1 // SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause) 2 /* 3 * f_mass_storage.c -- Mass Storage USB Composite Function 4 * 5 * Copyright (C) 2003-2008 Alan Stern 6 * Copyright (C) 2009 Samsung Electronics 7 * Author: Michal Nazarewicz <mina86@mina86.com> 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions, and the following disclaimer, 15 * without modification. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. The names of the above-listed copyright holders may not be used 20 * to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * ALTERNATIVELY, this software may be distributed under the terms of the 24 * GNU General Public License ("GPL") as published by the Free Software 25 * Foundation, either version 2 of that License or (at your option) any 26 * later version. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS 29 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 30 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 31 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 32 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 33 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 34 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 35 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 36 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 37 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 38 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 */ 40 41 /* 42 * The Mass Storage Function acts as a USB Mass Storage device, 43 * appearing to the host as a disk drive or as a CD-ROM drive. In 44 * addition to providing an example of a genuinely useful composite 45 * function for a USB device, it also illustrates a technique of 46 * double-buffering for increased throughput. 47 * 48 * For more information about MSF and in particular its module 49 * parameters and sysfs interface read the 50 * <Documentation/usb/mass-storage.rst> file. 51 */ 52 53 /* 54 * MSF is configured by specifying a fsg_config structure. It has the 55 * following fields: 56 * 57 * nluns Number of LUNs function have (anywhere from 1 58 * to FSG_MAX_LUNS). 59 * luns An array of LUN configuration values. This 60 * should be filled for each LUN that 61 * function will include (ie. for "nluns" 62 * LUNs). Each element of the array has 63 * the following fields: 64 * ->filename The path to the backing file for the LUN. 65 * Required if LUN is not marked as 66 * removable. 67 * ->ro Flag specifying access to the LUN shall be 68 * read-only. This is implied if CD-ROM 69 * emulation is enabled as well as when 70 * it was impossible to open "filename" 71 * in R/W mode. 72 * ->removable Flag specifying that LUN shall be indicated as 73 * being removable. 74 * ->cdrom Flag specifying that LUN shall be reported as 75 * being a CD-ROM. 76 * ->nofua Flag specifying that FUA flag in SCSI WRITE(10,12) 77 * commands for this LUN shall be ignored. 78 * 79 * vendor_name 80 * product_name 81 * release Information used as a reply to INQUIRY 82 * request. To use default set to NULL, 83 * NULL, 0xffff respectively. The first 84 * field should be 8 and the second 16 85 * characters or less. 86 * 87 * can_stall Set to permit function to halt bulk endpoints. 88 * Disabled on some USB devices known not 89 * to work correctly. You should set it 90 * to true. 91 * 92 * If "removable" is not set for a LUN then a backing file must be 93 * specified. If it is set, then NULL filename means the LUN's medium 94 * is not loaded (an empty string as "filename" in the fsg_config 95 * structure causes error). The CD-ROM emulation includes a single 96 * data track and no audio tracks; hence there need be only one 97 * backing file per LUN. 98 * 99 * This function is heavily based on "File-backed Storage Gadget" by 100 * Alan Stern which in turn is heavily based on "Gadget Zero" by David 101 * Brownell. The driver's SCSI command interface was based on the 102 * "Information technology - Small Computer System Interface - 2" 103 * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93, 104 * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. 105 * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which 106 * was based on the "Universal Serial Bus Mass Storage Class UFI 107 * Command Specification" document, Revision 1.0, December 14, 1998, 108 * available at 109 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>. 110 */ 111 112 /* 113 * Driver Design 114 * 115 * The MSF is fairly straightforward. There is a main kernel 116 * thread that handles most of the work. Interrupt routines field 117 * callbacks from the controller driver: bulk- and interrupt-request 118 * completion notifications, endpoint-0 events, and disconnect events. 119 * Completion events are passed to the main thread by wakeup calls. Many 120 * ep0 requests are handled at interrupt time, but SetInterface, 121 * SetConfiguration, and device reset requests are forwarded to the 122 * thread in the form of "exceptions" using SIGUSR1 signals (since they 123 * should interrupt any ongoing file I/O operations). 124 * 125 * The thread's main routine implements the standard command/data/status 126 * parts of a SCSI interaction. It and its subroutines are full of tests 127 * for pending signals/exceptions -- all this polling is necessary since 128 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an 129 * indication that the driver really wants to be running in userspace.) 130 * An important point is that so long as the thread is alive it keeps an 131 * open reference to the backing file. This will prevent unmounting 132 * the backing file's underlying filesystem and could cause problems 133 * during system shutdown, for example. To prevent such problems, the 134 * thread catches INT, TERM, and KILL signals and converts them into 135 * an EXIT exception. 136 * 137 * In normal operation the main thread is started during the gadget's 138 * fsg_bind() callback and stopped during fsg_unbind(). But it can 139 * also exit when it receives a signal, and there's no point leaving 140 * the gadget running when the thread is dead. As of this moment, MSF 141 * provides no way to deregister the gadget when thread dies -- maybe 142 * a callback functions is needed. 143 * 144 * To provide maximum throughput, the driver uses a circular pipeline of 145 * buffer heads (struct fsg_buffhd). In principle the pipeline can be 146 * arbitrarily long; in practice the benefits don't justify having more 147 * than 2 stages (i.e., double buffering). But it helps to think of the 148 * pipeline as being a long one. Each buffer head contains a bulk-in and 149 * a bulk-out request pointer (since the buffer can be used for both 150 * output and input -- directions always are given from the host's 151 * point of view) as well as a pointer to the buffer and various state 152 * variables. 153 * 154 * Use of the pipeline follows a simple protocol. There is a variable 155 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use. 156 * At any time that buffer head may still be in use from an earlier 157 * request, so each buffer head has a state variable indicating whether 158 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the 159 * buffer head to be EMPTY, filling the buffer either by file I/O or by 160 * USB I/O (during which the buffer head is BUSY), and marking the buffer 161 * head FULL when the I/O is complete. Then the buffer will be emptied 162 * (again possibly by USB I/O, during which it is marked BUSY) and 163 * finally marked EMPTY again (possibly by a completion routine). 164 * 165 * A module parameter tells the driver to avoid stalling the bulk 166 * endpoints wherever the transport specification allows. This is 167 * necessary for some UDCs like the SuperH, which cannot reliably clear a 168 * halt on a bulk endpoint. However, under certain circumstances the 169 * Bulk-only specification requires a stall. In such cases the driver 170 * will halt the endpoint and set a flag indicating that it should clear 171 * the halt in software during the next device reset. Hopefully this 172 * will permit everything to work correctly. Furthermore, although the 173 * specification allows the bulk-out endpoint to halt when the host sends 174 * too much data, implementing this would cause an unavoidable race. 175 * The driver will always use the "no-stall" approach for OUT transfers. 176 * 177 * One subtle point concerns sending status-stage responses for ep0 178 * requests. Some of these requests, such as device reset, can involve 179 * interrupting an ongoing file I/O operation, which might take an 180 * arbitrarily long time. During that delay the host might give up on 181 * the original ep0 request and issue a new one. When that happens the 182 * driver should not notify the host about completion of the original 183 * request, as the host will no longer be waiting for it. So the driver 184 * assigns to each ep0 request a unique tag, and it keeps track of the 185 * tag value of the request associated with a long-running exception 186 * (device-reset, interface-change, or configuration-change). When the 187 * exception handler is finished, the status-stage response is submitted 188 * only if the current ep0 request tag is equal to the exception request 189 * tag. Thus only the most recently received ep0 request will get a 190 * status-stage response. 191 * 192 * Warning: This driver source file is too long. It ought to be split up 193 * into a header file plus about 3 separate .c files, to handle the details 194 * of the Gadget, USB Mass Storage, and SCSI protocols. 195 */ 196 197 198 /* #define VERBOSE_DEBUG */ 199 /* #define DUMP_MSGS */ 200 201 #include <linux/blkdev.h> 202 #include <linux/completion.h> 203 #include <linux/dcache.h> 204 #include <linux/delay.h> 205 #include <linux/device.h> 206 #include <linux/fcntl.h> 207 #include <linux/file.h> 208 #include <linux/fs.h> 209 #include <linux/kthread.h> 210 #include <linux/sched/signal.h> 211 #include <linux/limits.h> 212 #include <linux/rwsem.h> 213 #include <linux/slab.h> 214 #include <linux/spinlock.h> 215 #include <linux/string.h> 216 #include <linux/freezer.h> 217 #include <linux/module.h> 218 #include <linux/uaccess.h> 219 #include <asm/unaligned.h> 220 221 #include <linux/usb/ch9.h> 222 #include <linux/usb/gadget.h> 223 #include <linux/usb/composite.h> 224 225 #include <linux/nospec.h> 226 227 #include "configfs.h" 228 229 230 /*------------------------------------------------------------------------*/ 231 232 #define FSG_DRIVER_DESC "Mass Storage Function" 233 #define FSG_DRIVER_VERSION "2009/09/11" 234 235 static const char fsg_string_interface[] = "Mass Storage"; 236 237 #include "storage_common.h" 238 #include "f_mass_storage.h" 239 240 /* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */ 241 static struct usb_string fsg_strings[] = { 242 {FSG_STRING_INTERFACE, fsg_string_interface}, 243 {} 244 }; 245 246 static struct usb_gadget_strings fsg_stringtab = { 247 .language = 0x0409, /* en-us */ 248 .strings = fsg_strings, 249 }; 250 251 static struct usb_gadget_strings *fsg_strings_array[] = { 252 &fsg_stringtab, 253 NULL, 254 }; 255 256 /*-------------------------------------------------------------------------*/ 257 258 struct fsg_dev; 259 struct fsg_common; 260 261 /* Data shared by all the FSG instances. */ 262 struct fsg_common { 263 struct usb_gadget *gadget; 264 struct usb_composite_dev *cdev; 265 struct fsg_dev *fsg; 266 wait_queue_head_t io_wait; 267 wait_queue_head_t fsg_wait; 268 269 /* filesem protects: backing files in use */ 270 struct rw_semaphore filesem; 271 272 /* lock protects: state and thread_task */ 273 spinlock_t lock; 274 275 struct usb_ep *ep0; /* Copy of gadget->ep0 */ 276 struct usb_request *ep0req; /* Copy of cdev->req */ 277 unsigned int ep0_req_tag; 278 279 struct fsg_buffhd *next_buffhd_to_fill; 280 struct fsg_buffhd *next_buffhd_to_drain; 281 struct fsg_buffhd *buffhds; 282 unsigned int fsg_num_buffers; 283 284 int cmnd_size; 285 u8 cmnd[MAX_COMMAND_SIZE]; 286 287 unsigned int lun; 288 struct fsg_lun *luns[FSG_MAX_LUNS]; 289 struct fsg_lun *curlun; 290 291 unsigned int bulk_out_maxpacket; 292 enum fsg_state state; /* For exception handling */ 293 unsigned int exception_req_tag; 294 void *exception_arg; 295 296 enum data_direction data_dir; 297 u32 data_size; 298 u32 data_size_from_cmnd; 299 u32 tag; 300 u32 residue; 301 u32 usb_amount_left; 302 303 unsigned int can_stall:1; 304 unsigned int free_storage_on_release:1; 305 unsigned int phase_error:1; 306 unsigned int short_packet_received:1; 307 unsigned int bad_lun_okay:1; 308 unsigned int running:1; 309 unsigned int sysfs:1; 310 311 struct completion thread_notifier; 312 struct task_struct *thread_task; 313 314 /* Gadget's private data. */ 315 void *private_data; 316 317 char inquiry_string[INQUIRY_STRING_LEN]; 318 }; 319 320 struct fsg_dev { 321 struct usb_function function; 322 struct usb_gadget *gadget; /* Copy of cdev->gadget */ 323 struct fsg_common *common; 324 325 u16 interface_number; 326 327 unsigned int bulk_in_enabled:1; 328 unsigned int bulk_out_enabled:1; 329 330 unsigned long atomic_bitflags; 331 #define IGNORE_BULK_OUT 0 332 333 struct usb_ep *bulk_in; 334 struct usb_ep *bulk_out; 335 }; 336 337 static inline int __fsg_is_set(struct fsg_common *common, 338 const char *func, unsigned line) 339 { 340 if (common->fsg) 341 return 1; 342 ERROR(common, "common->fsg is NULL in %s at %u\n", func, line); 343 WARN_ON(1); 344 return 0; 345 } 346 347 #define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__)) 348 349 static inline struct fsg_dev *fsg_from_func(struct usb_function *f) 350 { 351 return container_of(f, struct fsg_dev, function); 352 } 353 354 typedef void (*fsg_routine_t)(struct fsg_dev *); 355 356 static int exception_in_progress(struct fsg_common *common) 357 { 358 return common->state > FSG_STATE_NORMAL; 359 } 360 361 /* Make bulk-out requests be divisible by the maxpacket size */ 362 static void set_bulk_out_req_length(struct fsg_common *common, 363 struct fsg_buffhd *bh, unsigned int length) 364 { 365 unsigned int rem; 366 367 bh->bulk_out_intended_length = length; 368 rem = length % common->bulk_out_maxpacket; 369 if (rem > 0) 370 length += common->bulk_out_maxpacket - rem; 371 bh->outreq->length = length; 372 } 373 374 375 /*-------------------------------------------------------------------------*/ 376 377 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) 378 { 379 const char *name; 380 381 if (ep == fsg->bulk_in) 382 name = "bulk-in"; 383 else if (ep == fsg->bulk_out) 384 name = "bulk-out"; 385 else 386 name = ep->name; 387 DBG(fsg, "%s set halt\n", name); 388 return usb_ep_set_halt(ep); 389 } 390 391 392 /*-------------------------------------------------------------------------*/ 393 394 /* These routines may be called in process context or in_irq */ 395 396 static void __raise_exception(struct fsg_common *common, enum fsg_state new_state, 397 void *arg) 398 { 399 unsigned long flags; 400 401 /* 402 * Do nothing if a higher-priority exception is already in progress. 403 * If a lower-or-equal priority exception is in progress, preempt it 404 * and notify the main thread by sending it a signal. 405 */ 406 spin_lock_irqsave(&common->lock, flags); 407 if (common->state <= new_state) { 408 common->exception_req_tag = common->ep0_req_tag; 409 common->state = new_state; 410 common->exception_arg = arg; 411 if (common->thread_task) 412 send_sig_info(SIGUSR1, SEND_SIG_PRIV, 413 common->thread_task); 414 } 415 spin_unlock_irqrestore(&common->lock, flags); 416 } 417 418 static void raise_exception(struct fsg_common *common, enum fsg_state new_state) 419 { 420 __raise_exception(common, new_state, NULL); 421 } 422 423 /*-------------------------------------------------------------------------*/ 424 425 static int ep0_queue(struct fsg_common *common) 426 { 427 int rc; 428 429 rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC); 430 common->ep0->driver_data = common; 431 if (rc != 0 && rc != -ESHUTDOWN) { 432 /* We can't do much more than wait for a reset */ 433 WARNING(common, "error in submission: %s --> %d\n", 434 common->ep0->name, rc); 435 } 436 return rc; 437 } 438 439 440 /*-------------------------------------------------------------------------*/ 441 442 /* Completion handlers. These always run in_irq. */ 443 444 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req) 445 { 446 struct fsg_common *common = ep->driver_data; 447 struct fsg_buffhd *bh = req->context; 448 449 if (req->status || req->actual != req->length) 450 DBG(common, "%s --> %d, %u/%u\n", __func__, 451 req->status, req->actual, req->length); 452 if (req->status == -ECONNRESET) /* Request was cancelled */ 453 usb_ep_fifo_flush(ep); 454 455 /* Synchronize with the smp_load_acquire() in sleep_thread() */ 456 smp_store_release(&bh->state, BUF_STATE_EMPTY); 457 wake_up(&common->io_wait); 458 } 459 460 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req) 461 { 462 struct fsg_common *common = ep->driver_data; 463 struct fsg_buffhd *bh = req->context; 464 465 dump_msg(common, "bulk-out", req->buf, req->actual); 466 if (req->status || req->actual != bh->bulk_out_intended_length) 467 DBG(common, "%s --> %d, %u/%u\n", __func__, 468 req->status, req->actual, bh->bulk_out_intended_length); 469 if (req->status == -ECONNRESET) /* Request was cancelled */ 470 usb_ep_fifo_flush(ep); 471 472 /* Synchronize with the smp_load_acquire() in sleep_thread() */ 473 smp_store_release(&bh->state, BUF_STATE_FULL); 474 wake_up(&common->io_wait); 475 } 476 477 static int _fsg_common_get_max_lun(struct fsg_common *common) 478 { 479 int i = ARRAY_SIZE(common->luns) - 1; 480 481 while (i >= 0 && !common->luns[i]) 482 --i; 483 484 return i; 485 } 486 487 static int fsg_setup(struct usb_function *f, 488 const struct usb_ctrlrequest *ctrl) 489 { 490 struct fsg_dev *fsg = fsg_from_func(f); 491 struct usb_request *req = fsg->common->ep0req; 492 u16 w_index = le16_to_cpu(ctrl->wIndex); 493 u16 w_value = le16_to_cpu(ctrl->wValue); 494 u16 w_length = le16_to_cpu(ctrl->wLength); 495 496 if (!fsg_is_set(fsg->common)) 497 return -EOPNOTSUPP; 498 499 ++fsg->common->ep0_req_tag; /* Record arrival of a new request */ 500 req->context = NULL; 501 req->length = 0; 502 dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl)); 503 504 switch (ctrl->bRequest) { 505 506 case US_BULK_RESET_REQUEST: 507 if (ctrl->bRequestType != 508 (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) 509 break; 510 if (w_index != fsg->interface_number || w_value != 0 || 511 w_length != 0) 512 return -EDOM; 513 514 /* 515 * Raise an exception to stop the current operation 516 * and reinitialize our state. 517 */ 518 DBG(fsg, "bulk reset request\n"); 519 raise_exception(fsg->common, FSG_STATE_PROTOCOL_RESET); 520 return USB_GADGET_DELAYED_STATUS; 521 522 case US_BULK_GET_MAX_LUN: 523 if (ctrl->bRequestType != 524 (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) 525 break; 526 if (w_index != fsg->interface_number || w_value != 0 || 527 w_length != 1) 528 return -EDOM; 529 VDBG(fsg, "get max LUN\n"); 530 *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common); 531 532 /* Respond with data/status */ 533 req->length = min((u16)1, w_length); 534 return ep0_queue(fsg->common); 535 } 536 537 VDBG(fsg, 538 "unknown class-specific control req %02x.%02x v%04x i%04x l%u\n", 539 ctrl->bRequestType, ctrl->bRequest, 540 le16_to_cpu(ctrl->wValue), w_index, w_length); 541 return -EOPNOTSUPP; 542 } 543 544 545 /*-------------------------------------------------------------------------*/ 546 547 /* All the following routines run in process context */ 548 549 /* Use this for bulk or interrupt transfers, not ep0 */ 550 static int start_transfer(struct fsg_dev *fsg, struct usb_ep *ep, 551 struct usb_request *req) 552 { 553 int rc; 554 555 if (ep == fsg->bulk_in) 556 dump_msg(fsg, "bulk-in", req->buf, req->length); 557 558 rc = usb_ep_queue(ep, req, GFP_KERNEL); 559 if (rc) { 560 561 /* We can't do much more than wait for a reset */ 562 req->status = rc; 563 564 /* 565 * Note: currently the net2280 driver fails zero-length 566 * submissions if DMA is enabled. 567 */ 568 if (rc != -ESHUTDOWN && 569 !(rc == -EOPNOTSUPP && req->length == 0)) 570 WARNING(fsg, "error in submission: %s --> %d\n", 571 ep->name, rc); 572 } 573 return rc; 574 } 575 576 static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh) 577 { 578 if (!fsg_is_set(common)) 579 return false; 580 bh->state = BUF_STATE_SENDING; 581 if (start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq)) 582 bh->state = BUF_STATE_EMPTY; 583 return true; 584 } 585 586 static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh) 587 { 588 if (!fsg_is_set(common)) 589 return false; 590 bh->state = BUF_STATE_RECEIVING; 591 if (start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq)) 592 bh->state = BUF_STATE_FULL; 593 return true; 594 } 595 596 static int sleep_thread(struct fsg_common *common, bool can_freeze, 597 struct fsg_buffhd *bh) 598 { 599 int rc; 600 601 /* Wait until a signal arrives or bh is no longer busy */ 602 if (can_freeze) 603 /* 604 * synchronize with the smp_store_release(&bh->state) in 605 * bulk_in_complete() or bulk_out_complete() 606 */ 607 rc = wait_event_freezable(common->io_wait, 608 bh && smp_load_acquire(&bh->state) >= 609 BUF_STATE_EMPTY); 610 else 611 rc = wait_event_interruptible(common->io_wait, 612 bh && smp_load_acquire(&bh->state) >= 613 BUF_STATE_EMPTY); 614 return rc ? -EINTR : 0; 615 } 616 617 618 /*-------------------------------------------------------------------------*/ 619 620 static int do_read(struct fsg_common *common) 621 { 622 struct fsg_lun *curlun = common->curlun; 623 u32 lba; 624 struct fsg_buffhd *bh; 625 int rc; 626 u32 amount_left; 627 loff_t file_offset, file_offset_tmp; 628 unsigned int amount; 629 ssize_t nread; 630 631 /* 632 * Get the starting Logical Block Address and check that it's 633 * not too big. 634 */ 635 if (common->cmnd[0] == READ_6) 636 lba = get_unaligned_be24(&common->cmnd[1]); 637 else { 638 lba = get_unaligned_be32(&common->cmnd[2]); 639 640 /* 641 * We allow DPO (Disable Page Out = don't save data in the 642 * cache) and FUA (Force Unit Access = don't read from the 643 * cache), but we don't implement them. 644 */ 645 if ((common->cmnd[1] & ~0x18) != 0) { 646 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 647 return -EINVAL; 648 } 649 } 650 if (lba >= curlun->num_sectors) { 651 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 652 return -EINVAL; 653 } 654 file_offset = ((loff_t) lba) << curlun->blkbits; 655 656 /* Carry out the file reads */ 657 amount_left = common->data_size_from_cmnd; 658 if (unlikely(amount_left == 0)) 659 return -EIO; /* No default reply */ 660 661 for (;;) { 662 /* 663 * Figure out how much we need to read: 664 * Try to read the remaining amount. 665 * But don't read more than the buffer size. 666 * And don't try to read past the end of the file. 667 */ 668 amount = min(amount_left, FSG_BUFLEN); 669 amount = min((loff_t)amount, 670 curlun->file_length - file_offset); 671 672 /* Wait for the next buffer to become available */ 673 bh = common->next_buffhd_to_fill; 674 rc = sleep_thread(common, false, bh); 675 if (rc) 676 return rc; 677 678 /* 679 * If we were asked to read past the end of file, 680 * end with an empty buffer. 681 */ 682 if (amount == 0) { 683 curlun->sense_data = 684 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 685 curlun->sense_data_info = 686 file_offset >> curlun->blkbits; 687 curlun->info_valid = 1; 688 bh->inreq->length = 0; 689 bh->state = BUF_STATE_FULL; 690 break; 691 } 692 693 /* Perform the read */ 694 file_offset_tmp = file_offset; 695 nread = kernel_read(curlun->filp, bh->buf, amount, 696 &file_offset_tmp); 697 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount, 698 (unsigned long long)file_offset, (int)nread); 699 if (signal_pending(current)) 700 return -EINTR; 701 702 if (nread < 0) { 703 LDBG(curlun, "error in file read: %d\n", (int)nread); 704 nread = 0; 705 } else if (nread < amount) { 706 LDBG(curlun, "partial file read: %d/%u\n", 707 (int)nread, amount); 708 nread = round_down(nread, curlun->blksize); 709 } 710 file_offset += nread; 711 amount_left -= nread; 712 common->residue -= nread; 713 714 /* 715 * Except at the end of the transfer, nread will be 716 * equal to the buffer size, which is divisible by the 717 * bulk-in maxpacket size. 718 */ 719 bh->inreq->length = nread; 720 bh->state = BUF_STATE_FULL; 721 722 /* If an error occurred, report it and its position */ 723 if (nread < amount) { 724 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 725 curlun->sense_data_info = 726 file_offset >> curlun->blkbits; 727 curlun->info_valid = 1; 728 break; 729 } 730 731 if (amount_left == 0) 732 break; /* No more left to read */ 733 734 /* Send this buffer and go read some more */ 735 bh->inreq->zero = 0; 736 if (!start_in_transfer(common, bh)) 737 /* Don't know what to do if common->fsg is NULL */ 738 return -EIO; 739 common->next_buffhd_to_fill = bh->next; 740 } 741 742 return -EIO; /* No default reply */ 743 } 744 745 746 /*-------------------------------------------------------------------------*/ 747 748 static int do_write(struct fsg_common *common) 749 { 750 struct fsg_lun *curlun = common->curlun; 751 u32 lba; 752 struct fsg_buffhd *bh; 753 int get_some_more; 754 u32 amount_left_to_req, amount_left_to_write; 755 loff_t usb_offset, file_offset, file_offset_tmp; 756 unsigned int amount; 757 ssize_t nwritten; 758 int rc; 759 760 if (curlun->ro) { 761 curlun->sense_data = SS_WRITE_PROTECTED; 762 return -EINVAL; 763 } 764 spin_lock(&curlun->filp->f_lock); 765 curlun->filp->f_flags &= ~O_SYNC; /* Default is not to wait */ 766 spin_unlock(&curlun->filp->f_lock); 767 768 /* 769 * Get the starting Logical Block Address and check that it's 770 * not too big 771 */ 772 if (common->cmnd[0] == WRITE_6) 773 lba = get_unaligned_be24(&common->cmnd[1]); 774 else { 775 lba = get_unaligned_be32(&common->cmnd[2]); 776 777 /* 778 * We allow DPO (Disable Page Out = don't save data in the 779 * cache) and FUA (Force Unit Access = write directly to the 780 * medium). We don't implement DPO; we implement FUA by 781 * performing synchronous output. 782 */ 783 if (common->cmnd[1] & ~0x18) { 784 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 785 return -EINVAL; 786 } 787 if (!curlun->nofua && (common->cmnd[1] & 0x08)) { /* FUA */ 788 spin_lock(&curlun->filp->f_lock); 789 curlun->filp->f_flags |= O_SYNC; 790 spin_unlock(&curlun->filp->f_lock); 791 } 792 } 793 if (lba >= curlun->num_sectors) { 794 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 795 return -EINVAL; 796 } 797 798 /* Carry out the file writes */ 799 get_some_more = 1; 800 file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits; 801 amount_left_to_req = common->data_size_from_cmnd; 802 amount_left_to_write = common->data_size_from_cmnd; 803 804 while (amount_left_to_write > 0) { 805 806 /* Queue a request for more data from the host */ 807 bh = common->next_buffhd_to_fill; 808 if (bh->state == BUF_STATE_EMPTY && get_some_more) { 809 810 /* 811 * Figure out how much we want to get: 812 * Try to get the remaining amount, 813 * but not more than the buffer size. 814 */ 815 amount = min(amount_left_to_req, FSG_BUFLEN); 816 817 /* Beyond the end of the backing file? */ 818 if (usb_offset >= curlun->file_length) { 819 get_some_more = 0; 820 curlun->sense_data = 821 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 822 curlun->sense_data_info = 823 usb_offset >> curlun->blkbits; 824 curlun->info_valid = 1; 825 continue; 826 } 827 828 /* Get the next buffer */ 829 usb_offset += amount; 830 common->usb_amount_left -= amount; 831 amount_left_to_req -= amount; 832 if (amount_left_to_req == 0) 833 get_some_more = 0; 834 835 /* 836 * Except at the end of the transfer, amount will be 837 * equal to the buffer size, which is divisible by 838 * the bulk-out maxpacket size. 839 */ 840 set_bulk_out_req_length(common, bh, amount); 841 if (!start_out_transfer(common, bh)) 842 /* Dunno what to do if common->fsg is NULL */ 843 return -EIO; 844 common->next_buffhd_to_fill = bh->next; 845 continue; 846 } 847 848 /* Write the received data to the backing file */ 849 bh = common->next_buffhd_to_drain; 850 if (bh->state == BUF_STATE_EMPTY && !get_some_more) 851 break; /* We stopped early */ 852 853 /* Wait for the data to be received */ 854 rc = sleep_thread(common, false, bh); 855 if (rc) 856 return rc; 857 858 common->next_buffhd_to_drain = bh->next; 859 bh->state = BUF_STATE_EMPTY; 860 861 /* Did something go wrong with the transfer? */ 862 if (bh->outreq->status != 0) { 863 curlun->sense_data = SS_COMMUNICATION_FAILURE; 864 curlun->sense_data_info = 865 file_offset >> curlun->blkbits; 866 curlun->info_valid = 1; 867 break; 868 } 869 870 amount = bh->outreq->actual; 871 if (curlun->file_length - file_offset < amount) { 872 LERROR(curlun, "write %u @ %llu beyond end %llu\n", 873 amount, (unsigned long long)file_offset, 874 (unsigned long long)curlun->file_length); 875 amount = curlun->file_length - file_offset; 876 } 877 878 /* 879 * Don't accept excess data. The spec doesn't say 880 * what to do in this case. We'll ignore the error. 881 */ 882 amount = min(amount, bh->bulk_out_intended_length); 883 884 /* Don't write a partial block */ 885 amount = round_down(amount, curlun->blksize); 886 if (amount == 0) 887 goto empty_write; 888 889 /* Perform the write */ 890 file_offset_tmp = file_offset; 891 nwritten = kernel_write(curlun->filp, bh->buf, amount, 892 &file_offset_tmp); 893 VLDBG(curlun, "file write %u @ %llu -> %d\n", amount, 894 (unsigned long long)file_offset, (int)nwritten); 895 if (signal_pending(current)) 896 return -EINTR; /* Interrupted! */ 897 898 if (nwritten < 0) { 899 LDBG(curlun, "error in file write: %d\n", 900 (int) nwritten); 901 nwritten = 0; 902 } else if (nwritten < amount) { 903 LDBG(curlun, "partial file write: %d/%u\n", 904 (int) nwritten, amount); 905 nwritten = round_down(nwritten, curlun->blksize); 906 } 907 file_offset += nwritten; 908 amount_left_to_write -= nwritten; 909 common->residue -= nwritten; 910 911 /* If an error occurred, report it and its position */ 912 if (nwritten < amount) { 913 curlun->sense_data = SS_WRITE_ERROR; 914 curlun->sense_data_info = 915 file_offset >> curlun->blkbits; 916 curlun->info_valid = 1; 917 break; 918 } 919 920 empty_write: 921 /* Did the host decide to stop early? */ 922 if (bh->outreq->actual < bh->bulk_out_intended_length) { 923 common->short_packet_received = 1; 924 break; 925 } 926 } 927 928 return -EIO; /* No default reply */ 929 } 930 931 932 /*-------------------------------------------------------------------------*/ 933 934 static int do_synchronize_cache(struct fsg_common *common) 935 { 936 struct fsg_lun *curlun = common->curlun; 937 int rc; 938 939 /* We ignore the requested LBA and write out all file's 940 * dirty data buffers. */ 941 rc = fsg_lun_fsync_sub(curlun); 942 if (rc) 943 curlun->sense_data = SS_WRITE_ERROR; 944 return 0; 945 } 946 947 948 /*-------------------------------------------------------------------------*/ 949 950 static void invalidate_sub(struct fsg_lun *curlun) 951 { 952 struct file *filp = curlun->filp; 953 struct inode *inode = file_inode(filp); 954 unsigned long rc; 955 956 rc = invalidate_mapping_pages(inode->i_mapping, 0, -1); 957 VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc); 958 } 959 960 static int do_verify(struct fsg_common *common) 961 { 962 struct fsg_lun *curlun = common->curlun; 963 u32 lba; 964 u32 verification_length; 965 struct fsg_buffhd *bh = common->next_buffhd_to_fill; 966 loff_t file_offset, file_offset_tmp; 967 u32 amount_left; 968 unsigned int amount; 969 ssize_t nread; 970 971 /* 972 * Get the starting Logical Block Address and check that it's 973 * not too big. 974 */ 975 lba = get_unaligned_be32(&common->cmnd[2]); 976 if (lba >= curlun->num_sectors) { 977 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 978 return -EINVAL; 979 } 980 981 /* 982 * We allow DPO (Disable Page Out = don't save data in the 983 * cache) but we don't implement it. 984 */ 985 if (common->cmnd[1] & ~0x10) { 986 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 987 return -EINVAL; 988 } 989 990 verification_length = get_unaligned_be16(&common->cmnd[7]); 991 if (unlikely(verification_length == 0)) 992 return -EIO; /* No default reply */ 993 994 /* Prepare to carry out the file verify */ 995 amount_left = verification_length << curlun->blkbits; 996 file_offset = ((loff_t) lba) << curlun->blkbits; 997 998 /* Write out all the dirty buffers before invalidating them */ 999 fsg_lun_fsync_sub(curlun); 1000 if (signal_pending(current)) 1001 return -EINTR; 1002 1003 invalidate_sub(curlun); 1004 if (signal_pending(current)) 1005 return -EINTR; 1006 1007 /* Just try to read the requested blocks */ 1008 while (amount_left > 0) { 1009 /* 1010 * Figure out how much we need to read: 1011 * Try to read the remaining amount, but not more than 1012 * the buffer size. 1013 * And don't try to read past the end of the file. 1014 */ 1015 amount = min(amount_left, FSG_BUFLEN); 1016 amount = min((loff_t)amount, 1017 curlun->file_length - file_offset); 1018 if (amount == 0) { 1019 curlun->sense_data = 1020 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1021 curlun->sense_data_info = 1022 file_offset >> curlun->blkbits; 1023 curlun->info_valid = 1; 1024 break; 1025 } 1026 1027 /* Perform the read */ 1028 file_offset_tmp = file_offset; 1029 nread = kernel_read(curlun->filp, bh->buf, amount, 1030 &file_offset_tmp); 1031 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount, 1032 (unsigned long long) file_offset, 1033 (int) nread); 1034 if (signal_pending(current)) 1035 return -EINTR; 1036 1037 if (nread < 0) { 1038 LDBG(curlun, "error in file verify: %d\n", (int)nread); 1039 nread = 0; 1040 } else if (nread < amount) { 1041 LDBG(curlun, "partial file verify: %d/%u\n", 1042 (int)nread, amount); 1043 nread = round_down(nread, curlun->blksize); 1044 } 1045 if (nread == 0) { 1046 curlun->sense_data = SS_UNRECOVERED_READ_ERROR; 1047 curlun->sense_data_info = 1048 file_offset >> curlun->blkbits; 1049 curlun->info_valid = 1; 1050 break; 1051 } 1052 file_offset += nread; 1053 amount_left -= nread; 1054 } 1055 return 0; 1056 } 1057 1058 1059 /*-------------------------------------------------------------------------*/ 1060 1061 static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh) 1062 { 1063 struct fsg_lun *curlun = common->curlun; 1064 u8 *buf = (u8 *) bh->buf; 1065 1066 if (!curlun) { /* Unsupported LUNs are okay */ 1067 common->bad_lun_okay = 1; 1068 memset(buf, 0, 36); 1069 buf[0] = TYPE_NO_LUN; /* Unsupported, no device-type */ 1070 buf[4] = 31; /* Additional length */ 1071 return 36; 1072 } 1073 1074 buf[0] = curlun->cdrom ? TYPE_ROM : TYPE_DISK; 1075 buf[1] = curlun->removable ? 0x80 : 0; 1076 buf[2] = 2; /* ANSI SCSI level 2 */ 1077 buf[3] = 2; /* SCSI-2 INQUIRY data format */ 1078 buf[4] = 31; /* Additional length */ 1079 buf[5] = 0; /* No special options */ 1080 buf[6] = 0; 1081 buf[7] = 0; 1082 if (curlun->inquiry_string[0]) 1083 memcpy(buf + 8, curlun->inquiry_string, 1084 sizeof(curlun->inquiry_string)); 1085 else 1086 memcpy(buf + 8, common->inquiry_string, 1087 sizeof(common->inquiry_string)); 1088 return 36; 1089 } 1090 1091 static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh) 1092 { 1093 struct fsg_lun *curlun = common->curlun; 1094 u8 *buf = (u8 *) bh->buf; 1095 u32 sd, sdinfo; 1096 int valid; 1097 1098 /* 1099 * From the SCSI-2 spec., section 7.9 (Unit attention condition): 1100 * 1101 * If a REQUEST SENSE command is received from an initiator 1102 * with a pending unit attention condition (before the target 1103 * generates the contingent allegiance condition), then the 1104 * target shall either: 1105 * a) report any pending sense data and preserve the unit 1106 * attention condition on the logical unit, or, 1107 * b) report the unit attention condition, may discard any 1108 * pending sense data, and clear the unit attention 1109 * condition on the logical unit for that initiator. 1110 * 1111 * FSG normally uses option a); enable this code to use option b). 1112 */ 1113 #if 0 1114 if (curlun && curlun->unit_attention_data != SS_NO_SENSE) { 1115 curlun->sense_data = curlun->unit_attention_data; 1116 curlun->unit_attention_data = SS_NO_SENSE; 1117 } 1118 #endif 1119 1120 if (!curlun) { /* Unsupported LUNs are okay */ 1121 common->bad_lun_okay = 1; 1122 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED; 1123 sdinfo = 0; 1124 valid = 0; 1125 } else { 1126 sd = curlun->sense_data; 1127 sdinfo = curlun->sense_data_info; 1128 valid = curlun->info_valid << 7; 1129 curlun->sense_data = SS_NO_SENSE; 1130 curlun->sense_data_info = 0; 1131 curlun->info_valid = 0; 1132 } 1133 1134 memset(buf, 0, 18); 1135 buf[0] = valid | 0x70; /* Valid, current error */ 1136 buf[2] = SK(sd); 1137 put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */ 1138 buf[7] = 18 - 8; /* Additional sense length */ 1139 buf[12] = ASC(sd); 1140 buf[13] = ASCQ(sd); 1141 return 18; 1142 } 1143 1144 static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh) 1145 { 1146 struct fsg_lun *curlun = common->curlun; 1147 u32 lba = get_unaligned_be32(&common->cmnd[2]); 1148 int pmi = common->cmnd[8]; 1149 u8 *buf = (u8 *)bh->buf; 1150 1151 /* Check the PMI and LBA fields */ 1152 if (pmi > 1 || (pmi == 0 && lba != 0)) { 1153 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1154 return -EINVAL; 1155 } 1156 1157 put_unaligned_be32(curlun->num_sectors - 1, &buf[0]); 1158 /* Max logical block */ 1159 put_unaligned_be32(curlun->blksize, &buf[4]);/* Block length */ 1160 return 8; 1161 } 1162 1163 static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh) 1164 { 1165 struct fsg_lun *curlun = common->curlun; 1166 int msf = common->cmnd[1] & 0x02; 1167 u32 lba = get_unaligned_be32(&common->cmnd[2]); 1168 u8 *buf = (u8 *)bh->buf; 1169 1170 if (common->cmnd[1] & ~0x02) { /* Mask away MSF */ 1171 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1172 return -EINVAL; 1173 } 1174 if (lba >= curlun->num_sectors) { 1175 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE; 1176 return -EINVAL; 1177 } 1178 1179 memset(buf, 0, 8); 1180 buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */ 1181 store_cdrom_address(&buf[4], msf, lba); 1182 return 8; 1183 } 1184 1185 static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh) 1186 { 1187 struct fsg_lun *curlun = common->curlun; 1188 int msf = common->cmnd[1] & 0x02; 1189 int start_track = common->cmnd[6]; 1190 u8 *buf = (u8 *)bh->buf; 1191 1192 if ((common->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */ 1193 start_track > 1) { 1194 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1195 return -EINVAL; 1196 } 1197 1198 memset(buf, 0, 20); 1199 buf[1] = (20-2); /* TOC data length */ 1200 buf[2] = 1; /* First track number */ 1201 buf[3] = 1; /* Last track number */ 1202 buf[5] = 0x16; /* Data track, copying allowed */ 1203 buf[6] = 0x01; /* Only track is number 1 */ 1204 store_cdrom_address(&buf[8], msf, 0); 1205 1206 buf[13] = 0x16; /* Lead-out track is data */ 1207 buf[14] = 0xAA; /* Lead-out track number */ 1208 store_cdrom_address(&buf[16], msf, curlun->num_sectors); 1209 return 20; 1210 } 1211 1212 static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh) 1213 { 1214 struct fsg_lun *curlun = common->curlun; 1215 int mscmnd = common->cmnd[0]; 1216 u8 *buf = (u8 *) bh->buf; 1217 u8 *buf0 = buf; 1218 int pc, page_code; 1219 int changeable_values, all_pages; 1220 int valid_page = 0; 1221 int len, limit; 1222 1223 if ((common->cmnd[1] & ~0x08) != 0) { /* Mask away DBD */ 1224 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1225 return -EINVAL; 1226 } 1227 pc = common->cmnd[2] >> 6; 1228 page_code = common->cmnd[2] & 0x3f; 1229 if (pc == 3) { 1230 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED; 1231 return -EINVAL; 1232 } 1233 changeable_values = (pc == 1); 1234 all_pages = (page_code == 0x3f); 1235 1236 /* 1237 * Write the mode parameter header. Fixed values are: default 1238 * medium type, no cache control (DPOFUA), and no block descriptors. 1239 * The only variable value is the WriteProtect bit. We will fill in 1240 * the mode data length later. 1241 */ 1242 memset(buf, 0, 8); 1243 if (mscmnd == MODE_SENSE) { 1244 buf[2] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */ 1245 buf += 4; 1246 limit = 255; 1247 } else { /* MODE_SENSE_10 */ 1248 buf[3] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */ 1249 buf += 8; 1250 limit = 65535; /* Should really be FSG_BUFLEN */ 1251 } 1252 1253 /* No block descriptors */ 1254 1255 /* 1256 * The mode pages, in numerical order. The only page we support 1257 * is the Caching page. 1258 */ 1259 if (page_code == 0x08 || all_pages) { 1260 valid_page = 1; 1261 buf[0] = 0x08; /* Page code */ 1262 buf[1] = 10; /* Page length */ 1263 memset(buf+2, 0, 10); /* None of the fields are changeable */ 1264 1265 if (!changeable_values) { 1266 buf[2] = 0x04; /* Write cache enable, */ 1267 /* Read cache not disabled */ 1268 /* No cache retention priorities */ 1269 put_unaligned_be16(0xffff, &buf[4]); 1270 /* Don't disable prefetch */ 1271 /* Minimum prefetch = 0 */ 1272 put_unaligned_be16(0xffff, &buf[8]); 1273 /* Maximum prefetch */ 1274 put_unaligned_be16(0xffff, &buf[10]); 1275 /* Maximum prefetch ceiling */ 1276 } 1277 buf += 12; 1278 } 1279 1280 /* 1281 * Check that a valid page was requested and the mode data length 1282 * isn't too long. 1283 */ 1284 len = buf - buf0; 1285 if (!valid_page || len > limit) { 1286 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1287 return -EINVAL; 1288 } 1289 1290 /* Store the mode data length */ 1291 if (mscmnd == MODE_SENSE) 1292 buf0[0] = len - 1; 1293 else 1294 put_unaligned_be16(len - 2, buf0); 1295 return len; 1296 } 1297 1298 static int do_start_stop(struct fsg_common *common) 1299 { 1300 struct fsg_lun *curlun = common->curlun; 1301 int loej, start; 1302 1303 if (!curlun) { 1304 return -EINVAL; 1305 } else if (!curlun->removable) { 1306 curlun->sense_data = SS_INVALID_COMMAND; 1307 return -EINVAL; 1308 } else if ((common->cmnd[1] & ~0x01) != 0 || /* Mask away Immed */ 1309 (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */ 1310 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1311 return -EINVAL; 1312 } 1313 1314 loej = common->cmnd[4] & 0x02; 1315 start = common->cmnd[4] & 0x01; 1316 1317 /* 1318 * Our emulation doesn't support mounting; the medium is 1319 * available for use as soon as it is loaded. 1320 */ 1321 if (start) { 1322 if (!fsg_lun_is_open(curlun)) { 1323 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 1324 return -EINVAL; 1325 } 1326 return 0; 1327 } 1328 1329 /* Are we allowed to unload the media? */ 1330 if (curlun->prevent_medium_removal) { 1331 LDBG(curlun, "unload attempt prevented\n"); 1332 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED; 1333 return -EINVAL; 1334 } 1335 1336 if (!loej) 1337 return 0; 1338 1339 up_read(&common->filesem); 1340 down_write(&common->filesem); 1341 fsg_lun_close(curlun); 1342 up_write(&common->filesem); 1343 down_read(&common->filesem); 1344 1345 return 0; 1346 } 1347 1348 static int do_prevent_allow(struct fsg_common *common) 1349 { 1350 struct fsg_lun *curlun = common->curlun; 1351 int prevent; 1352 1353 if (!common->curlun) { 1354 return -EINVAL; 1355 } else if (!common->curlun->removable) { 1356 common->curlun->sense_data = SS_INVALID_COMMAND; 1357 return -EINVAL; 1358 } 1359 1360 prevent = common->cmnd[4] & 0x01; 1361 if ((common->cmnd[4] & ~0x01) != 0) { /* Mask away Prevent */ 1362 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1363 return -EINVAL; 1364 } 1365 1366 if (curlun->prevent_medium_removal && !prevent) 1367 fsg_lun_fsync_sub(curlun); 1368 curlun->prevent_medium_removal = prevent; 1369 return 0; 1370 } 1371 1372 static int do_read_format_capacities(struct fsg_common *common, 1373 struct fsg_buffhd *bh) 1374 { 1375 struct fsg_lun *curlun = common->curlun; 1376 u8 *buf = (u8 *) bh->buf; 1377 1378 buf[0] = buf[1] = buf[2] = 0; 1379 buf[3] = 8; /* Only the Current/Maximum Capacity Descriptor */ 1380 buf += 4; 1381 1382 put_unaligned_be32(curlun->num_sectors, &buf[0]); 1383 /* Number of blocks */ 1384 put_unaligned_be32(curlun->blksize, &buf[4]);/* Block length */ 1385 buf[4] = 0x02; /* Current capacity */ 1386 return 12; 1387 } 1388 1389 static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh) 1390 { 1391 struct fsg_lun *curlun = common->curlun; 1392 1393 /* We don't support MODE SELECT */ 1394 if (curlun) 1395 curlun->sense_data = SS_INVALID_COMMAND; 1396 return -EINVAL; 1397 } 1398 1399 1400 /*-------------------------------------------------------------------------*/ 1401 1402 static int halt_bulk_in_endpoint(struct fsg_dev *fsg) 1403 { 1404 int rc; 1405 1406 rc = fsg_set_halt(fsg, fsg->bulk_in); 1407 if (rc == -EAGAIN) 1408 VDBG(fsg, "delayed bulk-in endpoint halt\n"); 1409 while (rc != 0) { 1410 if (rc != -EAGAIN) { 1411 WARNING(fsg, "usb_ep_set_halt -> %d\n", rc); 1412 rc = 0; 1413 break; 1414 } 1415 1416 /* Wait for a short time and then try again */ 1417 if (msleep_interruptible(100) != 0) 1418 return -EINTR; 1419 rc = usb_ep_set_halt(fsg->bulk_in); 1420 } 1421 return rc; 1422 } 1423 1424 static int wedge_bulk_in_endpoint(struct fsg_dev *fsg) 1425 { 1426 int rc; 1427 1428 DBG(fsg, "bulk-in set wedge\n"); 1429 rc = usb_ep_set_wedge(fsg->bulk_in); 1430 if (rc == -EAGAIN) 1431 VDBG(fsg, "delayed bulk-in endpoint wedge\n"); 1432 while (rc != 0) { 1433 if (rc != -EAGAIN) { 1434 WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc); 1435 rc = 0; 1436 break; 1437 } 1438 1439 /* Wait for a short time and then try again */ 1440 if (msleep_interruptible(100) != 0) 1441 return -EINTR; 1442 rc = usb_ep_set_wedge(fsg->bulk_in); 1443 } 1444 return rc; 1445 } 1446 1447 static int throw_away_data(struct fsg_common *common) 1448 { 1449 struct fsg_buffhd *bh, *bh2; 1450 u32 amount; 1451 int rc; 1452 1453 for (bh = common->next_buffhd_to_drain; 1454 bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0; 1455 bh = common->next_buffhd_to_drain) { 1456 1457 /* Try to submit another request if we need one */ 1458 bh2 = common->next_buffhd_to_fill; 1459 if (bh2->state == BUF_STATE_EMPTY && 1460 common->usb_amount_left > 0) { 1461 amount = min(common->usb_amount_left, FSG_BUFLEN); 1462 1463 /* 1464 * Except at the end of the transfer, amount will be 1465 * equal to the buffer size, which is divisible by 1466 * the bulk-out maxpacket size. 1467 */ 1468 set_bulk_out_req_length(common, bh2, amount); 1469 if (!start_out_transfer(common, bh2)) 1470 /* Dunno what to do if common->fsg is NULL */ 1471 return -EIO; 1472 common->next_buffhd_to_fill = bh2->next; 1473 common->usb_amount_left -= amount; 1474 continue; 1475 } 1476 1477 /* Wait for the data to be received */ 1478 rc = sleep_thread(common, false, bh); 1479 if (rc) 1480 return rc; 1481 1482 /* Throw away the data in a filled buffer */ 1483 bh->state = BUF_STATE_EMPTY; 1484 common->next_buffhd_to_drain = bh->next; 1485 1486 /* A short packet or an error ends everything */ 1487 if (bh->outreq->actual < bh->bulk_out_intended_length || 1488 bh->outreq->status != 0) { 1489 raise_exception(common, FSG_STATE_ABORT_BULK_OUT); 1490 return -EINTR; 1491 } 1492 } 1493 return 0; 1494 } 1495 1496 static int finish_reply(struct fsg_common *common) 1497 { 1498 struct fsg_buffhd *bh = common->next_buffhd_to_fill; 1499 int rc = 0; 1500 1501 switch (common->data_dir) { 1502 case DATA_DIR_NONE: 1503 break; /* Nothing to send */ 1504 1505 /* 1506 * If we don't know whether the host wants to read or write, 1507 * this must be CB or CBI with an unknown command. We mustn't 1508 * try to send or receive any data. So stall both bulk pipes 1509 * if we can and wait for a reset. 1510 */ 1511 case DATA_DIR_UNKNOWN: 1512 if (!common->can_stall) { 1513 /* Nothing */ 1514 } else if (fsg_is_set(common)) { 1515 fsg_set_halt(common->fsg, common->fsg->bulk_out); 1516 rc = halt_bulk_in_endpoint(common->fsg); 1517 } else { 1518 /* Don't know what to do if common->fsg is NULL */ 1519 rc = -EIO; 1520 } 1521 break; 1522 1523 /* All but the last buffer of data must have already been sent */ 1524 case DATA_DIR_TO_HOST: 1525 if (common->data_size == 0) { 1526 /* Nothing to send */ 1527 1528 /* Don't know what to do if common->fsg is NULL */ 1529 } else if (!fsg_is_set(common)) { 1530 rc = -EIO; 1531 1532 /* If there's no residue, simply send the last buffer */ 1533 } else if (common->residue == 0) { 1534 bh->inreq->zero = 0; 1535 if (!start_in_transfer(common, bh)) 1536 return -EIO; 1537 common->next_buffhd_to_fill = bh->next; 1538 1539 /* 1540 * For Bulk-only, mark the end of the data with a short 1541 * packet. If we are allowed to stall, halt the bulk-in 1542 * endpoint. (Note: This violates the Bulk-Only Transport 1543 * specification, which requires us to pad the data if we 1544 * don't halt the endpoint. Presumably nobody will mind.) 1545 */ 1546 } else { 1547 bh->inreq->zero = 1; 1548 if (!start_in_transfer(common, bh)) 1549 rc = -EIO; 1550 common->next_buffhd_to_fill = bh->next; 1551 if (common->can_stall) 1552 rc = halt_bulk_in_endpoint(common->fsg); 1553 } 1554 break; 1555 1556 /* 1557 * We have processed all we want from the data the host has sent. 1558 * There may still be outstanding bulk-out requests. 1559 */ 1560 case DATA_DIR_FROM_HOST: 1561 if (common->residue == 0) { 1562 /* Nothing to receive */ 1563 1564 /* Did the host stop sending unexpectedly early? */ 1565 } else if (common->short_packet_received) { 1566 raise_exception(common, FSG_STATE_ABORT_BULK_OUT); 1567 rc = -EINTR; 1568 1569 /* 1570 * We haven't processed all the incoming data. Even though 1571 * we may be allowed to stall, doing so would cause a race. 1572 * The controller may already have ACK'ed all the remaining 1573 * bulk-out packets, in which case the host wouldn't see a 1574 * STALL. Not realizing the endpoint was halted, it wouldn't 1575 * clear the halt -- leading to problems later on. 1576 */ 1577 #if 0 1578 } else if (common->can_stall) { 1579 if (fsg_is_set(common)) 1580 fsg_set_halt(common->fsg, 1581 common->fsg->bulk_out); 1582 raise_exception(common, FSG_STATE_ABORT_BULK_OUT); 1583 rc = -EINTR; 1584 #endif 1585 1586 /* 1587 * We can't stall. Read in the excess data and throw it 1588 * all away. 1589 */ 1590 } else { 1591 rc = throw_away_data(common); 1592 } 1593 break; 1594 } 1595 return rc; 1596 } 1597 1598 static void send_status(struct fsg_common *common) 1599 { 1600 struct fsg_lun *curlun = common->curlun; 1601 struct fsg_buffhd *bh; 1602 struct bulk_cs_wrap *csw; 1603 int rc; 1604 u8 status = US_BULK_STAT_OK; 1605 u32 sd, sdinfo = 0; 1606 1607 /* Wait for the next buffer to become available */ 1608 bh = common->next_buffhd_to_fill; 1609 rc = sleep_thread(common, false, bh); 1610 if (rc) 1611 return; 1612 1613 if (curlun) { 1614 sd = curlun->sense_data; 1615 sdinfo = curlun->sense_data_info; 1616 } else if (common->bad_lun_okay) 1617 sd = SS_NO_SENSE; 1618 else 1619 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED; 1620 1621 if (common->phase_error) { 1622 DBG(common, "sending phase-error status\n"); 1623 status = US_BULK_STAT_PHASE; 1624 sd = SS_INVALID_COMMAND; 1625 } else if (sd != SS_NO_SENSE) { 1626 DBG(common, "sending command-failure status\n"); 1627 status = US_BULK_STAT_FAIL; 1628 VDBG(common, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;" 1629 " info x%x\n", 1630 SK(sd), ASC(sd), ASCQ(sd), sdinfo); 1631 } 1632 1633 /* Store and send the Bulk-only CSW */ 1634 csw = (void *)bh->buf; 1635 1636 csw->Signature = cpu_to_le32(US_BULK_CS_SIGN); 1637 csw->Tag = common->tag; 1638 csw->Residue = cpu_to_le32(common->residue); 1639 csw->Status = status; 1640 1641 bh->inreq->length = US_BULK_CS_WRAP_LEN; 1642 bh->inreq->zero = 0; 1643 if (!start_in_transfer(common, bh)) 1644 /* Don't know what to do if common->fsg is NULL */ 1645 return; 1646 1647 common->next_buffhd_to_fill = bh->next; 1648 return; 1649 } 1650 1651 1652 /*-------------------------------------------------------------------------*/ 1653 1654 /* 1655 * Check whether the command is properly formed and whether its data size 1656 * and direction agree with the values we already have. 1657 */ 1658 static int check_command(struct fsg_common *common, int cmnd_size, 1659 enum data_direction data_dir, unsigned int mask, 1660 int needs_medium, const char *name) 1661 { 1662 int i; 1663 unsigned int lun = common->cmnd[1] >> 5; 1664 static const char dirletter[4] = {'u', 'o', 'i', 'n'}; 1665 char hdlen[20]; 1666 struct fsg_lun *curlun; 1667 1668 hdlen[0] = 0; 1669 if (common->data_dir != DATA_DIR_UNKNOWN) 1670 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir], 1671 common->data_size); 1672 VDBG(common, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n", 1673 name, cmnd_size, dirletter[(int) data_dir], 1674 common->data_size_from_cmnd, common->cmnd_size, hdlen); 1675 1676 /* 1677 * We can't reply at all until we know the correct data direction 1678 * and size. 1679 */ 1680 if (common->data_size_from_cmnd == 0) 1681 data_dir = DATA_DIR_NONE; 1682 if (common->data_size < common->data_size_from_cmnd) { 1683 /* 1684 * Host data size < Device data size is a phase error. 1685 * Carry out the command, but only transfer as much as 1686 * we are allowed. 1687 */ 1688 common->data_size_from_cmnd = common->data_size; 1689 common->phase_error = 1; 1690 } 1691 common->residue = common->data_size; 1692 common->usb_amount_left = common->data_size; 1693 1694 /* Conflicting data directions is a phase error */ 1695 if (common->data_dir != data_dir && common->data_size_from_cmnd > 0) { 1696 common->phase_error = 1; 1697 return -EINVAL; 1698 } 1699 1700 /* Verify the length of the command itself */ 1701 if (cmnd_size != common->cmnd_size) { 1702 1703 /* 1704 * Special case workaround: There are plenty of buggy SCSI 1705 * implementations. Many have issues with cbw->Length 1706 * field passing a wrong command size. For those cases we 1707 * always try to work around the problem by using the length 1708 * sent by the host side provided it is at least as large 1709 * as the correct command length. 1710 * Examples of such cases would be MS-Windows, which issues 1711 * REQUEST SENSE with cbw->Length == 12 where it should 1712 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and 1713 * REQUEST SENSE with cbw->Length == 10 where it should 1714 * be 6 as well. 1715 */ 1716 if (cmnd_size <= common->cmnd_size) { 1717 DBG(common, "%s is buggy! Expected length %d " 1718 "but we got %d\n", name, 1719 cmnd_size, common->cmnd_size); 1720 cmnd_size = common->cmnd_size; 1721 } else { 1722 common->phase_error = 1; 1723 return -EINVAL; 1724 } 1725 } 1726 1727 /* Check that the LUN values are consistent */ 1728 if (common->lun != lun) 1729 DBG(common, "using LUN %u from CBW, not LUN %u from CDB\n", 1730 common->lun, lun); 1731 1732 /* Check the LUN */ 1733 curlun = common->curlun; 1734 if (curlun) { 1735 if (common->cmnd[0] != REQUEST_SENSE) { 1736 curlun->sense_data = SS_NO_SENSE; 1737 curlun->sense_data_info = 0; 1738 curlun->info_valid = 0; 1739 } 1740 } else { 1741 common->bad_lun_okay = 0; 1742 1743 /* 1744 * INQUIRY and REQUEST SENSE commands are explicitly allowed 1745 * to use unsupported LUNs; all others may not. 1746 */ 1747 if (common->cmnd[0] != INQUIRY && 1748 common->cmnd[0] != REQUEST_SENSE) { 1749 DBG(common, "unsupported LUN %u\n", common->lun); 1750 return -EINVAL; 1751 } 1752 } 1753 1754 /* 1755 * If a unit attention condition exists, only INQUIRY and 1756 * REQUEST SENSE commands are allowed; anything else must fail. 1757 */ 1758 if (curlun && curlun->unit_attention_data != SS_NO_SENSE && 1759 common->cmnd[0] != INQUIRY && 1760 common->cmnd[0] != REQUEST_SENSE) { 1761 curlun->sense_data = curlun->unit_attention_data; 1762 curlun->unit_attention_data = SS_NO_SENSE; 1763 return -EINVAL; 1764 } 1765 1766 /* Check that only command bytes listed in the mask are non-zero */ 1767 common->cmnd[1] &= 0x1f; /* Mask away the LUN */ 1768 for (i = 1; i < cmnd_size; ++i) { 1769 if (common->cmnd[i] && !(mask & (1 << i))) { 1770 if (curlun) 1771 curlun->sense_data = SS_INVALID_FIELD_IN_CDB; 1772 return -EINVAL; 1773 } 1774 } 1775 1776 /* If the medium isn't mounted and the command needs to access 1777 * it, return an error. */ 1778 if (curlun && !fsg_lun_is_open(curlun) && needs_medium) { 1779 curlun->sense_data = SS_MEDIUM_NOT_PRESENT; 1780 return -EINVAL; 1781 } 1782 1783 return 0; 1784 } 1785 1786 /* wrapper of check_command for data size in blocks handling */ 1787 static int check_command_size_in_blocks(struct fsg_common *common, 1788 int cmnd_size, enum data_direction data_dir, 1789 unsigned int mask, int needs_medium, const char *name) 1790 { 1791 if (common->curlun) 1792 common->data_size_from_cmnd <<= common->curlun->blkbits; 1793 return check_command(common, cmnd_size, data_dir, 1794 mask, needs_medium, name); 1795 } 1796 1797 static int do_scsi_command(struct fsg_common *common) 1798 { 1799 struct fsg_buffhd *bh; 1800 int rc; 1801 int reply = -EINVAL; 1802 int i; 1803 static char unknown[16]; 1804 1805 dump_cdb(common); 1806 1807 /* Wait for the next buffer to become available for data or status */ 1808 bh = common->next_buffhd_to_fill; 1809 common->next_buffhd_to_drain = bh; 1810 rc = sleep_thread(common, false, bh); 1811 if (rc) 1812 return rc; 1813 1814 common->phase_error = 0; 1815 common->short_packet_received = 0; 1816 1817 down_read(&common->filesem); /* We're using the backing file */ 1818 switch (common->cmnd[0]) { 1819 1820 case INQUIRY: 1821 common->data_size_from_cmnd = common->cmnd[4]; 1822 reply = check_command(common, 6, DATA_DIR_TO_HOST, 1823 (1<<4), 0, 1824 "INQUIRY"); 1825 if (reply == 0) 1826 reply = do_inquiry(common, bh); 1827 break; 1828 1829 case MODE_SELECT: 1830 common->data_size_from_cmnd = common->cmnd[4]; 1831 reply = check_command(common, 6, DATA_DIR_FROM_HOST, 1832 (1<<1) | (1<<4), 0, 1833 "MODE SELECT(6)"); 1834 if (reply == 0) 1835 reply = do_mode_select(common, bh); 1836 break; 1837 1838 case MODE_SELECT_10: 1839 common->data_size_from_cmnd = 1840 get_unaligned_be16(&common->cmnd[7]); 1841 reply = check_command(common, 10, DATA_DIR_FROM_HOST, 1842 (1<<1) | (3<<7), 0, 1843 "MODE SELECT(10)"); 1844 if (reply == 0) 1845 reply = do_mode_select(common, bh); 1846 break; 1847 1848 case MODE_SENSE: 1849 common->data_size_from_cmnd = common->cmnd[4]; 1850 reply = check_command(common, 6, DATA_DIR_TO_HOST, 1851 (1<<1) | (1<<2) | (1<<4), 0, 1852 "MODE SENSE(6)"); 1853 if (reply == 0) 1854 reply = do_mode_sense(common, bh); 1855 break; 1856 1857 case MODE_SENSE_10: 1858 common->data_size_from_cmnd = 1859 get_unaligned_be16(&common->cmnd[7]); 1860 reply = check_command(common, 10, DATA_DIR_TO_HOST, 1861 (1<<1) | (1<<2) | (3<<7), 0, 1862 "MODE SENSE(10)"); 1863 if (reply == 0) 1864 reply = do_mode_sense(common, bh); 1865 break; 1866 1867 case ALLOW_MEDIUM_REMOVAL: 1868 common->data_size_from_cmnd = 0; 1869 reply = check_command(common, 6, DATA_DIR_NONE, 1870 (1<<4), 0, 1871 "PREVENT-ALLOW MEDIUM REMOVAL"); 1872 if (reply == 0) 1873 reply = do_prevent_allow(common); 1874 break; 1875 1876 case READ_6: 1877 i = common->cmnd[4]; 1878 common->data_size_from_cmnd = (i == 0) ? 256 : i; 1879 reply = check_command_size_in_blocks(common, 6, 1880 DATA_DIR_TO_HOST, 1881 (7<<1) | (1<<4), 1, 1882 "READ(6)"); 1883 if (reply == 0) 1884 reply = do_read(common); 1885 break; 1886 1887 case READ_10: 1888 common->data_size_from_cmnd = 1889 get_unaligned_be16(&common->cmnd[7]); 1890 reply = check_command_size_in_blocks(common, 10, 1891 DATA_DIR_TO_HOST, 1892 (1<<1) | (0xf<<2) | (3<<7), 1, 1893 "READ(10)"); 1894 if (reply == 0) 1895 reply = do_read(common); 1896 break; 1897 1898 case READ_12: 1899 common->data_size_from_cmnd = 1900 get_unaligned_be32(&common->cmnd[6]); 1901 reply = check_command_size_in_blocks(common, 12, 1902 DATA_DIR_TO_HOST, 1903 (1<<1) | (0xf<<2) | (0xf<<6), 1, 1904 "READ(12)"); 1905 if (reply == 0) 1906 reply = do_read(common); 1907 break; 1908 1909 case READ_CAPACITY: 1910 common->data_size_from_cmnd = 8; 1911 reply = check_command(common, 10, DATA_DIR_TO_HOST, 1912 (0xf<<2) | (1<<8), 1, 1913 "READ CAPACITY"); 1914 if (reply == 0) 1915 reply = do_read_capacity(common, bh); 1916 break; 1917 1918 case READ_HEADER: 1919 if (!common->curlun || !common->curlun->cdrom) 1920 goto unknown_cmnd; 1921 common->data_size_from_cmnd = 1922 get_unaligned_be16(&common->cmnd[7]); 1923 reply = check_command(common, 10, DATA_DIR_TO_HOST, 1924 (3<<7) | (0x1f<<1), 1, 1925 "READ HEADER"); 1926 if (reply == 0) 1927 reply = do_read_header(common, bh); 1928 break; 1929 1930 case READ_TOC: 1931 if (!common->curlun || !common->curlun->cdrom) 1932 goto unknown_cmnd; 1933 common->data_size_from_cmnd = 1934 get_unaligned_be16(&common->cmnd[7]); 1935 reply = check_command(common, 10, DATA_DIR_TO_HOST, 1936 (7<<6) | (1<<1), 1, 1937 "READ TOC"); 1938 if (reply == 0) 1939 reply = do_read_toc(common, bh); 1940 break; 1941 1942 case READ_FORMAT_CAPACITIES: 1943 common->data_size_from_cmnd = 1944 get_unaligned_be16(&common->cmnd[7]); 1945 reply = check_command(common, 10, DATA_DIR_TO_HOST, 1946 (3<<7), 1, 1947 "READ FORMAT CAPACITIES"); 1948 if (reply == 0) 1949 reply = do_read_format_capacities(common, bh); 1950 break; 1951 1952 case REQUEST_SENSE: 1953 common->data_size_from_cmnd = common->cmnd[4]; 1954 reply = check_command(common, 6, DATA_DIR_TO_HOST, 1955 (1<<4), 0, 1956 "REQUEST SENSE"); 1957 if (reply == 0) 1958 reply = do_request_sense(common, bh); 1959 break; 1960 1961 case START_STOP: 1962 common->data_size_from_cmnd = 0; 1963 reply = check_command(common, 6, DATA_DIR_NONE, 1964 (1<<1) | (1<<4), 0, 1965 "START-STOP UNIT"); 1966 if (reply == 0) 1967 reply = do_start_stop(common); 1968 break; 1969 1970 case SYNCHRONIZE_CACHE: 1971 common->data_size_from_cmnd = 0; 1972 reply = check_command(common, 10, DATA_DIR_NONE, 1973 (0xf<<2) | (3<<7), 1, 1974 "SYNCHRONIZE CACHE"); 1975 if (reply == 0) 1976 reply = do_synchronize_cache(common); 1977 break; 1978 1979 case TEST_UNIT_READY: 1980 common->data_size_from_cmnd = 0; 1981 reply = check_command(common, 6, DATA_DIR_NONE, 1982 0, 1, 1983 "TEST UNIT READY"); 1984 break; 1985 1986 /* 1987 * Although optional, this command is used by MS-Windows. We 1988 * support a minimal version: BytChk must be 0. 1989 */ 1990 case VERIFY: 1991 common->data_size_from_cmnd = 0; 1992 reply = check_command(common, 10, DATA_DIR_NONE, 1993 (1<<1) | (0xf<<2) | (3<<7), 1, 1994 "VERIFY"); 1995 if (reply == 0) 1996 reply = do_verify(common); 1997 break; 1998 1999 case WRITE_6: 2000 i = common->cmnd[4]; 2001 common->data_size_from_cmnd = (i == 0) ? 256 : i; 2002 reply = check_command_size_in_blocks(common, 6, 2003 DATA_DIR_FROM_HOST, 2004 (7<<1) | (1<<4), 1, 2005 "WRITE(6)"); 2006 if (reply == 0) 2007 reply = do_write(common); 2008 break; 2009 2010 case WRITE_10: 2011 common->data_size_from_cmnd = 2012 get_unaligned_be16(&common->cmnd[7]); 2013 reply = check_command_size_in_blocks(common, 10, 2014 DATA_DIR_FROM_HOST, 2015 (1<<1) | (0xf<<2) | (3<<7), 1, 2016 "WRITE(10)"); 2017 if (reply == 0) 2018 reply = do_write(common); 2019 break; 2020 2021 case WRITE_12: 2022 common->data_size_from_cmnd = 2023 get_unaligned_be32(&common->cmnd[6]); 2024 reply = check_command_size_in_blocks(common, 12, 2025 DATA_DIR_FROM_HOST, 2026 (1<<1) | (0xf<<2) | (0xf<<6), 1, 2027 "WRITE(12)"); 2028 if (reply == 0) 2029 reply = do_write(common); 2030 break; 2031 2032 /* 2033 * Some mandatory commands that we recognize but don't implement. 2034 * They don't mean much in this setting. It's left as an exercise 2035 * for anyone interested to implement RESERVE and RELEASE in terms 2036 * of Posix locks. 2037 */ 2038 case FORMAT_UNIT: 2039 case RELEASE: 2040 case RESERVE: 2041 case SEND_DIAGNOSTIC: 2042 /* Fall through */ 2043 2044 default: 2045 unknown_cmnd: 2046 common->data_size_from_cmnd = 0; 2047 sprintf(unknown, "Unknown x%02x", common->cmnd[0]); 2048 reply = check_command(common, common->cmnd_size, 2049 DATA_DIR_UNKNOWN, ~0, 0, unknown); 2050 if (reply == 0) { 2051 common->curlun->sense_data = SS_INVALID_COMMAND; 2052 reply = -EINVAL; 2053 } 2054 break; 2055 } 2056 up_read(&common->filesem); 2057 2058 if (reply == -EINTR || signal_pending(current)) 2059 return -EINTR; 2060 2061 /* Set up the single reply buffer for finish_reply() */ 2062 if (reply == -EINVAL) 2063 reply = 0; /* Error reply length */ 2064 if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) { 2065 reply = min((u32)reply, common->data_size_from_cmnd); 2066 bh->inreq->length = reply; 2067 bh->state = BUF_STATE_FULL; 2068 common->residue -= reply; 2069 } /* Otherwise it's already set */ 2070 2071 return 0; 2072 } 2073 2074 2075 /*-------------------------------------------------------------------------*/ 2076 2077 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh) 2078 { 2079 struct usb_request *req = bh->outreq; 2080 struct bulk_cb_wrap *cbw = req->buf; 2081 struct fsg_common *common = fsg->common; 2082 2083 /* Was this a real packet? Should it be ignored? */ 2084 if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags)) 2085 return -EINVAL; 2086 2087 /* Is the CBW valid? */ 2088 if (req->actual != US_BULK_CB_WRAP_LEN || 2089 cbw->Signature != cpu_to_le32( 2090 US_BULK_CB_SIGN)) { 2091 DBG(fsg, "invalid CBW: len %u sig 0x%x\n", 2092 req->actual, 2093 le32_to_cpu(cbw->Signature)); 2094 2095 /* 2096 * The Bulk-only spec says we MUST stall the IN endpoint 2097 * (6.6.1), so it's unavoidable. It also says we must 2098 * retain this state until the next reset, but there's 2099 * no way to tell the controller driver it should ignore 2100 * Clear-Feature(HALT) requests. 2101 * 2102 * We aren't required to halt the OUT endpoint; instead 2103 * we can simply accept and discard any data received 2104 * until the next reset. 2105 */ 2106 wedge_bulk_in_endpoint(fsg); 2107 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags); 2108 return -EINVAL; 2109 } 2110 2111 /* Is the CBW meaningful? */ 2112 if (cbw->Lun >= ARRAY_SIZE(common->luns) || 2113 cbw->Flags & ~US_BULK_FLAG_IN || cbw->Length <= 0 || 2114 cbw->Length > MAX_COMMAND_SIZE) { 2115 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, " 2116 "cmdlen %u\n", 2117 cbw->Lun, cbw->Flags, cbw->Length); 2118 2119 /* 2120 * We can do anything we want here, so let's stall the 2121 * bulk pipes if we are allowed to. 2122 */ 2123 if (common->can_stall) { 2124 fsg_set_halt(fsg, fsg->bulk_out); 2125 halt_bulk_in_endpoint(fsg); 2126 } 2127 return -EINVAL; 2128 } 2129 2130 /* Save the command for later */ 2131 common->cmnd_size = cbw->Length; 2132 memcpy(common->cmnd, cbw->CDB, common->cmnd_size); 2133 if (cbw->Flags & US_BULK_FLAG_IN) 2134 common->data_dir = DATA_DIR_TO_HOST; 2135 else 2136 common->data_dir = DATA_DIR_FROM_HOST; 2137 common->data_size = le32_to_cpu(cbw->DataTransferLength); 2138 if (common->data_size == 0) 2139 common->data_dir = DATA_DIR_NONE; 2140 common->lun = cbw->Lun; 2141 if (common->lun < ARRAY_SIZE(common->luns)) 2142 common->curlun = common->luns[common->lun]; 2143 else 2144 common->curlun = NULL; 2145 common->tag = cbw->Tag; 2146 return 0; 2147 } 2148 2149 static int get_next_command(struct fsg_common *common) 2150 { 2151 struct fsg_buffhd *bh; 2152 int rc = 0; 2153 2154 /* Wait for the next buffer to become available */ 2155 bh = common->next_buffhd_to_fill; 2156 rc = sleep_thread(common, true, bh); 2157 if (rc) 2158 return rc; 2159 2160 /* Queue a request to read a Bulk-only CBW */ 2161 set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN); 2162 if (!start_out_transfer(common, bh)) 2163 /* Don't know what to do if common->fsg is NULL */ 2164 return -EIO; 2165 2166 /* 2167 * We will drain the buffer in software, which means we 2168 * can reuse it for the next filling. No need to advance 2169 * next_buffhd_to_fill. 2170 */ 2171 2172 /* Wait for the CBW to arrive */ 2173 rc = sleep_thread(common, true, bh); 2174 if (rc) 2175 return rc; 2176 2177 rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO; 2178 bh->state = BUF_STATE_EMPTY; 2179 2180 return rc; 2181 } 2182 2183 2184 /*-------------------------------------------------------------------------*/ 2185 2186 static int alloc_request(struct fsg_common *common, struct usb_ep *ep, 2187 struct usb_request **preq) 2188 { 2189 *preq = usb_ep_alloc_request(ep, GFP_ATOMIC); 2190 if (*preq) 2191 return 0; 2192 ERROR(common, "can't allocate request for %s\n", ep->name); 2193 return -ENOMEM; 2194 } 2195 2196 /* Reset interface setting and re-init endpoint state (toggle etc). */ 2197 static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg) 2198 { 2199 struct fsg_dev *fsg; 2200 int i, rc = 0; 2201 2202 if (common->running) 2203 DBG(common, "reset interface\n"); 2204 2205 reset: 2206 /* Deallocate the requests */ 2207 if (common->fsg) { 2208 fsg = common->fsg; 2209 2210 for (i = 0; i < common->fsg_num_buffers; ++i) { 2211 struct fsg_buffhd *bh = &common->buffhds[i]; 2212 2213 if (bh->inreq) { 2214 usb_ep_free_request(fsg->bulk_in, bh->inreq); 2215 bh->inreq = NULL; 2216 } 2217 if (bh->outreq) { 2218 usb_ep_free_request(fsg->bulk_out, bh->outreq); 2219 bh->outreq = NULL; 2220 } 2221 } 2222 2223 /* Disable the endpoints */ 2224 if (fsg->bulk_in_enabled) { 2225 usb_ep_disable(fsg->bulk_in); 2226 fsg->bulk_in_enabled = 0; 2227 } 2228 if (fsg->bulk_out_enabled) { 2229 usb_ep_disable(fsg->bulk_out); 2230 fsg->bulk_out_enabled = 0; 2231 } 2232 2233 common->fsg = NULL; 2234 wake_up(&common->fsg_wait); 2235 } 2236 2237 common->running = 0; 2238 if (!new_fsg || rc) 2239 return rc; 2240 2241 common->fsg = new_fsg; 2242 fsg = common->fsg; 2243 2244 /* Enable the endpoints */ 2245 rc = config_ep_by_speed(common->gadget, &(fsg->function), fsg->bulk_in); 2246 if (rc) 2247 goto reset; 2248 rc = usb_ep_enable(fsg->bulk_in); 2249 if (rc) 2250 goto reset; 2251 fsg->bulk_in->driver_data = common; 2252 fsg->bulk_in_enabled = 1; 2253 2254 rc = config_ep_by_speed(common->gadget, &(fsg->function), 2255 fsg->bulk_out); 2256 if (rc) 2257 goto reset; 2258 rc = usb_ep_enable(fsg->bulk_out); 2259 if (rc) 2260 goto reset; 2261 fsg->bulk_out->driver_data = common; 2262 fsg->bulk_out_enabled = 1; 2263 common->bulk_out_maxpacket = usb_endpoint_maxp(fsg->bulk_out->desc); 2264 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags); 2265 2266 /* Allocate the requests */ 2267 for (i = 0; i < common->fsg_num_buffers; ++i) { 2268 struct fsg_buffhd *bh = &common->buffhds[i]; 2269 2270 rc = alloc_request(common, fsg->bulk_in, &bh->inreq); 2271 if (rc) 2272 goto reset; 2273 rc = alloc_request(common, fsg->bulk_out, &bh->outreq); 2274 if (rc) 2275 goto reset; 2276 bh->inreq->buf = bh->outreq->buf = bh->buf; 2277 bh->inreq->context = bh->outreq->context = bh; 2278 bh->inreq->complete = bulk_in_complete; 2279 bh->outreq->complete = bulk_out_complete; 2280 } 2281 2282 common->running = 1; 2283 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) 2284 if (common->luns[i]) 2285 common->luns[i]->unit_attention_data = 2286 SS_RESET_OCCURRED; 2287 return rc; 2288 } 2289 2290 2291 /****************************** ALT CONFIGS ******************************/ 2292 2293 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) 2294 { 2295 struct fsg_dev *fsg = fsg_from_func(f); 2296 2297 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg); 2298 return USB_GADGET_DELAYED_STATUS; 2299 } 2300 2301 static void fsg_disable(struct usb_function *f) 2302 { 2303 struct fsg_dev *fsg = fsg_from_func(f); 2304 2305 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); 2306 } 2307 2308 2309 /*-------------------------------------------------------------------------*/ 2310 2311 static void handle_exception(struct fsg_common *common) 2312 { 2313 int i; 2314 struct fsg_buffhd *bh; 2315 enum fsg_state old_state; 2316 struct fsg_lun *curlun; 2317 unsigned int exception_req_tag; 2318 struct fsg_dev *new_fsg; 2319 2320 /* 2321 * Clear the existing signals. Anything but SIGUSR1 is converted 2322 * into a high-priority EXIT exception. 2323 */ 2324 for (;;) { 2325 int sig = kernel_dequeue_signal(); 2326 if (!sig) 2327 break; 2328 if (sig != SIGUSR1) { 2329 spin_lock_irq(&common->lock); 2330 if (common->state < FSG_STATE_EXIT) 2331 DBG(common, "Main thread exiting on signal\n"); 2332 common->state = FSG_STATE_EXIT; 2333 spin_unlock_irq(&common->lock); 2334 } 2335 } 2336 2337 /* Cancel all the pending transfers */ 2338 if (likely(common->fsg)) { 2339 for (i = 0; i < common->fsg_num_buffers; ++i) { 2340 bh = &common->buffhds[i]; 2341 if (bh->state == BUF_STATE_SENDING) 2342 usb_ep_dequeue(common->fsg->bulk_in, bh->inreq); 2343 if (bh->state == BUF_STATE_RECEIVING) 2344 usb_ep_dequeue(common->fsg->bulk_out, 2345 bh->outreq); 2346 2347 /* Wait for a transfer to become idle */ 2348 if (sleep_thread(common, false, bh)) 2349 return; 2350 } 2351 2352 /* Clear out the controller's fifos */ 2353 if (common->fsg->bulk_in_enabled) 2354 usb_ep_fifo_flush(common->fsg->bulk_in); 2355 if (common->fsg->bulk_out_enabled) 2356 usb_ep_fifo_flush(common->fsg->bulk_out); 2357 } 2358 2359 /* 2360 * Reset the I/O buffer states and pointers, the SCSI 2361 * state, and the exception. Then invoke the handler. 2362 */ 2363 spin_lock_irq(&common->lock); 2364 2365 for (i = 0; i < common->fsg_num_buffers; ++i) { 2366 bh = &common->buffhds[i]; 2367 bh->state = BUF_STATE_EMPTY; 2368 } 2369 common->next_buffhd_to_fill = &common->buffhds[0]; 2370 common->next_buffhd_to_drain = &common->buffhds[0]; 2371 exception_req_tag = common->exception_req_tag; 2372 new_fsg = common->exception_arg; 2373 old_state = common->state; 2374 common->state = FSG_STATE_NORMAL; 2375 2376 if (old_state != FSG_STATE_ABORT_BULK_OUT) { 2377 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) { 2378 curlun = common->luns[i]; 2379 if (!curlun) 2380 continue; 2381 curlun->prevent_medium_removal = 0; 2382 curlun->sense_data = SS_NO_SENSE; 2383 curlun->unit_attention_data = SS_NO_SENSE; 2384 curlun->sense_data_info = 0; 2385 curlun->info_valid = 0; 2386 } 2387 } 2388 spin_unlock_irq(&common->lock); 2389 2390 /* Carry out any extra actions required for the exception */ 2391 switch (old_state) { 2392 case FSG_STATE_NORMAL: 2393 break; 2394 2395 case FSG_STATE_ABORT_BULK_OUT: 2396 send_status(common); 2397 break; 2398 2399 case FSG_STATE_PROTOCOL_RESET: 2400 /* 2401 * In case we were forced against our will to halt a 2402 * bulk endpoint, clear the halt now. (The SuperH UDC 2403 * requires this.) 2404 */ 2405 if (!fsg_is_set(common)) 2406 break; 2407 if (test_and_clear_bit(IGNORE_BULK_OUT, 2408 &common->fsg->atomic_bitflags)) 2409 usb_ep_clear_halt(common->fsg->bulk_in); 2410 2411 if (common->ep0_req_tag == exception_req_tag) 2412 ep0_queue(common); /* Complete the status stage */ 2413 2414 /* 2415 * Technically this should go here, but it would only be 2416 * a waste of time. Ditto for the INTERFACE_CHANGE and 2417 * CONFIG_CHANGE cases. 2418 */ 2419 /* for (i = 0; i < common->ARRAY_SIZE(common->luns); ++i) */ 2420 /* if (common->luns[i]) */ 2421 /* common->luns[i]->unit_attention_data = */ 2422 /* SS_RESET_OCCURRED; */ 2423 break; 2424 2425 case FSG_STATE_CONFIG_CHANGE: 2426 do_set_interface(common, new_fsg); 2427 if (new_fsg) 2428 usb_composite_setup_continue(common->cdev); 2429 break; 2430 2431 case FSG_STATE_EXIT: 2432 do_set_interface(common, NULL); /* Free resources */ 2433 spin_lock_irq(&common->lock); 2434 common->state = FSG_STATE_TERMINATED; /* Stop the thread */ 2435 spin_unlock_irq(&common->lock); 2436 break; 2437 2438 case FSG_STATE_TERMINATED: 2439 break; 2440 } 2441 } 2442 2443 2444 /*-------------------------------------------------------------------------*/ 2445 2446 static int fsg_main_thread(void *common_) 2447 { 2448 struct fsg_common *common = common_; 2449 int i; 2450 2451 /* 2452 * Allow the thread to be killed by a signal, but set the signal mask 2453 * to block everything but INT, TERM, KILL, and USR1. 2454 */ 2455 allow_signal(SIGINT); 2456 allow_signal(SIGTERM); 2457 allow_signal(SIGKILL); 2458 allow_signal(SIGUSR1); 2459 2460 /* Allow the thread to be frozen */ 2461 set_freezable(); 2462 2463 /* The main loop */ 2464 while (common->state != FSG_STATE_TERMINATED) { 2465 if (exception_in_progress(common) || signal_pending(current)) { 2466 handle_exception(common); 2467 continue; 2468 } 2469 2470 if (!common->running) { 2471 sleep_thread(common, true, NULL); 2472 continue; 2473 } 2474 2475 if (get_next_command(common) || exception_in_progress(common)) 2476 continue; 2477 if (do_scsi_command(common) || exception_in_progress(common)) 2478 continue; 2479 if (finish_reply(common) || exception_in_progress(common)) 2480 continue; 2481 send_status(common); 2482 } 2483 2484 spin_lock_irq(&common->lock); 2485 common->thread_task = NULL; 2486 spin_unlock_irq(&common->lock); 2487 2488 /* Eject media from all LUNs */ 2489 2490 down_write(&common->filesem); 2491 for (i = 0; i < ARRAY_SIZE(common->luns); i++) { 2492 struct fsg_lun *curlun = common->luns[i]; 2493 2494 if (curlun && fsg_lun_is_open(curlun)) 2495 fsg_lun_close(curlun); 2496 } 2497 up_write(&common->filesem); 2498 2499 /* Let fsg_unbind() know the thread has exited */ 2500 complete_and_exit(&common->thread_notifier, 0); 2501 } 2502 2503 2504 /*************************** DEVICE ATTRIBUTES ***************************/ 2505 2506 static ssize_t ro_show(struct device *dev, struct device_attribute *attr, char *buf) 2507 { 2508 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2509 2510 return fsg_show_ro(curlun, buf); 2511 } 2512 2513 static ssize_t nofua_show(struct device *dev, struct device_attribute *attr, 2514 char *buf) 2515 { 2516 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2517 2518 return fsg_show_nofua(curlun, buf); 2519 } 2520 2521 static ssize_t file_show(struct device *dev, struct device_attribute *attr, 2522 char *buf) 2523 { 2524 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2525 struct rw_semaphore *filesem = dev_get_drvdata(dev); 2526 2527 return fsg_show_file(curlun, filesem, buf); 2528 } 2529 2530 static ssize_t ro_store(struct device *dev, struct device_attribute *attr, 2531 const char *buf, size_t count) 2532 { 2533 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2534 struct rw_semaphore *filesem = dev_get_drvdata(dev); 2535 2536 return fsg_store_ro(curlun, filesem, buf, count); 2537 } 2538 2539 static ssize_t nofua_store(struct device *dev, struct device_attribute *attr, 2540 const char *buf, size_t count) 2541 { 2542 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2543 2544 return fsg_store_nofua(curlun, buf, count); 2545 } 2546 2547 static ssize_t file_store(struct device *dev, struct device_attribute *attr, 2548 const char *buf, size_t count) 2549 { 2550 struct fsg_lun *curlun = fsg_lun_from_dev(dev); 2551 struct rw_semaphore *filesem = dev_get_drvdata(dev); 2552 2553 return fsg_store_file(curlun, filesem, buf, count); 2554 } 2555 2556 static DEVICE_ATTR_RW(nofua); 2557 /* mode wil be set in fsg_lun_attr_is_visible() */ 2558 static DEVICE_ATTR(ro, 0, ro_show, ro_store); 2559 static DEVICE_ATTR(file, 0, file_show, file_store); 2560 2561 /****************************** FSG COMMON ******************************/ 2562 2563 static void fsg_lun_release(struct device *dev) 2564 { 2565 /* Nothing needs to be done */ 2566 } 2567 2568 static struct fsg_common *fsg_common_setup(struct fsg_common *common) 2569 { 2570 if (!common) { 2571 common = kzalloc(sizeof(*common), GFP_KERNEL); 2572 if (!common) 2573 return ERR_PTR(-ENOMEM); 2574 common->free_storage_on_release = 1; 2575 } else { 2576 common->free_storage_on_release = 0; 2577 } 2578 init_rwsem(&common->filesem); 2579 spin_lock_init(&common->lock); 2580 init_completion(&common->thread_notifier); 2581 init_waitqueue_head(&common->io_wait); 2582 init_waitqueue_head(&common->fsg_wait); 2583 common->state = FSG_STATE_TERMINATED; 2584 memset(common->luns, 0, sizeof(common->luns)); 2585 2586 return common; 2587 } 2588 2589 void fsg_common_set_sysfs(struct fsg_common *common, bool sysfs) 2590 { 2591 common->sysfs = sysfs; 2592 } 2593 EXPORT_SYMBOL_GPL(fsg_common_set_sysfs); 2594 2595 static void _fsg_common_free_buffers(struct fsg_buffhd *buffhds, unsigned n) 2596 { 2597 if (buffhds) { 2598 struct fsg_buffhd *bh = buffhds; 2599 while (n--) { 2600 kfree(bh->buf); 2601 ++bh; 2602 } 2603 kfree(buffhds); 2604 } 2605 } 2606 2607 int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n) 2608 { 2609 struct fsg_buffhd *bh, *buffhds; 2610 int i; 2611 2612 buffhds = kcalloc(n, sizeof(*buffhds), GFP_KERNEL); 2613 if (!buffhds) 2614 return -ENOMEM; 2615 2616 /* Data buffers cyclic list */ 2617 bh = buffhds; 2618 i = n; 2619 goto buffhds_first_it; 2620 do { 2621 bh->next = bh + 1; 2622 ++bh; 2623 buffhds_first_it: 2624 bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL); 2625 if (unlikely(!bh->buf)) 2626 goto error_release; 2627 } while (--i); 2628 bh->next = buffhds; 2629 2630 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); 2631 common->fsg_num_buffers = n; 2632 common->buffhds = buffhds; 2633 2634 return 0; 2635 2636 error_release: 2637 /* 2638 * "buf"s pointed to by heads after n - i are NULL 2639 * so releasing them won't hurt 2640 */ 2641 _fsg_common_free_buffers(buffhds, n); 2642 2643 return -ENOMEM; 2644 } 2645 EXPORT_SYMBOL_GPL(fsg_common_set_num_buffers); 2646 2647 void fsg_common_remove_lun(struct fsg_lun *lun) 2648 { 2649 if (device_is_registered(&lun->dev)) 2650 device_unregister(&lun->dev); 2651 fsg_lun_close(lun); 2652 kfree(lun); 2653 } 2654 EXPORT_SYMBOL_GPL(fsg_common_remove_lun); 2655 2656 static void _fsg_common_remove_luns(struct fsg_common *common, int n) 2657 { 2658 int i; 2659 2660 for (i = 0; i < n; ++i) 2661 if (common->luns[i]) { 2662 fsg_common_remove_lun(common->luns[i]); 2663 common->luns[i] = NULL; 2664 } 2665 } 2666 2667 void fsg_common_remove_luns(struct fsg_common *common) 2668 { 2669 _fsg_common_remove_luns(common, ARRAY_SIZE(common->luns)); 2670 } 2671 EXPORT_SYMBOL_GPL(fsg_common_remove_luns); 2672 2673 void fsg_common_free_buffers(struct fsg_common *common) 2674 { 2675 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); 2676 common->buffhds = NULL; 2677 } 2678 EXPORT_SYMBOL_GPL(fsg_common_free_buffers); 2679 2680 int fsg_common_set_cdev(struct fsg_common *common, 2681 struct usb_composite_dev *cdev, bool can_stall) 2682 { 2683 struct usb_string *us; 2684 2685 common->gadget = cdev->gadget; 2686 common->ep0 = cdev->gadget->ep0; 2687 common->ep0req = cdev->req; 2688 common->cdev = cdev; 2689 2690 us = usb_gstrings_attach(cdev, fsg_strings_array, 2691 ARRAY_SIZE(fsg_strings)); 2692 if (IS_ERR(us)) 2693 return PTR_ERR(us); 2694 2695 fsg_intf_desc.iInterface = us[FSG_STRING_INTERFACE].id; 2696 2697 /* 2698 * Some peripheral controllers are known not to be able to 2699 * halt bulk endpoints correctly. If one of them is present, 2700 * disable stalls. 2701 */ 2702 common->can_stall = can_stall && 2703 gadget_is_stall_supported(common->gadget); 2704 2705 return 0; 2706 } 2707 EXPORT_SYMBOL_GPL(fsg_common_set_cdev); 2708 2709 static struct attribute *fsg_lun_dev_attrs[] = { 2710 &dev_attr_ro.attr, 2711 &dev_attr_file.attr, 2712 &dev_attr_nofua.attr, 2713 NULL 2714 }; 2715 2716 static umode_t fsg_lun_dev_is_visible(struct kobject *kobj, 2717 struct attribute *attr, int idx) 2718 { 2719 struct device *dev = kobj_to_dev(kobj); 2720 struct fsg_lun *lun = fsg_lun_from_dev(dev); 2721 2722 if (attr == &dev_attr_ro.attr) 2723 return lun->cdrom ? S_IRUGO : (S_IWUSR | S_IRUGO); 2724 if (attr == &dev_attr_file.attr) 2725 return lun->removable ? (S_IWUSR | S_IRUGO) : S_IRUGO; 2726 return attr->mode; 2727 } 2728 2729 static const struct attribute_group fsg_lun_dev_group = { 2730 .attrs = fsg_lun_dev_attrs, 2731 .is_visible = fsg_lun_dev_is_visible, 2732 }; 2733 2734 static const struct attribute_group *fsg_lun_dev_groups[] = { 2735 &fsg_lun_dev_group, 2736 NULL 2737 }; 2738 2739 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg, 2740 unsigned int id, const char *name, 2741 const char **name_pfx) 2742 { 2743 struct fsg_lun *lun; 2744 char *pathbuf, *p; 2745 int rc = -ENOMEM; 2746 2747 if (id >= ARRAY_SIZE(common->luns)) 2748 return -ENODEV; 2749 2750 if (common->luns[id]) 2751 return -EBUSY; 2752 2753 if (!cfg->filename && !cfg->removable) { 2754 pr_err("no file given for LUN%d\n", id); 2755 return -EINVAL; 2756 } 2757 2758 lun = kzalloc(sizeof(*lun), GFP_KERNEL); 2759 if (!lun) 2760 return -ENOMEM; 2761 2762 lun->name_pfx = name_pfx; 2763 2764 lun->cdrom = !!cfg->cdrom; 2765 lun->ro = cfg->cdrom || cfg->ro; 2766 lun->initially_ro = lun->ro; 2767 lun->removable = !!cfg->removable; 2768 2769 if (!common->sysfs) { 2770 /* we DON'T own the name!*/ 2771 lun->name = name; 2772 } else { 2773 lun->dev.release = fsg_lun_release; 2774 lun->dev.parent = &common->gadget->dev; 2775 lun->dev.groups = fsg_lun_dev_groups; 2776 dev_set_drvdata(&lun->dev, &common->filesem); 2777 dev_set_name(&lun->dev, "%s", name); 2778 lun->name = dev_name(&lun->dev); 2779 2780 rc = device_register(&lun->dev); 2781 if (rc) { 2782 pr_info("failed to register LUN%d: %d\n", id, rc); 2783 put_device(&lun->dev); 2784 goto error_sysfs; 2785 } 2786 } 2787 2788 common->luns[id] = lun; 2789 2790 if (cfg->filename) { 2791 rc = fsg_lun_open(lun, cfg->filename); 2792 if (rc) 2793 goto error_lun; 2794 } 2795 2796 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 2797 p = "(no medium)"; 2798 if (fsg_lun_is_open(lun)) { 2799 p = "(error)"; 2800 if (pathbuf) { 2801 p = file_path(lun->filp, pathbuf, PATH_MAX); 2802 if (IS_ERR(p)) 2803 p = "(error)"; 2804 } 2805 } 2806 pr_info("LUN: %s%s%sfile: %s\n", 2807 lun->removable ? "removable " : "", 2808 lun->ro ? "read only " : "", 2809 lun->cdrom ? "CD-ROM " : "", 2810 p); 2811 kfree(pathbuf); 2812 2813 return 0; 2814 2815 error_lun: 2816 if (device_is_registered(&lun->dev)) 2817 device_unregister(&lun->dev); 2818 fsg_lun_close(lun); 2819 common->luns[id] = NULL; 2820 error_sysfs: 2821 kfree(lun); 2822 return rc; 2823 } 2824 EXPORT_SYMBOL_GPL(fsg_common_create_lun); 2825 2826 int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg) 2827 { 2828 char buf[8]; /* enough for 100000000 different numbers, decimal */ 2829 int i, rc; 2830 2831 fsg_common_remove_luns(common); 2832 2833 for (i = 0; i < cfg->nluns; ++i) { 2834 snprintf(buf, sizeof(buf), "lun%d", i); 2835 rc = fsg_common_create_lun(common, &cfg->luns[i], i, buf, NULL); 2836 if (rc) 2837 goto fail; 2838 } 2839 2840 pr_info("Number of LUNs=%d\n", cfg->nluns); 2841 2842 return 0; 2843 2844 fail: 2845 _fsg_common_remove_luns(common, i); 2846 return rc; 2847 } 2848 EXPORT_SYMBOL_GPL(fsg_common_create_luns); 2849 2850 void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn, 2851 const char *pn) 2852 { 2853 int i; 2854 2855 /* Prepare inquiryString */ 2856 i = get_default_bcdDevice(); 2857 snprintf(common->inquiry_string, sizeof(common->inquiry_string), 2858 "%-8s%-16s%04x", vn ?: "Linux", 2859 /* Assume product name dependent on the first LUN */ 2860 pn ?: ((*common->luns)->cdrom 2861 ? "File-CD Gadget" 2862 : "File-Stor Gadget"), 2863 i); 2864 } 2865 EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string); 2866 2867 static void fsg_common_release(struct fsg_common *common) 2868 { 2869 int i; 2870 2871 /* If the thread isn't already dead, tell it to exit now */ 2872 if (common->state != FSG_STATE_TERMINATED) { 2873 raise_exception(common, FSG_STATE_EXIT); 2874 wait_for_completion(&common->thread_notifier); 2875 } 2876 2877 for (i = 0; i < ARRAY_SIZE(common->luns); ++i) { 2878 struct fsg_lun *lun = common->luns[i]; 2879 if (!lun) 2880 continue; 2881 fsg_lun_close(lun); 2882 if (device_is_registered(&lun->dev)) 2883 device_unregister(&lun->dev); 2884 kfree(lun); 2885 } 2886 2887 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers); 2888 if (common->free_storage_on_release) 2889 kfree(common); 2890 } 2891 2892 2893 /*-------------------------------------------------------------------------*/ 2894 2895 static int fsg_bind(struct usb_configuration *c, struct usb_function *f) 2896 { 2897 struct fsg_dev *fsg = fsg_from_func(f); 2898 struct fsg_common *common = fsg->common; 2899 struct usb_gadget *gadget = c->cdev->gadget; 2900 int i; 2901 struct usb_ep *ep; 2902 unsigned max_burst; 2903 int ret; 2904 struct fsg_opts *opts; 2905 2906 /* Don't allow to bind if we don't have at least one LUN */ 2907 ret = _fsg_common_get_max_lun(common); 2908 if (ret < 0) { 2909 pr_err("There should be at least one LUN.\n"); 2910 return -EINVAL; 2911 } 2912 2913 opts = fsg_opts_from_func_inst(f->fi); 2914 if (!opts->no_configfs) { 2915 ret = fsg_common_set_cdev(fsg->common, c->cdev, 2916 fsg->common->can_stall); 2917 if (ret) 2918 return ret; 2919 fsg_common_set_inquiry_string(fsg->common, NULL, NULL); 2920 } 2921 2922 if (!common->thread_task) { 2923 common->state = FSG_STATE_NORMAL; 2924 common->thread_task = 2925 kthread_create(fsg_main_thread, common, "file-storage"); 2926 if (IS_ERR(common->thread_task)) { 2927 ret = PTR_ERR(common->thread_task); 2928 common->thread_task = NULL; 2929 common->state = FSG_STATE_TERMINATED; 2930 return ret; 2931 } 2932 DBG(common, "I/O thread pid: %d\n", 2933 task_pid_nr(common->thread_task)); 2934 wake_up_process(common->thread_task); 2935 } 2936 2937 fsg->gadget = gadget; 2938 2939 /* New interface */ 2940 i = usb_interface_id(c, f); 2941 if (i < 0) 2942 goto fail; 2943 fsg_intf_desc.bInterfaceNumber = i; 2944 fsg->interface_number = i; 2945 2946 /* Find all the endpoints we will use */ 2947 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc); 2948 if (!ep) 2949 goto autoconf_fail; 2950 fsg->bulk_in = ep; 2951 2952 ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc); 2953 if (!ep) 2954 goto autoconf_fail; 2955 fsg->bulk_out = ep; 2956 2957 /* Assume endpoint addresses are the same for both speeds */ 2958 fsg_hs_bulk_in_desc.bEndpointAddress = 2959 fsg_fs_bulk_in_desc.bEndpointAddress; 2960 fsg_hs_bulk_out_desc.bEndpointAddress = 2961 fsg_fs_bulk_out_desc.bEndpointAddress; 2962 2963 /* Calculate bMaxBurst, we know packet size is 1024 */ 2964 max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15); 2965 2966 fsg_ss_bulk_in_desc.bEndpointAddress = 2967 fsg_fs_bulk_in_desc.bEndpointAddress; 2968 fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst; 2969 2970 fsg_ss_bulk_out_desc.bEndpointAddress = 2971 fsg_fs_bulk_out_desc.bEndpointAddress; 2972 fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst; 2973 2974 ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function, 2975 fsg_ss_function, fsg_ss_function); 2976 if (ret) 2977 goto autoconf_fail; 2978 2979 return 0; 2980 2981 autoconf_fail: 2982 ERROR(fsg, "unable to autoconfigure all endpoints\n"); 2983 i = -ENOTSUPP; 2984 fail: 2985 /* terminate the thread */ 2986 if (fsg->common->state != FSG_STATE_TERMINATED) { 2987 raise_exception(fsg->common, FSG_STATE_EXIT); 2988 wait_for_completion(&fsg->common->thread_notifier); 2989 } 2990 return i; 2991 } 2992 2993 /****************************** ALLOCATE FUNCTION *************************/ 2994 2995 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f) 2996 { 2997 struct fsg_dev *fsg = fsg_from_func(f); 2998 struct fsg_common *common = fsg->common; 2999 3000 DBG(fsg, "unbind\n"); 3001 if (fsg->common->fsg == fsg) { 3002 __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); 3003 /* FIXME: make interruptible or killable somehow? */ 3004 wait_event(common->fsg_wait, common->fsg != fsg); 3005 } 3006 3007 usb_free_all_descriptors(&fsg->function); 3008 } 3009 3010 static inline struct fsg_lun_opts *to_fsg_lun_opts(struct config_item *item) 3011 { 3012 return container_of(to_config_group(item), struct fsg_lun_opts, group); 3013 } 3014 3015 static inline struct fsg_opts *to_fsg_opts(struct config_item *item) 3016 { 3017 return container_of(to_config_group(item), struct fsg_opts, 3018 func_inst.group); 3019 } 3020 3021 static void fsg_lun_attr_release(struct config_item *item) 3022 { 3023 struct fsg_lun_opts *lun_opts; 3024 3025 lun_opts = to_fsg_lun_opts(item); 3026 kfree(lun_opts); 3027 } 3028 3029 static struct configfs_item_operations fsg_lun_item_ops = { 3030 .release = fsg_lun_attr_release, 3031 }; 3032 3033 static ssize_t fsg_lun_opts_file_show(struct config_item *item, char *page) 3034 { 3035 struct fsg_lun_opts *opts = to_fsg_lun_opts(item); 3036 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent); 3037 3038 return fsg_show_file(opts->lun, &fsg_opts->common->filesem, page); 3039 } 3040 3041 static ssize_t fsg_lun_opts_file_store(struct config_item *item, 3042 const char *page, size_t len) 3043 { 3044 struct fsg_lun_opts *opts = to_fsg_lun_opts(item); 3045 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent); 3046 3047 return fsg_store_file(opts->lun, &fsg_opts->common->filesem, page, len); 3048 } 3049 3050 CONFIGFS_ATTR(fsg_lun_opts_, file); 3051 3052 static ssize_t fsg_lun_opts_ro_show(struct config_item *item, char *page) 3053 { 3054 return fsg_show_ro(to_fsg_lun_opts(item)->lun, page); 3055 } 3056 3057 static ssize_t fsg_lun_opts_ro_store(struct config_item *item, 3058 const char *page, size_t len) 3059 { 3060 struct fsg_lun_opts *opts = to_fsg_lun_opts(item); 3061 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent); 3062 3063 return fsg_store_ro(opts->lun, &fsg_opts->common->filesem, page, len); 3064 } 3065 3066 CONFIGFS_ATTR(fsg_lun_opts_, ro); 3067 3068 static ssize_t fsg_lun_opts_removable_show(struct config_item *item, 3069 char *page) 3070 { 3071 return fsg_show_removable(to_fsg_lun_opts(item)->lun, page); 3072 } 3073 3074 static ssize_t fsg_lun_opts_removable_store(struct config_item *item, 3075 const char *page, size_t len) 3076 { 3077 return fsg_store_removable(to_fsg_lun_opts(item)->lun, page, len); 3078 } 3079 3080 CONFIGFS_ATTR(fsg_lun_opts_, removable); 3081 3082 static ssize_t fsg_lun_opts_cdrom_show(struct config_item *item, char *page) 3083 { 3084 return fsg_show_cdrom(to_fsg_lun_opts(item)->lun, page); 3085 } 3086 3087 static ssize_t fsg_lun_opts_cdrom_store(struct config_item *item, 3088 const char *page, size_t len) 3089 { 3090 struct fsg_lun_opts *opts = to_fsg_lun_opts(item); 3091 struct fsg_opts *fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent); 3092 3093 return fsg_store_cdrom(opts->lun, &fsg_opts->common->filesem, page, 3094 len); 3095 } 3096 3097 CONFIGFS_ATTR(fsg_lun_opts_, cdrom); 3098 3099 static ssize_t fsg_lun_opts_nofua_show(struct config_item *item, char *page) 3100 { 3101 return fsg_show_nofua(to_fsg_lun_opts(item)->lun, page); 3102 } 3103 3104 static ssize_t fsg_lun_opts_nofua_store(struct config_item *item, 3105 const char *page, size_t len) 3106 { 3107 return fsg_store_nofua(to_fsg_lun_opts(item)->lun, page, len); 3108 } 3109 3110 CONFIGFS_ATTR(fsg_lun_opts_, nofua); 3111 3112 static ssize_t fsg_lun_opts_inquiry_string_show(struct config_item *item, 3113 char *page) 3114 { 3115 return fsg_show_inquiry_string(to_fsg_lun_opts(item)->lun, page); 3116 } 3117 3118 static ssize_t fsg_lun_opts_inquiry_string_store(struct config_item *item, 3119 const char *page, size_t len) 3120 { 3121 return fsg_store_inquiry_string(to_fsg_lun_opts(item)->lun, page, len); 3122 } 3123 3124 CONFIGFS_ATTR(fsg_lun_opts_, inquiry_string); 3125 3126 static struct configfs_attribute *fsg_lun_attrs[] = { 3127 &fsg_lun_opts_attr_file, 3128 &fsg_lun_opts_attr_ro, 3129 &fsg_lun_opts_attr_removable, 3130 &fsg_lun_opts_attr_cdrom, 3131 &fsg_lun_opts_attr_nofua, 3132 &fsg_lun_opts_attr_inquiry_string, 3133 NULL, 3134 }; 3135 3136 static const struct config_item_type fsg_lun_type = { 3137 .ct_item_ops = &fsg_lun_item_ops, 3138 .ct_attrs = fsg_lun_attrs, 3139 .ct_owner = THIS_MODULE, 3140 }; 3141 3142 static struct config_group *fsg_lun_make(struct config_group *group, 3143 const char *name) 3144 { 3145 struct fsg_lun_opts *opts; 3146 struct fsg_opts *fsg_opts; 3147 struct fsg_lun_config config; 3148 char *num_str; 3149 u8 num; 3150 int ret; 3151 3152 num_str = strchr(name, '.'); 3153 if (!num_str) { 3154 pr_err("Unable to locate . in LUN.NUMBER\n"); 3155 return ERR_PTR(-EINVAL); 3156 } 3157 num_str++; 3158 3159 ret = kstrtou8(num_str, 0, &num); 3160 if (ret) 3161 return ERR_PTR(ret); 3162 3163 fsg_opts = to_fsg_opts(&group->cg_item); 3164 if (num >= FSG_MAX_LUNS) 3165 return ERR_PTR(-ERANGE); 3166 num = array_index_nospec(num, FSG_MAX_LUNS); 3167 3168 mutex_lock(&fsg_opts->lock); 3169 if (fsg_opts->refcnt || fsg_opts->common->luns[num]) { 3170 ret = -EBUSY; 3171 goto out; 3172 } 3173 3174 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 3175 if (!opts) { 3176 ret = -ENOMEM; 3177 goto out; 3178 } 3179 3180 memset(&config, 0, sizeof(config)); 3181 config.removable = true; 3182 3183 ret = fsg_common_create_lun(fsg_opts->common, &config, num, name, 3184 (const char **)&group->cg_item.ci_name); 3185 if (ret) { 3186 kfree(opts); 3187 goto out; 3188 } 3189 opts->lun = fsg_opts->common->luns[num]; 3190 opts->lun_id = num; 3191 mutex_unlock(&fsg_opts->lock); 3192 3193 config_group_init_type_name(&opts->group, name, &fsg_lun_type); 3194 3195 return &opts->group; 3196 out: 3197 mutex_unlock(&fsg_opts->lock); 3198 return ERR_PTR(ret); 3199 } 3200 3201 static void fsg_lun_drop(struct config_group *group, struct config_item *item) 3202 { 3203 struct fsg_lun_opts *lun_opts; 3204 struct fsg_opts *fsg_opts; 3205 3206 lun_opts = to_fsg_lun_opts(item); 3207 fsg_opts = to_fsg_opts(&group->cg_item); 3208 3209 mutex_lock(&fsg_opts->lock); 3210 if (fsg_opts->refcnt) { 3211 struct config_item *gadget; 3212 3213 gadget = group->cg_item.ci_parent->ci_parent; 3214 unregister_gadget_item(gadget); 3215 } 3216 3217 fsg_common_remove_lun(lun_opts->lun); 3218 fsg_opts->common->luns[lun_opts->lun_id] = NULL; 3219 lun_opts->lun_id = 0; 3220 mutex_unlock(&fsg_opts->lock); 3221 3222 config_item_put(item); 3223 } 3224 3225 static void fsg_attr_release(struct config_item *item) 3226 { 3227 struct fsg_opts *opts = to_fsg_opts(item); 3228 3229 usb_put_function_instance(&opts->func_inst); 3230 } 3231 3232 static struct configfs_item_operations fsg_item_ops = { 3233 .release = fsg_attr_release, 3234 }; 3235 3236 static ssize_t fsg_opts_stall_show(struct config_item *item, char *page) 3237 { 3238 struct fsg_opts *opts = to_fsg_opts(item); 3239 int result; 3240 3241 mutex_lock(&opts->lock); 3242 result = sprintf(page, "%d", opts->common->can_stall); 3243 mutex_unlock(&opts->lock); 3244 3245 return result; 3246 } 3247 3248 static ssize_t fsg_opts_stall_store(struct config_item *item, const char *page, 3249 size_t len) 3250 { 3251 struct fsg_opts *opts = to_fsg_opts(item); 3252 int ret; 3253 bool stall; 3254 3255 mutex_lock(&opts->lock); 3256 3257 if (opts->refcnt) { 3258 mutex_unlock(&opts->lock); 3259 return -EBUSY; 3260 } 3261 3262 ret = strtobool(page, &stall); 3263 if (!ret) { 3264 opts->common->can_stall = stall; 3265 ret = len; 3266 } 3267 3268 mutex_unlock(&opts->lock); 3269 3270 return ret; 3271 } 3272 3273 CONFIGFS_ATTR(fsg_opts_, stall); 3274 3275 #ifdef CONFIG_USB_GADGET_DEBUG_FILES 3276 static ssize_t fsg_opts_num_buffers_show(struct config_item *item, char *page) 3277 { 3278 struct fsg_opts *opts = to_fsg_opts(item); 3279 int result; 3280 3281 mutex_lock(&opts->lock); 3282 result = sprintf(page, "%d", opts->common->fsg_num_buffers); 3283 mutex_unlock(&opts->lock); 3284 3285 return result; 3286 } 3287 3288 static ssize_t fsg_opts_num_buffers_store(struct config_item *item, 3289 const char *page, size_t len) 3290 { 3291 struct fsg_opts *opts = to_fsg_opts(item); 3292 int ret; 3293 u8 num; 3294 3295 mutex_lock(&opts->lock); 3296 if (opts->refcnt) { 3297 ret = -EBUSY; 3298 goto end; 3299 } 3300 ret = kstrtou8(page, 0, &num); 3301 if (ret) 3302 goto end; 3303 3304 ret = fsg_common_set_num_buffers(opts->common, num); 3305 if (ret) 3306 goto end; 3307 ret = len; 3308 3309 end: 3310 mutex_unlock(&opts->lock); 3311 return ret; 3312 } 3313 3314 CONFIGFS_ATTR(fsg_opts_, num_buffers); 3315 #endif 3316 3317 static struct configfs_attribute *fsg_attrs[] = { 3318 &fsg_opts_attr_stall, 3319 #ifdef CONFIG_USB_GADGET_DEBUG_FILES 3320 &fsg_opts_attr_num_buffers, 3321 #endif 3322 NULL, 3323 }; 3324 3325 static struct configfs_group_operations fsg_group_ops = { 3326 .make_group = fsg_lun_make, 3327 .drop_item = fsg_lun_drop, 3328 }; 3329 3330 static const struct config_item_type fsg_func_type = { 3331 .ct_item_ops = &fsg_item_ops, 3332 .ct_group_ops = &fsg_group_ops, 3333 .ct_attrs = fsg_attrs, 3334 .ct_owner = THIS_MODULE, 3335 }; 3336 3337 static void fsg_free_inst(struct usb_function_instance *fi) 3338 { 3339 struct fsg_opts *opts; 3340 3341 opts = fsg_opts_from_func_inst(fi); 3342 fsg_common_release(opts->common); 3343 kfree(opts); 3344 } 3345 3346 static struct usb_function_instance *fsg_alloc_inst(void) 3347 { 3348 struct fsg_opts *opts; 3349 struct fsg_lun_config config; 3350 int rc; 3351 3352 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 3353 if (!opts) 3354 return ERR_PTR(-ENOMEM); 3355 mutex_init(&opts->lock); 3356 opts->func_inst.free_func_inst = fsg_free_inst; 3357 opts->common = fsg_common_setup(opts->common); 3358 if (IS_ERR(opts->common)) { 3359 rc = PTR_ERR(opts->common); 3360 goto release_opts; 3361 } 3362 3363 rc = fsg_common_set_num_buffers(opts->common, 3364 CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS); 3365 if (rc) 3366 goto release_common; 3367 3368 pr_info(FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n"); 3369 3370 memset(&config, 0, sizeof(config)); 3371 config.removable = true; 3372 rc = fsg_common_create_lun(opts->common, &config, 0, "lun.0", 3373 (const char **)&opts->func_inst.group.cg_item.ci_name); 3374 if (rc) 3375 goto release_buffers; 3376 3377 opts->lun0.lun = opts->common->luns[0]; 3378 opts->lun0.lun_id = 0; 3379 3380 config_group_init_type_name(&opts->func_inst.group, "", &fsg_func_type); 3381 3382 config_group_init_type_name(&opts->lun0.group, "lun.0", &fsg_lun_type); 3383 configfs_add_default_group(&opts->lun0.group, &opts->func_inst.group); 3384 3385 return &opts->func_inst; 3386 3387 release_buffers: 3388 fsg_common_free_buffers(opts->common); 3389 release_common: 3390 kfree(opts->common); 3391 release_opts: 3392 kfree(opts); 3393 return ERR_PTR(rc); 3394 } 3395 3396 static void fsg_free(struct usb_function *f) 3397 { 3398 struct fsg_dev *fsg; 3399 struct fsg_opts *opts; 3400 3401 fsg = container_of(f, struct fsg_dev, function); 3402 opts = container_of(f->fi, struct fsg_opts, func_inst); 3403 3404 mutex_lock(&opts->lock); 3405 opts->refcnt--; 3406 mutex_unlock(&opts->lock); 3407 3408 kfree(fsg); 3409 } 3410 3411 static struct usb_function *fsg_alloc(struct usb_function_instance *fi) 3412 { 3413 struct fsg_opts *opts = fsg_opts_from_func_inst(fi); 3414 struct fsg_common *common = opts->common; 3415 struct fsg_dev *fsg; 3416 3417 fsg = kzalloc(sizeof(*fsg), GFP_KERNEL); 3418 if (unlikely(!fsg)) 3419 return ERR_PTR(-ENOMEM); 3420 3421 mutex_lock(&opts->lock); 3422 opts->refcnt++; 3423 mutex_unlock(&opts->lock); 3424 3425 fsg->function.name = FSG_DRIVER_DESC; 3426 fsg->function.bind = fsg_bind; 3427 fsg->function.unbind = fsg_unbind; 3428 fsg->function.setup = fsg_setup; 3429 fsg->function.set_alt = fsg_set_alt; 3430 fsg->function.disable = fsg_disable; 3431 fsg->function.free_func = fsg_free; 3432 3433 fsg->common = common; 3434 3435 return &fsg->function; 3436 } 3437 3438 DECLARE_USB_FUNCTION_INIT(mass_storage, fsg_alloc_inst, fsg_alloc); 3439 MODULE_LICENSE("GPL"); 3440 MODULE_AUTHOR("Michal Nazarewicz"); 3441 3442 /************************* Module parameters *************************/ 3443 3444 3445 void fsg_config_from_params(struct fsg_config *cfg, 3446 const struct fsg_module_parameters *params, 3447 unsigned int fsg_num_buffers) 3448 { 3449 struct fsg_lun_config *lun; 3450 unsigned i; 3451 3452 /* Configure LUNs */ 3453 cfg->nluns = 3454 min(params->luns ?: (params->file_count ?: 1u), 3455 (unsigned)FSG_MAX_LUNS); 3456 for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) { 3457 lun->ro = !!params->ro[i]; 3458 lun->cdrom = !!params->cdrom[i]; 3459 lun->removable = !!params->removable[i]; 3460 lun->filename = 3461 params->file_count > i && params->file[i][0] 3462 ? params->file[i] 3463 : NULL; 3464 } 3465 3466 /* Let MSF use defaults */ 3467 cfg->vendor_name = NULL; 3468 cfg->product_name = NULL; 3469 3470 cfg->ops = NULL; 3471 cfg->private_data = NULL; 3472 3473 /* Finalise */ 3474 cfg->can_stall = params->stall; 3475 cfg->fsg_num_buffers = fsg_num_buffers; 3476 } 3477 EXPORT_SYMBOL_GPL(fsg_config_from_params); 3478