258299fcf1ad031adf4744ccc0bc22a82a5526ce
[openwrt/openwrt.git] / target / linux / brcm2708 / patches-4.9 / 950-0031-Add-dwc_otg-driver.patch
1 From 65f57e56fcf9d40383718f0bcd9e6f95a34ca1aa Mon Sep 17 00:00:00 2001
2 From: popcornmix <popcornmix@gmail.com>
3 Date: Wed, 1 May 2013 19:46:17 +0100
4 Subject: [PATCH] Add dwc_otg driver
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 Signed-off-by: popcornmix <popcornmix@gmail.com>
10
11 usb: dwc: fix lockdep false positive
12
13 Signed-off-by: Kari Suvanto <karis79@gmail.com>
14
15 usb: dwc: fix inconsistent lock state
16
17 Signed-off-by: Kari Suvanto <karis79@gmail.com>
18
19 Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
20 Thanks to Gordon and Costas
21
22 Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.
23
24 Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh
25
26 Make sure we wait for the reset to finish
27
28 dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
29 memory corruption, escalating to OOPS under high USB load.
30
31 dwc_otg: Fix unsafe access of QTD during URB enqueue
32
33 In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
34 transaction could complete almost immediately after the qtd was assigned
35 to a host channel during URB enqueue, which meant the qtd pointer was no
36 longer valid having been completed and removed. Usually, this resulted in
37 an OOPS during URB submission. By predetermining whether transactions
38 need to be queued or not, this unsafe pointer access is avoided.
39
40 This bug was only evident on the Pi model A where a device was attached
41 that had no periodic endpoints (e.g. USB pendrive or some wlan devices).
42
43 dwc_otg: Fix incorrect URB allocation error handling
44
45 If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
46 because for some reason a member of the *unallocated* struct was set to
47 zero. Error handling changed to fail correctly.
48
49 dwc_otg: fix potential use-after-free case in interrupt handler
50
51 If a transaction had previously aborted, certain interrupts are
52 enabled to track error counts and reset where necessary. On IN
53 endpoints the host generates an ACK interrupt near-simultaneously
54 with completion of transfer. In the case where this transfer had
55 previously had an error, this results in a use-after-free on
56 the QTD memory space with a 1-byte length being overwritten to
57 0x00.
58
59 dwc_otg: add handling of SPLIT transaction data toggle errors
60
61 Previously a data toggle error on packets from a USB1.1 device behind
62 a TT would result in the Pi locking up as the driver never handled
63 the associated interrupt. Patch adds basic retry mechanism and
64 interrupt acknowledgement to cater for either a chance toggle error or
65 for devices that have a broken initial toggle state (FT8U232/FT232BM).
66
67 dwc_otg: implement tasklet for returning URBs to usbcore hcd layer
68
69 The dwc_otg driver interrupt handler for transfer completion will spend
70 a very long time with interrupts disabled when a URB is completed -
71 this is because usb_hcd_giveback_urb is called from within the handler
72 which for a USB device driver with complicated processing (e.g. webcam)
73 will take an exorbitant amount of time to complete. This results in
74 missed completion interrupts for other USB packets which lead to them
75 being dropped due to microframe overruns.
76
77 This patch splits returning the URB to the usb hcd layer into a
78 high-priority tasklet. This will have most benefit for isochronous IN
79 transfers but will also have incidental benefit where multiple periodic
80 devices are active at once.
81
82 dwc_otg: fix NAK holdoff and allow on split transactions only
83
84 This corrects a bug where if a single active non-periodic endpoint
85 had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
86 would get skipped and never get queued again. This would result in
87 a silent device until error detection (automatic or otherwise) would
88 either reset the device or flush and requeue the URBs.
89
90 Additionally the NAK holdoff was enabled for all transactions - this
91 would potentially stall a HS endpoint for 1ms if a previous error state
92 enabled this interrupt and the next response was a NAK. Fix so that
93 only split transactions get held off.
94
95 dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler
96
97 usb_hcd_unlink_urb_from_ep must be called with the HCD lock held. Calling it
98 asynchronously in the tasklet was not safe (regression in
99 c4564d4a1a0a9b10d4419e48239f5d99e88d2667).
100
101 This change unlinks it from the endpoint prior to queueing it for handling in
102 the tasklet, and also adds a check to ensure the urb is OK to be unlinked
103 before doing so.
104
105 NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
106 when a USB device was unplugged/replugged during data transfer. This effect
107 was reproduced using automated USB port power control, hundreds of replug
108 events were performed during active transfers to confirm that the problem was
109 eliminated.
110
111 USB fix using a FIQ to implement split transactions
112
113 This commit adds a FIQ implementaion that schedules
114 the split transactions using a FIQ so we don't get
115 held off by the interrupt latency of Linux
116
117 dwc_otg: fix device attributes and avoid kernel warnings on boot
118
119 dcw_otg: avoid logging function that can cause panics
120
121 See: https://github.com/raspberrypi/firmware/issues/21
122 Thanks to cleverca22 for fix
123
124 dwc_otg: mask correct interrupts after transaction error recovery
125
126 The dwc_otg driver will unmask certain interrupts on a transaction
127 that previously halted in the error state in order to reset the
128 QTD error count. The various fine-grained interrupt handlers do not
129 consider that other interrupts besides themselves were unmasked.
130
131 By disabling the two other interrupts only ever enabled in DMA mode
132 for this purpose, we can avoid unnecessary function calls in the
133 IRQ handler. This will also prevent an unneccesary FIQ interrupt
134 from being generated if the FIQ is enabled.
135
136 dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ
137
138 In the case of a transaction to a device that had previously aborted
139 due to an error, several interrupts are enabled to reset the error
140 count when a device responds. This has the side-effect of making the
141 FIQ thrash because the hardware will generate multiple instances of
142 a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
143 on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
144 associated interrupts.
145
146 Additionally, on non-split transactions make sure that only unmasked
147 interrupts are cleared. This caused a hard-to-trigger but serious
148 race condition when you had the combination of an endpoint awaiting
149 error recovery and a transaction completed on an endpoint - due to
150 the sequencing and timing of interrupts generated by the dwc_otg core,
151 it was possible to confuse the IRQ handler.
152
153 Fix function tracing
154
155 dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue
156
157 dwc_otg: prevent OOPSes during device disconnects
158
159 The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
160 access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
161 friends does not occur within a critical section and so if a device
162 was unplugged during activity there was a high chance that the
163 usbcore hub_thread would try to disable the endpoint with partially-
164 formed entries in the URB queue. This would result in BUG() or null
165 pointer dereferences.
166
167 Fix so that access of urb->hcpriv, enqueuing to the hardware and
168 adding to usbcore endpoint URB lists is contained within a single
169 critical section.
170
171 dwc_otg: prevent BUG() in TT allocation if hub address is > 16
172
173 A fixed-size array is used to track TT allocation. This was
174 previously set to 16 which caused a crash because
175 dwc_otg_hcd_allocate_port would read past the end of the array.
176
177 This was hit if a hub was plugged in which enumerated as addr > 16,
178 due to previous device resets or unplugs.
179
180 Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
181 to a large size if 128 hub addresses are supported. This field is
182 for debug only for tracking which frame an allocate happened in.
183
184 dwc_otg: make channel halts with unknown state less damaging
185
186 If the IRQ received a channel halt interrupt through the FIQ
187 with no other bits set, the IRQ would not release the host
188 channel and never complete the URB.
189
190 Add catchall handling to treat as a transaction error and retry.
191
192 dwc_otg: fiq_split: use TTs with more granularity
193
194 This fixes certain issues with split transaction scheduling.
195
196 - Isochronous multi-packet OUT transactions now hog the TT until
197 they are completed - this prevents hubs aborting transactions
198 if they get a periodic start-split out-of-order
199 - Don't perform TT allocation on non-periodic endpoints - this
200 allows simultaneous use of the TT's bulk/control and periodic
201 transaction buffers
202
203 This commit will mainly affect USB audio playback.
204
205 dwc_otg: fix potential sleep while atomic during urb enqueue
206
207 Fixes a regression introduced with eb1b482a. Kmalloc called from
208 dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
209 the GPF_ATOMIC flag set. Force this flag when inside the larger
210 critical section.
211
212 dwc_otg: make fiq_split_enable imply fiq_fix_enable
213
214 Failing to set up the FIQ correctly would result in
215 "IRQ 32: nobody cared" errors in dmesg.
216
217 dwc_otg: prevent crashes on host port disconnects
218
219 Fix several issues resulting in crashes or inconsistent state
220 if a Model A root port was disconnected.
221
222 - Clean up queue heads properly in kill_urbs_in_qh_list by
223 removing the empty QHs from the schedule lists
224 - Set the halt status properly to prevent IRQ handlers from
225 using freed memory
226 - Add fiq_split related cleanup for saved registers
227 - Make microframe scheduling reclaim host channels if
228 active during a disconnect
229 - Abort URBs with -ESHUTDOWN status response, informing
230 device drivers so they respond in a more correct fashion
231 and don't try to resubmit URBs
232 - Prevent IRQ handlers from attempting to handle channel
233 interrupts if the associated URB was dequeued (and the
234 driver state was cleared)
235
236 dwc_otg: prevent leaking URBs during enqueue
237
238 A dwc_otg_urb would get leaked if the HCD enqueue function
239 failed for any reason. Free the URB at the appropriate points.
240
241 dwc_otg: Enable NAK holdoff for control split transactions
242
243 Certain low-speed devices take a very long time to complete a
244 data or status stage of a control transaction, producing NAK
245 responses until they complete internal processing - the USB2.0
246 spec limit is up to 500mS. This causes the same type of interrupt
247 storm as seen with USB-serial dongles prior to c8edb238.
248
249 In certain circumstances, usually while booting, this interrupt
250 storm could cause SD card timeouts.
251
252 dwc_otg: Fix for occasional lockup on boot when doing a USB reset
253
254 dwc_otg: Don't issue traffic to LS devices in FS mode
255
256 Issuing low-speed packets when the root port is in full-speed mode
257 causes the root port to stop responding. Explicitly fail when
258 enqueuing URBs to a LS endpoint on a FS bus.
259
260 Fix ARM architecture issue with local_irq_restore()
261
262 If local_fiq_enable() is called before a local_irq_restore(flags) where
263 the flags variable has the F bit set, the FIQ will be erroneously disabled.
264
265 Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.
266
267 Also fix some of the hacks previously implemented for previous dwc_otg
268 incarnations.
269
270 dwc_otg: fiq_fsm: Base commit for driver rewrite
271
272 This commit removes the previous FIQ fixes entirely and adds fiq_fsm.
273
274 This rewrite features much more complete support for split transactions
275 and takes into account several OTG hardware bugs. High-speed
276 isochronous transactions are also capable of being performed by fiq_fsm.
277
278 All driver options have been removed and replaced with:
279 - dwc_otg.fiq_enable (bool)
280 - dwc_otg.fiq_fsm_enable (bool)
281 - dwc_otg.fiq_fsm_mask (bitmask)
282 - dwc_otg.nak_holdoff (unsigned int)
283
284 Defaults are specified such that fiq_fsm behaves similarly to the
285 previously implemented FIQ fixes.
286
287 fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used
288
289 If the transfer associated with a QTD failed due to a bus error, the HCD
290 would retry the transfer up to 3 times (implementing the USB2.0
291 three-strikes retry in software).
292
293 Due to the masking mechanism used by fiq_fsm, it is only possible to pass
294 a single interrupt through to the HCD per-transfer.
295
296 In this instance host channels would fall off the radar because the error
297 reset would function, but the subsequent channel halt would be lost.
298
299 Push the error count reset into the FIQ handler.
300
301 fiq_fsm: Implement timeout mechanism
302
303 For full-speed endpoints with a large packet size, interrupt latency
304 runs the risk of the FIQ starting a transaction too late in a full-speed
305 frame. If the device is still transmitting data when EOF2 for the
306 downstream frame occurs, the hub will disable the port. This change is
307 not reflected in the hub status endpoint and the device becomes
308 unresponsive.
309
310 Prevent high-bandwidth transactions from being started too late in a
311 frame. The mechanism is not guaranteed: a combination of bit stuffing
312 and hub latency may still result in a device overrunning.
313
314 fiq_fsm: fix bounce buffer utilisation for Isochronous OUT
315
316 Multi-packet isochronous OUT transactions were subject to a few bounday
317 bugs. Fix them.
318
319 Audio playback is now much more robust: however, an issue stands with
320 devices that have adaptive sinks - ALSA plays samples too fast.
321
322 dwc_otg: Return full-speed frame numbers in HS mode
323
324 The frame counter increments on every *microframe* in high-speed mode.
325 Most device drivers expect this number to be in full-speed frames - this
326 caused considerable confusion to e.g. snd_usb_audio which uses the
327 frame counter to estimate the number of samples played.
328
329 fiq_fsm: save PID on completion of interrupt OUT transfers
330
331 Also add edge case handling for interrupt transports.
332
333 Note that for periodic split IN, data toggles are unimplemented in the
334 OTG host hardware - it unconditionally accepts any PID.
335
336 fiq_fsm: add missing case for fiq_fsm_tt_in_use()
337
338 Certain combinations of bitrate and endpoint activity could
339 result in a periodic transaction erroneously getting started
340 while the previous Isochronous OUT was still active.
341
342 fiq_fsm: clear hcintmsk for aborted transactions
343
344 Prevents the FIQ from erroneously handling interrupts
345 on a timed out channel.
346
347 fiq_fsm: enable by default
348
349 fiq_fsm: fix dequeues for non-periodic split transactions
350
351 If a dequeue happened between the SSPLIT and CSPLIT phases of the
352 transaction, the HCD would never receive an interrupt.
353
354 fiq_fsm: Disable by default
355
356 fiq_fsm: Handle HC babble errors
357
358 The HCTSIZ transfer size field raises a babble interrupt if
359 the counter wraps. Handle the resulting interrupt in this case.
360
361 dwc_otg: fix interrupt registration for fiq_enable=0
362
363 Additionally make the module parameter conditional for wherever
364 hcd->fiq_state is touched.
365
366 fiq_fsm: Enable by default
367
368 dwc_otg: Fix various issues with root port and transaction errors
369
370 Process the host port interrupts correctly (and don't trample them).
371 Root port hotplug now functional again.
372
373 Fix a few thinkos with the transaction error passthrough for fiq_fsm.
374
375 fiq_fsm: Implement hack for Split Interrupt transactions
376
377 Hubs aren't too picky about which endpoint we send Control type split
378 transactions to. By treating Interrupt transfers as Control, it is
379 possible to use the non-periodic queue in the OTG core as well as the
380 non-periodic FIFOs in the hub itself. This massively reduces the
381 microframe exclusivity/contention that periodic split transactions
382 otherwise have to enforce.
383
384 It goes without saying that this is a fairly egregious USB specification
385 violation, but it works.
386
387 Original idea by Hans Petter Selasky @ FreeBSD.org.
388
389 dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.
390
391 dwc_otg: introduce fiq_fsm_spin(un|)lock()
392
393 SMP safety for the FIQ relies on register read-modify write cycles being
394 completed in the correct order. Several places in the DWC code modify
395 registers also touched by the FIQ. Protect these by a bare-bones lock
396 mechanism.
397
398 This also makes it possible to run the FIQ and IRQ handlers on different
399 cores.
400
401 fiq_fsm: fix build on bcm2708 and bcm2709 platforms
402
403 dwc_otg: put some barriers back where they should be for UP
404
405 bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active
406
407 dwc_otg: fixup read-modify-write in critical paths
408
409 Be more careful about read-modify-write on registers that the FIQ
410 also touches.
411
412 Guard fiq_fsm_spin_lock with fiq_enable check
413
414 fiq_fsm: Falling out of the state machine isn't fatal
415
416 This edge case can be hit if the port is disabled while the FIQ is
417 in the middle of a transaction. Make the effects less severe.
418
419 Also get rid of the useless return value.
420
421 squash: dwc_otg: Allow to build without SMP
422
423 usb: core: make overcurrent messages more prominent
424
425 Hub overcurrent messages are more serious than "debug". Increase loglevel.
426
427 usb: dwc_otg: Don't use dma_to_virt()
428
429 Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
430 Open code the old dma_to_virt() implementation to work around this.
431
432 Limit the use of __bus_to_virt() to cases where transfer_buffer_length
433 is set and transfer_buffer is not set. This is done to increase the
434 chance that this driver will also work on ARCH_BCM2835.
435
436 transfer_buffer should not be NULL if the length is set, but the
437 comment in the code indicates that there are situations where this
438 might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
439 comment pointing to a possible: 'usb storage / SCSI bug'.
440
441 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
442
443 dwc_otg: Fix crash when fiq_enable=0
444
445 dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly
446
447 Certain low-bandwidth high-speed USB devices (specialist audio devices,
448 compressed-frame webcams) have packet intervals > 1 microframe.
449
450 Stride these transfers in the FIQ by using the start-of-frame interrupt
451 to restart the channel at the right time.
452
453 dwc_otg: Force host mode to fix incorrect compute module boards
454
455 dwc_otg: Add ARCH_BCM2835 support
456
457 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
458
459 dwc_otg: Simplify FIQ irq number code
460
461 Dropping ATAGS means we can simplify the FIQ irq number code.
462 Also add error checking on the returned irq number.
463
464 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
465
466 dwc_otg: Remove duplicate gadget probe/unregister function
467
468 dwc_otg: Properly set the HFIR
469
470 Douglas Anderson reported:
471
472 According to the most up to date version of the dwc2 databook, the FRINT
473 field of the HFIR register should be programmed to:
474 * 125 us * (PHY clock freq for HS) - 1
475 * 1000 us * (PHY clock freq for FS/LS) - 1
476
477 This is opposed to older versions of the doc that claimed it should be:
478 * 125 us * (PHY clock freq for HS)
479 * 1000 us * (PHY clock freq for FS/LS)
480
481 and reported lower timing jitter on a USB analyser
482
483 dcw_otg: trim xfer length when buffer larger than allocated size is received
484
485 dwc_otg: Don't free qh align buffers in atomic context
486
487 dwc_otg: Enable the hack for Split Interrupt transactions by default
488
489 dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
490 So far we are aware of many success stories but no failure caused by this setting.
491 Make it a default to learn more.
492
493 See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437
494
495 Signed-off-by: popcornmix <popcornmix@gmail.com>
496
497 dwc_otg: Use kzalloc when suitable
498
499 dwc_otg: Pass struct device to dma_alloc*()
500
501 This makes it possible to get the bus address from Device Tree.
502
503 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
504 ---
505 arch/arm/include/asm/irqflags.h | 16 +-
506 arch/arm/kernel/fiqasm.S | 4 +
507 drivers/usb/Makefile | 1 +
508 drivers/usb/core/generic.c | 1 +
509 drivers/usb/core/hub.c | 2 +-
510 drivers/usb/core/message.c | 79 +
511 drivers/usb/core/otg_whitelist.h | 114 +-
512 drivers/usb/gadget/file_storage.c | 3676 ++++++++++
513 drivers/usb/host/Kconfig | 13 +
514 drivers/usb/host/Makefile | 2 +
515 drivers/usb/host/dwc_common_port/Makefile | 58 +
516 drivers/usb/host/dwc_common_port/Makefile.fbsd | 17 +
517 drivers/usb/host/dwc_common_port/Makefile.linux | 49 +
518 drivers/usb/host/dwc_common_port/changes.txt | 174 +
519 drivers/usb/host/dwc_common_port/doc/doxygen.cfg | 270 +
520 drivers/usb/host/dwc_common_port/dwc_cc.c | 532 ++
521 drivers/usb/host/dwc_common_port/dwc_cc.h | 224 +
522 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c | 1308 ++++
523 .../usb/host/dwc_common_port/dwc_common_linux.c | 1418 ++++
524 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c | 1275 ++++
525 drivers/usb/host/dwc_common_port/dwc_crypto.c | 308 +
526 drivers/usb/host/dwc_common_port/dwc_crypto.h | 111 +
527 drivers/usb/host/dwc_common_port/dwc_dh.c | 291 +
528 drivers/usb/host/dwc_common_port/dwc_dh.h | 106 +
529 drivers/usb/host/dwc_common_port/dwc_list.h | 594 ++
530 drivers/usb/host/dwc_common_port/dwc_mem.c | 245 +
531 drivers/usb/host/dwc_common_port/dwc_modpow.c | 636 ++
532 drivers/usb/host/dwc_common_port/dwc_modpow.h | 34 +
533 drivers/usb/host/dwc_common_port/dwc_notifier.c | 319 +
534 drivers/usb/host/dwc_common_port/dwc_notifier.h | 122 +
535 drivers/usb/host/dwc_common_port/dwc_os.h | 1276 ++++
536 drivers/usb/host/dwc_common_port/usb.h | 946 +++
537 drivers/usb/host/dwc_otg/Makefile | 82 +
538 drivers/usb/host/dwc_otg/doc/doxygen.cfg | 224 +
539 drivers/usb/host/dwc_otg/dummy_audio.c | 1574 +++++
540 drivers/usb/host/dwc_otg/dwc_cfi_common.h | 142 +
541 drivers/usb/host/dwc_otg/dwc_otg_adp.c | 854 +++
542 drivers/usb/host/dwc_otg/dwc_otg_adp.h | 80 +
543 drivers/usb/host/dwc_otg/dwc_otg_attr.c | 1210 ++++
544 drivers/usb/host/dwc_otg/dwc_otg_attr.h | 89 +
545 drivers/usb/host/dwc_otg/dwc_otg_cfi.c | 1876 +++++
546 drivers/usb/host/dwc_otg/dwc_otg_cfi.h | 320 +
547 drivers/usb/host/dwc_otg/dwc_otg_cil.c | 7141 ++++++++++++++++++++
548 drivers/usb/host/dwc_otg/dwc_otg_cil.h | 1464 ++++
549 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c | 1594 +++++
550 drivers/usb/host/dwc_otg/dwc_otg_core_if.h | 705 ++
551 drivers/usb/host/dwc_otg/dwc_otg_dbg.h | 117 +
552 drivers/usb/host/dwc_otg/dwc_otg_driver.c | 1757 +++++
553 drivers/usb/host/dwc_otg/dwc_otg_driver.h | 86 +
554 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c | 1355 ++++
555 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h | 370 +
556 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S | 80 +
557 drivers/usb/host/dwc_otg/dwc_otg_hcd.c | 4260 ++++++++++++
558 drivers/usb/host/dwc_otg/dwc_otg_hcd.h | 868 +++
559 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c | 1139 ++++
560 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h | 417 ++
561 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c | 2727 ++++++++
562 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 1005 +++
563 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c | 963 +++
564 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h | 188 +
565 drivers/usb/host/dwc_otg/dwc_otg_pcd.c | 2725 ++++++++
566 drivers/usb/host/dwc_otg/dwc_otg_pcd.h | 273 +
567 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h | 361 +
568 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c | 5148 ++++++++++++++
569 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c | 1280 ++++
570 drivers/usb/host/dwc_otg/dwc_otg_regs.h | 2550 +++++++
571 drivers/usb/host/dwc_otg/test/Makefile | 16 +
572 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm | 337 +
573 drivers/usb/host/dwc_otg/test/test_mod_param.pl | 133 +
574 drivers/usb/host/dwc_otg/test/test_sysfs.pl | 193 +
575 70 files changed, 59908 insertions(+), 16 deletions(-)
576 create mode 100644 drivers/usb/gadget/file_storage.c
577 create mode 100644 drivers/usb/host/dwc_common_port/Makefile
578 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.fbsd
579 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.linux
580 create mode 100644 drivers/usb/host/dwc_common_port/changes.txt
581 create mode 100644 drivers/usb/host/dwc_common_port/doc/doxygen.cfg
582 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.c
583 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.h
584 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
585 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_linux.c
586 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
587 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.c
588 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.h
589 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.c
590 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.h
591 create mode 100644 drivers/usb/host/dwc_common_port/dwc_list.h
592 create mode 100644 drivers/usb/host/dwc_common_port/dwc_mem.c
593 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.c
594 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.h
595 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.c
596 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.h
597 create mode 100644 drivers/usb/host/dwc_common_port/dwc_os.h
598 create mode 100644 drivers/usb/host/dwc_common_port/usb.h
599 create mode 100644 drivers/usb/host/dwc_otg/Makefile
600 create mode 100644 drivers/usb/host/dwc_otg/doc/doxygen.cfg
601 create mode 100644 drivers/usb/host/dwc_otg/dummy_audio.c
602 create mode 100644 drivers/usb/host/dwc_otg/dwc_cfi_common.h
603 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.c
604 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.h
605 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.c
606 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.h
607 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.c
608 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.h
609 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.c
610 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.h
611 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
612 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_core_if.h
613 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_dbg.h
614 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.c
615 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.h
616 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
617 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
618 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
619 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.c
620 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.h
621 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
622 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
623 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
624 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
625 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
626 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
627 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.c
628 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.h
629 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
630 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
631 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
632 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_regs.h
633 create mode 100644 drivers/usb/host/dwc_otg/test/Makefile
634 create mode 100644 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
635 create mode 100644 drivers/usb/host/dwc_otg/test/test_mod_param.pl
636 create mode 100644 drivers/usb/host/dwc_otg/test/test_sysfs.pl
637
638 --- a/arch/arm/include/asm/irqflags.h
639 +++ b/arch/arm/include/asm/irqflags.h
640 @@ -162,13 +162,23 @@ static inline unsigned long arch_local_s
641 }
642
643 /*
644 - * restore saved IRQ & FIQ state
645 + * restore saved IRQ state
646 */
647 #define arch_local_irq_restore arch_local_irq_restore
648 static inline void arch_local_irq_restore(unsigned long flags)
649 {
650 - asm volatile(
651 - " msr " IRQMASK_REG_NAME_W ", %0 @ local_irq_restore"
652 + unsigned long temp = 0;
653 + flags &= ~(1 << 6);
654 + asm volatile (
655 + " mrs %0, cpsr"
656 + : "=r" (temp)
657 + :
658 + : "memory", "cc");
659 + /* Preserve FIQ bit */
660 + temp &= (1 << 6);
661 + flags = flags | temp;
662 + asm volatile (
663 + " msr cpsr_c, %0 @ local_irq_restore"
664 :
665 : "r" (flags)
666 : "memory", "cc");
667 --- a/arch/arm/kernel/fiqasm.S
668 +++ b/arch/arm/kernel/fiqasm.S
669 @@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
670 mov r0, r0 @ avoid hazard prior to ARMv4
671 ret lr
672 ENDPROC(__get_fiq_regs)
673 +
674 +ENTRY(__FIQ_Branch)
675 + mov pc, r8
676 +ENDPROC(__FIQ_Branch)
677 --- a/drivers/usb/Makefile
678 +++ b/drivers/usb/Makefile
679 @@ -7,6 +7,7 @@
680 obj-$(CONFIG_USB) += core/
681 obj-$(CONFIG_USB_SUPPORT) += phy/
682
683 +obj-$(CONFIG_USB_DWCOTG) += host/
684 obj-$(CONFIG_USB_DWC3) += dwc3/
685 obj-$(CONFIG_USB_DWC2) += dwc2/
686 obj-$(CONFIG_USB_ISP1760) += isp1760/
687 --- a/drivers/usb/core/generic.c
688 +++ b/drivers/usb/core/generic.c
689 @@ -152,6 +152,7 @@ int usb_choose_configuration(struct usb_
690 dev_warn(&udev->dev,
691 "no configuration chosen from %d choice%s\n",
692 num_configs, plural(num_configs));
693 + dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
694 }
695 return i;
696 }
697 --- a/drivers/usb/core/hub.c
698 +++ b/drivers/usb/core/hub.c
699 @@ -5068,7 +5068,7 @@ static void port_event(struct usb_hub *h
700 if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
701 u16 status = 0, unused;
702
703 - dev_dbg(&port_dev->dev, "over-current change\n");
704 + dev_notice(&port_dev->dev, "over-current change\n");
705 usb_clear_port_feature(hdev, port1,
706 USB_PORT_FEAT_C_OVER_CURRENT);
707 msleep(100); /* Cool down */
708 --- a/drivers/usb/core/message.c
709 +++ b/drivers/usb/core/message.c
710 @@ -1912,6 +1912,85 @@ free_interfaces:
711 if (cp->string == NULL &&
712 !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
713 cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
714 +/* Uncomment this define to enable the HS Electrical Test support */
715 +#define DWC_HS_ELECT_TST 1
716 +#ifdef DWC_HS_ELECT_TST
717 + /* Here we implement the HS Electrical Test support. The
718 + * tester uses a vendor ID of 0x1A0A to indicate we should
719 + * run a special test sequence. The product ID tells us
720 + * which sequence to run. We invoke the test sequence by
721 + * sending a non-standard SetFeature command to our root
722 + * hub port. Our dwc_otg_hcd_hub_control() routine will
723 + * recognize the command and perform the desired test
724 + * sequence.
725 + */
726 + if (dev->descriptor.idVendor == 0x1A0A) {
727 + /* HSOTG Electrical Test */
728 + dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
729 +
730 + if (dev->bus && dev->bus->root_hub) {
731 + struct usb_device *hdev = dev->bus->root_hub;
732 + dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
733 +
734 + switch (dev->descriptor.idProduct) {
735 + case 0x0101: /* TEST_SE0_NAK */
736 + dev_warn(&dev->dev, "TEST_SE0_NAK\n");
737 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
738 + USB_REQ_SET_FEATURE, USB_RT_PORT,
739 + USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
740 + break;
741 +
742 + case 0x0102: /* TEST_J */
743 + dev_warn(&dev->dev, "TEST_J\n");
744 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
745 + USB_REQ_SET_FEATURE, USB_RT_PORT,
746 + USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
747 + break;
748 +
749 + case 0x0103: /* TEST_K */
750 + dev_warn(&dev->dev, "TEST_K\n");
751 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
752 + USB_REQ_SET_FEATURE, USB_RT_PORT,
753 + USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
754 + break;
755 +
756 + case 0x0104: /* TEST_PACKET */
757 + dev_warn(&dev->dev, "TEST_PACKET\n");
758 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
759 + USB_REQ_SET_FEATURE, USB_RT_PORT,
760 + USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
761 + break;
762 +
763 + case 0x0105: /* TEST_FORCE_ENABLE */
764 + dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
765 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
766 + USB_REQ_SET_FEATURE, USB_RT_PORT,
767 + USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
768 + break;
769 +
770 + case 0x0106: /* HS_HOST_PORT_SUSPEND_RESUME */
771 + dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
772 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
773 + USB_REQ_SET_FEATURE, USB_RT_PORT,
774 + USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
775 + break;
776 +
777 + case 0x0107: /* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
778 + dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
779 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
780 + USB_REQ_SET_FEATURE, USB_RT_PORT,
781 + USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
782 + break;
783 +
784 + case 0x0108: /* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
785 + dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
786 + usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
787 + USB_REQ_SET_FEATURE, USB_RT_PORT,
788 + USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
789 + }
790 + }
791 + }
792 +#endif /* DWC_HS_ELECT_TST */
793
794 /* Now that the interfaces are installed, re-enable LPM. */
795 usb_unlocked_enable_lpm(dev);
796 --- a/drivers/usb/core/otg_whitelist.h
797 +++ b/drivers/usb/core/otg_whitelist.h
798 @@ -19,33 +19,82 @@
799 static struct usb_device_id whitelist_table[] = {
800
801 /* hubs are optional in OTG, but very handy ... */
802 +#define CERT_WITHOUT_HUBS
803 +#if defined(CERT_WITHOUT_HUBS)
804 +{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
805 +#else
806 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
807 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
808 +{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
809 +#endif
810
811 #ifdef CONFIG_USB_PRINTER /* ignoring nonstatic linkage! */
812 /* FIXME actually, printers are NOT supposed to use device classes;
813 * they're supposed to use interface classes...
814 */
815 -{ USB_DEVICE_INFO(7, 1, 1) },
816 -{ USB_DEVICE_INFO(7, 1, 2) },
817 -{ USB_DEVICE_INFO(7, 1, 3) },
818 +//{ USB_DEVICE_INFO(7, 1, 1) },
819 +//{ USB_DEVICE_INFO(7, 1, 2) },
820 +//{ USB_DEVICE_INFO(7, 1, 3) },
821 #endif
822
823 #ifdef CONFIG_USB_NET_CDCETHER
824 /* Linux-USB CDC Ethernet gadget */
825 -{ USB_DEVICE(0x0525, 0xa4a1), },
826 +//{ USB_DEVICE(0x0525, 0xa4a1), },
827 /* Linux-USB CDC Ethernet + RNDIS gadget */
828 -{ USB_DEVICE(0x0525, 0xa4a2), },
829 +//{ USB_DEVICE(0x0525, 0xa4a2), },
830 #endif
831
832 #if IS_ENABLED(CONFIG_USB_TEST)
833 /* gadget zero, for testing */
834 -{ USB_DEVICE(0x0525, 0xa4a0), },
835 +//{ USB_DEVICE(0x0525, 0xa4a0), },
836 #endif
837
838 +/* OPT Tester */
839 +{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
840 +{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
841 +{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
842 +{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
843 +{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
844 +{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME */
845 +{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
846 +{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
847 +
848 +/* Sony cameras */
849 +{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
850 +
851 +/* Memory Devices */
852 +//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
853 +//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
854 +//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
855 +//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD */
856 +{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
857 +//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
858 +
859 +/* HP Printers */
860 +//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
861 +//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
862 +
863 +/* Speakers */
864 +//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
865 +//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
866 +
867 { } /* Terminating entry */
868 };
869
870 +static inline void report_errors(struct usb_device *dev)
871 +{
872 + /* OTG MESSAGE: report errors here, customize to match your product */
873 + dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
874 + le16_to_cpu(dev->descriptor.idVendor),
875 + le16_to_cpu(dev->descriptor.idProduct));
876 + if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
877 + dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
878 + } else {
879 + dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
880 + }
881 +}
882 +
883 +
884 static int is_targeted(struct usb_device *dev)
885 {
886 struct usb_device_id *id = whitelist_table;
887 @@ -95,16 +144,57 @@ static int is_targeted(struct usb_device
888 continue;
889
890 return 1;
891 - }
892 + /* NOTE: can't use usb_match_id() since interface caches
893 + * aren't set up yet. this is cut/paste from that code.
894 + */
895 + for (id = whitelist_table; id->match_flags; id++) {
896 +#ifdef DEBUG
897 + dev_dbg(&dev->dev,
898 + "ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
899 + id->idVendor,
900 + id->idProduct,
901 + id->bDeviceClass,
902 + id->bDeviceSubClass,
903 + id->bDeviceProtocol);
904 +#endif
905
906 - /* add other match criteria here ... */
907 + if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
908 + id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
909 + continue;
910 +
911 + if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
912 + id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
913 + continue;
914 +
915 + /* No need to test id->bcdDevice_lo != 0, since 0 is never
916 + greater than any unsigned number. */
917 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
918 + (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
919 + continue;
920 +
921 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
922 + (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
923 + continue;
924 +
925 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
926 + (id->bDeviceClass != dev->descriptor.bDeviceClass))
927 + continue;
928 +
929 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
930 + (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
931 + continue;
932 +
933 + if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
934 + (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
935 + continue;
936
937 + return 1;
938 + }
939 + }
940
941 - /* OTG MESSAGE: report errors here, customize to match your product */
942 - dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
943 - le16_to_cpu(dev->descriptor.idVendor),
944 - le16_to_cpu(dev->descriptor.idProduct));
945 + /* add other match criteria here ... */
946
947 + report_errors(dev);
948 return 0;
949 }
950
951 --- /dev/null
952 +++ b/drivers/usb/gadget/file_storage.c
953 @@ -0,0 +1,3676 @@
954 +/*
955 + * file_storage.c -- File-backed USB Storage Gadget, for USB development
956 + *
957 + * Copyright (C) 2003-2008 Alan Stern
958 + * All rights reserved.
959 + *
960 + * Redistribution and use in source and binary forms, with or without
961 + * modification, are permitted provided that the following conditions
962 + * are met:
963 + * 1. Redistributions of source code must retain the above copyright
964 + * notice, this list of conditions, and the following disclaimer,
965 + * without modification.
966 + * 2. Redistributions in binary form must reproduce the above copyright
967 + * notice, this list of conditions and the following disclaimer in the
968 + * documentation and/or other materials provided with the distribution.
969 + * 3. The names of the above-listed copyright holders may not be used
970 + * to endorse or promote products derived from this software without
971 + * specific prior written permission.
972 + *
973 + * ALTERNATIVELY, this software may be distributed under the terms of the
974 + * GNU General Public License ("GPL") as published by the Free Software
975 + * Foundation, either version 2 of that License or (at your option) any
976 + * later version.
977 + *
978 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
979 + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
980 + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
981 + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
982 + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
983 + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
984 + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
985 + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
986 + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
987 + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
988 + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
989 + */
990 +
991 +
992 +/*
993 + * The File-backed Storage Gadget acts as a USB Mass Storage device,
994 + * appearing to the host as a disk drive or as a CD-ROM drive. In addition
995 + * to providing an example of a genuinely useful gadget driver for a USB
996 + * device, it also illustrates a technique of double-buffering for increased
997 + * throughput. Last but not least, it gives an easy way to probe the
998 + * behavior of the Mass Storage drivers in a USB host.
999 + *
1000 + * Backing storage is provided by a regular file or a block device, specified
1001 + * by the "file" module parameter. Access can be limited to read-only by
1002 + * setting the optional "ro" module parameter. (For CD-ROM emulation,
1003 + * access is always read-only.) The gadget will indicate that it has
1004 + * removable media if the optional "removable" module parameter is set.
1005 + *
1006 + * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
1007 + * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
1008 + * by the optional "transport" module parameter. It also supports the
1009 + * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
1010 + * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
1011 + * the optional "protocol" module parameter. In addition, the default
1012 + * Vendor ID, Product ID, release number and serial number can be overridden.
1013 + *
1014 + * There is support for multiple logical units (LUNs), each of which has
1015 + * its own backing file. The number of LUNs can be set using the optional
1016 + * "luns" module parameter (anywhere from 1 to 8), and the corresponding
1017 + * files are specified using comma-separated lists for "file" and "ro".
1018 + * The default number of LUNs is taken from the number of "file" elements;
1019 + * it is 1 if "file" is not given. If "removable" is not set then a backing
1020 + * file must be specified for each LUN. If it is set, then an unspecified
1021 + * or empty backing filename means the LUN's medium is not loaded. Ideally
1022 + * each LUN would be settable independently as a disk drive or a CD-ROM
1023 + * drive, but currently all LUNs have to be the same type. The CD-ROM
1024 + * emulation includes a single data track and no audio tracks; hence there
1025 + * need be only one backing file per LUN.
1026 + *
1027 + * Requirements are modest; only a bulk-in and a bulk-out endpoint are
1028 + * needed (an interrupt-out endpoint is also needed for CBI). The memory
1029 + * requirement amounts to two 16K buffers, size configurable by a parameter.
1030 + * Support is included for both full-speed and high-speed operation.
1031 + *
1032 + * Note that the driver is slightly non-portable in that it assumes a
1033 + * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
1034 + * interrupt-in endpoints. With most device controllers this isn't an
1035 + * issue, but there may be some with hardware restrictions that prevent
1036 + * a buffer from being used by more than one endpoint.
1037 + *
1038 + * Module options:
1039 + *
1040 + * file=filename[,filename...]
1041 + * Required if "removable" is not set, names of
1042 + * the files or block devices used for
1043 + * backing storage
1044 + * serial=HHHH... Required serial number (string of hex chars)
1045 + * ro=b[,b...] Default false, booleans for read-only access
1046 + * removable Default false, boolean for removable media
1047 + * luns=N Default N = number of filenames, number of
1048 + * LUNs to support
1049 + * nofua=b[,b...] Default false, booleans for ignore FUA flag
1050 + * in SCSI WRITE(10,12) commands
1051 + * stall Default determined according to the type of
1052 + * USB device controller (usually true),
1053 + * boolean to permit the driver to halt
1054 + * bulk endpoints
1055 + * cdrom Default false, boolean for whether to emulate
1056 + * a CD-ROM drive
1057 + * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
1058 + * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
1059 + * ATAPI, QIC, UFI, 8070, or SCSI;
1060 + * also 1 - 6)
1061 + * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
1062 + * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
1063 + * release=0xRRRR Override the USB release number (bcdDevice)
1064 + * buflen=N Default N=16384, buffer size used (will be
1065 + * rounded down to a multiple of
1066 + * PAGE_CACHE_SIZE)
1067 + *
1068 + * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
1069 + * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
1070 + * default values are used for everything else.
1071 + *
1072 + * The pathnames of the backing files and the ro settings are available in
1073 + * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
1074 + * the gadget's sysfs directory. If the "removable" option is set, writing to
1075 + * these files will simulate ejecting/loading the medium (writing an empty
1076 + * line means eject) and adjusting a write-enable tab. Changes to the ro
1077 + * setting are not allowed when the medium is loaded or if CD-ROM emulation
1078 + * is being used.
1079 + *
1080 + * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
1081 + * The driver's SCSI command interface was based on the "Information
1082 + * technology - Small Computer System Interface - 2" document from
1083 + * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
1084 + * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
1085 + * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
1086 + * "Universal Serial Bus Mass Storage Class UFI Command Specification"
1087 + * document, Revision 1.0, December 14, 1998, available at
1088 + * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
1089 + */
1090 +
1091 +
1092 +/*
1093 + * Driver Design
1094 + *
1095 + * The FSG driver is fairly straightforward. There is a main kernel
1096 + * thread that handles most of the work. Interrupt routines field
1097 + * callbacks from the controller driver: bulk- and interrupt-request
1098 + * completion notifications, endpoint-0 events, and disconnect events.
1099 + * Completion events are passed to the main thread by wakeup calls. Many
1100 + * ep0 requests are handled at interrupt time, but SetInterface,
1101 + * SetConfiguration, and device reset requests are forwarded to the
1102 + * thread in the form of "exceptions" using SIGUSR1 signals (since they
1103 + * should interrupt any ongoing file I/O operations).
1104 + *
1105 + * The thread's main routine implements the standard command/data/status
1106 + * parts of a SCSI interaction. It and its subroutines are full of tests
1107 + * for pending signals/exceptions -- all this polling is necessary since
1108 + * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
1109 + * indication that the driver really wants to be running in userspace.)
1110 + * An important point is that so long as the thread is alive it keeps an
1111 + * open reference to the backing file. This will prevent unmounting
1112 + * the backing file's underlying filesystem and could cause problems
1113 + * during system shutdown, for example. To prevent such problems, the
1114 + * thread catches INT, TERM, and KILL signals and converts them into
1115 + * an EXIT exception.
1116 + *
1117 + * In normal operation the main thread is started during the gadget's
1118 + * fsg_bind() callback and stopped during fsg_unbind(). But it can also
1119 + * exit when it receives a signal, and there's no point leaving the
1120 + * gadget running when the thread is dead. So just before the thread
1121 + * exits, it deregisters the gadget driver. This makes things a little
1122 + * tricky: The driver is deregistered at two places, and the exiting
1123 + * thread can indirectly call fsg_unbind() which in turn can tell the
1124 + * thread to exit. The first problem is resolved through the use of the
1125 + * REGISTERED atomic bitflag; the driver will only be deregistered once.
1126 + * The second problem is resolved by having fsg_unbind() check
1127 + * fsg->state; it won't try to stop the thread if the state is already
1128 + * FSG_STATE_TERMINATED.
1129 + *
1130 + * To provide maximum throughput, the driver uses a circular pipeline of
1131 + * buffer heads (struct fsg_buffhd). In principle the pipeline can be
1132 + * arbitrarily long; in practice the benefits don't justify having more
1133 + * than 2 stages (i.e., double buffering). But it helps to think of the
1134 + * pipeline as being a long one. Each buffer head contains a bulk-in and
1135 + * a bulk-out request pointer (since the buffer can be used for both
1136 + * output and input -- directions always are given from the host's
1137 + * point of view) as well as a pointer to the buffer and various state
1138 + * variables.
1139 + *
1140 + * Use of the pipeline follows a simple protocol. There is a variable
1141 + * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
1142 + * At any time that buffer head may still be in use from an earlier
1143 + * request, so each buffer head has a state variable indicating whether
1144 + * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
1145 + * buffer head to be EMPTY, filling the buffer either by file I/O or by
1146 + * USB I/O (during which the buffer head is BUSY), and marking the buffer
1147 + * head FULL when the I/O is complete. Then the buffer will be emptied
1148 + * (again possibly by USB I/O, during which it is marked BUSY) and
1149 + * finally marked EMPTY again (possibly by a completion routine).
1150 + *
1151 + * A module parameter tells the driver to avoid stalling the bulk
1152 + * endpoints wherever the transport specification allows. This is
1153 + * necessary for some UDCs like the SuperH, which cannot reliably clear a
1154 + * halt on a bulk endpoint. However, under certain circumstances the
1155 + * Bulk-only specification requires a stall. In such cases the driver
1156 + * will halt the endpoint and set a flag indicating that it should clear
1157 + * the halt in software during the next device reset. Hopefully this
1158 + * will permit everything to work correctly. Furthermore, although the
1159 + * specification allows the bulk-out endpoint to halt when the host sends
1160 + * too much data, implementing this would cause an unavoidable race.
1161 + * The driver will always use the "no-stall" approach for OUT transfers.
1162 + *
1163 + * One subtle point concerns sending status-stage responses for ep0
1164 + * requests. Some of these requests, such as device reset, can involve
1165 + * interrupting an ongoing file I/O operation, which might take an
1166 + * arbitrarily long time. During that delay the host might give up on
1167 + * the original ep0 request and issue a new one. When that happens the
1168 + * driver should not notify the host about completion of the original
1169 + * request, as the host will no longer be waiting for it. So the driver
1170 + * assigns to each ep0 request a unique tag, and it keeps track of the
1171 + * tag value of the request associated with a long-running exception
1172 + * (device-reset, interface-change, or configuration-change). When the
1173 + * exception handler is finished, the status-stage response is submitted
1174 + * only if the current ep0 request tag is equal to the exception request
1175 + * tag. Thus only the most recently received ep0 request will get a
1176 + * status-stage response.
1177 + *
1178 + * Warning: This driver source file is too long. It ought to be split up
1179 + * into a header file plus about 3 separate .c files, to handle the details
1180 + * of the Gadget, USB Mass Storage, and SCSI protocols.
1181 + */
1182 +
1183 +
1184 +/* #define VERBOSE_DEBUG */
1185 +/* #define DUMP_MSGS */
1186 +
1187 +
1188 +#include <linux/blkdev.h>
1189 +#include <linux/completion.h>
1190 +#include <linux/dcache.h>
1191 +#include <linux/delay.h>
1192 +#include <linux/device.h>
1193 +#include <linux/fcntl.h>
1194 +#include <linux/file.h>
1195 +#include <linux/fs.h>
1196 +#include <linux/kref.h>
1197 +#include <linux/kthread.h>
1198 +#include <linux/limits.h>
1199 +#include <linux/module.h>
1200 +#include <linux/rwsem.h>
1201 +#include <linux/slab.h>
1202 +#include <linux/spinlock.h>
1203 +#include <linux/string.h>
1204 +#include <linux/freezer.h>
1205 +#include <linux/utsname.h>
1206 +
1207 +#include <linux/usb/ch9.h>
1208 +#include <linux/usb/gadget.h>
1209 +
1210 +#include "gadget_chips.h"
1211 +
1212 +
1213 +
1214 +/*
1215 + * Kbuild is not very cooperative with respect to linking separately
1216 + * compiled library objects into one module. So for now we won't use
1217 + * separate compilation ... ensuring init/exit sections work to shrink
1218 + * the runtime footprint, and giving us at least some parts of what
1219 + * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
1220 + */
1221 +#include "usbstring.c"
1222 +#include "config.c"
1223 +#include "epautoconf.c"
1224 +
1225 +/*-------------------------------------------------------------------------*/
1226 +
1227 +#define DRIVER_DESC "File-backed Storage Gadget"
1228 +#define DRIVER_NAME "g_file_storage"
1229 +#define DRIVER_VERSION "1 September 2010"
1230 +
1231 +static char fsg_string_manufacturer[64];
1232 +static const char fsg_string_product[] = DRIVER_DESC;
1233 +static const char fsg_string_config[] = "Self-powered";
1234 +static const char fsg_string_interface[] = "Mass Storage";
1235 +
1236 +
1237 +#include "storage_common.c"
1238 +
1239 +
1240 +MODULE_DESCRIPTION(DRIVER_DESC);
1241 +MODULE_AUTHOR("Alan Stern");
1242 +MODULE_LICENSE("Dual BSD/GPL");
1243 +
1244 +/*
1245 + * This driver assumes self-powered hardware and has no way for users to
1246 + * trigger remote wakeup. It uses autoconfiguration to select endpoints
1247 + * and endpoint addresses.
1248 + */
1249 +
1250 +
1251 +/*-------------------------------------------------------------------------*/
1252 +
1253 +
1254 +/* Encapsulate the module parameter settings */
1255 +
1256 +static struct {
1257 + char *file[FSG_MAX_LUNS];
1258 + char *serial;
1259 + bool ro[FSG_MAX_LUNS];
1260 + bool nofua[FSG_MAX_LUNS];
1261 + unsigned int num_filenames;
1262 + unsigned int num_ros;
1263 + unsigned int num_nofuas;
1264 + unsigned int nluns;
1265 +
1266 + bool removable;
1267 + bool can_stall;
1268 + bool cdrom;
1269 +
1270 + char *transport_parm;
1271 + char *protocol_parm;
1272 + unsigned short vendor;
1273 + unsigned short product;
1274 + unsigned short release;
1275 + unsigned int buflen;
1276 +
1277 + int transport_type;
1278 + char *transport_name;
1279 + int protocol_type;
1280 + char *protocol_name;
1281 +
1282 +} mod_data = { // Default values
1283 + .transport_parm = "BBB",
1284 + .protocol_parm = "SCSI",
1285 + .removable = 0,
1286 + .can_stall = 1,
1287 + .cdrom = 0,
1288 + .vendor = FSG_VENDOR_ID,
1289 + .product = FSG_PRODUCT_ID,
1290 + .release = 0xffff, // Use controller chip type
1291 + .buflen = 16384,
1292 + };
1293 +
1294 +
1295 +module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
1296 + S_IRUGO);
1297 +MODULE_PARM_DESC(file, "names of backing files or devices");
1298 +
1299 +module_param_named(serial, mod_data.serial, charp, S_IRUGO);
1300 +MODULE_PARM_DESC(serial, "USB serial number");
1301 +
1302 +module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
1303 +MODULE_PARM_DESC(ro, "true to force read-only");
1304 +
1305 +module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
1306 + S_IRUGO);
1307 +MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
1308 +
1309 +module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
1310 +MODULE_PARM_DESC(luns, "number of LUNs");
1311 +
1312 +module_param_named(removable, mod_data.removable, bool, S_IRUGO);
1313 +MODULE_PARM_DESC(removable, "true to simulate removable media");
1314 +
1315 +module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
1316 +MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
1317 +
1318 +module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
1319 +MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
1320 +
1321 +/* In the non-TEST version, only the module parameters listed above
1322 + * are available. */
1323 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1324 +
1325 +module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
1326 +MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
1327 +
1328 +module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
1329 +MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
1330 + "8070, or SCSI)");
1331 +
1332 +module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
1333 +MODULE_PARM_DESC(vendor, "USB Vendor ID");
1334 +
1335 +module_param_named(product, mod_data.product, ushort, S_IRUGO);
1336 +MODULE_PARM_DESC(product, "USB Product ID");
1337 +
1338 +module_param_named(release, mod_data.release, ushort, S_IRUGO);
1339 +MODULE_PARM_DESC(release, "USB release number");
1340 +
1341 +module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
1342 +MODULE_PARM_DESC(buflen, "I/O buffer size");
1343 +
1344 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1345 +
1346 +
1347 +/*
1348 + * These definitions will permit the compiler to avoid generating code for
1349 + * parts of the driver that aren't used in the non-TEST version. Even gcc
1350 + * can recognize when a test of a constant expression yields a dead code
1351 + * path.
1352 + */
1353 +
1354 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1355 +
1356 +#define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
1357 +#define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
1358 +#define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
1359 +
1360 +#else
1361 +
1362 +#define transport_is_bbb() 1
1363 +#define transport_is_cbi() 0
1364 +#define protocol_is_scsi() 1
1365 +
1366 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1367 +
1368 +
1369 +/*-------------------------------------------------------------------------*/
1370 +
1371 +
1372 +struct fsg_dev {
1373 + /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
1374 + spinlock_t lock;
1375 + struct usb_gadget *gadget;
1376 +
1377 + /* filesem protects: backing files in use */
1378 + struct rw_semaphore filesem;
1379 +
1380 + /* reference counting: wait until all LUNs are released */
1381 + struct kref ref;
1382 +
1383 + struct usb_ep *ep0; // Handy copy of gadget->ep0
1384 + struct usb_request *ep0req; // For control responses
1385 + unsigned int ep0_req_tag;
1386 + const char *ep0req_name;
1387 +
1388 + struct usb_request *intreq; // For interrupt responses
1389 + int intreq_busy;
1390 + struct fsg_buffhd *intr_buffhd;
1391 +
1392 + unsigned int bulk_out_maxpacket;
1393 + enum fsg_state state; // For exception handling
1394 + unsigned int exception_req_tag;
1395 +
1396 + u8 config, new_config;
1397 +
1398 + unsigned int running : 1;
1399 + unsigned int bulk_in_enabled : 1;
1400 + unsigned int bulk_out_enabled : 1;
1401 + unsigned int intr_in_enabled : 1;
1402 + unsigned int phase_error : 1;
1403 + unsigned int short_packet_received : 1;
1404 + unsigned int bad_lun_okay : 1;
1405 +
1406 + unsigned long atomic_bitflags;
1407 +#define REGISTERED 0
1408 +#define IGNORE_BULK_OUT 1
1409 +#define SUSPENDED 2
1410 +
1411 + struct usb_ep *bulk_in;
1412 + struct usb_ep *bulk_out;
1413 + struct usb_ep *intr_in;
1414 +
1415 + struct fsg_buffhd *next_buffhd_to_fill;
1416 + struct fsg_buffhd *next_buffhd_to_drain;
1417 +
1418 + int thread_wakeup_needed;
1419 + struct completion thread_notifier;
1420 + struct task_struct *thread_task;
1421 +
1422 + int cmnd_size;
1423 + u8 cmnd[MAX_COMMAND_SIZE];
1424 + enum data_direction data_dir;
1425 + u32 data_size;
1426 + u32 data_size_from_cmnd;
1427 + u32 tag;
1428 + unsigned int lun;
1429 + u32 residue;
1430 + u32 usb_amount_left;
1431 +
1432 + /* The CB protocol offers no way for a host to know when a command
1433 + * has completed. As a result the next command may arrive early,
1434 + * and we will still have to handle it. For that reason we need
1435 + * a buffer to store new commands when using CB (or CBI, which
1436 + * does not oblige a host to wait for command completion either). */
1437 + int cbbuf_cmnd_size;
1438 + u8 cbbuf_cmnd[MAX_COMMAND_SIZE];
1439 +
1440 + unsigned int nluns;
1441 + struct fsg_lun *luns;
1442 + struct fsg_lun *curlun;
1443 + /* Must be the last entry */
1444 + struct fsg_buffhd buffhds[];
1445 +};
1446 +
1447 +typedef void (*fsg_routine_t)(struct fsg_dev *);
1448 +
1449 +static int exception_in_progress(struct fsg_dev *fsg)
1450 +{
1451 + return (fsg->state > FSG_STATE_IDLE);
1452 +}
1453 +
1454 +/* Make bulk-out requests be divisible by the maxpacket size */
1455 +static void set_bulk_out_req_length(struct fsg_dev *fsg,
1456 + struct fsg_buffhd *bh, unsigned int length)
1457 +{
1458 + unsigned int rem;
1459 +
1460 + bh->bulk_out_intended_length = length;
1461 + rem = length % fsg->bulk_out_maxpacket;
1462 + if (rem > 0)
1463 + length += fsg->bulk_out_maxpacket - rem;
1464 + bh->outreq->length = length;
1465 +}
1466 +
1467 +static struct fsg_dev *the_fsg;
1468 +static struct usb_gadget_driver fsg_driver;
1469 +
1470 +
1471 +/*-------------------------------------------------------------------------*/
1472 +
1473 +static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
1474 +{
1475 + const char *name;
1476 +
1477 + if (ep == fsg->bulk_in)
1478 + name = "bulk-in";
1479 + else if (ep == fsg->bulk_out)
1480 + name = "bulk-out";
1481 + else
1482 + name = ep->name;
1483 + DBG(fsg, "%s set halt\n", name);
1484 + return usb_ep_set_halt(ep);
1485 +}
1486 +
1487 +
1488 +/*-------------------------------------------------------------------------*/
1489 +
1490 +/*
1491 + * DESCRIPTORS ... most are static, but strings and (full) configuration
1492 + * descriptors are built on demand. Also the (static) config and interface
1493 + * descriptors are adjusted during fsg_bind().
1494 + */
1495 +
1496 +/* There is only one configuration. */
1497 +#define CONFIG_VALUE 1
1498 +
1499 +static struct usb_device_descriptor
1500 +device_desc = {
1501 + .bLength = sizeof device_desc,
1502 + .bDescriptorType = USB_DT_DEVICE,
1503 +
1504 + .bcdUSB = cpu_to_le16(0x0200),
1505 + .bDeviceClass = USB_CLASS_PER_INTERFACE,
1506 +
1507 + /* The next three values can be overridden by module parameters */
1508 + .idVendor = cpu_to_le16(FSG_VENDOR_ID),
1509 + .idProduct = cpu_to_le16(FSG_PRODUCT_ID),
1510 + .bcdDevice = cpu_to_le16(0xffff),
1511 +
1512 + .iManufacturer = FSG_STRING_MANUFACTURER,
1513 + .iProduct = FSG_STRING_PRODUCT,
1514 + .iSerialNumber = FSG_STRING_SERIAL,
1515 + .bNumConfigurations = 1,
1516 +};
1517 +
1518 +static struct usb_config_descriptor
1519 +config_desc = {
1520 + .bLength = sizeof config_desc,
1521 + .bDescriptorType = USB_DT_CONFIG,
1522 +
1523 + /* wTotalLength computed by usb_gadget_config_buf() */
1524 + .bNumInterfaces = 1,
1525 + .bConfigurationValue = CONFIG_VALUE,
1526 + .iConfiguration = FSG_STRING_CONFIG,
1527 + .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
1528 + .bMaxPower = CONFIG_USB_GADGET_VBUS_DRAW / 2,
1529 +};
1530 +
1531 +
1532 +static struct usb_qualifier_descriptor
1533 +dev_qualifier = {
1534 + .bLength = sizeof dev_qualifier,
1535 + .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
1536 +
1537 + .bcdUSB = cpu_to_le16(0x0200),
1538 + .bDeviceClass = USB_CLASS_PER_INTERFACE,
1539 +
1540 + .bNumConfigurations = 1,
1541 +};
1542 +
1543 +static int populate_bos(struct fsg_dev *fsg, u8 *buf)
1544 +{
1545 + memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
1546 + buf += USB_DT_BOS_SIZE;
1547 +
1548 + memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
1549 + buf += USB_DT_USB_EXT_CAP_SIZE;
1550 +
1551 + memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
1552 +
1553 + return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
1554 + + USB_DT_USB_EXT_CAP_SIZE;
1555 +}
1556 +
1557 +/*
1558 + * Config descriptors must agree with the code that sets configurations
1559 + * and with code managing interfaces and their altsettings. They must
1560 + * also handle different speeds and other-speed requests.
1561 + */
1562 +static int populate_config_buf(struct usb_gadget *gadget,
1563 + u8 *buf, u8 type, unsigned index)
1564 +{
1565 + enum usb_device_speed speed = gadget->speed;
1566 + int len;
1567 + const struct usb_descriptor_header **function;
1568 +
1569 + if (index > 0)
1570 + return -EINVAL;
1571 +
1572 + if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
1573 + speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
1574 + function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
1575 + ? (const struct usb_descriptor_header **)fsg_hs_function
1576 + : (const struct usb_descriptor_header **)fsg_fs_function;
1577 +
1578 + /* for now, don't advertise srp-only devices */
1579 + if (!gadget_is_otg(gadget))
1580 + function++;
1581 +
1582 + len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
1583 + ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
1584 + return len;
1585 +}
1586 +
1587 +
1588 +/*-------------------------------------------------------------------------*/
1589 +
1590 +/* These routines may be called in process context or in_irq */
1591 +
1592 +/* Caller must hold fsg->lock */
1593 +static void wakeup_thread(struct fsg_dev *fsg)
1594 +{
1595 + /* Tell the main thread that something has happened */
1596 + fsg->thread_wakeup_needed = 1;
1597 + if (fsg->thread_task)
1598 + wake_up_process(fsg->thread_task);
1599 +}
1600 +
1601 +
1602 +static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
1603 +{
1604 + unsigned long flags;
1605 +
1606 + /* Do nothing if a higher-priority exception is already in progress.
1607 + * If a lower-or-equal priority exception is in progress, preempt it
1608 + * and notify the main thread by sending it a signal. */
1609 + spin_lock_irqsave(&fsg->lock, flags);
1610 + if (fsg->state <= new_state) {
1611 + fsg->exception_req_tag = fsg->ep0_req_tag;
1612 + fsg->state = new_state;
1613 + if (fsg->thread_task)
1614 + send_sig_info(SIGUSR1, SEND_SIG_FORCED,
1615 + fsg->thread_task);
1616 + }
1617 + spin_unlock_irqrestore(&fsg->lock, flags);
1618 +}
1619 +
1620 +
1621 +/*-------------------------------------------------------------------------*/
1622 +
1623 +/* The disconnect callback and ep0 routines. These always run in_irq,
1624 + * except that ep0_queue() is called in the main thread to acknowledge
1625 + * completion of various requests: set config, set interface, and
1626 + * Bulk-only device reset. */
1627 +
1628 +static void fsg_disconnect(struct usb_gadget *gadget)
1629 +{
1630 + struct fsg_dev *fsg = get_gadget_data(gadget);
1631 +
1632 + DBG(fsg, "disconnect or port reset\n");
1633 + raise_exception(fsg, FSG_STATE_DISCONNECT);
1634 +}
1635 +
1636 +
1637 +static int ep0_queue(struct fsg_dev *fsg)
1638 +{
1639 + int rc;
1640 +
1641 + rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
1642 + if (rc != 0 && rc != -ESHUTDOWN) {
1643 +
1644 + /* We can't do much more than wait for a reset */
1645 + WARNING(fsg, "error in submission: %s --> %d\n",
1646 + fsg->ep0->name, rc);
1647 + }
1648 + return rc;
1649 +}
1650 +
1651 +static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
1652 +{
1653 + struct fsg_dev *fsg = ep->driver_data;
1654 +
1655 + if (req->actual > 0)
1656 + dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
1657 + if (req->status || req->actual != req->length)
1658 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1659 + req->status, req->actual, req->length);
1660 + if (req->status == -ECONNRESET) // Request was cancelled
1661 + usb_ep_fifo_flush(ep);
1662 +
1663 + if (req->status == 0 && req->context)
1664 + ((fsg_routine_t) (req->context))(fsg);
1665 +}
1666 +
1667 +
1668 +/*-------------------------------------------------------------------------*/
1669 +
1670 +/* Bulk and interrupt endpoint completion handlers.
1671 + * These always run in_irq. */
1672 +
1673 +static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
1674 +{
1675 + struct fsg_dev *fsg = ep->driver_data;
1676 + struct fsg_buffhd *bh = req->context;
1677 +
1678 + if (req->status || req->actual != req->length)
1679 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1680 + req->status, req->actual, req->length);
1681 + if (req->status == -ECONNRESET) // Request was cancelled
1682 + usb_ep_fifo_flush(ep);
1683 +
1684 + /* Hold the lock while we update the request and buffer states */
1685 + smp_wmb();
1686 + spin_lock(&fsg->lock);
1687 + bh->inreq_busy = 0;
1688 + bh->state = BUF_STATE_EMPTY;
1689 + wakeup_thread(fsg);
1690 + spin_unlock(&fsg->lock);
1691 +}
1692 +
1693 +static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
1694 +{
1695 + struct fsg_dev *fsg = ep->driver_data;
1696 + struct fsg_buffhd *bh = req->context;
1697 +
1698 + dump_msg(fsg, "bulk-out", req->buf, req->actual);
1699 + if (req->status || req->actual != bh->bulk_out_intended_length)
1700 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1701 + req->status, req->actual,
1702 + bh->bulk_out_intended_length);
1703 + if (req->status == -ECONNRESET) // Request was cancelled
1704 + usb_ep_fifo_flush(ep);
1705 +
1706 + /* Hold the lock while we update the request and buffer states */
1707 + smp_wmb();
1708 + spin_lock(&fsg->lock);
1709 + bh->outreq_busy = 0;
1710 + bh->state = BUF_STATE_FULL;
1711 + wakeup_thread(fsg);
1712 + spin_unlock(&fsg->lock);
1713 +}
1714 +
1715 +
1716 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1717 +static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1718 +{
1719 + struct fsg_dev *fsg = ep->driver_data;
1720 + struct fsg_buffhd *bh = req->context;
1721 +
1722 + if (req->status || req->actual != req->length)
1723 + DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1724 + req->status, req->actual, req->length);
1725 + if (req->status == -ECONNRESET) // Request was cancelled
1726 + usb_ep_fifo_flush(ep);
1727 +
1728 + /* Hold the lock while we update the request and buffer states */
1729 + smp_wmb();
1730 + spin_lock(&fsg->lock);
1731 + fsg->intreq_busy = 0;
1732 + bh->state = BUF_STATE_EMPTY;
1733 + wakeup_thread(fsg);
1734 + spin_unlock(&fsg->lock);
1735 +}
1736 +
1737 +#else
1738 +static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1739 +{}
1740 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1741 +
1742 +
1743 +/*-------------------------------------------------------------------------*/
1744 +
1745 +/* Ep0 class-specific handlers. These always run in_irq. */
1746 +
1747 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
1748 +static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1749 +{
1750 + struct usb_request *req = fsg->ep0req;
1751 + static u8 cbi_reset_cmnd[6] = {
1752 + SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
1753 +
1754 + /* Error in command transfer? */
1755 + if (req->status || req->length != req->actual ||
1756 + req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
1757 +
1758 + /* Not all controllers allow a protocol stall after
1759 + * receiving control-out data, but we'll try anyway. */
1760 + fsg_set_halt(fsg, fsg->ep0);
1761 + return; // Wait for reset
1762 + }
1763 +
1764 + /* Is it the special reset command? */
1765 + if (req->actual >= sizeof cbi_reset_cmnd &&
1766 + memcmp(req->buf, cbi_reset_cmnd,
1767 + sizeof cbi_reset_cmnd) == 0) {
1768 +
1769 + /* Raise an exception to stop the current operation
1770 + * and reinitialize our state. */
1771 + DBG(fsg, "cbi reset request\n");
1772 + raise_exception(fsg, FSG_STATE_RESET);
1773 + return;
1774 + }
1775 +
1776 + VDBG(fsg, "CB[I] accept device-specific command\n");
1777 + spin_lock(&fsg->lock);
1778 +
1779 + /* Save the command for later */
1780 + if (fsg->cbbuf_cmnd_size)
1781 + WARNING(fsg, "CB[I] overwriting previous command\n");
1782 + fsg->cbbuf_cmnd_size = req->actual;
1783 + memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
1784 +
1785 + wakeup_thread(fsg);
1786 + spin_unlock(&fsg->lock);
1787 +}
1788 +
1789 +#else
1790 +static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1791 +{}
1792 +#endif /* CONFIG_USB_FILE_STORAGE_TEST */
1793 +
1794 +
1795 +static int class_setup_req(struct fsg_dev *fsg,
1796 + const struct usb_ctrlrequest *ctrl)
1797 +{
1798 + struct usb_request *req = fsg->ep0req;
1799 + int value = -EOPNOTSUPP;
1800 + u16 w_index = le16_to_cpu(ctrl->wIndex);
1801 + u16 w_value = le16_to_cpu(ctrl->wValue);
1802 + u16 w_length = le16_to_cpu(ctrl->wLength);
1803 +
1804 + if (!fsg->config)
1805 + return value;
1806 +
1807 + /* Handle Bulk-only class-specific requests */
1808 + if (transport_is_bbb()) {
1809 + switch (ctrl->bRequest) {
1810 +
1811 + case US_BULK_RESET_REQUEST:
1812 + if (ctrl->bRequestType != (USB_DIR_OUT |
1813 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1814 + break;
1815 + if (w_index != 0 || w_value != 0 || w_length != 0) {
1816 + value = -EDOM;
1817 + break;
1818 + }
1819 +
1820 + /* Raise an exception to stop the current operation
1821 + * and reinitialize our state. */
1822 + DBG(fsg, "bulk reset request\n");
1823 + raise_exception(fsg, FSG_STATE_RESET);
1824 + value = DELAYED_STATUS;
1825 + break;
1826 +
1827 + case US_BULK_GET_MAX_LUN:
1828 + if (ctrl->bRequestType != (USB_DIR_IN |
1829 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1830 + break;
1831 + if (w_index != 0 || w_value != 0 || w_length != 1) {
1832 + value = -EDOM;
1833 + break;
1834 + }
1835 + VDBG(fsg, "get max LUN\n");
1836 + *(u8 *) req->buf = fsg->nluns - 1;
1837 + value = 1;
1838 + break;
1839 + }
1840 + }
1841 +
1842 + /* Handle CBI class-specific requests */
1843 + else {
1844 + switch (ctrl->bRequest) {
1845 +
1846 + case USB_CBI_ADSC_REQUEST:
1847 + if (ctrl->bRequestType != (USB_DIR_OUT |
1848 + USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1849 + break;
1850 + if (w_index != 0 || w_value != 0) {
1851 + value = -EDOM;
1852 + break;
1853 + }
1854 + if (w_length > MAX_COMMAND_SIZE) {
1855 + value = -EOVERFLOW;
1856 + break;
1857 + }
1858 + value = w_length;
1859 + fsg->ep0req->context = received_cbi_adsc;
1860 + break;
1861 + }
1862 + }
1863 +
1864 + if (value == -EOPNOTSUPP)
1865 + VDBG(fsg,
1866 + "unknown class-specific control req "
1867 + "%02x.%02x v%04x i%04x l%u\n",
1868 + ctrl->bRequestType, ctrl->bRequest,
1869 + le16_to_cpu(ctrl->wValue), w_index, w_length);
1870 + return value;
1871 +}
1872 +
1873 +
1874 +/*-------------------------------------------------------------------------*/
1875 +
1876 +/* Ep0 standard request handlers. These always run in_irq. */
1877 +
1878 +static int standard_setup_req(struct fsg_dev *fsg,
1879 + const struct usb_ctrlrequest *ctrl)
1880 +{
1881 + struct usb_request *req = fsg->ep0req;
1882 + int value = -EOPNOTSUPP;
1883 + u16 w_index = le16_to_cpu(ctrl->wIndex);
1884 + u16 w_value = le16_to_cpu(ctrl->wValue);
1885 +
1886 + /* Usually this just stores reply data in the pre-allocated ep0 buffer,
1887 + * but config change events will also reconfigure hardware. */
1888 + switch (ctrl->bRequest) {
1889 +
1890 + case USB_REQ_GET_DESCRIPTOR:
1891 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1892 + USB_RECIP_DEVICE))
1893 + break;
1894 + switch (w_value >> 8) {
1895 +
1896 + case USB_DT_DEVICE:
1897 + VDBG(fsg, "get device descriptor\n");
1898 + device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
1899 + value = sizeof device_desc;
1900 + memcpy(req->buf, &device_desc, value);
1901 + break;
1902 + case USB_DT_DEVICE_QUALIFIER:
1903 + VDBG(fsg, "get device qualifier\n");
1904 + if (!gadget_is_dualspeed(fsg->gadget) ||
1905 + fsg->gadget->speed == USB_SPEED_SUPER)
1906 + break;
1907 + /*
1908 + * Assume ep0 uses the same maxpacket value for both
1909 + * speeds
1910 + */
1911 + dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
1912 + value = sizeof dev_qualifier;
1913 + memcpy(req->buf, &dev_qualifier, value);
1914 + break;
1915 +
1916 + case USB_DT_OTHER_SPEED_CONFIG:
1917 + VDBG(fsg, "get other-speed config descriptor\n");
1918 + if (!gadget_is_dualspeed(fsg->gadget) ||
1919 + fsg->gadget->speed == USB_SPEED_SUPER)
1920 + break;
1921 + goto get_config;
1922 + case USB_DT_CONFIG:
1923 + VDBG(fsg, "get configuration descriptor\n");
1924 +get_config:
1925 + value = populate_config_buf(fsg->gadget,
1926 + req->buf,
1927 + w_value >> 8,
1928 + w_value & 0xff);
1929 + break;
1930 +
1931 + case USB_DT_STRING:
1932 + VDBG(fsg, "get string descriptor\n");
1933 +
1934 + /* wIndex == language code */
1935 + value = usb_gadget_get_string(&fsg_stringtab,
1936 + w_value & 0xff, req->buf);
1937 + break;
1938 +
1939 + case USB_DT_BOS:
1940 + VDBG(fsg, "get bos descriptor\n");
1941 +
1942 + if (gadget_is_superspeed(fsg->gadget))
1943 + value = populate_bos(fsg, req->buf);
1944 + break;
1945 + }
1946 +
1947 + break;
1948 +
1949 + /* One config, two speeds */
1950 + case USB_REQ_SET_CONFIGURATION:
1951 + if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
1952 + USB_RECIP_DEVICE))
1953 + break;
1954 + VDBG(fsg, "set configuration\n");
1955 + if (w_value == CONFIG_VALUE || w_value == 0) {
1956 + fsg->new_config = w_value;
1957 +
1958 + /* Raise an exception to wipe out previous transaction
1959 + * state (queued bufs, etc) and set the new config. */
1960 + raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
1961 + value = DELAYED_STATUS;
1962 + }
1963 + break;
1964 + case USB_REQ_GET_CONFIGURATION:
1965 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1966 + USB_RECIP_DEVICE))
1967 + break;
1968 + VDBG(fsg, "get configuration\n");
1969 + *(u8 *) req->buf = fsg->config;
1970 + value = 1;
1971 + break;
1972 +
1973 + case USB_REQ_SET_INTERFACE:
1974 + if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
1975 + USB_RECIP_INTERFACE))
1976 + break;
1977 + if (fsg->config && w_index == 0) {
1978 +
1979 + /* Raise an exception to wipe out previous transaction
1980 + * state (queued bufs, etc) and install the new
1981 + * interface altsetting. */
1982 + raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
1983 + value = DELAYED_STATUS;
1984 + }
1985 + break;
1986 + case USB_REQ_GET_INTERFACE:
1987 + if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1988 + USB_RECIP_INTERFACE))
1989 + break;
1990 + if (!fsg->config)
1991 + break;
1992 + if (w_index != 0) {
1993 + value = -EDOM;
1994 + break;
1995 + }
1996 + VDBG(fsg, "get interface\n");
1997 + *(u8 *) req->buf = 0;
1998 + value = 1;
1999 + break;
2000 +
2001 + default:
2002 + VDBG(fsg,
2003 + "unknown control req %02x.%02x v%04x i%04x l%u\n",
2004 + ctrl->bRequestType, ctrl->bRequest,
2005 + w_value, w_index, le16_to_cpu(ctrl->wLength));
2006 + }
2007 +
2008 + return value;
2009 +}
2010 +
2011 +
2012 +static int fsg_setup(struct usb_gadget *gadget,
2013 + const struct usb_ctrlrequest *ctrl)
2014 +{
2015 + struct fsg_dev *fsg = get_gadget_data(gadget);
2016 + int rc;
2017 + int w_length = le16_to_cpu(ctrl->wLength);
2018 +
2019 + ++fsg->ep0_req_tag; // Record arrival of a new request
2020 + fsg->ep0req->context = NULL;
2021 + fsg->ep0req->length = 0;
2022 + dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
2023 +
2024 + if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
2025 + rc = class_setup_req(fsg, ctrl);
2026 + else
2027 + rc = standard_setup_req(fsg, ctrl);
2028 +
2029 + /* Respond with data/status or defer until later? */
2030 + if (rc >= 0 && rc != DELAYED_STATUS) {
2031 + rc = min(rc, w_length);
2032 + fsg->ep0req->length = rc;
2033 + fsg->ep0req->zero = rc < w_length;
2034 + fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
2035 + "ep0-in" : "ep0-out");
2036 + rc = ep0_queue(fsg);
2037 + }
2038 +
2039 + /* Device either stalls (rc < 0) or reports success */
2040 + return rc;
2041 +}
2042 +
2043 +
2044 +/*-------------------------------------------------------------------------*/
2045 +
2046 +/* All the following routines run in process context */
2047 +
2048 +
2049 +/* Use this for bulk or interrupt transfers, not ep0 */
2050 +static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
2051 + struct usb_request *req, int *pbusy,
2052 + enum fsg_buffer_state *state)
2053 +{
2054 + int rc;
2055 +
2056 + if (ep == fsg->bulk_in)
2057 + dump_msg(fsg, "bulk-in", req->buf, req->length);
2058 + else if (ep == fsg->intr_in)
2059 + dump_msg(fsg, "intr-in", req->buf, req->length);
2060 +
2061 + spin_lock_irq(&fsg->lock);
2062 + *pbusy = 1;
2063 + *state = BUF_STATE_BUSY;
2064 + spin_unlock_irq(&fsg->lock);
2065 + rc = usb_ep_queue(ep, req, GFP_KERNEL);
2066 + if (rc != 0) {
2067 + *pbusy = 0;
2068 + *state = BUF_STATE_EMPTY;
2069 +
2070 + /* We can't do much more than wait for a reset */
2071 +
2072 + /* Note: currently the net2280 driver fails zero-length
2073 + * submissions if DMA is enabled. */
2074 + if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
2075 + req->length == 0))
2076 + WARNING(fsg, "error in submission: %s --> %d\n",
2077 + ep->name, rc);
2078 + }
2079 +}
2080 +
2081 +
2082 +static int sleep_thread(struct fsg_dev *fsg)
2083 +{
2084 + int rc = 0;
2085 +
2086 + /* Wait until a signal arrives or we are woken up */
2087 + for (;;) {
2088 + try_to_freeze();
2089 + set_current_state(TASK_INTERRUPTIBLE);
2090 + if (signal_pending(current)) {
2091 + rc = -EINTR;
2092 + break;
2093 + }
2094 + if (fsg->thread_wakeup_needed)
2095 + break;
2096 + schedule();
2097 + }
2098 + __set_current_state(TASK_RUNNING);
2099 + fsg->thread_wakeup_needed = 0;
2100 + return rc;
2101 +}
2102 +
2103 +
2104 +/*-------------------------------------------------------------------------*/
2105 +
2106 +static int do_read(struct fsg_dev *fsg)
2107 +{
2108 + struct fsg_lun *curlun = fsg->curlun;
2109 + u32 lba;
2110 + struct fsg_buffhd *bh;
2111 + int rc;
2112 + u32 amount_left;
2113 + loff_t file_offset, file_offset_tmp;
2114 + unsigned int amount;
2115 + ssize_t nread;
2116 +
2117 + /* Get the starting Logical Block Address and check that it's
2118 + * not too big */
2119 + if (fsg->cmnd[0] == READ_6)
2120 + lba = get_unaligned_be24(&fsg->cmnd[1]);
2121 + else {
2122 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2123 +
2124 + /* We allow DPO (Disable Page Out = don't save data in the
2125 + * cache) and FUA (Force Unit Access = don't read from the
2126 + * cache), but we don't implement them. */
2127 + if ((fsg->cmnd[1] & ~0x18) != 0) {
2128 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2129 + return -EINVAL;
2130 + }
2131 + }
2132 + if (lba >= curlun->num_sectors) {
2133 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2134 + return -EINVAL;
2135 + }
2136 + file_offset = ((loff_t) lba) << curlun->blkbits;
2137 +
2138 + /* Carry out the file reads */
2139 + amount_left = fsg->data_size_from_cmnd;
2140 + if (unlikely(amount_left == 0))
2141 + return -EIO; // No default reply
2142 +
2143 + for (;;) {
2144 +
2145 + /* Figure out how much we need to read:
2146 + * Try to read the remaining amount.
2147 + * But don't read more than the buffer size.
2148 + * And don't try to read past the end of the file.
2149 + */
2150 + amount = min((unsigned int) amount_left, mod_data.buflen);
2151 + amount = min((loff_t) amount,
2152 + curlun->file_length - file_offset);
2153 +
2154 + /* Wait for the next buffer to become available */
2155 + bh = fsg->next_buffhd_to_fill;
2156 + while (bh->state != BUF_STATE_EMPTY) {
2157 + rc = sleep_thread(fsg);
2158 + if (rc)
2159 + return rc;
2160 + }
2161 +
2162 + /* If we were asked to read past the end of file,
2163 + * end with an empty buffer. */
2164 + if (amount == 0) {
2165 + curlun->sense_data =
2166 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2167 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2168 + curlun->info_valid = 1;
2169 + bh->inreq->length = 0;
2170 + bh->state = BUF_STATE_FULL;
2171 + break;
2172 + }
2173 +
2174 + /* Perform the read */
2175 + file_offset_tmp = file_offset;
2176 + nread = vfs_read(curlun->filp,
2177 + (char __user *) bh->buf,
2178 + amount, &file_offset_tmp);
2179 + VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2180 + (unsigned long long) file_offset,
2181 + (int) nread);
2182 + if (signal_pending(current))
2183 + return -EINTR;
2184 +
2185 + if (nread < 0) {
2186 + LDBG(curlun, "error in file read: %d\n",
2187 + (int) nread);
2188 + nread = 0;
2189 + } else if (nread < amount) {
2190 + LDBG(curlun, "partial file read: %d/%u\n",
2191 + (int) nread, amount);
2192 + nread = round_down(nread, curlun->blksize);
2193 + }
2194 + file_offset += nread;
2195 + amount_left -= nread;
2196 + fsg->residue -= nread;
2197 +
2198 + /* Except at the end of the transfer, nread will be
2199 + * equal to the buffer size, which is divisible by the
2200 + * bulk-in maxpacket size.
2201 + */
2202 + bh->inreq->length = nread;
2203 + bh->state = BUF_STATE_FULL;
2204 +
2205 + /* If an error occurred, report it and its position */
2206 + if (nread < amount) {
2207 + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2208 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2209 + curlun->info_valid = 1;
2210 + break;
2211 + }
2212 +
2213 + if (amount_left == 0)
2214 + break; // No more left to read
2215 +
2216 + /* Send this buffer and go read some more */
2217 + bh->inreq->zero = 0;
2218 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
2219 + &bh->inreq_busy, &bh->state);
2220 + fsg->next_buffhd_to_fill = bh->next;
2221 + }
2222 +
2223 + return -EIO; // No default reply
2224 +}
2225 +
2226 +
2227 +/*-------------------------------------------------------------------------*/
2228 +
2229 +static int do_write(struct fsg_dev *fsg)
2230 +{
2231 + struct fsg_lun *curlun = fsg->curlun;
2232 + u32 lba;
2233 + struct fsg_buffhd *bh;
2234 + int get_some_more;
2235 + u32 amount_left_to_req, amount_left_to_write;
2236 + loff_t usb_offset, file_offset, file_offset_tmp;
2237 + unsigned int amount;
2238 + ssize_t nwritten;
2239 + int rc;
2240 +
2241 + if (curlun->ro) {
2242 + curlun->sense_data = SS_WRITE_PROTECTED;
2243 + return -EINVAL;
2244 + }
2245 + spin_lock(&curlun->filp->f_lock);
2246 + curlun->filp->f_flags &= ~O_SYNC; // Default is not to wait
2247 + spin_unlock(&curlun->filp->f_lock);
2248 +
2249 + /* Get the starting Logical Block Address and check that it's
2250 + * not too big */
2251 + if (fsg->cmnd[0] == WRITE_6)
2252 + lba = get_unaligned_be24(&fsg->cmnd[1]);
2253 + else {
2254 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2255 +
2256 + /* We allow DPO (Disable Page Out = don't save data in the
2257 + * cache) and FUA (Force Unit Access = write directly to the
2258 + * medium). We don't implement DPO; we implement FUA by
2259 + * performing synchronous output. */
2260 + if ((fsg->cmnd[1] & ~0x18) != 0) {
2261 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2262 + return -EINVAL;
2263 + }
2264 + /* FUA */
2265 + if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
2266 + spin_lock(&curlun->filp->f_lock);
2267 + curlun->filp->f_flags |= O_DSYNC;
2268 + spin_unlock(&curlun->filp->f_lock);
2269 + }
2270 + }
2271 + if (lba >= curlun->num_sectors) {
2272 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2273 + return -EINVAL;
2274 + }
2275 +
2276 + /* Carry out the file writes */
2277 + get_some_more = 1;
2278 + file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
2279 + amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
2280 +
2281 + while (amount_left_to_write > 0) {
2282 +
2283 + /* Queue a request for more data from the host */
2284 + bh = fsg->next_buffhd_to_fill;
2285 + if (bh->state == BUF_STATE_EMPTY && get_some_more) {
2286 +
2287 + /* Figure out how much we want to get:
2288 + * Try to get the remaining amount,
2289 + * but not more than the buffer size.
2290 + */
2291 + amount = min(amount_left_to_req, mod_data.buflen);
2292 +
2293 + /* Beyond the end of the backing file? */
2294 + if (usb_offset >= curlun->file_length) {
2295 + get_some_more = 0;
2296 + curlun->sense_data =
2297 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2298 + curlun->sense_data_info = usb_offset >> curlun->blkbits;
2299 + curlun->info_valid = 1;
2300 + continue;
2301 + }
2302 +
2303 + /* Get the next buffer */
2304 + usb_offset += amount;
2305 + fsg->usb_amount_left -= amount;
2306 + amount_left_to_req -= amount;
2307 + if (amount_left_to_req == 0)
2308 + get_some_more = 0;
2309 +
2310 + /* Except at the end of the transfer, amount will be
2311 + * equal to the buffer size, which is divisible by
2312 + * the bulk-out maxpacket size.
2313 + */
2314 + set_bulk_out_req_length(fsg, bh, amount);
2315 + start_transfer(fsg, fsg->bulk_out, bh->outreq,
2316 + &bh->outreq_busy, &bh->state);
2317 + fsg->next_buffhd_to_fill = bh->next;
2318 + continue;
2319 + }
2320 +
2321 + /* Write the received data to the backing file */
2322 + bh = fsg->next_buffhd_to_drain;
2323 + if (bh->state == BUF_STATE_EMPTY && !get_some_more)
2324 + break; // We stopped early
2325 + if (bh->state == BUF_STATE_FULL) {
2326 + smp_rmb();
2327 + fsg->next_buffhd_to_drain = bh->next;
2328 + bh->state = BUF_STATE_EMPTY;
2329 +
2330 + /* Did something go wrong with the transfer? */
2331 + if (bh->outreq->status != 0) {
2332 + curlun->sense_data = SS_COMMUNICATION_FAILURE;
2333 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2334 + curlun->info_valid = 1;
2335 + break;
2336 + }
2337 +
2338 + amount = bh->outreq->actual;
2339 + if (curlun->file_length - file_offset < amount) {
2340 + LERROR(curlun,
2341 + "write %u @ %llu beyond end %llu\n",
2342 + amount, (unsigned long long) file_offset,
2343 + (unsigned long long) curlun->file_length);
2344 + amount = curlun->file_length - file_offset;
2345 + }
2346 +
2347 + /* Don't accept excess data. The spec doesn't say
2348 + * what to do in this case. We'll ignore the error.
2349 + */
2350 + amount = min(amount, bh->bulk_out_intended_length);
2351 +
2352 + /* Don't write a partial block */
2353 + amount = round_down(amount, curlun->blksize);
2354 + if (amount == 0)
2355 + goto empty_write;
2356 +
2357 + /* Perform the write */
2358 + file_offset_tmp = file_offset;
2359 + nwritten = vfs_write(curlun->filp,
2360 + (char __user *) bh->buf,
2361 + amount, &file_offset_tmp);
2362 + VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
2363 + (unsigned long long) file_offset,
2364 + (int) nwritten);
2365 + if (signal_pending(current))
2366 + return -EINTR; // Interrupted!
2367 +
2368 + if (nwritten < 0) {
2369 + LDBG(curlun, "error in file write: %d\n",
2370 + (int) nwritten);
2371 + nwritten = 0;
2372 + } else if (nwritten < amount) {
2373 + LDBG(curlun, "partial file write: %d/%u\n",
2374 + (int) nwritten, amount);
2375 + nwritten = round_down(nwritten, curlun->blksize);
2376 + }
2377 + file_offset += nwritten;
2378 + amount_left_to_write -= nwritten;
2379 + fsg->residue -= nwritten;
2380 +
2381 + /* If an error occurred, report it and its position */
2382 + if (nwritten < amount) {
2383 + curlun->sense_data = SS_WRITE_ERROR;
2384 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2385 + curlun->info_valid = 1;
2386 + break;
2387 + }
2388 +
2389 + empty_write:
2390 + /* Did the host decide to stop early? */
2391 + if (bh->outreq->actual < bh->bulk_out_intended_length) {
2392 + fsg->short_packet_received = 1;
2393 + break;
2394 + }
2395 + continue;
2396 + }
2397 +
2398 + /* Wait for something to happen */
2399 + rc = sleep_thread(fsg);
2400 + if (rc)
2401 + return rc;
2402 + }
2403 +
2404 + return -EIO; // No default reply
2405 +}
2406 +
2407 +
2408 +/*-------------------------------------------------------------------------*/
2409 +
2410 +static int do_synchronize_cache(struct fsg_dev *fsg)
2411 +{
2412 + struct fsg_lun *curlun = fsg->curlun;
2413 + int rc;
2414 +
2415 + /* We ignore the requested LBA and write out all file's
2416 + * dirty data buffers. */
2417 + rc = fsg_lun_fsync_sub(curlun);
2418 + if (rc)
2419 + curlun->sense_data = SS_WRITE_ERROR;
2420 + return 0;
2421 +}
2422 +
2423 +
2424 +/*-------------------------------------------------------------------------*/
2425 +
2426 +static void invalidate_sub(struct fsg_lun *curlun)
2427 +{
2428 + struct file *filp = curlun->filp;
2429 + struct inode *inode = filp->f_path.dentry->d_inode;
2430 + unsigned long rc;
2431 +
2432 + rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
2433 + VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
2434 +}
2435 +
2436 +static int do_verify(struct fsg_dev *fsg)
2437 +{
2438 + struct fsg_lun *curlun = fsg->curlun;
2439 + u32 lba;
2440 + u32 verification_length;
2441 + struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
2442 + loff_t file_offset, file_offset_tmp;
2443 + u32 amount_left;
2444 + unsigned int amount;
2445 + ssize_t nread;
2446 +
2447 + /* Get the starting Logical Block Address and check that it's
2448 + * not too big */
2449 + lba = get_unaligned_be32(&fsg->cmnd[2]);
2450 + if (lba >= curlun->num_sectors) {
2451 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2452 + return -EINVAL;
2453 + }
2454 +
2455 + /* We allow DPO (Disable Page Out = don't save data in the
2456 + * cache) but we don't implement it. */
2457 + if ((fsg->cmnd[1] & ~0x10) != 0) {
2458 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2459 + return -EINVAL;
2460 + }
2461 +
2462 + verification_length = get_unaligned_be16(&fsg->cmnd[7]);
2463 + if (unlikely(verification_length == 0))
2464 + return -EIO; // No default reply
2465 +
2466 + /* Prepare to carry out the file verify */
2467 + amount_left = verification_length << curlun->blkbits;
2468 + file_offset = ((loff_t) lba) << curlun->blkbits;
2469 +
2470 + /* Write out all the dirty buffers before invalidating them */
2471 + fsg_lun_fsync_sub(curlun);
2472 + if (signal_pending(current))
2473 + return -EINTR;
2474 +
2475 + invalidate_sub(curlun);
2476 + if (signal_pending(current))
2477 + return -EINTR;
2478 +
2479 + /* Just try to read the requested blocks */
2480 + while (amount_left > 0) {
2481 +
2482 + /* Figure out how much we need to read:
2483 + * Try to read the remaining amount, but not more than
2484 + * the buffer size.
2485 + * And don't try to read past the end of the file.
2486 + */
2487 + amount = min((unsigned int) amount_left, mod_data.buflen);
2488 + amount = min((loff_t) amount,
2489 + curlun->file_length - file_offset);
2490 + if (amount == 0) {
2491 + curlun->sense_data =
2492 + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2493 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2494 + curlun->info_valid = 1;
2495 + break;
2496 + }
2497 +
2498 + /* Perform the read */
2499 + file_offset_tmp = file_offset;
2500 + nread = vfs_read(curlun->filp,
2501 + (char __user *) bh->buf,
2502 + amount, &file_offset_tmp);
2503 + VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2504 + (unsigned long long) file_offset,
2505 + (int) nread);
2506 + if (signal_pending(current))
2507 + return -EINTR;
2508 +
2509 + if (nread < 0) {
2510 + LDBG(curlun, "error in file verify: %d\n",
2511 + (int) nread);
2512 + nread = 0;
2513 + } else if (nread < amount) {
2514 + LDBG(curlun, "partial file verify: %d/%u\n",
2515 + (int) nread, amount);
2516 + nread = round_down(nread, curlun->blksize);
2517 + }
2518 + if (nread == 0) {
2519 + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2520 + curlun->sense_data_info = file_offset >> curlun->blkbits;
2521 + curlun->info_valid = 1;
2522 + break;
2523 + }
2524 + file_offset += nread;
2525 + amount_left -= nread;
2526 + }
2527 + return 0;
2528 +}
2529 +
2530 +
2531 +/*-------------------------------------------------------------------------*/
2532 +
2533 +static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2534 +{
2535 + u8 *buf = (u8 *) bh->buf;
2536 +
2537 + static char vendor_id[] = "Linux ";
2538 + static char product_disk_id[] = "File-Stor Gadget";
2539 + static char product_cdrom_id[] = "File-CD Gadget ";
2540 +
2541 + if (!fsg->curlun) { // Unsupported LUNs are okay
2542 + fsg->bad_lun_okay = 1;
2543 + memset(buf, 0, 36);
2544 + buf[0] = 0x7f; // Unsupported, no device-type
2545 + buf[4] = 31; // Additional length
2546 + return 36;
2547 + }
2548 +
2549 + memset(buf, 0, 8);
2550 + buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
2551 + if (mod_data.removable)
2552 + buf[1] = 0x80;
2553 + buf[2] = 2; // ANSI SCSI level 2
2554 + buf[3] = 2; // SCSI-2 INQUIRY data format
2555 + buf[4] = 31; // Additional length
2556 + // No special options
2557 + sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
2558 + (mod_data.cdrom ? product_cdrom_id :
2559 + product_disk_id),
2560 + mod_data.release);
2561 + return 36;
2562 +}
2563 +
2564 +
2565 +static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2566 +{
2567 + struct fsg_lun *curlun = fsg->curlun;
2568 + u8 *buf = (u8 *) bh->buf;
2569 + u32 sd, sdinfo;
2570 + int valid;
2571 +
2572 + /*
2573 + * From the SCSI-2 spec., section 7.9 (Unit attention condition):
2574 + *
2575 + * If a REQUEST SENSE command is received from an initiator
2576 + * with a pending unit attention condition (before the target
2577 + * generates the contingent allegiance condition), then the
2578 + * target shall either:
2579 + * a) report any pending sense data and preserve the unit
2580 + * attention condition on the logical unit, or,
2581 + * b) report the unit attention condition, may discard any
2582 + * pending sense data, and clear the unit attention
2583 + * condition on the logical unit for that initiator.
2584 + *
2585 + * FSG normally uses option a); enable this code to use option b).
2586 + */
2587 +#if 0
2588 + if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
2589 + curlun->sense_data = curlun->unit_attention_data;
2590 + curlun->unit_attention_data = SS_NO_SENSE;
2591 + }
2592 +#endif
2593 +
2594 + if (!curlun) { // Unsupported LUNs are okay
2595 + fsg->bad_lun_okay = 1;
2596 + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2597 + sdinfo = 0;
2598 + valid = 0;
2599 + } else {
2600 + sd = curlun->sense_data;
2601 + sdinfo = curlun->sense_data_info;
2602 + valid = curlun->info_valid << 7;
2603 + curlun->sense_data = SS_NO_SENSE;
2604 + curlun->sense_data_info = 0;
2605 + curlun->info_valid = 0;
2606 + }
2607 +
2608 + memset(buf, 0, 18);
2609 + buf[0] = valid | 0x70; // Valid, current error
2610 + buf[2] = SK(sd);
2611 + put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
2612 + buf[7] = 18 - 8; // Additional sense length
2613 + buf[12] = ASC(sd);
2614 + buf[13] = ASCQ(sd);
2615 + return 18;
2616 +}
2617 +
2618 +
2619 +static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2620 +{
2621 + struct fsg_lun *curlun = fsg->curlun;
2622 + u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
2623 + int pmi = fsg->cmnd[8];
2624 + u8 *buf = (u8 *) bh->buf;
2625 +
2626 + /* Check the PMI and LBA fields */
2627 + if (pmi > 1 || (pmi == 0 && lba != 0)) {
2628 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2629 + return -EINVAL;
2630 + }
2631 +
2632 + put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
2633 + /* Max logical block */
2634 + put_unaligned_be32(curlun->blksize, &buf[4]); /* Block length */
2635 + return 8;
2636 +}
2637 +
2638 +
2639 +static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2640 +{
2641 + struct fsg_lun *curlun = fsg->curlun;
2642 + int msf = fsg->cmnd[1] & 0x02;
2643 + u32 lba = get_unaligned_be32(&fsg->cmnd[2]);
2644 + u8 *buf = (u8 *) bh->buf;
2645 +
2646 + if ((fsg->cmnd[1] & ~0x02) != 0) { /* Mask away MSF */
2647 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2648 + return -EINVAL;
2649 + }
2650 + if (lba >= curlun->num_sectors) {
2651 + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2652 + return -EINVAL;
2653 + }
2654 +
2655 + memset(buf, 0, 8);
2656 + buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
2657 + store_cdrom_address(&buf[4], msf, lba);
2658 + return 8;
2659 +}
2660 +
2661 +
2662 +static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2663 +{
2664 + struct fsg_lun *curlun = fsg->curlun;
2665 + int msf = fsg->cmnd[1] & 0x02;
2666 + int start_track = fsg->cmnd[6];
2667 + u8 *buf = (u8 *) bh->buf;
2668 +
2669 + if ((fsg->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
2670 + start_track > 1) {
2671 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2672 + return -EINVAL;
2673 + }
2674 +
2675 + memset(buf, 0, 20);
2676 + buf[1] = (20-2); /* TOC data length */
2677 + buf[2] = 1; /* First track number */
2678 + buf[3] = 1; /* Last track number */
2679 + buf[5] = 0x16; /* Data track, copying allowed */
2680 + buf[6] = 0x01; /* Only track is number 1 */
2681 + store_cdrom_address(&buf[8], msf, 0);
2682 +
2683 + buf[13] = 0x16; /* Lead-out track is data */
2684 + buf[14] = 0xAA; /* Lead-out track number */
2685 + store_cdrom_address(&buf[16], msf, curlun->num_sectors);
2686 + return 20;
2687 +}
2688 +
2689 +
2690 +static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2691 +{
2692 + struct fsg_lun *curlun = fsg->curlun;
2693 + int mscmnd = fsg->cmnd[0];
2694 + u8 *buf = (u8 *) bh->buf;
2695 + u8 *buf0 = buf;
2696 + int pc, page_code;
2697 + int changeable_values, all_pages;
2698 + int valid_page = 0;
2699 + int len, limit;
2700 +
2701 + if ((fsg->cmnd[1] & ~0x08) != 0) { // Mask away DBD
2702 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2703 + return -EINVAL;
2704 + }
2705 + pc = fsg->cmnd[2] >> 6;
2706 + page_code = fsg->cmnd[2] & 0x3f;
2707 + if (pc == 3) {
2708 + curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
2709 + return -EINVAL;
2710 + }
2711 + changeable_values = (pc == 1);
2712 + all_pages = (page_code == 0x3f);
2713 +
2714 + /* Write the mode parameter header. Fixed values are: default
2715 + * medium type, no cache control (DPOFUA), and no block descriptors.
2716 + * The only variable value is the WriteProtect bit. We will fill in
2717 + * the mode data length later. */
2718 + memset(buf, 0, 8);
2719 + if (mscmnd == MODE_SENSE) {
2720 + buf[2] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
2721 + buf += 4;
2722 + limit = 255;
2723 + } else { // MODE_SENSE_10
2724 + buf[3] = (curlun->ro ? 0x80 : 0x00); // WP, DPOFUA
2725 + buf += 8;
2726 + limit = 65535; // Should really be mod_data.buflen
2727 + }
2728 +
2729 + /* No block descriptors */
2730 +
2731 + /* The mode pages, in numerical order. The only page we support
2732 + * is the Caching page. */
2733 + if (page_code == 0x08 || all_pages) {
2734 + valid_page = 1;
2735 + buf[0] = 0x08; // Page code
2736 + buf[1] = 10; // Page length
2737 + memset(buf+2, 0, 10); // None of the fields are changeable
2738 +
2739 + if (!changeable_values) {
2740 + buf[2] = 0x04; // Write cache enable,
2741 + // Read cache not disabled
2742 + // No cache retention priorities
2743 + put_unaligned_be16(0xffff, &buf[4]);
2744 + /* Don't disable prefetch */
2745 + /* Minimum prefetch = 0 */
2746 + put_unaligned_be16(0xffff, &buf[8]);
2747 + /* Maximum prefetch */
2748 + put_unaligned_be16(0xffff, &buf[10]);
2749 + /* Maximum prefetch ceiling */
2750 + }
2751 + buf += 12;
2752 + }
2753 +
2754 + /* Check that a valid page was requested and the mode data length
2755 + * isn't too long. */
2756 + len = buf - buf0;
2757 + if (!valid_page || len > limit) {
2758 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2759 + return -EINVAL;
2760 + }
2761 +
2762 + /* Store the mode data length */
2763 + if (mscmnd == MODE_SENSE)
2764 + buf0[0] = len - 1;
2765 + else
2766 + put_unaligned_be16(len - 2, buf0);
2767 + return len;
2768 +}
2769 +
2770 +
2771 +static int do_start_stop(struct fsg_dev *fsg)
2772 +{
2773 + struct fsg_lun *curlun = fsg->curlun;
2774 + int loej, start;
2775 +
2776 + if (!mod_data.removable) {
2777 + curlun->sense_data = SS_INVALID_COMMAND;
2778 + return -EINVAL;
2779 + }
2780 +
2781 + // int immed = fsg->cmnd[1] & 0x01;
2782 + loej = fsg->cmnd[4] & 0x02;
2783 + start = fsg->cmnd[4] & 0x01;
2784 +
2785 +#ifdef CONFIG_USB_FILE_STORAGE_TEST
2786 + if ((fsg->cmnd[1] & ~0x01) != 0 || // Mask away Immed
2787 + (fsg->cmnd[4] & ~0x03) != 0) { // Mask LoEj, Start
2788 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2789 + return -EINVAL;
2790 + }
2791 +
2792 + if (!start) {
2793 +
2794 + /* Are we allowed to unload the media? */
2795 + if (curlun->prevent_medium_removal) {
2796 + LDBG(curlun, "unload attempt prevented\n");
2797 + curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
2798 + return -EINVAL;
2799 + }
2800 + if (loej) { // Simulate an unload/eject
2801 + up_read(&fsg->filesem);
2802 + down_write(&fsg->filesem);
2803 + fsg_lun_close(curlun);
2804 + up_write(&fsg->filesem);
2805 + down_read(&fsg->filesem);
2806 + }
2807 + } else {
2808 +
2809 + /* Our emulation doesn't support mounting; the medium is
2810 + * available for use as soon as it is loaded. */
2811 + if (!fsg_lun_is_open(curlun)) {
2812 + curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2813 + return -EINVAL;
2814 + }
2815 + }
2816 +#endif
2817 + return 0;
2818 +}
2819 +
2820 +
2821 +static int do_prevent_allow(struct fsg_dev *fsg)
2822 +{
2823 + struct fsg_lun *curlun = fsg->curlun;
2824 + int prevent;
2825 +
2826 + if (!mod_data.removable) {
2827 + curlun->sense_data = SS_INVALID_COMMAND;
2828 + return -EINVAL;
2829 + }
2830 +
2831 + prevent = fsg->cmnd[4] & 0x01;
2832 + if ((fsg->cmnd[4] & ~0x01) != 0) { // Mask away Prevent
2833 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2834 + return -EINVAL;
2835 + }
2836 +
2837 + if (curlun->prevent_medium_removal && !prevent)
2838 + fsg_lun_fsync_sub(curlun);
2839 + curlun->prevent_medium_removal = prevent;
2840 + return 0;
2841 +}
2842 +
2843 +
2844 +static int do_read_format_capacities(struct fsg_dev *fsg,
2845 + struct fsg_buffhd *bh)
2846 +{
2847 + struct fsg_lun *curlun = fsg->curlun;
2848 + u8 *buf = (u8 *) bh->buf;
2849 +
2850 + buf[0] = buf[1] = buf[2] = 0;
2851 + buf[3] = 8; // Only the Current/Maximum Capacity Descriptor
2852 + buf += 4;
2853 +
2854 + put_unaligned_be32(curlun->num_sectors, &buf[0]);
2855 + /* Number of blocks */
2856 + put_unaligned_be32(curlun->blksize, &buf[4]); /* Block length */
2857 + buf[4] = 0x02; /* Current capacity */
2858 + return 12;
2859 +}
2860 +
2861 +
2862 +static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2863 +{
2864 + struct fsg_lun *curlun = fsg->curlun;
2865 +
2866 + /* We don't support MODE SELECT */
2867 + curlun->sense_data = SS_INVALID_COMMAND;
2868 + return -EINVAL;
2869 +}
2870 +
2871 +
2872 +/*-------------------------------------------------------------------------*/
2873 +
2874 +static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
2875 +{
2876 + int rc;
2877 +
2878 + rc = fsg_set_halt(fsg, fsg->bulk_in);
2879 + if (rc == -EAGAIN)
2880 + VDBG(fsg, "delayed bulk-in endpoint halt\n");
2881 + while (rc != 0) {
2882 + if (rc != -EAGAIN) {
2883 + WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
2884 + rc = 0;
2885 + break;
2886 + }
2887 +
2888 + /* Wait for a short time and then try again */
2889 + if (msleep_interruptible(100) != 0)
2890 + return -EINTR;
2891 + rc = usb_ep_set_halt(fsg->bulk_in);
2892 + }
2893 + return rc;
2894 +}
2895 +
2896 +static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
2897 +{
2898 + int rc;
2899 +
2900 + DBG(fsg, "bulk-in set wedge\n");
2901 + rc = usb_ep_set_wedge(fsg->bulk_in);
2902 + if (rc == -EAGAIN)
2903 + VDBG(fsg, "delayed bulk-in endpoint wedge\n");
2904 + while (rc != 0) {
2905 + if (rc != -EAGAIN) {
2906 + WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
2907 + rc = 0;
2908 + break;
2909 + }
2910 +
2911 + /* Wait for a short time and then try again */
2912 + if (msleep_interruptible(100) != 0)
2913 + return -EINTR;
2914 + rc = usb_ep_set_wedge(fsg->bulk_in);
2915 + }
2916 + return rc;
2917 +}
2918 +
2919 +static int throw_away_data(struct fsg_dev *fsg)
2920 +{
2921 + struct fsg_buffhd *bh;
2922 + u32 amount;
2923 + int rc;
2924 +
2925 + while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
2926 + fsg->usb_amount_left > 0) {
2927 +
2928 + /* Throw away the data in a filled buffer */
2929 + if (bh->state == BUF_STATE_FULL) {
2930 + smp_rmb();
2931 + bh->state = BUF_STATE_EMPTY;
2932 + fsg->next_buffhd_to_drain = bh->next;
2933 +
2934 + /* A short packet or an error ends everything */
2935 + if (bh->outreq->actual < bh->bulk_out_intended_length ||
2936 + bh->outreq->status != 0) {
2937 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2938 + return -EINTR;
2939 + }
2940 + continue;
2941 + }
2942 +
2943 + /* Try to submit another request if we need one */
2944 + bh = fsg->next_buffhd_to_fill;
2945 + if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
2946 + amount = min(fsg->usb_amount_left,
2947 + (u32) mod_data.buflen);
2948 +
2949 + /* Except at the end of the transfer, amount will be
2950 + * equal to the buffer size, which is divisible by
2951 + * the bulk-out maxpacket size.
2952 + */
2953 + set_bulk_out_req_length(fsg, bh, amount);
2954 + start_transfer(fsg, fsg->bulk_out, bh->outreq,
2955 + &bh->outreq_busy, &bh->state);
2956 + fsg->next_buffhd_to_fill = bh->next;
2957 + fsg->usb_amount_left -= amount;
2958 + continue;
2959 + }
2960 +
2961 + /* Otherwise wait for something to happen */
2962 + rc = sleep_thread(fsg);
2963 + if (rc)
2964 + return rc;
2965 + }
2966 + return 0;
2967 +}
2968 +
2969 +
2970 +static int finish_reply(struct fsg_dev *fsg)
2971 +{
2972 + struct fsg_buffhd *bh = fsg->next_buffhd_to_fill;
2973 + int rc = 0;
2974 +
2975 + switch (fsg->data_dir) {
2976 + case DATA_DIR_NONE:
2977 + break; // Nothing to send
2978 +
2979 + /* If we don't know whether the host wants to read or write,
2980 + * this must be CB or CBI with an unknown command. We mustn't
2981 + * try to send or receive any data. So stall both bulk pipes
2982 + * if we can and wait for a reset. */
2983 + case DATA_DIR_UNKNOWN:
2984 + if (mod_data.can_stall) {
2985 + fsg_set_halt(fsg, fsg->bulk_out);
2986 + rc = halt_bulk_in_endpoint(fsg);
2987 + }
2988 + break;
2989 +
2990 + /* All but the last buffer of data must have already been sent */
2991 + case DATA_DIR_TO_HOST:
2992 + if (fsg->data_size == 0)
2993 + ; // Nothing to send
2994 +
2995 + /* If there's no residue, simply send the last buffer */
2996 + else if (fsg->residue == 0) {
2997 + bh->inreq->zero = 0;
2998 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
2999 + &bh->inreq_busy, &bh->state);
3000 + fsg->next_buffhd_to_fill = bh->next;
3001 + }
3002 +
3003 + /* There is a residue. For CB and CBI, simply mark the end
3004 + * of the data with a short packet. However, if we are
3005 + * allowed to stall, there was no data at all (residue ==
3006 + * data_size), and the command failed (invalid LUN or
3007 + * sense data is set), then halt the bulk-in endpoint
3008 + * instead. */
3009 + else if (!transport_is_bbb()) {
3010 + if (mod_data.can_stall &&
3011 + fsg->residue == fsg->data_size &&
3012 + (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
3013 + bh->state = BUF_STATE_EMPTY;
3014 + rc = halt_bulk_in_endpoint(fsg);
3015 + } else {
3016 + bh->inreq->zero = 1;
3017 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3018 + &bh->inreq_busy, &bh->state);
3019 + fsg->next_buffhd_to_fill = bh->next;
3020 + }
3021 + }
3022 +
3023 + /*
3024 + * For Bulk-only, mark the end of the data with a short
3025 + * packet. If we are allowed to stall, halt the bulk-in
3026 + * endpoint. (Note: This violates the Bulk-Only Transport
3027 + * specification, which requires us to pad the data if we
3028 + * don't halt the endpoint. Presumably nobody will mind.)
3029 + */
3030 + else {
3031 + bh->inreq->zero = 1;
3032 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3033 + &bh->inreq_busy, &bh->state);
3034 + fsg->next_buffhd_to_fill = bh->next;
3035 + if (mod_data.can_stall)
3036 + rc = halt_bulk_in_endpoint(fsg);
3037 + }
3038 + break;
3039 +
3040 + /* We have processed all we want from the data the host has sent.
3041 + * There may still be outstanding bulk-out requests. */
3042 + case DATA_DIR_FROM_HOST:
3043 + if (fsg->residue == 0)
3044 + ; // Nothing to receive
3045 +
3046 + /* Did the host stop sending unexpectedly early? */
3047 + else if (fsg->short_packet_received) {
3048 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
3049 + rc = -EINTR;
3050 + }
3051 +
3052 + /* We haven't processed all the incoming data. Even though
3053 + * we may be allowed to stall, doing so would cause a race.
3054 + * The controller may already have ACK'ed all the remaining
3055 + * bulk-out packets, in which case the host wouldn't see a
3056 + * STALL. Not realizing the endpoint was halted, it wouldn't
3057 + * clear the halt -- leading to problems later on. */
3058 +#if 0
3059 + else if (mod_data.can_stall) {
3060 + fsg_set_halt(fsg, fsg->bulk_out);
3061 + raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
3062 + rc = -EINTR;
3063 + }
3064 +#endif
3065 +
3066 + /* We can't stall. Read in the excess data and throw it
3067 + * all away. */
3068 + else
3069 + rc = throw_away_data(fsg);
3070 + break;
3071 + }
3072 + return rc;
3073 +}
3074 +
3075 +
3076 +static int send_status(struct fsg_dev *fsg)
3077 +{
3078 + struct fsg_lun *curlun = fsg->curlun;
3079 + struct fsg_buffhd *bh;
3080 + int rc;
3081 + u8 status = US_BULK_STAT_OK;
3082 + u32 sd, sdinfo = 0;
3083 +
3084 + /* Wait for the next buffer to become available */
3085 + bh = fsg->next_buffhd_to_fill;
3086 + while (bh->state != BUF_STATE_EMPTY) {
3087 + rc = sleep_thread(fsg);
3088 + if (rc)
3089 + return rc;
3090 + }
3091 +
3092 + if (curlun) {
3093 + sd = curlun->sense_data;
3094 + sdinfo = curlun->sense_data_info;
3095 + } else if (fsg->bad_lun_okay)
3096 + sd = SS_NO_SENSE;
3097 + else
3098 + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
3099 +
3100 + if (fsg->phase_error) {
3101 + DBG(fsg, "sending phase-error status\n");
3102 + status = US_BULK_STAT_PHASE;
3103 + sd = SS_INVALID_COMMAND;
3104 + } else if (sd != SS_NO_SENSE) {
3105 + DBG(fsg, "sending command-failure status\n");
3106 + status = US_BULK_STAT_FAIL;
3107 + VDBG(fsg, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
3108 + " info x%x\n",
3109 + SK(sd), ASC(sd), ASCQ(sd), sdinfo);
3110 + }
3111 +
3112 + if (transport_is_bbb()) {
3113 + struct bulk_cs_wrap *csw = bh->buf;
3114 +
3115 + /* Store and send the Bulk-only CSW */
3116 + csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
3117 + csw->Tag = fsg->tag;
3118 + csw->Residue = cpu_to_le32(fsg->residue);
3119 + csw->Status = status;
3120 +
3121 + bh->inreq->length = US_BULK_CS_WRAP_LEN;
3122 + bh->inreq->zero = 0;
3123 + start_transfer(fsg, fsg->bulk_in, bh->inreq,
3124 + &bh->inreq_busy, &bh->state);
3125 +
3126 + } else if (mod_data.transport_type == USB_PR_CB) {
3127 +
3128 + /* Control-Bulk transport has no status phase! */
3129 + return 0;
3130 +
3131 + } else { // USB_PR_CBI
3132 + struct interrupt_data *buf = bh->buf;
3133 +
3134 + /* Store and send the Interrupt data. UFI sends the ASC
3135 + * and ASCQ bytes. Everything else sends a Type (which
3136 + * is always 0) and the status Value. */
3137 + if (mod_data.protocol_type == USB_SC_UFI) {
3138 + buf->bType = ASC(sd);
3139 + buf->bValue = ASCQ(sd);
3140 + } else {
3141 + buf->bType = 0;
3142 + buf->bValue = status;
3143 + }
3144 + fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
3145 +
3146 + fsg->intr_buffhd = bh; // Point to the right buffhd
3147 + fsg->intreq->buf = bh->inreq->buf;
3148 + fsg->intreq->context = bh;
3149 + start_transfer(fsg, fsg->intr_in, fsg->intreq,
3150 + &fsg->intreq_busy, &bh->state);
3151 + }
3152 +
3153 + fsg->next_buffhd_to_fill = bh->next;
3154 + return 0;
3155 +}
3156 +
3157 +
3158 +/*-------------------------------------------------------------------------*/
3159 +
3160 +/* Check whether the command is properly formed and whether its data size
3161 + * and direction agree with the values we already have. */
3162 +static int check_command(struct fsg_dev *fsg, int cmnd_size,
3163 + enum data_direction data_dir, unsigned int mask,
3164 + int needs_medium, const char *name)
3165 +{
3166 + int i;
3167 + int lun = fsg->cmnd[1] >> 5;
3168 + static const char dirletter[4] = {'u', 'o', 'i', 'n'};
3169 + char hdlen[20];
3170 + struct fsg_lun *curlun;
3171 +
3172 + /* Adjust the expected cmnd_size for protocol encapsulation padding.
3173 + * Transparent SCSI doesn't pad. */
3174 + if (protocol_is_scsi())
3175 + ;
3176 +
3177 + /* There's some disagreement as to whether RBC pads commands or not.
3178 + * We'll play it safe and accept either form. */
3179 + else if (mod_data.protocol_type == USB_SC_RBC) {
3180 + if (fsg->cmnd_size == 12)
3181 + cmnd_size = 12;
3182 +
3183 + /* All the other protocols pad to 12 bytes */
3184 + } else
3185 + cmnd_size = 12;
3186 +
3187 + hdlen[0] = 0;
3188 + if (fsg->data_dir != DATA_DIR_UNKNOWN)
3189 + sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
3190 + fsg->data_size);
3191 + VDBG(fsg, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
3192 + name, cmnd_size, dirletter[(int) data_dir],
3193 + fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
3194 +
3195 + /* We can't reply at all until we know the correct data direction
3196 + * and size. */
3197 + if (fsg->data_size_from_cmnd == 0)
3198 + data_dir = DATA_DIR_NONE;
3199 + if (fsg->data_dir == DATA_DIR_UNKNOWN) { // CB or CBI
3200 + fsg->data_dir = data_dir;
3201 + fsg->data_size = fsg->data_size_from_cmnd;
3202 +
3203 + } else { // Bulk-only
3204 + if (fsg->data_size < fsg->data_size_from_cmnd) {
3205 +
3206 + /* Host data size < Device data size is a phase error.
3207 + * Carry out the command, but only transfer as much
3208 + * as we are allowed. */
3209 + fsg->data_size_from_cmnd = fsg->data_size;
3210 + fsg->phase_error = 1;
3211 + }
3212 + }
3213 + fsg->residue = fsg->usb_amount_left = fsg->data_size;
3214 +
3215 + /* Conflicting data directions is a phase error */
3216 + if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
3217 + fsg->phase_error = 1;
3218 + return -EINVAL;
3219 + }
3220 +
3221 + /* Verify the length of the command itself */
3222 + if (cmnd_size != fsg->cmnd_size) {
3223 +
3224 + /* Special case workaround: There are plenty of buggy SCSI
3225 + * implementations. Many have issues with cbw->Length
3226 + * field passing a wrong command size. For those cases we
3227 + * always try to work around the problem by using the length
3228 + * sent by the host side provided it is at least as large
3229 + * as the correct command length.
3230 + * Examples of such cases would be MS-Windows, which issues
3231 + * REQUEST SENSE with cbw->Length == 12 where it should
3232 + * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
3233 + * REQUEST SENSE with cbw->Length == 10 where it should
3234 + * be 6 as well.
3235 + */
3236 + if (cmnd_size <= fsg->cmnd_size) {
3237 + DBG(fsg, "%s is buggy! Expected length %d "
3238 + "but we got %d\n", name,
3239 + cmnd_size, fsg->cmnd_size);
3240 + cmnd_size = fsg->cmnd_size;
3241 + } else {
3242 + fsg->phase_error = 1;
3243 + return -EINVAL;
3244 + }
3245 + }
3246 +
3247 + /* Check that the LUN values are consistent */
3248 + if (transport_is_bbb()) {
3249 + if (fsg->lun != lun)
3250 + DBG(fsg, "using LUN %d from CBW, "
3251 + "not LUN %d from CDB\n",
3252 + fsg->lun, lun);
3253 + }
3254 +
3255 + /* Check the LUN */
3256 + curlun = fsg->curlun;
3257 + if (curlun) {
3258 + if (fsg->cmnd[0] != REQUEST_SENSE) {
3259 + curlun->sense_data = SS_NO_SENSE;
3260 + curlun->sense_data_info = 0;
3261 + curlun->info_valid = 0;
3262 + }
3263 + } else {
3264 + fsg->bad_lun_okay = 0;
3265 +
3266 + /* INQUIRY and REQUEST SENSE commands are explicitly allowed
3267 + * to use unsupported LUNs; all others may not. */
3268 + if (fsg->cmnd[0] != INQUIRY &&
3269 + fsg->cmnd[0] != REQUEST_SENSE) {
3270 + DBG(fsg, "unsupported LUN %d\n", fsg->lun);
3271 + return -EINVAL;
3272 + }
3273 + }
3274 +
3275 + /* If a unit attention condition exists, only INQUIRY and
3276 + * REQUEST SENSE commands are allowed; anything else must fail. */
3277 + if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
3278 + fsg->cmnd[0] != INQUIRY &&
3279 + fsg->cmnd[0] != REQUEST_SENSE) {
3280 + curlun->sense_data = curlun->unit_attention_data;
3281 + curlun->unit_attention_data = SS_NO_SENSE;
3282 + return -EINVAL;
3283 + }
3284 +
3285 + /* Check that only command bytes listed in the mask are non-zero */
3286 + fsg->cmnd[1] &= 0x1f; // Mask away the LUN
3287 + for (i = 1; i < cmnd_size; ++i) {
3288 + if (fsg->cmnd[i] && !(mask & (1 << i))) {
3289 + if (curlun)
3290 + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
3291 + return -EINVAL;
3292 + }
3293 + }
3294 +
3295 + /* If the medium isn't mounted and the command needs to access
3296 + * it, return an error. */
3297 + if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
3298 + curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
3299 + return -EINVAL;
3300 + }
3301 +
3302 + return 0;
3303 +}
3304 +
3305 +/* wrapper of check_command for data size in blocks handling */
3306 +static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
3307 + enum data_direction data_dir, unsigned int mask,
3308 + int needs_medium, const char *name)
3309 +{
3310 + if (fsg->curlun)
3311 + fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
3312 + return check_command(fsg, cmnd_size, data_dir,
3313 + mask, needs_medium, name);
3314 +}
3315 +
3316 +static int do_scsi_command(struct fsg_dev *fsg)
3317 +{
3318 + struct fsg_buffhd *bh;
3319 + int rc;
3320 + int reply = -EINVAL;
3321 + int i;
3322 + static char unknown[16];
3323 +
3324 + dump_cdb(fsg);
3325 +
3326 + /* Wait for the next buffer to become available for data or status */
3327 + bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
3328 + while (bh->state != BUF_STATE_EMPTY) {
3329 + rc = sleep_thread(fsg);
3330 + if (rc)
3331 + return rc;
3332 + }
3333 + fsg->phase_error = 0;
3334 + fsg->short_packet_received = 0;
3335 +
3336 + down_read(&fsg->filesem); // We're using the backing file
3337 + switch (fsg->cmnd[0]) {
3338 +
3339 + case INQUIRY:
3340 + fsg->data_size_from_cmnd = fsg->cmnd[4];
3341 + if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
3342 + (1<<4), 0,
3343 + "INQUIRY")) == 0)
3344 + reply = do_inquiry(fsg, bh);
3345 + break;
3346 +
3347 + case MODE_SELECT:
3348 + fsg->data_size_from_cmnd = fsg->cmnd[4];
3349 + if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
3350 + (1<<1) | (1<<4), 0,
3351 + "MODE SELECT(6)")) == 0)
3352 + reply = do_mode_select(fsg, bh);
3353 + break;
3354 +
3355 + case MODE_SELECT_10:
3356 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3357 + if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
3358 + (1<<1) | (3<<7), 0,
3359 + "MODE SELECT(10)")) == 0)
3360 + reply = do_mode_select(fsg, bh);
3361 + break;
3362 +
3363 + case MODE_SENSE:
3364 + fsg->data_size_from_cmnd = fsg->cmnd[4];
3365 + if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
3366 + (1<<1) | (1<<2) | (1<<4), 0,
3367 + "MODE SENSE(6)")) == 0)
3368 + reply = do_mode_sense(fsg, bh);
3369 + break;
3370 +
3371 + case MODE_SENSE_10:
3372 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3373 + if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3374 + (1<<1) | (1<<2) | (3<<7), 0,
3375 + "MODE SENSE(10)")) == 0)
3376 + reply = do_mode_sense(fsg, bh);
3377 + break;
3378 +
3379 + case ALLOW_MEDIUM_REMOVAL:
3380 + fsg->data_size_from_cmnd = 0;
3381 + if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
3382 + (1<<4), 0,
3383 + "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
3384 + reply = do_prevent_allow(fsg);
3385 + break;
3386 +
3387 + case READ_6:
3388 + i = fsg->cmnd[4];
3389 + fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
3390 + if ((reply = check_command_size_in_blocks(fsg, 6,
3391 + DATA_DIR_TO_HOST,
3392 + (7<<1) | (1<<4), 1,
3393 + "READ(6)")) == 0)
3394 + reply = do_read(fsg);
3395 + break;
3396 +
3397 + case READ_10:
3398 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3399 + if ((reply = check_command_size_in_blocks(fsg, 10,
3400 + DATA_DIR_TO_HOST,
3401 + (1<<1) | (0xf<<2) | (3<<7), 1,
3402 + "READ(10)")) == 0)
3403 + reply = do_read(fsg);
3404 + break;
3405 +
3406 + case READ_12:
3407 + fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
3408 + if ((reply = check_command_size_in_blocks(fsg, 12,
3409 + DATA_DIR_TO_HOST,
3410 + (1<<1) | (0xf<<2) | (0xf<<6), 1,
3411 + "READ(12)")) == 0)
3412 + reply = do_read(fsg);
3413 + break;
3414 +
3415 + case READ_CAPACITY:
3416 + fsg->data_size_from_cmnd = 8;
3417 + if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3418 + (0xf<<2) | (1<<8), 1,
3419 + "READ CAPACITY")) == 0)
3420 + reply = do_read_capacity(fsg, bh);
3421 + break;
3422 +
3423 + case READ_HEADER:
3424 + if (!mod_data.cdrom)
3425 + goto unknown_cmnd;
3426 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3427 + if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3428 + (3<<7) | (0x1f<<1), 1,
3429 + "READ HEADER")) == 0)
3430 + reply = do_read_header(fsg, bh);
3431 + break;
3432 +
3433 + case READ_TOC:
3434 + if (!mod_data.cdrom)
3435 + goto unknown_cmnd;
3436 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3437 + if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3438 + (7<<6) | (1<<1), 1,
3439 + "READ TOC")) == 0)
3440 + reply = do_read_toc(fsg, bh);
3441 + break;
3442 +
3443 + case READ_FORMAT_CAPACITIES:
3444 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3445 + if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3446 + (3<<7), 1,
3447 + "READ FORMAT CAPACITIES")) == 0)
3448 + reply = do_read_format_capacities(fsg, bh);
3449 + break;
3450 +
3451 + case REQUEST_SENSE:
3452 + fsg->data_size_from_cmnd = fsg->cmnd[4];
3453 + if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
3454 + (1<<4), 0,
3455 + "REQUEST SENSE")) == 0)
3456 + reply = do_request_sense(fsg, bh);
3457 + break;
3458 +
3459 + case START_STOP:
3460 + fsg->data_size_from_cmnd = 0;
3461 + if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
3462 + (1<<1) | (1<<4), 0,
3463 + "START-STOP UNIT")) == 0)
3464 + reply = do_start_stop(fsg);
3465 + break;
3466 +
3467 + case SYNCHRONIZE_CACHE:
3468 + fsg->data_size_from_cmnd = 0;
3469 + if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
3470 + (0xf<<2) | (3<<7), 1,
3471 + "SYNCHRONIZE CACHE")) == 0)
3472 + reply = do_synchronize_cache(fsg);
3473 + break;
3474 +
3475 + case TEST_UNIT_READY:
3476 + fsg->data_size_from_cmnd = 0;
3477 + reply = check_command(fsg, 6, DATA_DIR_NONE,
3478 + 0, 1,
3479 + "TEST UNIT READY");
3480 + break;
3481 +
3482 + /* Although optional, this command is used by MS-Windows. We
3483 + * support a minimal version: BytChk must be 0. */
3484 + case VERIFY:
3485 + fsg->data_size_from_cmnd = 0;
3486 + if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
3487 + (1<<1) | (0xf<<2) | (3<<7), 1,
3488 + "VERIFY")) == 0)
3489 + reply = do_verify(fsg);
3490 + break;
3491 +
3492 + case WRITE_6:
3493 + i = fsg->cmnd[4];
3494 + fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
3495 + if ((reply = check_command_size_in_blocks(fsg, 6,
3496 + DATA_DIR_FROM_HOST,
3497 + (7<<1) | (1<<4), 1,
3498 + "WRITE(6)")) == 0)
3499 + reply = do_write(fsg);
3500 + break;
3501 +
3502 + case WRITE_10:
3503 + fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
3504 + if ((reply = check_command_size_in_blocks(fsg, 10,
3505 + DATA_DIR_FROM_HOST,
3506 + (1<<1) | (0xf<<2) | (3<<7), 1,
3507 + "WRITE(10)")) == 0)
3508 + reply = do_write(fsg);
3509 + break;
3510 +
3511 + case WRITE_12:
3512 + fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
3513 + if ((reply = check_command_size_in_blocks(fsg, 12,
3514 + DATA_DIR_FROM_HOST,
3515 + (1<<1) | (0xf<<2) | (0xf<<6), 1,
3516 + "WRITE(12)")) == 0)
3517 + reply = do_write(fsg);
3518 + break;
3519 +
3520 + /* Some mandatory commands that we recognize but don't implement.
3521 + * They don't mean much in this setting. It's left as an exercise
3522 + * for anyone interested to implement RESERVE and RELEASE in terms
3523 + * of Posix locks. */
3524 + case FORMAT_UNIT:
3525 + case RELEASE:
3526 + case RESERVE:
3527 + case SEND_DIAGNOSTIC:
3528 + // Fall through
3529 +
3530 + default:
3531 + unknown_cmnd:
3532 + fsg->data_size_from_cmnd = 0;
3533 + sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
3534 + if ((reply = check_command(fsg, fsg->cmnd_size,
3535 + DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
3536 + fsg->curlun->sense_data = SS_INVALID_COMMAND;
3537 + reply = -EINVAL;
3538 + }
3539 + break;
3540 + }
3541 + up_read(&fsg->filesem);
3542 +
3543 + if (reply == -EINTR || signal_pending(current))
3544 + return -EINTR;
3545 +
3546 + /* Set up the single reply buffer for finish_reply() */
3547 + if (reply == -EINVAL)
3548 + reply = 0; // Error reply length
3549 + if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
3550 + reply = min((u32) reply, fsg->data_size_from_cmnd);
3551 + bh->inreq->length = reply;
3552 + bh->state = BUF_STATE_FULL;
3553 + fsg->residue -= reply;
3554 + } // Otherwise it's already set
3555 +
3556 + return 0;
3557 +}
3558 +
3559 +
3560 +/*-------------------------------------------------------------------------*/
3561 +
3562 +static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
3563 +{
3564 + struct usb_request *req = bh->outreq;
3565 + struct bulk_cb_wrap *cbw = req->buf;
3566 +
3567 + /* Was this a real packet? Should it be ignored? */
3568 + if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
3569 + return -EINVAL;
3570 +
3571 + /* Is the CBW valid? */
3572 + if (req->actual != US_BULK_CB_WRAP_LEN ||
3573 + cbw->Signature != cpu_to_le32(
3574 + US_BULK_CB_SIGN)) {
3575 + DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
3576 + req->actual,
3577 + le32_to_cpu(cbw->Signature));
3578 +
3579 + /* The Bulk-only spec says we MUST stall the IN endpoint
3580 + * (6.6.1), so it's unavoidable. It also says we must
3581 + * retain this state until the next reset, but there's
3582 + * no way to tell the controller driver it should ignore
3583 + * Clear-Feature(HALT) requests.
3584 + *
3585 + * We aren't required to halt the OUT endpoint; instead
3586 + * we can simply accept and discard any data received
3587 + * until the next reset. */
3588 + wedge_bulk_in_endpoint(fsg);
3589 + set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
3590 + return -EINVAL;
3591 + }
3592 +
3593 + /* Is the CBW meaningful? */
3594 + if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
3595 + cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
3596 + DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
3597 + "cmdlen %u\n",
3598 + cbw->Lun, cbw->Flags, cbw->Length);
3599 +
3600 + /* We can do anything we want here, so let's stall the
3601 + * bulk pipes if we are allowed to. */
3602 + if (mod_data.can_stall) {
3603 + fsg_set_halt(fsg, fsg->bulk_out);
3604 + halt_bulk_in_endpoint(fsg);
3605 + }
3606 + return -EINVAL;
3607 + }
3608 +
3609 + /* Save the command for later */
3610 + fsg->cmnd_size = cbw->Length;
3611 + memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
3612 + if (cbw->Flags & US_BULK_FLAG_IN)
3613 + fsg->data_dir = DATA_DIR_TO_HOST;
3614 + else
3615 + fsg->data_dir = DATA_DIR_FROM_HOST;
3616 + fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
3617 + if (fsg->data_size == 0)
3618 + fsg->data_dir = DATA_DIR_NONE;
3619 + fsg->lun = cbw->Lun;
3620 + fsg->tag = cbw->Tag;
3621 + return 0;
3622 +}
3623 +
3624 +
3625 +static int get_next_command(struct fsg_dev *fsg)
3626 +{
3627 + struct fsg_buffhd *bh;
3628 + int rc = 0;
3629 +
3630 + if (transport_is_bbb()) {
3631 +
3632 + /* Wait for the next buffer to become available */
3633 + bh = fsg->next_buffhd_to_fill;
3634 + while (bh->state != BUF_STATE_EMPTY) {
3635 + rc = sleep_thread(fsg);
3636 + if (rc)
3637 + return rc;
3638 + }
3639 +
3640 + /* Queue a request to read a Bulk-only CBW */
3641 + set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
3642 + start_transfer(fsg, fsg->bulk_out, bh->outreq,
3643 + &bh->outreq_busy, &bh->state);
3644 +
3645 + /* We will drain the buffer in software, which means we
3646 + * can reuse it for the next filling. No need to advance
3647 + * next_buffhd_to_fill. */
3648 +
3649 + /* Wait for the CBW to arrive */
3650 + while (bh->state != BUF_STATE_FULL) {
3651 + rc = sleep_thread(fsg);
3652 + if (rc)
3653 + return rc;
3654 + }
3655 + smp_rmb();
3656 + rc = received_cbw(fsg, bh);
3657 + bh->state = BUF_STATE_EMPTY;
3658 +
3659 + } else { // USB_PR_CB or USB_PR_CBI
3660 +
3661 + /* Wait for the next command to arrive */
3662 + while (fsg->cbbuf_cmnd_size == 0) {
3663 + rc = sleep_thread(fsg);
3664 + if (rc)
3665 + return rc;
3666 + }
3667 +
3668 + /* Is the previous status interrupt request still busy?
3669 + * The host is allowed to skip reading the status,
3670 + * so we must cancel it. */
3671 + if (fsg->intreq_busy)
3672 + usb_ep_dequeue(fsg->intr_in, fsg->intreq);
3673 +
3674 + /* Copy the command and mark the buffer empty */
3675 + fsg->data_dir = DATA_DIR_UNKNOWN;
3676 + spin_lock_irq(&fsg->lock);
3677 + fsg->cmnd_size = fsg->cbbuf_cmnd_size;
3678 + memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
3679 + fsg->cbbuf_cmnd_size = 0;
3680 + spin_unlock_irq(&fsg->lock);
3681 +
3682 + /* Use LUN from the command */
3683 + fsg->lun = fsg->cmnd[1] >> 5;
3684 + }
3685 +
3686 + /* Update current lun */
3687 + if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
3688 + fsg->curlun = &fsg->luns[fsg->lun];
3689 + else
3690 + fsg->curlun = NULL;
3691 +
3692 + return rc;
3693 +}
3694 +
3695 +
3696 +/*-------------------------------------------------------------------------*/
3697 +
3698 +static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
3699 + const struct usb_endpoint_descriptor *d)
3700 +{
3701 + int rc;
3702 +
3703 + ep->driver_data = fsg;
3704 + ep->desc = d;
3705 + rc = usb_ep_enable(ep);
3706 + if (rc)
3707 + ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
3708 + return rc;
3709 +}
3710 +
3711 +static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
3712 + struct usb_request **preq)
3713 +{
3714 + *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
3715 + if (*preq)
3716 + return 0;
3717 + ERROR(fsg, "can't allocate request for %s\n", ep->name);
3718 + return -ENOMEM;
3719 +}
3720 +
3721 +/*
3722 + * Reset interface setting and re-init endpoint state (toggle etc).
3723 + * Call with altsetting < 0 to disable the interface. The only other
3724 + * available altsetting is 0, which enables the interface.
3725 + */
3726 +static int do_set_interface(struct fsg_dev *fsg, int altsetting)
3727 +{
3728 + int rc = 0;
3729 + int i;
3730 + const struct usb_endpoint_descriptor *d;
3731 +
3732 + if (fsg->running)
3733 + DBG(fsg, "reset interface\n");
3734 +
3735 +reset:
3736 + /* Deallocate the requests */
3737 + for (i = 0; i < fsg_num_buffers; ++i) {
3738 + struct fsg_buffhd *bh = &fsg->buffhds[i];
3739 +
3740 + if (bh->inreq) {
3741 + usb_ep_free_request(fsg->bulk_in, bh->inreq);
3742 + bh->inreq = NULL;
3743 + }
3744 + if (bh->outreq) {
3745 + usb_ep_free_request(fsg->bulk_out, bh->outreq);
3746 + bh->outreq = NULL;
3747 + }
3748 + }
3749 + if (fsg->intreq) {
3750 + usb_ep_free_request(fsg->intr_in, fsg->intreq);
3751 + fsg->intreq = NULL;
3752 + }
3753 +
3754 + /* Disable the endpoints */
3755 + if (fsg->bulk_in_enabled) {
3756 + usb_ep_disable(fsg->bulk_in);
3757 + fsg->bulk_in_enabled = 0;
3758 + }
3759 + if (fsg->bulk_out_enabled) {
3760 + usb_ep_disable(fsg->bulk_out);
3761 + fsg->bulk_out_enabled = 0;
3762 + }
3763 + if (fsg->intr_in_enabled) {
3764 + usb_ep_disable(fsg->intr_in);
3765 + fsg->intr_in_enabled = 0;
3766 + }
3767 +
3768 + fsg->running = 0;
3769 + if (altsetting < 0 || rc != 0)
3770 + return rc;
3771 +
3772 + DBG(fsg, "set interface %d\n", altsetting);
3773 +
3774 + /* Enable the endpoints */
3775 + d = fsg_ep_desc(fsg->gadget,
3776 + &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
3777 + &fsg_ss_bulk_in_desc);
3778 + if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
3779 + goto reset;
3780 + fsg->bulk_in_enabled = 1;
3781 +
3782 + d = fsg_ep_desc(fsg->gadget,
3783 + &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
3784 + &fsg_ss_bulk_out_desc);
3785 + if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
3786 + goto reset;
3787 + fsg->bulk_out_enabled = 1;
3788 + fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
3789 + clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
3790 +
3791 + if (transport_is_cbi()) {
3792 + d = fsg_ep_desc(fsg->gadget,
3793 + &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
3794 + &fsg_ss_intr_in_desc);
3795 + if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
3796 + goto reset;
3797 + fsg->intr_in_enabled = 1;
3798 + }
3799 +
3800 + /* Allocate the requests */
3801 + for (i = 0; i < fsg_num_buffers; ++i) {
3802 + struct fsg_buffhd *bh = &fsg->buffhds[i];
3803 +
3804 + if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
3805 + goto reset;
3806 + if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
3807 + goto reset;
3808 + bh->inreq->buf = bh->outreq->buf = bh->buf;
3809 + bh->inreq->context = bh->outreq->context = bh;
3810 + bh->inreq->complete = bulk_in_complete;
3811 + bh->outreq->complete = bulk_out_complete;
3812 + }
3813 + if (transport_is_cbi()) {
3814 + if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
3815 + goto reset;
3816 + fsg->intreq->complete = intr_in_complete;
3817 + }
3818 +
3819 + fsg->running = 1;
3820 + for (i = 0; i < fsg->nluns; ++i)
3821 + fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3822 + return rc;
3823 +}
3824 +
3825 +
3826 +/*
3827 + * Change our operational configuration. This code must agree with the code
3828 + * that returns config descriptors, and with interface altsetting code.
3829 + *
3830 + * It's also responsible for power management interactions. Some
3831 + * configurations might not work with our current power sources.
3832 + * For now we just assume the gadget is always self-powered.
3833 + */
3834 +static int do_set_config(struct fsg_dev *fsg, u8 new_config)
3835 +{
3836 + int rc = 0;
3837 +
3838 + /* Disable the single interface */
3839 + if (fsg->config != 0) {
3840 + DBG(fsg, "reset config\n");
3841 + fsg->config = 0;
3842 + rc = do_set_interface(fsg, -1);
3843 + }
3844 +
3845 + /* Enable the interface */
3846 + if (new_config != 0) {
3847 + fsg->config = new_config;
3848 + if ((rc = do_set_interface(fsg, 0)) != 0)
3849 + fsg->config = 0; // Reset on errors
3850 + else
3851 + INFO(fsg, "%s config #%d\n",
3852 + usb_speed_string(fsg->gadget->speed),
3853 + fsg->config);
3854 + }
3855 + return rc;
3856 +}
3857 +
3858 +
3859 +/*-------------------------------------------------------------------------*/
3860 +
3861 +static void handle_exception(struct fsg_dev *fsg)
3862 +{
3863 + siginfo_t info;
3864 + int sig;
3865 + int i;
3866 + int num_active;
3867 + struct fsg_buffhd *bh;
3868 + enum fsg_state old_state;
3869 + u8 new_config;
3870 + struct fsg_lun *curlun;
3871 + unsigned int exception_req_tag;
3872 + int rc;
3873 +
3874 + /* Clear the existing signals. Anything but SIGUSR1 is converted
3875 + * into a high-priority EXIT exception. */
3876 + for (;;) {
3877 + sig = dequeue_signal_lock(current, &current->blocked, &info);
3878 + if (!sig)
3879 + break;
3880 + if (sig != SIGUSR1) {
3881 + if (fsg->state < FSG_STATE_EXIT)
3882 + DBG(fsg, "Main thread exiting on signal\n");
3883 + raise_exception(fsg, FSG_STATE_EXIT);
3884 + }
3885 + }
3886 +
3887 + /* Cancel all the pending transfers */
3888 + if (fsg->intreq_busy)
3889 + usb_ep_dequeue(fsg->intr_in, fsg->intreq);
3890 + for (i = 0; i < fsg_num_buffers; ++i) {
3891 + bh = &fsg->buffhds[i];
3892 + if (bh->inreq_busy)
3893 + usb_ep_dequeue(fsg->bulk_in, bh->inreq);
3894 + if (bh->outreq_busy)
3895 + usb_ep_dequeue(fsg->bulk_out, bh->outreq);
3896 + }
3897 +
3898 + /* Wait until everything is idle */
3899 + for (;;) {
3900 + num_active = fsg->intreq_busy;
3901 + for (i = 0; i < fsg_num_buffers; ++i) {
3902 + bh = &fsg->buffhds[i];
3903 + num_active += bh->inreq_busy + bh->outreq_busy;
3904 + }
3905 + if (num_active == 0)
3906 + break;
3907 + if (sleep_thread(fsg))
3908 + return;
3909 + }
3910 +
3911 + /* Clear out the controller's fifos */
3912 + if (fsg->bulk_in_enabled)
3913 + usb_ep_fifo_flush(fsg->bulk_in);
3914 + if (fsg->bulk_out_enabled)
3915 + usb_ep_fifo_flush(fsg->bulk_out);
3916 + if (fsg->intr_in_enabled)
3917 + usb_ep_fifo_flush(fsg->intr_in);
3918 +
3919 + /* Reset the I/O buffer states and pointers, the SCSI
3920 + * state, and the exception. Then invoke the handler. */
3921 + spin_lock_irq(&fsg->lock);
3922 +
3923 + for (i = 0; i < fsg_num_buffers; ++i) {
3924 + bh = &fsg->buffhds[i];
3925 + bh->state = BUF_STATE_EMPTY;
3926 + }
3927 + fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
3928 + &fsg->buffhds[0];
3929 +
3930 + exception_req_tag = fsg->exception_req_tag;
3931 + new_config = fsg->new_config;
3932 + old_state = fsg->state;
3933 +
3934 + if (old_state == FSG_STATE_ABORT_BULK_OUT)
3935 + fsg->state = FSG_STATE_STATUS_PHASE;
3936 + else {
3937 + for (i = 0; i < fsg->nluns; ++i) {
3938 + curlun = &fsg->luns[i];
3939 + curlun->prevent_medium_removal = 0;
3940 + curlun->sense_data = curlun->unit_attention_data =
3941 + SS_NO_SENSE;
3942 + curlun->sense_data_info = 0;
3943 + curlun->info_valid = 0;
3944 + }
3945 + fsg->state = FSG_STATE_IDLE;
3946 + }
3947 + spin_unlock_irq(&fsg->lock);
3948 +
3949 + /* Carry out any extra actions required for the exception */
3950 + switch (old_state) {
3951 + default:
3952 + break;
3953 +
3954 + case FSG_STATE_ABORT_BULK_OUT:
3955 + send_status(fsg);
3956 + spin_lock_irq(&fsg->lock);
3957 + if (fsg->state == FSG_STATE_STATUS_PHASE)
3958 + fsg->state = FSG_STATE_IDLE;
3959 + spin_unlock_irq(&fsg->lock);
3960 + break;
3961 +
3962 + case FSG_STATE_RESET:
3963 + /* In case we were forced against our will to halt a
3964 + * bulk endpoint, clear the halt now. (The SuperH UDC
3965 + * requires this.) */
3966 + if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
3967 + usb_ep_clear_halt(fsg->bulk_in);
3968 +
3969 + if (transport_is_bbb()) {
3970 + if (fsg->ep0_req_tag == exception_req_tag)
3971 + ep0_queue(fsg); // Complete the status stage
3972 +
3973 + } else if (transport_is_cbi())
3974 + send_status(fsg); // Status by interrupt pipe
3975 +
3976 + /* Technically this should go here, but it would only be
3977 + * a waste of time. Ditto for the INTERFACE_CHANGE and
3978 + * CONFIG_CHANGE cases. */
3979 + // for (i = 0; i < fsg->nluns; ++i)
3980 + // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3981 + break;
3982 +
3983 + case FSG_STATE_INTERFACE_CHANGE:
3984 + rc = do_set_interface(fsg, 0);
3985 + if (fsg->ep0_req_tag != exception_req_tag)
3986 + break;
3987 + if (rc != 0) // STALL on errors
3988 + fsg_set_halt(fsg, fsg->ep0);
3989 + else // Complete the status stage
3990 + ep0_queue(fsg);
3991 + break;
3992 +
3993 + case FSG_STATE_CONFIG_CHANGE:
3994 + rc = do_set_config(fsg, new_config);
3995 + if (fsg->ep0_req_tag != exception_req_tag)
3996 + break;
3997 + if (rc != 0) // STALL on errors
3998 + fsg_set_halt(fsg, fsg->ep0);
3999 + else // Complete the status stage
4000 + ep0_queue(fsg);
4001 + break;
4002 +
4003 + case FSG_STATE_DISCONNECT:
4004 + for (i = 0; i < fsg->nluns; ++i)
4005 + fsg_lun_fsync_sub(fsg->luns + i);
4006 + do_set_config(fsg, 0); // Unconfigured state
4007 + break;
4008 +
4009 + case FSG_STATE_EXIT:
4010 + case FSG_STATE_TERMINATED:
4011 + do_set_config(fsg, 0); // Free resources
4012 + spin_lock_irq(&fsg->lock);
4013 + fsg->state = FSG_STATE_TERMINATED; // Stop the thread
4014 + spin_unlock_irq(&fsg->lock);
4015 + break;
4016 + }
4017 +}
4018 +
4019 +
4020 +/*-------------------------------------------------------------------------*/
4021 +
4022 +static int fsg_main_thread(void *fsg_)
4023 +{
4024 + struct fsg_dev *fsg = fsg_;
4025 +
4026 + /* Allow the thread to be killed by a signal, but set the signal mask
4027 + * to block everything but INT, TERM, KILL, and USR1. */
4028 + allow_signal(SIGINT);
4029 + allow_signal(SIGTERM);
4030 + a