2 * f_mass_storage.c -- Mass Storage USB Composite Function
4 * Copyright (C) 2003-2008 Alan Stern
5 * Copyright (C) 2009 Samsung Electronics
6 * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
9 * SPDX-License-Identifier: GPL-2.0+ BSD-3-Clause
13 * The Mass Storage Function acts as a USB Mass Storage device,
14 * appearing to the host as a disk drive or as a CD-ROM drive. In
15 * addition to providing an example of a genuinely useful composite
16 * function for a USB device, it also illustrates a technique of
17 * double-buffering for increased throughput.
19 * Function supports multiple logical units (LUNs). Backing storage
20 * for each LUN is provided by a regular file or a block device.
21 * Access for each LUN can be limited to read-only. Moreover, the
22 * function can indicate that LUN is removable and/or CD-ROM. (The
23 * later implies read-only access.)
25 * MSF is configured by specifying a fsg_config structure. It has the
28 * nluns Number of LUNs function have (anywhere from 1
29 * to FSG_MAX_LUNS which is 8).
30 * luns An array of LUN configuration values. This
31 * should be filled for each LUN that
32 * function will include (ie. for "nluns"
33 * LUNs). Each element of the array has
34 * the following fields:
35 * ->filename The path to the backing file for the LUN.
36 * Required if LUN is not marked as
38 * ->ro Flag specifying access to the LUN shall be
39 * read-only. This is implied if CD-ROM
40 * emulation is enabled as well as when
41 * it was impossible to open "filename"
43 * ->removable Flag specifying that LUN shall be indicated as
45 * ->cdrom Flag specifying that LUN shall be reported as
48 * lun_name_format A printf-like format for names of the LUN
49 * devices. This determines how the
50 * directory in sysfs will be named.
51 * Unless you are using several MSFs in
52 * a single gadget (as opposed to single
53 * MSF in many configurations) you may
54 * leave it as NULL (in which case
55 * "lun%d" will be used). In the format
56 * you can use "%d" to index LUNs for
57 * MSF's with more than one LUN. (Beware
58 * that there is only one integer given
59 * as an argument for the format and
60 * specifying invalid format may cause
61 * unspecified behaviour.)
62 * thread_name Name of the kernel thread process used by the
63 * MSF. You can safely set it to NULL
64 * (in which case default "file-storage"
69 * release Information used as a reply to INQUIRY
70 * request. To use default set to NULL,
71 * NULL, 0xffff respectively. The first
72 * field should be 8 and the second 16
75 * can_stall Set to permit function to halt bulk endpoints.
76 * Disabled on some USB devices known not
77 * to work correctly. You should set it
80 * If "removable" is not set for a LUN then a backing file must be
81 * specified. If it is set, then NULL filename means the LUN's medium
82 * is not loaded (an empty string as "filename" in the fsg_config
83 * structure causes error). The CD-ROM emulation includes a single
84 * data track and no audio tracks; hence there need be only one
85 * backing file per LUN. Note also that the CD-ROM block length is
86 * set to 512 rather than the more common value 2048.
89 * MSF includes support for module parameters. If gadget using it
90 * decides to use it, the following module parameters will be
93 * file=filename[,filename...]
94 * Names of the files or block devices used for
96 * ro=b[,b...] Default false, boolean for read-only access.
98 * Default true, boolean for removable media.
99 * cdrom=b[,b...] Default false, boolean for whether to emulate
101 * luns=N Default N = number of filenames, number of
103 * stall Default determined according to the type of
104 * USB device controller (usually true),
105 * boolean to permit the driver to halt
108 * The module parameters may be prefixed with some string. You need
109 * to consult gadget's documentation or source to verify whether it is
110 * using those module parameters and if it does what are the prefixes
111 * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
115 * Requirements are modest; only a bulk-in and a bulk-out endpoint are
116 * needed. The memory requirement amounts to two 16K buffers, size
117 * configurable by a parameter. Support is included for both
118 * full-speed and high-speed operation.
120 * Note that the driver is slightly non-portable in that it assumes a
121 * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
122 * interrupt-in endpoints. With most device controllers this isn't an
123 * issue, but there may be some with hardware restrictions that prevent
124 * a buffer from being used by more than one endpoint.
127 * The pathnames of the backing files and the ro settings are
128 * available in the attribute files "file" and "ro" in the lun<n> (or
129 * to be more precise in a directory which name comes from
130 * "lun_name_format" option!) subdirectory of the gadget's sysfs
131 * directory. If the "removable" option is set, writing to these
132 * files will simulate ejecting/loading the medium (writing an empty
133 * line means eject) and adjusting a write-enable tab. Changes to the
134 * ro setting are not allowed when the medium is loaded or if CD-ROM
135 * emulation is being used.
137 * When a LUN receive an "eject" SCSI request (Start/Stop Unit),
138 * if the LUN is removable, the backing file is released to simulate
142 * This function is heavily based on "File-backed Storage Gadget" by
143 * Alan Stern which in turn is heavily based on "Gadget Zero" by David
144 * Brownell. The driver's SCSI command interface was based on the
145 * "Information technology - Small Computer System Interface - 2"
146 * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
147 * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
148 * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
149 * was based on the "Universal Serial Bus Mass Storage Class UFI
150 * Command Specification" document, Revision 1.0, December 14, 1998,
152 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
158 * The MSF is fairly straightforward. There is a main kernel
159 * thread that handles most of the work. Interrupt routines field
160 * callbacks from the controller driver: bulk- and interrupt-request
161 * completion notifications, endpoint-0 events, and disconnect events.
162 * Completion events are passed to the main thread by wakeup calls. Many
163 * ep0 requests are handled at interrupt time, but SetInterface,
164 * SetConfiguration, and device reset requests are forwarded to the
165 * thread in the form of "exceptions" using SIGUSR1 signals (since they
166 * should interrupt any ongoing file I/O operations).
168 * The thread's main routine implements the standard command/data/status
169 * parts of a SCSI interaction. It and its subroutines are full of tests
170 * for pending signals/exceptions -- all this polling is necessary since
171 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
172 * indication that the driver really wants to be running in userspace.)
173 * An important point is that so long as the thread is alive it keeps an
174 * open reference to the backing file. This will prevent unmounting
175 * the backing file's underlying filesystem and could cause problems
176 * during system shutdown, for example. To prevent such problems, the
177 * thread catches INT, TERM, and KILL signals and converts them into
180 * In normal operation the main thread is started during the gadget's
181 * fsg_bind() callback and stopped during fsg_unbind(). But it can
182 * also exit when it receives a signal, and there's no point leaving
183 * the gadget running when the thread is dead. At of this moment, MSF
184 * provides no way to deregister the gadget when thread dies -- maybe
185 * a callback functions is needed.
187 * To provide maximum throughput, the driver uses a circular pipeline of
188 * buffer heads (struct fsg_buffhd). In principle the pipeline can be
189 * arbitrarily long; in practice the benefits don't justify having more
190 * than 2 stages (i.e., double buffering). But it helps to think of the
191 * pipeline as being a long one. Each buffer head contains a bulk-in and
192 * a bulk-out request pointer (since the buffer can be used for both
193 * output and input -- directions always are given from the host's
194 * point of view) as well as a pointer to the buffer and various state
197 * Use of the pipeline follows a simple protocol. There is a variable
198 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
199 * At any time that buffer head may still be in use from an earlier
200 * request, so each buffer head has a state variable indicating whether
201 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
202 * buffer head to be EMPTY, filling the buffer either by file I/O or by
203 * USB I/O (during which the buffer head is BUSY), and marking the buffer
204 * head FULL when the I/O is complete. Then the buffer will be emptied
205 * (again possibly by USB I/O, during which it is marked BUSY) and
206 * finally marked EMPTY again (possibly by a completion routine).
208 * A module parameter tells the driver to avoid stalling the bulk
209 * endpoints wherever the transport specification allows. This is
210 * necessary for some UDCs like the SuperH, which cannot reliably clear a
211 * halt on a bulk endpoint. However, under certain circumstances the
212 * Bulk-only specification requires a stall. In such cases the driver
213 * will halt the endpoint and set a flag indicating that it should clear
214 * the halt in software during the next device reset. Hopefully this
215 * will permit everything to work correctly. Furthermore, although the
216 * specification allows the bulk-out endpoint to halt when the host sends
217 * too much data, implementing this would cause an unavoidable race.
218 * The driver will always use the "no-stall" approach for OUT transfers.
220 * One subtle point concerns sending status-stage responses for ep0
221 * requests. Some of these requests, such as device reset, can involve
222 * interrupting an ongoing file I/O operation, which might take an
223 * arbitrarily long time. During that delay the host might give up on
224 * the original ep0 request and issue a new one. When that happens the
225 * driver should not notify the host about completion of the original
226 * request, as the host will no longer be waiting for it. So the driver
227 * assigns to each ep0 request a unique tag, and it keeps track of the
228 * tag value of the request associated with a long-running exception
229 * (device-reset, interface-change, or configuration-change). When the
230 * exception handler is finished, the status-stage response is submitted
231 * only if the current ep0 request tag is equal to the exception request
232 * tag. Thus only the most recently received ep0 request will get a
233 * status-stage response.
235 * Warning: This driver source file is too long. It ought to be split up
236 * into a header file plus about 3 separate .c files, to handle the details
237 * of the Gadget, USB Mass Storage, and SCSI protocols.
240 /* #define VERBOSE_DEBUG */
241 /* #define DUMP_MSGS */
249 #include <linux/err.h>
250 #include <linux/usb/ch9.h>
251 #include <linux/usb/gadget.h>
252 #include <usb_mass_storage.h>
254 #include <asm/unaligned.h>
255 #include <linux/usb/gadget.h>
256 #include <linux/usb/gadget.h>
257 #include <linux/usb/composite.h>
258 #include <usb/lin_gadget_compat.h>
261 /*------------------------------------------------------------------------*/
263 #define FSG_DRIVER_DESC "Mass Storage Function"
264 #define FSG_DRIVER_VERSION "2012/06/5"
266 static const char fsg_string_interface
[] = "Mass Storage";
268 #define FSG_NO_INTR_EP 1
269 #define FSG_NO_DEVICE_STRINGS 1
271 #define FSG_NO_INTR_EP 1
273 #include "storage_common.c"
275 /*-------------------------------------------------------------------------*/
277 #define GFP_ATOMIC ((gfp_t) 0)
278 #define PAGE_CACHE_SHIFT 12
279 #define PAGE_CACHE_SIZE (1 << PAGE_CACHE_SHIFT)
280 #define kthread_create(...) __builtin_return_address(0)
281 #define wait_for_completion(...) do {} while (0)
283 struct kref
{int x
; };
284 struct completion
{int x
; };
286 inline void set_bit(int nr
, volatile void *addr
)
289 unsigned int *a
= (unsigned int *) addr
;
292 mask
= 1 << (nr
& 0x1f);
296 inline void clear_bit(int nr
, volatile void *addr
)
299 unsigned int *a
= (unsigned int *) addr
;
302 mask
= 1 << (nr
& 0x1f);
309 /* Data shared by all the FSG instances. */
311 struct usb_gadget
*gadget
;
312 struct fsg_dev
*fsg
, *new_fsg
;
314 struct usb_ep
*ep0
; /* Copy of gadget->ep0 */
315 struct usb_request
*ep0req
; /* Copy of cdev->req */
316 unsigned int ep0_req_tag
;
318 struct fsg_buffhd
*next_buffhd_to_fill
;
319 struct fsg_buffhd
*next_buffhd_to_drain
;
320 struct fsg_buffhd buffhds
[FSG_NUM_BUFFERS
];
323 u8 cmnd
[MAX_COMMAND_SIZE
];
327 struct fsg_lun luns
[FSG_MAX_LUNS
];
329 unsigned int bulk_out_maxpacket
;
330 enum fsg_state state
; /* For exception handling */
331 unsigned int exception_req_tag
;
333 enum data_direction data_dir
;
335 u32 data_size_from_cmnd
;
340 unsigned int can_stall
:1;
341 unsigned int free_storage_on_release
:1;
342 unsigned int phase_error
:1;
343 unsigned int short_packet_received
:1;
344 unsigned int bad_lun_okay
:1;
345 unsigned int running
:1;
347 int thread_wakeup_needed
;
348 struct completion thread_notifier
;
349 struct task_struct
*thread_task
;
351 /* Callback functions. */
352 const struct fsg_operations
*ops
;
353 /* Gadget's private data. */
356 const char *vendor_name
; /* 8 characters or less */
357 const char *product_name
; /* 16 characters or less */
360 /* Vendor (8 chars), product (16 chars), release (4
361 * hexadecimal digits) and NUL byte */
362 char inquiry_string
[8 + 16 + 4 + 1];
369 struct fsg_lun_config
{
370 const char *filename
;
375 } luns
[FSG_MAX_LUNS
];
377 /* Callback functions. */
378 const struct fsg_operations
*ops
;
379 /* Gadget's private data. */
382 const char *vendor_name
; /* 8 characters or less */
383 const char *product_name
; /* 16 characters or less */
389 struct usb_function function
;
390 struct usb_gadget
*gadget
; /* Copy of cdev->gadget */
391 struct fsg_common
*common
;
393 u16 interface_number
;
395 unsigned int bulk_in_enabled
:1;
396 unsigned int bulk_out_enabled
:1;
398 unsigned long atomic_bitflags
;
399 #define IGNORE_BULK_OUT 0
401 struct usb_ep
*bulk_in
;
402 struct usb_ep
*bulk_out
;
406 static inline int __fsg_is_set(struct fsg_common
*common
,
407 const char *func
, unsigned line
)
411 ERROR(common
, "common->fsg is NULL in %s at %u\n", func
, line
);
416 #define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
419 static inline struct fsg_dev
*fsg_from_func(struct usb_function
*f
)
421 return container_of(f
, struct fsg_dev
, function
);
425 typedef void (*fsg_routine_t
)(struct fsg_dev
*);
427 static int exception_in_progress(struct fsg_common
*common
)
429 return common
->state
> FSG_STATE_IDLE
;
432 /* Make bulk-out requests be divisible by the maxpacket size */
433 static void set_bulk_out_req_length(struct fsg_common
*common
,
434 struct fsg_buffhd
*bh
, unsigned int length
)
438 bh
->bulk_out_intended_length
= length
;
439 rem
= length
% common
->bulk_out_maxpacket
;
441 length
+= common
->bulk_out_maxpacket
- rem
;
442 bh
->outreq
->length
= length
;
445 /*-------------------------------------------------------------------------*/
448 struct fsg_common
*the_fsg_common
;
450 static int fsg_set_halt(struct fsg_dev
*fsg
, struct usb_ep
*ep
)
454 if (ep
== fsg
->bulk_in
)
456 else if (ep
== fsg
->bulk_out
)
460 DBG(fsg
, "%s set halt\n", name
);
461 return usb_ep_set_halt(ep
);
464 /*-------------------------------------------------------------------------*/
466 /* These routines may be called in process context or in_irq */
468 /* Caller must hold fsg->lock */
469 static void wakeup_thread(struct fsg_common
*common
)
471 common
->thread_wakeup_needed
= 1;
474 static void raise_exception(struct fsg_common
*common
, enum fsg_state new_state
)
476 /* Do nothing if a higher-priority exception is already in progress.
477 * If a lower-or-equal priority exception is in progress, preempt it
478 * and notify the main thread by sending it a signal. */
479 if (common
->state
<= new_state
) {
480 common
->exception_req_tag
= common
->ep0_req_tag
;
481 common
->state
= new_state
;
482 common
->thread_wakeup_needed
= 1;
486 /*-------------------------------------------------------------------------*/
488 static int ep0_queue(struct fsg_common
*common
)
492 rc
= usb_ep_queue(common
->ep0
, common
->ep0req
, GFP_ATOMIC
);
493 common
->ep0
->driver_data
= common
;
494 if (rc
!= 0 && rc
!= -ESHUTDOWN
) {
495 /* We can't do much more than wait for a reset */
496 WARNING(common
, "error in submission: %s --> %d\n",
497 common
->ep0
->name
, rc
);
502 /*-------------------------------------------------------------------------*/
504 /* Bulk and interrupt endpoint completion handlers.
505 * These always run in_irq. */
507 static void bulk_in_complete(struct usb_ep
*ep
, struct usb_request
*req
)
509 struct fsg_common
*common
= ep
->driver_data
;
510 struct fsg_buffhd
*bh
= req
->context
;
512 if (req
->status
|| req
->actual
!= req
->length
)
513 DBG(common
, "%s --> %d, %u/%u\n", __func__
,
514 req
->status
, req
->actual
, req
->length
);
515 if (req
->status
== -ECONNRESET
) /* Request was cancelled */
516 usb_ep_fifo_flush(ep
);
518 /* Hold the lock while we update the request and buffer states */
520 bh
->state
= BUF_STATE_EMPTY
;
521 wakeup_thread(common
);
524 static void bulk_out_complete(struct usb_ep
*ep
, struct usb_request
*req
)
526 struct fsg_common
*common
= ep
->driver_data
;
527 struct fsg_buffhd
*bh
= req
->context
;
529 dump_msg(common
, "bulk-out", req
->buf
, req
->actual
);
530 if (req
->status
|| req
->actual
!= bh
->bulk_out_intended_length
)
531 DBG(common
, "%s --> %d, %u/%u\n", __func__
,
532 req
->status
, req
->actual
,
533 bh
->bulk_out_intended_length
);
534 if (req
->status
== -ECONNRESET
) /* Request was cancelled */
535 usb_ep_fifo_flush(ep
);
537 /* Hold the lock while we update the request and buffer states */
539 bh
->state
= BUF_STATE_FULL
;
540 wakeup_thread(common
);
543 /*-------------------------------------------------------------------------*/
545 /* Ep0 class-specific handlers. These always run in_irq. */
547 static int fsg_setup(struct usb_function
*f
,
548 const struct usb_ctrlrequest
*ctrl
)
550 struct fsg_dev
*fsg
= fsg_from_func(f
);
551 struct usb_request
*req
= fsg
->common
->ep0req
;
552 u16 w_index
= get_unaligned_le16(&ctrl
->wIndex
);
553 u16 w_value
= get_unaligned_le16(&ctrl
->wValue
);
554 u16 w_length
= get_unaligned_le16(&ctrl
->wLength
);
556 if (!fsg_is_set(fsg
->common
))
559 switch (ctrl
->bRequest
) {
561 case USB_BULK_RESET_REQUEST
:
562 if (ctrl
->bRequestType
!=
563 (USB_DIR_OUT
| USB_TYPE_CLASS
| USB_RECIP_INTERFACE
))
565 if (w_index
!= fsg
->interface_number
|| w_value
!= 0)
568 /* Raise an exception to stop the current operation
569 * and reinitialize our state. */
570 DBG(fsg
, "bulk reset request\n");
571 raise_exception(fsg
->common
, FSG_STATE_RESET
);
572 return DELAYED_STATUS
;
574 case USB_BULK_GET_MAX_LUN_REQUEST
:
575 if (ctrl
->bRequestType
!=
576 (USB_DIR_IN
| USB_TYPE_CLASS
| USB_RECIP_INTERFACE
))
578 if (w_index
!= fsg
->interface_number
|| w_value
!= 0)
580 VDBG(fsg
, "get max LUN\n");
581 *(u8
*) req
->buf
= fsg
->common
->nluns
- 1;
583 /* Respond with data/status */
584 req
->length
= min((u16
)1, w_length
);
585 return ep0_queue(fsg
->common
);
589 "unknown class-specific control req "
590 "%02x.%02x v%04x i%04x l%u\n",
591 ctrl
->bRequestType
, ctrl
->bRequest
,
592 get_unaligned_le16(&ctrl
->wValue
), w_index
, w_length
);
596 /*-------------------------------------------------------------------------*/
598 /* All the following routines run in process context */
600 /* Use this for bulk or interrupt transfers, not ep0 */
601 static void start_transfer(struct fsg_dev
*fsg
, struct usb_ep
*ep
,
602 struct usb_request
*req
, int *pbusy
,
603 enum fsg_buffer_state
*state
)
607 if (ep
== fsg
->bulk_in
)
608 dump_msg(fsg
, "bulk-in", req
->buf
, req
->length
);
611 *state
= BUF_STATE_BUSY
;
612 rc
= usb_ep_queue(ep
, req
, GFP_KERNEL
);
615 *state
= BUF_STATE_EMPTY
;
617 /* We can't do much more than wait for a reset */
619 /* Note: currently the net2280 driver fails zero-length
620 * submissions if DMA is enabled. */
621 if (rc
!= -ESHUTDOWN
&& !(rc
== -EOPNOTSUPP
&&
623 WARNING(fsg
, "error in submission: %s --> %d\n",
628 #define START_TRANSFER_OR(common, ep_name, req, pbusy, state) \
629 if (fsg_is_set(common)) \
630 start_transfer((common)->fsg, (common)->fsg->ep_name, \
631 req, pbusy, state); \
634 #define START_TRANSFER(common, ep_name, req, pbusy, state) \
635 START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
637 static void busy_indicator(void)
665 static int sleep_thread(struct fsg_common
*common
)
670 /* Wait until a signal arrives or we are woken up */
672 if (common
->thread_wakeup_needed
)
686 /* Check cable connection */
687 if (!g_dnl_board_usb_cable_connected())
693 usb_gadget_handle_interrupts(0);
695 common
->thread_wakeup_needed
= 0;
699 /*-------------------------------------------------------------------------*/
701 static int do_read(struct fsg_common
*common
)
703 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
705 struct fsg_buffhd
*bh
;
710 unsigned int partial_page
;
713 /* Get the starting Logical Block Address and check that it's
715 if (common
->cmnd
[0] == SC_READ_6
)
716 lba
= get_unaligned_be24(&common
->cmnd
[1]);
718 lba
= get_unaligned_be32(&common
->cmnd
[2]);
720 /* We allow DPO (Disable Page Out = don't save data in the
721 * cache) and FUA (Force Unit Access = don't read from the
722 * cache), but we don't implement them. */
723 if ((common
->cmnd
[1] & ~0x18) != 0) {
724 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
728 if (lba
>= curlun
->num_sectors
) {
729 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
732 file_offset
= ((loff_t
) lba
) << 9;
734 /* Carry out the file reads */
735 amount_left
= common
->data_size_from_cmnd
;
736 if (unlikely(amount_left
== 0))
737 return -EIO
; /* No default reply */
741 /* Figure out how much we need to read:
742 * Try to read the remaining amount.
743 * But don't read more than the buffer size.
744 * And don't try to read past the end of the file.
745 * Finally, if we're not at a page boundary, don't read past
747 * If this means reading 0 then we were asked to read past
748 * the end of file. */
749 amount
= min(amount_left
, FSG_BUFLEN
);
750 partial_page
= file_offset
& (PAGE_CACHE_SIZE
- 1);
751 if (partial_page
> 0)
752 amount
= min(amount
, (unsigned int) PAGE_CACHE_SIZE
-
755 /* Wait for the next buffer to become available */
756 bh
= common
->next_buffhd_to_fill
;
757 while (bh
->state
!= BUF_STATE_EMPTY
) {
758 rc
= sleep_thread(common
);
763 /* If we were asked to read past the end of file,
764 * end with an empty buffer. */
767 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
768 curlun
->info_valid
= 1;
769 bh
->inreq
->length
= 0;
770 bh
->state
= BUF_STATE_FULL
;
774 /* Perform the read */
775 rc
= ums
->read_sector(ums
,
776 file_offset
/ SECTOR_SIZE
,
777 amount
/ SECTOR_SIZE
,
778 (char __user
*)bh
->buf
);
782 nread
= rc
* SECTOR_SIZE
;
784 VLDBG(curlun
, "file read %u @ %llu -> %d\n", amount
,
785 (unsigned long long) file_offset
,
789 LDBG(curlun
, "error in file read: %d\n",
792 } else if (nread
< amount
) {
793 LDBG(curlun
, "partial file read: %d/%u\n",
794 (int) nread
, amount
);
795 nread
-= (nread
& 511); /* Round down to a block */
797 file_offset
+= nread
;
798 amount_left
-= nread
;
799 common
->residue
-= nread
;
800 bh
->inreq
->length
= nread
;
801 bh
->state
= BUF_STATE_FULL
;
803 /* If an error occurred, report it and its position */
804 if (nread
< amount
) {
805 curlun
->sense_data
= SS_UNRECOVERED_READ_ERROR
;
806 curlun
->info_valid
= 1;
810 if (amount_left
== 0)
811 break; /* No more left to read */
813 /* Send this buffer and go read some more */
815 START_TRANSFER_OR(common
, bulk_in
, bh
->inreq
,
816 &bh
->inreq_busy
, &bh
->state
)
817 /* Don't know what to do if
818 * common->fsg is NULL */
820 common
->next_buffhd_to_fill
= bh
->next
;
823 return -EIO
; /* No default reply */
826 /*-------------------------------------------------------------------------*/
828 static int do_write(struct fsg_common
*common
)
830 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
832 struct fsg_buffhd
*bh
;
834 u32 amount_left_to_req
, amount_left_to_write
;
835 loff_t usb_offset
, file_offset
;
837 unsigned int partial_page
;
842 curlun
->sense_data
= SS_WRITE_PROTECTED
;
846 /* Get the starting Logical Block Address and check that it's
848 if (common
->cmnd
[0] == SC_WRITE_6
)
849 lba
= get_unaligned_be24(&common
->cmnd
[1]);
851 lba
= get_unaligned_be32(&common
->cmnd
[2]);
853 /* We allow DPO (Disable Page Out = don't save data in the
854 * cache) and FUA (Force Unit Access = write directly to the
855 * medium). We don't implement DPO; we implement FUA by
856 * performing synchronous output. */
857 if (common
->cmnd
[1] & ~0x18) {
858 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
862 if (lba
>= curlun
->num_sectors
) {
863 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
867 /* Carry out the file writes */
869 file_offset
= usb_offset
= ((loff_t
) lba
) << 9;
870 amount_left_to_req
= common
->data_size_from_cmnd
;
871 amount_left_to_write
= common
->data_size_from_cmnd
;
873 while (amount_left_to_write
> 0) {
875 /* Queue a request for more data from the host */
876 bh
= common
->next_buffhd_to_fill
;
877 if (bh
->state
== BUF_STATE_EMPTY
&& get_some_more
) {
879 /* Figure out how much we want to get:
880 * Try to get the remaining amount.
881 * But don't get more than the buffer size.
882 * And don't try to go past the end of the file.
883 * If we're not at a page boundary,
884 * don't go past the next page.
885 * If this means getting 0, then we were asked
886 * to write past the end of file.
887 * Finally, round down to a block boundary. */
888 amount
= min(amount_left_to_req
, FSG_BUFLEN
);
889 partial_page
= usb_offset
& (PAGE_CACHE_SIZE
- 1);
890 if (partial_page
> 0)
892 (unsigned int) PAGE_CACHE_SIZE
- partial_page
);
897 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
898 curlun
->info_valid
= 1;
901 amount
-= (amount
& 511);
904 /* Why were we were asked to transfer a
910 /* Get the next buffer */
911 usb_offset
+= amount
;
912 common
->usb_amount_left
-= amount
;
913 amount_left_to_req
-= amount
;
914 if (amount_left_to_req
== 0)
917 /* amount is always divisible by 512, hence by
918 * the bulk-out maxpacket size */
919 bh
->outreq
->length
= amount
;
920 bh
->bulk_out_intended_length
= amount
;
921 bh
->outreq
->short_not_ok
= 1;
922 START_TRANSFER_OR(common
, bulk_out
, bh
->outreq
,
923 &bh
->outreq_busy
, &bh
->state
)
924 /* Don't know what to do if
925 * common->fsg is NULL */
927 common
->next_buffhd_to_fill
= bh
->next
;
931 /* Write the received data to the backing file */
932 bh
= common
->next_buffhd_to_drain
;
933 if (bh
->state
== BUF_STATE_EMPTY
&& !get_some_more
)
934 break; /* We stopped early */
935 if (bh
->state
== BUF_STATE_FULL
) {
936 common
->next_buffhd_to_drain
= bh
->next
;
937 bh
->state
= BUF_STATE_EMPTY
;
939 /* Did something go wrong with the transfer? */
940 if (bh
->outreq
->status
!= 0) {
941 curlun
->sense_data
= SS_COMMUNICATION_FAILURE
;
942 curlun
->info_valid
= 1;
946 amount
= bh
->outreq
->actual
;
948 /* Perform the write */
949 rc
= ums
->write_sector(ums
,
950 file_offset
/ SECTOR_SIZE
,
951 amount
/ SECTOR_SIZE
,
952 (char __user
*)bh
->buf
);
955 nwritten
= rc
* SECTOR_SIZE
;
957 VLDBG(curlun
, "file write %u @ %llu -> %d\n", amount
,
958 (unsigned long long) file_offset
,
962 LDBG(curlun
, "error in file write: %d\n",
965 } else if (nwritten
< amount
) {
966 LDBG(curlun
, "partial file write: %d/%u\n",
967 (int) nwritten
, amount
);
968 nwritten
-= (nwritten
& 511);
969 /* Round down to a block */
971 file_offset
+= nwritten
;
972 amount_left_to_write
-= nwritten
;
973 common
->residue
-= nwritten
;
975 /* If an error occurred, report it and its position */
976 if (nwritten
< amount
) {
977 printf("nwritten:%zd amount:%u\n", nwritten
,
979 curlun
->sense_data
= SS_WRITE_ERROR
;
980 curlun
->info_valid
= 1;
984 /* Did the host decide to stop early? */
985 if (bh
->outreq
->actual
!= bh
->outreq
->length
) {
986 common
->short_packet_received
= 1;
992 /* Wait for something to happen */
993 rc
= sleep_thread(common
);
998 return -EIO
; /* No default reply */
1001 /*-------------------------------------------------------------------------*/
1003 static int do_synchronize_cache(struct fsg_common
*common
)
1008 /*-------------------------------------------------------------------------*/
1010 static int do_verify(struct fsg_common
*common
)
1012 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1014 u32 verification_length
;
1015 struct fsg_buffhd
*bh
= common
->next_buffhd_to_fill
;
1018 unsigned int amount
;
1022 /* Get the starting Logical Block Address and check that it's
1024 lba
= get_unaligned_be32(&common
->cmnd
[2]);
1025 if (lba
>= curlun
->num_sectors
) {
1026 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1030 /* We allow DPO (Disable Page Out = don't save data in the
1031 * cache) but we don't implement it. */
1032 if (common
->cmnd
[1] & ~0x10) {
1033 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1037 verification_length
= get_unaligned_be16(&common
->cmnd
[7]);
1038 if (unlikely(verification_length
== 0))
1039 return -EIO
; /* No default reply */
1041 /* Prepare to carry out the file verify */
1042 amount_left
= verification_length
<< 9;
1043 file_offset
= ((loff_t
) lba
) << 9;
1045 /* Write out all the dirty buffers before invalidating them */
1047 /* Just try to read the requested blocks */
1048 while (amount_left
> 0) {
1050 /* Figure out how much we need to read:
1051 * Try to read the remaining amount, but not more than
1053 * And don't try to read past the end of the file.
1054 * If this means reading 0 then we were asked to read
1055 * past the end of file. */
1056 amount
= min(amount_left
, FSG_BUFLEN
);
1058 curlun
->sense_data
=
1059 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1060 curlun
->info_valid
= 1;
1064 /* Perform the read */
1065 rc
= ums
->read_sector(ums
,
1066 file_offset
/ SECTOR_SIZE
,
1067 amount
/ SECTOR_SIZE
,
1068 (char __user
*)bh
->buf
);
1071 nread
= rc
* SECTOR_SIZE
;
1073 VLDBG(curlun
, "file read %u @ %llu -> %d\n", amount
,
1074 (unsigned long long) file_offset
,
1077 LDBG(curlun
, "error in file verify: %d\n",
1080 } else if (nread
< amount
) {
1081 LDBG(curlun
, "partial file verify: %d/%u\n",
1082 (int) nread
, amount
);
1083 nread
-= (nread
& 511); /* Round down to a sector */
1086 curlun
->sense_data
= SS_UNRECOVERED_READ_ERROR
;
1087 curlun
->info_valid
= 1;
1090 file_offset
+= nread
;
1091 amount_left
-= nread
;
1096 /*-------------------------------------------------------------------------*/
1098 static int do_inquiry(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1100 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1101 static const char vendor_id
[] = "Linux ";
1102 u8
*buf
= (u8
*) bh
->buf
;
1104 if (!curlun
) { /* Unsupported LUNs are okay */
1105 common
->bad_lun_okay
= 1;
1107 buf
[0] = 0x7f; /* Unsupported, no device-type */
1108 buf
[4] = 31; /* Additional length */
1114 buf
[1] = curlun
->removable
? 0x80 : 0;
1115 buf
[2] = 2; /* ANSI SCSI level 2 */
1116 buf
[3] = 2; /* SCSI-2 INQUIRY data format */
1117 buf
[4] = 31; /* Additional length */
1118 /* No special options */
1119 sprintf((char *) (buf
+ 8), "%-8s%-16s%04x", (char*) vendor_id
,
1120 ums
->name
, (u16
) 0xffff);
1126 static int do_request_sense(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1128 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1129 u8
*buf
= (u8
*) bh
->buf
;
1134 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1136 * If a REQUEST SENSE command is received from an initiator
1137 * with a pending unit attention condition (before the target
1138 * generates the contingent allegiance condition), then the
1139 * target shall either:
1140 * a) report any pending sense data and preserve the unit
1141 * attention condition on the logical unit, or,
1142 * b) report the unit attention condition, may discard any
1143 * pending sense data, and clear the unit attention
1144 * condition on the logical unit for that initiator.
1146 * FSG normally uses option a); enable this code to use option b).
1149 if (curlun
&& curlun
->unit_attention_data
!= SS_NO_SENSE
) {
1150 curlun
->sense_data
= curlun
->unit_attention_data
;
1151 curlun
->unit_attention_data
= SS_NO_SENSE
;
1155 if (!curlun
) { /* Unsupported LUNs are okay */
1156 common
->bad_lun_okay
= 1;
1157 sd
= SS_LOGICAL_UNIT_NOT_SUPPORTED
;
1161 sd
= curlun
->sense_data
;
1162 valid
= curlun
->info_valid
<< 7;
1163 curlun
->sense_data
= SS_NO_SENSE
;
1164 curlun
->info_valid
= 0;
1168 buf
[0] = valid
| 0x70; /* Valid, current error */
1170 put_unaligned_be32(sdinfo
, &buf
[3]); /* Sense information */
1171 buf
[7] = 18 - 8; /* Additional sense length */
1177 static int do_read_capacity(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1179 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1180 u32 lba
= get_unaligned_be32(&common
->cmnd
[2]);
1181 int pmi
= common
->cmnd
[8];
1182 u8
*buf
= (u8
*) bh
->buf
;
1184 /* Check the PMI and LBA fields */
1185 if (pmi
> 1 || (pmi
== 0 && lba
!= 0)) {
1186 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1190 put_unaligned_be32(curlun
->num_sectors
- 1, &buf
[0]);
1191 /* Max logical block */
1192 put_unaligned_be32(512, &buf
[4]); /* Block length */
1196 static int do_read_header(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1198 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1199 int msf
= common
->cmnd
[1] & 0x02;
1200 u32 lba
= get_unaligned_be32(&common
->cmnd
[2]);
1201 u8
*buf
= (u8
*) bh
->buf
;
1203 if (common
->cmnd
[1] & ~0x02) { /* Mask away MSF */
1204 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1207 if (lba
>= curlun
->num_sectors
) {
1208 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1213 buf
[0] = 0x01; /* 2048 bytes of user data, rest is EC */
1214 store_cdrom_address(&buf
[4], msf
, lba
);
1219 static int do_read_toc(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1221 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1222 int msf
= common
->cmnd
[1] & 0x02;
1223 int start_track
= common
->cmnd
[6];
1224 u8
*buf
= (u8
*) bh
->buf
;
1226 if ((common
->cmnd
[1] & ~0x02) != 0 || /* Mask away MSF */
1228 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1233 buf
[1] = (20-2); /* TOC data length */
1234 buf
[2] = 1; /* First track number */
1235 buf
[3] = 1; /* Last track number */
1236 buf
[5] = 0x16; /* Data track, copying allowed */
1237 buf
[6] = 0x01; /* Only track is number 1 */
1238 store_cdrom_address(&buf
[8], msf
, 0);
1240 buf
[13] = 0x16; /* Lead-out track is data */
1241 buf
[14] = 0xAA; /* Lead-out track number */
1242 store_cdrom_address(&buf
[16], msf
, curlun
->num_sectors
);
1247 static int do_mode_sense(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1249 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1250 int mscmnd
= common
->cmnd
[0];
1251 u8
*buf
= (u8
*) bh
->buf
;
1254 int changeable_values
, all_pages
;
1258 if ((common
->cmnd
[1] & ~0x08) != 0) { /* Mask away DBD */
1259 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1262 pc
= common
->cmnd
[2] >> 6;
1263 page_code
= common
->cmnd
[2] & 0x3f;
1265 curlun
->sense_data
= SS_SAVING_PARAMETERS_NOT_SUPPORTED
;
1268 changeable_values
= (pc
== 1);
1269 all_pages
= (page_code
== 0x3f);
1271 /* Write the mode parameter header. Fixed values are: default
1272 * medium type, no cache control (DPOFUA), and no block descriptors.
1273 * The only variable value is the WriteProtect bit. We will fill in
1274 * the mode data length later. */
1276 if (mscmnd
== SC_MODE_SENSE_6
) {
1277 buf
[2] = (curlun
->ro
? 0x80 : 0x00); /* WP, DPOFUA */
1280 } else { /* SC_MODE_SENSE_10 */
1281 buf
[3] = (curlun
->ro
? 0x80 : 0x00); /* WP, DPOFUA */
1283 limit
= 65535; /* Should really be FSG_BUFLEN */
1286 /* No block descriptors */
1288 /* The mode pages, in numerical order. The only page we support
1289 * is the Caching page. */
1290 if (page_code
== 0x08 || all_pages
) {
1292 buf
[0] = 0x08; /* Page code */
1293 buf
[1] = 10; /* Page length */
1294 memset(buf
+2, 0, 10); /* None of the fields are changeable */
1296 if (!changeable_values
) {
1297 buf
[2] = 0x04; /* Write cache enable, */
1298 /* Read cache not disabled */
1299 /* No cache retention priorities */
1300 put_unaligned_be16(0xffff, &buf
[4]);
1301 /* Don't disable prefetch */
1302 /* Minimum prefetch = 0 */
1303 put_unaligned_be16(0xffff, &buf
[8]);
1304 /* Maximum prefetch */
1305 put_unaligned_be16(0xffff, &buf
[10]);
1306 /* Maximum prefetch ceiling */
1311 /* Check that a valid page was requested and the mode data length
1312 * isn't too long. */
1314 if (!valid_page
|| len
> limit
) {
1315 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1319 /* Store the mode data length */
1320 if (mscmnd
== SC_MODE_SENSE_6
)
1323 put_unaligned_be16(len
- 2, buf0
);
1328 static int do_start_stop(struct fsg_common
*common
)
1330 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1334 } else if (!curlun
->removable
) {
1335 curlun
->sense_data
= SS_INVALID_COMMAND
;
1342 static int do_prevent_allow(struct fsg_common
*common
)
1344 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1347 if (!curlun
->removable
) {
1348 curlun
->sense_data
= SS_INVALID_COMMAND
;
1352 prevent
= common
->cmnd
[4] & 0x01;
1353 if ((common
->cmnd
[4] & ~0x01) != 0) { /* Mask away Prevent */
1354 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1358 if (curlun
->prevent_medium_removal
&& !prevent
)
1359 fsg_lun_fsync_sub(curlun
);
1360 curlun
->prevent_medium_removal
= prevent
;
1365 static int do_read_format_capacities(struct fsg_common
*common
,
1366 struct fsg_buffhd
*bh
)
1368 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1369 u8
*buf
= (u8
*) bh
->buf
;
1371 buf
[0] = buf
[1] = buf
[2] = 0;
1372 buf
[3] = 8; /* Only the Current/Maximum Capacity Descriptor */
1375 put_unaligned_be32(curlun
->num_sectors
, &buf
[0]);
1376 /* Number of blocks */
1377 put_unaligned_be32(512, &buf
[4]); /* Block length */
1378 buf
[4] = 0x02; /* Current capacity */
1383 static int do_mode_select(struct fsg_common
*common
, struct fsg_buffhd
*bh
)
1385 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1387 /* We don't support MODE SELECT */
1389 curlun
->sense_data
= SS_INVALID_COMMAND
;
1394 /*-------------------------------------------------------------------------*/
1396 static int halt_bulk_in_endpoint(struct fsg_dev
*fsg
)
1400 rc
= fsg_set_halt(fsg
, fsg
->bulk_in
);
1402 VDBG(fsg
, "delayed bulk-in endpoint halt\n");
1404 if (rc
!= -EAGAIN
) {
1405 WARNING(fsg
, "usb_ep_set_halt -> %d\n", rc
);
1410 rc
= usb_ep_set_halt(fsg
->bulk_in
);
1415 static int wedge_bulk_in_endpoint(struct fsg_dev
*fsg
)
1419 DBG(fsg
, "bulk-in set wedge\n");
1420 rc
= 0; /* usb_ep_set_wedge(fsg->bulk_in); */
1422 VDBG(fsg
, "delayed bulk-in endpoint wedge\n");
1424 if (rc
!= -EAGAIN
) {
1425 WARNING(fsg
, "usb_ep_set_wedge -> %d\n", rc
);
1433 static int pad_with_zeros(struct fsg_dev
*fsg
)
1435 struct fsg_buffhd
*bh
= fsg
->common
->next_buffhd_to_fill
;
1436 u32 nkeep
= bh
->inreq
->length
;
1440 bh
->state
= BUF_STATE_EMPTY
; /* For the first iteration */
1441 fsg
->common
->usb_amount_left
= nkeep
+ fsg
->common
->residue
;
1442 while (fsg
->common
->usb_amount_left
> 0) {
1444 /* Wait for the next buffer to be free */
1445 while (bh
->state
!= BUF_STATE_EMPTY
) {
1446 rc
= sleep_thread(fsg
->common
);
1451 nsend
= min(fsg
->common
->usb_amount_left
, FSG_BUFLEN
);
1452 memset(bh
->buf
+ nkeep
, 0, nsend
- nkeep
);
1453 bh
->inreq
->length
= nsend
;
1454 bh
->inreq
->zero
= 0;
1455 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
1456 &bh
->inreq_busy
, &bh
->state
);
1457 bh
= fsg
->common
->next_buffhd_to_fill
= bh
->next
;
1458 fsg
->common
->usb_amount_left
-= nsend
;
1464 static int throw_away_data(struct fsg_common
*common
)
1466 struct fsg_buffhd
*bh
;
1470 for (bh
= common
->next_buffhd_to_drain
;
1471 bh
->state
!= BUF_STATE_EMPTY
|| common
->usb_amount_left
> 0;
1472 bh
= common
->next_buffhd_to_drain
) {
1474 /* Throw away the data in a filled buffer */
1475 if (bh
->state
== BUF_STATE_FULL
) {
1476 bh
->state
= BUF_STATE_EMPTY
;
1477 common
->next_buffhd_to_drain
= bh
->next
;
1479 /* A short packet or an error ends everything */
1480 if (bh
->outreq
->actual
!= bh
->outreq
->length
||
1481 bh
->outreq
->status
!= 0) {
1482 raise_exception(common
,
1483 FSG_STATE_ABORT_BULK_OUT
);
1489 /* Try to submit another request if we need one */
1490 bh
= common
->next_buffhd_to_fill
;
1491 if (bh
->state
== BUF_STATE_EMPTY
1492 && common
->usb_amount_left
> 0) {
1493 amount
= min(common
->usb_amount_left
, FSG_BUFLEN
);
1495 /* amount is always divisible by 512, hence by
1496 * the bulk-out maxpacket size */
1497 bh
->outreq
->length
= amount
;
1498 bh
->bulk_out_intended_length
= amount
;
1499 bh
->outreq
->short_not_ok
= 1;
1500 START_TRANSFER_OR(common
, bulk_out
, bh
->outreq
,
1501 &bh
->outreq_busy
, &bh
->state
)
1502 /* Don't know what to do if
1503 * common->fsg is NULL */
1505 common
->next_buffhd_to_fill
= bh
->next
;
1506 common
->usb_amount_left
-= amount
;
1510 /* Otherwise wait for something to happen */
1511 rc
= sleep_thread(common
);
1519 static int finish_reply(struct fsg_common
*common
)
1521 struct fsg_buffhd
*bh
= common
->next_buffhd_to_fill
;
1524 switch (common
->data_dir
) {
1526 break; /* Nothing to send */
1528 /* If we don't know whether the host wants to read or write,
1529 * this must be CB or CBI with an unknown command. We mustn't
1530 * try to send or receive any data. So stall both bulk pipes
1531 * if we can and wait for a reset. */
1532 case DATA_DIR_UNKNOWN
:
1533 if (!common
->can_stall
) {
1535 } else if (fsg_is_set(common
)) {
1536 fsg_set_halt(common
->fsg
, common
->fsg
->bulk_out
);
1537 rc
= halt_bulk_in_endpoint(common
->fsg
);
1539 /* Don't know what to do if common->fsg is NULL */
1544 /* All but the last buffer of data must have already been sent */
1545 case DATA_DIR_TO_HOST
:
1546 if (common
->data_size
== 0) {
1547 /* Nothing to send */
1549 /* If there's no residue, simply send the last buffer */
1550 } else if (common
->residue
== 0) {
1551 bh
->inreq
->zero
= 0;
1552 START_TRANSFER_OR(common
, bulk_in
, bh
->inreq
,
1553 &bh
->inreq_busy
, &bh
->state
)
1555 common
->next_buffhd_to_fill
= bh
->next
;
1557 /* For Bulk-only, if we're allowed to stall then send the
1558 * short packet and halt the bulk-in endpoint. If we can't
1559 * stall, pad out the remaining data with 0's. */
1560 } else if (common
->can_stall
) {
1561 bh
->inreq
->zero
= 1;
1562 START_TRANSFER_OR(common
, bulk_in
, bh
->inreq
,
1563 &bh
->inreq_busy
, &bh
->state
)
1564 /* Don't know what to do if
1565 * common->fsg is NULL */
1567 common
->next_buffhd_to_fill
= bh
->next
;
1569 rc
= halt_bulk_in_endpoint(common
->fsg
);
1570 } else if (fsg_is_set(common
)) {
1571 rc
= pad_with_zeros(common
->fsg
);
1573 /* Don't know what to do if common->fsg is NULL */
1578 /* We have processed all we want from the data the host has sent.
1579 * There may still be outstanding bulk-out requests. */
1580 case DATA_DIR_FROM_HOST
:
1581 if (common
->residue
== 0) {
1582 /* Nothing to receive */
1584 /* Did the host stop sending unexpectedly early? */
1585 } else if (common
->short_packet_received
) {
1586 raise_exception(common
, FSG_STATE_ABORT_BULK_OUT
);
1589 /* We haven't processed all the incoming data. Even though
1590 * we may be allowed to stall, doing so would cause a race.
1591 * The controller may already have ACK'ed all the remaining
1592 * bulk-out packets, in which case the host wouldn't see a
1593 * STALL. Not realizing the endpoint was halted, it wouldn't
1594 * clear the halt -- leading to problems later on. */
1596 } else if (common
->can_stall
) {
1597 if (fsg_is_set(common
))
1598 fsg_set_halt(common
->fsg
,
1599 common
->fsg
->bulk_out
);
1600 raise_exception(common
, FSG_STATE_ABORT_BULK_OUT
);
1604 /* We can't stall. Read in the excess data and throw it
1607 rc
= throw_away_data(common
);
1615 static int send_status(struct fsg_common
*common
)
1617 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1618 struct fsg_buffhd
*bh
;
1619 struct bulk_cs_wrap
*csw
;
1621 u8 status
= USB_STATUS_PASS
;
1624 /* Wait for the next buffer to become available */
1625 bh
= common
->next_buffhd_to_fill
;
1626 while (bh
->state
!= BUF_STATE_EMPTY
) {
1627 rc
= sleep_thread(common
);
1633 sd
= curlun
->sense_data
;
1634 else if (common
->bad_lun_okay
)
1637 sd
= SS_LOGICAL_UNIT_NOT_SUPPORTED
;
1639 if (common
->phase_error
) {
1640 DBG(common
, "sending phase-error status\n");
1641 status
= USB_STATUS_PHASE_ERROR
;
1642 sd
= SS_INVALID_COMMAND
;
1643 } else if (sd
!= SS_NO_SENSE
) {
1644 DBG(common
, "sending command-failure status\n");
1645 status
= USB_STATUS_FAIL
;
1646 VDBG(common
, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
1648 SK(sd
), ASC(sd
), ASCQ(sd
), sdinfo
);
1651 /* Store and send the Bulk-only CSW */
1652 csw
= (void *)bh
->buf
;
1654 csw
->Signature
= cpu_to_le32(USB_BULK_CS_SIG
);
1655 csw
->Tag
= common
->tag
;
1656 csw
->Residue
= cpu_to_le32(common
->residue
);
1657 csw
->Status
= status
;
1659 bh
->inreq
->length
= USB_BULK_CS_WRAP_LEN
;
1660 bh
->inreq
->zero
= 0;
1661 START_TRANSFER_OR(common
, bulk_in
, bh
->inreq
,
1662 &bh
->inreq_busy
, &bh
->state
)
1663 /* Don't know what to do if common->fsg is NULL */
1666 common
->next_buffhd_to_fill
= bh
->next
;
1671 /*-------------------------------------------------------------------------*/
1673 /* Check whether the command is properly formed and whether its data size
1674 * and direction agree with the values we already have. */
1675 static int check_command(struct fsg_common
*common
, int cmnd_size
,
1676 enum data_direction data_dir
, unsigned int mask
,
1677 int needs_medium
, const char *name
)
1680 int lun
= common
->cmnd
[1] >> 5;
1681 static const char dirletter
[4] = {'u', 'o', 'i', 'n'};
1683 struct fsg_lun
*curlun
;
1686 if (common
->data_dir
!= DATA_DIR_UNKNOWN
)
1687 sprintf(hdlen
, ", H%c=%u", dirletter
[(int) common
->data_dir
],
1689 VDBG(common
, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
1690 name
, cmnd_size
, dirletter
[(int) data_dir
],
1691 common
->data_size_from_cmnd
, common
->cmnd_size
, hdlen
);
1693 /* We can't reply at all until we know the correct data direction
1695 if (common
->data_size_from_cmnd
== 0)
1696 data_dir
= DATA_DIR_NONE
;
1697 if (common
->data_size
< common
->data_size_from_cmnd
) {
1698 /* Host data size < Device data size is a phase error.
1699 * Carry out the command, but only transfer as much as
1700 * we are allowed. */
1701 common
->data_size_from_cmnd
= common
->data_size
;
1702 common
->phase_error
= 1;
1704 common
->residue
= common
->data_size
;
1705 common
->usb_amount_left
= common
->data_size
;
1707 /* Conflicting data directions is a phase error */
1708 if (common
->data_dir
!= data_dir
1709 && common
->data_size_from_cmnd
> 0) {
1710 common
->phase_error
= 1;
1714 /* Verify the length of the command itself */
1715 if (cmnd_size
!= common
->cmnd_size
) {
1717 /* Special case workaround: There are plenty of buggy SCSI
1718 * implementations. Many have issues with cbw->Length
1719 * field passing a wrong command size. For those cases we
1720 * always try to work around the problem by using the length
1721 * sent by the host side provided it is at least as large
1722 * as the correct command length.
1723 * Examples of such cases would be MS-Windows, which issues
1724 * REQUEST SENSE with cbw->Length == 12 where it should
1725 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
1726 * REQUEST SENSE with cbw->Length == 10 where it should
1729 if (cmnd_size
<= common
->cmnd_size
) {
1730 DBG(common
, "%s is buggy! Expected length %d "
1731 "but we got %d\n", name
,
1732 cmnd_size
, common
->cmnd_size
);
1733 cmnd_size
= common
->cmnd_size
;
1735 common
->phase_error
= 1;
1740 /* Check that the LUN values are consistent */
1741 if (common
->lun
!= lun
)
1742 DBG(common
, "using LUN %d from CBW, not LUN %d from CDB\n",
1746 if (common
->lun
>= 0 && common
->lun
< common
->nluns
) {
1747 curlun
= &common
->luns
[common
->lun
];
1748 if (common
->cmnd
[0] != SC_REQUEST_SENSE
) {
1749 curlun
->sense_data
= SS_NO_SENSE
;
1750 curlun
->info_valid
= 0;
1754 common
->bad_lun_okay
= 0;
1756 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
1757 * to use unsupported LUNs; all others may not. */
1758 if (common
->cmnd
[0] != SC_INQUIRY
&&
1759 common
->cmnd
[0] != SC_REQUEST_SENSE
) {
1760 DBG(common
, "unsupported LUN %d\n", common
->lun
);
1765 /* If a unit attention condition exists, only INQUIRY and
1766 * REQUEST SENSE commands are allowed; anything else must fail. */
1767 if (curlun
&& curlun
->unit_attention_data
!= SS_NO_SENSE
&&
1768 common
->cmnd
[0] != SC_INQUIRY
&&
1769 common
->cmnd
[0] != SC_REQUEST_SENSE
) {
1770 curlun
->sense_data
= curlun
->unit_attention_data
;
1771 curlun
->unit_attention_data
= SS_NO_SENSE
;
1775 /* Check that only command bytes listed in the mask are non-zero */
1776 common
->cmnd
[1] &= 0x1f; /* Mask away the LUN */
1777 for (i
= 1; i
< cmnd_size
; ++i
) {
1778 if (common
->cmnd
[i
] && !(mask
& (1 << i
))) {
1780 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1789 static int do_scsi_command(struct fsg_common
*common
)
1791 struct fsg_buffhd
*bh
;
1793 int reply
= -EINVAL
;
1795 static char unknown
[16];
1796 struct fsg_lun
*curlun
= &common
->luns
[common
->lun
];
1800 /* Wait for the next buffer to become available for data or status */
1801 bh
= common
->next_buffhd_to_fill
;
1802 common
->next_buffhd_to_drain
= bh
;
1803 while (bh
->state
!= BUF_STATE_EMPTY
) {
1804 rc
= sleep_thread(common
);
1808 common
->phase_error
= 0;
1809 common
->short_packet_received
= 0;
1811 down_read(&common
->filesem
); /* We're using the backing file */
1812 switch (common
->cmnd
[0]) {
1815 common
->data_size_from_cmnd
= common
->cmnd
[4];
1816 reply
= check_command(common
, 6, DATA_DIR_TO_HOST
,
1820 reply
= do_inquiry(common
, bh
);
1823 case SC_MODE_SELECT_6
:
1824 common
->data_size_from_cmnd
= common
->cmnd
[4];
1825 reply
= check_command(common
, 6, DATA_DIR_FROM_HOST
,
1829 reply
= do_mode_select(common
, bh
);
1832 case SC_MODE_SELECT_10
:
1833 common
->data_size_from_cmnd
=
1834 get_unaligned_be16(&common
->cmnd
[7]);
1835 reply
= check_command(common
, 10, DATA_DIR_FROM_HOST
,
1839 reply
= do_mode_select(common
, bh
);
1842 case SC_MODE_SENSE_6
:
1843 common
->data_size_from_cmnd
= common
->cmnd
[4];
1844 reply
= check_command(common
, 6, DATA_DIR_TO_HOST
,
1845 (1<<1) | (1<<2) | (1<<4), 0,
1848 reply
= do_mode_sense(common
, bh
);
1851 case SC_MODE_SENSE_10
:
1852 common
->data_size_from_cmnd
=
1853 get_unaligned_be16(&common
->cmnd
[7]);
1854 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1855 (1<<1) | (1<<2) | (3<<7), 0,
1858 reply
= do_mode_sense(common
, bh
);
1861 case SC_PREVENT_ALLOW_MEDIUM_REMOVAL
:
1862 common
->data_size_from_cmnd
= 0;
1863 reply
= check_command(common
, 6, DATA_DIR_NONE
,
1865 "PREVENT-ALLOW MEDIUM REMOVAL");
1867 reply
= do_prevent_allow(common
);
1871 i
= common
->cmnd
[4];
1872 common
->data_size_from_cmnd
= (i
== 0 ? 256 : i
) << 9;
1873 reply
= check_command(common
, 6, DATA_DIR_TO_HOST
,
1877 reply
= do_read(common
);
1881 common
->data_size_from_cmnd
=
1882 get_unaligned_be16(&common
->cmnd
[7]) << 9;
1883 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1884 (1<<1) | (0xf<<2) | (3<<7), 1,
1887 reply
= do_read(common
);
1891 common
->data_size_from_cmnd
=
1892 get_unaligned_be32(&common
->cmnd
[6]) << 9;
1893 reply
= check_command(common
, 12, DATA_DIR_TO_HOST
,
1894 (1<<1) | (0xf<<2) | (0xf<<6), 1,
1897 reply
= do_read(common
);
1900 case SC_READ_CAPACITY
:
1901 common
->data_size_from_cmnd
= 8;
1902 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1903 (0xf<<2) | (1<<8), 1,
1906 reply
= do_read_capacity(common
, bh
);
1909 case SC_READ_HEADER
:
1910 if (!common
->luns
[common
->lun
].cdrom
)
1912 common
->data_size_from_cmnd
=
1913 get_unaligned_be16(&common
->cmnd
[7]);
1914 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1915 (3<<7) | (0x1f<<1), 1,
1918 reply
= do_read_header(common
, bh
);
1922 if (!common
->luns
[common
->lun
].cdrom
)
1924 common
->data_size_from_cmnd
=
1925 get_unaligned_be16(&common
->cmnd
[7]);
1926 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1930 reply
= do_read_toc(common
, bh
);
1933 case SC_READ_FORMAT_CAPACITIES
:
1934 common
->data_size_from_cmnd
=
1935 get_unaligned_be16(&common
->cmnd
[7]);
1936 reply
= check_command(common
, 10, DATA_DIR_TO_HOST
,
1938 "READ FORMAT CAPACITIES");
1940 reply
= do_read_format_capacities(common
, bh
);
1943 case SC_REQUEST_SENSE
:
1944 common
->data_size_from_cmnd
= common
->cmnd
[4];
1945 reply
= check_command(common
, 6, DATA_DIR_TO_HOST
,
1949 reply
= do_request_sense(common
, bh
);
1952 case SC_START_STOP_UNIT
:
1953 common
->data_size_from_cmnd
= 0;
1954 reply
= check_command(common
, 6, DATA_DIR_NONE
,
1958 reply
= do_start_stop(common
);
1961 case SC_SYNCHRONIZE_CACHE
:
1962 common
->data_size_from_cmnd
= 0;
1963 reply
= check_command(common
, 10, DATA_DIR_NONE
,
1964 (0xf<<2) | (3<<7), 1,
1965 "SYNCHRONIZE CACHE");
1967 reply
= do_synchronize_cache(common
);
1970 case SC_TEST_UNIT_READY
:
1971 common
->data_size_from_cmnd
= 0;
1972 reply
= check_command(common
, 6, DATA_DIR_NONE
,
1977 /* Although optional, this command is used by MS-Windows. We
1978 * support a minimal version: BytChk must be 0. */
1980 common
->data_size_from_cmnd
= 0;
1981 reply
= check_command(common
, 10, DATA_DIR_NONE
,
1982 (1<<1) | (0xf<<2) | (3<<7), 1,
1985 reply
= do_verify(common
);
1989 i
= common
->cmnd
[4];
1990 common
->data_size_from_cmnd
= (i
== 0 ? 256 : i
) << 9;
1991 reply
= check_command(common
, 6, DATA_DIR_FROM_HOST
,
1995 reply
= do_write(common
);
1999 common
->data_size_from_cmnd
=
2000 get_unaligned_be16(&common
->cmnd
[7]) << 9;
2001 reply
= check_command(common
, 10, DATA_DIR_FROM_HOST
,
2002 (1<<1) | (0xf<<2) | (3<<7), 1,
2005 reply
= do_write(common
);
2009 common
->data_size_from_cmnd
=
2010 get_unaligned_be32(&common
->cmnd
[6]) << 9;
2011 reply
= check_command(common
, 12, DATA_DIR_FROM_HOST
,
2012 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2015 reply
= do_write(common
);
2018 /* Some mandatory commands that we recognize but don't implement.
2019 * They don't mean much in this setting. It's left as an exercise
2020 * for anyone interested to implement RESERVE and RELEASE in terms
2021 * of Posix locks. */
2022 case SC_FORMAT_UNIT
:
2025 case SC_SEND_DIAGNOSTIC
:
2030 common
->data_size_from_cmnd
= 0;
2031 sprintf(unknown
, "Unknown x%02x", common
->cmnd
[0]);
2032 reply
= check_command(common
, common
->cmnd_size
,
2033 DATA_DIR_UNKNOWN
, 0xff, 0, unknown
);
2035 curlun
->sense_data
= SS_INVALID_COMMAND
;
2040 up_read(&common
->filesem
);
2042 if (reply
== -EINTR
)
2045 /* Set up the single reply buffer for finish_reply() */
2046 if (reply
== -EINVAL
)
2047 reply
= 0; /* Error reply length */
2048 if (reply
>= 0 && common
->data_dir
== DATA_DIR_TO_HOST
) {
2049 reply
= min((u32
) reply
, common
->data_size_from_cmnd
);
2050 bh
->inreq
->length
= reply
;
2051 bh
->state
= BUF_STATE_FULL
;
2052 common
->residue
-= reply
;
2053 } /* Otherwise it's already set */
2058 /*-------------------------------------------------------------------------*/
2060 static int received_cbw(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
2062 struct usb_request
*req
= bh
->outreq
;
2063 struct fsg_bulk_cb_wrap
*cbw
= req
->buf
;
2064 struct fsg_common
*common
= fsg
->common
;
2066 /* Was this a real packet? Should it be ignored? */
2067 if (req
->status
|| test_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
))
2070 /* Is the CBW valid? */
2071 if (req
->actual
!= USB_BULK_CB_WRAP_LEN
||
2072 cbw
->Signature
!= cpu_to_le32(
2074 DBG(fsg
, "invalid CBW: len %u sig 0x%x\n",
2076 le32_to_cpu(cbw
->Signature
));
2078 /* The Bulk-only spec says we MUST stall the IN endpoint
2079 * (6.6.1), so it's unavoidable. It also says we must
2080 * retain this state until the next reset, but there's
2081 * no way to tell the controller driver it should ignore
2082 * Clear-Feature(HALT) requests.
2084 * We aren't required to halt the OUT endpoint; instead
2085 * we can simply accept and discard any data received
2086 * until the next reset. */
2087 wedge_bulk_in_endpoint(fsg
);
2088 set_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
);
2092 /* Is the CBW meaningful? */
2093 if (cbw
->Lun
>= FSG_MAX_LUNS
|| cbw
->Flags
& ~USB_BULK_IN_FLAG
||
2094 cbw
->Length
<= 0 || cbw
->Length
> MAX_COMMAND_SIZE
) {
2095 DBG(fsg
, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2097 cbw
->Lun
, cbw
->Flags
, cbw
->Length
);
2099 /* We can do anything we want here, so let's stall the
2100 * bulk pipes if we are allowed to. */
2101 if (common
->can_stall
) {
2102 fsg_set_halt(fsg
, fsg
->bulk_out
);
2103 halt_bulk_in_endpoint(fsg
);
2108 /* Save the command for later */
2109 common
->cmnd_size
= cbw
->Length
;
2110 memcpy(common
->cmnd
, cbw
->CDB
, common
->cmnd_size
);
2111 if (cbw
->Flags
& USB_BULK_IN_FLAG
)
2112 common
->data_dir
= DATA_DIR_TO_HOST
;
2114 common
->data_dir
= DATA_DIR_FROM_HOST
;
2115 common
->data_size
= le32_to_cpu(cbw
->DataTransferLength
);
2116 if (common
->data_size
== 0)
2117 common
->data_dir
= DATA_DIR_NONE
;
2118 common
->lun
= cbw
->Lun
;
2119 common
->tag
= cbw
->Tag
;
2124 static int get_next_command(struct fsg_common
*common
)
2126 struct fsg_buffhd
*bh
;
2129 /* Wait for the next buffer to become available */
2130 bh
= common
->next_buffhd_to_fill
;
2131 while (bh
->state
!= BUF_STATE_EMPTY
) {
2132 rc
= sleep_thread(common
);
2137 /* Queue a request to read a Bulk-only CBW */
2138 set_bulk_out_req_length(common
, bh
, USB_BULK_CB_WRAP_LEN
);
2139 bh
->outreq
->short_not_ok
= 1;
2140 START_TRANSFER_OR(common
, bulk_out
, bh
->outreq
,
2141 &bh
->outreq_busy
, &bh
->state
)
2142 /* Don't know what to do if common->fsg is NULL */
2145 /* We will drain the buffer in software, which means we
2146 * can reuse it for the next filling. No need to advance
2147 * next_buffhd_to_fill. */
2149 /* Wait for the CBW to arrive */
2150 while (bh
->state
!= BUF_STATE_FULL
) {
2151 rc
= sleep_thread(common
);
2156 rc
= fsg_is_set(common
) ? received_cbw(common
->fsg
, bh
) : -EIO
;
2157 bh
->state
= BUF_STATE_EMPTY
;
2163 /*-------------------------------------------------------------------------*/
2165 static int enable_endpoint(struct fsg_common
*common
, struct usb_ep
*ep
,
2166 const struct usb_endpoint_descriptor
*d
)
2170 ep
->driver_data
= common
;
2171 rc
= usb_ep_enable(ep
, d
);
2173 ERROR(common
, "can't enable %s, result %d\n", ep
->name
, rc
);
2177 static int alloc_request(struct fsg_common
*common
, struct usb_ep
*ep
,
2178 struct usb_request
**preq
)
2180 *preq
= usb_ep_alloc_request(ep
, GFP_ATOMIC
);
2183 ERROR(common
, "can't allocate request for %s\n", ep
->name
);
2187 /* Reset interface setting and re-init endpoint state (toggle etc). */
2188 static int do_set_interface(struct fsg_common
*common
, struct fsg_dev
*new_fsg
)
2190 const struct usb_endpoint_descriptor
*d
;
2191 struct fsg_dev
*fsg
;
2194 if (common
->running
)
2195 DBG(common
, "reset interface\n");
2198 /* Deallocate the requests */
2202 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2203 struct fsg_buffhd
*bh
= &common
->buffhds
[i
];
2206 usb_ep_free_request(fsg
->bulk_in
, bh
->inreq
);
2210 usb_ep_free_request(fsg
->bulk_out
, bh
->outreq
);
2215 /* Disable the endpoints */
2216 if (fsg
->bulk_in_enabled
) {
2217 usb_ep_disable(fsg
->bulk_in
);
2218 fsg
->bulk_in_enabled
= 0;
2220 if (fsg
->bulk_out_enabled
) {
2221 usb_ep_disable(fsg
->bulk_out
);
2222 fsg
->bulk_out_enabled
= 0;
2226 /* wake_up(&common->fsg_wait); */
2229 common
->running
= 0;
2233 common
->fsg
= new_fsg
;
2236 /* Enable the endpoints */
2237 d
= fsg_ep_desc(common
->gadget
,
2238 &fsg_fs_bulk_in_desc
, &fsg_hs_bulk_in_desc
);
2239 rc
= enable_endpoint(common
, fsg
->bulk_in
, d
);
2242 fsg
->bulk_in_enabled
= 1;
2244 d
= fsg_ep_desc(common
->gadget
,
2245 &fsg_fs_bulk_out_desc
, &fsg_hs_bulk_out_desc
);
2246 rc
= enable_endpoint(common
, fsg
->bulk_out
, d
);
2249 fsg
->bulk_out_enabled
= 1;
2250 common
->bulk_out_maxpacket
=
2251 le16_to_cpu(get_unaligned(&d
->wMaxPacketSize
));
2252 clear_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
);
2254 /* Allocate the requests */
2255 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2256 struct fsg_buffhd
*bh
= &common
->buffhds
[i
];
2258 rc
= alloc_request(common
, fsg
->bulk_in
, &bh
->inreq
);
2261 rc
= alloc_request(common
, fsg
->bulk_out
, &bh
->outreq
);
2264 bh
->inreq
->buf
= bh
->outreq
->buf
= bh
->buf
;
2265 bh
->inreq
->context
= bh
->outreq
->context
= bh
;
2266 bh
->inreq
->complete
= bulk_in_complete
;
2267 bh
->outreq
->complete
= bulk_out_complete
;
2270 common
->running
= 1;
2276 /****************************** ALT CONFIGS ******************************/
2279 static int fsg_set_alt(struct usb_function
*f
, unsigned intf
, unsigned alt
)
2281 struct fsg_dev
*fsg
= fsg_from_func(f
);
2282 fsg
->common
->new_fsg
= fsg
;
2283 raise_exception(fsg
->common
, FSG_STATE_CONFIG_CHANGE
);
2287 static void fsg_disable(struct usb_function
*f
)
2289 struct fsg_dev
*fsg
= fsg_from_func(f
);
2290 fsg
->common
->new_fsg
= NULL
;
2291 raise_exception(fsg
->common
, FSG_STATE_CONFIG_CHANGE
);
2294 /*-------------------------------------------------------------------------*/
2296 static void handle_exception(struct fsg_common
*common
)
2299 struct fsg_buffhd
*bh
;
2300 enum fsg_state old_state
;
2301 struct fsg_lun
*curlun
;
2302 unsigned int exception_req_tag
;
2304 /* Cancel all the pending transfers */
2306 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2307 bh
= &common
->buffhds
[i
];
2309 usb_ep_dequeue(common
->fsg
->bulk_in
, bh
->inreq
);
2310 if (bh
->outreq_busy
)
2311 usb_ep_dequeue(common
->fsg
->bulk_out
,
2315 /* Wait until everything is idle */
2318 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2319 bh
= &common
->buffhds
[i
];
2320 num_active
+= bh
->inreq_busy
+ bh
->outreq_busy
;
2322 if (num_active
== 0)
2324 if (sleep_thread(common
))
2328 /* Clear out the controller's fifos */
2329 if (common
->fsg
->bulk_in_enabled
)
2330 usb_ep_fifo_flush(common
->fsg
->bulk_in
);
2331 if (common
->fsg
->bulk_out_enabled
)
2332 usb_ep_fifo_flush(common
->fsg
->bulk_out
);
2335 /* Reset the I/O buffer states and pointers, the SCSI
2336 * state, and the exception. Then invoke the handler. */
2338 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2339 bh
= &common
->buffhds
[i
];
2340 bh
->state
= BUF_STATE_EMPTY
;
2342 common
->next_buffhd_to_fill
= &common
->buffhds
[0];
2343 common
->next_buffhd_to_drain
= &common
->buffhds
[0];
2344 exception_req_tag
= common
->exception_req_tag
;
2345 old_state
= common
->state
;
2347 if (old_state
== FSG_STATE_ABORT_BULK_OUT
)
2348 common
->state
= FSG_STATE_STATUS_PHASE
;
2350 for (i
= 0; i
< common
->nluns
; ++i
) {
2351 curlun
= &common
->luns
[i
];
2352 curlun
->sense_data
= SS_NO_SENSE
;
2353 curlun
->info_valid
= 0;
2355 common
->state
= FSG_STATE_IDLE
;
2358 /* Carry out any extra actions required for the exception */
2359 switch (old_state
) {
2360 case FSG_STATE_ABORT_BULK_OUT
:
2361 send_status(common
);
2363 if (common
->state
== FSG_STATE_STATUS_PHASE
)
2364 common
->state
= FSG_STATE_IDLE
;
2367 case FSG_STATE_RESET
:
2368 /* In case we were forced against our will to halt a
2369 * bulk endpoint, clear the halt now. (The SuperH UDC
2370 * requires this.) */
2371 if (!fsg_is_set(common
))
2373 if (test_and_clear_bit(IGNORE_BULK_OUT
,
2374 &common
->fsg
->atomic_bitflags
))
2375 usb_ep_clear_halt(common
->fsg
->bulk_in
);
2377 if (common
->ep0_req_tag
== exception_req_tag
)
2378 ep0_queue(common
); /* Complete the status stage */
2382 case FSG_STATE_CONFIG_CHANGE
:
2383 do_set_interface(common
, common
->new_fsg
);
2386 case FSG_STATE_EXIT
:
2387 case FSG_STATE_TERMINATED
:
2388 do_set_interface(common
, NULL
); /* Free resources */
2389 common
->state
= FSG_STATE_TERMINATED
; /* Stop the thread */
2392 case FSG_STATE_INTERFACE_CHANGE
:
2393 case FSG_STATE_DISCONNECT
:
2394 case FSG_STATE_COMMAND_PHASE
:
2395 case FSG_STATE_DATA_PHASE
:
2396 case FSG_STATE_STATUS_PHASE
:
2397 case FSG_STATE_IDLE
:
2402 /*-------------------------------------------------------------------------*/
2404 int fsg_main_thread(void *common_
)
2407 struct fsg_common
*common
= the_fsg_common
;
2410 if (exception_in_progress(common
)) {
2411 handle_exception(common
);
2415 if (!common
->running
) {
2416 ret
= sleep_thread(common
);
2423 ret
= get_next_command(common
);
2427 if (!exception_in_progress(common
))
2428 common
->state
= FSG_STATE_DATA_PHASE
;
2430 if (do_scsi_command(common
) || finish_reply(common
))
2433 if (!exception_in_progress(common
))
2434 common
->state
= FSG_STATE_STATUS_PHASE
;
2436 if (send_status(common
))
2439 if (!exception_in_progress(common
))
2440 common
->state
= FSG_STATE_IDLE
;
2443 common
->thread_task
= NULL
;
2448 static void fsg_common_release(struct kref
*ref
);
2450 static struct fsg_common
*fsg_common_init(struct fsg_common
*common
,
2451 struct usb_composite_dev
*cdev
)
2453 struct usb_gadget
*gadget
= cdev
->gadget
;
2454 struct fsg_buffhd
*bh
;
2455 struct fsg_lun
*curlun
;
2458 /* Find out how many LUNs there should be */
2460 if (nluns
< 1 || nluns
> FSG_MAX_LUNS
) {
2461 printf("invalid number of LUNs: %u\n", nluns
);
2462 return ERR_PTR(-EINVAL
);
2467 common
= calloc(sizeof(*common
), 1);
2469 return ERR_PTR(-ENOMEM
);
2470 common
->free_storage_on_release
= 1;
2472 memset(common
, 0, sizeof(*common
));
2473 common
->free_storage_on_release
= 0;
2477 common
->private_data
= NULL
;
2479 common
->gadget
= gadget
;
2480 common
->ep0
= gadget
->ep0
;
2481 common
->ep0req
= cdev
->req
;
2483 /* Maybe allocate device-global string IDs, and patch descriptors */
2484 if (fsg_strings
[FSG_STRING_INTERFACE
].id
== 0) {
2485 rc
= usb_string_id(cdev
);
2486 if (unlikely(rc
< 0))
2488 fsg_strings
[FSG_STRING_INTERFACE
].id
= rc
;
2489 fsg_intf_desc
.iInterface
= rc
;
2492 /* Create the LUNs, open their backing files, and register the
2493 * LUN devices in sysfs. */
2494 curlun
= calloc(nluns
, sizeof *curlun
);
2499 common
->nluns
= nluns
;
2501 for (i
= 0; i
< nluns
; i
++) {
2502 common
->luns
[i
].removable
= 1;
2504 rc
= fsg_lun_open(&common
->luns
[i
], "");
2510 /* Data buffers cyclic list */
2511 bh
= common
->buffhds
;
2513 i
= FSG_NUM_BUFFERS
;
2514 goto buffhds_first_it
;
2520 bh
->outreq_busy
= 0;
2521 bh
->buf
= memalign(CONFIG_SYS_CACHELINE_SIZE
, FSG_BUFLEN
);
2522 if (unlikely(!bh
->buf
)) {
2527 bh
->next
= common
->buffhds
;
2529 snprintf(common
->inquiry_string
, sizeof common
->inquiry_string
,
2532 "File-Store Gadget",
2535 /* Some peripheral controllers are known not to be able to
2536 * halt bulk endpoints correctly. If one of them is present,
2540 /* Tell the thread to start working */
2541 common
->thread_task
=
2542 kthread_create(fsg_main_thread
, common
,
2543 OR(cfg
->thread_name
, "file-storage"));
2544 if (IS_ERR(common
->thread_task
)) {
2545 rc
= PTR_ERR(common
->thread_task
);
2551 INFO(common
, FSG_DRIVER_DESC
", version: " FSG_DRIVER_VERSION
"\n");
2552 INFO(common
, "Number of LUNs=%d\n", common
->nluns
);
2557 common
->nluns
= i
+ 1;
2559 common
->state
= FSG_STATE_TERMINATED
; /* The thread is dead */
2560 /* Call fsg_common_release() directly, ref might be not
2562 fsg_common_release(&common
->ref
);
2566 static void fsg_common_release(struct kref
*ref
)
2568 struct fsg_common
*common
= container_of(ref
, struct fsg_common
, ref
);
2570 /* If the thread isn't already dead, tell it to exit now */
2571 if (common
->state
!= FSG_STATE_TERMINATED
) {
2572 raise_exception(common
, FSG_STATE_EXIT
);
2573 wait_for_completion(&common
->thread_notifier
);
2576 if (likely(common
->luns
)) {
2577 struct fsg_lun
*lun
= common
->luns
;
2578 unsigned i
= common
->nluns
;
2580 /* In error recovery common->nluns may be zero. */
2581 for (; i
; --i
, ++lun
)
2584 kfree(common
->luns
);
2588 struct fsg_buffhd
*bh
= common
->buffhds
;
2589 unsigned i
= FSG_NUM_BUFFERS
;
2592 } while (++bh
, --i
);
2595 if (common
->free_storage_on_release
)
2600 /*-------------------------------------------------------------------------*/
2603 * usb_copy_descriptors - copy a vector of USB descriptors
2604 * @src: null-terminated vector to copy
2605 * Context: initialization code, which may sleep
2607 * This makes a copy of a vector of USB descriptors. Its primary use
2608 * is to support usb_function objects which can have multiple copies,
2609 * each needing different descriptors. Functions may have static
2610 * tables of descriptors, which are used as templates and customized
2611 * with identifiers (for interfaces, strings, endpoints, and more)
2612 * as needed by a given function instance.
2614 struct usb_descriptor_header
**
2615 usb_copy_descriptors(struct usb_descriptor_header
**src
)
2617 struct usb_descriptor_header
**tmp
;
2621 struct usb_descriptor_header
**ret
;
2623 /* count descriptors and their sizes; then add vector size */
2624 for (bytes
= 0, n_desc
= 0, tmp
= src
; *tmp
; tmp
++, n_desc
++)
2625 bytes
+= (*tmp
)->bLength
;
2626 bytes
+= (n_desc
+ 1) * sizeof(*tmp
);
2628 mem
= memalign(CONFIG_SYS_CACHELINE_SIZE
, bytes
);
2632 /* fill in pointers starting at "tmp",
2633 * to descriptors copied starting at "mem";
2638 mem
+= (n_desc
+ 1) * sizeof(*tmp
);
2640 memcpy(mem
, *src
, (*src
)->bLength
);
2643 mem
+= (*src
)->bLength
;
2651 static void fsg_unbind(struct usb_configuration
*c
, struct usb_function
*f
)
2653 struct fsg_dev
*fsg
= fsg_from_func(f
);
2655 DBG(fsg
, "unbind\n");
2656 if (fsg
->common
->fsg
== fsg
) {
2657 fsg
->common
->new_fsg
= NULL
;
2658 raise_exception(fsg
->common
, FSG_STATE_CONFIG_CHANGE
);
2661 free(fsg
->function
.descriptors
);
2662 free(fsg
->function
.hs_descriptors
);
2666 static int fsg_bind(struct usb_configuration
*c
, struct usb_function
*f
)
2668 struct fsg_dev
*fsg
= fsg_from_func(f
);
2669 struct usb_gadget
*gadget
= c
->cdev
->gadget
;
2672 fsg
->gadget
= gadget
;
2675 i
= usb_interface_id(c
, f
);
2678 fsg_intf_desc
.bInterfaceNumber
= i
;
2679 fsg
->interface_number
= i
;
2681 /* Find all the endpoints we will use */
2682 ep
= usb_ep_autoconfig(gadget
, &fsg_fs_bulk_in_desc
);
2685 ep
->driver_data
= fsg
->common
; /* claim the endpoint */
2688 ep
= usb_ep_autoconfig(gadget
, &fsg_fs_bulk_out_desc
);
2691 ep
->driver_data
= fsg
->common
; /* claim the endpoint */
2694 /* Copy descriptors */
2695 f
->descriptors
= usb_copy_descriptors(fsg_fs_function
);
2696 if (unlikely(!f
->descriptors
))
2699 if (gadget_is_dualspeed(gadget
)) {
2700 /* Assume endpoint addresses are the same for both speeds */
2701 fsg_hs_bulk_in_desc
.bEndpointAddress
=
2702 fsg_fs_bulk_in_desc
.bEndpointAddress
;
2703 fsg_hs_bulk_out_desc
.bEndpointAddress
=
2704 fsg_fs_bulk_out_desc
.bEndpointAddress
;
2705 f
->hs_descriptors
= usb_copy_descriptors(fsg_hs_function
);
2706 if (unlikely(!f
->hs_descriptors
)) {
2707 free(f
->descriptors
);
2714 ERROR(fsg
, "unable to autoconfigure all endpoints\n");
2719 /****************************** ADD FUNCTION ******************************/
2721 static struct usb_gadget_strings
*fsg_strings_array
[] = {
2726 static int fsg_bind_config(struct usb_composite_dev
*cdev
,
2727 struct usb_configuration
*c
,
2728 struct fsg_common
*common
)
2730 struct fsg_dev
*fsg
;
2733 fsg
= calloc(1, sizeof *fsg
);
2736 fsg
->function
.name
= FSG_DRIVER_DESC
;
2737 fsg
->function
.strings
= fsg_strings_array
;
2738 fsg
->function
.bind
= fsg_bind
;
2739 fsg
->function
.unbind
= fsg_unbind
;
2740 fsg
->function
.setup
= fsg_setup
;
2741 fsg
->function
.set_alt
= fsg_set_alt
;
2742 fsg
->function
.disable
= fsg_disable
;
2744 fsg
->common
= common
;
2746 /* Our caller holds a reference to common structure so we
2747 * don't have to be worry about it being freed until we return
2748 * from this function. So instead of incrementing counter now
2749 * and decrement in error recovery we increment it only when
2750 * call to usb_add_function() was successful. */
2752 rc
= usb_add_function(c
, &fsg
->function
);
2760 int fsg_add(struct usb_configuration
*c
)
2762 struct fsg_common
*fsg_common
;
2764 fsg_common
= fsg_common_init(NULL
, c
->cdev
);
2766 fsg_common
->vendor_name
= 0;
2767 fsg_common
->product_name
= 0;
2768 fsg_common
->release
= 0xffff;
2770 fsg_common
->ops
= NULL
;
2771 fsg_common
->private_data
= NULL
;
2773 the_fsg_common
= fsg_common
;
2775 return fsg_bind_config(c
->cdev
, c
, fsg_common
);
2778 int fsg_init(struct ums
*ums_dev
)
2785 DECLARE_GADGET_BIND_CALLBACK(usb_dnl_ums
, fsg_add
);