kernel: bump 4.14 to 4.14.115
[openwrt/openwrt.git] / target / linux / brcm2708 / patches-4.14 / 950-0037-Add-dwc_otg-driver.patch
1 From 451dab6b675762f8889979b04ee3e529eee915e8 Mon Sep 17 00:00:00 2001
2 From: popcornmix <popcornmix@gmail.com>
3 Date: Wed, 1 May 2013 19:46:17 +0100
4 Subject: [PATCH 037/454] Add dwc_otg driver
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 Signed-off-by: popcornmix <popcornmix@gmail.com>
10
11 usb: dwc: fix lockdep false positive
12
13 Signed-off-by: Kari Suvanto <karis79@gmail.com>
14
15 usb: dwc: fix inconsistent lock state
16
17 Signed-off-by: Kari Suvanto <karis79@gmail.com>
18
19 Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
20 Thanks to Gordon and Costas
21
22 Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.
23
24 Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh
25
26 Make sure we wait for the reset to finish
27
28 dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
29 memory corruption, escalating to OOPS under high USB load.
30
31 dwc_otg: Fix unsafe access of QTD during URB enqueue
32
33 In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
34 transaction could complete almost immediately after the qtd was assigned
35 to a host channel during URB enqueue, which meant the qtd pointer was no
36 longer valid having been completed and removed. Usually, this resulted in
37 an OOPS during URB submission. By predetermining whether transactions
38 need to be queued or not, this unsafe pointer access is avoided.
39
40 This bug was only evident on the Pi model A where a device was attached
41 that had no periodic endpoints (e.g. USB pendrive or some wlan devices).
42
43 dwc_otg: Fix incorrect URB allocation error handling
44
45 If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
46 because for some reason a member of the *unallocated* struct was set to
47 zero. Error handling changed to fail correctly.
48
49 dwc_otg: fix potential use-after-free case in interrupt handler
50
51 If a transaction had previously aborted, certain interrupts are
52 enabled to track error counts and reset where necessary. On IN
53 endpoints the host generates an ACK interrupt near-simultaneously
54 with completion of transfer. In the case where this transfer had
55 previously had an error, this results in a use-after-free on
56 the QTD memory space with a 1-byte length being overwritten to
57 0x00.
58
59 dwc_otg: add handling of SPLIT transaction data toggle errors
60
61 Previously a data toggle error on packets from a USB1.1 device behind
62 a TT would result in the Pi locking up as the driver never handled
63 the associated interrupt. Patch adds basic retry mechanism and
64 interrupt acknowledgement to cater for either a chance toggle error or
65 for devices that have a broken initial toggle state (FT8U232/FT232BM).
66
67 dwc_otg: implement tasklet for returning URBs to usbcore hcd layer
68
69 The dwc_otg driver interrupt handler for transfer completion will spend
70 a very long time with interrupts disabled when a URB is completed -
71 this is because usb_hcd_giveback_urb is called from within the handler
72 which for a USB device driver with complicated processing (e.g. webcam)
73 will take an exorbitant amount of time to complete. This results in
74 missed completion interrupts for other USB packets which lead to them
75 being dropped due to microframe overruns.
76
77 This patch splits returning the URB to the usb hcd layer into a
78 high-priority tasklet. This will have most benefit for isochronous IN
79 transfers but will also have incidental benefit where multiple periodic
80 devices are active at once.
81
82 dwc_otg: fix NAK holdoff and allow on split transactions only
83
84 This corrects a bug where if a single active non-periodic endpoint
85 had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
86 would get skipped and never get queued again. This would result in
87 a silent device until error detection (automatic or otherwise) would
88 either reset the device or flush and requeue the URBs.
89
90 Additionally the NAK holdoff was enabled for all transactions - this
91 would potentially stall a HS endpoint for 1ms if a previous error state
92 enabled this interrupt and the next response was a NAK. Fix so that
93 only split transactions get held off.
94
95 dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler
96
97 usb_hcd_unlink_urb_from_ep must be called with the HCD lock held. Calling it
98 asynchronously in the tasklet was not safe (regression in
99 c4564d4a1a0a9b10d4419e48239f5d99e88d2667).
100
101 This change unlinks it from the endpoint prior to queueing it for handling in
102 the tasklet, and also adds a check to ensure the urb is OK to be unlinked
103 before doing so.
104
105 NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
106 when a USB device was unplugged/replugged during data transfer. This effect
107 was reproduced using automated USB port power control, hundreds of replug
108 events were performed during active transfers to confirm that the problem was
109 eliminated.
110
111 USB fix using a FIQ to implement split transactions
112
113 This commit adds a FIQ implementaion that schedules
114 the split transactions using a FIQ so we don't get
115 held off by the interrupt latency of Linux
116
117 dwc_otg: fix device attributes and avoid kernel warnings on boot
118
119 dcw_otg: avoid logging function that can cause panics
120
121 See: https://github.com/raspberrypi/firmware/issues/21
122 Thanks to cleverca22 for fix
123
124 dwc_otg: mask correct interrupts after transaction error recovery
125
126 The dwc_otg driver will unmask certain interrupts on a transaction
127 that previously halted in the error state in order to reset the
128 QTD error count. The various fine-grained interrupt handlers do not
129 consider that other interrupts besides themselves were unmasked.
130
131 By disabling the two other interrupts only ever enabled in DMA mode
132 for this purpose, we can avoid unnecessary function calls in the
133 IRQ handler. This will also prevent an unneccesary FIQ interrupt
134 from being generated if the FIQ is enabled.
135
136 dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ
137
138 In the case of a transaction to a device that had previously aborted
139 due to an error, several interrupts are enabled to reset the error
140 count when a device responds. This has the side-effect of making the
141 FIQ thrash because the hardware will generate multiple instances of
142 a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
143 on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
144 associated interrupts.
145
146 Additionally, on non-split transactions make sure that only unmasked
147 interrupts are cleared. This caused a hard-to-trigger but serious
148 race condition when you had the combination of an endpoint awaiting
149 error recovery and a transaction completed on an endpoint - due to
150 the sequencing and timing of interrupts generated by the dwc_otg core,
151 it was possible to confuse the IRQ handler.
152
153 Fix function tracing
154
155 dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue
156
157 dwc_otg: prevent OOPSes during device disconnects
158
159 The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
160 access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
161 friends does not occur within a critical section and so if a device
162 was unplugged during activity there was a high chance that the
163 usbcore hub_thread would try to disable the endpoint with partially-
164 formed entries in the URB queue. This would result in BUG() or null
165 pointer dereferences.
166
167 Fix so that access of urb->hcpriv, enqueuing to the hardware and
168 adding to usbcore endpoint URB lists is contained within a single
169 critical section.
170
171 dwc_otg: prevent BUG() in TT allocation if hub address is > 16
172
173 A fixed-size array is used to track TT allocation. This was
174 previously set to 16 which caused a crash because
175 dwc_otg_hcd_allocate_port would read past the end of the array.
176
177 This was hit if a hub was plugged in which enumerated as addr > 16,
178 due to previous device resets or unplugs.
179
180 Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
181 to a large size if 128 hub addresses are supported. This field is
182 for debug only for tracking which frame an allocate happened in.
183
184 dwc_otg: make channel halts with unknown state less damaging
185
186 If the IRQ received a channel halt interrupt through the FIQ
187 with no other bits set, the IRQ would not release the host
188 channel and never complete the URB.
189
190 Add catchall handling to treat as a transaction error and retry.
191
192 dwc_otg: fiq_split: use TTs with more granularity
193
194 This fixes certain issues with split transaction scheduling.
195
196 - Isochronous multi-packet OUT transactions now hog the TT until
197 they are completed - this prevents hubs aborting transactions
198 if they get a periodic start-split out-of-order
199 - Don't perform TT allocation on non-periodic endpoints - this
200 allows simultaneous use of the TT's bulk/control and periodic
201 transaction buffers
202
203 This commit will mainly affect USB audio playback.
204
205 dwc_otg: fix potential sleep while atomic during urb enqueue
206
207 Fixes a regression introduced with eb1b482a. Kmalloc called from
208 dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
209 the GPF_ATOMIC flag set. Force this flag when inside the larger
210 critical section.
211
212 dwc_otg: make fiq_split_enable imply fiq_fix_enable
213
214 Failing to set up the FIQ correctly would result in
215 "IRQ 32: nobody cared" errors in dmesg.
216
217 dwc_otg: prevent crashes on host port disconnects
218
219 Fix several issues resulting in crashes or inconsistent state
220 if a Model A root port was disconnected.
221
222 - Clean up queue heads properly in kill_urbs_in_qh_list by
223 removing the empty QHs from the schedule lists
224 - Set the halt status properly to prevent IRQ handlers from
225 using freed memory
226 - Add fiq_split related cleanup for saved registers
227 - Make microframe scheduling reclaim host channels if
228 active during a disconnect
229 - Abort URBs with -ESHUTDOWN status response, informing
230 device drivers so they respond in a more correct fashion
231 and don't try to resubmit URBs
232 - Prevent IRQ handlers from attempting to handle channel
233 interrupts if the associated URB was dequeued (and the
234 driver state was cleared)
235
236 dwc_otg: prevent leaking URBs during enqueue
237
238 A dwc_otg_urb would get leaked if the HCD enqueue function
239 failed for any reason. Free the URB at the appropriate points.
240
241 dwc_otg: Enable NAK holdoff for control split transactions
242
243 Certain low-speed devices take a very long time to complete a
244 data or status stage of a control transaction, producing NAK
245 responses until they complete internal processing - the USB2.0
246 spec limit is up to 500mS. This causes the same type of interrupt
247 storm as seen with USB-serial dongles prior to c8edb238.
248
249 In certain circumstances, usually while booting, this interrupt
250 storm could cause SD card timeouts.
251
252 dwc_otg: Fix for occasional lockup on boot when doing a USB reset
253
254 dwc_otg: Don't issue traffic to LS devices in FS mode
255
256 Issuing low-speed packets when the root port is in full-speed mode
257 causes the root port to stop responding. Explicitly fail when
258 enqueuing URBs to a LS endpoint on a FS bus.
259
260 Fix ARM architecture issue with local_irq_restore()
261
262 If local_fiq_enable() is called before a local_irq_restore(flags) where
263 the flags variable has the F bit set, the FIQ will be erroneously disabled.
264
265 Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.
266
267 Also fix some of the hacks previously implemented for previous dwc_otg
268 incarnations.
269
270 dwc_otg: fiq_fsm: Base commit for driver rewrite
271
272 This commit removes the previous FIQ fixes entirely and adds fiq_fsm.
273
274 This rewrite features much more complete support for split transactions
275 and takes into account several OTG hardware bugs. High-speed
276 isochronous transactions are also capable of being performed by fiq_fsm.
277
278 All driver options have been removed and replaced with:
279 - dwc_otg.fiq_enable (bool)
280 - dwc_otg.fiq_fsm_enable (bool)
281 - dwc_otg.fiq_fsm_mask (bitmask)
282 - dwc_otg.nak_holdoff (unsigned int)
283
284 Defaults are specified such that fiq_fsm behaves similarly to the
285 previously implemented FIQ fixes.
286
287 fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used
288
289 If the transfer associated with a QTD failed due to a bus error, the HCD
290 would retry the transfer up to 3 times (implementing the USB2.0
291 three-strikes retry in software).
292
293 Due to the masking mechanism used by fiq_fsm, it is only possible to pass
294 a single interrupt through to the HCD per-transfer.
295
296 In this instance host channels would fall off the radar because the error
297 reset would function, but the subsequent channel halt would be lost.
298
299 Push the error count reset into the FIQ handler.
300
301 fiq_fsm: Implement timeout mechanism
302
303 For full-speed endpoints with a large packet size, interrupt latency
304 runs the risk of the FIQ starting a transaction too late in a full-speed
305 frame. If the device is still transmitting data when EOF2 for the
306 downstream frame occurs, the hub will disable the port. This change is
307 not reflected in the hub status endpoint and the device becomes
308 unresponsive.
309
310 Prevent high-bandwidth transactions from being started too late in a
311 frame. The mechanism is not guaranteed: a combination of bit stuffing
312 and hub latency may still result in a device overrunning.
313
314 fiq_fsm: fix bounce buffer utilisation for Isochronous OUT
315
316 Multi-packet isochronous OUT transactions were subject to a few bounday
317 bugs. Fix them.
318
319 Audio playback is now much more robust: however, an issue stands with
320 devices that have adaptive sinks - ALSA plays samples too fast.
321
322 dwc_otg: Return full-speed frame numbers in HS mode
323
324 The frame counter increments on every *microframe* in high-speed mode.
325 Most device drivers expect this number to be in full-speed frames - this
326 caused considerable confusion to e.g. snd_usb_audio which uses the
327 frame counter to estimate the number of samples played.
328
329 fiq_fsm: save PID on completion of interrupt OUT transfers
330
331 Also add edge case handling for interrupt transports.
332
333 Note that for periodic split IN, data toggles are unimplemented in the
334 OTG host hardware - it unconditionally accepts any PID.
335
336 fiq_fsm: add missing case for fiq_fsm_tt_in_use()
337
338 Certain combinations of bitrate and endpoint activity could
339 result in a periodic transaction erroneously getting started
340 while the previous Isochronous OUT was still active.
341
342 fiq_fsm: clear hcintmsk for aborted transactions
343
344 Prevents the FIQ from erroneously handling interrupts
345 on a timed out channel.
346
347 fiq_fsm: enable by default
348
349 fiq_fsm: fix dequeues for non-periodic split transactions
350
351 If a dequeue happened between the SSPLIT and CSPLIT phases of the
352 transaction, the HCD would never receive an interrupt.
353
354 fiq_fsm: Disable by default
355
356 fiq_fsm: Handle HC babble errors
357
358 The HCTSIZ transfer size field raises a babble interrupt if
359 the counter wraps. Handle the resulting interrupt in this case.
360
361 dwc_otg: fix interrupt registration for fiq_enable=0
362
363 Additionally make the module parameter conditional for wherever
364 hcd->fiq_state is touched.
365
366 fiq_fsm: Enable by default
367
368 dwc_otg: Fix various issues with root port and transaction errors
369
370 Process the host port interrupts correctly (and don't trample them).
371 Root port hotplug now functional again.
372
373 Fix a few thinkos with the transaction error passthrough for fiq_fsm.
374
375 fiq_fsm: Implement hack for Split Interrupt transactions
376
377 Hubs aren't too picky about which endpoint we send Control type split
378 transactions to. By treating Interrupt transfers as Control, it is
379 possible to use the non-periodic queue in the OTG core as well as the
380 non-periodic FIFOs in the hub itself. This massively reduces the
381 microframe exclusivity/contention that periodic split transactions
382 otherwise have to enforce.
383
384 It goes without saying that this is a fairly egregious USB specification
385 violation, but it works.
386
387 Original idea by Hans Petter Selasky @ FreeBSD.org.
388
389 dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.
390
391 dwc_otg: introduce fiq_fsm_spin(un|)lock()
392
393 SMP safety for the FIQ relies on register read-modify write cycles being
394 completed in the correct order. Several places in the DWC code modify
395 registers also touched by the FIQ. Protect these by a bare-bones lock
396 mechanism.
397
398 This also makes it possible to run the FIQ and IRQ handlers on different
399 cores.
400
401 fiq_fsm: fix build on bcm2708 and bcm2709 platforms
402
403 dwc_otg: put some barriers back where they should be for UP
404
405 bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active
406
407 dwc_otg: fixup read-modify-write in critical paths
408
409 Be more careful about read-modify-write on registers that the FIQ
410 also touches.
411
412 Guard fiq_fsm_spin_lock with fiq_enable check
413
414 fiq_fsm: Falling out of the state machine isn't fatal
415
416 This edge case can be hit if the port is disabled while the FIQ is
417 in the middle of a transaction. Make the effects less severe.
418
419 Also get rid of the useless return value.
420
421 squash: dwc_otg: Allow to build without SMP
422
423 usb: core: make overcurrent messages more prominent
424
425 Hub overcurrent messages are more serious than "debug". Increase loglevel.
426
427 usb: dwc_otg: Don't use dma_to_virt()
428
429 Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
430 Open code the old dma_to_virt() implementation to work around this.
431
432 Limit the use of __bus_to_virt() to cases where transfer_buffer_length
433 is set and transfer_buffer is not set. This is done to increase the
434 chance that this driver will also work on ARCH_BCM2835.
435
436 transfer_buffer should not be NULL if the length is set, but the
437 comment in the code indicates that there are situations where this
438 might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
439 comment pointing to a possible: 'usb storage / SCSI bug'.
440
441 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
442
443 dwc_otg: Fix crash when fiq_enable=0
444
445 dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly
446
447 Certain low-bandwidth high-speed USB devices (specialist audio devices,
448 compressed-frame webcams) have packet intervals > 1 microframe.
449
450 Stride these transfers in the FIQ by using the start-of-frame interrupt
451 to restart the channel at the right time.
452
453 dwc_otg: Force host mode to fix incorrect compute module boards
454
455 dwc_otg: Add ARCH_BCM2835 support
456
457 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
458
459 dwc_otg: Simplify FIQ irq number code
460
461 Dropping ATAGS means we can simplify the FIQ irq number code.
462 Also add error checking on the returned irq number.
463
464 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
465
466 dwc_otg: Remove duplicate gadget probe/unregister function
467
468 dwc_otg: Properly set the HFIR
469
470 Douglas Anderson reported:
471
472 According to the most up to date version of the dwc2 databook, the FRINT
473 field of the HFIR register should be programmed to:
474 * 125 us * (PHY clock freq for HS) - 1
475 * 1000 us * (PHY clock freq for FS/LS) - 1
476
477 This is opposed to older versions of the doc that claimed it should be:
478 * 125 us * (PHY clock freq for HS)
479 * 1000 us * (PHY clock freq for FS/LS)
480
481 and reported lower timing jitter on a USB analyser
482
483 dcw_otg: trim xfer length when buffer larger than allocated size is received
484
485 dwc_otg: Don't free qh align buffers in atomic context
486
487 dwc_otg: Enable the hack for Split Interrupt transactions by default
488
489 dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
490 So far we are aware of many success stories but no failure caused by this setting.
491 Make it a default to learn more.
492
493 See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437
494
495 Signed-off-by: popcornmix <popcornmix@gmail.com>
496
497 dwc_otg: Use kzalloc when suitable
498
499 dwc_otg: Pass struct device to dma_alloc*()
500
501 This makes it possible to get the bus address from Device Tree.
502
503 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
504
505 dwc_otg: fix summarize urb->actual_length for isochronous transfers
506
507 Kernel does not copy input data of ISO transfers to userspace
508 if actual_length is set only in ISO transfers and not summarized
509 in urb->actual_length. Fixes raspberrypi/linux#903
510
511 fiq_fsm: Use correct states when starting isoc OUT transfers
512
513 In fiq_fsm_start_next_periodic() if an isochronous OUT transfer
514 was selected, no regard was given as to whether this was a single-packet
515 transfer or a multi-packet staged transfer.
516
517 For single-packet transfers, this had the effect of repeatedly sending
518 OUT packets with bogus data and lengths.
519
520 Eventually if the channel was repeatedly enabled enough times, this
521 would lock up the OTG core and no further bus transfers would happen.
522
523 Set the FSM state up properly if we select a single-packet transfer.
524
525 Fixes https://github.com/raspberrypi/linux/issues/1842
526
527 dwc_otg: make nak_holdoff work as intended with empty queues
528
529 If URBs reading from non-periodic split endpoints were dequeued and
530 the last transfer from the endpoint was a NAK handshake, the resulting
531 qh->nak_frame value was stale which would result in unnecessarily long
532 polling intervals for the first subsequent transfer with a fresh URB.
533
534 Fixup qh->nak_frame in dwc_otg_hcd_urb_dequeue and also guard against
535 a case where a single URB is submitted to the endpoint, a NAK was
536 received on the transfer immediately prior to receiving data and the
537 device subsequently resubmits another URB past the qh->nak_frame interval.
538
539 Fixes https://github.com/raspberrypi/linux/issues/1709
540
541 dwc_otg: fix split transaction data toggle handling around dequeues
542
543 See https://github.com/raspberrypi/linux/issues/1709
544
545 Fix several issues regarding endpoint state when URBs are dequeued
546 - If the HCD is disconnected, flush FIQ-enabled channels properly
547 - Save the data toggle state for bulk endpoints if the last transfer
548 from an endpoint where URBs were dequeued returned a data packet
549 - Reset hc->start_pkt_count properly in assign_and_init_hc()
550
551 dwc_otg: fix several potential crash sources
552
553 On root port disconnect events, the host driver state is cleared and
554 in-progress host channels are forcibly stopped. This doesn't play
555 well with the FIQ running in the background, so:
556 - Guard the disconnect callback with both the host spinlock and FIQ
557 spinlock
558 - Move qtd dereference in dwc_otg_handle_hc_fsm() after the early-out
559 so we don't dereference a qtd that has gone away
560 - Turn catch-all BUG()s in dwc_otg_handle_hc_fsm() into warnings.
561
562 dwc_otg: delete hcd->channel_lock
563
564 The lock serves no purpose as it is only held while the HCD spinlock
565 is already being held.
566
567 dwc_otg: remove unnecessary dma-mode channel halts on disconnect interrupt
568
569 Host channels are already halted in kill_urbs_in_qh_list() with the
570 subsequent interrupt processing behaving as if the URB was dequeued
571 via HCD callback.
572
573 There's no need to clobber the host channel registers a second time
574 as this exposes races between the driver and host channel resulting
575 in hcd->free_hc_list becoming corrupted.
576
577 dwcotg: Allow to build without FIQ on ARM64
578
579 Signed-off-by: popcornmix <popcornmix@gmail.com>
580
581 dwc_otg: make periodic scheduling behave properly for FS buses
582
583 If the root port is in full-speed mode, transfer times at 12mbit/s
584 would be calculated but matched against high-speed quotas.
585
586 Reinitialise hcd->frame_usecs[i] on each port enable event so that
587 full-speed bandwidth can be tracked sensibly.
588
589 Also, don't bother using the FIQ for transfers when in full-speed
590 mode - at the slower bus speed, interrupt frequency is reduced by
591 an order of magnitude.
592
593 Related issue: https://github.com/raspberrypi/linux/issues/2020
594
595 dwc_otg: fiq_fsm: Make isochronous compatibility checks work properly
596
597 Get rid of the spammy printk and local pointer mangling.
598 Also, there is a nominal benefit for using fiq_fsm for isochronous
599 transfers in FS mode (~1.1k IRQs per second vs 2.1k IRQs per second)
600 so remove the root port speed check.
601
602 dwc_otg: add module parameter int_ep_interval_min
603
604 Add a module parameter (defaulting to ignored) that clamps the polling rate
605 of high-speed Interrupt endpoints to a minimum microframe interval.
606
607 The parameter is modifiable at runtime as it is used when activating new
608 endpoints (such as on device connect).
609
610 dwc_otg: fiq_fsm: Add non-periodic TT exclusivity constraints
611
612 Certain hub types do not discriminate between pipe direction (IN or OUT)
613 when considering non-periodic transfers. Therefore these hubs get confused
614 if multiple transfers are issued in different directions with the same
615 device address and endpoint number.
616
617 Constrain queuing non-periodic split transactions so they are performed
618 serially in such cases.
619
620 Related: https://github.com/raspberrypi/linux/issues/2024
621
622 dwc_otg: Fixup change to DRIVER_ATTR interface
623
624 dwc_otg: Fix compilation warnings
625
626 Signed-off-by: Phil Elwell <phil@raspberrypi.org>
627
628 USB_DWCOTG: Disable building dwc_otg as a module (#2265)
629
630 When dwc_otg is built as a module, build will fail with the following
631 error:
632
633 ERROR: "DWC_TASK_HI_SCHEDULE" [drivers/usb/host/dwc_otg/dwc_otg.ko] undefined!
634 scripts/Makefile.modpost:91: recipe for target '__modpost' failed
635 make[1]: *** [__modpost] Error 1
636 Makefile:1199: recipe for target 'modules' failed
637 make: *** [modules] Error 2
638
639 Even if the error is solved by including the missing
640 DWC_TASK_HI_SCHEDULE function, the kernel will panic when loading
641 dwc_otg.
642
643 As a workaround, simply prevent user from building dwc_otg as a module
644 as the current kernel does not support it.
645
646 See: https://github.com/raspberrypi/linux/issues/2258
647
648 Signed-off-by: Malik Olivier Boussejra <malik@boussejra.com>
649 ---
650 arch/arm/include/asm/irqflags.h | 16 +-
651 arch/arm/kernel/fiqasm.S | 4 +
652 drivers/usb/Makefile | 1 +
653 drivers/usb/core/generic.c | 1 +
654 drivers/usb/core/hub.c | 2 +-
655 drivers/usb/core/message.c | 79 +
656 drivers/usb/core/otg_whitelist.h | 114 +-
657 drivers/usb/gadget/file_storage.c | 3676 +++++++++
658 drivers/usb/host/Kconfig | 10 +
659 drivers/usb/host/Makefile | 2 +
660 drivers/usb/host/dwc_common_port/Makefile | 58 +
661 .../usb/host/dwc_common_port/Makefile.fbsd | 17 +
662 .../usb/host/dwc_common_port/Makefile.linux | 49 +
663 drivers/usb/host/dwc_common_port/changes.txt | 174 +
664 .../usb/host/dwc_common_port/doc/doxygen.cfg | 270 +
665 drivers/usb/host/dwc_common_port/dwc_cc.c | 532 ++
666 drivers/usb/host/dwc_common_port/dwc_cc.h | 224 +
667 .../host/dwc_common_port/dwc_common_fbsd.c | 1308 +++
668 .../host/dwc_common_port/dwc_common_linux.c | 1418 ++++
669 .../host/dwc_common_port/dwc_common_nbsd.c | 1275 +++
670 drivers/usb/host/dwc_common_port/dwc_crypto.c | 308 +
671 drivers/usb/host/dwc_common_port/dwc_crypto.h | 111 +
672 drivers/usb/host/dwc_common_port/dwc_dh.c | 291 +
673 drivers/usb/host/dwc_common_port/dwc_dh.h | 106 +
674 drivers/usb/host/dwc_common_port/dwc_list.h | 594 ++
675 drivers/usb/host/dwc_common_port/dwc_mem.c | 245 +
676 drivers/usb/host/dwc_common_port/dwc_modpow.c | 636 ++
677 drivers/usb/host/dwc_common_port/dwc_modpow.h | 34 +
678 .../usb/host/dwc_common_port/dwc_notifier.c | 319 +
679 .../usb/host/dwc_common_port/dwc_notifier.h | 122 +
680 drivers/usb/host/dwc_common_port/dwc_os.h | 1276 +++
681 drivers/usb/host/dwc_common_port/usb.h | 946 +++
682 drivers/usb/host/dwc_otg/Makefile | 82 +
683 drivers/usb/host/dwc_otg/doc/doxygen.cfg | 224 +
684 drivers/usb/host/dwc_otg/dummy_audio.c | 1574 ++++
685 drivers/usb/host/dwc_otg/dwc_cfi_common.h | 142 +
686 drivers/usb/host/dwc_otg/dwc_otg_adp.c | 854 ++
687 drivers/usb/host/dwc_otg/dwc_otg_adp.h | 80 +
688 drivers/usb/host/dwc_otg/dwc_otg_attr.c | 1212 +++
689 drivers/usb/host/dwc_otg/dwc_otg_attr.h | 89 +
690 drivers/usb/host/dwc_otg/dwc_otg_cfi.c | 1876 +++++
691 drivers/usb/host/dwc_otg/dwc_otg_cfi.h | 320 +
692 drivers/usb/host/dwc_otg/dwc_otg_cil.c | 7141 +++++++++++++++++
693 drivers/usb/host/dwc_otg/dwc_otg_cil.h | 1464 ++++
694 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c | 1596 ++++
695 drivers/usb/host/dwc_otg/dwc_otg_core_if.h | 705 ++
696 drivers/usb/host/dwc_otg/dwc_otg_dbg.h | 117 +
697 drivers/usb/host/dwc_otg/dwc_otg_driver.c | 1760 ++++
698 drivers/usb/host/dwc_otg/dwc_otg_driver.h | 86 +
699 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c | 1389 ++++
700 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h | 372 +
701 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S | 80 +
702 drivers/usb/host/dwc_otg/dwc_otg_hcd.c | 4283 ++++++++++
703 drivers/usb/host/dwc_otg/dwc_otg_hcd.h | 870 ++
704 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c | 1134 +++
705 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h | 417 +
706 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c | 2752 +++++++
707 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 1007 +++
708 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c | 971 +++
709 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h | 188 +
710 drivers/usb/host/dwc_otg/dwc_otg_pcd.c | 2725 +++++++
711 drivers/usb/host/dwc_otg/dwc_otg_pcd.h | 273 +
712 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h | 361 +
713 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c | 5148 ++++++++++++
714 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c | 1280 +++
715 drivers/usb/host/dwc_otg/dwc_otg_regs.h | 2550 ++++++
716 drivers/usb/host/dwc_otg/test/Makefile | 16 +
717 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm | 337 +
718 .../usb/host/dwc_otg/test/test_mod_param.pl | 133 +
719 drivers/usb/host/dwc_otg/test/test_sysfs.pl | 193 +
720 70 files changed, 60003 insertions(+), 16 deletions(-)
721 create mode 100644 drivers/usb/gadget/file_storage.c
722 create mode 100644 drivers/usb/host/dwc_common_port/Makefile
723 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.fbsd
724 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.linux
725 create mode 100644 drivers/usb/host/dwc_common_port/changes.txt
726 create mode 100644 drivers/usb/host/dwc_common_port/doc/doxygen.cfg
727 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.c
728 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.h
729 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
730 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_linux.c
731 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
732 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.c
733 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.h
734 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.c
735 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.h
736 create mode 100644 drivers/usb/host/dwc_common_port/dwc_list.h
737 create mode 100644 drivers/usb/host/dwc_common_port/dwc_mem.c
738 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.c
739 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.h
740 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.c
741 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.h
742 create mode 100644 drivers/usb/host/dwc_common_port/dwc_os.h
743 create mode 100644 drivers/usb/host/dwc_common_port/usb.h
744 create mode 100644 drivers/usb/host/dwc_otg/Makefile
745 create mode 100644 drivers/usb/host/dwc_otg/doc/doxygen.cfg
746 create mode 100644 drivers/usb/host/dwc_otg/dummy_audio.c
747 create mode 100644 drivers/usb/host/dwc_otg/dwc_cfi_common.h
748 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.c
749 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.h
750 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.c
751 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.h
752 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.c
753 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.h
754 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.c
755 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.h
756 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
757 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_core_if.h
758 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_dbg.h
759 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.c
760 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.h
761 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
762 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
763 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
764 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.c
765 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.h
766 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
767 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
768 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
769 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
770 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
771 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
772 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.c
773 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.h
774 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
775 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
776 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
777 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_regs.h
778 create mode 100644 drivers/usb/host/dwc_otg/test/Makefile
779 create mode 100644 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
780 create mode 100644 drivers/usb/host/dwc_otg/test/test_mod_param.pl
781 create mode 100644 drivers/usb/host/dwc_otg/test/test_sysfs.pl
782
783 --- a/arch/arm/include/asm/irqflags.h
784 +++ b/arch/arm/include/asm/irqflags.h
785 @@ -163,13 +163,23 @@ static inline unsigned long arch_local_s
786 }
787
788 /*
789 - * restore saved IRQ & FIQ state
790 + * restore saved IRQ state
791 */
792 #define arch_local_irq_restore arch_local_irq_restore
793 static inline void arch_local_irq_restore(unsigned long flags)
794 {
795 - asm volatile(
796 - " msr " IRQMASK_REG_NAME_W ", %0 @ local_irq_restore"
797 + unsigned long temp = 0;
798 + flags &= ~(1 << 6);
799 + asm volatile (
800 + " mrs %0, cpsr"
801 + : "=r" (temp)
802 + :
803 + : "memory", "cc");
804 + /* Preserve FIQ bit */
805 + temp &= (1 << 6);
806 + flags = flags | temp;
807 + asm volatile (
808 + " msr cpsr_c, %0 @ local_irq_restore"
809 :
810 : "r" (flags)
811 : "memory", "cc");
812 --- a/arch/arm/kernel/fiqasm.S
813 +++ b/arch/arm/kernel/fiqasm.S
814 @@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
815 mov r0, r0 @ avoid hazard prior to ARMv4
816 ret lr
817 ENDPROC(__get_fiq_regs)
818 +
819 +ENTRY(__FIQ_Branch)
820 + mov pc, r8
821 +ENDPROC(__FIQ_Branch)
822 --- a/drivers/usb/Makefile
823 +++ b/drivers/usb/Makefile
824 @@ -8,6 +8,7 @@
825 obj-$(CONFIG_USB) += core/
826 obj-$(CONFIG_USB_SUPPORT) += phy/
827
828 +obj-$(CONFIG_USB_DWCOTG) += host/
829 obj-$(CONFIG_USB_DWC3) += dwc3/
830 obj-$(CONFIG_USB_DWC2) += dwc2/
831 obj-$(CONFIG_USB_ISP1760) += isp1760/
832 --- a/drivers/usb/core/generic.c
833 +++ b/drivers/usb/core/generic.c
834 @@ -154,6 +154,7 @@ int usb_choose_configuration(struct usb_
835 dev_warn(&udev->dev,
836 "no configuration chosen from %d choice%s\n",
837 num_configs, plural(num_configs));
838 + dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
839 }
840 return i;
841 }
842 --- a/drivers/usb/core/hub.c
843 +++ b/drivers/usb/core/hub.c
844 @@ -5091,7 +5091,7 @@ static void port_event(struct usb_hub *h
845 if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
846 u16 status = 0, unused;
847
848 - dev_dbg(&port_dev->dev, "over-current change\n");
849 + dev_notice(&port_dev->dev, "over-current change\n");
850 usb_clear_port_feature(hdev, port1,
851 USB_PORT_FEAT_C_OVER_CURRENT);
852 msleep(100); /* Cool down */
853 --- a/drivers/usb/core/message.c
854 +++ b/drivers/usb/core/message.c
855 @@ -1923,6 +1923,85 @@ free_interfaces:
856 if (cp->string == NULL &&
857 !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
858 cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
859 +/* Uncomment this define to enable the HS Electrical Test support */
860 +#define DWC_HS_ELECT_TST 1
861 +#ifdef DWC_HS_ELECT_TST
862 + /* Here we implement the HS Electrical Test support. The
863 + * tester uses a vendor ID of 0x1A0A to indicate we should
864 + * run a special test sequence. The product ID tells us
865 + * which sequence to run. We invoke the test sequence by
866 + * sending a non-standard SetFeature command to our root
867 + * hub port. Our dwc_otg_hcd_hub_control() routine will
868 + * recognize the command and perform the desired test
869 + * sequence.
870 + */
871 + if (dev->descriptor.idVendor == 0x1A0A) {
872 + /* HSOTG Electrical Test */
873 + dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
874 +
875 + if (dev->bus && dev->bus->root_hub) {
876 + struct usb_device *hdev = dev->bus->root_hub;
877 + dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
878 +
879 + switch (dev->descriptor.idProduct) {
880 + case 0x0101: /* TEST_SE0_NAK */
881 + dev_warn(&dev->dev, "TEST_SE0_NAK\n");
882 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
883 + USB_REQ_SET_FEATURE, USB_RT_PORT,
884 + USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
885 + break;
886 +
887 + case 0x0102: /* TEST_J */
888 + dev_warn(&dev->dev, "TEST_J\n");
889 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
890 + USB_REQ_SET_FEATURE, USB_RT_PORT,
891 + USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
892 + break;
893 +
894 + case 0x0103: /* TEST_K */
895 + dev_warn(&dev->dev, "TEST_K\n");
896 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
897 + USB_REQ_SET_FEATURE, USB_RT_PORT,
898 + USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
899 + break;
900 +
901 + case 0x0104: /* TEST_PACKET */
902 + dev_warn(&dev->dev, "TEST_PACKET\n");
903 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
904 + USB_REQ_SET_FEATURE, USB_RT_PORT,
905 + USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
906 + break;
907 +
908 + case 0x0105: /* TEST_FORCE_ENABLE */
909 + dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
910 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
911 + USB_REQ_SET_FEATURE, USB_RT_PORT,
912 + USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
913 + break;
914 +
915 + case 0x0106: /* HS_HOST_PORT_SUSPEND_RESUME */
916 + dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
917 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
918 + USB_REQ_SET_FEATURE, USB_RT_PORT,
919 + USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
920 + break;
921 +
922 + case 0x0107: /* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
923 + dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
924 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
925 + USB_REQ_SET_FEATURE, USB_RT_PORT,
926 + USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
927 + break;
928 +
929 + case 0x0108: /* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
930 + dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
931 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
932 + USB_REQ_SET_FEATURE, USB_RT_PORT,
933 + USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
934 + }
935 + }
936 + }
937 +#endif /* DWC_HS_ELECT_TST */
938
939 /* Now that the interfaces are installed, re-enable LPM. */
940 usb_unlocked_enable_lpm(dev);
941 --- a/drivers/usb/core/otg_whitelist.h
942 +++ b/drivers/usb/core/otg_whitelist.h
943 @@ -19,33 +19,82 @@
944 static struct usb_device_id whitelist_table[] = {
945
946 /* hubs are optional in OTG, but very handy ... */
947 +#define CERT_WITHOUT_HUBS
948 +#if defined(CERT_WITHOUT_HUBS)
949 +{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
950 +#else
951 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
952 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
953 +{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
954 +#endif
955
956 #ifdef CONFIG_USB_PRINTER /* ignoring nonstatic linkage! */
957 /* FIXME actually, printers are NOT supposed to use device classes;
958 * they're supposed to use interface classes...
959 */
960 -{ USB_DEVICE_INFO(7, 1, 1) },
961 -{ USB_DEVICE_INFO(7, 1, 2) },
962 -{ USB_DEVICE_INFO(7, 1, 3) },
963 +//{ USB_DEVICE_INFO(7, 1, 1) },
964 +//{ USB_DEVICE_INFO(7, 1, 2) },
965 +//{ USB_DEVICE_INFO(7, 1, 3) },
966 #endif
967
968 #ifdef CONFIG_USB_NET_CDCETHER
969 /* Linux-USB CDC Ethernet gadget */
970 -{ USB_DEVICE(0x0525, 0xa4a1), },
971 +//{ USB_DEVICE(0x0525, 0xa4a1), },
972 /* Linux-USB CDC Ethernet + RNDIS gadget */
973 -{ USB_DEVICE(0x0525, 0xa4a2), },
974 +//{ USB_DEVICE(0x0525, 0xa4a2), },
975 #endif
976
977 #if IS_ENABLED(CONFIG_USB_TEST)
978 /* gadget zero, for testing */
979 -{ USB_DEVICE(0x0525, 0xa4a0), },
980 +//{ USB_DEVICE(0x0525, 0xa4a0), },
981 #endif
982
983 +/* OPT Tester */
984 +{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
985 +{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
986 +{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
987 +{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
988 +{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
989 +{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME */
990 +{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
991 +{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
992 +
993 +/* Sony cameras */
994 +{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
995 +
996 +/* Memory Devices */
997 +//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
998 +//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
999 +//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
1000 +//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD */
1001 +{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
1002 +//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
1003 +
1004 +/* HP Printers */
1005 +//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
1006 +//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
1007 +
1008 +/* Speakers */
1009 +//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
1010 +//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
1011 +
1012 { } /* Terminating entry */
1013 };
1014
1015 +static inline void report_errors(struct usb_device *dev)
1016 +{
1017 + /* OTG MESSAGE: report errors here, customize to match your product */
1018 + dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
1019 + le16_to_cpu(dev->descriptor.idVendor),
1020 + le16_to_cpu(dev->descriptor.idProduct));
1021 + if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
1022 + dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
1023 + } else {
1024 + dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
1025 + }
1026 +}
1027 +
1028 +
1029 static int is_targeted(struct usb_device *dev)
1030 {
1031 struct usb_device_id *id = whitelist_table;
1032 @@ -95,16 +144,57 @@ static int is_targeted(struct usb_device
1033 continue;
1034
1035 return 1;
1036 - }
1037 + /* NOTE: can't use usb_match_id() since interface caches
1038 + * aren't set up yet. this is cut/paste from that code.
1039 + */
1040 + for (id = whitelist_table; id->match_flags; id++) {
1041 +#ifdef DEBUG
1042 + dev_dbg(&dev->dev,
1043 + "ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
1044 + id->idVendor,
1045 + id->idProduct,
1046 + id->bDeviceClass,
1047 + id->bDeviceSubClass,
1048 + id->bDeviceProtocol);
1049 +#endif
1050
1051 - /* add other match criteria here ... */
1052 + if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
1053 + id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
1054 + continue;
1055 +
1056 + if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
1057 + id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
1058 + continue;
1059 +
1060 + /* No need to test id->bcdDevice_lo != 0, since 0 is never
1061 + greater than any unsigned number. */
1062 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
1063 + (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
1064 + continue;
1065 +
1066 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
1067 + (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
1068 + continue;
1069 +
1070 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
1071 + (id->bDeviceClass != dev->descriptor.bDeviceClass))
1072 + continue;
1073 +
1074 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
1075 + (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
1076 + continue;
1077 +
1078 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
1079 + (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
1080 + continue;
1081
1082 + return 1;
1083 + }
1084 + }
1085
1086 - /* OTG MESSAGE: report errors here, customize to match your product */
1087 - dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
1088 - le16_to_cpu(dev->descriptor.idVendor),
1089 - le16_to_cpu(dev->descriptor.idProduct));
1090 + /* add other match criteria here ... */
1091
1092 + report_errors(dev);
1093 return 0;
1094 }
1095
1096 --- /dev/null
1097 +++ b/drivers/usb/gadget/file_storage.c
1098 @@ -0,0 +1,3676 @@
1099 +/*
1100 + * file_storage.c -- File-backed USB Storage Gadget, for USB development
1101 + *
1102 + * Copyright (C) 2003-2008 Alan Stern
1103 + * All rights reserved.
1104 + *
1105 + * Redistribution and use in source and binary forms, with or without
1106 + * modification, are permitted provided that the following conditions
1107 + * are met:
1108 + * 1. Redistributions of source code must retain the above copyright
1109 + * notice, this list of conditions, and the following disclaimer,
1110 + * without modification.
1111 + * 2. Redistributions in binary form must reproduce the above copyright
1112 + * notice, this list of conditions and the following disclaimer in the
1113 + * documentation and/or other materials provided with the distribution.
1114 + * 3. The names of the above-listed copyright holders may not be used
1115 + * to endorse or promote products derived from this software without
1116 + * specific prior written permission.
1117 + *
1118 + * ALTERNATIVELY, this software may be distributed under the terms of the
1119 + * GNU General Public License ("GPL") as published by the Free Software
1120 + * Foundation, either version 2 of that License or (at your option) any
1121 + * later version.
1122 + *
1123 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
1124 + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
1125 + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
1126 + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
1127 + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
1128 + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
1129 + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
1130 + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
1131 + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
1132 + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
1133 + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1134 + */
1135 +
1136 +
1137 +/*
1138 + * The File-backed Storage Gadget acts as a USB Mass Storage device,
1139 + * appearing to the host as a disk drive or as a CD-ROM drive. In addition
1140 + * to providing an example of a genuinely useful gadget driver for a USB
1141 + * device, it also illustrates a technique of double-buffering for increased
1142 + * throughput. Last but not least, it gives an easy way to probe the
1143 + * behavior of the Mass Storage drivers in a USB host.
1144 + *
1145 + * Backing storage is provided by a regular file or a block device, specified
1146 + * by the "file" module parameter. Access can be limited to read-only by
1147 + * setting the optional "ro" module parameter. (For CD-ROM emulation,
1148 + * access is always read-only.) The gadget will indicate that it has
1149 + * removable media if the optional "removable" module parameter is set.
1150 + *
1151 + * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
1152 + * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
1153 + * by the optional "transport" module parameter. It also supports the
1154 + * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
1155 + * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
1156 + * the optional "protocol" module parameter. In addition, the default
1157 + * Vendor ID, Product ID, release number and serial number can be overridden.
1158 + *
1159 + * There is support for multiple logical units (LUNs), each of which has
1160 + * its own backing file. The number of LUNs can be set using the optional
1161 + * "luns" module parameter (anywhere from 1 to 8), and the corresponding
1162 + * files are specified using comma-separated lists for "file" and "ro".
1163 + * The default number of LUNs is taken from the number of "file" elements;
1164 + * it is 1 if "file" is not given. If "removable" is not set then a backing
1165 + * file must be specified for each LUN. If it is set, then an unspecified
1166 + * or empty backing filename means the LUN's medium is not loaded. Ideally
1167 + * each LUN would be settable independently as a disk drive or a CD-ROM
1168 + * drive, but currently all LUNs have to be the same type. The CD-ROM
1169 + * emulation includes a single data track and no audio tracks; hence there
1170 + * need be only one backing file per LUN.
1171 + *
1172 + * Requirements are modest; only a bulk-in and a bulk-out endpoint are
1173 + * needed (an interrupt-out endpoint is also needed for CBI). The memory
1174 + * requirement amounts to two 16K buffers, size configurable by a parameter.
1175 + * Support is included for both full-speed and high-speed operation.
1176 + *
1177 + * Note that the driver is slightly non-portable in that it assumes a
1178 + * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
1179 + * interrupt-in endpoints. With most device controllers this isn't an
1180 + * issue, but there may be some with hardware restrictions that prevent
1181 + * a buffer from being used by more than one endpoint.
1182 + *
1183 + * Module options:
1184 + *
1185 + * file=filename[,filename...]
1186 + * Required if "removable" is not set, names of
1187 + * the files or block devices used for
1188 + * backing storage
1189 + * serial=HHHH... Required serial number (string of hex chars)
1190 + * ro=b[,b...] Default false, booleans for read-only access
1191 + * removable Default false, boolean for removable media
1192 + * luns=N Default N = number of filenames, number of
1193 + * LUNs to support
1194 + * nofua=b[,b...] Default false, booleans for ignore FUA flag
1195 + * in SCSI WRITE(10,12) commands
1196 + * stall Default determined according to the type of
1197 + * USB device controller (usually true),
1198 + * boolean to permit the driver to halt
1199 + * bulk endpoints
1200 + * cdrom Default false, boolean for whether to emulate
1201 + * a CD-ROM drive
1202 + * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
1203 + * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
1204 + * ATAPI, QIC, UFI, 8070, or SCSI;
1205 + * also 1 - 6)
1206 + * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
1207 + * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
1208 + * release=0xRRRR Override the USB release number (bcdDevice)
1209 + * buflen=N Default N=16384, buffer size used (will be
1210 + * rounded down to a multiple of
1211 + * PAGE_CACHE_SIZE)
1212 + *
1213 + * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
1214 + * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
1215 + * default values are used for everything else.
1216 + *
1217 + * The pathnames of the backing files and the ro settings are available in
1218 + * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
1219 + * the gadget's sysfs directory. If the "removable" option is set, writing to
1220 + * these files will simulate ejecting/loading the medium (writing an empty
1221 + * line means eject) and adjusting a write-enable tab. Changes to the ro
1222 + * setting are not allowed when the medium is loaded or if CD-ROM emulation
1223 + * is being used.
1224 + *
1225 + * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
1226 + * The driver's SCSI command interface was based on the "Information
1227 + * technology - Small Computer System Interface - 2" document from
1228 + * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
1229 + * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
1230 + * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
1231 + * "Universal Serial Bus Mass Storage Class UFI Command Specification"
1232 + * document, Revision 1.0, December 14, 1998, available at
1233 + * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
1234 + */
1235 +
1236 +
1237 +/*
1238 + * Driver Design
1239 + *
1240 + * The FSG driver is fairly straightforward. There is a main kernel
1241 + * thread that handles most of the work. Interrupt routines field
1242 + * callbacks from the controller driver: bulk- and interrupt-request
1243 + * completion notifications, endpoint-0 events, and disconnect events.
1244 + * Completion events are passed to the main thread by wakeup calls. Many
1245 + * ep0 requests are handled at interrupt time, but SetInterface,
1246 + * SetConfiguration, and device reset requests are forwarded to the
1247 + * thread in the form of "exceptions" using SIGUSR1 signals (since they
1248 + * should interrupt any ongoing file I/O operations).
1249 + *
1250 + * The thread's main routine implements the standard command/data/status
1251 + * parts of a SCSI interaction. It and its subroutines are full of tests
1252 + * for pending signals/exceptions -- all this polling is necessary since
1253 + * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
1254 + * indication that the driver really wants to be running in userspace.)
1255 + * An important point is that so long as the thread is alive it keeps an
1256 + * open reference to the backing file. This will prevent unmounting
1257 + * the backing file's underlying filesystem and could cause problems
1258 + * during system shutdown, for example. To prevent such problems, the
1259 + * thread catches INT, TERM, and KILL signals and converts them into
1260 + * an EXIT exception.
1261 + *
1262 + * In normal operation the main thread is started during the gadget's
1263 + * fsg_bind() callback and stopped during fsg_unbind(). But it can also
1264 + * exit when it receives a signal, and there's no point leaving the
1265 + * gadget running when the thread is dead. So just before the thread
1266 + * exits, it deregisters the gadget driver. This makes things a little
1267 + * tricky: The driver is deregistered at two places, and the exiting
1268 + * thread can indirectly call fsg_unbind() which in turn can tell the
1269 + * thread to exit. The first problem is resolved through the use of the
1270 + * REGISTERED atomic bitflag; the driver will only be deregistered once.
1271 + * The second problem is resolved by having fsg_unbind() check
1272 + * fsg->state; it won't try to stop the thread if the state is already
1273 + * FSG_STATE_TERMINATED.
1274 + *
1275 + * To provide maximum throughput, the driver uses a circular pipeline of
1276 + * buffer heads (struct fsg_buffhd). In principle the pipeline can be
1277 + * arbitrarily long; in practice the benefits don't justify having more
1278 + * than 2 stages (i.e., double buffering). But it helps to think of the
1279 + * pipeline as being a long one. Each buffer head contains a bulk-in and
1280 + * a bulk-out request pointer (since the buffer can be used for both
1281 + * output and input -- directions always are given from the host's
1282 + * point of view) as well as a pointer to the buffer and various state
1283 + * variables.
1284 + *
1285 + * Use of the pipeline follows a simple protocol. There is a variable
1286 + * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
1287 + * At any time that buffer head may still be in use from an earlier
1288 + * request, so each buffer head has a state variable indicating whether
1289 + * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
1290 + * buffer head to be EMPTY, filling the buffer either by file I/O or by
1291 + * USB I/O (during which the buffer head is BUSY), and marking the buffer
1292 + * head FULL when the I/O is complete. Then the buffer will be emptied
1293 + * (again possibly by USB I/O, during which it is marked BUSY) and
1294 + * finally marked EMPTY again (possibly by a completion routine).
1295 + *
1296 + * A module parameter tells the driver to avoid stalling the bulk
1297 + * endpoints wherever the transport specification allows. This is
1298 + * necessary for some UDCs like the SuperH, which cannot reliably clear a
1299 + * halt on a bulk endpoint. However, under certain circumstances the
1300 + * Bulk-only specification requires a stall. In such cases the driver
1301 + * will halt the endpoint and set a flag indicating that it should clear
1302 + * the halt in software during the next device reset. Hopefully this
1303 + * will permit everything to work correctly. Furthermore, although the
1304 + * specification allows the bulk-out endpoint to halt when the host sends
1305 + * too much data, implementing this would cause an unavoidable race.
1306 + * The driver will always use the "no-stall" approach for OUT transfers.
1307 + *
1308 + * One subtle point concerns sending status-stage responses for ep0
1309 + * requests. Some of these requests, such as device reset, can involve
1310 + * interrupting an ongoing file I/O operation, which might take an
1311 + * arbitrarily long time. During that delay the host might give up on
1312 + * the original ep0 request and issue a new one. When that happens the
1313 + * driver should not notify the host about completion of the original
1314 + * request, as the host will no longer be waiting for it. So the driver
1315 + * assigns to each ep0 request a unique tag, and it keeps track of the
1316 + * tag value of the request associated with a long-running exception
1317 + * (device-reset, interface-change, or configuration-change). When the
1318 + * exception handler is finished, the status-stage response is submitted
1319 + * only if the current ep0 request tag is equal to the exception request
1320 + * tag. Thus only the most recently received ep0 request will get a
1321 + * status-stage response.
1322 + *
1323 + * Warning: This driver source file is too long. It ought to be split up
1324 + * into a header file plus about 3 separate .c files, to handle the details
1325 + * of the Gadget, USB Mass Storage, and SCSI protocols.
1326 + */
1327 +
1328 +
1329 +/* #define VERBOSE_DEBUG */
1330 +/* #define DUMP_MSGS */
1331 +
1332 +
1333 +#include <linux/blkdev.h>
1334 +#include <linux/completion.h>
1335 +#include <linux/dcache.h>
1336 +#include <linux/delay.h>
1337 +#include <linux/device.h>
1338 +#include <linux/fcntl.h>
1339 +#include <linux/file.h>
1340 +#include <linux/fs.h>
1341 +#include <linux/kref.h>
1342 +#include <linux/kthread.h>
1343 +#include <linux/limits.h>
1344 +#include <linux/module.h>
1345 +#include <linux/rwsem.h>
1346 +#include <linux/slab.h>
1347 +#include <linux/spinlock.h>
1348 +#include <linux/string.h>
1349 +#include <linux/freezer.h>
1350 +#include <linux/utsname.h>
1351 +
1352 +#include <linux/usb/ch9.h>
1353 +#include <linux/usb/gadget.h>
1354 +
1355 +#include "gadget_chips.h"
1356 +
1357 +
1358 +
1359 +/*
1360 + * Kbuild is not very cooperative with respect to linking separately
1361 + * compiled library objects into one module. So for now we won't use
1362 + * separate compilation ... ensuring init/exit sections work to shrink
1363 + * the runtime footprint, and giving us at least some parts of what
1364 + * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
1365 + */
1366 +#include "usbstring.c"
1367 +#include "config.c"
1368 +#include "epautoconf.c"
1369 +
1370 +/*-------------------------------------------------------------------------*/
1371 +
1372 +#define DRIVER_DESC "File-backed Storage Gadget"
1373 +#define DRIVER_NAME "g_file_storage"
1374 +#define DRIVER_VERSION "1 September 2010"
1375 +
1376 +static char fsg_string_manufacturer[64];
1377 +static const char fsg_string_product[] = DRIVER_DESC;
1378 +static const char fsg_string_config[] = "Self-powered";
1379 +static const char fsg_string_interface[] = "Mass Storage";
1380 +
1381 +
1382 +#include "storage_common.c"
1383 +
1384 +
1385 +MODULE_DESCRIPTION(DRIVER_DESC);
1386 +MODULE_AUTHOR("Alan Stern");
1387 +MODULE_LICENSE("Dual BSD/GPL");
1388 +
1389 +/*
1390 + * This driver assumes self-powered hardware and has no way for users to
1391 + * trigger remote wakeup. It uses autoconfiguration to select endpoints
1392 + * and endpoint addresses.
1393 + */
1394 +
1395 +
1396 +/*-------------------------------------------------------------------------*/
1397 +
1398 +
1399 +/* Encapsulate the module parameter settings */
1400 +
1401 +static struct {
1402 + char *file[FSG_MAX_LUNS];
1403 + char *serial;
1404 + bool ro[FSG_MAX_LUNS];
1405 + bool nofua[FSG_MAX_LUNS];
1406 + unsigned int num_filenames;
1407 + unsigned int num_ros;
1408 + unsigned int num_nofuas;
1409 + unsigned int nluns;
1410 +
1411 + bool removable;
1412 + bool can_stall;
1413 + bool cdrom;
1414 +
1415 + char *transport_parm;
1416 + char *protocol_parm;
1417 + unsigned short vendor;
1418 + unsigned short product;
1419 + unsigned short release;
1420 + unsigned int buflen;
1421 +
1422 + int transport_type;
1423 + char *transport_name;
1424 + int protocol_type;
1425 + char *protocol_name;
1426 +
1427 +} mod_data = { // Default values
1428 + .transport_parm = "BBB",
1429 + .protocol_parm = "SCSI",
1430 + .removable = 0,
1431 + .can_stall = 1,
1432 + .cdrom = 0,
1433 + .vendor = FSG_VENDOR_ID,
1434 + .product = FSG_PRODUCT_ID,
1435 + .release = 0xffff, // Use controller chip type
1436 + .buflen = 16384,
1437 + };
1438 +
1439 +
1440 +module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
1441 + S_IRUGO);
1442 +MODULE_PARM_DESC(file, "names of backing files or devices");
1443 +
1444 +module_param_named(serial, mod_data.serial, charp, S_IRUGO);
1445 +MODULE_PARM_DESC(serial, "USB serial number");
1446 +
1447 +module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
1448 +MODULE_PARM_DESC(ro, "true to force read-only");
1449 +
1450 +module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
1451 + S_IRUGO);
1452 +MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
1453 +
1454 +module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
1455 +MODULE_PARM_DESC(luns, "number of LUNs");
1456 +
1457 +module_param_named(removable, mod_data.removable, bool, S_IRUGO);
1458 +MODULE_PARM_DESC(removable, "true to simulate removable media");
1459 +
1460 +module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
1461 +MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
1462 +
1463 +module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
1464 +MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
1465 +
1466 +/* In the non-TEST version, only the module parameters listed above
1467 + * are available. */
1468 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1469 +
1470 +module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
1471 +MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
1472 +
1473 +module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
1474 +MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
1475 + "8070, or SCSI)");
1476 +
1477 +module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
1478 +MODULE_PARM_DESC(vendor, "USB Vendor ID");
1479 +
1480 +module_param_named(product, mod_data.product, ushort, S_IRUGO);
1481 +MODULE_PARM_DESC(product, "USB Product ID");
1482 +
1483 +module_param_named(release, mod_data.release, ushort, S_IRUGO);
1484 +MODULE_PARM_DESC(release, "USB release number");
1485 +
1486 +module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
1487 +MODULE_PARM_DESC(buflen, "I/O buffer size");
1488 +
1489 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1490 +
1491 +
1492 +/*
1493 + * These definitions will permit the compiler to avoid generating code for
1494 + * parts of the driver that aren't used in the non-TEST version. Even gcc
1495 + * can recognize when a test of a constant expression yields a dead code
1496 + * path.
1497 + */
1498 +
1499 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1500 +
1501 +#define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
1502 +#define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
1503 +#define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
1504 +
1505 +#else
1506 +
1507 +#define transport_is_bbb() 1
1508 +#define transport_is_cbi() 0
1509 +#define protocol_is_scsi() 1
1510 +
1511 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1512 +
1513 +
1514 +/*-------------------------------------------------------------------------*/
1515 +
1516 +
1517 +struct fsg_dev {
1518 + /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
1519 + spinlock_t lock;
1520 + struct usb_gadget *gadget;
1521 +
1522 + /* filesem protects: backing files in use */
1523 + struct rw_semaphore filesem;
1524 +
1525 + /* reference counting: wait until all LUNs are released */
1526 + struct kref ref;
1527 +
1528 + struct usb_ep *ep0; // Handy copy of gadget->ep0
1529 + struct usb_request *ep0req; // For control responses
1530 + unsigned int ep0_req_tag;
1531 + const char *ep0req_name;
1532 +
1533 + struct usb_request *intreq; // For interrupt responses
1534 + int intreq_busy;
1535 + struct fsg_buffhd *intr_buffhd;
1536 +
1537 + unsigned int bulk_out_maxpacket;
1538 + enum fsg_state state; // For exception handling
1539 + unsigned int exception_req_tag;
1540 +
1541 + u8 config, new_config;
1542 +
1543 + unsigned int running : 1;
1544 + unsigned int bulk_in_enabled : 1;
1545 + unsigned int bulk_out_enabled : 1;
1546 + unsigned int intr_in_enabled : 1;
1547 + unsigned int phase_error : 1;
1548 + unsigned int short_packet_received : 1;
1549 + unsigned int bad_lun_okay : 1;
1550 +
1551 + unsigned long atomic_bitflags;
1552 +#define REGISTERED 0
1553 +#define IGNORE_BULK_OUT 1
1554 +#define SUSPENDED 2
1555 +
1556 + struct usb_ep *bulk_in;
1557 + struct usb_ep *bulk_out;
1558 + struct usb_ep *intr_in;
1559 +
1560 + struct fsg_buffhd *next_buffhd_to_fill;
1561 + struct fsg_buffhd *next_buffhd_to_drain;
1562 +
1563 + int thread_wakeup_needed;
1564 + struct completion thread_notifier;
1565 + struct task_struct *thread_task;
1566 +
1567 + int cmnd_size;
1568 + u8 cmnd[MAX_COMMAND_SIZE];
1569 + enum data_direction data_dir;
1570 + u32 data_size;
1571 + u32 data_size_from_cmnd;
1572 + u32 tag;
1573 + unsigned int lun;
1574 + u32 residue;
1575 + u32 usb_amount_left;
1576 +
1577 + /* The CB protocol offers no way for a host to know when a command
1578 + * has completed. As a result the next command may arrive early,
1579 + * and we will still have to handle it. For that reason we need
1580 + * a buffer to store new commands when using CB (or CBI, which
1581 + * does not oblige a host to wait for command completion either). */
1582 + int cbbuf_cmnd_size;
1583 + u8 cbbuf_cmnd[MAX_COMMAND_SIZE];
1584 +
1585 + unsigned int nluns;
1586 + struct fsg_lun *luns;
1587 + struct fsg_lun *curlun;
1588 + /* Must be the last entry */
1589 + struct fsg_buffhd buffhds[];
1590 +};
1591 +
1592 +typedef void (*fsg_routine_t)(struct fsg_dev *);
1593 +
1594 +static int exception_in_progress(struct fsg_dev *fsg)
1595 +{
1596 + return (fsg->state > FSG_STATE_IDLE);
1597 +}
1598 +
1599 +/* Make bulk-out requests be divisible by the maxpacket size */
1600 +static void set_bulk_out_req_length(struct fsg_dev *fsg,
1601 + struct fsg_buffhd *bh, unsigned int length)
1602 +{
1603 + unsigned int rem;
1604 +
1605 + bh->bulk_out_intended_length = length;
1606 + rem = length % fsg->bulk_out_maxpacket;
1607 + if (rem > 0)
1608 + length += fsg->bulk_out_maxpacket - rem;
1609 + bh->outreq->length = length;
1610 +}
1611 +
1612 +static struct fsg_dev *the_fsg;
1613 +static struct usb_gadget_driver fsg_driver;
1614 +
1615 +
1616 +/*-------------------------------------------------------------------------*/
1617 +
1618 +static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
1619 +{
1620 + const char *name;
1621 +
1622 + if (ep == fsg->bulk_in)
1623 + name = "bulk-in";
1624 + else if (ep == fsg->bulk_out)
1625 + name = "bulk-out";
1626 + else
1627 + name = ep->name;
1628 + DBG(fsg, "%s set halt\n", name);
1629 + return usb_ep_set_halt(ep);
1630 +}
1631 +
1632 +
1633 +/*-------------------------------------------------------------------------*/
1634 +
1635 +/*
1636 + * DESCRIPTORS ... most are static, but strings and (full) configuration
1637 + * descriptors are built on demand. Also the (static) config and interface
1638 + * descriptors are adjusted during fsg_bind().
1639 + */
1640 +
1641 +/* There is only one configuration. */
1642 +#define CONFIG_VALUE 1
1643 +
1644 +static struct usb_device_descriptor
1645 +device_desc = {
1646 + .bLength = sizeof device_desc,
1647 + .bDescriptorType = USB_DT_DEVICE,
1648 +
1649 + .bcdUSB = cpu_to_le16(0x0200),
1650 + .bDeviceClass = USB_CLASS_PER_INTERFACE,
1651 +
1652 + /* The next three values can be overridden by module parameters */
1653 + .idVendor = cpu_to_le16(FSG_VENDOR_ID),
1654 + .idProduct = cpu_to_le16(FSG_PRODUCT_ID),
1655 + .bcdDevice = cpu_to_le16(0xffff),
1656 +
1657 + .iManufacturer = FSG_STRING_MANUFACTURER,
1658 + .iProduct = FSG_STRING_PRODUCT,
1659 + .iSerialNumber = FSG_STRING_SERIAL,
1660 + .bNumConfigurations = 1,
1661 +};
1662 +
1663 +static struct usb_config_descriptor
1664 +config_desc = {
1665 + .bLength = sizeof config_desc,
1666 + .bDescriptorType = USB_DT_CONFIG,
1667 +
1668 + /* wTotalLength computed by usb_gadget_config_buf() */
1669 + .bNumInterfaces = 1,
1670 + .bConfigurationValue = CONFIG_VALUE,
1671 + .iConfiguration = FSG_STRING_CONFIG,
1672 + .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
1673 + .bMaxPower = CONFIG_USB_GADGET_VBUS_DRAW / 2,
1674 +};
1675 +
1676 +
1677 +static struct usb_qualifier_descriptor
1678 +dev_qualifier = {
1679 + .bLength = sizeof dev_qualifier,
1680 + .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
1681 +
1682 + .bcdUSB = cpu_to_le16(0x0200),
1683 + .bDeviceClass = USB_CLASS_PER_INTERFACE,
1684 +
1685 + .bNumConfigurations = 1,
1686 +};
1687 +
1688 +static int populate_bos(struct fsg_dev *fsg, u8 *buf)
1689 +{
1690 + memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
1691 + buf += USB_DT_BOS_SIZE;
1692 +
1693 + memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
1694 + buf += USB_DT_USB_EXT_CAP_SIZE;
1695 +
1696 + memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
1697 +
1698 + return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
1699 + + USB_DT_USB_EXT_CAP_SIZE;
1700 +}
1701 +
1702 +/*
1703 + * Config descriptors must agree with the code that sets configurations
1704 + * and with code managing interfaces and their altsettings. They must
1705 + * also handle different speeds and other-speed requests.
1706 + */
1707 +static int populate_config_buf(struct usb_gadget *gadget,
1708 + u8 *buf, u8 type, unsigned index)
1709 +{
1710 + enum usb_device_speed speed = gadget->speed;
1711 + int len;
1712 + const struct usb_descriptor_header **function;
1713 +
1714 + if (index > 0)
1715 + return -EINVAL;
1716 +
1717 + if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
1718 + speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
1719 + function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
1720 + ? (const struct usb_descriptor_header **)fsg_hs_function
1721 + : (const struct usb_descriptor_header **)fsg_fs_function;
1722 +
1723 + /* for now, don't advertise srp-only devices */
1724 + if (!gadget_is_otg(gadget))
1725 + function++;
1726 +
1727 + len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
1728 + ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
1729 + return len;
1730 +}
1731 +
1732 +
1733 +/*-------------------------------------------------------------------------*/
1734 +
1735 +/* These routines may be called in process context or in_irq */
1736 +
1737 +/* Caller must hold fsg->lock */
1738 +static void wakeup_thread(struct fsg_dev *fsg)
1739 +{
1740 + /* Tell the main thread that something has happened */
1741 + fsg->thread_wakeup_needed = 1;
1742 + if (fsg->thread_task)
1743 + wake_up_process(fsg->thread_task);
1744 +}
1745 +
1746 +
1747 +static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
1748 +{
1749 + unsigned long flags;
1750 +
1751 + /* Do nothing if a higher-priority exception is already in progress.
1752 + * If a lower-or-equal priority exception is in progress, preempt it
1753 + * and notify the main thread by sending it a signal. */
1754 + spin_lock_irqsave(&fsg->lock, flags);
1755 + if (fsg->state <= new_state) {
1756 + fsg->exception_req_tag = fsg->ep0_req_tag;
1757 + fsg->state = new_state;
1758 + if (fsg->thread_task)
1759 + send_sig_info(SIGUSR1, SEND_SIG_FORCED,
1760 + fsg->thread_task);
1761 + }
1762 + spin_unlock_irqrestore(&fsg->lock, flags);
1763 +}
1764 +
1765 +
1766 +/*-------------------------------------------------------------------------*/
1767 +
1768 +/* The disconnect callback and ep0 routines. These always run in_irq,
1769 + * except that ep0_queue() is called in the main thread to acknowledge
1770 + * completion of various requests: set config, set interface, and
1771 + * Bulk-only device reset. */
1772 +
1773 +static void fsg_disconnect(struct usb_gadget *gadget)
1774 +{
1775 + struct fsg_dev *fsg = get_gadget_data(gadget);
1776 +
1777 + DBG(fsg, "disconnect or port reset\n");
1778 + raise_exception(fsg, FSG_STATE_DISCONNECT);
1779 +}
1780 +
1781 +
1782 +static int ep0_queue(struct fsg_dev *fsg)
1783 +{
1784 + int rc;
1785 +
1786 + rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
1787 + if (rc != 0 && rc != -ESHUTDOWN) {
1788 +
1789 + /* We can't do much more than wait for a reset */
1790 + WARNING(fsg, "error in submission: %s --> %d\n",
1791 + fsg->ep0->name, rc);
1792 + }
1793 + return rc;
1794 +}
1795 +
1796 +static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
1797 +{
1798 + struct fsg_dev *fsg = ep->driver_data;
1799 +
1800 + if (req->actual > 0)
1801 + dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
1802 + if (req->status || req->actual != req->length)
1803 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1804 + req->status, req->actual, req->length);
1805 + if (req->status == -ECONNRESET) // Request was cancelled
1806 + usb_ep_fifo_flush(ep);
1807 +
1808 + if (req->status == 0 && req->context)
1809 + ((fsg_routine_t) (req->context))(fsg);
1810 +}
1811 +
1812 +
1813 +/*-------------------------------------------------------------------------*/
1814 +
1815 +/* Bulk and interrupt endpoint completion handlers.
1816 + * These always run in_irq. */
1817 +
1818 +static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
1819 +{
1820 + struct fsg_dev *fsg = ep->driver_data;
1821 + struct fsg_buffhd *bh = req->context;
1822 +
1823 + if (req->status || req->actual != req->length)
1824 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1825 + req->status, req->actual, req->length);
1826 + if (req->status == -ECONNRESET) // Request was cancelled
1827 + usb_ep_fifo_flush(ep);
1828 +
1829 + /* Hold the lock while we update the request and buffer states */
1830 + smp_wmb();
1831 + spin_lock(&fsg->lock);
1832 + bh->inreq_busy = 0;
1833 + bh->state = BUF_STATE_EMPTY;
1834 + wakeup_thread(fsg);
1835 + spin_unlock(&fsg->lock);
1836 +}
1837 +
1838 +static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
1839 +{
1840 + struct fsg_dev *fsg = ep->driver_data;
1841 + struct fsg_buffhd *bh = req->context;
1842 +
1843 + dump_msg(fsg, "bulk-out", req->buf, req->actual);
1844 + if (req->status || req->actual != bh->bulk_out_intended_length)
1845 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1846 + req->status, req->actual,
1847 + bh->bulk_out_intended_length);
1848 + if (req->status == -ECONNRESET) // Request was cancelled
1849 + usb_ep_fifo_flush(ep);
1850 +
1851 + /* Hold the lock while we update the request and buffer states */
1852 + smp_wmb();
1853 + spin_lock(&fsg->lock);
1854 + bh->outreq_busy = 0;
1855 + bh->state = BUF_STATE_FULL;
1856 + wakeup_thread(fsg);
1857 + spin_unlock(&fsg->lock);
1858 +}
1859 +
1860 +
1861 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1862 +static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1863 +{
1864 + struct fsg_dev *fsg = ep->driver_data;
1865 + struct fsg_buffhd *bh = req->context;
1866 +
1867 + if (req->status || req->actual != req->length)
1868 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1869 + req->status, req->actual, req->length);
1870 + if (req->status == -ECONNRESET) // Request was cancelled
1871 + usb_ep_fifo_flush(ep);
1872 +
1873 + /* Hold the lock while we update the request and buffer states */
1874 + smp_wmb();
1875 + spin_lock(&fsg->lock);
1876 + fsg->intreq_busy = 0;
1877 + bh->state = BUF_STATE_EMPTY;
1878 + wakeup_thread(fsg);
1879 + spin_unlock(&fsg->lock);
1880 +}
1881 +
1882 +#else
1883 +static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1884 +{}
1885 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1886 +
1887 +
1888 +/*-------------------------------------------------------------------------*/
1889 +
1890 +/* Ep0 class-specific handlers. These always run in_irq. */
1891 +
1892 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1893 +static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1894 +{
1895 + struct usb_request *req = fsg->ep0req;
1896 + static u8 cbi_reset_cmnd[6] = {
1897 + SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
1898 +
1899 + /* Error in command transfer? */
1900 + if (req->status || req->length != req->actual ||
1901 + req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
1902 +
1903 + /* Not all controllers allow a protocol stall after
1904 + * receiving control-out data, but we'll try anyway. */
1905 + fsg_set_halt(fsg, fsg->ep0);
1906 + return; // Wait for reset
1907 + }
1908 +
1909 + /* Is it the special reset command? */
1910 + if (req->actual >= sizeof cbi_reset_cmnd &&
1911 + memcmp(req->buf, cbi_reset_cmnd,
1912 + sizeof cbi_reset_cmnd) == 0) {
1913 +
1914 + /* Raise an exception to stop the current operation
1915 + * and reinitialize our state. */
1916 + DBG(fsg, "cbi reset request\n");
1917 + raise_exception(fsg, FSG_STATE_RESET);
1918 + return;
1919 + }
1920 +
1921 + VDBG(fsg, "CB[I] accept device-specific command\n");
1922 + spin_lock(&fsg->lock);
1923 +
1924 + /* Save the command for later */
1925 + if (fsg->cbbuf_cmnd_size)
1926 + WARNING(fsg, "CB[I] overwriting previous command\n");
1927 + fsg->cbbuf_cmnd_size = req->actual;
1928 + memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
1929 +
1930 + wakeup_thread(fsg);
1931 + spin_unlock(&fsg->lock);
1932 +}
1933 +
1934 +#else
1935 +static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1936 +{}
1937 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1938 +
1939 +
1940 +static int class_setup_req(struct fsg_dev *fsg,
1941 + const struct usb_ctrlrequest *ctrl)
1942 +{
1943 + struct usb_request *req = fsg->ep0req;
1944 + int value = -EOPNOTSUPP;
1945 + u16 w_index = le16_to_cpu(ctrl->wIndex);
1946 + u16 w_value = le16_to_cpu(ctrl->wValue);
1947 + u16 w_length = le16_to_cpu(ctrl->wLength);
1948 +
1949 + if (!fsg->config)
1950 + return value;
1951 +
1952 + /* Handle Bulk-only class-specific requests */
1953 + if (transport_is_bbb()) {
1954 + switch (ctrl->bRequest) {
1955 +
1956 + case US_BULK_RESET_REQUEST:
1957 + if (ctrl->bRequestType != (USB_DIR_OUT |
1958 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1959 + break;
1960 + if (w_index != 0 || w_value != 0 || w_length != 0) {
1961 + value = -EDOM;
1962 + break;
1963 + }
1964 +
1965 + /* Raise an exception to stop the current operation
1966 + * and reinitialize our state. */
1967 + DBG(fsg, "bulk reset request\n");
1968 + raise_exception(fsg, FSG_STATE_RESET);
1969 + value = DELAYED_STATUS;
1970 + break;
1971 +
1972 + case US_BULK_GET_MAX_LUN:
1973 + if (ctrl->bRequestType != (USB_DIR_IN |
1974 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1975 + break;
1976 + if (w_index != 0 || w_value != 0 || w_length != 1) {
1977 + value = -EDOM;
1978 + break;
1979 + }
1980 + VDBG(fsg, "get max LUN\n");
1981 + *(u8 *) req->buf = fsg->nluns - 1;
1982 + value = 1;
1983 + break;
1984 + }
1985 + }
1986 +
1987 + /* Handle CBI class-specific requests */
1988 + else {
1989 + switch (ctrl->bRequest) {
1990 +
1991 + case USB_CBI_ADSC_REQUEST:
1992 + if (ctrl->bRequestType != (USB_DIR_OUT |
1993 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1994 + break;
1995 + if (w_index != 0 || w_value != 0) {
1996 + value = -EDOM;
1997 + break;
1998 + }
1999 + if (w_length > MAX_COMMAND_SIZE) {
2000 + value = -EOVERFLOW;
2001 + break;
2002 + }
2003 + value = w_length;
2004 + fsg->ep0req->context = received_cbi_adsc;
2005 + break;
2006 + }
2007 + }
2008 +
2009 + if (value == -EOPNOTSUPP)
2010 + VDBG(fsg,
2011 + "unknown class-specific control req "
2012 + "%02x.%02x v%04x i%04x l%u\n",
2013 + ctrl->bRequestType, ctrl->bRequest,
2014 + le16_to_cpu(ctrl->wValue), w_index, w_length);
2015 + return value;
2016 +}
2017 +
2018 +
2019 +/*-------------------------------------------------------------------------*/
2020 +
2021 +/* Ep0 standard request handlers. These always run in_irq. */
2022 +
2023 +static int standard_setup_req(struct fsg_dev *fsg,
2024 + const struct usb_ctrlrequest *ctrl)
2025 +{
2026 + struct usb_request *req = fsg->ep0req;
2027 + int value = -EOPNOTSUPP;
2028 + u16 w_index = le16_to_cpu(ctrl->wIndex);
2029 + u16 w_value = le16_to_cpu(ctrl->wValue);
2030 +
2031 + /* Usually this just stores reply data in the pre-allocated ep0 buffer,
2032 + * but config change events will also reconfigure hardware. */
2033 + switch (ctrl->bRequest) {
2034 +
2035 + case USB_REQ_GET_DESCRIPTOR:
2036 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
2037 + USB_RECIP_DEVICE))
2038 + break;
2039 + switch (w_value >> 8) {
2040 +
2041 + case USB_DT_DEVICE:
2042 + VDBG(fsg, "get device descriptor\n");
2043 + device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
2044 + value = sizeof device_desc;
2045 + memcpy(req->buf, &device_desc, value);
2046 + break;
2047 + case USB_DT_DEVICE_QUALIFIER:
2048 + VDBG(fsg, "get device qualifier\n");
2049 + if (!gadget_is_dualspeed(fsg->gadget) ||
2050 + fsg->gadget->speed == USB_SPEED_SUPER)
2051 + break;
2052 + /*
2053 + * Assume ep0 uses the same maxpacket value for both
2054 + * speeds
2055 + */
2056 + dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
2057 + value = sizeof dev_qualifier;
2058 + memcpy(req->buf, &dev_qualifier, value);
2059 + break;
2060 +
2061 + case USB_DT_OTHER_SPEED_CONFIG:
2062 + VDBG(fsg, "get other-speed config descriptor\n");
2063 + if (!gadget_is_dualspeed(fsg->gadget) ||
2064 + fsg->gadget->speed == USB_SPEED_SUPER)
2065 + break;
2066 + goto get_config;
2067 + case USB_DT_CONFIG:
2068 + VDBG(fsg, "get configuration descriptor\n");
2069 +get_config:
2070 + value = populate_config_buf(fsg->gadget,
2071 + req->buf,
2072 + w_value >> 8,
2073 + w_value & 0xff);
2074 + break;
2075 +
2076 + case USB_DT_STRING:
2077 + VDBG(fsg, "get string descriptor\n");
2078 +
2079 + /* wIndex == language code */
2080 + value = usb_gadget_get_string(&fsg_stringtab,
2081 + w_value & 0xff, req->buf);
2082 + break;
2083 +
2084 + case USB_DT_BOS:
2085 + VDBG(fsg, "get bos descriptor\n");
2086 +
2087 + if (gadget_is_superspeed(fsg->gadget))
2088 + value = populate_bos(fsg, req->buf);
2089 + break;
2090 + }
2091 +
2092 + break;
2093 +
2094 + /* One config, two speeds */
2095 + case USB_REQ_SET_CONFIGURATION:
2096 + if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
2097 + USB_RECIP_DEVICE))
2098 + break;
2099 + VDBG(fsg, "set configuration\n");
2100 + if (w_value == CONFIG_VALUE || w_value == 0) {
2101 + fsg->new_config = w_value;
2102 +
2103 + /* Raise an exception to wipe out previous transaction
2104 + * state (queued bufs, etc) and set the new config. */
2105 + raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
2106 + value = DELAYED_STATUS;
2107 + }
2108 + break;
2109 + case USB_REQ_GET_CONFIGURATION:
2110 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
2111 + USB_RECIP_DEVICE))
2112 + break;
2113 + VDBG(fsg, "get configuration\n");
2114 + *(u8 *) req->buf = fsg->config;
2115 + value = 1;
2116 + break;
2117 +
2118 + case USB_REQ_SET_INTERFACE:
2119 + if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
2120 + USB_RECIP_INTERFACE))
2121 + break;
2122 + if (fsg->config && w_index == 0) {
2123 +
2124 + /* Raise an exception to wipe out previous transaction
2125 + * state (queued bufs, etc) and install the new
2126 + * interface altsetting. */
2127 + raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
2128 + value = DELAYED_STATUS;
2129 + }
2130 + break;
2131 + case USB_REQ_GET_INTERFACE:
2132 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
2133 + USB_RECIP_INTERFACE))
2134 + break;
2135 + if (!fsg->config)
2136 + break;
2137 + if (w_index != 0) {
2138 + value = -EDOM;
2139 + break;
2140 + }
2141 + VDBG(fsg, "get interface\n");
2142 + *(u8 *) req->buf = 0;
2143 + value = 1;
2144 + break;
2145 +
2146 + default:
2147 + VDBG(fsg,
2148 + "unknown control req %02x.%02x v%04x i%04x l%u\n",
2149 + ctrl->bRequestType, ctrl->bRequest,
2150 + w_value, w_index, le16_to_cpu(ctrl->wLength));
2151 + }
2152 +
2153 + return value;
2154 +}
2155 +
2156 +
2157 +static int fsg_setup(struct usb_gadget *gadget,
2158 + const struct usb_ctrlrequest *ctrl)
2159 +{
2160 + struct fsg_dev *fsg = get_gadget_data(gadget);
2161 + int rc;
2162 + int w_length = le16_to_cpu(ctrl->wLength);
2163 +
2164 + ++fsg->ep0_req_tag; // Record arrival of a new request
2165 + fsg->ep0req->context = NULL;
2166 + fsg->ep0req->length = 0;
2167 + dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
2168 +
2169 + if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
2170 + rc = class_setup_req(fsg, ctrl);
2171 + else
2172 + rc = standard_setup_req(fsg, ctrl);
2173 +
2174 + /* Respond with data/status or defer until later? */
2175 + if (rc >= 0 && rc != DELAYED_STATUS) {
2176 + rc = min(rc, w_length);
2177 + fsg->ep0req->length = rc;
2178 + fsg->ep0req->zero = rc < w_length;
2179 + fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
2180 + "ep0-in" : "ep0-out");
2181 + rc = ep0_queue(fsg);
2182 + }
2183 +
2184 + /* Device either stalls (rc < 0) or reports success */
2185 + return rc;
2186 +}
2187 +
2188 +
2189 +/*-------------------------------------------------------------------------*/
2190 +
2191 +/* All the following routines run in process context */
2192 +
2193 +
2194 +/* Use this for bulk or interrupt transfers, not ep0 */
2195 +static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
2196 + struct usb_request *req, int *pbusy,
2197 + enum fsg_buffer_state *state)
2198 +{
2199 + int rc;
2200 +
2201 + if (ep == fsg->bulk_in)
2202 + dump_msg(fsg, "bulk-in", req->buf, req->length);
2203 + else if (ep == fsg->intr_in)
2204 + dump_msg(fsg, "intr-in", req->buf, req->length);
2205 +
2206 + spin_lock_irq(&fsg->lock);
2207 + *pbusy = 1;
2208 + *state = BUF_STATE_BUSY;
2209 + spin_unlock_irq(&fsg->lock);
2210 + rc = usb_ep_queue(ep, req, GFP_KERNEL);
2211 + if (rc != 0) {
2212 + *pbusy = 0;
2213 + *state = BUF_STATE_EMPTY;
2214 +
2215 + /* We can't do much more than wait for a reset */
2216 +
2217 + /* Note: currently the net2280 driver fails zero-length
2218 + * submissions if DMA is enabled. */
2219 + if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
2220 + req->length == 0))
2221 + WARNING(fsg, "error in submission: %s --> %d\n",
2222 + ep->name, rc);
2223 + }
2224 +}
2225 +
2226 +
2227 +static int sleep_thread(struct fsg_dev *fsg)
2228 +{
2229 + int rc = 0;
2230 +
2231 + /* Wait until a signal arrives or we are woken up */
2232 + for (;;) {
2233 + try_to_freeze();
2234 + set_current_state(TASK_INTERRUPTIBLE);
2235 + if (signal_pending(current)) {
2236 + rc = -EINTR;
2237 + break;
2238 + }
2239 + if (fsg->thread_wakeup_needed)
2240 + break;
2241 + schedule();
2242 + }
2243 + __set_current_state(TASK_RUNNING);
2244 + fsg->thread_wakeup_needed = 0;
2245 + return rc;
2246 +}
2247 +
2248 +
2249 +/*-------------------------------------------------------------------------*/
2250 +
2251 +static int do_read(struct fsg_dev *fsg)
2252 +{
2253 + struct fsg_lun *curlun = fsg->curlun;
2254 + u32 lba;
2255 + struct fsg_buffhd *bh;
2256 + int rc;
2257 + u32 amount_left;
2258 + loff_t file_offset, file_offset_tmp;
2259 + unsigned int amount;
2260 + ssize_t nread;
2261 +
2262 + /* Get the starting Logical Block Address and check that it's
2263 + * not too big */
2264 + if (fsg->cmnd[0] == READ_6)
2265 + lba = get_unaligned_be24(&fsg->cmnd[1]);
2266 + else {
2267 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2268 +
2269 + /* We allow DPO (Disable Page Out = don't save data in the
2270 + * cache) and FUA (Force Unit Access = don't read from the
2271 + * cache), but we don't implement them. */
2272 + if ((fsg->cmnd[1] & ~0x18) != 0) {
2273 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2274 + return -EINVAL;
2275 + }
2276 + }
2277 + if (lba >= curlun->num_sectors) {
2278 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2279 + return -EINVAL;
2280 + }
2281 + file_offset = ((loff_t) lba) << curlun->blkbits;
2282 +
2283 + /* Carry out the file reads */
2284 + amount_left = fsg->data_size_from_cmnd;
2285 + if (unlikely(amount_left == 0))
2286 + return -EIO; // No default reply
2287 +
2288 + for (;;) {
2289 +
2290 + /* Figure out how much we need to read:
2291 + * Try to read the remaining amount.
2292 + * But don't read more than the buffer size.
2293 + * And don't try to read past the end of the file.
2294 + */
2295 + amount = min((unsigned int) amount_left, mod_data.buflen);
2296 + amount = min((loff_t) amount,
2297 + curlun->file_length - file_offset);
2298 +
2299 + /* Wait for the next buffer to become available */
2300 + bh = fsg->next_buffhd_to_fill;
2301 + while (bh->state != BUF_STATE_EMPTY) {
2302 + rc = sleep_thread(fsg);
2303 + if (rc)
2304 + return rc;
2305 + }
2306 +
2307 + /* If we were asked to read past the end of file,
2308 + * end with an empty buffer. */
2309 + if (amount == 0) {
2310 + curlun->sense_data =
2311 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2312 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2313 + curlun->info_valid = 1;
2314 + bh->inreq->length = 0;
2315 + bh->state = BUF_STATE_FULL;
2316 + break;
2317 + }
2318 +
2319 + /* Perform the read */
2320 + file_offset_tmp = file_offset;
2321 + nread = vfs_read(curlun->filp,
2322 + (char __user *) bh->buf,
2323 + amount, &file_offset_tmp);
2324 + VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2325 + (unsigned long long) file_offset,
2326 + (int) nread);
2327 + if (signal_pending(current))
2328 + return -EINTR;
2329 +
2330 + if (nread < 0) {
2331 + LDBG(curlun, "error in file read: %d\n",
2332 + (int) nread);
2333 + nread = 0;
2334 + } else if (nread < amount) {
2335 + LDBG(curlun, "partial file read: %d/%u\n",
2336 + (int) nread, amount);
2337 + nread = round_down(nread, curlun->blksize);
2338 + }
2339 + file_offset += nread;
2340 + amount_left -= nread;
2341 + fsg->residue -= nread;
2342 +
2343 + /* Except at the end of the transfer, nread will be
2344 + * equal to the buffer size, which is divisible by the
2345 + * bulk-in maxpacket size.
2346 + */
2347 + bh->inreq->length = nread;
2348 + bh->state = BUF_STATE_FULL;
2349 +
2350 + /* If an error occurred, report it and its position */
2351 + if (nread < amount) {
2352 + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2353 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2354 + curlun->info_valid = 1;
2355 + break;
2356 + }
2357 +
2358 + if (amount_left == 0)
2359 + break; // No more left to read
2360 +
2361 + /* Send this buffer and go read some more */
2362 + bh->inreq->zero = 0;
2363 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
2364 + &bh->inreq_busy, &bh->state);
2365 + fsg->next_buffhd_to_fill = bh->next;
2366 + }
2367 +
2368 + return -EIO; // No default reply
2369 +}
2370 +
2371 +
2372 +/*-------------------------------------------------------------------------*/
2373 +
2374 +static int do_write(struct fsg_dev *fsg)
2375 +{
2376 + struct fsg_lun *curlun = fsg->curlun;
2377 + u32 lba;
2378 + struct fsg_buffhd *bh;
2379 + int get_some_more;
2380 + u32 amount_left_to_req, amount_left_to_write;
2381 + loff_t usb_offset, file_offset, file_offset_tmp;
2382 + unsigned int amount;
2383 + ssize_t nwritten;
2384 + int rc;
2385 +
2386 + if (curlun->ro) {
2387 + curlun->sense_data = SS_WRITE_PROTECTED;
2388 + return -EINVAL;
2389 + }
2390 + spin_lock(&curlun->filp->f_lock);
2391 + curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait
2392 + spin_unlock(&curlun->filp->f_lock);
2393 +
2394 + /* Get the starting Logical Block Address and check that it's
2395 + * not too big */
2396 + if (fsg->cmnd[0] == WRITE_6)
2397 + lba = get_unaligned_be24(&fsg->cmnd[1]);
2398 + else {
2399 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2400 +
2401 + /* We allow DPO (Disable Page Out = don't save data in the
2402 + * cache) and FUA (Force Unit Access = write directly to the
2403 + * medium). We don't implement DPO; we implement FUA by
2404 + * performing synchronous output. */
2405 + if ((fsg->cmnd[1] & ~0x18) != 0) {
2406 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2407 + return -EINVAL;
2408 + }
2409 + /* FUA */
2410 + if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
2411 + spin_lock(&curlun->filp->f_lock);
2412 + curlun->filp->f_flags |= O_DSYNC;
2413 + spin_unlock(&curlun->filp->f_lock);
2414 + }
2415 + }
2416 + if (lba >= curlun->num_sectors) {
2417 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2418 + return -EINVAL;
2419 + }
2420 +
2421 + /* Carry out the file writes */
2422 + get_some_more = 1;
2423 + file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
2424 + amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
2425 +
2426 + while (amount_left_to_write > 0) {
2427 +
2428 + /* Queue a request for more data from the host */
2429 + bh = fsg->next_buffhd_to_fill;
2430 + if (bh->state == BUF_STATE_EMPTY && get_some_more) {
2431 +
2432 + /* Figure out how much we want to get:
2433 + * Try to get the remaining amount,
2434 + * but not more than the buffer size.
2435 + */
2436 + amount = min(amount_left_to_req, mod_data.buflen);
2437 +
2438 + /* Beyond the end of the backing file? */
2439 + if (usb_offset >= curlun->file_length) {
2440 + get_some_more = 0;
2441 + curlun->sense_data =
2442 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2443 + curlun->sense_data_info = usb_offset >> curlun->blkbits;
2444 + curlun->info_valid = 1;
2445 + continue;
2446 + }
2447 +
2448 + /* Get the next buffer */
2449 + usb_offset += amount;
2450 + fsg->usb_amount_left -= amount;
2451 + amount_left_to_req -= amount;
2452 + if (amount_left_to_req == 0)
2453 + get_some_more = 0;
2454 +
2455 + /* Except at the end of the transfer, amount will be
2456 + * equal to the buffer size, which is divisible by
2457 + * the bulk-out maxpacket size.
2458 + */
2459 + set_bulk_out_req_length(fsg, bh, amount);
2460 + start_transfer(fsg, fsg->bulk_out, bh->outreq,
2461 + &bh->outreq_busy, &bh->state);
2462 + fsg->next_buffhd_to_fill = bh->next;
2463 + continue;
2464 + }
2465 +
2466 + /* Write the received data to the backing file */
2467 + bh = fsg->next_buffhd_to_drain;
2468 + if (bh->state == BUF_STATE_EMPTY && !get_some_more)
2469 + break; // We stopped early
2470 + if (bh->state == BUF_STATE_FULL) {
2471 + smp_rmb();
2472 + fsg->next_buffhd_to_drain = bh->next;
2473 + bh->state = BUF_STATE_EMPTY;
2474 +
2475 + /* Did something go wrong with the transfer? */
2476 + if (bh->outreq->status != 0) {
2477 + curlun->sense_data = SS_COMMUNICATION_FAILURE;
2478 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2479 + curlun->info_valid = 1;
2480 + break;
2481 + }
2482 +
2483 + amount = bh->outreq->actual;
2484 + if (curlun->file_length - file_offset < amount) {
2485 + LERROR(curlun,
2486 + "write %u @ %llu beyond end %llu\n",
2487 + amount, (unsigned long long) file_offset,
2488 + (unsigned long long) curlun->file_length);
2489 + amount = curlun->file_length - file_offset;
2490 + }
2491 +
2492 + /* Don't accept excess data. The spec doesn't say
2493 + * what to do in this case. We'll ignore the error.
2494 + */
2495 + amount = min(amount, bh->bulk_out_intended_length);
2496 +
2497 + /* Don't write a partial block */
2498 + amount = round_down(amount, curlun->blksize);
2499 + if (amount == 0)
2500 + goto empty_write;
2501 +
2502 + /* Perform the write */
2503 + file_offset_tmp = file_offset;
2504 + nwritten = vfs_write(curlun->filp,
2505 + (char __user *) bh->buf,
2506 + amount, &file_offset_tmp);
2507 + VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
2508 + (unsigned long long) file_offset,
2509 + (int) nwritten);
2510 + if (signal_pending(current))
2511 + return -EINTR; // Interrupted!
2512 +
2513 + if (nwritten < 0) {
2514 + LDBG(curlun, "error in file write: %d\n",
2515 + (int) nwritten);
2516 + nwritten = 0;
2517 + } else if (nwritten < amount) {
2518 + LDBG(curlun, "partial file write: %d/%u\n",
2519 + (int) nwritten, amount);
2520 + nwritten = round_down(nwritten, curlun->blksize);
2521 + }
2522 + file_offset += nwritten;
2523 + amount_left_to_write -= nwritten;
2524 + fsg->residue -= nwritten;
2525 +
2526 + /* If an error occurred, report it and its position */
2527 + if (nwritten < amount) {
2528 + curlun->sense_data = SS_WRITE_ERROR;
2529 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2530 + curlun->info_valid = 1;
2531 + break;
2532 + }
2533 +
2534 + empty_write:
2535 + /* Did the host decide to stop early? */
2536 + if (bh->outreq->actual < bh->bulk_out_intended_length) {
2537 + fsg->short_packet_received = 1;
2538 + break;
2539 + }
2540 + continue;
2541 + }
2542 +
2543 + /* Wait for something to happen */
2544 + rc = sleep_thread(fsg);
2545 + if (rc)
2546 + return rc;
2547 + }
2548 +
2549 + return -EIO; // No default reply
2550 +}
2551 +
2552 +
2553 +/*-------------------------------------------------------------------------*/
2554 +
2555 +static int do_synchronize_cache(struct fsg_dev *fsg)
2556 +{
2557 + struct fsg_lun *curlun = fsg->curlun;
2558 + int rc;
2559 +
2560 + /* We ignore the requested LBA and write out all file's
2561 + * dirty data buffers. */
2562 + rc = fsg_lun_fsync_sub(curlun);
2563 + if (rc)
2564 + curlun->sense_data = SS_WRITE_ERROR;
2565 + return 0;
2566 +}
2567 +
2568 +
2569 +/*-------------------------------------------------------------------------*/
2570 +
2571 +static void invalidate_sub(struct fsg_lun *curlun)
2572 +{
2573 + struct file *filp = curlun->filp;
2574 + struct inode *inode = filp->f_path.dentry->d_inode;
2575 + unsigned long rc;
2576 +
2577 + rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
2578 + VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
2579 +}
2580 +
2581 +static int do_verify(struct fsg_dev *fsg)
2582 +{
2583 + struct fsg_lun *curlun = fsg->curlun;
2584 + u32 lba;
2585 + u32 verification_length;
2586 + struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
2587 + loff_t file_offset, file_offset_tmp;
2588 + u32 amount_left;
2589 + unsigned int amount;
2590 + ssize_t nread;
2591 +
2592 + /* Get the starting Logical Block Address and check that it's
2593 + * not too big */
2594 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2595 + if (lba >= curlun->num_sectors) {
2596 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2597 + return -EINVAL;
2598 + }
2599 +
2600 + /* We allow DPO (Disable Page Out = don't save data in the
2601 + * cache) but we don't implement it. */
2602 + if ((fsg->cmnd[1] & ~0x10) != 0) {
2603 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2604 + return -EINVAL;
2605 + }
2606 +
2607 + verification_length = get_unaligned_be16(&fsg->cmnd[7]);
2608 + if (unlikely(verification_length == 0))
2609 + return -EIO; // No default reply
2610 +
2611 + /* Prepare to carry out the file verify */
2612 + amount_left = verification_length << curlun->blkbits;
2613 + file_offset = ((loff_t) lba) << curlun->blkbits;
2614 +
2615 + /* Write out all the dirty buffers before invalidating them */
2616 + fsg_lun_fsync_sub(curlun);
2617 + if (signal_pending(current))
2618 + return -EINTR;
2619 +
2620 + invalidate_sub(curlun);
2621 + if (signal_pending(current))
2622 + return -EINTR;
2623 +
2624 + /* Just try to read the requested blocks */
2625 + while (amount_left > 0) {
2626 +
2627 + /* Figure out how much we need to read:
2628 + * Try to read the remaining amount, but not more than
2629 + * the buffer size.
2630 + * And don't try to read past the end of the file.
2631 + */
2632 + amount = min((unsigned int) amount_left, mod_data.buflen);
2633 + amount = min((loff_t) amount,
2634 + curlun->file_length - file_offset);
2635 + if (amount == 0) {
2636 + curlun->sense_data =
2637 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2638 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2639 + curlun->info_valid = 1;
2640 + break;
2641 + }
2642 +
2643 + /* Perform the read */
2644 + file_offset_tmp = file_offset;
2645 + nread = vfs_read(curlun->filp,
2646 + (char __user *) bh->buf,
2647 + amount, &file_offset_tmp);
2648 + VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2649 + (unsigned long long) file_offset,
2650 + (int) nread);
2651 + if (signal_pending(current))
2652 + return -EINTR;
2653 +
2654 + if (nread < 0) {
2655 + LDBG(curlun, "error in file verify: %d\n",
2656 + (int) nread);
2657 + nread = 0;
2658 + } else if (nread < amount) {
2659 + LDBG(curlun, "partial file verify: %d/%u\n",
2660 + (int) nread, amount);
2661 + nread = round_down(nread, curlun->blksize);
2662 + }
2663 + if (nread == 0) {
2664 + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2665 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2666 + curlun->info_valid = 1;
2667 + break;
2668 + }
2669 + file_offset += nread;
2670 + amount_left -= nread;
2671 + }
2672 + return 0;
2673 +}
2674 +
2675 +
2676 +/*-------------------------------------------------------------------------*/
2677 +
2678 +static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2679 +{
2680 + u8 *buf = (u8 *) bh->buf;
2681 +
2682 + static char vendor_id[] = "Linux ";
2683 + static char product_disk_id[] = "File-Stor Gadget";
2684 + static char product_cdrom_id[] = "File-CD Gadget ";
2685 +
2686 + if (!fsg->curlun) { // Unsupported LUNs are okay
2687 + fsg->bad_lun_okay = 1;
2688 + memset(buf, 0, 36);
2689 + buf[0] = 0x7f; // Unsupported, no device-type
2690 + buf[4] = 31; // Additional length
2691 + return 36;
2692 + }
2693 +
2694 + memset(buf, 0, 8);
2695 + buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
2696 + if (mod_data.removable)
2697 + buf[1] = 0x80;
2698 + buf[2] = 2; // ANSI SCSI level 2
2699 + buf[3] = 2; // SCSI-2 INQUIRY data format
2700 + buf[4] = 31; // Additional length
2701 + // No special options
2702 + sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
2703 + (mod_data.cdrom ? product_cdrom_id :
2704 + product_disk_id),
2705 + mod_data.release);
2706 + return 36;
2707 +}
2708 +
2709 +
2710 +static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2711 +{
2712 + struct fsg_lun *curlun = fsg->curlun;
2713 + u8 *buf = (u8 *) bh->buf;
2714 + u32 sd, sdinfo;
2715 + int valid;
2716 +
2717 + /*
2718 + * From the SCSI-2 spec., section 7.9 (Unit attention condition):
2719 + *
2720 + * If a REQUEST SENSE command is received from an initiator
2721 + * with a pending unit attention condition (before the target
2722 + * generates the contingent allegiance condition), then the
2723 + * target shall either:
2724 + * a) report any pending sense data and preserve the unit
2725 + * attention condition on the logical unit, or,
2726 + * b) report the unit attention condition, may discard any
2727 + * pending sense data, and clear the unit attention
2728 + * condition on the logical unit for that initiator.
2729 + *
2730 + * FSG normally uses option a); enable this code to use option b).
2731 + */
2732 +#if 0
2733 + if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
2734 + curlun->sense_data = curlun->unit_attention_data;
2735 + curlun->unit_attention_data = SS_NO_SENSE;
2736 + }
2737 +#endif
2738 +
2739 + if (!curlun) { // Unsupported LUNs are okay
2740 + fsg->bad_lun_okay = 1;
2741 + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2742 + sdinfo = 0;
2743 + valid = 0;
2744 + } else {
2745 + sd = curlun->sense_data;
2746 + sdinfo = curlun->sense_data_info;
2747 + valid = curlun->info_valid << 7;
2748 + curlun->sense_data = SS_NO_SENSE;
2749 + curlun->sense_data_info = 0;
2750 + curlun->info_valid = 0;
2751 + }
2752 +
2753 + memset(buf, 0, 18);
2754 + buf[0] = valid | 0x70; // Valid, current error
2755 + buf[2] = SK(sd);
2756 + put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
2757 + buf[7] = 18 - 8; // Additional sense length
2758 + buf[12] = ASC(sd);
2759 + buf[13] = ASCQ(sd);
2760 + return 18;
2761 +}
2762 +
2763 +
2764 +static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2765 +{
2766 + struct fsg_lun *curlun = fsg->curlun;
2767 + u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
2768 + int pmi = fsg->cmnd[8];
2769 + u8 *buf = (u8 *) bh->buf;
2770 +
2771 + /* Check the PMI and LBA fields */
2772 + if (pmi > 1 || (pmi == 0 && lba != 0)) {
2773 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2774 + return -EINVAL;
2775 + }
2776 +
2777 + put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
2778 + /* Max logical block */
2779 + put_unaligned_be32(curlun->blksize, &buf[4]); /* Block length */
2780 + return 8;
2781 +}
2782 +
2783 +
2784 +static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2785 +{
2786 + struct fsg_lun *curlun = fsg->curlun;
2787 + int msf = fsg->cmnd[1] & 0x02;
2788 + u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
2789 + u8 *buf = (u8 *) bh->buf;
2790 +
2791 + if ((fsg->cmnd[1] & ~0x02) != 0) { /* Mask away MSF */
2792 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2793 + return -EINVAL;
2794 + }
2795 + if (lba >= curlun->num_sectors) {
2796 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2797 + return -EINVAL;
2798 + }
2799 +
2800 + memset(buf, 0, 8);
2801 + buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
2802 + store_cdrom_address(&buf[4], msf, lba);
2803 + return 8;
2804 +}
2805 +
2806 +
2807 +static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2808 +{
2809 + struct fsg_lun *curlun = fsg->curlun;
2810 + int msf = fsg->cmnd[1] & 0x02;
2811 + int start_track = fsg->cmnd[6];
2812 + u8 *buf = (u8 *) bh->buf;
2813 +
2814 + if ((fsg->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
2815 + start_track > 1) {
2816 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2817 + return -EINVAL;
2818 + }
2819 +
2820 + memset(buf, 0, 20);
2821 + buf[1] = (20-2); /* TOC data length */
2822 + buf[2] = 1; /* First track number */
2823 + buf[3] = 1; /* Last track number */
2824 + buf[5] = 0x16; /* Data track, copying allowed */
2825 + buf[6] = 0x01; /* Only track is number 1 */
2826 + store_cdrom_address(&buf[8], msf, 0);
2827 +
2828 + buf[13] = 0x16; /* Lead-out track is data */
2829 + buf[14] = 0xAA; /* Lead-out track number */
2830 + store_cdrom_address(&buf[16], msf, curlun->num_sectors);
2831 + return 20;
2832 +}
2833 +
2834 +
2835 +static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2836 +{
2837 + struct fsg_lun *curlun = fsg->curlun;
2838 + int mscmnd = fsg->cmnd[0];
2839 + u8 *buf = (u8 *) bh->buf;
2840 + u8 *buf0 = buf;
2841 + int pc, page_code;
2842 + int changeable_values, all_pages;
2843 + int valid_page = 0;
2844 + int len, limit;
2845 +
2846 + if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD
2847 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2848 + return -EINVAL;
2849 + }
2850 + pc = fsg->cmnd[2] >> 6;
2851 + page_code = fsg->cmnd[2] & 0x3f;
2852 + if (pc == 3) {
2853 + curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
2854 + return -EINVAL;
2855 + }
2856 + changeable_values = (pc == 1);
2857 + all_pages = (page_code == 0x3f);
2858 +
2859 + /* Write the mode parameter header. Fixed values are: default
2860 + * medium type, no cache control (DPOFUA), and no block descriptors.
2861 + * The only variable value is the WriteProtect bit. We will fill in
2862 + * the mode data length later. */
2863 + memset(buf, 0, 8);
2864 + if (mscmnd == MODE_SENSE) {
2865 + buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
2866 + buf += 4;
2867 + limit = 255;
2868 + } else { // MODE_SENSE_10
2869 + buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
2870 + buf += 8;
2871 + limit = 65535; // Should really be mod_data.buflen
2872 + }
2873 +
2874 + /* No block descriptors */
2875 +
2876 + /* The mode pages, in numerical order. The only page we support
2877 + * is the Caching page. */
2878 + if (page_code == 0x08 || all_pages) {
2879 + valid_page = 1;
2880 + buf[0] = 0x08; // Page code
2881 + buf[1] = 10; // Page length
2882 + memset(buf+2, 0, 10); // None of the fields are changeable
2883 +
2884 + if (!changeable_values) {
2885 + buf[2] = 0x04; // Write cache enable,
2886 + // Read cache not disabled
2887 + // No cache retention priorities
2888 + put_unaligned_be16(0xffff, &buf[4]);
2889 + /* Don't disable prefetch */
2890 + /* Minimum prefetch = 0 */
2891 + put_unaligned_be16(0xffff, &buf[8]);
2892 + /* Maximum prefetch */
2893 + put_unaligned_be16(0xffff, &buf[10]);
2894 + /* Maximum prefetch ceiling */
2895 + }
2896 + buf += 12;
2897 + }
2898 +
2899 + /* Check that a valid page was requested and the mode data length
2900 + * isn't too long. */
2901 + len = buf - buf0;
2902 + if (!valid_page || len > limit) {
2903 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2904 + return -EINVAL;
2905 + }
2906 +
2907 + /* Store the mode data length */
2908 + if (mscmnd == MODE_SENSE)
2909 + buf0[0] = len - 1;
2910 + else
2911 + put_unaligned_be16(len - 2, buf0);
2912 + return len;
2913 +}
2914 +
2915 +
2916 +static int do_start_stop(struct fsg_dev *fsg)
2917 +{
2918 + struct fsg_lun *curlun = fsg->curlun;
2919 + int loej, start;
2920 +
2921 + if (!mod_data.removable) {
2922 + curlun->sense_data = SS_INVALID_COMMAND;
2923 + return -EINVAL;
2924 + }
2925 +
2926 + // int immed = fsg->cmnd[1] & 0x01;
2927 + loej = fsg->cmnd[4] & 0x02;
2928 + start = fsg->cmnd[4] & 0x01;
2929 +
2930 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
2931 + if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed
2932 + (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start
2933 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2934 + return -EINVAL;
2935 + }
2936 +
2937 + if (!start) {
2938 +
2939 + /* Are we allowed to unload the media? */
2940 + if (curlun->prevent_medium_removal) {
2941 + LDBG(curlun, "unload attempt prevented\n");
2942 + curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
2943 + return -EINVAL;
2944 + }
2945 + if (loej) { // Simulate an unload/eject
2946 + up_read(&fsg->filesem);
2947 + down_write(&fsg->filesem);
2948 + fsg_lun_close(curlun);
2949 + up_write(&fsg->filesem);
2950 + down_read(&fsg->filesem);
2951 + }
2952 + } else {
2953 +
2954 + /* Our emulation doesn't support mounting; the medium is
2955 + * available for use as soon as it is loaded. */
2956 + if (!fsg_lun_is_open(curlun)) {
2957 + curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2958 + return -EINVAL;
2959 + }
2960 + }
2961 +#endif
2962 + return 0;
2963 +}
2964 +
2965 +
2966 +static int do_prevent_allow(struct fsg_dev *fsg)
2967 +{
2968 + struct fsg_lun *curlun = fsg->curlun;
2969 + int prevent;
2970 +
2971 + if (!mod_data.removable) {
2972 + curlun->sense_data = SS_INVALID_COMMAND;
2973 + return -EINVAL;
2974 + }
2975 +
2976 + prevent = fsg->cmnd[4] & 0x01;
2977 + if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent
2978 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2979 + return -EINVAL;
2980 + }
2981 +
2982 + if (curlun->prevent_medium_removal && !prevent)
2983 + fsg_lun_fsync_sub(curlun);
2984 + curlun->prevent_medium_removal = prevent;
2985 + return 0;
2986 +}
2987 +
2988 +
2989 +static int do_read_format_capacities(struct fsg_dev *fsg,
2990 + struct fsg_buffhd *bh)
2991 +{
2992 + struct fsg_lun *curlun = fsg->curlun;
2993 + u8 *buf = (u8 *) bh->buf;
2994 +
2995 + buf[0] = buf[1] = buf[2] = 0;
2996 + buf[3] = 8; // Only the Current/Maximum Capacity Descriptor
2997 + buf += 4;
2998 +
2999 + put_unaligned_be32(curlun->num_sectors, &buf[0]);
3000 + /* Number of blocks */
3001 + put_unaligned_be32(curlun->blksize, &buf[4]); /* Block length */
3002 + buf[4] = 0x02; /* Current capacity */
3003 + return 12;
3004 +}
3005 +
3006 +
3007 +static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
3008 +{
3009 + struct fsg_lun *curlun = fsg->curlun;
3010 +
3011 + /* We don't support MODE SELECT */
3012 + curlun->sense_data = SS_INVALID_COMMAND;
3013 + return -EINVAL;
3014 +}
3015 +
3016 +
3017 +/*-------------------------------------------------------------------------*/
3018 +
3019 +static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
3020 +{
3021 + int rc;
3022 +
3023 + rc = fsg_set_halt(fsg, fsg->bulk_in);
3024 + if (rc == -EAGAIN)
3025 + VDBG(fsg, "delayed bulk-in endpoint halt\n");
3026 + while (rc != 0) {
3027 + if (rc != -EAGAIN) {
3028 + WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
3029 + rc = 0;
3030 + break;
3031 + }
3032 +
3033 + /* Wait for a short time and then try again */
3034 + if (msleep_interruptible(100) != 0)
3035 + return -EINTR;
3036 + rc = usb_ep_set_halt(fsg->bulk_in);
3037 + }
3038 + return rc;
3039 +}
3040 +
3041 +static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
3042 +{
3043 + int rc;
3044 +
3045 + DBG(fsg, "bulk-in set wedge\n");
3046 + rc = usb_ep_set_wedge(fsg->bulk_in);
3047 + if (rc == -EAGAIN)
3048 + VDBG(fsg, "delayed bulk-in endpoint wedge\n");
3049 + while (rc != 0) {
3050 + if (rc != -EAGAIN) {
3051 + WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
3052 + rc = 0;
3053 + break;
3054 + }
3055 +
3056 + /* Wait for a short time and then try again */
3057 + if (msleep_interruptible(100) != 0)
3058 + return -EINTR;
3059 + rc = usb_ep_set_wedge(fsg->bulk_in);
3060 + }
3061 + return rc;
3062 +}
3063 +
3064 +static int throw_away_data(struct fsg_dev *fsg)
3065 +{
3066 + struct fsg_buffhd *bh;
3067 + u32 amount;
3068 + int rc;
3069 +
3070 + while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
3071 + fsg->usb_amount_left > 0) {
3072 +
3073 + /* Throw away the data in a filled buffer */
3074 + if (bh->state == BUF_STATE_FULL) {
3075 + smp_rmb();
3076 + bh->state = BUF_STATE_EMPTY;
3077 + fsg->next_buffhd_to_drain = bh->next;
3078 +
3079 + /* A short packet or an error ends everything */
3080 + if (bh->outreq->actual < bh->bulk_out_intended_length ||
3081 + bh->outreq->status != 0) {
3082 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
3083 + return -EINTR;
3084 + }
3085 + continue;
3086 + }
3087 +
3088 + /* Try to submit another request if we need one */
3089 + bh = fsg->next_buffhd_to_fill;
3090 + if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
3091 + amount = min(fsg->usb_amount_left,
3092 + (u32) mod_data.buflen);
3093 +
3094 + /* Except at the end of the transfer, amount will be
3095 + * equal to the buffer size, which is divisible by
3096 + * the bulk-out maxpacket size.
3097 + */
3098 + set_bulk_out_req_length(fsg, bh, amount);
3099 + start_transfer(fsg, fsg->bulk_out, bh->outreq,
3100 + &bh->outreq_busy, &bh->state);
3101 + fsg->next_buffhd_to_fill = bh->next;
3102 + fsg->usb_amount_left -= amount;
3103 + continue;
3104 + }
3105 +
3106 + /* Otherwise wait for something to happen */
3107 + rc = sleep_thread(fsg);
3108 + if (rc)
3109 + return rc;
3110 + }
3111 + return 0;
3112 +}
3113 +
3114 +
3115 +static int finish_reply(struct fsg_dev *fsg)
3116 +{
3117 + struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
3118 + int rc = 0;
3119 +
3120 + switch (fsg->data_dir) {
3121 + case DATA_DIR_NONE:
3122 + break; // Nothing to send
3123 +
3124 + /* If we don't know whether the host wants to read or write,
3125 + * this must be CB or CBI with an unknown command. We mustn't
3126 + * try to send or receive any data. So stall both bulk pipes
3127 + * if we can and wait for a reset. */
3128 + case DATA_DIR_UNKNOWN:
3129 + if (mod_data.can_stall) {
3130 + fsg_set_halt(fsg, fsg->bulk_out);
3131 + rc = halt_bulk_in_endpoint(fsg);
3132 + }
3133 + break;
3134 +
3135 + /* All but the last buffer of data must have already been sent */
3136 + case DATA_DIR_TO_HOST:
3137 + if (fsg->data_size == 0)
3138 + ; // Nothing to send
3139 +
3140 + /* If there's no residue, simply send the last buffer */
3141 + else if (fsg->residue == 0) {
3142 + bh->inreq->zero = 0;
3143 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3144 + &bh->inreq_busy, &bh->state);
3145 + fsg->next_buffhd_to_fill = bh->next;
3146 + }
3147 +
3148 + /* There is a residue. For CB and CBI, simply mark the end
3149 + * of the data with a short packet. However, if we are
3150 + * allowed to stall, there was no data at all (residue ==
3151 + * data_size), and the command failed (invalid LUN or
3152 + * sense data is set), then halt the bulk-in endpoint
3153 + * instead. */
3154 + else if (!transport_is_bbb()) {
3155 + if (mod_data.can_stall &&
3156 + fsg->residue == fsg->data_size &&
3157 + (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
3158 + bh->state = BUF_STATE_EMPTY;
3159 + rc = halt_bulk_in_endpoint(fsg);
3160 + } else {
3161 + bh->inreq->zero = 1;
3162 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3163 + &bh->inreq_busy, &bh->state);
3164 + fsg->next_buffhd_to_fill = bh->next;
3165 + }
3166 + }
3167 +
3168 + /*
3169 + * For Bulk-only, mark the end of the data with a short
3170 + * packet. If we are allowed to stall, halt the bulk-in
3171 + * endpoint. (Note: This violates the Bulk-Only Transport
3172 + * specification, which requires us to pad the data if we
3173 + * don't halt the endpoint. Presumably nobody will mind.)
3174 + */
3175 + else {
3176 + bh->inreq->zero = 1;
3177 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3178 + &bh->inreq_busy, &bh->state);
3179 + fsg->next_buffhd_to_fill = bh->next;
3180 + if (mod_data.can_stall)
3181 + rc = halt_bulk_in_endpoint(fsg);
3182 + }
3183 + break;
3184 +
3185 + /* We have processed all we want from the data the host has sent.
3186 + * There may still be outstanding bulk-out requests. */
3187 + case DATA_DIR_FROM_HOST:
3188 + if (fsg->residue == 0)
3189 + ; // Nothing to receive
3190 +
3191 + /* Did the host stop sending unexpectedly early? */
3192 + else if (fsg->short_packet_received) {
3193 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
3194 + rc = -EINTR;
3195 + }
3196 +
3197 + /* We haven't processed all the incoming data. Even though
3198 + * we may be allowed to stall, doing so would cause a race.
3199 + * The controller may already have ACK'ed all the remaining
3200 + * bulk-out packets, in which case the host wouldn't see a
3201 + * STALL. Not realizing the endpoint was halted, it wouldn't
3202 + * clear the halt -- leading to problems later on. */
3203 +#if 0
3204 + else if (mod_data.can_stall) {
3205 + fsg_set_halt(fsg, fsg->bulk_out);
3206 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
3207 + rc = -EINTR;
3208 + }
3209 +#endif
3210 +
3211 + /* We can't stall. Read in the excess data and throw it
3212 + * all away. */
3213 + else
3214 + rc = throw_away_data(fsg);
3215 + break;
3216 + }
3217 + return rc;
3218 +}
3219 +
3220 +
3221 +static int send_status(struct fsg_dev *fsg)
3222 +{
3223 + struct fsg_lun *curlun = fsg->curlun;
3224 + struct fsg_buffhd *bh;
3225 + int rc;
3226 + u8 status = US_BULK_STAT_OK;
3227 + u32 sd, sdinfo = 0;
3228 +
3229 + /* Wait for the next buffer to become available */
3230 + bh = fsg->next_buffhd_to_fill;
3231 + while (bh->state != BUF_STATE_EMPTY) {
3232 + rc = sleep_thread(fsg);
3233 + if (rc)
3234 + return rc;
3235 + }
3236 +
3237 + if (curlun) {
3238 + sd = curlun->sense_data;
3239 + sdinfo = curlun->sense_data_info;
3240 + } else if (fsg->bad_lun_okay)
3241 + sd = SS_NO_SENSE;
3242 + else
3243 + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
3244 +
3245 + if (fsg->phase_error) {
3246 + DBG(fsg, "sending phase-error status\n");
3247 + status = US_BULK_STAT_PHASE;
3248 + sd = SS_INVALID_COMMAND;
3249 + } else if (sd != SS_NO_SENSE) {
3250 + DBG(fsg, "sending command-failure status\n");
3251 + status = US_BULK_STAT_FAIL;
3252 + VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
3253 + " info x%x\n",
3254 + SK(sd), ASC(sd), ASCQ(sd), sdinfo);
3255 + }
3256 +
3257 + if (transport_is_bbb()) {
3258 + struct bulk_cs_wrap *csw = bh->buf;
3259 +
3260 + /* Store and send the Bulk-only CSW */
3261 + csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
3262 + csw->Tag = fsg->tag;
3263 + csw->Residue = cpu_to_le32(fsg->residue);
3264 + csw->Status = status;
3265 +
3266 + bh->inreq->length = US_BULK_CS_WRAP_LEN;
3267 + bh->inreq->zero = 0;
3268 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3269 + &bh->inreq_busy, &bh->state);
3270 +
3271 + } else if (mod_data.transport_type == USB_PR_CB) {
3272 +
3273 + /* Control-Bulk transport has no status phase! */
3274 + return 0;
3275 +
3276 + } else { // USB_PR_CBI
3277 + struct interrupt_data *buf = bh->buf;
3278 +
3279 + /* Store and send the Interrupt data. UFI sends the ASC
3280 + * and ASCQ bytes. Everything else sends a Type (which
3281 + * is always 0) and the status Value. */
3282 + if (mod_data.protocol_type == USB_SC_UFI) {
3283 + buf->bType = ASC(sd);
3284 + buf->bValue = ASCQ(sd);
3285 + } else {
3286 + buf->bType = 0;
3287 + buf->bValue = status;
3288 + }
3289 + fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
3290 +
3291 + fsg->intr_buffhd = bh; // Point to the right buffhd
3292 + fsg->intreq->buf = bh->inreq->buf;
3293 + fsg->intreq->context = bh;
3294 + start_transfer(fsg, fsg->intr_in, fsg->intreq,
3295 + &fsg->intreq_busy, &bh->state);
3296 + }
3297 +
3298 + fsg->next_buffhd_to_fill = bh->next;
3299 + return 0;
3300 +}
3301 +
3302 +
3303 +/*-------------------------------------------------------------------------*/
3304 +
3305 +/* Check whether the command is properly formed and whether its data size
3306 + * and direction agree with the values we already have. */
3307 +static int check_command(struct fsg_dev *fsg, int cmnd_size,
3308 + enum data_direction data_dir, unsigned int mask,
3309 + int needs_medium, const char *name)
3310 +{
3311 + int i;
3312 + int lun = fsg->cmnd[1] >> 5;
3313 + static const char dirletter[4] = {'u', 'o', 'i', 'n'};
3314 + char hdlen[20];
3315 + struct fsg_lun *curlun;
3316 +
3317 + /* Adjust the expected cmnd_size for protocol encapsulation padding.
3318 + * Transparent SCSI doesn't pad. */
3319 + if (protocol_is_scsi())
3320 + ;
3321 +
3322 + /* There's some disagreement as to whether RBC pads commands or not.
3323 + * We'll play it safe and accept either form. */
3324 + else if (mod_data.protocol_type == USB_SC_RBC) {
3325 + if (fsg->cmnd_size == 12)
3326 + cmnd_size = 12;
3327 +
3328 + /* All the other protocols pad to 12 bytes */
3329 + } else
3330 + cmnd_size = 12;
3331 +
3332 + hdlen[0] = 0;
3333 + if (fsg->data_dir != DATA_DIR_UNKNOWN)
3334 + sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
3335 + fsg->data_size);
3336 + VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
3337 + name, cmnd_size, dirletter[(int) data_dir],
3338 + fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
3339 +
3340 + /* We can't reply at all until we know the correct data direction
3341 + * and size. */
3342 + if (fsg->data_size_from_cmnd == 0)
3343 + data_dir = DATA_DIR_NONE;
3344 + if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI
3345 + fsg->data_dir = data_dir;
3346 + fsg->data_size = fsg->data_size_from_cmnd;
3347 +
3348 + } else { // Bulk-only
3349 + if (fsg->data_size < fsg->data_size_from_cmnd) {
3350 +
3351 + /* Host data size < Device data size is a phase error.
3352 + * Carry out the command, but only transfer as much
3353 + * as we are allowed. */
3354 + fsg->data_size_from_cmnd = fsg->data_size;
3355 + fsg->phase_error = 1;
3356 + }
3357 + }
3358 + fsg->residue = fsg->usb_amount_left = fsg->data_size;
3359 +
3360 + /* Conflicting data directions is a phase error */
3361 + if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
3362 + fsg->phase_error = 1;
3363 + return -EINVAL;
3364 + }
3365 +
3366 + /* Verify the length of the command itself */
3367 + if (cmnd_size != fsg->cmnd_size) {
3368 +
3369 + /* Special case workaround: There are plenty of buggy SCSI
3370 + * implementations. Many have issues with cbw->Length
3371 + * field passing a wrong command size. For those cases we
3372 + * always try to work around the problem by using the length
3373 + * sent by the host side provided it is at least as large
3374 + * as the correct command length.
3375 + * Examples of such cases would be MS-Windows, which issues
3376 + * REQUEST SENSE with cbw->Length == 12 where it should
3377 + * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
3378 + * REQUEST SENSE with cbw->Length == 10 where it should
3379 + * be 6 as well.
3380 + */
3381 + if (cmnd_size <= fsg->cmnd_size) {
3382 + DBG(fsg, "%s is buggy! Expected length %d "
3383 + "but we got %d\n", name,
3384 + cmnd_size, fsg->cmnd_size);
3385 + cmnd_size = fsg->cmnd_size;
3386 + } else {
3387 + fsg->phase_error = 1;
3388 + return -EINVAL;
3389 + }
3390 + }
3391 +
3392 + /* Check that the LUN values are consistent */
3393 + if (transport_is_bbb()) {
3394 + if (fsg->lun != lun)
3395 + DBG(fsg, "using LUN %d from CBW, "
3396 + "not LUN %d from CDB\n",
3397 + fsg->lun, lun);
3398 + }
3399 +
3400 + /* Check the LUN */
3401 + curlun = fsg->curlun;
3402 + if (curlun) {
3403 + if (fsg->cmnd[0] != REQUEST_SENSE) {
3404 + curlun->sense_data = SS_NO_SENSE;
3405 + curlun->sense_data_info = 0;
3406 + curlun->info_valid = 0;
3407 + }
3408 + } else {
3409 + fsg->bad_lun_okay = 0;
3410 +
3411 + /* INQUIRY and REQUEST SENSE commands are explicitly allowed
3412 + * to use unsupported LUNs; all others may not. */
3413 + if (fsg->cmnd[0] != INQUIRY &&
3414 + fsg->cmnd[0] != REQUEST_SENSE) {
3415 + DBG(fsg, "unsupported LUN %d\n", fsg->lun);
3416 + return -EINVAL;
3417 + }
3418 + }
3419 +
3420 + /* If a unit attention condition exists, only INQUIRY and
3421 + * REQUEST SENSE commands are allowed; anything else must fail. */
3422 + if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
3423 + fsg->cmnd[0] != INQUIRY &&
3424 + fsg->cmnd[0] != REQUEST_SENSE) {
3425 + curlun->sense_data = curlun->unit_attention_data;
3426 + curlun->unit_attention_data = SS_NO_SENSE;
3427 + return -EINVAL;
3428 + }