file_storage.c revision e538dfdae85244fd2c4231725d82cc1f1bc4942c
1/* 2 * file_storage.c -- File-backed USB Storage Gadget, for USB development 3 * 4 * Copyright (C) 2003-2008 Alan Stern 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions, and the following disclaimer, 12 * without modification. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The names of the above-listed copyright holders may not be used 17 * to endorse or promote products derived from this software without 18 * specific prior written permission. 19 * 20 * ALTERNATIVELY, this software may be distributed under the terms of the 21 * GNU General Public License ("GPL") as published by the Free Software 22 * Foundation, either version 2 of that License or (at your option) any 23 * later version. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS 26 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 27 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 29 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 30 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 31 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 32 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 33 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 34 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 35 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 39/* 40 * The File-backed Storage Gadget acts as a USB Mass Storage device, 41 * appearing to the host as a disk drive or as a CD-ROM drive. In addition 42 * to providing an example of a genuinely useful gadget driver for a USB 43 * device, it also illustrates a technique of double-buffering for increased 44 * throughput. Last but not least, it gives an easy way to probe the 45 * behavior of the Mass Storage drivers in a USB host. 46 * 47 * Backing storage is provided by a regular file or a block device, specified 48 * by the "file" module parameter. Access can be limited to read-only by 49 * setting the optional "ro" module parameter. (For CD-ROM emulation, 50 * access is always read-only.) The gadget will indicate that it has 51 * removable media if the optional "removable" module parameter is set. 52 * 53 * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI), 54 * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected 55 * by the optional "transport" module parameter. It also supports the 56 * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03), 57 * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by 58 * the optional "protocol" module parameter. In addition, the default 59 * Vendor ID, Product ID, release number and serial number can be overridden. 60 * 61 * There is support for multiple logical units (LUNs), each of which has 62 * its own backing file. The number of LUNs can be set using the optional 63 * "luns" module parameter (anywhere from 1 to 8), and the corresponding 64 * files are specified using comma-separated lists for "file" and "ro". 65 * The default number of LUNs is taken from the number of "file" elements; 66 * it is 1 if "file" is not given. If "removable" is not set then a backing 67 * file must be specified for each LUN. If it is set, then an unspecified 68 * or empty backing filename means the LUN's medium is not loaded. Ideally 69 * each LUN would be settable independently as a disk drive or a CD-ROM 70 * drive, but currently all LUNs have to be the same type. The CD-ROM 71 * emulation includes a single data track and no audio tracks; hence there 72 * need be only one backing file per LUN. Note also that the CD-ROM block 73 * length is set to 512 rather than the more common value 2048. 74 * 75 * Requirements are modest; only a bulk-in and a bulk-out endpoint are 76 * needed (an interrupt-out endpoint is also needed for CBI). The memory 77 * requirement amounts to two 16K buffers, size configurable by a parameter. 78 * Support is included for both full-speed and high-speed operation. 79 * 80 * Note that the driver is slightly non-portable in that it assumes a 81 * single memory/DMA buffer will be useable for bulk-in, bulk-out, and 82 * interrupt-in endpoints. With most device controllers this isn't an 83 * issue, but there may be some with hardware restrictions that prevent 84 * a buffer from being used by more than one endpoint. 85 * 86 * Module options: 87 * 88 * file=filename[,filename...] 89 * Required if "removable" is not set, names of 90 * the files or block devices used for 91 * backing storage 92 * serial=HHHH... Required serial number (string of hex chars) 93 * ro=b[,b...] Default false, booleans for read-only access 94 * removable Default false, boolean for removable media 95 * luns=N Default N = number of filenames, number of 96 * LUNs to support 97 * nofua=b[,b...] Default false, booleans for ignore FUA flag 98 * in SCSI WRITE(10,12) commands 99 * stall Default determined according to the type of 100 * USB device controller (usually true), 101 * boolean to permit the driver to halt 102 * bulk endpoints 103 * cdrom Default false, boolean for whether to emulate 104 * a CD-ROM drive 105 * transport=XXX Default BBB, transport name (CB, CBI, or BBB) 106 * protocol=YYY Default SCSI, protocol name (RBC, 8020 or 107 * ATAPI, QIC, UFI, 8070, or SCSI; 108 * also 1 - 6) 109 * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID 110 * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID 111 * release=0xRRRR Override the USB release number (bcdDevice) 112 * buflen=N Default N=16384, buffer size used (will be 113 * rounded down to a multiple of 114 * PAGE_CACHE_SIZE) 115 * 116 * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro", 117 * "removable", "luns", "nofua", "stall", and "cdrom" options are available; 118 * default values are used for everything else. 119 * 120 * The pathnames of the backing files and the ro settings are available in 121 * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of 122 * the gadget's sysfs directory. If the "removable" option is set, writing to 123 * these files will simulate ejecting/loading the medium (writing an empty 124 * line means eject) and adjusting a write-enable tab. Changes to the ro 125 * setting are not allowed when the medium is loaded or if CD-ROM emulation 126 * is being used. 127 * 128 * This gadget driver is heavily based on "Gadget Zero" by David Brownell. 129 * The driver's SCSI command interface was based on the "Information 130 * technology - Small Computer System Interface - 2" document from 131 * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at 132 * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception 133 * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the 134 * "Universal Serial Bus Mass Storage Class UFI Command Specification" 135 * document, Revision 1.0, December 14, 1998, available at 136 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>. 137 */ 138 139 140/* 141 * Driver Design 142 * 143 * The FSG driver is fairly straightforward. There is a main kernel 144 * thread that handles most of the work. Interrupt routines field 145 * callbacks from the controller driver: bulk- and interrupt-request 146 * completion notifications, endpoint-0 events, and disconnect events. 147 * Completion events are passed to the main thread by wakeup calls. Many 148 * ep0 requests are handled at interrupt time, but SetInterface, 149 * SetConfiguration, and device reset requests are forwarded to the 150 * thread in the form of "exceptions" using SIGUSR1 signals (since they 151 * should interrupt any ongoing file I/O operations). 152 * 153 * The thread's main routine implements the standard command/data/status 154 * parts of a SCSI interaction. It and its subroutines are full of tests 155 * for pending signals/exceptions -- all this polling is necessary since 156 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an 157 * indication that the driver really wants to be running in userspace.) 158 * An important point is that so long as the thread is alive it keeps an 159 * open reference to the backing file. This will prevent unmounting 160 * the backing file's underlying filesystem and could cause problems 161 * during system shutdown, for example. To prevent such problems, the 162 * thread catches INT, TERM, and KILL signals and converts them into 163 * an EXIT exception. 164 * 165 * In normal operation the main thread is started during the gadget's 166 * fsg_bind() callback and stopped during fsg_unbind(). But it can also 167 * exit when it receives a signal, and there's no point leaving the 168 * gadget running when the thread is dead. So just before the thread 169 * exits, it deregisters the gadget driver. This makes things a little 170 * tricky: The driver is deregistered at two places, and the exiting 171 * thread can indirectly call fsg_unbind() which in turn can tell the 172 * thread to exit. The first problem is resolved through the use of the 173 * REGISTERED atomic bitflag; the driver will only be deregistered once. 174 * The second problem is resolved by having fsg_unbind() check 175 * fsg->state; it won't try to stop the thread if the state is already 176 * FSG_STATE_TERMINATED. 177 * 178 * To provide maximum throughput, the driver uses a circular pipeline of 179 * buffer heads (struct fsg_buffhd). In principle the pipeline can be 180 * arbitrarily long; in practice the benefits don't justify having more 181 * than 2 stages (i.e., double buffering). But it helps to think of the 182 * pipeline as being a long one. Each buffer head contains a bulk-in and 183 * a bulk-out request pointer (since the buffer can be used for both 184 * output and input -- directions always are given from the host's 185 * point of view) as well as a pointer to the buffer and various state 186 * variables. 187 * 188 * Use of the pipeline follows a simple protocol. There is a variable 189 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use. 190 * At any time that buffer head may still be in use from an earlier 191 * request, so each buffer head has a state variable indicating whether 192 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the 193 * buffer head to be EMPTY, filling the buffer either by file I/O or by 194 * USB I/O (during which the buffer head is BUSY), and marking the buffer 195 * head FULL when the I/O is complete. Then the buffer will be emptied 196 * (again possibly by USB I/O, during which it is marked BUSY) and 197 * finally marked EMPTY again (possibly by a completion routine). 198 * 199 * A module parameter tells the driver to avoid stalling the bulk 200 * endpoints wherever the transport specification allows. This is 201 * necessary for some UDCs like the SuperH, which cannot reliably clear a 202 * halt on a bulk endpoint. However, under certain circumstances the 203 * Bulk-only specification requires a stall. In such cases the driver 204 * will halt the endpoint and set a flag indicating that it should clear 205 * the halt in software during the next device reset. Hopefully this 206 * will permit everything to work correctly. Furthermore, although the 207 * specification allows the bulk-out endpoint to halt when the host sends 208 * too much data, implementing this would cause an unavoidable race. 209 * The driver will always use the "no-stall" approach for OUT transfers. 210 * 211 * One subtle point concerns sending status-stage responses for ep0 212 * requests. Some of these requests, such as device reset, can involve 213 * interrupting an ongoing file I/O operation, which might take an 214 * arbitrarily long time. During that delay the host might give up on 215 * the original ep0 request and issue a new one. When that happens the 216 * driver should not notify the host about completion of the original 217 * request, as the host will no longer be waiting for it. So the driver 218 * assigns to each ep0 request a unique tag, and it keeps track of the 219 * tag value of the request associated with a long-running exception 220 * (device-reset, interface-change, or configuration-change). When the 221 * exception handler is finished, the status-stage response is submitted 222 * only if the current ep0 request tag is equal to the exception request 223 * tag. Thus only the most recently received ep0 request will get a 224 * status-stage response. 225 * 226 * Warning: This driver source file is too long. It ought to be split up 227 * into a header file plus about 3 separate .c files, to handle the details 228 * of the Gadget, USB Mass Storage, and SCSI protocols. 229 */ 230 231 232/* #define VERBOSE_DEBUG */ 233/* #define DUMP_MSGS */ 234 235 236#include <linux/blkdev.h> 237#include <linux/completion.h> 238#include <linux/dcache.h> 239#include <linux/delay.h> 240#include <linux/device.h> 241#include <linux/fcntl.h> 242#include <linux/file.h> 243#include <linux/fs.h> 244#include <linux/kref.h> 245#include <linux/kthread.h> 246#include <linux/limits.h> 247#include <linux/rwsem.h> 248#include <linux/slab.h> 249#include <linux/spinlock.h> 250#include <linux/string.h> 251#include <linux/freezer.h> 252#include <linux/utsname.h> 253 254#include <linux/usb/ch9.h> 255#include <linux/usb/gadget.h> 256 257#include "gadget_chips.h" 258 259 260 261/* 262 * Kbuild is not very cooperative with respect to linking separately 263 * compiled library objects into one module. So for now we won't use 264 * separate compilation ... ensuring init/exit sections work to shrink 265 * the runtime footprint, and giving us at least some parts of what 266 * a "gcc --combine ... part1.c part2.c part3.c ... " build would. 267 */ 268#include "usbstring.c" 269#include "config.c" 270#include "epautoconf.c" 271 272/*-------------------------------------------------------------------------*/ 273 274#define DRIVER_DESC "File-backed Storage Gadget" 275#define DRIVER_NAME "g_file_storage" 276#define DRIVER_VERSION "1 September 2010" 277 278static char fsg_string_manufacturer[64]; 279static const char fsg_string_product[] = DRIVER_DESC; 280static const char fsg_string_config[] = "Self-powered"; 281static const char fsg_string_interface[] = "Mass Storage"; 282 283 284#include "storage_common.c" 285 286 287MODULE_DESCRIPTION(DRIVER_DESC); 288MODULE_AUTHOR("Alan Stern"); 289MODULE_LICENSE("Dual BSD/GPL"); 290 291/* 292 * This driver assumes self-powered hardware and has no way for users to 293 * trigger remote wakeup. It uses autoconfiguration to select endpoints 294 * and endpoint addresses. 295 */ 296 297 298/*-------------------------------------------------------------------------*/ 299 300 301/* Encapsulate the module parameter settings */ 302 303static struct { 304 char *file[FSG_MAX_LUNS]; 305 char *serial; 306 int ro[FSG_MAX_LUNS]; 307 int nofua[FSG_MAX_LUNS]; 308 unsigned int num_filenames; 309 unsigned int num_ros; 310 unsigned int num_nofuas; 311 unsigned int nluns; 312 313 int removable; 314 int can_stall; 315 int cdrom; 316 317 char *transport_parm; 318 char *protocol_parm; 319 unsigned short vendor; 320 unsigned short product; 321 unsigned short release; 322 unsigned int buflen; 323 324 int transport_type; 325 char *transport_name; 326 int protocol_type; 327 char *protocol_name; 328 329} mod_data = { // Default values 330 .transport_parm = "BBB", 331 .protocol_parm = "SCSI", 332 .removable = 0, 333 .can_stall = 1, 334 .cdrom = 0, 335 .vendor = FSG_VENDOR_ID, 336 .product = FSG_PRODUCT_ID, 337 .release = 0xffff, // Use controller chip type 338 .buflen = 16384, 339 }; 340 341 342module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames, 343 S_IRUGO); 344MODULE_PARM_DESC(file, "names of backing files or devices"); 345 346module_param_named(serial, mod_data.serial, charp, S_IRUGO); 347MODULE_PARM_DESC(serial, "USB serial number"); 348 349module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO); 350MODULE_PARM_DESC(ro, "true to force read-only"); 351 352module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas, 353 S_IRUGO); 354MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit"); 355 356module_param_named(luns, mod_data.nluns, uint, S_IRUGO); 357MODULE_PARM_DESC(luns, "number of LUNs"); 358 359module_param_named(removable, mod_data.removable, bool, S_IRUGO); 360MODULE_PARM_DESC(removable, "true to simulate removable media"); 361 362module_param_named(stall, mod_data.can_stall, bool, S_IRUGO); 363MODULE_PARM_DESC(stall, "false to prevent bulk stalls"); 364 365module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO); 366MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk"); 367 368/* In the non-TEST version, only the module parameters listed above 369 * are available. */ 370#ifdef CONFIG_USB_FILE_STORAGE_TEST 371 372module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO); 373MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)"); 374 375module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO); 376MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, " 377 "8070, or SCSI)"); 378 379module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO); 380MODULE_PARM_DESC(vendor, "USB Vendor ID"); 381 382module_param_named(product, mod_data.product, ushort, S_IRUGO); 383MODULE_PARM_DESC(product, "USB Product ID"); 384 385module_param_named(release, mod_data.release, ushort, S_IRUGO); 386MODULE_PARM_DESC(release, "USB release number"); 387 388module_param_named(buflen, mod_data.buflen, uint, S_IRUGO); 389MODULE_PARM_DESC(buflen, "I/O buffer size"); 390 391#endif /* CONFIG_USB_FILE_STORAGE_TEST */ 392 393 394/* 395 * These definitions will permit the compiler to avoid generating code for 396 * parts of the driver that aren't used in the non-TEST version. Even gcc 397 * can recognize when a test of a constant expression yields a dead code 398 * path. 399 */ 400 401#ifdef CONFIG_USB_FILE_STORAGE_TEST 402 403#define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK) 404#define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI) 405#define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI) 406 407#else 408 409#define transport_is_bbb() 1 410#define transport_is_cbi() 0 411#define protocol_is_scsi() 1 412 413#endif /* CONFIG_USB_FILE_STORAGE_TEST */ 414 415 416/*-------------------------------------------------------------------------*/ 417 418 419struct fsg_dev { 420 /* lock protects: state, all the req_busy's, and cbbuf_cmnd */ 421 spinlock_t lock; 422 struct usb_gadget *gadget; 423 424 /* filesem protects: backing files in use */ 425 struct rw_semaphore filesem; 426 427 /* reference counting: wait until all LUNs are released */ 428 struct kref ref; 429 430 struct usb_ep *ep0; // Handy copy of gadget->ep0 431 struct usb_request *ep0req; // For control responses 432 unsigned int ep0_req_tag; 433 const char *ep0req_name; 434 435 struct usb_request *intreq; // For interrupt responses 436 int intreq_busy; 437 struct fsg_buffhd *intr_buffhd; 438 439 unsigned int bulk_out_maxpacket; 440 enum fsg_state state; // For exception handling 441 unsigned int exception_req_tag; 442 443 u8 config, new_config; 444 445 unsigned int running : 1; 446 unsigned int bulk_in_enabled : 1; 447 unsigned int bulk_out_enabled : 1; 448 unsigned int intr_in_enabled : 1; 449 unsigned int phase_error : 1; 450 unsigned int short_packet_received : 1; 451 unsigned int bad_lun_okay : 1; 452 453 unsigned long atomic_bitflags; 454#define REGISTERED 0 455#define IGNORE_BULK_OUT 1 456#define SUSPENDED 2 457 458 struct usb_ep *bulk_in; 459 struct usb_ep *bulk_out; 460 struct usb_ep *intr_in; 461 462 struct fsg_buffhd *next_buffhd_to_fill; 463 struct fsg_buffhd *next_buffhd_to_drain; 464 struct fsg_buffhd buffhds[FSG_NUM_BUFFERS]; 465 466 int thread_wakeup_needed; 467 struct completion thread_notifier; 468 struct task_struct *thread_task; 469 470 int cmnd_size; 471 u8 cmnd[MAX_COMMAND_SIZE]; 472 enum data_direction data_dir; 473 u32 data_size; 474 u32 data_size_from_cmnd; 475 u32 tag; 476 unsigned int lun; 477 u32 residue; 478 u32 usb_amount_left; 479 480 /* The CB protocol offers no way for a host to know when a command 481 * has completed. As a result the next command may arrive early, 482 * and we will still have to handle it. For that reason we need 483 * a buffer to store new commands when using CB (or CBI, which 484 * does not oblige a host to wait for command completion either). */ 485 int cbbuf_cmnd_size; 486 u8 cbbuf_cmnd[MAX_COMMAND_SIZE]; 487 488 unsigned int nluns; 489 struct fsg_lun *luns; 490 struct fsg_lun *curlun; 491}; 492 493typedef void (*fsg_routine_t)(struct fsg_dev *); 494 495static int exception_in_progress(struct fsg_dev *fsg) 496{ 497 return (fsg->state > FSG_STATE_IDLE); 498} 499 500/* Make bulk-out requests be divisible by the maxpacket size */ 501static void set_bulk_out_req_length(struct fsg_dev *fsg, 502 struct fsg_buffhd *bh, unsigned int length) 503{ 504 unsigned int rem; 505 506 bh->bulk_out_intended_length = length; 507 rem = length % fsg->bulk_out_maxpacket; 508 if (rem > 0) 509 length += fsg->bulk_out_maxpacket - rem; 510 bh->outreq->length = length; 511} 512 513static struct fsg_dev *the_fsg; 514static struct usb_gadget_driver fsg_driver; 515 516 517/*-------------------------------------------------------------------------*/ 518 519static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) 520{ 521 const char *name; 522 523 if (ep == fsg->bulk_in) 524 name = "bulk-in"; 525 else if (ep == fsg->bulk_out) 526 name = "bulk-out"; 527 else 528 name = ep->name; 529 DBG(fsg, "%s set halt\n", name); 530 return usb_ep_set_halt(ep); 531} 532 533 534/*-------------------------------------------------------------------------*/ 535 536/* 537 * DESCRIPTORS ... most are static, but strings and (full) configuration 538 * descriptors are built on demand. Also the (static) config and interface 539 * descriptors are adjusted during fsg_bind(). 540 */ 541 542/* There is only one configuration. */ 543#define CONFIG_VALUE 1 544 545static struct usb_device_descriptor 546device_desc = { 547 .bLength = sizeof device_desc, 548 .bDescriptorType = USB_DT_DEVICE, 549 550 .bcdUSB = cpu_to_le16(0x0200), 551 .bDeviceClass = USB_CLASS_PER_INTERFACE, 552 553 /* The next three values can be overridden by module parameters */ 554 .idVendor = cpu_to_le16(FSG_VENDOR_ID), 555 .idProduct = cpu_to_le16(FSG_PRODUCT_ID), 556 .bcdDevice = cpu_to_le16(0xffff), 557 558 .iManufacturer = FSG_STRING_MANUFACTURER, 559 .iProduct = FSG_STRING_PRODUCT, 560 .iSerialNumber = FSG_STRING_SERIAL, 561 .bNumConfigurations = 1, 562}; 563 564static struct usb_config_descriptor 565config_desc = { 566 .bLength = sizeof config_desc, 567 .bDescriptorType = USB_DT_CONFIG, 568 569 /* wTotalLength computed by usb_gadget_config_buf() */ 570 .bNumInterfaces = 1, 571 .bConfigurationValue = CONFIG_VALUE, 572 .iConfiguration = FSG_STRING_CONFIG, 573 .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER, 574 .bMaxPower = CONFIG_USB_GADGET_VBUS_DRAW / 2, 575}; 576 577 578static struct usb_qualifier_descriptor 579dev_qualifier = { 580 .bLength = sizeof dev_qualifier, 581 .bDescriptorType = USB_DT_DEVICE_QUALIFIER, 582 583 .bcdUSB = cpu_to_le16(0x0200), 584 .bDeviceClass = USB_CLASS_PER_INTERFACE, 585 586 .bNumConfigurations = 1, 587}; 588 589 590 591/* 592 * Config descriptors must agree with the code that sets configurations 593 * and with code managing interfaces and their altsettings. They must 594 * also handle different speeds and other-speed requests. 595 */ 596static int populate_config_buf(struct usb_gadget *gadget, 597 u8 *buf, u8 type, unsigned index) 598{ 599 enum usb_device_speed speed = gadget->speed; 600 int len; 601 const struct usb_descriptor_header **function; 602 603 if (index > 0) 604 return -EINVAL; 605 606 if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG) 607 speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed; 608 function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH 609 ? (const struct usb_descriptor_header **)fsg_hs_function 610 : (const struct usb_descriptor_header **)fsg_fs_function; 611 612 /* for now, don't advertise srp-only devices */ 613 if (!gadget_is_otg(gadget)) 614 function++; 615 616 len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function); 617 ((struct usb_config_descriptor *) buf)->bDescriptorType = type; 618 return len; 619} 620 621 622/*-------------------------------------------------------------------------*/ 623 624/* These routines may be called in process context or in_irq */ 625 626/* Caller must hold fsg->lock */ 627static void wakeup_thread(struct fsg_dev *fsg) 628{ 629 /* Tell the main thread that something has happened */ 630 fsg->thread_wakeup_needed = 1; 631 if (fsg->thread_task) 632 wake_up_process(fsg->thread_task); 633} 634 635 636static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state) 637{ 638 unsigned long flags; 639 640 /* Do nothing if a higher-priority exception is already in progress. 641 * If a lower-or-equal priority exception is in progress, preempt it 642 * and notify the main thread by sending it a signal. */ 643 spin_lock_irqsave(&fsg->lock, flags); 644 if (fsg->state <= new_state) { 645 fsg->exception_req_tag = fsg->ep0_req_tag; 646 fsg->state = new_state; 647 if (fsg->thread_task) 648 send_sig_info(SIGUSR1, SEND_SIG_FORCED, 649 fsg->thread_task); 650 } 651 spin_unlock_irqrestore(&fsg->lock, flags); 652} 653 654 655/*-------------------------------------------------------------------------*/ 656 657/* The disconnect callback and ep0 routines. These always run in_irq, 658 * except that ep0_queue() is called in the main thread to acknowledge 659 * completion of various requests: set config, set interface, and 660 * Bulk-only device reset. */ 661 662static void fsg_disconnect(struct usb_gadget *gadget) 663{ 664 struct fsg_dev *fsg = get_gadget_data(gadget); 665 666 DBG(fsg, "disconnect or port reset\n"); 667 raise_exception(fsg, FSG_STATE_DISCONNECT); 668} 669 670 671static int ep0_queue(struct fsg_dev *fsg) 672{ 673 int rc; 674 675 rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC); 676 if (rc != 0 && rc != -ESHUTDOWN) { 677 678 /* We can't do much more than wait for a reset */ 679 WARNING(fsg, "error in submission: %s --> %d\n", 680 fsg->ep0->name, rc); 681 } 682 return rc; 683} 684 685static void ep0_complete(struct usb_ep *ep, struct usb_request *req) 686{ 687 struct fsg_dev *fsg = ep->driver_data; 688 689 if (req->actual > 0) 690 dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual); 691 if (req->status || req->actual != req->length) 692 DBG(fsg, "%s --> %d, %u/%u\n", __func__, 693 req->status, req->actual, req->length); 694 if (req->status == -ECONNRESET) // Request was cancelled 695 usb_ep_fifo_flush(ep); 696 697 if (req->status == 0 && req->context) 698 ((fsg_routine_t) (req->context))(fsg); 699} 700 701 702/*-------------------------------------------------------------------------*/ 703 704/* Bulk and interrupt endpoint completion handlers. 705 * These always run in_irq. */ 706 707static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req) 708{ 709 struct fsg_dev *fsg = ep->driver_data; 710 struct fsg_buffhd *bh = req->context; 711 712 if (req->status || req->actual != req->length) 713 DBG(fsg, "%s --> %d, %u/%u\n", __func__, 714 req->status, req->actual, req->length); 715 if (req->status == -ECONNRESET) // Request was cancelled 716 usb_ep_fifo_flush(ep); 717 718 /* Hold the lock while we update the request and buffer states */ 719 smp_wmb(); 720 spin_lock(&fsg->lock); 721 bh->inreq_busy = 0; 722 bh->state = BUF_STATE_EMPTY; 723 wakeup_thread(fsg); 724 spin_unlock(&fsg->lock); 725} 726 727static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req) 728{ 729 struct fsg_dev *fsg = ep->driver_data; 730 struct fsg_buffhd *bh = req->context; 731 732 dump_msg(fsg, "bulk-out", req->buf, req->actual); 733 if (req->status || req->actual != bh->bulk_out_intended_length) 734 DBG(fsg, "%s --> %d, %u/%u\n", __func__, 735 req->status, req->actual, 736 bh->bulk_out_intended_length); 737 if (req->status == -ECONNRESET) // Request was cancelled 738 usb_ep_fifo_flush(ep); 739 740 /* Hold the lock while we update the request and buffer states */ 741 smp_wmb(); 742 spin_lock(&fsg->lock); 743 bh->outreq_busy = 0; 744 bh->state = BUF_STATE_FULL; 745 wakeup_thread(fsg); 746 spin_unlock(&fsg->lock); 747} 748 749 750#ifdef CONFIG_USB_FILE_STORAGE_TEST 751static void intr_in_complete(struct usb_ep *ep, struct usb_request *req) 752{ 753 struct fsg_dev *fsg = ep->driver_data; 754 struct fsg_buffhd *bh = req->context; 755 756 if (req->status || req->actual != req->length) 757 DBG(fsg, "%s --> %d, %u/%u\n", __func__, 758 req->status, req->actual, req->length); 759 if (req->status == -ECONNRESET) // Request was cancelled 760 usb_ep_fifo_flush(ep); 761 762 /* Hold the lock while we update the request and buffer states */ 763 smp_wmb(); 764 spin_lock(&fsg->lock); 765 fsg->intreq_busy = 0; 766 bh->state = BUF_STATE_EMPTY; 767 wakeup_thread(fsg); 768 spin_unlock(&fsg->lock); 769} 770 771#else 772static void intr_in_complete(struct usb_ep *ep, struct usb_request *req) 773{} 774#endif /* CONFIG_USB_FILE_STORAGE_TEST */ 775 776 777/*-------------------------------------------------------------------------*/ 778 779/* Ep0 class-specific handlers. These always run in_irq. */ 780 781#ifdef CONFIG_USB_FILE_STORAGE_TEST 782static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh) 783{ 784 struct usb_request *req = fsg->ep0req; 785 static u8 cbi_reset_cmnd[6] = { 786 SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff}; 787 788 /* Error in command transfer? */ 789 if (req->status || req->length != req->actual || 790 req->actual < 6 || req->actual > MAX_COMMAND_SIZE) { 791 792 /* Not all controllers allow a protocol stall after 793 * receiving control-out data, but we'll try anyway. */ 794 fsg_set_halt(fsg, fsg->ep0); 795 return; // Wait for reset 796 } 797 798 /* Is it the special reset command? */ 799 if (req->actual >= sizeof cbi_reset_cmnd && 800 memcmp(req->buf, cbi_reset_cmnd, 801 sizeof cbi_reset_cmnd) == 0) { 802 803 /* Raise an exception to stop the current operation 804 * and reinitialize our state. */ 805 DBG(fsg, "cbi reset request\n"); 806 raise_exception(fsg, FSG_STATE_RESET); 807 return; 808 } 809 810 VDBG(fsg, "CB[I] accept device-specific command\n"); 811 spin_lock(&fsg->lock); 812 813 /* Save the command for later */ 814 if (fsg->cbbuf_cmnd_size) 815 WARNING(fsg, "CB[I] overwriting previous command\n"); 816 fsg->cbbuf_cmnd_size = req->actual; 817 memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size); 818 819 wakeup_thread(fsg); 820 spin_unlock(&fsg->lock); 821} 822 823#else 824static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh) 825{} 826#endif /* CONFIG_USB_FILE_STORAGE_TEST */ 827 828 829static int class_setup_req(struct fsg_dev *fsg, 830 const struct usb_ctrlrequest *ctrl) 831{ 832 struct usb_request *req = fsg->ep0req; 833 int value = -EOPNOTSUPP; 834 u16 w_index = le16_to_cpu(ctrl->wIndex); 835 u16 w_value = le16_to_cpu(ctrl->wValue); 836 u16 w_length = le16_to_cpu(ctrl->wLength); 837 838 if (!fsg->config) 839 return value; 840 841 /* Handle Bulk-only class-specific requests */ 842 if (transport_is_bbb()) { 843 switch (ctrl->bRequest) { 844 845 case USB_BULK_RESET_REQUEST: 846 if (ctrl->bRequestType != (USB_DIR_OUT | 847 USB_TYPE_CLASS | USB_RECIP_INTERFACE)) 848 break; 849 if (w_index != 0 || w_value != 0) { 850 value = -EDOM; 851 break; 852 } 853 854 /* Raise an exception to stop the current operation 855 * and reinitialize our state. */ 856 DBG(fsg, "bulk reset request\n"); 857 raise_exception(fsg, FSG_STATE_RESET); 858 value = DELAYED_STATUS; 859 break; 860 861 case USB_BULK_GET_MAX_LUN_REQUEST: 862 if (ctrl->bRequestType != (USB_DIR_IN | 863 USB_TYPE_CLASS | USB_RECIP_INTERFACE)) 864 break; 865 if (w_index != 0 || w_value != 0) { 866 value = -EDOM; 867 break; 868 } 869 VDBG(fsg, "get max LUN\n"); 870 *(u8 *) req->buf = fsg->nluns - 1; 871 value = 1; 872 break; 873 } 874 } 875 876 /* Handle CBI class-specific requests */ 877 else { 878 switch (ctrl->bRequest) { 879 880 case USB_CBI_ADSC_REQUEST: 881 if (ctrl->bRequestType != (USB_DIR_OUT | 882 USB_TYPE_CLASS | USB_RECIP_INTERFACE)) 883 break; 884 if (w_index != 0 || w_value != 0) { 885 value = -EDOM; 886 break; 887 } 888 if (w_length > MAX_COMMAND_SIZE) { 889 value = -EOVERFLOW; 890 break; 891 } 892 value = w_length; 893 fsg->ep0req->context = received_cbi_adsc; 894 break; 895 } 896 } 897 898 if (value == -EOPNOTSUPP) 899 VDBG(fsg, 900 "unknown class-specific control req " 901 "%02x.%02x v%04x i%04x l%u\n", 902 ctrl->bRequestType, ctrl->bRequest, 903 le16_to_cpu(ctrl->wValue), w_index, w_length); 904 return value; 905} 906 907 908/*-------------------------------------------------------------------------*/ 909 910/* Ep0 standard request handlers. These always run in_irq. */ 911 912static int standard_setup_req(struct fsg_dev *fsg, 913 const struct usb_ctrlrequest *ctrl) 914{ 915 struct usb_request *req = fsg->ep0req; 916 int value = -EOPNOTSUPP; 917 u16 w_index = le16_to_cpu(ctrl->wIndex); 918 u16 w_value = le16_to_cpu(ctrl->wValue); 919 920 /* Usually this just stores reply data in the pre-allocated ep0 buffer, 921 * but config change events will also reconfigure hardware. */ 922 switch (ctrl->bRequest) { 923 924 case USB_REQ_GET_DESCRIPTOR: 925 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD | 926 USB_RECIP_DEVICE)) 927 break; 928 switch (w_value >> 8) { 929 930 case USB_DT_DEVICE: 931 VDBG(fsg, "get device descriptor\n"); 932 device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket; 933 value = sizeof device_desc; 934 memcpy(req->buf, &device_desc, value); 935 break; 936 case USB_DT_DEVICE_QUALIFIER: 937 VDBG(fsg, "get device qualifier\n"); 938 if (!gadget_is_dualspeed(fsg->gadget)) 939 break; 940 /* 941 * Assume ep0 uses the same maxpacket value for both 942 * speeds 943 */ 944 dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket; 945 value = sizeof dev_qualifier; 946 memcpy(req->buf, &dev_qualifier, value); 947 break; 948 949 case USB_DT_OTHER_SPEED_CONFIG: 950 VDBG(fsg, "get other-speed config descriptor\n"); 951 if (!gadget_is_dualspeed(fsg->gadget)) 952 break; 953 goto get_config; 954 case USB_DT_CONFIG: 955 VDBG(fsg, "get configuration descriptor\n"); 956get_config: 957 value = populate_config_buf(fsg->gadget, 958 req->buf, 959 w_value >> 8, 960 w_value & 0xff); 961 break; 962 963 case USB_DT_STRING: 964 VDBG(fsg, "get string descriptor\n"); 965 966 /* wIndex == language code */ 967 value = usb_gadget_get_string(&fsg_stringtab, 968 w_value & 0xff, req->buf); 969 break; 970 } 971 break; 972 973 /* One config, two speeds */ 974 case USB_REQ_SET_CONFIGURATION: 975 if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD | 976 USB_RECIP_DEVICE)) 977 break; 978 VDBG(fsg, "set configuration\n"); 979 if (w_value == CONFIG_VALUE || w_value == 0) { 980 fsg->new_config = w_value; 981 982 /* Raise an exception to wipe out previous transaction 983 * state (queued bufs, etc) and set the new config. */ 984 raise_exception(fsg, FSG_STATE_CONFIG_CHANGE); 985 value = DELAYED_STATUS; 986 } 987 break; 988 case USB_REQ_GET_CONFIGURATION: 989 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD | 990 USB_RECIP_DEVICE)) 991 break; 992 VDBG(fsg, "get configuration\n"); 993 *(u8 *) req->buf = fsg->config; 994 value = 1; 995 break; 996 997 case USB_REQ_SET_INTERFACE: 998 if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD | 999 USB_RECIP_INTERFACE)) 1000 break; 1001 if (fsg->config && w_index == 0) { 1002 1003 /* Raise an exception to wipe out previous transaction 1004 * state (queued bufs, etc) and install the new 1005 * interface altsetting. */ 1006 raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE); 1007 value = DELAYED_STATUS; 1008 } 1009 break; 1010 case USB_REQ_GET_INTERFACE: 1011 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD | 1012 USB_RECIP_INTERFACE)) 1013 break; 1014 if (!fsg->config) 1015 break; 1016 if (w_index != 0) { 1017 value = -EDOM; 1018 break; 1019 } 1020 VDBG(fsg, "get interface\n"); 1021 *(u8 *) req->buf = 0; 1022 value = 1; 1023 break; 1024 1025 default: 1026 VDBG(fsg, 1027 "unknown control req %02x.%02x v%04x i%04x l%u\n", 1028 ctrl->bRequestType, ctrl->bRequest, 1029 w_value, w_index, le16_to_cpu(ctrl->wLength)); 1030 } 1031 1032 return value; 1033} 1034 1035 1036static int fsg_setup(struct usb_gadget *gadget, 1037 const struct usb_ctrlrequest *ctrl) 1038{ 1039 struct fsg_dev *fsg = get_gadget_data(gadget); 1040 int rc; 1041 int w_length = le16_to_cpu(ctrl->wLength); 1042 1043 ++fsg->ep0_req_tag; // Record arrival of a new request 1044 fsg->ep0req->context = NULL; 1045 fsg->ep0req->length = 0; 1046 dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl)); 1047 1048 if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) 1049 rc = class_setup_req(fsg, ctrl); 1050 else 1051 rc = standard_setup_req(fsg, ctrl); 1052 1053 /* Respond with data/status or defer until later? */ 1054 if (rc >= 0 && rc != DELAYED_STATUS) { 1055 rc = min(rc, w_length); 1056 fsg->ep0req->length = rc; 1057 fsg->ep0req->zero = rc < w_length; 1058 fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ? 1059 "ep0-in" : "ep0-out"); 1060 rc = ep0_queue(fsg); 1061 } 1062 1063 /* Device either stalls (rc < 0) or reports success */ 1064 return rc; 1065} 1066 1067 1068/*-------------------------------------------------------------------------*/ 1069 1070/* All the following routines run in process context */ 1071 1072 1073/* Use this for bulk or interrupt transfers, not ep0 */ 1074static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep, 1075 struct usb_request *req, int *pbusy, 1076 enum fsg_buffer_state *state) 1077{ 1078 int rc; 1079 1080 if (ep == fsg->bulk_in) 1081 dump_msg(fsg, "bulk-in", req->buf, req->length); 1082 else if (ep == fsg->intr_in) 1083 dump_msg(fsg, "intr-in", req->buf, req->length); 1084 1085 spin_lock_irq(&fsg->lock); 1086 *pbusy = 1; 1087 *state = BUF_STATE_BUSY; 1088 spin_unlock_irq(&fsg->lock); 1089 rc = usb_ep_queue(ep, req, GFP_KERNEL); 1090 if (rc != 0) { 1091 *pbusy = 0; 1092 *state = BUF_STATE_EMPTY; 1093 1094 /* We can't do much more than wait for a reset */ 1095 1096 /* Note: currently the net2280 driver fails zero-length 1097 * submissions if DMA is enabled. */ 1098 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP && 1099 req->length == 0)) 1100 WARNING(fsg, "error in submission: %s --> %d\n", 1101 ep->name, rc); 1102 } 1103} 1104 1105 1106static int sleep_thread(struct fsg_dev *fsg) 1107{ 1108 int rc = 0; 1109 1110 /* Wait until a signal arrives or we are woken up */ 1111 for (;;) { 1112 try_to_freeze(); 1113 set_current_state(TASK_INTERRUPTIBLE); 1114 if (signal_pending(current)) { 1115 rc = -EINTR; 1116 break; 1117 } 1118 if (fsg->thread_wakeup_needed) 1119 break; 1120 schedule(); 1121 } 1122 __set_current_state(TASK_RUNNING); 1123 fsg->thread_wakeup_needed = 0; 1124 return rc; 1125} 1126 1127 1128/*-------------------------------------------------------------------------*/ 1129 1130static int do_read(struct fsg_dev *fsg) 1131{ 1132 struct fsg_lun *curlun = fsg->curlun; 1133 u32 lba; 1134 struct fsg_buffhd *bh; 1135 int rc; 1136 u32 amount_left; 1137 loff_t file_offset, file_offset_tmp; 1138 unsigned int amount; 1139 unsigned int partial_page; 1140 ssize_t nread; 1141 1142 /* Get the starting Logical Block Address and check that it's 1143 * not too big */ 1144 if (fsg->cmnd[0] == READ_6) 1145 lba = get_unaligned_be24(&fsg->cmnd[1]); 1146 else { 1147 lba = get_unaligned_be32(&fsg->cmnd[2]); 1148 1149 /* We allow DPO (Disable Page Out = don't save data in the 1150 * cache) and FUA (Force Unit Access = don't read from the 1151 * cache), but we don't implement them. */ 1152 if ((fsg->cmnd[1] & ~0x18) != 0) { 1153 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1154 return -EINVAL; 1155 } 1156 } 1157 if (lba >= curlun->num_sectors) { 1158 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1159 return -EINVAL; 1160 } 1161 file_offset = ((loff_t) lba) << 9; 1162 1163 /* Carry out the file reads */ 1164 amount_left = fsg->data_size_from_cmnd; 1165 if (unlikely(amount_left == 0)) 1166 return -EIO; // No default reply 1167 1168 for (;;) { 1169 1170 /* Figure out how much we need to read: 1171 * Try to read the remaining amount. 1172 * But don't read more than the buffer size. 1173 * And don't try to read past the end of the file. 1174 * Finally, if we're not at a page boundary, don't read past 1175 * the next page. 1176 * If this means reading 0 then we were asked to read past 1177 * the end of file. */ 1178 amount = min((unsigned int) amount_left, mod_data.buflen); 1179 amount = min((loff_t) amount, 1180 curlun->file_length - file_offset); 1181 partial_page = file_offset & (PAGE_CACHE_SIZE - 1); 1182 if (partial_page > 0) 1183 amount = min(amount, (unsigned int) PAGE_CACHE_SIZE - 1184 partial_page); 1185 1186 /* Wait for the next buffer to become available */ 1187 bh = fsg->next_buffhd_to_fill; 1188 while (bh->state != BUF_STATE_EMPTY) { 1189 rc = sleep_thread(fsg); 1190 if (rc) 1191 return rc; 1192 } 1193 1194 /* If we were asked to read past the end of file, 1195 * end with an empty buffer. */ 1196 if (amount == 0) { 1197 curlun->sense_data = 1198 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1199 curlun->sense_data_info = file_offset >> 9; 1200 curlun->info_valid = 1; 1201 bh->inreq->length = 0; 1202 bh->state = BUF_STATE_FULL; 1203 break; 1204 } 1205 1206 /* Perform the read */ 1207 file_offset_tmp = file_offset; 1208 nread = vfs_read(curlun->filp, 1209 (char __user *) bh->buf, 1210 amount, &file_offset_tmp); 1211 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount, 1212 (unsigned long long) file_offset, 1213 (int) nread); 1214 if (signal_pending(current)) 1215 return -EINTR; 1216 1217 if (nread < 0) { 1218 LDBG(curlun, "error in file read: %d\n", 1219 (int) nread); 1220 nread = 0; 1221 } else if (nread < amount) { 1222 LDBG(curlun, "partial file read: %d/%u\n", 1223 (int) nread, amount); 1224 nread -= (nread & 511); // Round down to a block 1225 } 1226 file_offset += nread; 1227 amount_left -= nread; 1228 fsg->residue -= nread; 1229 bh->inreq->length = nread; 1230 bh->state = BUF_STATE_FULL; 1231 1232 /* If an error occurred, report it and its position */ 1233 if (nread < amount) { 1234 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 1235 curlun->sense_data_info = file_offset >> 9; 1236 curlun->info_valid = 1; 1237 break; 1238 } 1239 1240 if (amount_left == 0) 1241 break; // No more left to read 1242 1243 /* Send this buffer and go read some more */ 1244 bh->inreq->zero = 0; 1245 start_transfer(fsg, fsg->bulk_in, bh->inreq, 1246 &bh->inreq_busy, &bh->state); 1247 fsg->next_buffhd_to_fill = bh->next; 1248 } 1249 1250 return -EIO; // No default reply 1251} 1252 1253 1254/*-------------------------------------------------------------------------*/ 1255 1256static int do_write(struct fsg_dev *fsg) 1257{ 1258 struct fsg_lun *curlun = fsg->curlun; 1259 u32 lba; 1260 struct fsg_buffhd *bh; 1261 int get_some_more; 1262 u32 amount_left_to_req, amount_left_to_write; 1263 loff_t usb_offset, file_offset, file_offset_tmp; 1264 unsigned int amount; 1265 unsigned int partial_page; 1266 ssize_t nwritten; 1267 int rc; 1268 1269 if (curlun->ro) { 1270 curlun->sense_data = SS_WRITE_PROTECTED; 1271 return -EINVAL; 1272 } 1273 spin_lock(&curlun->filp->f_lock); 1274 curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait 1275 spin_unlock(&curlun->filp->f_lock); 1276 1277 /* Get the starting Logical Block Address and check that it's 1278 * not too big */ 1279 if (fsg->cmnd[0] == WRITE_6) 1280 lba = get_unaligned_be24(&fsg->cmnd[1]); 1281 else { 1282 lba = get_unaligned_be32(&fsg->cmnd[2]); 1283 1284 /* We allow DPO (Disable Page Out = don't save data in the 1285 * cache) and FUA (Force Unit Access = write directly to the 1286 * medium). We don't implement DPO; we implement FUA by 1287 * performing synchronous output. */ 1288 if ((fsg->cmnd[1] & ~0x18) != 0) { 1289 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1290 return -EINVAL; 1291 } 1292 /* FUA */ 1293 if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) { 1294 spin_lock(&curlun->filp->f_lock); 1295 curlun->filp->f_flags |= O_DSYNC; 1296 spin_unlock(&curlun->filp->f_lock); 1297 } 1298 } 1299 if (lba >= curlun->num_sectors) { 1300 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1301 return -EINVAL; 1302 } 1303 1304 /* Carry out the file writes */ 1305 get_some_more = 1; 1306 file_offset = usb_offset = ((loff_t) lba) << 9; 1307 amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd; 1308 1309 while (amount_left_to_write > 0) { 1310 1311 /* Queue a request for more data from the host */ 1312 bh = fsg->next_buffhd_to_fill; 1313 if (bh->state == BUF_STATE_EMPTY && get_some_more) { 1314 1315 /* Figure out how much we want to get: 1316 * Try to get the remaining amount. 1317 * But don't get more than the buffer size. 1318 * And don't try to go past the end of the file. 1319 * If we're not at a page boundary, 1320 * don't go past the next page. 1321 * If this means getting 0, then we were asked 1322 * to write past the end of file. 1323 * Finally, round down to a block boundary. */ 1324 amount = min(amount_left_to_req, mod_data.buflen); 1325 amount = min((loff_t) amount, curlun->file_length - 1326 usb_offset); 1327 partial_page = usb_offset & (PAGE_CACHE_SIZE - 1); 1328 if (partial_page > 0) 1329 amount = min(amount, 1330 (unsigned int) PAGE_CACHE_SIZE - partial_page); 1331 1332 if (amount == 0) { 1333 get_some_more = 0; 1334 curlun->sense_data = 1335 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1336 curlun->sense_data_info = usb_offset >> 9; 1337 curlun->info_valid = 1; 1338 continue; 1339 } 1340 amount -= (amount & 511); 1341 if (amount == 0) { 1342 1343 /* Why were we were asked to transfer a 1344 * partial block? */ 1345 get_some_more = 0; 1346 continue; 1347 } 1348 1349 /* Get the next buffer */ 1350 usb_offset += amount; 1351 fsg->usb_amount_left -= amount; 1352 amount_left_to_req -= amount; 1353 if (amount_left_to_req == 0) 1354 get_some_more = 0; 1355 1356 /* amount is always divisible by 512, hence by 1357 * the bulk-out maxpacket size */ 1358 bh->outreq->length = bh->bulk_out_intended_length = 1359 amount; 1360 bh->outreq->short_not_ok = 1; 1361 start_transfer(fsg, fsg->bulk_out, bh->outreq, 1362 &bh->outreq_busy, &bh->state); 1363 fsg->next_buffhd_to_fill = bh->next; 1364 continue; 1365 } 1366 1367 /* Write the received data to the backing file */ 1368 bh = fsg->next_buffhd_to_drain; 1369 if (bh->state == BUF_STATE_EMPTY && !get_some_more) 1370 break; // We stopped early 1371 if (bh->state == BUF_STATE_FULL) { 1372 smp_rmb(); 1373 fsg->next_buffhd_to_drain = bh->next; 1374 bh->state = BUF_STATE_EMPTY; 1375 1376 /* Did something go wrong with the transfer? */ 1377 if (bh->outreq->status != 0) { 1378 curlun->sense_data = SS_COMMUNICATION_FAILURE; 1379 curlun->sense_data_info = file_offset >> 9; 1380 curlun->info_valid = 1; 1381 break; 1382 } 1383 1384 amount = bh->outreq->actual; 1385 if (curlun->file_length - file_offset < amount) { 1386 LERROR(curlun, 1387 "write %u @ %llu beyond end %llu\n", 1388 amount, (unsigned long long) file_offset, 1389 (unsigned long long) curlun->file_length); 1390 amount = curlun->file_length - file_offset; 1391 } 1392 1393 /* Perform the write */ 1394 file_offset_tmp = file_offset; 1395 nwritten = vfs_write(curlun->filp, 1396 (char __user *) bh->buf, 1397 amount, &file_offset_tmp); 1398 VLDBG(curlun, "file write %u @ %llu -> %d\n", amount, 1399 (unsigned long long) file_offset, 1400 (int) nwritten); 1401 if (signal_pending(current)) 1402 return -EINTR; // Interrupted! 1403 1404 if (nwritten < 0) { 1405 LDBG(curlun, "error in file write: %d\n", 1406 (int) nwritten); 1407 nwritten = 0; 1408 } else if (nwritten < amount) { 1409 LDBG(curlun, "partial file write: %d/%u\n", 1410 (int) nwritten, amount); 1411 nwritten -= (nwritten & 511); 1412 // Round down to a block 1413 } 1414 file_offset += nwritten; 1415 amount_left_to_write -= nwritten; 1416 fsg->residue -= nwritten; 1417 1418 /* If an error occurred, report it and its position */ 1419 if (nwritten < amount) { 1420 curlun->sense_data = SS_WRITE_ERROR; 1421 curlun->sense_data_info = file_offset >> 9; 1422 curlun->info_valid = 1; 1423 break; 1424 } 1425 1426 /* Did the host decide to stop early? */ 1427 if (bh->outreq->actual != bh->outreq->length) { 1428 fsg->short_packet_received = 1; 1429 break; 1430 } 1431 continue; 1432 } 1433 1434 /* Wait for something to happen */ 1435 rc = sleep_thread(fsg); 1436 if (rc) 1437 return rc; 1438 } 1439 1440 return -EIO; // No default reply 1441} 1442 1443 1444/*-------------------------------------------------------------------------*/ 1445 1446static int do_synchronize_cache(struct fsg_dev *fsg) 1447{ 1448 struct fsg_lun *curlun = fsg->curlun; 1449 int rc; 1450 1451 /* We ignore the requested LBA and write out all file's 1452 * dirty data buffers. */ 1453 rc = fsg_lun_fsync_sub(curlun); 1454 if (rc) 1455 curlun->sense_data = SS_WRITE_ERROR; 1456 return 0; 1457} 1458 1459 1460/*-------------------------------------------------------------------------*/ 1461 1462static void invalidate_sub(struct fsg_lun *curlun) 1463{ 1464 struct file *filp = curlun->filp; 1465 struct inode *inode = filp->f_path.dentry->d_inode; 1466 unsigned long rc; 1467 1468 rc = invalidate_mapping_pages(inode->i_mapping, 0, -1); 1469 VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc); 1470} 1471 1472static int do_verify(struct fsg_dev *fsg) 1473{ 1474 struct fsg_lun *curlun = fsg->curlun; 1475 u32 lba; 1476 u32 verification_length; 1477 struct fsg_buffhd *bh = fsg->next_buffhd_to_fill; 1478 loff_t file_offset, file_offset_tmp; 1479 u32 amount_left; 1480 unsigned int amount; 1481 ssize_t nread; 1482 1483 /* Get the starting Logical Block Address and check that it's 1484 * not too big */ 1485 lba = get_unaligned_be32(&fsg->cmnd[2]); 1486 if (lba >= curlun->num_sectors) { 1487 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1488 return -EINVAL; 1489 } 1490 1491 /* We allow DPO (Disable Page Out = don't save data in the 1492 * cache) but we don't implement it. */ 1493 if ((fsg->cmnd[1] & ~0x10) != 0) { 1494 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1495 return -EINVAL; 1496 } 1497 1498 verification_length = get_unaligned_be16(&fsg->cmnd[7]); 1499 if (unlikely(verification_length == 0)) 1500 return -EIO; // No default reply 1501 1502 /* Prepare to carry out the file verify */ 1503 amount_left = verification_length << 9; 1504 file_offset = ((loff_t) lba) << 9; 1505 1506 /* Write out all the dirty buffers before invalidating them */ 1507 fsg_lun_fsync_sub(curlun); 1508 if (signal_pending(current)) 1509 return -EINTR; 1510 1511 invalidate_sub(curlun); 1512 if (signal_pending(current)) 1513 return -EINTR; 1514 1515 /* Just try to read the requested blocks */ 1516 while (amount_left > 0) { 1517 1518 /* Figure out how much we need to read: 1519 * Try to read the remaining amount, but not more than 1520 * the buffer size. 1521 * And don't try to read past the end of the file. 1522 * If this means reading 0 then we were asked to read 1523 * past the end of file. */ 1524 amount = min((unsigned int) amount_left, mod_data.buflen); 1525 amount = min((loff_t) amount, 1526 curlun->file_length - file_offset); 1527 if (amount == 0) { 1528 curlun->sense_data = 1529 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1530 curlun->sense_data_info = file_offset >> 9; 1531 curlun->info_valid = 1; 1532 break; 1533 } 1534 1535 /* Perform the read */ 1536 file_offset_tmp = file_offset; 1537 nread = vfs_read(curlun->filp, 1538 (char __user *) bh->buf, 1539 amount, &file_offset_tmp); 1540 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount, 1541 (unsigned long long) file_offset, 1542 (int) nread); 1543 if (signal_pending(current)) 1544 return -EINTR; 1545 1546 if (nread < 0) { 1547 LDBG(curlun, "error in file verify: %d\n", 1548 (int) nread); 1549 nread = 0; 1550 } else if (nread < amount) { 1551 LDBG(curlun, "partial file verify: %d/%u\n", 1552 (int) nread, amount); 1553 nread -= (nread & 511); // Round down to a sector 1554 } 1555 if (nread == 0) { 1556 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 1557 curlun->sense_data_info = file_offset >> 9; 1558 curlun->info_valid = 1; 1559 break; 1560 } 1561 file_offset += nread; 1562 amount_left -= nread; 1563 } 1564 return 0; 1565} 1566 1567 1568/*-------------------------------------------------------------------------*/ 1569 1570static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1571{ 1572 u8 *buf = (u8 *) bh->buf; 1573 1574 static char vendor_id[] = "Linux "; 1575 static char product_disk_id[] = "File-Stor Gadget"; 1576 static char product_cdrom_id[] = "File-CD Gadget "; 1577 1578 if (!fsg->curlun) { // Unsupported LUNs are okay 1579 fsg->bad_lun_okay = 1; 1580 memset(buf, 0, 36); 1581 buf[0] = 0x7f; // Unsupported, no device-type 1582 buf[4] = 31; // Additional length 1583 return 36; 1584 } 1585 1586 memset(buf, 0, 8); 1587 buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK); 1588 if (mod_data.removable) 1589 buf[1] = 0x80; 1590 buf[2] = 2; // ANSI SCSI level 2 1591 buf[3] = 2; // SCSI-2 INQUIRY data format 1592 buf[4] = 31; // Additional length 1593 // No special options 1594 sprintf(buf + 8, "%-8s%-16s%04x", vendor_id, 1595 (mod_data.cdrom ? product_cdrom_id : 1596 product_disk_id), 1597 mod_data.release); 1598 return 36; 1599} 1600 1601 1602static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1603{ 1604 struct fsg_lun *curlun = fsg->curlun; 1605 u8 *buf = (u8 *) bh->buf; 1606 u32 sd, sdinfo; 1607 int valid; 1608 1609 /* 1610 * From the SCSI-2 spec., section 7.9 (Unit attention condition): 1611 * 1612 * If a REQUEST SENSE command is received from an initiator 1613 * with a pending unit attention condition (before the target 1614 * generates the contingent allegiance condition), then the 1615 * target shall either: 1616 * a) report any pending sense data and preserve the unit 1617 * attention condition on the logical unit, or, 1618 * b) report the unit attention condition, may discard any 1619 * pending sense data, and clear the unit attention 1620 * condition on the logical unit for that initiator. 1621 * 1622 * FSG normally uses option a); enable this code to use option b). 1623 */ 1624#if 0 1625 if (curlun && curlun->unit_attention_data != SS_NO_SENSE) { 1626 curlun->sense_data = curlun->unit_attention_data; 1627 curlun->unit_attention_data = SS_NO_SENSE; 1628 } 1629#endif 1630 1631 if (!curlun) { // Unsupported LUNs are okay 1632 fsg->bad_lun_okay = 1; 1633 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED; 1634 sdinfo = 0; 1635 valid = 0; 1636 } else { 1637 sd = curlun->sense_data; 1638 sdinfo = curlun->sense_data_info; 1639 valid = curlun->info_valid << 7; 1640 curlun->sense_data = SS_NO_SENSE; 1641 curlun->sense_data_info = 0; 1642 curlun->info_valid = 0; 1643 } 1644 1645 memset(buf, 0, 18); 1646 buf[0] = valid | 0x70; // Valid, current error 1647 buf[2] = SK(sd); 1648 put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */ 1649 buf[7] = 18 - 8; // Additional sense length 1650 buf[12] = ASC(sd); 1651 buf[13] = ASCQ(sd); 1652 return 18; 1653} 1654 1655 1656static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1657{ 1658 struct fsg_lun *curlun = fsg->curlun; 1659 u32 lba = get_unaligned_be32(&fsg->cmnd[2]); 1660 int pmi = fsg->cmnd[8]; 1661 u8 *buf = (u8 *) bh->buf; 1662 1663 /* Check the PMI and LBA fields */ 1664 if (pmi > 1 || (pmi == 0 && lba != 0)) { 1665 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1666 return -EINVAL; 1667 } 1668 1669 put_unaligned_be32(curlun->num_sectors - 1, &buf[0]); 1670 /* Max logical block */ 1671 put_unaligned_be32(512, &buf[4]); /* Block length */ 1672 return 8; 1673} 1674 1675 1676static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1677{ 1678 struct fsg_lun *curlun = fsg->curlun; 1679 int msf = fsg->cmnd[1] & 0x02; 1680 u32 lba = get_unaligned_be32(&fsg->cmnd[2]); 1681 u8 *buf = (u8 *) bh->buf; 1682 1683 if ((fsg->cmnd[1] & ~0x02) != 0) { /* Mask away MSF */ 1684 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1685 return -EINVAL; 1686 } 1687 if (lba >= curlun->num_sectors) { 1688 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1689 return -EINVAL; 1690 } 1691 1692 memset(buf, 0, 8); 1693 buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */ 1694 store_cdrom_address(&buf[4], msf, lba); 1695 return 8; 1696} 1697 1698 1699static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1700{ 1701 struct fsg_lun *curlun = fsg->curlun; 1702 int msf = fsg->cmnd[1] & 0x02; 1703 int start_track = fsg->cmnd[6]; 1704 u8 *buf = (u8 *) bh->buf; 1705 1706 if ((fsg->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */ 1707 start_track > 1) { 1708 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1709 return -EINVAL; 1710 } 1711 1712 memset(buf, 0, 20); 1713 buf[1] = (20-2); /* TOC data length */ 1714 buf[2] = 1; /* First track number */ 1715 buf[3] = 1; /* Last track number */ 1716 buf[5] = 0x16; /* Data track, copying allowed */ 1717 buf[6] = 0x01; /* Only track is number 1 */ 1718 store_cdrom_address(&buf[8], msf, 0); 1719 1720 buf[13] = 0x16; /* Lead-out track is data */ 1721 buf[14] = 0xAA; /* Lead-out track number */ 1722 store_cdrom_address(&buf[16], msf, curlun->num_sectors); 1723 return 20; 1724} 1725 1726 1727static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1728{ 1729 struct fsg_lun *curlun = fsg->curlun; 1730 int mscmnd = fsg->cmnd[0]; 1731 u8 *buf = (u8 *) bh->buf; 1732 u8 *buf0 = buf; 1733 int pc, page_code; 1734 int changeable_values, all_pages; 1735 int valid_page = 0; 1736 int len, limit; 1737 1738 if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD 1739 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1740 return -EINVAL; 1741 } 1742 pc = fsg->cmnd[2] >> 6; 1743 page_code = fsg->cmnd[2] & 0x3f; 1744 if (pc == 3) { 1745 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED; 1746 return -EINVAL; 1747 } 1748 changeable_values = (pc == 1); 1749 all_pages = (page_code == 0x3f); 1750 1751 /* Write the mode parameter header. Fixed values are: default 1752 * medium type, no cache control (DPOFUA), and no block descriptors. 1753 * The only variable value is the WriteProtect bit. We will fill in 1754 * the mode data length later. */ 1755 memset(buf, 0, 8); 1756 if (mscmnd == MODE_SENSE) { 1757 buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA 1758 buf += 4; 1759 limit = 255; 1760 } else { // MODE_SENSE_10 1761 buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA 1762 buf += 8; 1763 limit = 65535; // Should really be mod_data.buflen 1764 } 1765 1766 /* No block descriptors */ 1767 1768 /* The mode pages, in numerical order. The only page we support 1769 * is the Caching page. */ 1770 if (page_code == 0x08 || all_pages) { 1771 valid_page = 1; 1772 buf[0] = 0x08; // Page code 1773 buf[1] = 10; // Page length 1774 memset(buf+2, 0, 10); // None of the fields are changeable 1775 1776 if (!changeable_values) { 1777 buf[2] = 0x04; // Write cache enable, 1778 // Read cache not disabled 1779 // No cache retention priorities 1780 put_unaligned_be16(0xffff, &buf[4]); 1781 /* Don't disable prefetch */ 1782 /* Minimum prefetch = 0 */ 1783 put_unaligned_be16(0xffff, &buf[8]); 1784 /* Maximum prefetch */ 1785 put_unaligned_be16(0xffff, &buf[10]); 1786 /* Maximum prefetch ceiling */ 1787 } 1788 buf += 12; 1789 } 1790 1791 /* Check that a valid page was requested and the mode data length 1792 * isn't too long. */ 1793 len = buf - buf0; 1794 if (!valid_page || len > limit) { 1795 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1796 return -EINVAL; 1797 } 1798 1799 /* Store the mode data length */ 1800 if (mscmnd == MODE_SENSE) 1801 buf0[0] = len - 1; 1802 else 1803 put_unaligned_be16(len - 2, buf0); 1804 return len; 1805} 1806 1807 1808static int do_start_stop(struct fsg_dev *fsg) 1809{ 1810 struct fsg_lun *curlun = fsg->curlun; 1811 int loej, start; 1812 1813 if (!mod_data.removable) { 1814 curlun->sense_data = SS_INVALID_COMMAND; 1815 return -EINVAL; 1816 } 1817 1818 // int immed = fsg->cmnd[1] & 0x01; 1819 loej = fsg->cmnd[4] & 0x02; 1820 start = fsg->cmnd[4] & 0x01; 1821 1822#ifdef CONFIG_USB_FILE_STORAGE_TEST 1823 if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed 1824 (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start 1825 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1826 return -EINVAL; 1827 } 1828 1829 if (!start) { 1830 1831 /* Are we allowed to unload the media? */ 1832 if (curlun->prevent_medium_removal) { 1833 LDBG(curlun, "unload attempt prevented\n"); 1834 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED; 1835 return -EINVAL; 1836 } 1837 if (loej) { // Simulate an unload/eject 1838 up_read(&fsg->filesem); 1839 down_write(&fsg->filesem); 1840 fsg_lun_close(curlun); 1841 up_write(&fsg->filesem); 1842 down_read(&fsg->filesem); 1843 } 1844 } else { 1845 1846 /* Our emulation doesn't support mounting; the medium is 1847 * available for use as soon as it is loaded. */ 1848 if (!fsg_lun_is_open(curlun)) { 1849 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 1850 return -EINVAL; 1851 } 1852 } 1853#endif 1854 return 0; 1855} 1856 1857 1858static int do_prevent_allow(struct fsg_dev *fsg) 1859{ 1860 struct fsg_lun *curlun = fsg->curlun; 1861 int prevent; 1862 1863 if (!mod_data.removable) { 1864 curlun->sense_data = SS_INVALID_COMMAND; 1865 return -EINVAL; 1866 } 1867 1868 prevent = fsg->cmnd[4] & 0x01; 1869 if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent 1870 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1871 return -EINVAL; 1872 } 1873 1874 if (curlun->prevent_medium_removal && !prevent) 1875 fsg_lun_fsync_sub(curlun); 1876 curlun->prevent_medium_removal = prevent; 1877 return 0; 1878} 1879 1880 1881static int do_read_format_capacities(struct fsg_dev *fsg, 1882 struct fsg_buffhd *bh) 1883{ 1884 struct fsg_lun *curlun = fsg->curlun; 1885 u8 *buf = (u8 *) bh->buf; 1886 1887 buf[0] = buf[1] = buf[2] = 0; 1888 buf[3] = 8; // Only the Current/Maximum Capacity Descriptor 1889 buf += 4; 1890 1891 put_unaligned_be32(curlun->num_sectors, &buf[0]); 1892 /* Number of blocks */ 1893 put_unaligned_be32(512, &buf[4]); /* Block length */ 1894 buf[4] = 0x02; /* Current capacity */ 1895 return 12; 1896} 1897 1898 1899static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh) 1900{ 1901 struct fsg_lun *curlun = fsg->curlun; 1902 1903 /* We don't support MODE SELECT */ 1904 curlun->sense_data = SS_INVALID_COMMAND; 1905 return -EINVAL; 1906} 1907 1908 1909/*-------------------------------------------------------------------------*/ 1910 1911static int halt_bulk_in_endpoint(struct fsg_dev *fsg) 1912{ 1913 int rc; 1914 1915 rc = fsg_set_halt(fsg, fsg->bulk_in); 1916 if (rc == -EAGAIN) 1917 VDBG(fsg, "delayed bulk-in endpoint halt\n"); 1918 while (rc != 0) { 1919 if (rc != -EAGAIN) { 1920 WARNING(fsg, "usb_ep_set_halt -> %d\n", rc); 1921 rc = 0; 1922 break; 1923 } 1924 1925 /* Wait for a short time and then try again */ 1926 if (msleep_interruptible(100) != 0) 1927 return -EINTR; 1928 rc = usb_ep_set_halt(fsg->bulk_in); 1929 } 1930 return rc; 1931} 1932 1933static int wedge_bulk_in_endpoint(struct fsg_dev *fsg) 1934{ 1935 int rc; 1936 1937 DBG(fsg, "bulk-in set wedge\n"); 1938 rc = usb_ep_set_wedge(fsg->bulk_in); 1939 if (rc == -EAGAIN) 1940 VDBG(fsg, "delayed bulk-in endpoint wedge\n"); 1941 while (rc != 0) { 1942 if (rc != -EAGAIN) { 1943 WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc); 1944 rc = 0; 1945 break; 1946 } 1947 1948 /* Wait for a short time and then try again */ 1949 if (msleep_interruptible(100) != 0) 1950 return -EINTR; 1951 rc = usb_ep_set_wedge(fsg->bulk_in); 1952 } 1953 return rc; 1954} 1955 1956static int throw_away_data(struct fsg_dev *fsg) 1957{ 1958 struct fsg_buffhd *bh; 1959 u32 amount; 1960 int rc; 1961 1962 while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY || 1963 fsg->usb_amount_left > 0) { 1964 1965 /* Throw away the data in a filled buffer */ 1966 if (bh->state == BUF_STATE_FULL) { 1967 smp_rmb(); 1968 bh->state = BUF_STATE_EMPTY; 1969 fsg->next_buffhd_to_drain = bh->next; 1970 1971 /* A short packet or an error ends everything */ 1972 if (bh->outreq->actual != bh->outreq->length || 1973 bh->outreq->status != 0) { 1974 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT); 1975 return -EINTR; 1976 } 1977 continue; 1978 } 1979 1980 /* Try to submit another request if we need one */ 1981 bh = fsg->next_buffhd_to_fill; 1982 if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) { 1983 amount = min(fsg->usb_amount_left, 1984 (u32) mod_data.buflen); 1985 1986 /* amount is always divisible by 512, hence by 1987 * the bulk-out maxpacket size */ 1988 bh->outreq->length = bh->bulk_out_intended_length = 1989 amount; 1990 bh->outreq->short_not_ok = 1; 1991 start_transfer(fsg, fsg->bulk_out, bh->outreq, 1992 &bh->outreq_busy, &bh->state); 1993 fsg->next_buffhd_to_fill = bh->next; 1994 fsg->usb_amount_left -= amount; 1995 continue; 1996 } 1997 1998 /* Otherwise wait for something to happen */ 1999 rc = sleep_thread(fsg); 2000 if (rc) 2001 return rc; 2002 } 2003 return 0; 2004} 2005 2006 2007static int finish_reply(struct fsg_dev *fsg) 2008{ 2009 struct fsg_buffhd *bh = fsg->next_buffhd_to_fill; 2010 int rc = 0; 2011 2012 switch (fsg->data_dir) { 2013 case DATA_DIR_NONE: 2014 break; // Nothing to send 2015 2016 /* If we don't know whether the host wants to read or write, 2017 * this must be CB or CBI with an unknown command. We mustn't 2018 * try to send or receive any data. So stall both bulk pipes 2019 * if we can and wait for a reset. */ 2020 case DATA_DIR_UNKNOWN: 2021 if (mod_data.can_stall) { 2022 fsg_set_halt(fsg, fsg->bulk_out); 2023 rc = halt_bulk_in_endpoint(fsg); 2024 } 2025 break; 2026 2027 /* All but the last buffer of data must have already been sent */ 2028 case DATA_DIR_TO_HOST: 2029 if (fsg->data_size == 0) 2030 ; // Nothing to send 2031 2032 /* If there's no residue, simply send the last buffer */ 2033 else if (fsg->residue == 0) { 2034 bh->inreq->zero = 0; 2035 start_transfer(fsg, fsg->bulk_in, bh->inreq, 2036 &bh->inreq_busy, &bh->state); 2037 fsg->next_buffhd_to_fill = bh->next; 2038 } 2039 2040 /* There is a residue. For CB and CBI, simply mark the end 2041 * of the data with a short packet. However, if we are 2042 * allowed to stall, there was no data at all (residue == 2043 * data_size), and the command failed (invalid LUN or 2044 * sense data is set), then halt the bulk-in endpoint 2045 * instead. */ 2046 else if (!transport_is_bbb()) { 2047 if (mod_data.can_stall && 2048 fsg->residue == fsg->data_size && 2049 (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) { 2050 bh->state = BUF_STATE_EMPTY; 2051 rc = halt_bulk_in_endpoint(fsg); 2052 } else { 2053 bh->inreq->zero = 1; 2054 start_transfer(fsg, fsg->bulk_in, bh->inreq, 2055 &bh->inreq_busy, &bh->state); 2056 fsg->next_buffhd_to_fill = bh->next; 2057 } 2058 } 2059 2060 /* 2061 * For Bulk-only, mark the end of the data with a short 2062 * packet. If we are allowed to stall, halt the bulk-in 2063 * endpoint. (Note: This violates the Bulk-Only Transport 2064 * specification, which requires us to pad the data if we 2065 * don't halt the endpoint. Presumably nobody will mind.) 2066 */ 2067 else { 2068 bh->inreq->zero = 1; 2069 start_transfer(fsg, fsg->bulk_in, bh->inreq, 2070 &bh->inreq_busy, &bh->state); 2071 fsg->next_buffhd_to_fill = bh->next; 2072 if (mod_data.can_stall) 2073 rc = halt_bulk_in_endpoint(fsg); 2074 } 2075 break; 2076 2077 /* We have processed all we want from the data the host has sent. 2078 * There may still be outstanding bulk-out requests. */ 2079 case DATA_DIR_FROM_HOST: 2080 if (fsg->residue == 0) 2081 ; // Nothing to receive 2082 2083 /* Did the host stop sending unexpectedly early? */ 2084 else if (fsg->short_packet_received) { 2085 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT); 2086 rc = -EINTR; 2087 } 2088 2089 /* We haven't processed all the incoming data. Even though 2090 * we may be allowed to stall, doing so would cause a race. 2091 * The controller may already have ACK'ed all the remaining 2092 * bulk-out packets, in which case the host wouldn't see a 2093 * STALL. Not realizing the endpoint was halted, it wouldn't 2094 * clear the halt -- leading to problems later on. */ 2095#if 0 2096 else if (mod_data.can_stall) { 2097 fsg_set_halt(fsg, fsg->bulk_out); 2098 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT); 2099 rc = -EINTR; 2100 } 2101#endif 2102 2103 /* We can't stall. Read in the excess data and throw it 2104 * all away. */ 2105 else 2106 rc = throw_away_data(fsg); 2107 break; 2108 } 2109 return rc; 2110} 2111 2112 2113static int send_status(struct fsg_dev *fsg) 2114{ 2115 struct fsg_lun *curlun = fsg->curlun; 2116 struct fsg_buffhd *bh; 2117 int rc; 2118 u8 status = USB_STATUS_PASS; 2119 u32 sd, sdinfo = 0; 2120 2121 /* Wait for the next buffer to become available */ 2122 bh = fsg->next_buffhd_to_fill; 2123 while (bh->state != BUF_STATE_EMPTY) { 2124 rc = sleep_thread(fsg); 2125 if (rc) 2126 return rc; 2127 } 2128 2129 if (curlun) { 2130 sd = curlun->sense_data; 2131 sdinfo = curlun->sense_data_info; 2132 } else if (fsg->bad_lun_okay) 2133 sd = SS_NO_SENSE; 2134 else 2135 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED; 2136 2137 if (fsg->phase_error) { 2138 DBG(fsg, "sending phase-error status\n"); 2139 status = USB_STATUS_PHASE_ERROR; 2140 sd = SS_INVALID_COMMAND; 2141 } else if (sd != SS_NO_SENSE) { 2142 DBG(fsg, "sending command-failure status\n"); 2143 status = USB_STATUS_FAIL; 2144 VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;" 2145 " info x%x\n", 2146 SK(sd), ASC(sd), ASCQ(sd), sdinfo); 2147 } 2148 2149 if (transport_is_bbb()) { 2150 struct bulk_cs_wrap *csw = bh->buf; 2151 2152 /* Store and send the Bulk-only CSW */ 2153 csw->Signature = cpu_to_le32(USB_BULK_CS_SIG); 2154 csw->Tag = fsg->tag; 2155 csw->Residue = cpu_to_le32(fsg->residue); 2156 csw->Status = status; 2157 2158 bh->inreq->length = USB_BULK_CS_WRAP_LEN; 2159 bh->inreq->zero = 0; 2160 start_transfer(fsg, fsg->bulk_in, bh->inreq, 2161 &bh->inreq_busy, &bh->state); 2162 2163 } else if (mod_data.transport_type == USB_PR_CB) { 2164 2165 /* Control-Bulk transport has no status phase! */ 2166 return 0; 2167 2168 } else { // USB_PR_CBI 2169 struct interrupt_data *buf = bh->buf; 2170 2171 /* Store and send the Interrupt data. UFI sends the ASC 2172 * and ASCQ bytes. Everything else sends a Type (which 2173 * is always 0) and the status Value. */ 2174 if (mod_data.protocol_type == USB_SC_UFI) { 2175 buf->bType = ASC(sd); 2176 buf->bValue = ASCQ(sd); 2177 } else { 2178 buf->bType = 0; 2179 buf->bValue = status; 2180 } 2181 fsg->intreq->length = CBI_INTERRUPT_DATA_LEN; 2182 2183 fsg->intr_buffhd = bh; // Point to the right buffhd 2184 fsg->intreq->buf = bh->inreq->buf; 2185 fsg->intreq->context = bh; 2186 start_transfer(fsg, fsg->intr_in, fsg->intreq, 2187 &fsg->intreq_busy, &bh->state); 2188 } 2189 2190 fsg->next_buffhd_to_fill = bh->next; 2191 return 0; 2192} 2193 2194 2195/*-------------------------------------------------------------------------*/ 2196 2197/* Check whether the command is properly formed and whether its data size 2198 * and direction agree with the values we already have. */ 2199static int check_command(struct fsg_dev *fsg, int cmnd_size, 2200 enum data_direction data_dir, unsigned int mask, 2201 int needs_medium, const char *name) 2202{ 2203 int i; 2204 int lun = fsg->cmnd[1] >> 5; 2205 static const char dirletter[4] = {'u', 'o', 'i', 'n'}; 2206 char hdlen[20]; 2207 struct fsg_lun *curlun; 2208 2209 /* Adjust the expected cmnd_size for protocol encapsulation padding. 2210 * Transparent SCSI doesn't pad. */ 2211 if (protocol_is_scsi()) 2212 ; 2213 2214 /* There's some disagreement as to whether RBC pads commands or not. 2215 * We'll play it safe and accept either form. */ 2216 else if (mod_data.protocol_type == USB_SC_RBC) { 2217 if (fsg->cmnd_size == 12) 2218 cmnd_size = 12; 2219 2220 /* All the other protocols pad to 12 bytes */ 2221 } else 2222 cmnd_size = 12; 2223 2224 hdlen[0] = 0; 2225 if (fsg->data_dir != DATA_DIR_UNKNOWN) 2226 sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir], 2227 fsg->data_size); 2228 VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n", 2229 name, cmnd_size, dirletter[(int) data_dir], 2230 fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen); 2231 2232 /* We can't reply at all until we know the correct data direction 2233 * and size. */ 2234 if (fsg->data_size_from_cmnd == 0) 2235 data_dir = DATA_DIR_NONE; 2236 if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI 2237 fsg->data_dir = data_dir; 2238 fsg->data_size = fsg->data_size_from_cmnd; 2239 2240 } else { // Bulk-only 2241 if (fsg->data_size < fsg->data_size_from_cmnd) { 2242 2243 /* Host data size < Device data size is a phase error. 2244 * Carry out the command, but only transfer as much 2245 * as we are allowed. */ 2246 fsg->data_size_from_cmnd = fsg->data_size; 2247 fsg->phase_error = 1; 2248 } 2249 } 2250 fsg->residue = fsg->usb_amount_left = fsg->data_size; 2251 2252 /* Conflicting data directions is a phase error */ 2253 if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) { 2254 fsg->phase_error = 1; 2255 return -EINVAL; 2256 } 2257 2258 /* Verify the length of the command itself */ 2259 if (cmnd_size != fsg->cmnd_size) { 2260 2261 /* Special case workaround: There are plenty of buggy SCSI 2262 * implementations. Many have issues with cbw->Length 2263 * field passing a wrong command size. For those cases we 2264 * always try to work around the problem by using the length 2265 * sent by the host side provided it is at least as large 2266 * as the correct command length. 2267 * Examples of such cases would be MS-Windows, which issues 2268 * REQUEST SENSE with cbw->Length == 12 where it should 2269 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and 2270 * REQUEST SENSE with cbw->Length == 10 where it should 2271 * be 6 as well. 2272 */ 2273 if (cmnd_size <= fsg->cmnd_size) { 2274 DBG(fsg, "%s is buggy! Expected length %d " 2275 "but we got %d\n", name, 2276 cmnd_size, fsg->cmnd_size); 2277 cmnd_size = fsg->cmnd_size; 2278 } else { 2279 fsg->phase_error = 1; 2280 return -EINVAL; 2281 } 2282 } 2283 2284 /* Check that the LUN values are consistent */ 2285 if (transport_is_bbb()) { 2286 if (fsg->lun != lun) 2287 DBG(fsg, "using LUN %d from CBW, " 2288 "not LUN %d from CDB\n", 2289 fsg->lun, lun); 2290 } else 2291 fsg->lun = lun; // Use LUN from the command 2292 2293 /* Check the LUN */ 2294 if (fsg->lun < fsg->nluns) { 2295 fsg->curlun = curlun = &fsg->luns[fsg->lun]; 2296 if (fsg->cmnd[0] != REQUEST_SENSE) { 2297 curlun->sense_data = SS_NO_SENSE; 2298 curlun->sense_data_info = 0; 2299 curlun->info_valid = 0; 2300 } 2301 } else { 2302 fsg->curlun = curlun = NULL; 2303 fsg->bad_lun_okay = 0; 2304 2305 /* INQUIRY and REQUEST SENSE commands are explicitly allowed 2306 * to use unsupported LUNs; all others may not. */ 2307 if (fsg->cmnd[0] != INQUIRY && 2308 fsg->cmnd[0] != REQUEST_SENSE) { 2309 DBG(fsg, "unsupported LUN %d\n", fsg->lun); 2310 return -EINVAL; 2311 } 2312 } 2313 2314 /* If a unit attention condition exists, only INQUIRY and 2315 * REQUEST SENSE commands are allowed; anything else must fail. */ 2316 if (curlun && curlun->unit_attention_data != SS_NO_SENSE && 2317 fsg->cmnd[0] != INQUIRY && 2318 fsg->cmnd[0] != REQUEST_SENSE) { 2319 curlun->sense_data = curlun->unit_attention_data; 2320 curlun->unit_attention_data = SS_NO_SENSE; 2321 return -EINVAL; 2322 } 2323 2324 /* Check that only command bytes listed in the mask are non-zero */ 2325 fsg->cmnd[1] &= 0x1f; // Mask away the LUN 2326 for (i = 1; i < cmnd_size; ++i) { 2327 if (fsg->cmnd[i] && !(mask & (1 << i))) { 2328 if (curlun) 2329 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 2330 return -EINVAL; 2331 } 2332 } 2333 2334 /* If the medium isn't mounted and the command needs to access 2335 * it, return an error. */ 2336 if (curlun && !fsg_lun_is_open(curlun) && needs_medium) { 2337 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 2338 return -EINVAL; 2339 } 2340 2341 return 0; 2342} 2343 2344 2345static int do_scsi_command(struct fsg_dev *fsg) 2346{ 2347 struct fsg_buffhd *bh; 2348 int rc; 2349 int reply = -EINVAL; 2350 int i; 2351 static char unknown[16]; 2352 2353 dump_cdb(fsg); 2354 2355 /* Wait for the next buffer to become available for data or status */ 2356 bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill; 2357 while (bh->state != BUF_STATE_EMPTY) { 2358 rc = sleep_thread(fsg); 2359 if (rc) 2360 return rc; 2361 } 2362 fsg->phase_error = 0; 2363 fsg->short_packet_received = 0; 2364 2365 down_read(&fsg->filesem); // We're using the backing file 2366 switch (fsg->cmnd[0]) { 2367 2368 case INQUIRY: 2369 fsg->data_size_from_cmnd = fsg->cmnd[4]; 2370 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST, 2371 (1<<4), 0, 2372 "INQUIRY")) == 0) 2373 reply = do_inquiry(fsg, bh); 2374 break; 2375 2376 case MODE_SELECT: 2377 fsg->data_size_from_cmnd = fsg->cmnd[4]; 2378 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST, 2379 (1<<1) | (1<<4), 0, 2380 "MODE SELECT(6)")) == 0) 2381 reply = do_mode_select(fsg, bh); 2382 break; 2383 2384 case MODE_SELECT_10: 2385 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]); 2386 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST, 2387 (1<<1) | (3<<7), 0, 2388 "MODE SELECT(10)")) == 0) 2389 reply = do_mode_select(fsg, bh); 2390 break; 2391 2392 case MODE_SENSE: 2393 fsg->data_size_from_cmnd = fsg->cmnd[4]; 2394 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST, 2395 (1<<1) | (1<<2) | (1<<4), 0, 2396 "MODE SENSE(6)")) == 0) 2397 reply = do_mode_sense(fsg, bh); 2398 break; 2399 2400 case MODE_SENSE_10: 2401 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]); 2402 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2403 (1<<1) | (1<<2) | (3<<7), 0, 2404 "MODE SENSE(10)")) == 0) 2405 reply = do_mode_sense(fsg, bh); 2406 break; 2407 2408 case ALLOW_MEDIUM_REMOVAL: 2409 fsg->data_size_from_cmnd = 0; 2410 if ((reply = check_command(fsg, 6, DATA_DIR_NONE, 2411 (1<<4), 0, 2412 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0) 2413 reply = do_prevent_allow(fsg); 2414 break; 2415 2416 case READ_6: 2417 i = fsg->cmnd[4]; 2418 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9; 2419 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST, 2420 (7<<1) | (1<<4), 1, 2421 "READ(6)")) == 0) 2422 reply = do_read(fsg); 2423 break; 2424 2425 case READ_10: 2426 fsg->data_size_from_cmnd = 2427 get_unaligned_be16(&fsg->cmnd[7]) << 9; 2428 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2429 (1<<1) | (0xf<<2) | (3<<7), 1, 2430 "READ(10)")) == 0) 2431 reply = do_read(fsg); 2432 break; 2433 2434 case READ_12: 2435 fsg->data_size_from_cmnd = 2436 get_unaligned_be32(&fsg->cmnd[6]) << 9; 2437 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST, 2438 (1<<1) | (0xf<<2) | (0xf<<6), 1, 2439 "READ(12)")) == 0) 2440 reply = do_read(fsg); 2441 break; 2442 2443 case READ_CAPACITY: 2444 fsg->data_size_from_cmnd = 8; 2445 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2446 (0xf<<2) | (1<<8), 1, 2447 "READ CAPACITY")) == 0) 2448 reply = do_read_capacity(fsg, bh); 2449 break; 2450 2451 case READ_HEADER: 2452 if (!mod_data.cdrom) 2453 goto unknown_cmnd; 2454 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]); 2455 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2456 (3<<7) | (0x1f<<1), 1, 2457 "READ HEADER")) == 0) 2458 reply = do_read_header(fsg, bh); 2459 break; 2460 2461 case READ_TOC: 2462 if (!mod_data.cdrom) 2463 goto unknown_cmnd; 2464 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]); 2465 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2466 (7<<6) | (1<<1), 1, 2467 "READ TOC")) == 0) 2468 reply = do_read_toc(fsg, bh); 2469 break; 2470 2471 case READ_FORMAT_CAPACITIES: 2472 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]); 2473 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST, 2474 (3<<7), 1, 2475 "READ FORMAT CAPACITIES")) == 0) 2476 reply = do_read_format_capacities(fsg, bh); 2477 break; 2478 2479 case REQUEST_SENSE: 2480 fsg->data_size_from_cmnd = fsg->cmnd[4]; 2481 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST, 2482 (1<<4), 0, 2483 "REQUEST SENSE")) == 0) 2484 reply = do_request_sense(fsg, bh); 2485 break; 2486 2487 case START_STOP: 2488 fsg->data_size_from_cmnd = 0; 2489 if ((reply = check_command(fsg, 6, DATA_DIR_NONE, 2490 (1<<1) | (1<<4), 0, 2491 "START-STOP UNIT")) == 0) 2492 reply = do_start_stop(fsg); 2493 break; 2494 2495 case SYNCHRONIZE_CACHE: 2496 fsg->data_size_from_cmnd = 0; 2497 if ((reply = check_command(fsg, 10, DATA_DIR_NONE, 2498 (0xf<<2) | (3<<7), 1, 2499 "SYNCHRONIZE CACHE")) == 0) 2500 reply = do_synchronize_cache(fsg); 2501 break; 2502 2503 case TEST_UNIT_READY: 2504 fsg->data_size_from_cmnd = 0; 2505 reply = check_command(fsg, 6, DATA_DIR_NONE, 2506 0, 1, 2507 "TEST UNIT READY"); 2508 break; 2509 2510 /* Although optional, this command is used by MS-Windows. We 2511 * support a minimal version: BytChk must be 0. */ 2512 case VERIFY: 2513 fsg->data_size_from_cmnd = 0; 2514 if ((reply = check_command(fsg, 10, DATA_DIR_NONE, 2515 (1<<1) | (0xf<<2) | (3<<7), 1, 2516 "VERIFY")) == 0) 2517 reply = do_verify(fsg); 2518 break; 2519 2520 case WRITE_6: 2521 i = fsg->cmnd[4]; 2522 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9; 2523 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST, 2524 (7<<1) | (1<<4), 1, 2525 "WRITE(6)")) == 0) 2526 reply = do_write(fsg); 2527 break; 2528 2529 case WRITE_10: 2530 fsg->data_size_from_cmnd = 2531 get_unaligned_be16(&fsg->cmnd[7]) << 9; 2532 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST, 2533 (1<<1) | (0xf<<2) | (3<<7), 1, 2534 "WRITE(10)")) == 0) 2535 reply = do_write(fsg); 2536 break; 2537 2538 case WRITE_12: 2539 fsg->data_size_from_cmnd = 2540 get_unaligned_be32(&fsg->cmnd[6]) << 9; 2541 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST, 2542 (1<<1) | (0xf<<2) | (0xf<<6), 1, 2543 "WRITE(12)")) == 0) 2544 reply = do_write(fsg); 2545 break; 2546 2547 /* Some mandatory commands that we recognize but don't implement. 2548 * They don't mean much in this setting. It's left as an exercise 2549 * for anyone interested to implement RESERVE and RELEASE in terms 2550 * of Posix locks. */ 2551 case FORMAT_UNIT: 2552 case RELEASE: 2553 case RESERVE: 2554 case SEND_DIAGNOSTIC: 2555 // Fall through 2556 2557 default: 2558 unknown_cmnd: 2559 fsg->data_size_from_cmnd = 0; 2560 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]); 2561 if ((reply = check_command(fsg, fsg->cmnd_size, 2562 DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) { 2563 fsg->curlun->sense_data = SS_INVALID_COMMAND; 2564 reply = -EINVAL; 2565 } 2566 break; 2567 } 2568 up_read(&fsg->filesem); 2569 2570 if (reply == -EINTR || signal_pending(current)) 2571 return -EINTR; 2572 2573 /* Set up the single reply buffer for finish_reply() */ 2574 if (reply == -EINVAL) 2575 reply = 0; // Error reply length 2576 if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) { 2577 reply = min((u32) reply, fsg->data_size_from_cmnd); 2578 bh->inreq->length = reply; 2579 bh->state = BUF_STATE_FULL; 2580 fsg->residue -= reply; 2581 } // Otherwise it's already set 2582 2583 return 0; 2584} 2585 2586 2587/*-------------------------------------------------------------------------*/ 2588 2589static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh) 2590{ 2591 struct usb_request *req = bh->outreq; 2592 struct fsg_bulk_cb_wrap *cbw = req->buf; 2593 2594 /* Was this a real packet? Should it be ignored? */ 2595 if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags)) 2596 return -EINVAL; 2597 2598 /* Is the CBW valid? */ 2599 if (req->actual != USB_BULK_CB_WRAP_LEN || 2600 cbw->Signature != cpu_to_le32( 2601 USB_BULK_CB_SIG)) { 2602 DBG(fsg, "invalid CBW: len %u sig 0x%x\n", 2603 req->actual, 2604 le32_to_cpu(cbw->Signature)); 2605 2606 /* The Bulk-only spec says we MUST stall the IN endpoint 2607 * (6.6.1), so it's unavoidable. It also says we must 2608 * retain this state until the next reset, but there's 2609 * no way to tell the controller driver it should ignore 2610 * Clear-Feature(HALT) requests. 2611 * 2612 * We aren't required to halt the OUT endpoint; instead 2613 * we can simply accept and discard any data received 2614 * until the next reset. */ 2615 wedge_bulk_in_endpoint(fsg); 2616 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags); 2617 return -EINVAL; 2618 } 2619 2620 /* Is the CBW meaningful? */ 2621 if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG || 2622 cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) { 2623 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, " 2624 "cmdlen %u\n", 2625 cbw->Lun, cbw->Flags, cbw->Length); 2626 2627 /* We can do anything we want here, so let's stall the 2628 * bulk pipes if we are allowed to. */ 2629 if (mod_data.can_stall) { 2630 fsg_set_halt(fsg, fsg->bulk_out); 2631 halt_bulk_in_endpoint(fsg); 2632 } 2633 return -EINVAL; 2634 } 2635 2636 /* Save the command for later */ 2637 fsg->cmnd_size = cbw->Length; 2638 memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size); 2639 if (cbw->Flags & USB_BULK_IN_FLAG) 2640 fsg->data_dir = DATA_DIR_TO_HOST; 2641 else 2642 fsg->data_dir = DATA_DIR_FROM_HOST; 2643 fsg->data_size = le32_to_cpu(cbw->DataTransferLength); 2644 if (fsg->data_size == 0) 2645 fsg->data_dir = DATA_DIR_NONE; 2646 fsg->lun = cbw->Lun; 2647 fsg->tag = cbw->Tag; 2648 return 0; 2649} 2650 2651 2652static int get_next_command(struct fsg_dev *fsg) 2653{ 2654 struct fsg_buffhd *bh; 2655 int rc = 0; 2656 2657 if (transport_is_bbb()) { 2658 2659 /* Wait for the next buffer to become available */ 2660 bh = fsg->next_buffhd_to_fill; 2661 while (bh->state != BUF_STATE_EMPTY) { 2662 rc = sleep_thread(fsg); 2663 if (rc) 2664 return rc; 2665 } 2666 2667 /* Queue a request to read a Bulk-only CBW */ 2668 set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN); 2669 bh->outreq->short_not_ok = 1; 2670 start_transfer(fsg, fsg->bulk_out, bh->outreq, 2671 &bh->outreq_busy, &bh->state); 2672 2673 /* We will drain the buffer in software, which means we 2674 * can reuse it for the next filling. No need to advance 2675 * next_buffhd_to_fill. */ 2676 2677 /* Wait for the CBW to arrive */ 2678 while (bh->state != BUF_STATE_FULL) { 2679 rc = sleep_thread(fsg); 2680 if (rc) 2681 return rc; 2682 } 2683 smp_rmb(); 2684 rc = received_cbw(fsg, bh); 2685 bh->state = BUF_STATE_EMPTY; 2686 2687 } else { // USB_PR_CB or USB_PR_CBI 2688 2689 /* Wait for the next command to arrive */ 2690 while (fsg->cbbuf_cmnd_size == 0) { 2691 rc = sleep_thread(fsg); 2692 if (rc) 2693 return rc; 2694 } 2695 2696 /* Is the previous status interrupt request still busy? 2697 * The host is allowed to skip reading the status, 2698 * so we must cancel it. */ 2699 if (fsg->intreq_busy) 2700 usb_ep_dequeue(fsg->intr_in, fsg->intreq); 2701 2702 /* Copy the command and mark the buffer empty */ 2703 fsg->data_dir = DATA_DIR_UNKNOWN; 2704 spin_lock_irq(&fsg->lock); 2705 fsg->cmnd_size = fsg->cbbuf_cmnd_size; 2706 memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size); 2707 fsg->cbbuf_cmnd_size = 0; 2708 spin_unlock_irq(&fsg->lock); 2709 } 2710 return rc; 2711} 2712 2713 2714/*-------------------------------------------------------------------------*/ 2715 2716static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep, 2717 const struct usb_endpoint_descriptor *d) 2718{ 2719 int rc; 2720 2721 ep->driver_data = fsg; 2722 ep->desc = d; 2723 rc = usb_ep_enable(ep); 2724 if (rc) 2725 ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc); 2726 return rc; 2727} 2728 2729static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep, 2730 struct usb_request **preq) 2731{ 2732 *preq = usb_ep_alloc_request(ep, GFP_ATOMIC); 2733 if (*preq) 2734 return 0; 2735 ERROR(fsg, "can't allocate request for %s\n", ep->name); 2736 return -ENOMEM; 2737} 2738 2739/* 2740 * Reset interface setting and re-init endpoint state (toggle etc). 2741 * Call with altsetting < 0 to disable the interface. The only other 2742 * available altsetting is 0, which enables the interface. 2743 */ 2744static int do_set_interface(struct fsg_dev *fsg, int altsetting) 2745{ 2746 int rc = 0; 2747 int i; 2748 const struct usb_endpoint_descriptor *d; 2749 2750 if (fsg->running) 2751 DBG(fsg, "reset interface\n"); 2752 2753reset: 2754 /* Deallocate the requests */ 2755 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 2756 struct fsg_buffhd *bh = &fsg->buffhds[i]; 2757 2758 if (bh->inreq) { 2759 usb_ep_free_request(fsg->bulk_in, bh->inreq); 2760 bh->inreq = NULL; 2761 } 2762 if (bh->outreq) { 2763 usb_ep_free_request(fsg->bulk_out, bh->outreq); 2764 bh->outreq = NULL; 2765 } 2766 } 2767 if (fsg->intreq) { 2768 usb_ep_free_request(fsg->intr_in, fsg->intreq); 2769 fsg->intreq = NULL; 2770 } 2771 2772 /* Disable the endpoints */ 2773 if (fsg->bulk_in_enabled) { 2774 usb_ep_disable(fsg->bulk_in); 2775 fsg->bulk_in_enabled = 0; 2776 } 2777 if (fsg->bulk_out_enabled) { 2778 usb_ep_disable(fsg->bulk_out); 2779 fsg->bulk_out_enabled = 0; 2780 } 2781 if (fsg->intr_in_enabled) { 2782 usb_ep_disable(fsg->intr_in); 2783 fsg->intr_in_enabled = 0; 2784 } 2785 2786 fsg->running = 0; 2787 if (altsetting < 0 || rc != 0) 2788 return rc; 2789 2790 DBG(fsg, "set interface %d\n", altsetting); 2791 2792 /* Enable the endpoints */ 2793 d = fsg_ep_desc(fsg->gadget, 2794 &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc); 2795 if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0) 2796 goto reset; 2797 fsg->bulk_in_enabled = 1; 2798 2799 d = fsg_ep_desc(fsg->gadget, 2800 &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc); 2801 if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0) 2802 goto reset; 2803 fsg->bulk_out_enabled = 1; 2804 fsg->bulk_out_maxpacket = usb_endpoint_maxp(d); 2805 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags); 2806 2807 if (transport_is_cbi()) { 2808 d = fsg_ep_desc(fsg->gadget, 2809 &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc); 2810 if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0) 2811 goto reset; 2812 fsg->intr_in_enabled = 1; 2813 } 2814 2815 /* Allocate the requests */ 2816 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 2817 struct fsg_buffhd *bh = &fsg->buffhds[i]; 2818 2819 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0) 2820 goto reset; 2821 if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0) 2822 goto reset; 2823 bh->inreq->buf = bh->outreq->buf = bh->buf; 2824 bh->inreq->context = bh->outreq->context = bh; 2825 bh->inreq->complete = bulk_in_complete; 2826 bh->outreq->complete = bulk_out_complete; 2827 } 2828 if (transport_is_cbi()) { 2829 if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0) 2830 goto reset; 2831 fsg->intreq->complete = intr_in_complete; 2832 } 2833 2834 fsg->running = 1; 2835 for (i = 0; i < fsg->nluns; ++i) 2836 fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED; 2837 return rc; 2838} 2839 2840 2841/* 2842 * Change our operational configuration. This code must agree with the code 2843 * that returns config descriptors, and with interface altsetting code. 2844 * 2845 * It's also responsible for power management interactions. Some 2846 * configurations might not work with our current power sources. 2847 * For now we just assume the gadget is always self-powered. 2848 */ 2849static int do_set_config(struct fsg_dev *fsg, u8 new_config) 2850{ 2851 int rc = 0; 2852 2853 /* Disable the single interface */ 2854 if (fsg->config != 0) { 2855 DBG(fsg, "reset config\n"); 2856 fsg->config = 0; 2857 rc = do_set_interface(fsg, -1); 2858 } 2859 2860 /* Enable the interface */ 2861 if (new_config != 0) { 2862 fsg->config = new_config; 2863 if ((rc = do_set_interface(fsg, 0)) != 0) 2864 fsg->config = 0; // Reset on errors 2865 else 2866 INFO(fsg, "%s config #%d\n", 2867 usb_speed_string(fsg->gadget->speed), 2868 fsg->config); 2869 } 2870 return rc; 2871} 2872 2873 2874/*-------------------------------------------------------------------------*/ 2875 2876static void handle_exception(struct fsg_dev *fsg) 2877{ 2878 siginfo_t info; 2879 int sig; 2880 int i; 2881 int num_active; 2882 struct fsg_buffhd *bh; 2883 enum fsg_state old_state; 2884 u8 new_config; 2885 struct fsg_lun *curlun; 2886 unsigned int exception_req_tag; 2887 int rc; 2888 2889 /* Clear the existing signals. Anything but SIGUSR1 is converted 2890 * into a high-priority EXIT exception. */ 2891 for (;;) { 2892 sig = dequeue_signal_lock(current, ¤t->blocked, &info); 2893 if (!sig) 2894 break; 2895 if (sig != SIGUSR1) { 2896 if (fsg->state < FSG_STATE_EXIT) 2897 DBG(fsg, "Main thread exiting on signal\n"); 2898 raise_exception(fsg, FSG_STATE_EXIT); 2899 } 2900 } 2901 2902 /* Cancel all the pending transfers */ 2903 if (fsg->intreq_busy) 2904 usb_ep_dequeue(fsg->intr_in, fsg->intreq); 2905 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 2906 bh = &fsg->buffhds[i]; 2907 if (bh->inreq_busy) 2908 usb_ep_dequeue(fsg->bulk_in, bh->inreq); 2909 if (bh->outreq_busy) 2910 usb_ep_dequeue(fsg->bulk_out, bh->outreq); 2911 } 2912 2913 /* Wait until everything is idle */ 2914 for (;;) { 2915 num_active = fsg->intreq_busy; 2916 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 2917 bh = &fsg->buffhds[i]; 2918 num_active += bh->inreq_busy + bh->outreq_busy; 2919 } 2920 if (num_active == 0) 2921 break; 2922 if (sleep_thread(fsg)) 2923 return; 2924 } 2925 2926 /* Clear out the controller's fifos */ 2927 if (fsg->bulk_in_enabled) 2928 usb_ep_fifo_flush(fsg->bulk_in); 2929 if (fsg->bulk_out_enabled) 2930 usb_ep_fifo_flush(fsg->bulk_out); 2931 if (fsg->intr_in_enabled) 2932 usb_ep_fifo_flush(fsg->intr_in); 2933 2934 /* Reset the I/O buffer states and pointers, the SCSI 2935 * state, and the exception. Then invoke the handler. */ 2936 spin_lock_irq(&fsg->lock); 2937 2938 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 2939 bh = &fsg->buffhds[i]; 2940 bh->state = BUF_STATE_EMPTY; 2941 } 2942 fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain = 2943 &fsg->buffhds[0]; 2944 2945 exception_req_tag = fsg->exception_req_tag; 2946 new_config = fsg->new_config; 2947 old_state = fsg->state; 2948 2949 if (old_state == FSG_STATE_ABORT_BULK_OUT) 2950 fsg->state = FSG_STATE_STATUS_PHASE; 2951 else { 2952 for (i = 0; i < fsg->nluns; ++i) { 2953 curlun = &fsg->luns[i]; 2954 curlun->prevent_medium_removal = 0; 2955 curlun->sense_data = curlun->unit_attention_data = 2956 SS_NO_SENSE; 2957 curlun->sense_data_info = 0; 2958 curlun->info_valid = 0; 2959 } 2960 fsg->state = FSG_STATE_IDLE; 2961 } 2962 spin_unlock_irq(&fsg->lock); 2963 2964 /* Carry out any extra actions required for the exception */ 2965 switch (old_state) { 2966 default: 2967 break; 2968 2969 case FSG_STATE_ABORT_BULK_OUT: 2970 send_status(fsg); 2971 spin_lock_irq(&fsg->lock); 2972 if (fsg->state == FSG_STATE_STATUS_PHASE) 2973 fsg->state = FSG_STATE_IDLE; 2974 spin_unlock_irq(&fsg->lock); 2975 break; 2976 2977 case FSG_STATE_RESET: 2978 /* In case we were forced against our will to halt a 2979 * bulk endpoint, clear the halt now. (The SuperH UDC 2980 * requires this.) */ 2981 if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags)) 2982 usb_ep_clear_halt(fsg->bulk_in); 2983 2984 if (transport_is_bbb()) { 2985 if (fsg->ep0_req_tag == exception_req_tag) 2986 ep0_queue(fsg); // Complete the status stage 2987 2988 } else if (transport_is_cbi()) 2989 send_status(fsg); // Status by interrupt pipe 2990 2991 /* Technically this should go here, but it would only be 2992 * a waste of time. Ditto for the INTERFACE_CHANGE and 2993 * CONFIG_CHANGE cases. */ 2994 // for (i = 0; i < fsg->nluns; ++i) 2995 // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED; 2996 break; 2997 2998 case FSG_STATE_INTERFACE_CHANGE: 2999 rc = do_set_interface(fsg, 0); 3000 if (fsg->ep0_req_tag != exception_req_tag) 3001 break; 3002 if (rc != 0) // STALL on errors 3003 fsg_set_halt(fsg, fsg->ep0); 3004 else // Complete the status stage 3005 ep0_queue(fsg); 3006 break; 3007 3008 case FSG_STATE_CONFIG_CHANGE: 3009 rc = do_set_config(fsg, new_config); 3010 if (fsg->ep0_req_tag != exception_req_tag) 3011 break; 3012 if (rc != 0) // STALL on errors 3013 fsg_set_halt(fsg, fsg->ep0); 3014 else // Complete the status stage 3015 ep0_queue(fsg); 3016 break; 3017 3018 case FSG_STATE_DISCONNECT: 3019 for (i = 0; i < fsg->nluns; ++i) 3020 fsg_lun_fsync_sub(fsg->luns + i); 3021 do_set_config(fsg, 0); // Unconfigured state 3022 break; 3023 3024 case FSG_STATE_EXIT: 3025 case FSG_STATE_TERMINATED: 3026 do_set_config(fsg, 0); // Free resources 3027 spin_lock_irq(&fsg->lock); 3028 fsg->state = FSG_STATE_TERMINATED; // Stop the thread 3029 spin_unlock_irq(&fsg->lock); 3030 break; 3031 } 3032} 3033 3034 3035/*-------------------------------------------------------------------------*/ 3036 3037static int fsg_main_thread(void *fsg_) 3038{ 3039 struct fsg_dev *fsg = fsg_; 3040 3041 /* Allow the thread to be killed by a signal, but set the signal mask 3042 * to block everything but INT, TERM, KILL, and USR1. */ 3043 allow_signal(SIGINT); 3044 allow_signal(SIGTERM); 3045 allow_signal(SIGKILL); 3046 allow_signal(SIGUSR1); 3047 3048 /* Allow the thread to be frozen */ 3049 set_freezable(); 3050 3051 /* Arrange for userspace references to be interpreted as kernel 3052 * pointers. That way we can pass a kernel pointer to a routine 3053 * that expects a __user pointer and it will work okay. */ 3054 set_fs(get_ds()); 3055 3056 /* The main loop */ 3057 while (fsg->state != FSG_STATE_TERMINATED) { 3058 if (exception_in_progress(fsg) || signal_pending(current)) { 3059 handle_exception(fsg); 3060 continue; 3061 } 3062 3063 if (!fsg->running) { 3064 sleep_thread(fsg); 3065 continue; 3066 } 3067 3068 if (get_next_command(fsg)) 3069 continue; 3070 3071 spin_lock_irq(&fsg->lock); 3072 if (!exception_in_progress(fsg)) 3073 fsg->state = FSG_STATE_DATA_PHASE; 3074 spin_unlock_irq(&fsg->lock); 3075 3076 if (do_scsi_command(fsg) || finish_reply(fsg)) 3077 continue; 3078 3079 spin_lock_irq(&fsg->lock); 3080 if (!exception_in_progress(fsg)) 3081 fsg->state = FSG_STATE_STATUS_PHASE; 3082 spin_unlock_irq(&fsg->lock); 3083 3084 if (send_status(fsg)) 3085 continue; 3086 3087 spin_lock_irq(&fsg->lock); 3088 if (!exception_in_progress(fsg)) 3089 fsg->state = FSG_STATE_IDLE; 3090 spin_unlock_irq(&fsg->lock); 3091 } 3092 3093 spin_lock_irq(&fsg->lock); 3094 fsg->thread_task = NULL; 3095 spin_unlock_irq(&fsg->lock); 3096 3097 /* If we are exiting because of a signal, unregister the 3098 * gadget driver. */ 3099 if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) 3100 usb_gadget_unregister_driver(&fsg_driver); 3101 3102 /* Let the unbind and cleanup routines know the thread has exited */ 3103 complete_and_exit(&fsg->thread_notifier, 0); 3104} 3105 3106 3107/*-------------------------------------------------------------------------*/ 3108 3109 3110/* The write permissions and store_xxx pointers are set in fsg_bind() */ 3111static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL); 3112static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL); 3113static DEVICE_ATTR(file, 0444, fsg_show_file, NULL); 3114 3115 3116/*-------------------------------------------------------------------------*/ 3117 3118static void fsg_release(struct kref *ref) 3119{ 3120 struct fsg_dev *fsg = container_of(ref, struct fsg_dev, ref); 3121 3122 kfree(fsg->luns); 3123 kfree(fsg); 3124} 3125 3126static void lun_release(struct device *dev) 3127{ 3128 struct rw_semaphore *filesem = dev_get_drvdata(dev); 3129 struct fsg_dev *fsg = 3130 container_of(filesem, struct fsg_dev, filesem); 3131 3132 kref_put(&fsg->ref, fsg_release); 3133} 3134 3135static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget) 3136{ 3137 struct fsg_dev *fsg = get_gadget_data(gadget); 3138 int i; 3139 struct fsg_lun *curlun; 3140 struct usb_request *req = fsg->ep0req; 3141 3142 DBG(fsg, "unbind\n"); 3143 clear_bit(REGISTERED, &fsg->atomic_bitflags); 3144 3145 /* Unregister the sysfs attribute files and the LUNs */ 3146 for (i = 0; i < fsg->nluns; ++i) { 3147 curlun = &fsg->luns[i]; 3148 if (curlun->registered) { 3149 device_remove_file(&curlun->dev, &dev_attr_nofua); 3150 device_remove_file(&curlun->dev, &dev_attr_ro); 3151 device_remove_file(&curlun->dev, &dev_attr_file); 3152 fsg_lun_close(curlun); 3153 device_unregister(&curlun->dev); 3154 curlun->registered = 0; 3155 } 3156 } 3157 3158 /* If the thread isn't already dead, tell it to exit now */ 3159 if (fsg->state != FSG_STATE_TERMINATED) { 3160 raise_exception(fsg, FSG_STATE_EXIT); 3161 wait_for_completion(&fsg->thread_notifier); 3162 3163 /* The cleanup routine waits for this completion also */ 3164 complete(&fsg->thread_notifier); 3165 } 3166 3167 /* Free the data buffers */ 3168 for (i = 0; i < FSG_NUM_BUFFERS; ++i) 3169 kfree(fsg->buffhds[i].buf); 3170 3171 /* Free the request and buffer for endpoint 0 */ 3172 if (req) { 3173 kfree(req->buf); 3174 usb_ep_free_request(fsg->ep0, req); 3175 } 3176 3177 set_gadget_data(gadget, NULL); 3178} 3179 3180 3181static int __init check_parameters(struct fsg_dev *fsg) 3182{ 3183 int prot; 3184 int gcnum; 3185 3186 /* Store the default values */ 3187 mod_data.transport_type = USB_PR_BULK; 3188 mod_data.transport_name = "Bulk-only"; 3189 mod_data.protocol_type = USB_SC_SCSI; 3190 mod_data.protocol_name = "Transparent SCSI"; 3191 3192 /* Some peripheral controllers are known not to be able to 3193 * halt bulk endpoints correctly. If one of them is present, 3194 * disable stalls. 3195 */ 3196 if (gadget_is_at91(fsg->gadget)) 3197 mod_data.can_stall = 0; 3198 3199 if (mod_data.release == 0xffff) { // Parameter wasn't set 3200 gcnum = usb_gadget_controller_number(fsg->gadget); 3201 if (gcnum >= 0) 3202 mod_data.release = 0x0300 + gcnum; 3203 else { 3204 WARNING(fsg, "controller '%s' not recognized\n", 3205 fsg->gadget->name); 3206 mod_data.release = 0x0399; 3207 } 3208 } 3209 3210 prot = simple_strtol(mod_data.protocol_parm, NULL, 0); 3211 3212#ifdef CONFIG_USB_FILE_STORAGE_TEST 3213 if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) { 3214 ; // Use default setting 3215 } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) { 3216 mod_data.transport_type = USB_PR_CB; 3217 mod_data.transport_name = "Control-Bulk"; 3218 } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) { 3219 mod_data.transport_type = USB_PR_CBI; 3220 mod_data.transport_name = "Control-Bulk-Interrupt"; 3221 } else { 3222 ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm); 3223 return -EINVAL; 3224 } 3225 3226 if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 || 3227 prot == USB_SC_SCSI) { 3228 ; // Use default setting 3229 } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 || 3230 prot == USB_SC_RBC) { 3231 mod_data.protocol_type = USB_SC_RBC; 3232 mod_data.protocol_name = "RBC"; 3233 } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 || 3234 strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 || 3235 prot == USB_SC_8020) { 3236 mod_data.protocol_type = USB_SC_8020; 3237 mod_data.protocol_name = "8020i (ATAPI)"; 3238 } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 || 3239 prot == USB_SC_QIC) { 3240 mod_data.protocol_type = USB_SC_QIC; 3241 mod_data.protocol_name = "QIC-157"; 3242 } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 || 3243 prot == USB_SC_UFI) { 3244 mod_data.protocol_type = USB_SC_UFI; 3245 mod_data.protocol_name = "UFI"; 3246 } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 || 3247 prot == USB_SC_8070) { 3248 mod_data.protocol_type = USB_SC_8070; 3249 mod_data.protocol_name = "8070i"; 3250 } else { 3251 ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm); 3252 return -EINVAL; 3253 } 3254 3255 mod_data.buflen &= PAGE_CACHE_MASK; 3256 if (mod_data.buflen <= 0) { 3257 ERROR(fsg, "invalid buflen\n"); 3258 return -ETOOSMALL; 3259 } 3260 3261#endif /* CONFIG_USB_FILE_STORAGE_TEST */ 3262 3263 /* Serial string handling. 3264 * On a real device, the serial string would be loaded 3265 * from permanent storage. */ 3266 if (mod_data.serial) { 3267 const char *ch; 3268 unsigned len = 0; 3269 3270 /* Sanity check : 3271 * The CB[I] specification limits the serial string to 3272 * 12 uppercase hexadecimal characters. 3273 * BBB need at least 12 uppercase hexadecimal characters, 3274 * with a maximum of 126. */ 3275 for (ch = mod_data.serial; *ch; ++ch) { 3276 ++len; 3277 if ((*ch < '0' || *ch > '9') && 3278 (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */ 3279 WARNING(fsg, 3280 "Invalid serial string character: %c\n", 3281 *ch); 3282 goto no_serial; 3283 } 3284 } 3285 if (len > 126 || 3286 (mod_data.transport_type == USB_PR_BULK && len < 12) || 3287 (mod_data.transport_type != USB_PR_BULK && len > 12)) { 3288 WARNING(fsg, "Invalid serial string length!\n"); 3289 goto no_serial; 3290 } 3291 fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial; 3292 } else { 3293 WARNING(fsg, "No serial-number string provided!\n"); 3294 no_serial: 3295 device_desc.iSerialNumber = 0; 3296 } 3297 3298 return 0; 3299} 3300 3301 3302static int __init fsg_bind(struct usb_gadget *gadget) 3303{ 3304 struct fsg_dev *fsg = the_fsg; 3305 int rc; 3306 int i; 3307 struct fsg_lun *curlun; 3308 struct usb_ep *ep; 3309 struct usb_request *req; 3310 char *pathbuf, *p; 3311 3312 fsg->gadget = gadget; 3313 set_gadget_data(gadget, fsg); 3314 fsg->ep0 = gadget->ep0; 3315 fsg->ep0->driver_data = fsg; 3316 3317 if ((rc = check_parameters(fsg)) != 0) 3318 goto out; 3319 3320 if (mod_data.removable) { // Enable the store_xxx attributes 3321 dev_attr_file.attr.mode = 0644; 3322 dev_attr_file.store = fsg_store_file; 3323 if (!mod_data.cdrom) { 3324 dev_attr_ro.attr.mode = 0644; 3325 dev_attr_ro.store = fsg_store_ro; 3326 } 3327 } 3328 3329 /* Only for removable media? */ 3330 dev_attr_nofua.attr.mode = 0644; 3331 dev_attr_nofua.store = fsg_store_nofua; 3332 3333 /* Find out how many LUNs there should be */ 3334 i = mod_data.nluns; 3335 if (i == 0) 3336 i = max(mod_data.num_filenames, 1u); 3337 if (i > FSG_MAX_LUNS) { 3338 ERROR(fsg, "invalid number of LUNs: %d\n", i); 3339 rc = -EINVAL; 3340 goto out; 3341 } 3342 3343 /* Create the LUNs, open their backing files, and register the 3344 * LUN devices in sysfs. */ 3345 fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL); 3346 if (!fsg->luns) { 3347 rc = -ENOMEM; 3348 goto out; 3349 } 3350 fsg->nluns = i; 3351 3352 for (i = 0; i < fsg->nluns; ++i) { 3353 curlun = &fsg->luns[i]; 3354 curlun->cdrom = !!mod_data.cdrom; 3355 curlun->ro = mod_data.cdrom || mod_data.ro[i]; 3356 curlun->initially_ro = curlun->ro; 3357 curlun->removable = mod_data.removable; 3358 curlun->nofua = mod_data.nofua[i]; 3359 curlun->dev.release = lun_release; 3360 curlun->dev.parent = &gadget->dev; 3361 curlun->dev.driver = &fsg_driver.driver; 3362 dev_set_drvdata(&curlun->dev, &fsg->filesem); 3363 dev_set_name(&curlun->dev,"%s-lun%d", 3364 dev_name(&gadget->dev), i); 3365 3366 kref_get(&fsg->ref); 3367 rc = device_register(&curlun->dev); 3368 if (rc) { 3369 INFO(fsg, "failed to register LUN%d: %d\n", i, rc); 3370 put_device(&curlun->dev); 3371 goto out; 3372 } 3373 curlun->registered = 1; 3374 3375 rc = device_create_file(&curlun->dev, &dev_attr_ro); 3376 if (rc) 3377 goto out; 3378 rc = device_create_file(&curlun->dev, &dev_attr_nofua); 3379 if (rc) 3380 goto out; 3381 rc = device_create_file(&curlun->dev, &dev_attr_file); 3382 if (rc) 3383 goto out; 3384 3385 if (mod_data.file[i] && *mod_data.file[i]) { 3386 rc = fsg_lun_open(curlun, mod_data.file[i]); 3387 if (rc) 3388 goto out; 3389 } else if (!mod_data.removable) { 3390 ERROR(fsg, "no file given for LUN%d\n", i); 3391 rc = -EINVAL; 3392 goto out; 3393 } 3394 } 3395 3396 /* Find all the endpoints we will use */ 3397 usb_ep_autoconfig_reset(gadget); 3398 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc); 3399 if (!ep) 3400 goto autoconf_fail; 3401 ep->driver_data = fsg; // claim the endpoint 3402 fsg->bulk_in = ep; 3403 3404 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc); 3405 if (!ep) 3406 goto autoconf_fail; 3407 ep->driver_data = fsg; // claim the endpoint 3408 fsg->bulk_out = ep; 3409 3410 if (transport_is_cbi()) { 3411 ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc); 3412 if (!ep) 3413 goto autoconf_fail; 3414 ep->driver_data = fsg; // claim the endpoint 3415 fsg->intr_in = ep; 3416 } 3417 3418 /* Fix up the descriptors */ 3419 device_desc.idVendor = cpu_to_le16(mod_data.vendor); 3420 device_desc.idProduct = cpu_to_le16(mod_data.product); 3421 device_desc.bcdDevice = cpu_to_le16(mod_data.release); 3422 3423 i = (transport_is_cbi() ? 3 : 2); // Number of endpoints 3424 fsg_intf_desc.bNumEndpoints = i; 3425 fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type; 3426 fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type; 3427 fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL; 3428 3429 if (gadget_is_dualspeed(gadget)) { 3430 fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL; 3431 3432 /* Assume endpoint addresses are the same for both speeds */ 3433 fsg_hs_bulk_in_desc.bEndpointAddress = 3434 fsg_fs_bulk_in_desc.bEndpointAddress; 3435 fsg_hs_bulk_out_desc.bEndpointAddress = 3436 fsg_fs_bulk_out_desc.bEndpointAddress; 3437 fsg_hs_intr_in_desc.bEndpointAddress = 3438 fsg_fs_intr_in_desc.bEndpointAddress; 3439 } 3440 3441 if (gadget_is_otg(gadget)) 3442 fsg_otg_desc.bmAttributes |= USB_OTG_HNP; 3443 3444 rc = -ENOMEM; 3445 3446 /* Allocate the request and buffer for endpoint 0 */ 3447 fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL); 3448 if (!req) 3449 goto out; 3450 req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL); 3451 if (!req->buf) 3452 goto out; 3453 req->complete = ep0_complete; 3454 3455 /* Allocate the data buffers */ 3456 for (i = 0; i < FSG_NUM_BUFFERS; ++i) { 3457 struct fsg_buffhd *bh = &fsg->buffhds[i]; 3458 3459 /* Allocate for the bulk-in endpoint. We assume that 3460 * the buffer will also work with the bulk-out (and 3461 * interrupt-in) endpoint. */ 3462 bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL); 3463 if (!bh->buf) 3464 goto out; 3465 bh->next = bh + 1; 3466 } 3467 fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0]; 3468 3469 /* This should reflect the actual gadget power source */ 3470 usb_gadget_set_selfpowered(gadget); 3471 3472 snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer, 3473 "%s %s with %s", 3474 init_utsname()->sysname, init_utsname()->release, 3475 gadget->name); 3476 3477 fsg->thread_task = kthread_create(fsg_main_thread, fsg, 3478 "file-storage-gadget"); 3479 if (IS_ERR(fsg->thread_task)) { 3480 rc = PTR_ERR(fsg->thread_task); 3481 goto out; 3482 } 3483 3484 INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n"); 3485 INFO(fsg, "NOTE: This driver is deprecated. " 3486 "Consider using g_mass_storage instead.\n"); 3487 INFO(fsg, "Number of LUNs=%d\n", fsg->nluns); 3488 3489 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 3490 for (i = 0; i < fsg->nluns; ++i) { 3491 curlun = &fsg->luns[i]; 3492 if (fsg_lun_is_open(curlun)) { 3493 p = NULL; 3494 if (pathbuf) { 3495 p = d_path(&curlun->filp->f_path, 3496 pathbuf, PATH_MAX); 3497 if (IS_ERR(p)) 3498 p = NULL; 3499 } 3500 LINFO(curlun, "ro=%d, nofua=%d, file: %s\n", 3501 curlun->ro, curlun->nofua, (p ? p : "(error)")); 3502 } 3503 } 3504 kfree(pathbuf); 3505 3506 DBG(fsg, "transport=%s (x%02x)\n", 3507 mod_data.transport_name, mod_data.transport_type); 3508 DBG(fsg, "protocol=%s (x%02x)\n", 3509 mod_data.protocol_name, mod_data.protocol_type); 3510 DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n", 3511 mod_data.vendor, mod_data.product, mod_data.release); 3512 DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n", 3513 mod_data.removable, mod_data.can_stall, 3514 mod_data.cdrom, mod_data.buflen); 3515 DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task)); 3516 3517 set_bit(REGISTERED, &fsg->atomic_bitflags); 3518 3519 /* Tell the thread to start working */ 3520 wake_up_process(fsg->thread_task); 3521 return 0; 3522 3523autoconf_fail: 3524 ERROR(fsg, "unable to autoconfigure all endpoints\n"); 3525 rc = -ENOTSUPP; 3526 3527out: 3528 fsg->state = FSG_STATE_TERMINATED; // The thread is dead 3529 fsg_unbind(gadget); 3530 complete(&fsg->thread_notifier); 3531 return rc; 3532} 3533 3534 3535/*-------------------------------------------------------------------------*/ 3536 3537static void fsg_suspend(struct usb_gadget *gadget) 3538{ 3539 struct fsg_dev *fsg = get_gadget_data(gadget); 3540 3541 DBG(fsg, "suspend\n"); 3542 set_bit(SUSPENDED, &fsg->atomic_bitflags); 3543} 3544 3545static void fsg_resume(struct usb_gadget *gadget) 3546{ 3547 struct fsg_dev *fsg = get_gadget_data(gadget); 3548 3549 DBG(fsg, "resume\n"); 3550 clear_bit(SUSPENDED, &fsg->atomic_bitflags); 3551} 3552 3553 3554/*-------------------------------------------------------------------------*/ 3555 3556static struct usb_gadget_driver fsg_driver = { 3557#ifdef CONFIG_USB_GADGET_DUALSPEED 3558 .speed = USB_SPEED_HIGH, 3559#else 3560 .speed = USB_SPEED_FULL, 3561#endif 3562 .function = (char *) fsg_string_product, 3563 .unbind = fsg_unbind, 3564 .disconnect = fsg_disconnect, 3565 .setup = fsg_setup, 3566 .suspend = fsg_suspend, 3567 .resume = fsg_resume, 3568 3569 .driver = { 3570 .name = DRIVER_NAME, 3571 .owner = THIS_MODULE, 3572 // .release = ... 3573 // .suspend = ... 3574 // .resume = ... 3575 }, 3576}; 3577 3578 3579static int __init fsg_alloc(void) 3580{ 3581 struct fsg_dev *fsg; 3582 3583 fsg = kzalloc(sizeof *fsg, GFP_KERNEL); 3584 if (!fsg) 3585 return -ENOMEM; 3586 spin_lock_init(&fsg->lock); 3587 init_rwsem(&fsg->filesem); 3588 kref_init(&fsg->ref); 3589 init_completion(&fsg->thread_notifier); 3590 3591 the_fsg = fsg; 3592 return 0; 3593} 3594 3595 3596static int __init fsg_init(void) 3597{ 3598 int rc; 3599 struct fsg_dev *fsg; 3600 3601 if ((rc = fsg_alloc()) != 0) 3602 return rc; 3603 fsg = the_fsg; 3604 if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0) 3605 kref_put(&fsg->ref, fsg_release); 3606 return rc; 3607} 3608module_init(fsg_init); 3609 3610 3611static void __exit fsg_cleanup(void) 3612{ 3613 struct fsg_dev *fsg = the_fsg; 3614 3615 /* Unregister the driver iff the thread hasn't already done so */ 3616 if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) 3617 usb_gadget_unregister_driver(&fsg_driver); 3618 3619 /* Wait for the thread to finish up */ 3620 wait_for_completion(&fsg->thread_notifier); 3621 3622 kref_put(&fsg->ref, fsg_release); 3623} 3624module_exit(fsg_cleanup); 3625