67. * Requirements are modest; only a bulk-in and a bulk-out endpoint are
  68. * needed (an interrupt-out endpoint is also needed for CBI). The memory
  69. * requirement amounts to two 16K buffers, size configurable by a parameter.
  70. * Support is included for both full-speed and high-speed operation.
  71. *
  72. * Note that the driver is slightly non-portable in that it assumes a
  73. * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
  74. * interrupt-in endpoints. With most device controllers this isn't an
  75. * issue, but there may be some with hardware restrictions that prevent
  76. * a buffer from being used by more than one endpoint.
  77. *
  78. * Module options:
  79. *
  80. * file=filename[,filename...]
  81. * Required if "removable" is not set, names of
  82. * the files or block devices used for
  83. * backing storage
  84. * ro=b[,b...] Default false, booleans for read-only access
  85. * removable Default false, boolean for removable media
  86. * luns=N Default N = number of filenames, number of
  87. * LUNs to support
  88. * stall Default determined according to the type of
  89. * USB device controller (usually true),
  90. * boolean to permit the driver to halt
  91. * bulk endpoints
  92. * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
  93. * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
  94. * ATAPI, QIC, UFI, 8070, or SCSI;
  95. * also 1 - 6)
  96. * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
  97. * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
  98. * release=0xRRRR Override the USB release number (bcdDevice)
  99. * buflen=N Default N=16384, buffer size used (will be
  100. * rounded down to a multiple of
  101. * PAGE_CACHE_SIZE)
  102. *
  103. * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
  104. * "removable", "luns", and "stall" options are available; default values
  105. * are used for everything else.
  106. *
  107. * The pathnames of the backing files and the ro settings are available in
  108. * the attribute files "file" and "ro" in the lun<n> subdirectory of the
  109. * gadget's sysfs directory. If the "removable" option is set, writing to
  110. * these files will simulate ejecting/loading the medium (writing an empty
  111. * line means eject) and adjusting a write-enable tab. Changes to the ro
  112. * setting are not allowed when the medium is loaded.
  113. *
  114. * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
  115. * The driver's SCSI command interface was based on the "Information
  116. * technology - Small Computer System Interface - 2" document from
  117. * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
  118. * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
  119. * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
  120. * "Universal Serial Bus Mass Storage Class UFI Command Specification"
  121. * document, Revision 1.0, December 14, 1998, available at
  122. * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
  123. */
  124. /*
  125. * Driver Design
  126. *
  127. * The FSG driver is fairly straightforward. There is a main kernel
  128. * thread that handles most of the work. Interrupt routines field
  129. * callbacks from the controller driver: bulk- and interrupt-request
  130. * completion notifications, endpoint-0 events, and disconnect events.
  131. * Completion events are passed to the main thread by wakeup calls. Many
  132. * ep0 requests are handled at interrupt time, but SetInterface,
  133. * SetConfiguration, and device reset requests are forwarded to the
  134. * thread in the form of "exceptions" using SIGUSR1 signals (since they
  135. * should interrupt any ongoing file I/O operations).
  136. *
  137. * The thread's main routine implements the standard command/data/status
  138. * parts of a SCSI interaction. It and its subroutines are full of tests
  139. * for pending signals/exceptions -- all this polling is necessary since
  140. * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
  141. * indication that the driver really wants to be running in userspace.)
  142. * An important point is that so long as the thread is alive it keeps an
  143. * open reference to the backing file. This will prevent unmounting
  144. * the backing file's underlying filesystem and could cause problems
  145. * during system shutdown, for example. To prevent such problems, the
  146. * thread catches INT, TERM, and KILL signals and converts them into
  147. * an EXIT exception.
  148. *
  149. * In normal operation the main thread is started during the gadget's
  150. * fsg_bind() callback and stopped during fsg_unbind(). But it can also
  151. * exit when it receives a signal, and there's no point leaving the
  152. * gadget running when the thread is dead. So just before the thread
  153. * exits, it deregisters the gadget driver. This makes things a little
  154. * tricky: The driver is deregistered at two places, and the exiting
  155. * thread can indirectly call fsg_unbind() which in turn can tell the
  156. * thread to exit. The first problem is resolved through the use of the
  157. * REGISTERED atomic bitflag; the driver will only be deregistered once.
  158. * The second problem is resolved by having fsg_unbind() check
  159. * fsg->state; it won't try to stop the thread if the state is already
  160. * FSG_STATE_TERMINATED.
  161. *
  162. * To provide maximum throughput, the driver uses a circular pipeline of
  163. * buffer heads (struct fsg_buffhd). In principle the pipeline can be
  164. * arbitrarily long; in practice the benefits don't justify having more
  165. * than 2 stages (i.e., double buffering). But it helps to think of the
  166. * pipeline as being a long one. Each buffer head contains a bulk-in and
  167. * a bulk-out request pointer (since the buffer can be used for both
  168. * output and input -- directions always are given from the host's
  169. * point of view) as well as a pointer to the buffer and various state
  170. * variables.
  171. *
  172. * Use of the pipeline follows a simple protocol. There is a variable
  173. * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
  174. * At any time that buffer head may still be in use from an earlier
  175. * request, so each buffer head has a state variable indicating whether
  176. * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
  177. * buffer head to be EMPTY, filling the buffer either by file I/O or by
  178. * USB I/O (during which the buffer head is BUSY), and marking the buffer
  179. * head FULL when the I/O is complete. Then the buffer will be emptied
  180. * (again possibly by USB I/O, during which it is marked BUSY) and
  181. * finally marked EMPTY again (possibly by a completion routine).
  182. *
  183. * A module parameter tells the driver to avoid stalling the bulk
  184. * endpoints wherever the transport specification allows. This is
  185. * necessary for some UDCs like the SuperH, which cannot reliably clear a
  186. * halt on a bulk endpoint. However, under certain circumstances the
  187. * Bulk-only specification requires a stall. In such cases the driver
  188. * will halt the endpoint and set a flag indicating that it should clear
  189. * the halt in software during the next device reset. Hopefully this
  190. * will permit everything to work correctly. Furthermore, although the
  191. * specification allows the bulk-out endpoint to halt when the host sends
  192. * too much data, implementing this would cause an unavoidable race.
  193. * The driver will always use the "no-stall" approach for OUT transfers.
  194. *
  195. * One subtle point concerns sending status-stage responses for ep0
  196. * requests. Some of these requests, such as device reset, can involve
  197. * interrupting an ongoing file I/O operation, which might take an
  198. * arbitrarily long time. During that delay the host might give up on
  199. * the original ep0 request and issue a new one. When that happens the
  200. * driver should not notify the host about completion of the original
  201. * request, as the host will no longer be waiting for it. So the driver
  202. * assigns to each ep0 request a unique tag, and it keeps track of the
  203. * tag value of the request associated with a long-running exception
  204. * (device-reset, interface-change, or configuration-change). When the
  205. * exception handler is finished, the status-stage response is submitted
  206. * only if the current ep0 request tag is equal to the exception request
  207. * tag. Thus only the most recently received ep0 request will get a
  208. * status-stage response.
  209. *
  210. * Warning: This driver source file is too long. It ought to be split up
  211. * into a header file plus about 3 separate .c files, to handle the details
  212. * of the Gadget, USB Mass Storage, and SCSI protocols.
  213. */
  214. /* #define VERBOSE_DEBUG */
  215. /* #define DUMP_MSGS */
  216. #include <linux/blkdev.h>
  217. #include <linux/completion.h>
  218. #include <linux/dcache.h>
  219. #include <linux/delay.h>
  220. #include <linux/device.h>
  221. #include <linux/fcntl.h>
  222. #include <linux/file.h>
  223. #include <linux/fs.h>
  224. #include <linux/kref.h>
  225. #include <linux/kthread.h>
  226. #include <linux/limits.h>
  227. #include <linux/rwsem.h>
  228. #include <linux/slab.h>
  229. #include <linux/spinlock.h>
  230. #include <linux/string.h>
  231. #include <linux/freezer.h>
  232. #include <linux/utsname.h>
  233. #include <linux/usb/ch9.h>
  234. #include <linux/usb/gadget.h>
  235. #include "gadget_chips.h"
  236. /*
  237. * Kbuild is not very cooperative with respect to linking separately
  238. * compiled library objects into one module. So for now we won't use
  239. * separate compilation ... ensuring init/exit sections work to shrink
  240. * the runtime footprint, and giving us at least some parts of what
  241. * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
  242. */
  243. #include "usbstring.c"
  244. #include "config.c"
  245. #include "epautoconf.c"
  246. /*-------------------------------------------------------------------------*/
  247. #define DRIVER_DESC "File-backed Storage Gadget"
  248. #define DRIVER_NAME "g_file_storage"
  249. #define DRIVER_VERSION "7 August 2007"
  250. static const char longname[] = DRIVER_DESC;
  251. static const char shortname[] = DRIVER_NAME;
  252. MODULE_DESCRIPTION(DRIVER_DESC);
  253. MODULE_AUTHOR("Alan Stern");
  254. MODULE_LICENSE("Dual BSD/GPL");
  255. /* Thanks to NetChip Technologies for donating this product ID.
  256. *
  257. * DO NOT REUSE THESE IDs with any other driver!! Ever!!
  258. * Instead: allocate your own, using normal USB-IF procedures. */
  259. #define DRIVER_VENDOR_ID 0x0525 // NetChip
  260. #define DRIVER_PRODUCT_ID 0xa4a5 // Linux-USB File-backed Storage Gadget
  261. /*
  262. * This driver assumes self-powered hardware and has no way for users to
  263. * trigger remote wakeup. It uses autoconfiguration to select endpoints
  264. * and endpoint addresses.
  265. */
  266. /*-------------------------------------------------------------------------*/
  267. #define LDBG(lun,fmt,args...) \
  268. dev_dbg(&(lun)->dev , fmt , ## args)
  269. #define MDBG(fmt,args...) \
  270. pr_debug(DRIVER_NAME ": " fmt , ## args)
  271. #ifndef DEBUG
  272. #undef VERBOSE_DEBUG
  273. #undef DUMP_MSGS
  274. #endif /* !DEBUG */
  275. #ifdef VERBOSE_DEBUG
  276. #define VLDBG LDBG
  277. #else
  278. #define VLDBG(lun,fmt,args...) \
  279. do { } while (0)
  280. #endif /* VERBOSE_DEBUG */
  281. #define LERROR(lun,fmt,args...) \
  282. dev_err(&(lun)->dev , fmt , ## args)
  283. #define LWARN(lun,fmt,args...) \
  284. dev_warn(&(lun)->dev , fmt , ## args)
  285. #define LINFO(lun,fmt,args...) \
  286. dev_info(&(lun)->dev , fmt , ## args)
  287. #define MINFO(fmt,args...) \
  288. pr_info(DRIVER_NAME ": " fmt , ## args)
  289. #define DBG(d, fmt, args...) \
  290. dev_dbg(&(d)->gadget->dev , fmt , ## args)
  291. #define VDBG(d, fmt, args...) \
  292. dev_vdbg(&(d)->gadget->dev , fmt , ## args)
  293. #define ERROR(d, fmt, args...) \
  294. dev_err(&(d)->gadget->dev , fmt , ## args)
  295. #define WARNING(d, fmt, args...) \
  296. dev_warn(&(d)->gadget->dev , fmt , ## args)
  297. #define INFO(d, fmt, args...) \
  298. dev_info(&(d)->gadget->dev , fmt , ## args)
  299. /*-------------------------------------------------------------------------*/
  300. /* Encapsulate the module parameter settings */
  301. #define MAX_LUNS 8
  302. static struct {
  303. char *file[MAX_LUNS];
  304. int ro[MAX_LUNS];
  305. unsigned int num_filenames;
  306. unsigned int num_ros;
  307. unsigned int nluns;
  308. int removable;
  309. int can_stall;
  310. char *transport_parm;
  311. char *protocol_parm;
  312. unsigned short vendor;
  313. unsigned short product;
  314. unsigned short release;
  315. unsigned int buflen;
  316. int transport_type;
  317. char *transport_name;
  318. int protocol_type;
  319. char *protocol_name;
  320. } mod_data = { // Default values
  321. .transport_parm = "BBB",
  322. .protocol_parm = "SCSI",
  323. .removable = 0,
  324. .can_stall = 1,
  325. .vendor = DRIVER_VENDOR_ID,
  326. .product = DRIVER_PRODUCT_ID,
  327. .release = 0xffff, // Use controller chip type
  328. .buflen = 16384,
  329. };
  330. module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
  331. S_IRUGO);
  332. MODULE_PARM_DESC(file, "names of backing files or devices");
  333. module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
  334. MODULE_PARM_DESC(ro, "true to force read-only");
  335. module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
  336. MODULE_PARM_DESC(luns, "number of LUNs");
  337. module_param_named(removable, mod_data.removable, bool, S_IRUGO);
  338. MODULE_PARM_DESC(removable, "true to simulate removable media");
  339. module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
  340. MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
  341. /* In the non-TEST version, only the module parameters listed above
  342. * are available. */
  343. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  344. module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
  345. MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
  346. module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
  347. MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
  348. "8070, or SCSI)");
  349. module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
  350. MODULE_PARM_DESC(vendor, "USB Vendor ID");
  351. module_param_named(product, mod_data.product, ushort, S_IRUGO);
  352. MODULE_PARM_DESC(product, "USB Product ID");
  353. module_param_named(release, mod_data.release, ushort, S_IRUGO);
  354. MODULE_PARM_DESC(release, "USB release number");
  355. module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
  356. MODULE_PARM_DESC(buflen, "I/O buffer size");
  357. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  358. /*-------------------------------------------------------------------------*/
  359. /* USB protocol value = the transport method */
  360. #define USB_PR_CBI 0x00 // Control/Bulk/Interrupt
  361. #define USB_PR_CB 0x01 // Control/Bulk w/o interrupt
  362. #define USB_PR_BULK 0x50 // Bulk-only
  363. /* USB subclass value = the protocol encapsulation */
  364. #define USB_SC_RBC 0x01 // Reduced Block Commands (flash)
  365. #define USB_SC_8020 0x02 // SFF-8020i, MMC-2, ATAPI (CD-ROM)
  366. #define USB_SC_QIC 0x03 // QIC-157 (tape)
  367. #define USB_SC_UFI 0x04 // UFI (floppy)
  368. #define USB_SC_8070 0x05 // SFF-8070i (removable)
  369. #define USB_SC_SCSI 0x06 // Transparent SCSI
  370. /* Bulk-only data structures */
  371. /* Command Block Wrapper */
  372. struct bulk_cb_wrap {
  373. __le32 Signature; // Contains 'USBC'
  374. u32 Tag; // Unique per command id
  375. __le32 DataTransferLength; // Size of the data
  376. u8 Flags; // Direction in bit 7
  377. u8 Lun; // LUN (normally 0)
  378. u8 Length; // Of the CDB, <= MAX_COMMAND_SIZE
  379. u8 CDB[16]; // Command Data Block
  380. };
  381. #define USB_BULK_CB_WRAP_LEN 31
  382. #define USB_BULK_CB_SIG 0x43425355 // Spells out USBC
  383. #define USB_BULK_IN_FLAG 0x80
  384. /* Command Status Wrapper */
  385. struct bulk_cs_wrap {
  386. __le32 Signature; // Should = 'USBS'
  387. u32 Tag; // Same as original command
  388. __le32 Residue; // Amount not transferred
  389. u8 Status; // See below
  390. };
  391. #define USB_BULK_CS_WRAP_LEN 13
  392. #define USB_BULK_CS_SIG 0x53425355 // Spells out 'USBS'
  393. #define USB_STATUS_PASS 0
  394. #define USB_STATUS_FAIL 1
  395. #define USB_STATUS_PHASE_ERROR 2
  396. /* Bulk-only class specific requests */
  397. #define USB_BULK_RESET_REQUEST 0xff
  398. #define USB_BULK_GET_MAX_LUN_REQUEST 0xfe
  399. /* CBI Interrupt data structure */
  400. struct interrupt_data {
  401. u8 bType;
  402. u8 bValue;
  403. };
  404. #define CBI_INTERRUPT_DATA_LEN 2
  405. /* CBI Accept Device-Specific Command request */
  406. #define USB_CBI_ADSC_REQUEST 0x00
  407. #define MAX_COMMAND_SIZE 16 // Length of a SCSI Command Data Block
  408. /* SCSI commands that we recognize */
  409. #define SC_FORMAT_UNIT 0x04
  410. #define SC_INQUIRY 0x12
  411. #define SC_MODE_SELECT_6 0x15
  412. #define SC_MODE_SELECT_10 0x55
  413. #define SC_MODE_SENSE_6 0x1a
  414. #define SC_MODE_SENSE_10 0x5a
  415. #define SC_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
  416. #define SC_READ_6 0x08
  417. #define SC_READ_10 0x28
  418. #define SC_READ_12 0xa8
  419. #define SC_READ_CAPACITY 0x25
  420. #define SC_READ_FORMAT_CAPACITIES 0x23
  421. #define SC_RELEASE 0x17
  422. #define SC_REQUEST_SENSE 0x03
  423. #define SC_RESERVE 0x16
  424. #define SC_SEND_DIAGNOSTIC 0x1d
  425. #define SC_START_STOP_UNIT 0x1b
  426. #define SC_SYNCHRONIZE_CACHE 0x35
  427. #define SC_TEST_UNIT_READY 0x00
  428. #define SC_VERIFY 0x2f
  429. #define SC_WRITE_6 0x0a
  430. #define SC_WRITE_10 0x2a
  431. #define SC_WRITE_12 0xaa
  432. /* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
  433. #define SS_NO_SENSE 0
  434. #define SS_COMMUNICATION_FAILURE 0x040800
  435. #define SS_INVALID_COMMAND 0x052000
  436. #define SS_INVALID_FIELD_IN_CDB 0x052400
  437. #define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE 0x052100
  438. #define SS_LOGICAL_UNIT_NOT_SUPPORTED 0x052500
  439. #define SS_MEDIUM_NOT_PRESENT 0x023a00
  440. #define SS_MEDIUM_REMOVAL_PREVENTED 0x055302
  441. #define SS_NOT_READY_TO_READY_TRANSITION 0x062800
  442. #define SS_RESET_OCCURRED 0x062900
  443. #define SS_SAVING_PARAMETERS_NOT_SUPPORTED 0x053900
  444. #define SS_UNRECOVERED_READ_ERROR 0x031100
  445. #define SS_WRITE_ERROR 0x030c02
  446. #define SS_WRITE_PROTECTED 0x072700
  447. #define SK(x) ((u8) ((x) >> 16)) // Sense Key byte, etc.
  448. #define ASC(x) ((u8) ((x) >> 8))
  449. #define ASCQ(x) ((u8) (x))
  450. /*-------------------------------------------------------------------------*/
  451. /*
  452. * These definitions will permit the compiler to avoid generating code for
  453. * parts of the driver that aren't used in the non-TEST version. Even gcc
  454. * can recognize when a test of a constant expression yields a dead code
  455. * path.
  456. */
  457. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  458. #define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
  459. #define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
  460. #define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
  461. #else
  462. #define transport_is_bbb() 1
  463. #define transport_is_cbi() 0
  464. #define protocol_is_scsi() 1
  465. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  466. struct lun {
  467. struct file *filp;
  468. loff_t file_length;
  469. loff_t num_sectors;
  470. unsigned int ro : 1;
  471. unsigned int prevent_medium_removal : 1;
  472. unsigned int registered : 1;
  473. unsigned int info_valid : 1;
  474. u32 sense_data;
  475. u32 sense_data_info;
  476. u32 unit_attention_data;
  477. struct device dev;
  478. };
  479. #define backing_file_is_open(curlun) ((curlun)->filp != NULL)
  480. static struct lun *dev_to_lun(struct device *dev)
  481. {
  482. return container_of(dev, struct lun, dev);
  483. }
  484. /* Big enough to hold our biggest descriptor */
  485. #define EP0_BUFSIZE 256
  486. #define DELAYED_STATUS (EP0_BUFSIZE + 999) // An impossibly large value
  487. /* Number of buffers we will use. 2 is enough for double-buffering */
  488. #define NUM_BUFFERS 2
  489. enum fsg_buffer_state {
  490. BUF_STATE_EMPTY = 0,
  491. BUF_STATE_FULL,
  492. BUF_STATE_BUSY
  493. };
  494. struct fsg_buffhd {
  495. void *buf;
  496. enum fsg_buffer_state state;
  497. struct fsg_buffhd *next;
  498. /* The NetChip 2280 is faster, and handles some protocol faults
  499. * better, if we don't submit any short bulk-out read requests.
  500. * So we will record the intended request length here. */
  501. unsigned int bulk_out_intended_length;
  502. struct usb_request *inreq;
  503. int inreq_busy;
  504. struct usb_request *outreq;
  505. int outreq_busy;
  506. };
  507. enum fsg_state {
  508. FSG_STATE_COMMAND_PHASE = -10, // This one isn't used anywhere
  509. FSG_STATE_DATA_PHASE,
  510. FSG_STATE_STATUS_PHASE,
  511. FSG_STATE_IDLE = 0,
  512. FSG_STATE_ABORT_BULK_OUT,
  513. FSG_STATE_RESET,
  514. FSG_STATE_INTERFACE_CHANGE,
  515. FSG_STATE_CONFIG_CHANGE,
  516. FSG_STATE_DISCONNECT,
  517. FSG_STATE_EXIT,
  518. FSG_STATE_TERMINATED
  519. };
  520. enum data_direction {
  521. DATA_DIR_UNKNOWN = 0,
  522. DATA_DIR_FROM_HOST,
  523. DATA_DIR_TO_HOST,
  524. DATA_DIR_NONE
  525. };
  526. struct fsg_dev {
  527. /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
  528. spinlock_t lock;
  529. struct usb_gadget *gadget;
  530. /* filesem protects: backing files in use */
  531. struct rw_semaphore filesem;
  532. /* reference counting: wait until all LUNs are released */
  533. struct kref ref;
  534. struct usb_ep *ep0; // Handy copy of gadget->ep0
  535. struct usb_request *ep0req; // For control responses
  536. unsigned int ep0_req_tag;
  537. const char *ep0req_name;
  538. struct usb_request *intreq; // For interrupt responses
  539. int intreq_busy;
  540. struct fsg_buffhd *intr_buffhd;
  541. unsigned int bulk_out_maxpacket;
  542. enum fsg_state state; // For exception handling
  543. unsigned int exception_req_tag;
  544. u8 config, new_config;
  545. unsigned int running : 1;
  546. unsigned int bulk_in_enabled : 1;
  547. unsigned int bulk_out_enabled : 1;
  548. unsigned int intr_in_enabled : 1;
  549. unsigned int phase_error : 1;
  550. unsigned int short_packet_received : 1;
  551. unsigned int bad_lun_okay : 1;
  552. unsigned long atomic_bitflags;
  553. #define REGISTERED 0
  554. #define IGNORE_BULK_OUT 1
  555. #define SUSPENDED 2
  556. struct usb_ep *bulk_in;
  557. struct usb_ep *bulk_out;
  558. struct usb_ep *intr_in;
  559. struct fsg_buffhd *next_buffhd_to_fill;
  560. struct fsg_buffhd *next_buffhd_to_drain;
  561. struct fsg_buffhd buffhds[NUM_BUFFERS];
  562. int thread_wakeup_needed;
  563. struct completion thread_notifier;
  564. struct task_struct *thread_task;
  565. int cmnd_size;
  566. u8 cmnd[MAX_COMMAND_SIZE];
  567. enum data_direction data_dir;
  568. u32 data_size;
  569. u32 data_size_from_cmnd;
  570. u32 tag;
  571. unsigned int lun;
  572. u32 residue;
  573. u32 usb_amount_left;
  574. /* The CB protocol offers no way for a host to know when a command
  575. * has completed. As a result the next command may arrive early,
  576. * and we will still have to handle it. For that reason we need
  577. * a buffer to store new commands when using CB (or CBI, which
  578. * does not oblige a host to wait for command completion either). */
  579. int cbbuf_cmnd_size;
  580. u8 cbbuf_cmnd[MAX_COMMAND_SIZE];
  581. unsigned int nluns;
  582. struct lun *luns;
  583. struct lun *curlun;
  584. };
  585. typedef void (*fsg_routine_t)(struct fsg_dev *);
  586. static int exception_in_progress(struct fsg_dev *fsg)
  587. {
  588. return (fsg->state > FSG_STATE_IDLE);
  589. }
  590. /* Make bulk-out requests be divisible by the maxpacket size */
  591. static void set_bulk_out_req_length(struct fsg_dev *fsg,
  592. struct fsg_buffhd *bh, unsigned int length)
  593. {
  594. unsigned int rem;
  595. bh->bulk_out_intended_length = length;
  596. rem = length % fsg->bulk_out_maxpacket;
  597. if (rem > 0)
  598. length += fsg->bulk_out_maxpacket - rem;
  599. bh->outreq->length = length;
  600. }
  601. static struct fsg_dev *the_fsg;
  602. static struct usb_gadget_driver fsg_driver;
  603. static void close_backing_file(struct lun *curlun);
  604. static void close_all_backing_files(struct fsg_dev *fsg);
  605. /*-------------------------------------------------------------------------*/
  606. #ifdef DUMP_MSGS
  607. static void dump_msg(struct fsg_dev *fsg, const char *label,
  608. const u8 *buf, unsigned int length)
  609. {
  610. if (length < 512) {
  611. DBG(fsg, "%s, length %u:\n", label, length);
  612. print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,
  613. 16, 1, buf, length, 0);
  614. }
  615. }
  616. static void dump_cdb(struct fsg_dev *fsg)
  617. {}
  618. #else
  619. static void dump_msg(struct fsg_dev *fsg, const char *label,
  620. const u8 *buf, unsigned int length)
  621. {}
  622. #ifdef VERBOSE_DEBUG
  623. static void dump_cdb(struct fsg_dev *fsg)
  624. {
  625. print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,
  626. 16, 1, fsg->cmnd, fsg->cmnd_size, 0);
  627. }
  628. #else
  629. static void dump_cdb(struct fsg_dev *fsg)
  630. {}
  631. #endif /* VERBOSE_DEBUG */
  632. #endif /* DUMP_MSGS */
  633. static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
  634. {
  635. const char *name;
  636. if (ep == fsg->bulk_in)
  637. name = "bulk-in";
  638. else if (ep == fsg->bulk_out)
  639. name = "bulk-out";
  640. else
  641. name = ep->name;
  642. DBG(fsg, "%s set halt\n", name);
  643. return usb_ep_set_halt(ep);
  644. }
  645. /*-------------------------------------------------------------------------*/
  646. /* Routines for unaligned data access */
  647. static u16 get_be16(u8 *buf)
  648. {
  649. return ((u16) buf[0] << 8) | ((u16) buf[1]);
  650. }
  651. static u32 get_be32(u8 *buf)
  652. {
  653. return ((u32) buf[0] << 24) | ((u32) buf[1] << 16) |
  654. ((u32) buf[2] << 8) | ((u32) buf[3]);
  655. }
  656. static void put_be16(u8 *buf, u16 val)
  657. {
  658. buf[0] = val >> 8;
  659. buf[1] = val;
  660. }
  661. static void put_be32(u8 *buf, u32 val)
  662. {
  663. buf[0] = val >> 24;
  664. buf[1] = val >> 16;
  665. buf[2] = val >> 8;
  666. buf[3] = val & 0xff;
  667. }
  668. /*-------------------------------------------------------------------------*/
  669. /*
  670. * DESCRIPTORS ... most are static, but strings and (full) configuration
  671. * descriptors are built on demand. Also the (static) config and interface
  672. * descriptors are adjusted during fsg_bind().
  673. */
  674. #define STRING_MANUFACTURER 1
  675. #define STRING_PRODUCT 2
  676. #define STRING_SERIAL 3
  677. #define STRING_CONFIG 4
  678. #define STRING_INTERFACE 5
  679. /* There is only one configuration. */
  680. #define CONFIG_VALUE 1
  681. static struct usb_device_descriptor
  682. device_desc = {
  683. .bLength = sizeof device_desc,
  684. .bDescriptorType = USB_DT_DEVICE,
  685. .bcdUSB = __constant_cpu_to_le16(0x0200),
  686. .bDeviceClass = USB_CLASS_PER_INTERFACE,
  687. /* The next three values can be overridden by module parameters */
  688. .idVendor = __constant_cpu_to_le16(DRIVER_VENDOR_ID),
  689. .idProduct = __constant_cpu_to_le16(DRIVER_PRODUCT_ID),
  690. .bcdDevice = __constant_cpu_to_le16(0xffff),
  691. .iManufacturer = STRING_MANUFACTURER,
  692. .iProduct = STRING_PRODUCT,
  693. .iSerialNumber = STRING_SERIAL,
  694. .bNumConfigurations = 1,
  695. };
  696. static struct usb_config_descriptor
  697. config_desc = {
  698. .bLength = sizeof config_desc,
  699. .bDescriptorType = USB_DT_CONFIG,
  700. /* wTotalLength computed by usb_gadget_config_buf() */
  701. .bNumInterfaces = 1,
  702. .bConfigurationValue = CONFIG_VALUE,
  703. .iConfiguration = STRING_CONFIG,
  704. .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
  705. .bMaxPower = 1, // self-powered
  706. };
  707. static struct usb_otg_descriptor
  708. otg_desc = {
  709. .bLength = sizeof(otg_desc),
  710. .bDescriptorType = USB_DT_OTG,
  711. .bmAttributes = USB_OTG_SRP,
  712. };
  713. /* There is only one interface. */
  714. static struct usb_interface_descriptor
  715. intf_desc = {
  716. .bLength = sizeof intf_desc,
  717. .bDescriptorType = USB_DT_INTERFACE,
  718. .bNumEndpoints = 2, // Adjusted during fsg_bind()
  719. .bInterfaceClass = USB_CLASS_MASS_STORAGE,
  720. .bInterfaceSubClass = USB_SC_SCSI, // Adjusted during fsg_bind()
  721. .bInterfaceProtocol = USB_PR_BULK, // Adjusted during fsg_bind()
  722. .iInterface = STRING_INTERFACE,
  723. };
  724. /* Three full-speed endpoint descriptors: bulk-in, bulk-out,
  725. * and interrupt-in. */
  726. static struct usb_endpoint_descriptor
  727. fs_bulk_in_desc = {
  728. .bLength = USB_DT_ENDPOINT_SIZE,
  729. .bDescriptorType = USB_DT_ENDPOINT,
  730. .bEndpointAddress = USB_DIR_IN,
  731. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  732. /* wMaxPacketSize set by autoconfiguration */
  733. };
  734. static struct usb_endpoint_descriptor
  735. fs_bulk_out_desc = {
  736. .bLength = USB_DT_ENDPOINT_SIZE,
  737. .bDescriptorType = USB_DT_ENDPOINT,
  738. .bEndpointAddress = USB_DIR_OUT,
  739. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  740. /* wMaxPacketSize set by autoconfiguration */
  741. };
  742. static struct usb_endpoint_descriptor
  743. fs_intr_in_desc = {
  744. .bLength = USB_DT_ENDPOINT_SIZE,
  745. .bDescriptorType = USB_DT_ENDPOINT,
  746. .bEndpointAddress = USB_DIR_IN,
  747. .bmAttributes = USB_ENDPOINT_XFER_INT,
  748. .wMaxPacketSize = __constant_cpu_to_le16(2),
  749. .bInterval = 32, // frames -> 32 ms
  750. };
  751. static const struct usb_descriptor_header *fs_function[] = {
  752. (struct usb_descriptor_header *) &otg_desc,
  753. (struct usb_descriptor_header *) &intf_desc,
  754. (struct usb_descriptor_header *) &fs_bulk_in_desc,
  755. (struct usb_descriptor_header *) &fs_bulk_out_desc,
  756. (struct usb_descriptor_header *) &fs_intr_in_desc,
  757. NULL,
  758. };
  759. #define FS_FUNCTION_PRE_EP_ENTRIES 2
  760. /*
  761. * USB 2.0 devices need to expose both high speed and full speed
  762. * descriptors, unless they only run at full speed.
  763. *
  764. * That means alternate endpoint descriptors (bigger packets)
  765. * and a "device qualifier" ... plus more construction options
  766. * for the config descriptor.
  767. */
  768. static struct usb_qualifier_descriptor
  769. dev_qualifier = {
  770. .bLength = sizeof dev_qualifier,
  771. .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
  772. .bcdUSB = __constant_cpu_to_le16(0x0200),
  773. .bDeviceClass = USB_CLASS_PER_INTERFACE,
  774. .bNumConfigurations = 1,
  775. };
  776. static struct usb_endpoint_descriptor
  777. hs_bulk_in_desc = {
  778. .bLength = USB_DT_ENDPOINT_SIZE,
  779. .bDescriptorType = USB_DT_ENDPOINT,
  780. /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
  781. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  782. .wMaxPacketSize = __constant_cpu_to_le16(512),
  783. };
  784. static struct usb_endpoint_descriptor
  785. hs_bulk_out_desc = {
  786. .bLength = USB_DT_ENDPOINT_SIZE,
  787. .bDescriptorType = USB_DT_ENDPOINT,
  788. /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
  789. .bmAttributes = USB_ENDPOINT_XFER_BULK,
  790. .wMaxPacketSize = __constant_cpu_to_le16(512),
  791. .bInterval = 1, // NAK every 1 uframe
  792. };
  793. static struct usb_endpoint_descriptor
  794. hs_intr_in_desc = {
  795. .bLength = USB_DT_ENDPOINT_SIZE,
  796. .bDescriptorType = USB_DT_ENDPOINT,
  797. /* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
  798. .bmAttributes = USB_ENDPOINT_XFER_INT,
  799. .wMaxPacketSize = __constant_cpu_to_le16(2),
  800. .bInterval = 9, // 2**(9-1) = 256 uframes -> 32 ms
  801. };
  802. static const struct usb_descriptor_header *hs_function[] = {
  803. (struct usb_descriptor_header *) &otg_desc,
  804. (struct usb_descriptor_header *) &intf_desc,
  805. (struct usb_descriptor_header *) &hs_bulk_in_desc,
  806. (struct usb_descriptor_header *) &hs_bulk_out_desc,
  807. (struct usb_descriptor_header *) &hs_intr_in_desc,
  808. NULL,
  809. };
  810. #define HS_FUNCTION_PRE_EP_ENTRIES 2
  811. /* Maxpacket and other transfer characteristics vary by speed. */
  812. static struct usb_endpoint_descriptor *
  813. ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
  814. struct usb_endpoint_descriptor *hs)
  815. {
  816. if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
  817. return hs;
  818. return fs;
  819. }
  820. /* The CBI specification limits the serial string to 12 uppercase hexadecimal
  821. * characters. */
  822. static char manufacturer[64];
  823. static char serial[13];
  824. /* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
  825. static struct usb_string strings[] = {
  826. {STRING_MANUFACTURER, manufacturer},
  827. {STRING_PRODUCT, longname},
  828. {STRING_SERIAL, serial},
  829. {STRING_CONFIG, "Self-powered"},
  830. {STRING_INTERFACE, "Mass Storage"},
  831. {}
  832. };
  833. static struct usb_gadget_strings stringtab = {
  834. .language = 0x0409, // en-us
  835. .strings = strings,
  836. };
  837. /*
  838. * Config descriptors must agree with the code that sets configurations
  839. * and with code managing interfaces and their altsettings. They must
  840. * also handle different speeds and other-speed requests.
  841. */
  842. static int populate_config_buf(struct usb_gadget *gadget,
  843. u8 *buf, u8 type, unsigned index)
  844. {
  845. enum usb_device_speed speed = gadget->speed;
  846. int len;
  847. const struct usb_descriptor_header **function;
  848. if (index > 0)
  849. return -EINVAL;
  850. if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
  851. speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
  852. if (gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH)
  853. function = hs_function;
  854. else
  855. function = fs_function;
  856. /* for now, don't advertise srp-only devices */
  857. if (!gadget_is_otg(gadget))
  858. function++;
  859. len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
  860. ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
  861. return len;
  862. }
  863. /*-------------------------------------------------------------------------*/
  864. /* These routines may be called in process context or in_irq */
  865. /* Caller must hold fsg->lock */
  866. static void wakeup_thread(struct fsg_dev *fsg)
  867. {
  868. /* Tell the main thread that something has happened */
  869. fsg->thread_wakeup_needed = 1;
  870. if (fsg->thread_task)
  871. wake_up_process(fsg->thread_task);
  872. }
  873. static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
  874. {
  875. unsigned long flags;
  876. /* Do nothing if a higher-priority exception is already in progress.
  877. * If a lower-or-equal priority exception is in progress, preempt it
  878. * and notify the main thread by sending it a signal. */
  879. spin_lock_irqsave(&fsg->lock, flags);
  880. if (fsg->state <= new_state) {
  881. fsg->exception_req_tag = fsg->ep0_req_tag;
  882. fsg->state = new_state;
  883. if (fsg->thread_task)
  884. send_sig_info(SIGUSR1, SEND_SIG_FORCED,
  885. fsg->thread_task);
  886. }
  887. spin_unlock_irqrestore(&fsg->lock, flags);
  888. }
  889. /*-------------------------------------------------------------------------*/
  890. /* The disconnect callback and ep0 routines. These always run in_irq,
  891. * except that ep0_queue() is called in the main thread to acknowledge
  892. * completion of various requests: set config, set interface, and
  893. * Bulk-only device reset. */
  894. static void fsg_disconnect(struct usb_gadget *gadget)
  895. {
  896. struct fsg_dev *fsg = get_gadget_data(gadget);
  897. DBG(fsg, "disconnect or port reset\n");
  898. raise_exception(fsg, FSG_STATE_DISCONNECT);
  899. }
  900. static int ep0_queue(struct fsg_dev *fsg)
  901. {
  902. int rc;
  903. rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
  904. if (rc != 0 && rc != -ESHUTDOWN) {
  905. /* We can't do much more than wait for a reset */
  906. WARNING(fsg, "error in submission: %s --> %d\n",
  907. fsg->ep0->name, rc);
  908. }
  909. return rc;
  910. }
  911. static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
  912. {
  913. struct fsg_dev *fsg = ep->driver_data;
  914. if (req->actual > 0)
  915. dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
  916. if (req->status || req->actual != req->length)
  917. DBG(fsg, "%s --> %d, %u/%u\n", __func__,
  918. req->status, req->actual, req->length);
  919. if (req->status == -ECONNRESET) // Request was cancelled
  920. usb_ep_fifo_flush(ep);
  921. if (req->status == 0 && req->context)
  922. ((fsg_routine_t) (req->context))(fsg);
  923. }
  924. /*-------------------------------------------------------------------------*/
  925. /* Bulk and interrupt endpoint completion handlers.
  926. * These always run in_irq. */
  927. static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
  928. {
  929. struct fsg_dev *fsg = ep->driver_data;
  930. struct fsg_buffhd *bh = req->context;
  931. if (req->status || req->actual != req->length)
  932. DBG(fsg, "%s --> %d, %u/%u\n", __func__,
  933. req->status, req->actual, req->length);
  934. if (req->status == -ECONNRESET) // Request was cancelled
  935. usb_ep_fifo_flush(ep);
  936. /* Hold the lock while we update the request and buffer states */
  937. smp_wmb();
  938. spin_lock(&fsg->lock);
  939. bh->inreq_busy = 0;
  940. bh->state = BUF_STATE_EMPTY;
  941. wakeup_thread(fsg);
  942. spin_unlock(&fsg->lock);
  943. }
  944. static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
  945. {
  946. struct fsg_dev *fsg = ep->driver_data;
  947. struct fsg_buffhd *bh = req->context;
  948. dump_msg(fsg, "bulk-out", req->buf, req->actual);
  949. if (req->status || req->actual != bh->bulk_out_intended_length)
  950. DBG(fsg, "%s --> %d, %u/%u\n", __func__,
  951. req->status, req->actual,
  952. bh->bulk_out_intended_length);
  953. if (req->status == -ECONNRESET) // Request was cancelled
  954. usb_ep_fifo_flush(ep);
  955. /* Hold the lock while we update the request and buffer states */
  956. smp_wmb();
  957. spin_lock(&fsg->lock);
  958. bh->outreq_busy = 0;
  959. bh->state = BUF_STATE_FULL;
  960. wakeup_thread(fsg);
  961. spin_unlock(&fsg->lock);
  962. }
  963. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  964. static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
  965. {
  966. struct fsg_dev *fsg = ep->driver_data;
  967. struct fsg_buffhd *bh = req->context;
  968. if (req->status || req->actual != req->length)
  969. DBG(fsg, "%s --> %d, %u/%u\n", __func__,
  970. req->status, req->actual, req->length);
  971. if (req->status == -ECONNRESET) // Request was cancelled
  972. usb_ep_fifo_flush(ep);
  973. /* Hold the lock while we update the request and buffer states */
  974. smp_wmb();
  975. spin_lock(&fsg->lock);
  976. fsg->intreq_busy = 0;
  977. bh->state = BUF_STATE_EMPTY;
  978. wakeup_thread(fsg);
  979. spin_unlock(&fsg->lock);
  980. }
  981. #else
  982. static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
  983. {}
  984. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  985. /*-------------------------------------------------------------------------*/
  986. /* Ep0 class-specific handlers. These always run in_irq. */
  987. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  988. static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  989. {
  990. struct usb_request *req = fsg->ep0req;
  991. static u8 cbi_reset_cmnd[6] = {
  992. SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
  993. /* Error in command transfer? */
  994. if (req->status || req->length != req->actual ||
  995. req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
  996. /* Not all controllers allow a protocol stall after
  997. * receiving control-out data, but we'll try anyway. */
  998. fsg_set_halt(fsg, fsg->ep0);
  999. return; // Wait for reset
  1000. }
  1001. /* Is it the special reset command? */
  1002. if (req->actual >= sizeof cbi_reset_cmnd &&
  1003. memcmp(req->buf, cbi_reset_cmnd,
  1004. sizeof cbi_reset_cmnd) == 0) {
  1005. /* Raise an exception to stop the current operation
  1006. * and reinitialize our state. */
  1007. DBG(fsg, "cbi reset request\n");
  1008. raise_exception(fsg, FSG_STATE_RESET);
  1009. return;
  1010. }
  1011. VDBG(fsg, "CB[I] accept device-specific command\n");
  1012. spin_lock(&fsg->lock);
  1013. /* Save the command for later */
  1014. if (fsg->cbbuf_cmnd_size)
  1015. WARNING(fsg, "CB[I] overwriting previous command\n");
  1016. fsg->cbbuf_cmnd_size = req->actual;
  1017. memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
  1018. wakeup_thread(fsg);
  1019. spin_unlock(&fsg->lock);
  1020. }
  1021. #else
  1022. static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1023. {}
  1024. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  1025. static int class_setup_req(struct fsg_dev *fsg,
  1026. const struct usb_ctrlrequest *ctrl)
  1027. {
  1028. struct usb_request *req = fsg->ep0req;
  1029. int value = -EOPNOTSUPP;
  1030. u16 w_index = le16_to_cpu(ctrl->wIndex);
  1031. u16 w_value = le16_to_cpu(ctrl->wValue);
  1032. u16 w_length = le16_to_cpu(ctrl->wLength);
  1033. if (!fsg->config)
  1034. return value;
  1035. /* Handle Bulk-only class-specific requests */
  1036. if (transport_is_bbb()) {
  1037. switch (ctrl->bRequest) {
  1038. case USB_BULK_RESET_REQUEST:
  1039. if (ctrl->bRequestType != (USB_DIR_OUT |
  1040. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1041. break;
  1042. if (w_index != 0 || w_value != 0) {
  1043. value = -EDOM;
  1044. break;
  1045. }
  1046. /* Raise an exception to stop the current operation
  1047. * and reinitialize our state. */
  1048. DBG(fsg, "bulk reset request\n");
  1049. raise_exception(fsg, FSG_STATE_RESET);
  1050. value = DELAYED_STATUS;
  1051. break;
  1052. case USB_BULK_GET_MAX_LUN_REQUEST:
  1053. if (ctrl->bRequestType != (USB_DIR_IN |
  1054. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1055. break;
  1056. if (w_index != 0 || w_value != 0) {
  1057. value = -EDOM;
  1058. break;
  1059. }
  1060. VDBG(fsg, "get max LUN\n");
  1061. *(u8 *) req->buf = fsg->nluns - 1;
  1062. value = 1;
  1063. break;
  1064. }
  1065. }
  1066. /* Handle CBI class-specific requests */
  1067. else {
  1068. switch (ctrl->bRequest) {
  1069. case USB_CBI_ADSC_REQUEST:
  1070. if (ctrl->bRequestType != (USB_DIR_OUT |
  1071. USB_TYPE_CLASS | USB_RECIP_INTERFACE))
  1072. break;
  1073. if (w_index != 0 || w_value != 0) {
  1074. value = -EDOM;
  1075. break;
  1076. }
  1077. if (w_length > MAX_COMMAND_SIZE) {
  1078. value = -EOVERFLOW;
  1079. break;
  1080. }
  1081. value = w_length;
  1082. fsg->ep0req->context = received_cbi_adsc;
  1083. break;
  1084. }
  1085. }
  1086. if (value == -EOPNOTSUPP)
  1087. VDBG(fsg,
  1088. "unknown class-specific control req "
  1089. "%02x.%02x v%04x i%04x l%u\n",
  1090. ctrl->bRequestType, ctrl->bRequest,
  1091. le16_to_cpu(ctrl->wValue), w_index, w_length);
  1092. return value;
  1093. }
  1094. /*-------------------------------------------------------------------------*/
  1095. /* Ep0 standard request handlers. These always run in_irq. */
  1096. static int standard_setup_req(struct fsg_dev *fsg,
  1097. const struct usb_ctrlrequest *ctrl)
  1098. {
  1099. struct usb_request *req = fsg->ep0req;
  1100. int value = -EOPNOTSUPP;
  1101. u16 w_index = le16_to_cpu(ctrl->wIndex);
  1102. u16 w_value = le16_to_cpu(ctrl->wValue);
  1103. /* Usually this just stores reply data in the pre-allocated ep0 buffer,
  1104. * but config change events will also reconfigure hardware. */
  1105. switch (ctrl->bRequest) {
  1106. case USB_REQ_GET_DESCRIPTOR:
  1107. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1108. USB_RECIP_DEVICE))
  1109. break;
  1110. switch (w_value >> 8) {
  1111. case USB_DT_DEVICE:
  1112. VDBG(fsg, "get device descriptor\n");
  1113. value = sizeof device_desc;
  1114. memcpy(req->buf, &device_desc, value);
  1115. break;
  1116. case USB_DT_DEVICE_QUALIFIER:
  1117. VDBG(fsg, "get device qualifier\n");
  1118. if (!gadget_is_dualspeed(fsg->gadget))
  1119. break;
  1120. value = sizeof dev_qualifier;
  1121. memcpy(req->buf, &dev_qualifier, value);
  1122. break;
  1123. case USB_DT_OTHER_SPEED_CONFIG:
  1124. VDBG(fsg, "get other-speed config descriptor\n");
  1125. if (!gadget_is_dualspeed(fsg->gadget))
  1126. break;
  1127. goto get_config;
  1128. case USB_DT_CONFIG:
  1129. VDBG(fsg, "get configuration descriptor\n");
  1130. get_config:
  1131. value = populate_config_buf(fsg->gadget,
  1132. req->buf,
  1133. w_value >> 8,
  1134. w_value & 0xff);
  1135. break;
  1136. case USB_DT_STRING:
  1137. VDBG(fsg, "get string descriptor\n");
  1138. /* wIndex == language code */
  1139. value = usb_gadget_get_string(&stringtab,
  1140. w_value & 0xff, req->buf);
  1141. break;
  1142. }
  1143. break;
  1144. /* One config, two speeds */
  1145. case USB_REQ_SET_CONFIGURATION:
  1146. if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
  1147. USB_RECIP_DEVICE))
  1148. break;
  1149. VDBG(fsg, "set configuration\n");
  1150. if (w_value == CONFIG_VALUE || w_value == 0) {
  1151. fsg->new_config = w_value;
  1152. /* Raise an exception to wipe out previous transaction
  1153. * state (queued bufs, etc) and set the new config. */
  1154. raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
  1155. value = DELAYED_STATUS;
  1156. }
  1157. break;
  1158. case USB_REQ_GET_CONFIGURATION:
  1159. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1160. USB_RECIP_DEVICE))
  1161. break;
  1162. VDBG(fsg, "get configuration\n");
  1163. *(u8 *) req->buf = fsg->config;
  1164. value = 1;
  1165. break;
  1166. case USB_REQ_SET_INTERFACE:
  1167. if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
  1168. USB_RECIP_INTERFACE))
  1169. break;
  1170. if (fsg->config && w_index == 0) {
  1171. /* Raise an exception to wipe out previous transaction
  1172. * state (queued bufs, etc) and install the new
  1173. * interface altsetting. */
  1174. raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
  1175. value = DELAYED_STATUS;
  1176. }
  1177. break;
  1178. case USB_REQ_GET_INTERFACE:
  1179. if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
  1180. USB_RECIP_INTERFACE))
  1181. break;
  1182. if (!fsg->config)
  1183. break;
  1184. if (w_index != 0) {
  1185. value = -EDOM;
  1186. break;
  1187. }
  1188. VDBG(fsg, "get interface\n");
  1189. *(u8 *) req->buf = 0;
  1190. value = 1;
  1191. break;
  1192. default:
  1193. VDBG(fsg,
  1194. "unknown control req %02x.%02x v%04x i%04x l%u\n",
  1195. ctrl->bRequestType, ctrl->bRequest,
  1196. w_value, w_index, le16_to_cpu(ctrl->wLength));
  1197. }
  1198. return value;
  1199. }
  1200. static int fsg_setup(struct usb_gadget *gadget,
  1201. const struct usb_ctrlrequest *ctrl)
  1202. {
  1203. struct fsg_dev *fsg = get_gadget_data(gadget);
  1204. int rc;
  1205. int w_length = le16_to_cpu(ctrl->wLength);
  1206. ++fsg->ep0_req_tag; // Record arrival of a new request
  1207. fsg->ep0req->context = NULL;
  1208. fsg->ep0req->length = 0;
  1209. dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
  1210. if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
  1211. rc = class_setup_req(fsg, ctrl);
  1212. else
  1213. rc = standard_setup_req(fsg, ctrl);
  1214. /* Respond with data/status or defer until later? */
  1215. if (rc >= 0 && rc != DELAYED_STATUS) {
  1216. rc = min(rc, w_length);
  1217. fsg->ep0req->length = rc;
  1218. fsg->ep0req->zero = rc < w_length;
  1219. fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
  1220. "ep0-in" : "ep0-out");
  1221. rc = ep0_queue(fsg);
  1222. }
  1223. /* Device either stalls (rc < 0) or reports success */
  1224. return rc;
  1225. }
  1226. /*-------------------------------------------------------------------------*/
  1227. /* All the following routines run in process context */
  1228. /* Use this for bulk or interrupt transfers, not ep0 */
  1229. static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
  1230. struct usb_request *req, int *pbusy,
  1231. enum fsg_buffer_state *state)
  1232. {
  1233. int rc;
  1234. if (ep == fsg->bulk_in)
  1235. dump_msg(fsg, "bulk-in", req->buf, req->length);
  1236. else if (ep == fsg->intr_in)
  1237. dump_msg(fsg, "intr-in", req->buf, req->length);
  1238. spin_lock_irq(&fsg->lock);
  1239. *pbusy = 1;
  1240. *state = BUF_STATE_BUSY;
  1241. spin_unlock_irq(&fsg->lock);
  1242. rc = usb_ep_queue(ep, req, GFP_KERNEL);
  1243. if (rc != 0) {
  1244. *pbusy = 0;
  1245. *state = BUF_STATE_EMPTY;
  1246. /* We can't do much more than wait for a reset */
  1247. /* Note: currently the net2280 driver fails zero-length
  1248. * submissions if DMA is enabled. */
  1249. if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
  1250. req->length == 0))
  1251. WARNING(fsg, "error in submission: %s --> %d\n",
  1252. ep->name, rc);
  1253. }
  1254. }
  1255. static int sleep_thread(struct fsg_dev *fsg)
  1256. {
  1257. int rc = 0;
  1258. /* Wait until a signal arrives or we are woken up */
  1259. for (;;) {
  1260. try_to_freeze();
  1261. set_current_state(TASK_INTERRUPTIBLE);
  1262. if (signal_pending(current)) {
  1263. rc = -EINTR;
  1264. break;
  1265. }
  1266. if (fsg->thread_wakeup_needed)
  1267. break;
  1268. schedule();
  1269. }
  1270. __set_current_state(TASK_RUNNING);
  1271. fsg->thread_wakeup_needed = 0;
  1272. return rc;
  1273. }
  1274. /*-------------------------------------------------------------------------*/
  1275. static int do_read(struct fsg_dev *fsg)
  1276. {
  1277. struct lun *curlun = fsg->curlun;
  1278. u32 lba;
  1279. struct fsg_buffhd *bh;
  1280. int rc;
  1281. u32 amount_left;
  1282. loff_t file_offset, file_offset_tmp;
  1283. unsigned int amount;
  1284. unsigned int partial_page;
  1285. ssize_t nread;
  1286. /* Get the starting Logical Block Address and check that it's
  1287. * not too big */
  1288. if (fsg->cmnd[0] == SC_READ_6)
  1289. lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
  1290. else {
  1291. lba = get_be32(&fsg->cmnd[2]);
  1292. /* We allow DPO (Disable Page Out = don't save data in the
  1293. * cache) and FUA (Force Unit Access = don't read from the
  1294. * cache), but we don't implement them. */
  1295. if ((fsg->cmnd[1] & ~0x18) != 0) {
  1296. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1297. return -EINVAL;
  1298. }
  1299. }
  1300. if (lba >= curlun->num_sectors) {
  1301. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1302. return -EINVAL;
  1303. }
  1304. file_offset = ((loff_t) lba) << 9;
  1305. /* Carry out the file reads */
  1306. amount_left = fsg->data_size_from_cmnd;
  1307. if (unlikely(amount_left == 0))
  1308. return -EIO; // No default reply
  1309. for (;;) {
  1310. /* Figure out how much we need to read:
  1311. * Try to read the remaining amount.
  1312. * But don't read more than the buffer size.
  1313. * And don't try to read past the end of the file.
  1314. * Finally, if we're not at a page boundary, don't read past
  1315. * the next page.
  1316. * If this means reading 0 then we were asked to read past
  1317. * the end of file. */
  1318. amount = min((unsigned int) amount_left, mod_data.buflen);
  1319. amount = min((loff_t) amount,
  1320. curlun->file_length - file_offset);
  1321. partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
  1322. if (partial_page > 0)
  1323. amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
  1324. partial_page);
  1325. /* Wait for the next buffer to become available */
  1326. bh = fsg->next_buffhd_to_fill;
  1327. while (bh->state != BUF_STATE_EMPTY) {
  1328. rc = sleep_thread(fsg);
  1329. if (rc)
  1330. return rc;
  1331. }
  1332. /* If we were asked to read past the end of file,
  1333. * end with an empty buffer. */
  1334. if (amount == 0) {
  1335. curlun->sense_data =
  1336. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1337. curlun->sense_data_info = file_offset >> 9;
  1338. curlun->info_valid = 1;
  1339. bh->inreq->length = 0;
  1340. bh->state = BUF_STATE_FULL;
  1341. break;
  1342. }
  1343. /* Perform the read */
  1344. file_offset_tmp = file_offset;
  1345. nread = vfs_read(curlun->filp,
  1346. (char __user *) bh->buf,
  1347. amount, &file_offset_tmp);
  1348. VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
  1349. (unsigned long long) file_offset,
  1350. (int) nread);
  1351. if (signal_pending(current))
  1352. return -EINTR;
  1353. if (nread < 0) {
  1354. LDBG(curlun, "error in file read: %d\n",
  1355. (int) nread);
  1356. nread = 0;
  1357. } else if (nread < amount) {
  1358. LDBG(curlun, "partial file read: %d/%u\n",
  1359. (int) nread, amount);
  1360. nread -= (nread & 511); // Round down to a block
  1361. }
  1362. file_offset += nread;
  1363. amount_left -= nread;
  1364. fsg->residue -= nread;
  1365. bh->inreq->length = nread;
  1366. bh->state = BUF_STATE_FULL;
  1367. /* If an error occurred, report it and its position */
  1368. if (nread < amount) {
  1369. curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
  1370. curlun->sense_data_info = file_offset >> 9;
  1371. curlun->info_valid = 1;
  1372. break;
  1373. }
  1374. if (amount_left == 0)
  1375. break; // No more left to read
  1376. /* Send this buffer and go read some more */
  1377. bh->inreq->zero = 0;
  1378. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  1379. &bh->inreq_busy, &bh->state);
  1380. fsg->next_buffhd_to_fill = bh->next;
  1381. }
  1382. return -EIO; // No default reply
  1383. }
  1384. /*-------------------------------------------------------------------------*/
  1385. static int do_write(struct fsg_dev *fsg)
  1386. {
  1387. struct lun *curlun = fsg->curlun;
  1388. u32 lba;
  1389. struct fsg_buffhd *bh;
  1390. int get_some_more;
  1391. u32 amount_left_to_req, amount_left_to_write;
  1392. loff_t usb_offset, file_offset, file_offset_tmp;
  1393. unsigned int amount;
  1394. unsigned int partial_page;
  1395. ssize_t nwritten;
  1396. int rc;
  1397. if (curlun->ro) {
  1398. curlun->sense_data = SS_WRITE_PROTECTED;
  1399. return -EINVAL;
  1400. }
  1401. curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait
  1402. /* Get the starting Logical Block Address and check that it's
  1403. * not too big */
  1404. if (fsg->cmnd[0] == SC_WRITE_6)
  1405. lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
  1406. else {
  1407. lba = get_be32(&fsg->cmnd[2]);
  1408. /* We allow DPO (Disable Page Out = don't save data in the
  1409. * cache) and FUA (Force Unit Access = write directly to the
  1410. * medium). We don't implement DPO; we implement FUA by
  1411. * performing synchronous output. */
  1412. if ((fsg->cmnd[1] & ~0x18) != 0) {
  1413. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1414. return -EINVAL;
  1415. }
  1416. if (fsg->cmnd[1] & 0x08) // FUA
  1417. curlun->filp->f_flags |= O_SYNC;
  1418. }
  1419. if (lba >= curlun->num_sectors) {
  1420. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1421. return -EINVAL;
  1422. }
  1423. /* Carry out the file writes */
  1424. get_some_more = 1;
  1425. file_offset = usb_offset = ((loff_t) lba) << 9;
  1426. amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
  1427. while (amount_left_to_write > 0) {
  1428. /* Queue a request for more data from the host */
  1429. bh = fsg->next_buffhd_to_fill;
  1430. if (bh->state == BUF_STATE_EMPTY && get_some_more) {
  1431. /* Figure out how much we want to get:
  1432. * Try to get the remaining amount.
  1433. * But don't get more than the buffer size.
  1434. * And don't try to go past the end of the file.
  1435. * If we're not at a page boundary,
  1436. * don't go past the next page.
  1437. * If this means getting 0, then we were asked
  1438. * to write past the end of file.
  1439. * Finally, round down to a block boundary. */
  1440. amount = min(amount_left_to_req, mod_data.buflen);
  1441. amount = min((loff_t) amount, curlun->file_length -
  1442. usb_offset);
  1443. partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
  1444. if (partial_page > 0)
  1445. amount = min(amount,
  1446. (unsigned int) PAGE_CACHE_SIZE - partial_page);
  1447. if (amount == 0) {
  1448. get_some_more = 0;
  1449. curlun->sense_data =
  1450. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1451. curlun->sense_data_info = usb_offset >> 9;
  1452. curlun->info_valid = 1;
  1453. continue;
  1454. }
  1455. amount -= (amount & 511);
  1456. if (amount == 0) {
  1457. /* Why were we were asked to transfer a
  1458. * partial block? */
  1459. get_some_more = 0;
  1460. continue;
  1461. }
  1462. /* Get the next buffer */
  1463. usb_offset += amount;
  1464. fsg->usb_amount_left -= amount;
  1465. amount_left_to_req -= amount;
  1466. if (amount_left_to_req == 0)
  1467. get_some_more = 0;
  1468. /* amount is always divisible by 512, hence by
  1469. * the bulk-out maxpacket size */
  1470. bh->outreq->length = bh->bulk_out_intended_length =
  1471. amount;
  1472. bh->outreq->short_not_ok = 1;
  1473. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  1474. &bh->outreq_busy, &bh->state);
  1475. fsg->next_buffhd_to_fill = bh->next;
  1476. continue;
  1477. }
  1478. /* Write the received data to the backing file */
  1479. bh = fsg->next_buffhd_to_drain;
  1480. if (bh->state == BUF_STATE_EMPTY && !get_some_more)
  1481. break; // We stopped early
  1482. if (bh->state == BUF_STATE_FULL) {
  1483. smp_rmb();
  1484. fsg->next_buffhd_to_drain = bh->next;
  1485. bh->state = BUF_STATE_EMPTY;
  1486. /* Did something go wrong with the transfer? */
  1487. if (bh->outreq->status != 0) {
  1488. curlun->sense_data = SS_COMMUNICATION_FAILURE;
  1489. curlun->sense_data_info = file_offset >> 9;
  1490. curlun->info_valid = 1;
  1491. break;
  1492. }
  1493. amount = bh->outreq->actual;
  1494. if (curlun->file_length - file_offset < amount) {
  1495. LERROR(curlun,
  1496. "write %u @ %llu beyond end %llu\n",
  1497. amount, (unsigned long long) file_offset,
  1498. (unsigned long long) curlun->file_length);
  1499. amount = curlun->file_length - file_offset;
  1500. }
  1501. /* Perform the write */
  1502. file_offset_tmp = file_offset;
  1503. nwritten = vfs_write(curlun->filp,
  1504. (char __user *) bh->buf,
  1505. amount, &file_offset_tmp);
  1506. VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
  1507. (unsigned long long) file_offset,
  1508. (int) nwritten);
  1509. if (signal_pending(current))
  1510. return -EINTR; // Interrupted!
  1511. if (nwritten < 0) {
  1512. LDBG(curlun, "error in file write: %d\n",
  1513. (int) nwritten);
  1514. nwritten = 0;
  1515. } else if (nwritten < amount) {
  1516. LDBG(curlun, "partial file write: %d/%u\n",
  1517. (int) nwritten, amount);
  1518. nwritten -= (nwritten & 511);
  1519. // Round down to a block
  1520. }
  1521. file_offset += nwritten;
  1522. amount_left_to_write -= nwritten;
  1523. fsg->residue -= nwritten;
  1524. /* If an error occurred, report it and its position */
  1525. if (nwritten < amount) {
  1526. curlun->sense_data = SS_WRITE_ERROR;
  1527. curlun->sense_data_info = file_offset >> 9;
  1528. curlun->info_valid = 1;
  1529. break;
  1530. }
  1531. /* Did the host decide to stop early? */
  1532. if (bh->outreq->actual != bh->outreq->length) {
  1533. fsg->short_packet_received = 1;
  1534. break;
  1535. }
  1536. continue;
  1537. }
  1538. /* Wait for something to happen */
  1539. rc = sleep_thread(fsg);
  1540. if (rc)
  1541. return rc;
  1542. }
  1543. return -EIO; // No default reply
  1544. }
  1545. /*-------------------------------------------------------------------------*/
  1546. /* Sync the file data, don't bother with the metadata.
  1547. * This code was copied from fs/buffer.c:sys_fdatasync(). */
  1548. static int fsync_sub(struct lun *curlun)
  1549. {
  1550. struct file *filp = curlun->filp;
  1551. struct inode *inode;
  1552. int rc, err;
  1553. if (curlun->ro || !filp)
  1554. return 0;
  1555. if (!filp->f_op->fsync)
  1556. return -EINVAL;
  1557. inode = filp->f_path.dentry->d_inode;
  1558. mutex_lock(&inode->i_mutex);
  1559. rc = filemap_fdatawrite(inode->i_mapping);
  1560. err = filp->f_op->fsync(filp, filp->f_path.dentry, 1);
  1561. if (!rc)
  1562. rc = err;
  1563. err = filemap_fdatawait(inode->i_mapping);
  1564. if (!rc)
  1565. rc = err;
  1566. mutex_unlock(&inode->i_mutex);
  1567. VLDBG(curlun, "fdatasync -> %d\n", rc);
  1568. return rc;
  1569. }
  1570. static void fsync_all(struct fsg_dev *fsg)
  1571. {
  1572. int i;
  1573. for (i = 0; i < fsg->nluns; ++i)
  1574. fsync_sub(&fsg->luns[i]);
  1575. }
  1576. static int do_synchronize_cache(struct fsg_dev *fsg)
  1577. {
  1578. struct lun *curlun = fsg->curlun;
  1579. int rc;
  1580. /* We ignore the requested LBA and write out all file's
  1581. * dirty data buffers. */
  1582. rc = fsync_sub(curlun);
  1583. if (rc)
  1584. curlun->sense_data = SS_WRITE_ERROR;
  1585. return 0;
  1586. }
  1587. /*-------------------------------------------------------------------------*/
  1588. static void invalidate_sub(struct lun *curlun)
  1589. {
  1590. struct file *filp = curlun->filp;
  1591. struct inode *inode = filp->f_path.dentry->d_inode;
  1592. unsigned long rc;
  1593. rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
  1594. VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
  1595. }
  1596. static int do_verify(struct fsg_dev *fsg)
  1597. {
  1598. struct lun *curlun = fsg->curlun;
  1599. u32 lba;
  1600. u32 verification_length;
  1601. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  1602. loff_t file_offset, file_offset_tmp;
  1603. u32 amount_left;
  1604. unsigned int amount;
  1605. ssize_t nread;
  1606. /* Get the starting Logical Block Address and check that it's
  1607. * not too big */
  1608. lba = get_be32(&fsg->cmnd[2]);
  1609. if (lba >= curlun->num_sectors) {
  1610. curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1611. return -EINVAL;
  1612. }
  1613. /* We allow DPO (Disable Page Out = don't save data in the
  1614. * cache) but we don't implement it. */
  1615. if ((fsg->cmnd[1] & ~0x10) != 0) {
  1616. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1617. return -EINVAL;
  1618. }
  1619. verification_length = get_be16(&fsg->cmnd[7]);
  1620. if (unlikely(verification_length == 0))
  1621. return -EIO; // No default reply
  1622. /* Prepare to carry out the file verify */
  1623. amount_left = verification_length << 9;
  1624. file_offset = ((loff_t) lba) << 9;
  1625. /* Write out all the dirty buffers before invalidating them */
  1626. fsync_sub(curlun);
  1627. if (signal_pending(current))
  1628. return -EINTR;
  1629. invalidate_sub(curlun);
  1630. if (signal_pending(current))
  1631. return -EINTR;
  1632. /* Just try to read the requested blocks */
  1633. while (amount_left > 0) {
  1634. /* Figure out how much we need to read:
  1635. * Try to read the remaining amount, but not more than
  1636. * the buffer size.
  1637. * And don't try to read past the end of the file.
  1638. * If this means reading 0 then we were asked to read
  1639. * past the end of file. */
  1640. amount = min((unsigned int) amount_left, mod_data.buflen);
  1641. amount = min((loff_t) amount,
  1642. curlun->file_length - file_offset);
  1643. if (amount == 0) {
  1644. curlun->sense_data =
  1645. SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
  1646. curlun->sense_data_info = file_offset >> 9;
  1647. curlun->info_valid = 1;
  1648. break;
  1649. }
  1650. /* Perform the read */
  1651. file_offset_tmp = file_offset;
  1652. nread = vfs_read(curlun->filp,
  1653. (char __user *) bh->buf,
  1654. amount, &file_offset_tmp);
  1655. VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
  1656. (unsigned long long) file_offset,
  1657. (int) nread);
  1658. if (signal_pending(current))
  1659. return -EINTR;
  1660. if (nread < 0) {
  1661. LDBG(curlun, "error in file verify: %d\n",
  1662. (int) nread);
  1663. nread = 0;
  1664. } else if (nread < amount) {
  1665. LDBG(curlun, "partial file verify: %d/%u\n",
  1666. (int) nread, amount);
  1667. nread -= (nread & 511); // Round down to a sector
  1668. }
  1669. if (nread == 0) {
  1670. curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
  1671. curlun->sense_data_info = file_offset >> 9;
  1672. curlun->info_valid = 1;
  1673. break;
  1674. }
  1675. file_offset += nread;
  1676. amount_left -= nread;
  1677. }
  1678. return 0;
  1679. }
  1680. /*-------------------------------------------------------------------------*/
  1681. static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1682. {
  1683. u8 *buf = (u8 *) bh->buf;
  1684. static char vendor_id[] = "Linux ";
  1685. static char product_id[] = "File-Stor Gadget";
  1686. if (!fsg->curlun) { // Unsupported LUNs are okay
  1687. fsg->bad_lun_okay = 1;
  1688. memset(buf, 0, 36);
  1689. buf[0] = 0x7f; // Unsupported, no device-type
  1690. return 36;
  1691. }
  1692. memset(buf, 0, 8); // Non-removable, direct-access device
  1693. if (mod_data.removable)
  1694. buf[1] = 0x80;
  1695. buf[2] = 2; // ANSI SCSI level 2
  1696. buf[3] = 2; // SCSI-2 INQUIRY data format
  1697. buf[4] = 31; // Additional length
  1698. // No special options
  1699. sprintf(buf + 8, "%-8s%-16s%04x", vendor_id, product_id,
  1700. mod_data.release);
  1701. return 36;
  1702. }
  1703. static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1704. {
  1705. struct lun *curlun = fsg->curlun;
  1706. u8 *buf = (u8 *) bh->buf;
  1707. u32 sd, sdinfo;
  1708. int valid;
  1709. /*
  1710. * From the SCSI-2 spec., section 7.9 (Unit attention condition):
  1711. *
  1712. * If a REQUEST SENSE command is received from an initiator
  1713. * with a pending unit attention condition (before the target
  1714. * generates the contingent allegiance condition), then the
  1715. * target shall either:
  1716. * a) report any pending sense data and preserve the unit
  1717. * attention condition on the logical unit, or,
  1718. * b) report the unit attention condition, may discard any
  1719. * pending sense data, and clear the unit attention
  1720. * condition on the logical unit for that initiator.
  1721. *
  1722. * FSG normally uses option a); enable this code to use option b).
  1723. */
  1724. #if 0
  1725. if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
  1726. curlun->sense_data = curlun->unit_attention_data;
  1727. curlun->unit_attention_data = SS_NO_SENSE;
  1728. }
  1729. #endif
  1730. if (!curlun) { // Unsupported LUNs are okay
  1731. fsg->bad_lun_okay = 1;
  1732. sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
  1733. sdinfo = 0;
  1734. valid = 0;
  1735. } else {
  1736. sd = curlun->sense_data;
  1737. sdinfo = curlun->sense_data_info;
  1738. valid = curlun->info_valid << 7;
  1739. curlun->sense_data = SS_NO_SENSE;
  1740. curlun->sense_data_info = 0;
  1741. curlun->info_valid = 0;
  1742. }
  1743. memset(buf, 0, 18);
  1744. buf[0] = valid | 0x70; // Valid, current error
  1745. buf[2] = SK(sd);
  1746. put_be32(&buf[3], sdinfo); // Sense information
  1747. buf[7] = 18 - 8; // Additional sense length
  1748. buf[12] = ASC(sd);
  1749. buf[13] = ASCQ(sd);
  1750. return 18;
  1751. }
  1752. static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1753. {
  1754. struct lun *curlun = fsg->curlun;
  1755. u32 lba = get_be32(&fsg->cmnd[2]);
  1756. int pmi = fsg->cmnd[8];
  1757. u8 *buf = (u8 *) bh->buf;
  1758. /* Check the PMI and LBA fields */
  1759. if (pmi > 1 || (pmi == 0 && lba != 0)) {
  1760. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1761. return -EINVAL;
  1762. }
  1763. put_be32(&buf[0], curlun->num_sectors - 1); // Max logical block
  1764. put_be32(&buf[4], 512); // Block length
  1765. return 8;
  1766. }
  1767. static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1768. {
  1769. struct lun *curlun = fsg->curlun;
  1770. int mscmnd = fsg->cmnd[0];
  1771. u8 *buf = (u8 *) bh->buf;
  1772. u8 *buf0 = buf;
  1773. int pc, page_code;
  1774. int changeable_values, all_pages;
  1775. int valid_page = 0;
  1776. int len, limit;
  1777. if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD
  1778. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1779. return -EINVAL;
  1780. }
  1781. pc = fsg->cmnd[2] >> 6;
  1782. page_code = fsg->cmnd[2] & 0x3f;
  1783. if (pc == 3) {
  1784. curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
  1785. return -EINVAL;
  1786. }
  1787. changeable_values = (pc == 1);
  1788. all_pages = (page_code == 0x3f);
  1789. /* Write the mode parameter header. Fixed values are: default
  1790. * medium type, no cache control (DPOFUA), and no block descriptors.
  1791. * The only variable value is the WriteProtect bit. We will fill in
  1792. * the mode data length later. */
  1793. memset(buf, 0, 8);
  1794. if (mscmnd == SC_MODE_SENSE_6) {
  1795. buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
  1796. buf += 4;
  1797. limit = 255;
  1798. } else { // SC_MODE_SENSE_10
  1799. buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
  1800. buf += 8;
  1801. limit = 65535; // Should really be mod_data.buflen
  1802. }
  1803. /* No block descriptors */
  1804. /* The mode pages, in numerical order. The only page we support
  1805. * is the Caching page. */
  1806. if (page_code == 0x08 || all_pages) {
  1807. valid_page = 1;
  1808. buf[0] = 0x08; // Page code
  1809. buf[1] = 10; // Page length
  1810. memset(buf+2, 0, 10); // None of the fields are changeable
  1811. if (!changeable_values) {
  1812. buf[2] = 0x04; // Write cache enable,
  1813. // Read cache not disabled
  1814. // No cache retention priorities
  1815. put_be16(&buf[4], 0xffff); // Don't disable prefetch
  1816. // Minimum prefetch = 0
  1817. put_be16(&buf[8], 0xffff); // Maximum prefetch
  1818. put_be16(&buf[10], 0xffff); // Maximum prefetch ceiling
  1819. }
  1820. buf += 12;
  1821. }
  1822. /* Check that a valid page was requested and the mode data length
  1823. * isn't too long. */
  1824. len = buf - buf0;
  1825. if (!valid_page || len > limit) {
  1826. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1827. return -EINVAL;
  1828. }
  1829. /* Store the mode data length */
  1830. if (mscmnd == SC_MODE_SENSE_6)
  1831. buf0[0] = len - 1;
  1832. else
  1833. put_be16(buf0, len - 2);
  1834. return len;
  1835. }
  1836. static int do_start_stop(struct fsg_dev *fsg)
  1837. {
  1838. struct lun *curlun = fsg->curlun;
  1839. int loej, start;
  1840. if (!mod_data.removable) {
  1841. curlun->sense_data = SS_INVALID_COMMAND;
  1842. return -EINVAL;
  1843. }
  1844. // int immed = fsg->cmnd[1] & 0x01;
  1845. loej = fsg->cmnd[4] & 0x02;
  1846. start = fsg->cmnd[4] & 0x01;
  1847. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  1848. if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed
  1849. (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start
  1850. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1851. return -EINVAL;
  1852. }
  1853. if (!start) {
  1854. /* Are we allowed to unload the media? */
  1855. if (curlun->prevent_medium_removal) {
  1856. LDBG(curlun, "unload attempt prevented\n");
  1857. curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
  1858. return -EINVAL;
  1859. }
  1860. if (loej) { // Simulate an unload/eject
  1861. up_read(&fsg->filesem);
  1862. down_write(&fsg->filesem);
  1863. close_backing_file(curlun);
  1864. up_write(&fsg->filesem);
  1865. down_read(&fsg->filesem);
  1866. }
  1867. } else {
  1868. /* Our emulation doesn't support mounting; the medium is
  1869. * available for use as soon as it is loaded. */
  1870. if (!backing_file_is_open(curlun)) {
  1871. curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
  1872. return -EINVAL;
  1873. }
  1874. }
  1875. #endif
  1876. return 0;
  1877. }
  1878. static int do_prevent_allow(struct fsg_dev *fsg)
  1879. {
  1880. struct lun *curlun = fsg->curlun;
  1881. int prevent;
  1882. if (!mod_data.removable) {
  1883. curlun->sense_data = SS_INVALID_COMMAND;
  1884. return -EINVAL;
  1885. }
  1886. prevent = fsg->cmnd[4] & 0x01;
  1887. if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent
  1888. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  1889. return -EINVAL;
  1890. }
  1891. if (curlun->prevent_medium_removal && !prevent)
  1892. fsync_sub(curlun);
  1893. curlun->prevent_medium_removal = prevent;
  1894. return 0;
  1895. }
  1896. static int do_read_format_capacities(struct fsg_dev *fsg,
  1897. struct fsg_buffhd *bh)
  1898. {
  1899. struct lun *curlun = fsg->curlun;
  1900. u8 *buf = (u8 *) bh->buf;
  1901. buf[0] = buf[1] = buf[2] = 0;
  1902. buf[3] = 8; // Only the Current/Maximum Capacity Descriptor
  1903. buf += 4;
  1904. put_be32(&buf[0], curlun->num_sectors); // Number of blocks
  1905. put_be32(&buf[4], 512); // Block length
  1906. buf[4] = 0x02; // Current capacity
  1907. return 12;
  1908. }
  1909. static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  1910. {
  1911. struct lun *curlun = fsg->curlun;
  1912. /* We don't support MODE SELECT */
  1913. curlun->sense_data = SS_INVALID_COMMAND;
  1914. return -EINVAL;
  1915. }
  1916. /*-------------------------------------------------------------------------*/
  1917. static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
  1918. {
  1919. int rc;
  1920. rc = fsg_set_halt(fsg, fsg->bulk_in);
  1921. if (rc == -EAGAIN)
  1922. VDBG(fsg, "delayed bulk-in endpoint halt\n");
  1923. while (rc != 0) {
  1924. if (rc != -EAGAIN) {
  1925. WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
  1926. rc = 0;
  1927. break;
  1928. }
  1929. /* Wait for a short time and then try again */
  1930. if (msleep_interruptible(100) != 0)
  1931. return -EINTR;
  1932. rc = usb_ep_set_halt(fsg->bulk_in);
  1933. }
  1934. return rc;
  1935. }
  1936. static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
  1937. {
  1938. int rc;
  1939. DBG(fsg, "bulk-in set wedge\n");
  1940. rc = usb_ep_set_wedge(fsg->bulk_in);
  1941. if (rc == -EAGAIN)
  1942. VDBG(fsg, "delayed bulk-in endpoint wedge\n");
  1943. while (rc != 0) {
  1944. if (rc != -EAGAIN) {
  1945. WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
  1946. rc = 0;
  1947. break;
  1948. }
  1949. /* Wait for a short time and then try again */
  1950. if (msleep_interruptible(100) != 0)
  1951. return -EINTR;
  1952. rc = usb_ep_set_wedge(fsg->bulk_in);
  1953. }
  1954. return rc;
  1955. }
  1956. static int pad_with_zeros(struct fsg_dev *fsg)
  1957. {
  1958. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  1959. u32 nkeep = bh->inreq->length;
  1960. u32 nsend;
  1961. int rc;
  1962. bh->state = BUF_STATE_EMPTY; // For the first iteration
  1963. fsg->usb_amount_left = nkeep + fsg->residue;
  1964. while (fsg->usb_amount_left > 0) {
  1965. /* Wait for the next buffer to be free */
  1966. while (bh->state != BUF_STATE_EMPTY) {
  1967. rc = sleep_thread(fsg);
  1968. if (rc)
  1969. return rc;
  1970. }
  1971. nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
  1972. memset(bh->buf + nkeep, 0, nsend - nkeep);
  1973. bh->inreq->length = nsend;
  1974. bh->inreq->zero = 0;
  1975. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  1976. &bh->inreq_busy, &bh->state);
  1977. bh = fsg->next_buffhd_to_fill = bh->next;
  1978. fsg->usb_amount_left -= nsend;
  1979. nkeep = 0;
  1980. }
  1981. return 0;
  1982. }
  1983. static int throw_away_data(struct fsg_dev *fsg)
  1984. {
  1985. struct fsg_buffhd *bh;
  1986. u32 amount;
  1987. int rc;
  1988. while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
  1989. fsg->usb_amount_left > 0) {
  1990. /* Throw away the data in a filled buffer */
  1991. if (bh->state == BUF_STATE_FULL) {
  1992. smp_rmb();
  1993. bh->state = BUF_STATE_EMPTY;
  1994. fsg->next_buffhd_to_drain = bh->next;
  1995. /* A short packet or an error ends everything */
  1996. if (bh->outreq->actual != bh->outreq->length ||
  1997. bh->outreq->status != 0) {
  1998. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  1999. return -EINTR;
  2000. }
  2001. continue;
  2002. }
  2003. /* Try to submit another request if we need one */
  2004. bh = fsg->next_buffhd_to_fill;
  2005. if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
  2006. amount = min(fsg->usb_amount_left,
  2007. (u32) mod_data.buflen);
  2008. /* amount is always divisible by 512, hence by
  2009. * the bulk-out maxpacket size */
  2010. bh->outreq->length = bh->bulk_out_intended_length =
  2011. amount;
  2012. bh->outreq->short_not_ok = 1;
  2013. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  2014. &bh->outreq_busy, &bh->state);
  2015. fsg->next_buffhd_to_fill = bh->next;
  2016. fsg->usb_amount_left -= amount;
  2017. continue;
  2018. }
  2019. /* Otherwise wait for something to happen */
  2020. rc = sleep_thread(fsg);
  2021. if (rc)
  2022. return rc;
  2023. }
  2024. return 0;
  2025. }
  2026. static int finish_reply(struct fsg_dev *fsg)
  2027. {
  2028. struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
  2029. int rc = 0;
  2030. switch (fsg->data_dir) {
  2031. case DATA_DIR_NONE:
  2032. break; // Nothing to send
  2033. /* If we don't know whether the host wants to read or write,
  2034. * this must be CB or CBI with an unknown command. We mustn't
  2035. * try to send or receive any data. So stall both bulk pipes
  2036. * if we can and wait for a reset. */
  2037. case DATA_DIR_UNKNOWN:
  2038. if (mod_data.can_stall) {
  2039. fsg_set_halt(fsg, fsg->bulk_out);
  2040. rc = halt_bulk_in_endpoint(fsg);
  2041. }
  2042. break;
  2043. /* All but the last buffer of data must have already been sent */
  2044. case DATA_DIR_TO_HOST:
  2045. if (fsg->data_size == 0)
  2046. ; // Nothing to send
  2047. /* If there's no residue, simply send the last buffer */
  2048. else if (fsg->residue == 0) {
  2049. bh->inreq->zero = 0;
  2050. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2051. &bh->inreq_busy, &bh->state);
  2052. fsg->next_buffhd_to_fill = bh->next;
  2053. }
  2054. /* There is a residue. For CB and CBI, simply mark the end
  2055. * of the data with a short packet. However, if we are
  2056. * allowed to stall, there was no data at all (residue ==
  2057. * data_size), and the command failed (invalid LUN or
  2058. * sense data is set), then halt the bulk-in endpoint
  2059. * instead. */
  2060. else if (!transport_is_bbb()) {
  2061. if (mod_data.can_stall &&
  2062. fsg->residue == fsg->data_size &&
  2063. (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
  2064. bh->state = BUF_STATE_EMPTY;
  2065. rc = halt_bulk_in_endpoint(fsg);
  2066. } else {
  2067. bh->inreq->zero = 1;
  2068. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2069. &bh->inreq_busy, &bh->state);
  2070. fsg->next_buffhd_to_fill = bh->next;
  2071. }
  2072. }
  2073. /* For Bulk-only, if we're allowed to stall then send the
  2074. * short packet and halt the bulk-in endpoint. If we can't
  2075. * stall, pad out the remaining data with 0's. */
  2076. else {
  2077. if (mod_data.can_stall) {
  2078. bh->inreq->zero = 1;
  2079. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2080. &bh->inreq_busy, &bh->state);
  2081. fsg->next_buffhd_to_fill = bh->next;
  2082. rc = halt_bulk_in_endpoint(fsg);
  2083. } else
  2084. rc = pad_with_zeros(fsg);
  2085. }
  2086. break;
  2087. /* We have processed all we want from the data the host has sent.
  2088. * There may still be outstanding bulk-out requests. */
  2089. case DATA_DIR_FROM_HOST:
  2090. if (fsg->residue == 0)
  2091. ; // Nothing to receive
  2092. /* Did the host stop sending unexpectedly early? */
  2093. else if (fsg->short_packet_received) {
  2094. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  2095. rc = -EINTR;
  2096. }
  2097. /* We haven't processed all the incoming data. Even though
  2098. * we may be allowed to stall, doing so would cause a race.
  2099. * The controller may already have ACK'ed all the remaining
  2100. * bulk-out packets, in which case the host wouldn't see a
  2101. * STALL. Not realizing the endpoint was halted, it wouldn't
  2102. * clear the halt -- leading to problems later on. */
  2103. #if 0
  2104. else if (mod_data.can_stall) {
  2105. fsg_set_halt(fsg, fsg->bulk_out);
  2106. raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
  2107. rc = -EINTR;
  2108. }
  2109. #endif
  2110. /* We can't stall. Read in the excess data and throw it
  2111. * all away. */
  2112. else
  2113. rc = throw_away_data(fsg);
  2114. break;
  2115. }
  2116. return rc;
  2117. }
  2118. static int send_status(struct fsg_dev *fsg)
  2119. {
  2120. struct lun *curlun = fsg->curlun;
  2121. struct fsg_buffhd *bh;
  2122. int rc;
  2123. u8 status = USB_STATUS_PASS;
  2124. u32 sd, sdinfo = 0;
  2125. /* Wait for the next buffer to become available */
  2126. bh = fsg->next_buffhd_to_fill;
  2127. while (bh->state != BUF_STATE_EMPTY) {
  2128. rc = sleep_thread(fsg);
  2129. if (rc)
  2130. return rc;
  2131. }
  2132. if (curlun) {
  2133. sd = curlun->sense_data;
  2134. sdinfo = curlun->sense_data_info;
  2135. } else if (fsg->bad_lun_okay)
  2136. sd = SS_NO_SENSE;
  2137. else
  2138. sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
  2139. if (fsg->phase_error) {
  2140. DBG(fsg, "sending phase-error status\n");
  2141. status = USB_STATUS_PHASE_ERROR;
  2142. sd = SS_INVALID_COMMAND;
  2143. } else if (sd != SS_NO_SENSE) {
  2144. DBG(fsg, "sending command-failure status\n");
  2145. status = USB_STATUS_FAIL;
  2146. VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
  2147. " info x%x\n",
  2148. SK(sd), ASC(sd), ASCQ(sd), sdinfo);
  2149. }
  2150. if (transport_is_bbb()) {
  2151. struct bulk_cs_wrap *csw = bh->buf;
  2152. /* Store and send the Bulk-only CSW */
  2153. csw->Signature = __constant_cpu_to_le32(USB_BULK_CS_SIG);
  2154. csw->Tag = fsg->tag;
  2155. csw->Residue = cpu_to_le32(fsg->residue);
  2156. csw->Status = status;
  2157. bh->inreq->length = USB_BULK_CS_WRAP_LEN;
  2158. bh->inreq->zero = 0;
  2159. start_transfer(fsg, fsg->bulk_in, bh->inreq,
  2160. &bh->inreq_busy, &bh->state);
  2161. } else if (mod_data.transport_type == USB_PR_CB) {
  2162. /* Control-Bulk transport has no status phase! */
  2163. return 0;
  2164. } else { // USB_PR_CBI
  2165. struct interrupt_data *buf = bh->buf;
  2166. /* Store and send the Interrupt data. UFI sends the ASC
  2167. * and ASCQ bytes. Everything else sends a Type (which
  2168. * is always 0) and the status Value. */
  2169. if (mod_data.protocol_type == USB_SC_UFI) {
  2170. buf->bType = ASC(sd);
  2171. buf->bValue = ASCQ(sd);
  2172. } else {
  2173. buf->bType = 0;
  2174. buf->bValue = status;
  2175. }
  2176. fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
  2177. fsg->intr_buffhd = bh; // Point to the right buffhd
  2178. fsg->intreq->buf = bh->inreq->buf;
  2179. fsg->intreq->context = bh;
  2180. start_transfer(fsg, fsg->intr_in, fsg->intreq,
  2181. &fsg->intreq_busy, &bh->state);
  2182. }
  2183. fsg->next_buffhd_to_fill = bh->next;
  2184. return 0;
  2185. }
  2186. /*-------------------------------------------------------------------------*/
  2187. /* Check whether the command is properly formed and whether its data size
  2188. * and direction agree with the values we already have. */
  2189. static int check_command(struct fsg_dev *fsg, int cmnd_size,
  2190. enum data_direction data_dir, unsigned int mask,
  2191. int needs_medium, const char *name)
  2192. {
  2193. int i;
  2194. int lun = fsg->cmnd[1] >> 5;
  2195. static const char dirletter[4] = {'u', 'o', 'i', 'n'};
  2196. char hdlen[20];
  2197. struct lun *curlun;
  2198. /* Adjust the expected cmnd_size for protocol encapsulation padding.
  2199. * Transparent SCSI doesn't pad. */
  2200. if (protocol_is_scsi())
  2201. ;
  2202. /* There's some disagreement as to whether RBC pads commands or not.
  2203. * We'll play it safe and accept either form. */
  2204. else if (mod_data.protocol_type == USB_SC_RBC) {
  2205. if (fsg->cmnd_size == 12)
  2206. cmnd_size = 12;
  2207. /* All the other protocols pad to 12 bytes */
  2208. } else
  2209. cmnd_size = 12;
  2210. hdlen[0] = 0;
  2211. if (fsg->data_dir != DATA_DIR_UNKNOWN)
  2212. sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
  2213. fsg->data_size);
  2214. VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
  2215. name, cmnd_size, dirletter[(int) data_dir],
  2216. fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
  2217. /* We can't reply at all until we know the correct data direction
  2218. * and size. */
  2219. if (fsg->data_size_from_cmnd == 0)
  2220. data_dir = DATA_DIR_NONE;
  2221. if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI
  2222. fsg->data_dir = data_dir;
  2223. fsg->data_size = fsg->data_size_from_cmnd;
  2224. } else { // Bulk-only
  2225. if (fsg->data_size < fsg->data_size_from_cmnd) {
  2226. /* Host data size < Device data size is a phase error.
  2227. * Carry out the command, but only transfer as much
  2228. * as we are allowed. */
  2229. fsg->data_size_from_cmnd = fsg->data_size;
  2230. fsg->phase_error = 1;
  2231. }
  2232. }
  2233. fsg->residue = fsg->usb_amount_left = fsg->data_size;
  2234. /* Conflicting data directions is a phase error */
  2235. if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
  2236. fsg->phase_error = 1;
  2237. return -EINVAL;
  2238. }
  2239. /* Verify the length of the command itself */
  2240. if (cmnd_size != fsg->cmnd_size) {
  2241. /* Special case workaround: MS-Windows issues REQUEST SENSE
  2242. * with cbw->Length == 12 (it should be 6). */
  2243. if (fsg->cmnd[0] == SC_REQUEST_SENSE && fsg->cmnd_size == 12)
  2244. cmnd_size = fsg->cmnd_size;
  2245. else {
  2246. fsg->phase_error = 1;
  2247. return -EINVAL;
  2248. }
  2249. }
  2250. /* Check that the LUN values are consistent */
  2251. if (transport_is_bbb()) {
  2252. if (fsg->lun != lun)
  2253. DBG(fsg, "using LUN %d from CBW, "
  2254. "not LUN %d from CDB\n",
  2255. fsg->lun, lun);
  2256. } else
  2257. fsg->lun = lun; // Use LUN from the command
  2258. /* Check the LUN */
  2259. if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
  2260. fsg->curlun = curlun = &fsg->luns[fsg->lun];
  2261. if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2262. curlun->sense_data = SS_NO_SENSE;
  2263. curlun->sense_data_info = 0;
  2264. curlun->info_valid = 0;
  2265. }
  2266. } else {
  2267. fsg->curlun = curlun = NULL;
  2268. fsg->bad_lun_okay = 0;
  2269. /* INQUIRY and REQUEST SENSE commands are explicitly allowed
  2270. * to use unsupported LUNs; all others may not. */
  2271. if (fsg->cmnd[0] != SC_INQUIRY &&
  2272. fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2273. DBG(fsg, "unsupported LUN %d\n", fsg->lun);
  2274. return -EINVAL;
  2275. }
  2276. }
  2277. /* If a unit attention condition exists, only INQUIRY and
  2278. * REQUEST SENSE commands are allowed; anything else must fail. */
  2279. if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
  2280. fsg->cmnd[0] != SC_INQUIRY &&
  2281. fsg->cmnd[0] != SC_REQUEST_SENSE) {
  2282. curlun->sense_data = curlun->unit_attention_data;
  2283. curlun->unit_attention_data = SS_NO_SENSE;
  2284. return -EINVAL;
  2285. }
  2286. /* Check that only command bytes listed in the mask are non-zero */
  2287. fsg->cmnd[1] &= 0x1f; // Mask away the LUN
  2288. for (i = 1; i < cmnd_size; ++i) {
  2289. if (fsg->cmnd[i] && !(mask & (1 << i))) {
  2290. if (curlun)
  2291. curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
  2292. return -EINVAL;
  2293. }
  2294. }
  2295. /* If the medium isn't mounted and the command needs to access
  2296. * it, return an error. */
  2297. if (curlun && !backing_file_is_open(curlun) && needs_medium) {
  2298. curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
  2299. return -EINVAL;
  2300. }
  2301. return 0;
  2302. }
  2303. static int do_scsi_command(struct fsg_dev *fsg)
  2304. {
  2305. struct fsg_buffhd *bh;
  2306. int rc;
  2307. int reply = -EINVAL;
  2308. int i;
  2309. static char unknown[16];
  2310. dump_cdb(fsg);
  2311. /* Wait for the next buffer to become available for data or status */
  2312. bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
  2313. while (bh->state != BUF_STATE_EMPTY) {
  2314. rc = sleep_thread(fsg);
  2315. if (rc)
  2316. return rc;
  2317. }
  2318. fsg->phase_error = 0;
  2319. fsg->short_packet_received = 0;
  2320. down_read(&fsg->filesem); // We're using the backing file
  2321. switch (fsg->cmnd[0]) {
  2322. case SC_INQUIRY:
  2323. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2324. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2325. (1<<4), 0,
  2326. "INQUIRY")) == 0)
  2327. reply = do_inquiry(fsg, bh);
  2328. break;
  2329. case SC_MODE_SELECT_6:
  2330. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2331. if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
  2332. (1<<1) | (1<<4), 0,
  2333. "MODE SELECT(6)")) == 0)
  2334. reply = do_mode_select(fsg, bh);
  2335. break;
  2336. case SC_MODE_SELECT_10:
  2337. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2338. if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
  2339. (1<<1) | (3<<7), 0,
  2340. "MODE SELECT(10)")) == 0)
  2341. reply = do_mode_select(fsg, bh);
  2342. break;
  2343. case SC_MODE_SENSE_6:
  2344. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2345. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2346. (1<<1) | (1<<2) | (1<<4), 0,
  2347. "MODE SENSE(6)")) == 0)
  2348. reply = do_mode_sense(fsg, bh);
  2349. break;
  2350. case SC_MODE_SENSE_10:
  2351. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2352. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2353. (1<<1) | (1<<2) | (3<<7), 0,
  2354. "MODE SENSE(10)")) == 0)
  2355. reply = do_mode_sense(fsg, bh);
  2356. break;
  2357. case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
  2358. fsg->data_size_from_cmnd = 0;
  2359. if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
  2360. (1<<4), 0,
  2361. "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
  2362. reply = do_prevent_allow(fsg);
  2363. break;
  2364. case SC_READ_6:
  2365. i = fsg->cmnd[4];
  2366. fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
  2367. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2368. (7<<1) | (1<<4), 1,
  2369. "READ(6)")) == 0)
  2370. reply = do_read(fsg);
  2371. break;
  2372. case SC_READ_10:
  2373. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
  2374. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2375. (1<<1) | (0xf<<2) | (3<<7), 1,
  2376. "READ(10)")) == 0)
  2377. reply = do_read(fsg);
  2378. break;
  2379. case SC_READ_12:
  2380. fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
  2381. if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
  2382. (1<<1) | (0xf<<2) | (0xf<<6), 1,
  2383. "READ(12)")) == 0)
  2384. reply = do_read(fsg);
  2385. break;
  2386. case SC_READ_CAPACITY:
  2387. fsg->data_size_from_cmnd = 8;
  2388. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2389. (0xf<<2) | (1<<8), 1,
  2390. "READ CAPACITY")) == 0)
  2391. reply = do_read_capacity(fsg, bh);
  2392. break;
  2393. case SC_READ_FORMAT_CAPACITIES:
  2394. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
  2395. if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
  2396. (3<<7), 1,
  2397. "READ FORMAT CAPACITIES")) == 0)
  2398. reply = do_read_format_capacities(fsg, bh);
  2399. break;
  2400. case SC_REQUEST_SENSE:
  2401. fsg->data_size_from_cmnd = fsg->cmnd[4];
  2402. if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
  2403. (1<<4), 0,
  2404. "REQUEST SENSE")) == 0)
  2405. reply = do_request_sense(fsg, bh);
  2406. break;
  2407. case SC_START_STOP_UNIT:
  2408. fsg->data_size_from_cmnd = 0;
  2409. if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
  2410. (1<<1) | (1<<4), 0,
  2411. "START-STOP UNIT")) == 0)
  2412. reply = do_start_stop(fsg);
  2413. break;
  2414. case SC_SYNCHRONIZE_CACHE:
  2415. fsg->data_size_from_cmnd = 0;
  2416. if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
  2417. (0xf<<2) | (3<<7), 1,
  2418. "SYNCHRONIZE CACHE")) == 0)
  2419. reply = do_synchronize_cache(fsg);
  2420. break;
  2421. case SC_TEST_UNIT_READY:
  2422. fsg->data_size_from_cmnd = 0;
  2423. reply = check_command(fsg, 6, DATA_DIR_NONE,
  2424. 0, 1,
  2425. "TEST UNIT READY");
  2426. break;
  2427. /* Although optional, this command is used by MS-Windows. We
  2428. * support a minimal version: BytChk must be 0. */
  2429. case SC_VERIFY:
  2430. fsg->data_size_from_cmnd = 0;
  2431. if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
  2432. (1<<1) | (0xf<<2) | (3<<7), 1,
  2433. "VERIFY")) == 0)
  2434. reply = do_verify(fsg);
  2435. break;
  2436. case SC_WRITE_6:
  2437. i = fsg->cmnd[4];
  2438. fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
  2439. if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
  2440. (7<<1) | (1<<4), 1,
  2441. "WRITE(6)")) == 0)
  2442. reply = do_write(fsg);
  2443. break;
  2444. case SC_WRITE_10:
  2445. fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
  2446. if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
  2447. (1<<1) | (0xf<<2) | (3<<7), 1,
  2448. "WRITE(10)")) == 0)
  2449. reply = do_write(fsg);
  2450. break;
  2451. case SC_WRITE_12:
  2452. fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
  2453. if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
  2454. (1<<1) | (0xf<<2) | (0xf<<6), 1,
  2455. "WRITE(12)")) == 0)
  2456. reply = do_write(fsg);
  2457. break;
  2458. /* Some mandatory commands that we recognize but don't implement.
  2459. * They don't mean much in this setting. It's left as an exercise
  2460. * for anyone interested to implement RESERVE and RELEASE in terms
  2461. * of Posix locks. */
  2462. case SC_FORMAT_UNIT:
  2463. case SC_RELEASE:
  2464. case SC_RESERVE:
  2465. case SC_SEND_DIAGNOSTIC:
  2466. // Fall through
  2467. default:
  2468. fsg->data_size_from_cmnd = 0;
  2469. sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
  2470. if ((reply = check_command(fsg, fsg->cmnd_size,
  2471. DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
  2472. fsg->curlun->sense_data = SS_INVALID_COMMAND;
  2473. reply = -EINVAL;
  2474. }
  2475. break;
  2476. }
  2477. up_read(&fsg->filesem);
  2478. if (reply == -EINTR || signal_pending(current))
  2479. return -EINTR;
  2480. /* Set up the single reply buffer for finish_reply() */
  2481. if (reply == -EINVAL)
  2482. reply = 0; // Error reply length
  2483. if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
  2484. reply = min((u32) reply, fsg->data_size_from_cmnd);
  2485. bh->inreq->length = reply;
  2486. bh->state = BUF_STATE_FULL;
  2487. fsg->residue -= reply;
  2488. } // Otherwise it's already set
  2489. return 0;
  2490. }
  2491. /*-------------------------------------------------------------------------*/
  2492. static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
  2493. {
  2494. struct usb_request *req = bh->outreq;
  2495. struct bulk_cb_wrap *cbw = req->buf;
  2496. /* Was this a real packet? Should it be ignored? */
  2497. if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
  2498. return -EINVAL;
  2499. /* Is the CBW valid? */
  2500. if (req->actual != USB_BULK_CB_WRAP_LEN ||
  2501. cbw->Signature != __constant_cpu_to_le32(
  2502. USB_BULK_CB_SIG)) {
  2503. DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
  2504. req->actual,
  2505. le32_to_cpu(cbw->Signature));
  2506. /* The Bulk-only spec says we MUST stall the IN endpoint
  2507. * (6.6.1), so it's unavoidable. It also says we must
  2508. * retain this state until the next reset, but there's
  2509. * no way to tell the controller driver it should ignore
  2510. * Clear-Feature(HALT) requests.
  2511. *
  2512. * We aren't required to halt the OUT endpoint; instead
  2513. * we can simply accept and discard any data received
  2514. * until the next reset. */
  2515. wedge_bulk_in_endpoint(fsg);
  2516. set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
  2517. return -EINVAL;
  2518. }
  2519. /* Is the CBW meaningful? */
  2520. if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
  2521. cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
  2522. DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
  2523. "cmdlen %u\n",
  2524. cbw->Lun, cbw->Flags, cbw->Length);
  2525. /* We can do anything we want here, so let's stall the
  2526. * bulk pipes if we are allowed to. */
  2527. if (mod_data.can_stall) {
  2528. fsg_set_halt(fsg, fsg->bulk_out);
  2529. halt_bulk_in_endpoint(fsg);
  2530. }
  2531. return -EINVAL;
  2532. }
  2533. /* Save the command for later */
  2534. fsg->cmnd_size = cbw->Length;
  2535. memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
  2536. if (cbw->Flags & USB_BULK_IN_FLAG)
  2537. fsg->data_dir = DATA_DIR_TO_HOST;
  2538. else
  2539. fsg->data_dir = DATA_DIR_FROM_HOST;
  2540. fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
  2541. if (fsg->data_size == 0)
  2542. fsg->data_dir = DATA_DIR_NONE;
  2543. fsg->lun = cbw->Lun;
  2544. fsg->tag = cbw->Tag;
  2545. return 0;
  2546. }
  2547. static int get_next_command(struct fsg_dev *fsg)
  2548. {
  2549. struct fsg_buffhd *bh;
  2550. int rc = 0;
  2551. if (transport_is_bbb()) {
  2552. /* Wait for the next buffer to become available */
  2553. bh = fsg->next_buffhd_to_fill;
  2554. while (bh->state != BUF_STATE_EMPTY) {
  2555. rc = sleep_thread(fsg);
  2556. if (rc)
  2557. return rc;
  2558. }
  2559. /* Queue a request to read a Bulk-only CBW */
  2560. set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
  2561. bh->outreq->short_not_ok = 1;
  2562. start_transfer(fsg, fsg->bulk_out, bh->outreq,
  2563. &bh->outreq_busy, &bh->state);
  2564. /* We will drain the buffer in software, which means we
  2565. * can reuse it for the next filling. No need to advance
  2566. * next_buffhd_to_fill. */
  2567. /* Wait for the CBW to arrive */
  2568. while (bh->state != BUF_STATE_FULL) {
  2569. rc = sleep_thread(fsg);
  2570. if (rc)
  2571. return rc;
  2572. }
  2573. smp_rmb();
  2574. rc = received_cbw(fsg, bh);
  2575. bh->state = BUF_STATE_EMPTY;
  2576. } else { // USB_PR_CB or USB_PR_CBI
  2577. /* Wait for the next command to arrive */
  2578. while (fsg->cbbuf_cmnd_size == 0) {
  2579. rc = sleep_thread(fsg);
  2580. if (rc)
  2581. return rc;
  2582. }
  2583. /* Is the previous status interrupt request still busy?
  2584. * The host is allowed to skip reading the status,
  2585. * so we must cancel it. */
  2586. if (fsg->intreq_busy)
  2587. usb_ep_dequeue(fsg->intr_in, fsg->intreq);
  2588. /* Copy the command and mark the buffer empty */
  2589. fsg->data_dir = DATA_DIR_UNKNOWN;
  2590. spin_lock_irq(&fsg->lock);
  2591. fsg->cmnd_size = fsg->cbbuf_cmnd_size;
  2592. memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
  2593. fsg->cbbuf_cmnd_size = 0;
  2594. spin_unlock_irq(&fsg->lock);
  2595. }
  2596. return rc;
  2597. }
  2598. /*-------------------------------------------------------------------------*/
  2599. static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
  2600. const struct usb_endpoint_descriptor *d)
  2601. {
  2602. int rc;
  2603. ep->driver_data = fsg;
  2604. rc = usb_ep_enable(ep, d);
  2605. if (rc)
  2606. ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
  2607. return rc;
  2608. }
  2609. static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
  2610. struct usb_request **preq)
  2611. {
  2612. *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
  2613. if (*preq)
  2614. return 0;
  2615. ERROR(fsg, "can't allocate request for %s\n", ep->name);
  2616. return -ENOMEM;
  2617. }
  2618. /*
  2619. * Reset interface setting and re-init endpoint state (toggle etc).
  2620. * Call with altsetting < 0 to disable the interface. The only other
  2621. * available altsetting is 0, which enables the interface.
  2622. */
  2623. static int do_set_interface(struct fsg_dev *fsg, int altsetting)
  2624. {
  2625. int rc = 0;
  2626. int i;
  2627. const struct usb_endpoint_descriptor *d;
  2628. if (fsg->running)
  2629. DBG(fsg, "reset interface\n");
  2630. reset:
  2631. /* Deallocate the requests */
  2632. for (i = 0; i < NUM_BUFFERS; ++i) {
  2633. struct fsg_buffhd *bh = &fsg->buffhds[i];
  2634. if (bh->inreq) {
  2635. usb_ep_free_request(fsg->bulk_in, bh->inreq);
  2636. bh->inreq = NULL;
  2637. }
  2638. if (bh->outreq) {
  2639. usb_ep_free_request(fsg->bulk_out, bh->outreq);
  2640. bh->outreq = NULL;
  2641. }
  2642. }
  2643. if (fsg->intreq) {
  2644. usb_ep_free_request(fsg->intr_in, fsg->intreq);
  2645. fsg->intreq = NULL;
  2646. }
  2647. /* Disable the endpoints */
  2648. if (fsg->bulk_in_enabled) {
  2649. usb_ep_disable(fsg->bulk_in);
  2650. fsg->bulk_in_enabled = 0;
  2651. }
  2652. if (fsg->bulk_out_enabled) {
  2653. usb_ep_disable(fsg->bulk_out);
  2654. fsg->bulk_out_enabled = 0;
  2655. }
  2656. if (fsg->intr_in_enabled) {
  2657. usb_ep_disable(fsg->intr_in);
  2658. fsg->intr_in_enabled = 0;
  2659. }
  2660. fsg->running = 0;
  2661. if (altsetting < 0 || rc != 0)
  2662. return rc;
  2663. DBG(fsg, "set interface %d\n", altsetting);
  2664. /* Enable the endpoints */
  2665. d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
  2666. if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
  2667. goto reset;
  2668. fsg->bulk_in_enabled = 1;
  2669. d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
  2670. if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
  2671. goto reset;
  2672. fsg->bulk_out_enabled = 1;
  2673. fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
  2674. clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
  2675. if (transport_is_cbi()) {
  2676. d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
  2677. if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
  2678. goto reset;
  2679. fsg->intr_in_enabled = 1;
  2680. }
  2681. /* Allocate the requests */
  2682. for (i = 0; i < NUM_BUFFERS; ++i) {
  2683. struct fsg_buffhd *bh = &fsg->buffhds[i];
  2684. if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
  2685. goto reset;
  2686. if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
  2687. goto reset;
  2688. bh->inreq->buf = bh->outreq->buf = bh->buf;
  2689. bh->inreq->context = bh->outreq->context = bh;
  2690. bh->inreq->complete = bulk_in_complete;
  2691. bh->outreq->complete = bulk_out_complete;
  2692. }
  2693. if (transport_is_cbi()) {
  2694. if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
  2695. goto reset;
  2696. fsg->intreq->complete = intr_in_complete;
  2697. }
  2698. fsg->running = 1;
  2699. for (i = 0; i < fsg->nluns; ++i)
  2700. fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
  2701. return rc;
  2702. }
  2703. /*
  2704. * Change our operational configuration. This code must agree with the code
  2705. * that returns config descriptors, and with interface altsetting code.
  2706. *
  2707. * It's also responsible for power management interactions. Some
  2708. * configurations might not work with our current power sources.
  2709. * For now we just assume the gadget is always self-powered.
  2710. */
  2711. static int do_set_config(struct fsg_dev *fsg, u8 new_config)
  2712. {
  2713. int rc = 0;
  2714. /* Disable the single interface */
  2715. if (fsg->config != 0) {
  2716. DBG(fsg, "reset config\n");
  2717. fsg->config = 0;
  2718. rc = do_set_interface(fsg, -1);
  2719. }
  2720. /* Enable the interface */
  2721. if (new_config != 0) {
  2722. fsg->config = new_config;
  2723. if ((rc = do_set_interface(fsg, 0)) != 0)
  2724. fsg->config = 0; // Reset on errors
  2725. else {
  2726. char *speed;
  2727. switch (fsg->gadget->speed) {
  2728. case USB_SPEED_LOW: speed = "low"; break;
  2729. case USB_SPEED_FULL: speed = "full"; break;
  2730. case USB_SPEED_HIGH: speed = "high"; break;
  2731. default: speed = "?"; break;
  2732. }
  2733. INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
  2734. }
  2735. }
  2736. return rc;
  2737. }
  2738. /*-------------------------------------------------------------------------*/
  2739. static void handle_exception(struct fsg_dev *fsg)
  2740. {
  2741. siginfo_t info;
  2742. int sig;
  2743. int i;
  2744. int num_active;
  2745. struct fsg_buffhd *bh;
  2746. enum fsg_state old_state;
  2747. u8 new_config;
  2748. struct lun *curlun;
  2749. unsigned int exception_req_tag;
  2750. int rc;
  2751. /* Clear the existing signals. Anything but SIGUSR1 is converted
  2752. * into a high-priority EXIT exception. */
  2753. for (;;) {
  2754. sig = dequeue_signal_lock(current, &current->blocked, &info);
  2755. if (!sig)
  2756. break;
  2757. if (sig != SIGUSR1) {
  2758. if (fsg->state < FSG_STATE_EXIT)
  2759. DBG(fsg, "Main thread exiting on signal\n");
  2760. raise_exception(fsg, FSG_STATE_EXIT);
  2761. }
  2762. }
  2763. /* Cancel all the pending transfers */
  2764. if (fsg->intreq_busy)
  2765. usb_ep_dequeue(fsg->intr_in, fsg->intreq);
  2766. for (i = 0; i < NUM_BUFFERS; ++i) {
  2767. bh = &fsg->buffhds[i];
  2768. if (bh->inreq_busy)
  2769. usb_ep_dequeue(fsg->bulk_in, bh->inreq);
  2770. if (bh->outreq_busy)
  2771. usb_ep_dequeue(fsg->bulk_out, bh->outreq);
  2772. }
  2773. /* Wait until everything is idle */
  2774. for (;;) {
  2775. num_active = fsg->intreq_busy;
  2776. for (i = 0; i < NUM_BUFFERS; ++i) {
  2777. bh = &fsg->buffhds[i];
  2778. num_active += bh->inreq_busy + bh->outreq_busy;
  2779. }
  2780. if (num_active == 0)
  2781. break;
  2782. if (sleep_thread(fsg))
  2783. return;
  2784. }
  2785. /* Clear out the controller's fifos */
  2786. if (fsg->bulk_in_enabled)
  2787. usb_ep_fifo_flush(fsg->bulk_in);
  2788. if (fsg->bulk_out_enabled)
  2789. usb_ep_fifo_flush(fsg->bulk_out);
  2790. if (fsg->intr_in_enabled)
  2791. usb_ep_fifo_flush(fsg->intr_in);
  2792. /* Reset the I/O buffer states and pointers, the SCSI
  2793. * state, and the exception. Then invoke the handler. */
  2794. spin_lock_irq(&fsg->lock);
  2795. for (i = 0; i < NUM_BUFFERS; ++i) {
  2796. bh = &fsg->buffhds[i];
  2797. bh->state = BUF_STATE_EMPTY;
  2798. }
  2799. fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
  2800. &fsg->buffhds[0];
  2801. exception_req_tag = fsg->exception_req_tag;
  2802. new_config = fsg->new_config;
  2803. old_state = fsg->state;
  2804. if (old_state == FSG_STATE_ABORT_BULK_OUT)
  2805. fsg->state = FSG_STATE_STATUS_PHASE;
  2806. else {
  2807. for (i = 0; i < fsg->nluns; ++i) {
  2808. curlun = &fsg->luns[i];
  2809. curlun->prevent_medium_removal = 0;
  2810. curlun->sense_data = curlun->unit_attention_data =
  2811. SS_NO_SENSE;
  2812. curlun->sense_data_info = 0;
  2813. curlun->info_valid = 0;
  2814. }
  2815. fsg->state = FSG_STATE_IDLE;
  2816. }
  2817. spin_unlock_irq(&fsg->lock);
  2818. /* Carry out any extra actions required for the exception */
  2819. switch (old_state) {
  2820. default:
  2821. break;
  2822. case FSG_STATE_ABORT_BULK_OUT:
  2823. send_status(fsg);
  2824. spin_lock_irq(&fsg->lock);
  2825. if (fsg->state == FSG_STATE_STATUS_PHASE)
  2826. fsg->state = FSG_STATE_IDLE;
  2827. spin_unlock_irq(&fsg->lock);
  2828. break;
  2829. case FSG_STATE_RESET:
  2830. /* In case we were forced against our will to halt a
  2831. * bulk endpoint, clear the halt now. (The SuperH UDC
  2832. * requires this.) */
  2833. if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
  2834. usb_ep_clear_halt(fsg->bulk_in);
  2835. if (transport_is_bbb()) {
  2836. if (fsg->ep0_req_tag == exception_req_tag)
  2837. ep0_queue(fsg); // Complete the status stage
  2838. } else if (transport_is_cbi())
  2839. send_status(fsg); // Status by interrupt pipe
  2840. /* Technically this should go here, but it would only be
  2841. * a waste of time. Ditto for the INTERFACE_CHANGE and
  2842. * CONFIG_CHANGE cases. */
  2843. // for (i = 0; i < fsg->nluns; ++i)
  2844. // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
  2845. break;
  2846. case FSG_STATE_INTERFACE_CHANGE:
  2847. rc = do_set_interface(fsg, 0);
  2848. if (fsg->ep0_req_tag != exception_req_tag)
  2849. break;
  2850. if (rc != 0) // STALL on errors
  2851. fsg_set_halt(fsg, fsg->ep0);
  2852. else // Complete the status stage
  2853. ep0_queue(fsg);
  2854. break;
  2855. case FSG_STATE_CONFIG_CHANGE:
  2856. rc = do_set_config(fsg, new_config);
  2857. if (fsg->ep0_req_tag != exception_req_tag)
  2858. break;
  2859. if (rc != 0) // STALL on errors
  2860. fsg_set_halt(fsg, fsg->ep0);
  2861. else // Complete the status stage
  2862. ep0_queue(fsg);
  2863. break;
  2864. case FSG_STATE_DISCONNECT:
  2865. fsync_all(fsg);
  2866. do_set_config(fsg, 0); // Unconfigured state
  2867. break;
  2868. case FSG_STATE_EXIT:
  2869. case FSG_STATE_TERMINATED:
  2870. do_set_config(fsg, 0); // Free resources
  2871. spin_lock_irq(&fsg->lock);
  2872. fsg->state = FSG_STATE_TERMINATED; // Stop the thread
  2873. spin_unlock_irq(&fsg->lock);
  2874. break;
  2875. }
  2876. }
  2877. /*-------------------------------------------------------------------------*/
  2878. static int fsg_main_thread(void *fsg_)
  2879. {
  2880. struct fsg_dev *fsg = fsg_;
  2881. /* Allow the thread to be killed by a signal, but set the signal mask
  2882. * to block everything but INT, TERM, KILL, and USR1. */
  2883. allow_signal(SIGINT);
  2884. allow_signal(SIGTERM);
  2885. allow_signal(SIGKILL);
  2886. allow_signal(SIGUSR1);
  2887. /* Allow the thread to be frozen */
  2888. set_freezable();
  2889. /* Arrange for userspace references to be interpreted as kernel
  2890. * pointers. That way we can pass a kernel pointer to a routine
  2891. * that expects a __user pointer and it will work okay. */
  2892. set_fs(get_ds());
  2893. /* The main loop */
  2894. while (fsg->state != FSG_STATE_TERMINATED) {
  2895. if (exception_in_progress(fsg) || signal_pending(current)) {
  2896. handle_exception(fsg);
  2897. continue;
  2898. }
  2899. if (!fsg->running) {
  2900. sleep_thread(fsg);
  2901. continue;
  2902. }
  2903. if (get_next_command(fsg))
  2904. continue;
  2905. spin_lock_irq(&fsg->lock);
  2906. if (!exception_in_progress(fsg))
  2907. fsg->state = FSG_STATE_DATA_PHASE;
  2908. spin_unlock_irq(&fsg->lock);
  2909. if (do_scsi_command(fsg) || finish_reply(fsg))
  2910. continue;
  2911. spin_lock_irq(&fsg->lock);
  2912. if (!exception_in_progress(fsg))
  2913. fsg->state = FSG_STATE_STATUS_PHASE;
  2914. spin_unlock_irq(&fsg->lock);
  2915. if (send_status(fsg))
  2916. continue;
  2917. spin_lock_irq(&fsg->lock);
  2918. if (!exception_in_progress(fsg))
  2919. fsg->state = FSG_STATE_IDLE;
  2920. spin_unlock_irq(&fsg->lock);
  2921. }
  2922. spin_lock_irq(&fsg->lock);
  2923. fsg->thread_task = NULL;
  2924. spin_unlock_irq(&fsg->lock);
  2925. /* In case we are exiting because of a signal, unregister the
  2926. * gadget driver and close the backing file. */
  2927. if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) {
  2928. usb_gadget_unregister_driver(&fsg_driver);
  2929. close_all_backing_files(fsg);
  2930. }
  2931. /* Let the unbind and cleanup routines know the thread has exited */
  2932. complete_and_exit(&fsg->thread_notifier, 0);
  2933. }
  2934. /*-------------------------------------------------------------------------*/
  2935. /* If the next two routines are called while the gadget is registered,
  2936. * the caller must own fsg->filesem for writing. */
  2937. static int open_backing_file(struct lun *curlun, const char *filename)
  2938. {
  2939. int ro;
  2940. struct file *filp = NULL;
  2941. int rc = -EINVAL;
  2942. struct inode *inode = NULL;
  2943. loff_t size;
  2944. loff_t num_sectors;
  2945. /* R/W if we can, R/O if we must */
  2946. ro = curlun->ro;
  2947. if (!ro) {
  2948. filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
  2949. if (-EROFS == PTR_ERR(filp))
  2950. ro = 1;
  2951. }
  2952. if (ro)
  2953. filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
  2954. if (IS_ERR(filp)) {
  2955. LINFO(curlun, "unable to open backing file: %s\n", filename);
  2956. return PTR_ERR(filp);
  2957. }
  2958. if (!(filp->f_mode & FMODE_WRITE))
  2959. ro = 1;
  2960. if (filp->f_path.dentry)
  2961. inode = filp->f_path.dentry->d_inode;
  2962. if (inode && S_ISBLK(inode->i_mode)) {
  2963. if (bdev_read_only(inode->i_bdev))
  2964. ro = 1;
  2965. } else if (!inode || !S_ISREG(inode->i_mode)) {
  2966. LINFO(curlun, "invalid file type: %s\n", filename);
  2967. goto out;
  2968. }
  2969. /* If we can't read the file, it's no good.
  2970. * If we can't write the file, use it read-only. */
  2971. if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
  2972. LINFO(curlun, "file not readable: %s\n", filename);
  2973. goto out;
  2974. }
  2975. if (!(filp->f_op->write || filp->f_op->aio_write))
  2976. ro = 1;
  2977. size = i_size_read(inode->i_mapping->host);
  2978. if (size < 0) {
  2979. LINFO(curlun, "unable to find file size: %s\n", filename);
  2980. rc = (int) size;
  2981. goto out;
  2982. }
  2983. num_sectors = size >> 9; // File size in 512-byte sectors
  2984. if (num_sectors == 0) {
  2985. LINFO(curlun, "file too small: %s\n", filename);
  2986. rc = -ETOOSMALL;
  2987. goto out;
  2988. }
  2989. get_file(filp);
  2990. curlun->ro = ro;
  2991. curlun->filp = filp;
  2992. curlun->file_length = size;
  2993. curlun->num_sectors = num_sectors;
  2994. LDBG(curlun, "open backing file: %s\n", filename);
  2995. rc = 0;
  2996. out:
  2997. filp_close(filp, current->files);
  2998. return rc;
  2999. }
  3000. static void close_backing_file(struct lun *curlun)
  3001. {
  3002. if (curlun->filp) {
  3003. LDBG(curlun, "close backing file\n");
  3004. fput(curlun->filp);
  3005. curlun->filp = NULL;
  3006. }
  3007. }
  3008. static void close_all_backing_files(struct fsg_dev *fsg)
  3009. {
  3010. int i;
  3011. for (i = 0; i < fsg->nluns; ++i)
  3012. close_backing_file(&fsg->luns[i]);
  3013. }
  3014. static ssize_t show_ro(struct device *dev, struct device_attribute *attr, char *buf)
  3015. {
  3016. struct lun *curlun = dev_to_lun(dev);
  3017. return sprintf(buf, "%d\n", curlun->ro);
  3018. }
  3019. static ssize_t show_file(struct device *dev, struct device_attribute *attr,
  3020. char *buf)
  3021. {
  3022. struct lun *curlun = dev_to_lun(dev);
  3023. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3024. char *p;
  3025. ssize_t rc;
  3026. down_read(&fsg->filesem);
  3027. if (backing_file_is_open(curlun)) { // Get the complete pathname
  3028. p = d_path(&curlun->filp->f_path, buf, PAGE_SIZE - 1);
  3029. if (IS_ERR(p))
  3030. rc = PTR_ERR(p);
  3031. else {
  3032. rc = strlen(p);
  3033. memmove(buf, p, rc);
  3034. buf[rc] = '\n'; // Add a newline
  3035. buf[++rc] = 0;
  3036. }
  3037. } else { // No file, return 0 bytes
  3038. *buf = 0;
  3039. rc = 0;
  3040. }
  3041. up_read(&fsg->filesem);
  3042. return rc;
  3043. }
  3044. static ssize_t store_ro(struct device *dev, struct device_attribute *attr,
  3045. const char *buf, size_t count)
  3046. {
  3047. ssize_t rc = count;
  3048. struct lun *curlun = dev_to_lun(dev);
  3049. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3050. int i;
  3051. if (sscanf(buf, "%d", &i) != 1)
  3052. return -EINVAL;
  3053. /* Allow the write-enable status to change only while the backing file
  3054. * is closed. */
  3055. down_read(&fsg->filesem);
  3056. if (backing_file_is_open(curlun)) {
  3057. LDBG(curlun, "read-only status change prevented\n");
  3058. rc = -EBUSY;
  3059. } else {
  3060. curlun->ro = !!i;
  3061. LDBG(curlun, "read-only status set to %d\n", curlun->ro);
  3062. }
  3063. up_read(&fsg->filesem);
  3064. return rc;
  3065. }
  3066. static ssize_t store_file(struct device *dev, struct device_attribute *attr,
  3067. const char *buf, size_t count)
  3068. {
  3069. struct lun *curlun = dev_to_lun(dev);
  3070. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3071. int rc = 0;
  3072. if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
  3073. LDBG(curlun, "eject attempt prevented\n");
  3074. return -EBUSY; // "Door is locked"
  3075. }
  3076. /* Remove a trailing newline */
  3077. if (count > 0 && buf[count-1] == '\n')
  3078. ((char *) buf)[count-1] = 0; // Ugh!
  3079. /* Eject current medium */
  3080. down_write(&fsg->filesem);
  3081. if (backing_file_is_open(curlun)) {
  3082. close_backing_file(curlun);
  3083. curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
  3084. }
  3085. /* Load new medium */
  3086. if (count > 0 && buf[0]) {
  3087. rc = open_backing_file(curlun, buf);
  3088. if (rc == 0)
  3089. curlun->unit_attention_data =
  3090. SS_NOT_READY_TO_READY_TRANSITION;
  3091. }
  3092. up_write(&fsg->filesem);
  3093. return (rc < 0 ? rc : count);
  3094. }
  3095. /* The write permissions and store_xxx pointers are set in fsg_bind() */
  3096. static DEVICE_ATTR(ro, 0444, show_ro, NULL);
  3097. static DEVICE_ATTR(file, 0444, show_file, NULL);
  3098. /*-------------------------------------------------------------------------*/
  3099. static void fsg_release(struct kref *ref)
  3100. {
  3101. struct fsg_dev *fsg = container_of(ref, struct fsg_dev, ref);
  3102. kfree(fsg->luns);
  3103. kfree(fsg);
  3104. }
  3105. static void lun_release(struct device *dev)
  3106. {
  3107. struct fsg_dev *fsg = dev_get_drvdata(dev);
  3108. kref_put(&fsg->ref, fsg_release);
  3109. }
  3110. static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
  3111. {
  3112. struct fsg_dev *fsg = get_gadget_data(gadget);
  3113. int i;
  3114. struct lun *curlun;
  3115. struct usb_request *req = fsg->ep0req;
  3116. DBG(fsg, "unbind\n");
  3117. clear_bit(REGISTERED, &fsg->atomic_bitflags);
  3118. /* Unregister the sysfs attribute files and the LUNs */
  3119. for (i = 0; i < fsg->nluns; ++i) {
  3120. curlun = &fsg->luns[i];
  3121. if (curlun->registered) {
  3122. device_remove_file(&curlun->dev, &dev_attr_ro);
  3123. device_remove_file(&curlun->dev, &dev_attr_file);
  3124. device_unregister(&curlun->dev);
  3125. curlun->registered = 0;
  3126. }
  3127. }
  3128. /* If the thread isn't already dead, tell it to exit now */
  3129. if (fsg->state != FSG_STATE_TERMINATED) {
  3130. raise_exception(fsg, FSG_STATE_EXIT);
  3131. wait_for_completion(&fsg->thread_notifier);
  3132. /* The cleanup routine waits for this completion also */
  3133. complete(&fsg->thread_notifier);
  3134. }
  3135. /* Free the data buffers */
  3136. for (i = 0; i < NUM_BUFFERS; ++i)
  3137. kfree(fsg->buffhds[i].buf);
  3138. /* Free the request and buffer for endpoint 0 */
  3139. if (req) {
  3140. kfree(req->buf);
  3141. usb_ep_free_request(fsg->ep0, req);
  3142. }
  3143. set_gadget_data(gadget, NULL);
  3144. }
  3145. static int __init check_parameters(struct fsg_dev *fsg)
  3146. {
  3147. int prot;
  3148. int gcnum;
  3149. /* Store the default values */
  3150. mod_data.transport_type = USB_PR_BULK;
  3151. mod_data.transport_name = "Bulk-only";
  3152. mod_data.protocol_type = USB_SC_SCSI;
  3153. mod_data.protocol_name = "Transparent SCSI";
  3154. if (gadget_is_sh(fsg->gadget))
  3155. mod_data.can_stall = 0;
  3156. if (mod_data.release == 0xffff) { // Parameter wasn't set
  3157. /* The sa1100 controller is not supported */
  3158. if (gadget_is_sa1100(fsg->gadget))
  3159. gcnum = -1;
  3160. else
  3161. gcnum = usb_gadget_controller_number(fsg->gadget);
  3162. if (gcnum >= 0)
  3163. mod_data.release = 0x0300 + gcnum;
  3164. else {
  3165. WARNING(fsg, "controller '%s' not recognized\n",
  3166. fsg->gadget->name);
  3167. mod_data.release = 0x0399;
  3168. }
  3169. }
  3170. prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
  3171. #ifdef CONFIG_USB_FILE_STORAGE_TEST
  3172. if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
  3173. ; // Use default setting
  3174. } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
  3175. mod_data.transport_type = USB_PR_CB;
  3176. mod_data.transport_name = "Control-Bulk";
  3177. } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
  3178. mod_data.transport_type = USB_PR_CBI;
  3179. mod_data.transport_name = "Control-Bulk-Interrupt";
  3180. } else {
  3181. ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
  3182. return -EINVAL;
  3183. }
  3184. if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
  3185. prot == USB_SC_SCSI) {
  3186. ; // Use default setting
  3187. } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
  3188. prot == USB_SC_RBC) {
  3189. mod_data.protocol_type = USB_SC_RBC;
  3190. mod_data.protocol_name = "RBC";
  3191. } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
  3192. strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
  3193. prot == USB_SC_8020) {
  3194. mod_data.protocol_type = USB_SC_8020;
  3195. mod_data.protocol_name = "8020i (ATAPI)";
  3196. } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
  3197. prot == USB_SC_QIC) {
  3198. mod_data.protocol_type = USB_SC_QIC;
  3199. mod_data.protocol_name = "QIC-157";
  3200. } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
  3201. prot == USB_SC_UFI) {
  3202. mod_data.protocol_type = USB_SC_UFI;
  3203. mod_data.protocol_name = "UFI";
  3204. } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
  3205. prot == USB_SC_8070) {
  3206. mod_data.protocol_type = USB_SC_8070;
  3207. mod_data.protocol_name = "8070i";
  3208. } else {
  3209. ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
  3210. return -EINVAL;
  3211. }
  3212. mod_data.buflen &= PAGE_CACHE_MASK;
  3213. if (mod_data.buflen <= 0) {
  3214. ERROR(fsg, "invalid buflen\n");
  3215. return -ETOOSMALL;
  3216. }
  3217. #endif /* CONFIG_USB_FILE_STORAGE_TEST */
  3218. return 0;
  3219. }
  3220. static int __init fsg_bind(struct usb_gadget *gadget)
  3221. {
  3222. struct fsg_dev *fsg = the_fsg;
  3223. int rc;
  3224. int i;
  3225. struct lun *curlun;
  3226. struct usb_ep *ep;
  3227. struct usb_request *req;
  3228. char *pathbuf, *p;
  3229. fsg->gadget = gadget;
  3230. set_gadget_data(gadget, fsg);
  3231. fsg->ep0 = gadget->ep0;
  3232. fsg->ep0->driver_data = fsg;
  3233. if ((rc = check_parameters(fsg)) != 0)
  3234. goto out;
  3235. if (mod_data.removable) { // Enable the store_xxx attributes
  3236. dev_attr_ro.attr.mode = dev_attr_file.attr.mode = 0644;
  3237. dev_attr_ro.store = store_ro;
  3238. dev_attr_file.store = store_file;
  3239. }
  3240. /* Find out how many LUNs there should be */
  3241. i = mod_data.nluns;
  3242. if (i == 0)
  3243. i = max(mod_data.num_filenames, 1u);
  3244. if (i > MAX_LUNS) {
  3245. ERROR(fsg, "invalid number of LUNs: %d\n", i);
  3246. rc = -EINVAL;
  3247. goto out;
  3248. }
  3249. /* Create the LUNs, open their backing files, and register the
  3250. * LUN devices in sysfs. */
  3251. fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
  3252. if (!fsg->luns) {
  3253. rc = -ENOMEM;
  3254. goto out;
  3255. }
  3256. fsg->nluns = i;
  3257. for (i = 0; i < fsg->nluns; ++i) {
  3258. curlun = &fsg->luns[i];
  3259. curlun->ro = mod_data.ro[i];
  3260. curlun->dev.release = lun_release;
  3261. curlun->dev.parent = &gadget->dev;
  3262. curlun->dev.driver = &fsg_driver.driver;
  3263. dev_set_drvdata(&curlun->dev, fsg);
  3264. dev_set_name(&curlun->dev,"%s-lun%d",
  3265. dev_name(&gadget->dev), i);
  3266. if ((rc = device_register(&curlun->dev)) != 0) {
  3267. INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
  3268. goto out;
  3269. }
  3270. if ((rc = device_create_file(&curlun->dev,
  3271. &dev_attr_ro)) != 0 ||
  3272. (rc = device_create_file(&curlun->dev,
  3273. &dev_attr_file)) != 0) {
  3274. device_unregister(&curlun->dev);
  3275. goto out;
  3276. }
  3277. curlun->registered = 1;
  3278. kref_get(&fsg->ref);
  3279. if (mod_data.file[i] && *mod_data.file[i]) {
  3280. if ((rc = open_backing_file(curlun,
  3281. mod_data.file[i])) != 0)
  3282. goto out;
  3283. } else if (!mod_data.removable) {
  3284. ERROR(fsg, "no file given for LUN%d\n", i);
  3285. rc = -EINVAL;
  3286. goto out;
  3287. }
  3288. }
  3289. /* Find all the endpoints we will use */
  3290. usb_ep_autoconfig_reset(gadget);
  3291. ep = usb_ep_autoconfig(gadget, &fs_bulk_in_desc);
  3292. if (!ep)
  3293. goto autoconf_fail;
  3294. ep->driver_data = fsg; // claim the endpoint
  3295. fsg->bulk_in = ep;
  3296. ep = usb_ep_autoconfig(gadget, &fs_bulk_out_desc);
  3297. if (!ep)
  3298. goto autoconf_fail;
  3299. ep->driver_data = fsg; // claim the endpoint
  3300. fsg->bulk_out = ep;
  3301. if (transport_is_cbi()) {
  3302. ep = usb_ep_autoconfig(gadget, &fs_intr_in_desc);
  3303. if (!ep)
  3304. goto autoconf_fail;
  3305. ep->driver_data = fsg; // claim the endpoint
  3306. fsg->intr_in = ep;
  3307. }
  3308. /* Fix up the descriptors */
  3309. device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
  3310. device_desc.idVendor = cpu_to_le16(mod_data.vendor);
  3311. device_desc.idProduct = cpu_to_le16(mod_data.product);
  3312. device_desc.bcdDevice = cpu_to_le16(mod_data.release);
  3313. i = (transport_is_cbi() ? 3 : 2); // Number of endpoints
  3314. intf_desc.bNumEndpoints = i;
  3315. intf_desc.bInterfaceSubClass = mod_data.protocol_type;
  3316. intf_desc.bInterfaceProtocol = mod_data.transport_type;
  3317. fs_function[i + FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
  3318. if (gadget_is_dualspeed(gadget)) {
  3319. hs_function[i + HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
  3320. /* Assume ep0 uses the same maxpacket value for both speeds */
  3321. dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
  3322. /* Assume endpoint addresses are the same for both speeds */
  3323. hs_bulk_in_desc.bEndpointAddress =
  3324. fs_bulk_in_desc.bEndpointAddress;
  3325. hs_bulk_out_desc.bEndpointAddress =
  3326. fs_bulk_out_desc.bEndpointAddress;
  3327. hs_intr_in_desc.bEndpointAddress =
  3328. fs_intr_in_desc.bEndpointAddress;
  3329. }
  3330. if (gadget_is_otg(gadget))
  3331. otg_desc.bmAttributes |= USB_OTG_HNP;
  3332. rc = -ENOMEM;
  3333. /* Allocate the request and buffer for endpoint 0 */
  3334. fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
  3335. if (!req)
  3336. goto out;
  3337. req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
  3338. if (!req->buf)
  3339. goto out;
  3340. req->complete = ep0_complete;
  3341. /* Allocate the data buffers */
  3342. for (i = 0; i < NUM_BUFFERS; ++i) {
  3343. struct fsg_buffhd *bh = &fsg->buffhds[i];
  3344. /* Allocate for the bulk-in endpoint. We assume that
  3345. * the buffer will also work with the bulk-out (and
  3346. * interrupt-in) endpoint. */
  3347. bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
  3348. if (!bh->buf)
  3349. goto out;
  3350. bh->next = bh + 1;
  3351. }
  3352. fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
  3353. /* This should reflect the actual gadget power source */
  3354. usb_gadget_set_selfpowered(gadget);
  3355. snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
  3356. init_utsname()->sysname, init_utsname()->release,
  3357. gadget->name);
  3358. /* On a real device, serial[] would be loaded from permanent
  3359. * storage. We just encode it from the driver version string. */
  3360. for (i = 0; i < sizeof(serial) - 2; i += 2) {
  3361. unsigned char c = DRIVER_VERSION[i / 2];
  3362. if (!c)
  3363. break;
  3364. sprintf(&serial[i], "%02X", c);
  3365. }
  3366. fsg->thread_task = kthread_create(fsg_main_thread, fsg,
  3367. "file-storage-gadget");
  3368. if (IS_ERR(fsg->thread_task)) {
  3369. rc = PTR_ERR(fsg->thread_task);
  3370. goto out;
  3371. }
  3372. INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
  3373. INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
  3374. pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
  3375. for (i = 0; i < fsg->nluns; ++i) {
  3376. curlun = &fsg->luns[i];
  3377. if (backing_file_is_open(curlun)) {
  3378. p = NULL;
  3379. if (pathbuf) {
  3380. p = d_path(&curlun->filp->f_path,
  3381. pathbuf, PATH_MAX);
  3382. if (IS_ERR(p))
  3383. p = NULL;
  3384. }
  3385. LINFO(curlun, "ro=%d, file: %s\n",
  3386. curlun->ro, (p ? p : "(error)"));
  3387. }
  3388. }
  3389. kfree(pathbuf);
  3390. DBG(fsg, "transport=%s (x%02x)\n",
  3391. mod_data.transport_name, mod_data.transport_type);
  3392. DBG(fsg, "protocol=%s (x%02x)\n",
  3393. mod_data.protocol_name, mod_data.protocol_type);
  3394. DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
  3395. mod_data.vendor, mod_data.product, mod_data.release);
  3396. DBG(fsg, "removable=%d, stall=%d, buflen=%u\n",
  3397. mod_data.removable, mod_data.can_stall,
  3398. mod_data.buflen);
  3399. DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
  3400. set_bit(REGISTERED, &fsg->atomic_bitflags);
  3401. /* Tell the thread to start working */
  3402. wake_up_process(fsg->thread_task);
  3403. return 0;
  3404. autoconf_fail:
  3405. ERROR(fsg, "unable to autoconfigure all endpoints\n");
  3406. rc = -ENOTSUPP;
  3407. out:
  3408. fsg->state = FSG_STATE_TERMINATED; // The thread is dead
  3409. fsg_unbind(gadget);
  3410. close_all_backing_files(fsg);
  3411. return rc;
  3412. }
  3413. /*-------------------------------------------------------------------------*/
  3414. static void fsg_suspend(struct usb_gadget *gadget)
  3415. {
  3416. struct fsg_dev *fsg = get_gadget_data(gadget);
  3417. DBG(fsg, "suspend\n");
  3418. set_bit(SUSPENDED, &fsg->atomic_bitflags);
  3419. }
  3420. static void fsg_resume(struct usb_gadget *gadget)
  3421. {
  3422. struct fsg_dev *fsg = get_gadget_data(gadget);
  3423. DBG(fsg, "resume\n");
  3424. clear_bit(SUSPENDED, &fsg->atomic_bitflags);
  3425. }
  3426. /*-------------------------------------------------------------------------*/
  3427. static struct usb_gadget_driver fsg_driver = {
  3428. #ifdef CONFIG_USB_GADGET_DUALSPEED
  3429. .speed = USB_SPEED_HIGH,
  3430. #else
  3431. .speed = USB_SPEED_FULL,
  3432. #endif
  3433. .function = (char *) longname,
  3434. .bind = fsg_bind,
  3435. .unbind = fsg_unbind,
  3436. .disconnect = fsg_disconnect,
  3437. .setup = fsg_setup,
  3438. .suspend = fsg_suspend,
  3439. .resume = fsg_resume,
  3440. .driver = {
  3441. .name = (char *) shortname,
  3442. .owner = THIS_MODULE,
  3443. // .release = ...
  3444. // .suspend = ...
  3445. // .resume = ...
  3446. },
  3447. };
  3448. static int __init fsg_alloc(void)
  3449. {
  3450. struct fsg_dev *fsg;
  3451. fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
  3452. if (!fsg)
  3453. return -ENOMEM;
  3454. spin_lock_init(&fsg->lock);
  3455. init_rwsem(&fsg->filesem);
  3456. kref_init(&fsg->ref);
  3457. init_completion(&fsg->thread_notifier);
  3458. the_fsg = fsg;
  3459. return 0;
  3460. }
  3461. static int __init fsg_init(void)
  3462. {
  3463. int rc;
  3464. struct fsg_dev *fsg;
  3465. if ((rc = fsg_alloc()) != 0)
  3466. return rc;
  3467. fsg = the_fsg;
  3468. if ((rc = usb_gadget_register_driver(&fsg_driver)) != 0)
  3469. kref_put(&fsg->ref, fsg_release);
  3470. return rc;
  3471. }
  3472. module_init(fsg_init);
  3473. static void __exit fsg_cleanup(void)
  3474. {
  3475. struct fsg_dev *fsg = the_fsg;
  3476. /* Unregister the driver iff the thread hasn't already done so */
  3477. if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
  3478. usb_gadget_unregister_driver(&fsg_driver);
  3479. /* Wait for the thread to finish up */
  3480. wait_for_completion(&fsg->thread_notifier);
  3481. close_all_backing_files(fsg);
  3482. kref_put(&fsg->ref, fsg_release);
  3483. }
  3484. module_exit(fsg_cleanup);