2 * file_storage.c -- File-backed USB Storage Gadget, for USB development
4 * Copyright (C) 2003-2008 Alan Stern
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions, and the following disclaimer,
12 * without modification.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. The names of the above-listed copyright holders may not be used
17 * to endorse or promote products derived from this software without
18 * specific prior written permission.
20 * ALTERNATIVELY, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") as published by the Free Software
22 * Foundation, either version 2 of that License or (at your option) any
25 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
26 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
27 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
29 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
30 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
31 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
32 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
34 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
35 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40 * The File-backed Storage Gadget acts as a USB Mass Storage device,
41 * appearing to the host as a disk drive or as a CD-ROM drive. In addition
42 * to providing an example of a genuinely useful gadget driver for a USB
43 * device, it also illustrates a technique of double-buffering for increased
44 * throughput. Last but not least, it gives an easy way to probe the
45 * behavior of the Mass Storage drivers in a USB host.
47 * Backing storage is provided by a regular file or a block device, specified
48 * by the "file" module parameter. Access can be limited to read-only by
49 * setting the optional "ro" module parameter. (For CD-ROM emulation,
50 * access is always read-only.) The gadget will indicate that it has
51 * removable media if the optional "removable" module parameter is set.
53 * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
54 * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
55 * by the optional "transport" module parameter. It also supports the
56 * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
57 * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
58 * the optional "protocol" module parameter. In addition, the default
59 * Vendor ID, Product ID, and release number can be overridden.
61 * There is support for multiple logical units (LUNs), each of which has
62 * its own backing file. The number of LUNs can be set using the optional
63 * "luns" module parameter (anywhere from 1 to 8), and the corresponding
64 * files are specified using comma-separated lists for "file" and "ro".
65 * The default number of LUNs is taken from the number of "file" elements;
66 * it is 1 if "file" is not given. If "removable" is not set then a backing
67 * file must be specified for each LUN. If it is set, then an unspecified
68 * or empty backing filename means the LUN's medium is not loaded. Ideally
69 * each LUN would be settable independently as a disk drive or a CD-ROM
70 * drive, but currently all LUNs have to be the same type. The CD-ROM
71 * emulation includes a single data track and no audio tracks; hence there
72 * need be only one backing file per LUN. Note also that the CD-ROM block
73 * length is set to 512 rather than the more common value 2048.
75 * Requirements are modest; only a bulk-in and a bulk-out endpoint are
76 * needed (an interrupt-out endpoint is also needed for CBI). The memory
77 * requirement amounts to two 16K buffers, size configurable by a parameter.
78 * Support is included for both full-speed and high-speed operation.
80 * Note that the driver is slightly non-portable in that it assumes a
81 * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
82 * interrupt-in endpoints. With most device controllers this isn't an
83 * issue, but there may be some with hardware restrictions that prevent
84 * a buffer from being used by more than one endpoint.
88 * file=filename[,filename...]
89 * Required if "removable" is not set, names of
90 * the files or block devices used for
92 * ro=b[,b...] Default false, booleans for read-only access
93 * removable Default false, boolean for removable media
94 * luns=N Default N = number of filenames, number of
96 * stall Default determined according to the type of
97 * USB device controller (usually true),
98 * boolean to permit the driver to halt
100 * cdrom Default false, boolean for whether to emulate
102 * transport=XXX Default BBB, transport name (CB, CBI, or BBB)
103 * protocol=YYY Default SCSI, protocol name (RBC, 8020 or
104 * ATAPI, QIC, UFI, 8070, or SCSI;
106 * vendor=0xVVVV Default 0x0525 (NetChip), USB Vendor ID
107 * product=0xPPPP Default 0xa4a5 (FSG), USB Product ID
108 * release=0xRRRR Override the USB release number (bcdDevice)
109 * buflen=N Default N=16384, buffer size used (will be
110 * rounded down to a multiple of
113 * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
114 * "removable", "luns", "stall", and "cdrom" options are available; default
115 * values are used for everything else.
117 * The pathnames of the backing files and the ro settings are available in
118 * the attribute files "file" and "ro" in the lun<n> subdirectory of the
119 * gadget's sysfs directory. If the "removable" option is set, writing to
120 * these files will simulate ejecting/loading the medium (writing an empty
121 * line means eject) and adjusting a write-enable tab. Changes to the ro
122 * setting are not allowed when the medium is loaded or if CD-ROM emulation
125 * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
126 * The driver's SCSI command interface was based on the "Information
127 * technology - Small Computer System Interface - 2" document from
128 * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
129 * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>. The single exception
130 * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
131 * "Universal Serial Bus Mass Storage Class UFI Command Specification"
132 * document, Revision 1.0, December 14, 1998, available at
133 * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
140 * The FSG driver is fairly straightforward. There is a main kernel
141 * thread that handles most of the work. Interrupt routines field
142 * callbacks from the controller driver: bulk- and interrupt-request
143 * completion notifications, endpoint-0 events, and disconnect events.
144 * Completion events are passed to the main thread by wakeup calls. Many
145 * ep0 requests are handled at interrupt time, but SetInterface,
146 * SetConfiguration, and device reset requests are forwarded to the
147 * thread in the form of "exceptions" using SIGUSR1 signals (since they
148 * should interrupt any ongoing file I/O operations).
150 * The thread's main routine implements the standard command/data/status
151 * parts of a SCSI interaction. It and its subroutines are full of tests
152 * for pending signals/exceptions -- all this polling is necessary since
153 * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
154 * indication that the driver really wants to be running in userspace.)
155 * An important point is that so long as the thread is alive it keeps an
156 * open reference to the backing file. This will prevent unmounting
157 * the backing file's underlying filesystem and could cause problems
158 * during system shutdown, for example. To prevent such problems, the
159 * thread catches INT, TERM, and KILL signals and converts them into
162 * In normal operation the main thread is started during the gadget's
163 * fsg_bind() callback and stopped during fsg_unbind(). But it can also
164 * exit when it receives a signal, and there's no point leaving the
165 * gadget running when the thread is dead. So just before the thread
166 * exits, it deregisters the gadget driver. This makes things a little
167 * tricky: The driver is deregistered at two places, and the exiting
168 * thread can indirectly call fsg_unbind() which in turn can tell the
169 * thread to exit. The first problem is resolved through the use of the
170 * REGISTERED atomic bitflag; the driver will only be deregistered once.
171 * The second problem is resolved by having fsg_unbind() check
172 * fsg->state; it won't try to stop the thread if the state is already
173 * FSG_STATE_TERMINATED.
175 * To provide maximum throughput, the driver uses a circular pipeline of
176 * buffer heads (struct fsg_buffhd). In principle the pipeline can be
177 * arbitrarily long; in practice the benefits don't justify having more
178 * than 2 stages (i.e., double buffering). But it helps to think of the
179 * pipeline as being a long one. Each buffer head contains a bulk-in and
180 * a bulk-out request pointer (since the buffer can be used for both
181 * output and input -- directions always are given from the host's
182 * point of view) as well as a pointer to the buffer and various state
185 * Use of the pipeline follows a simple protocol. There is a variable
186 * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
187 * At any time that buffer head may still be in use from an earlier
188 * request, so each buffer head has a state variable indicating whether
189 * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
190 * buffer head to be EMPTY, filling the buffer either by file I/O or by
191 * USB I/O (during which the buffer head is BUSY), and marking the buffer
192 * head FULL when the I/O is complete. Then the buffer will be emptied
193 * (again possibly by USB I/O, during which it is marked BUSY) and
194 * finally marked EMPTY again (possibly by a completion routine).
196 * A module parameter tells the driver to avoid stalling the bulk
197 * endpoints wherever the transport specification allows. This is
198 * necessary for some UDCs like the SuperH, which cannot reliably clear a
199 * halt on a bulk endpoint. However, under certain circumstances the
200 * Bulk-only specification requires a stall. In such cases the driver
201 * will halt the endpoint and set a flag indicating that it should clear
202 * the halt in software during the next device reset. Hopefully this
203 * will permit everything to work correctly. Furthermore, although the
204 * specification allows the bulk-out endpoint to halt when the host sends
205 * too much data, implementing this would cause an unavoidable race.
206 * The driver will always use the "no-stall" approach for OUT transfers.
208 * One subtle point concerns sending status-stage responses for ep0
209 * requests. Some of these requests, such as device reset, can involve
210 * interrupting an ongoing file I/O operation, which might take an
211 * arbitrarily long time. During that delay the host might give up on
212 * the original ep0 request and issue a new one. When that happens the
213 * driver should not notify the host about completion of the original
214 * request, as the host will no longer be waiting for it. So the driver
215 * assigns to each ep0 request a unique tag, and it keeps track of the
216 * tag value of the request associated with a long-running exception
217 * (device-reset, interface-change, or configuration-change). When the
218 * exception handler is finished, the status-stage response is submitted
219 * only if the current ep0 request tag is equal to the exception request
220 * tag. Thus only the most recently received ep0 request will get a
221 * status-stage response.
223 * Warning: This driver source file is too long. It ought to be split up
224 * into a header file plus about 3 separate .c files, to handle the details
225 * of the Gadget, USB Mass Storage, and SCSI protocols.
229 /* #define VERBOSE_DEBUG */
230 /* #define DUMP_MSGS */
233 #include <linux/blkdev.h>
234 #include <linux/completion.h>
235 #include <linux/dcache.h>
236 #include <linux/delay.h>
237 #include <linux/device.h>
238 #include <linux/fcntl.h>
239 #include <linux/file.h>
240 #include <linux/fs.h>
241 #include <linux/kref.h>
242 #include <linux/kthread.h>
243 #include <linux/limits.h>
244 #include <linux/rwsem.h>
245 #include <linux/slab.h>
246 #include <linux/spinlock.h>
247 #include <linux/string.h>
248 #include <linux/freezer.h>
249 #include <linux/utsname.h>
251 #include <linux/usb/ch9.h>
252 #include <linux/usb/gadget.h>
254 #include "gadget_chips.h"
259 * Kbuild is not very cooperative with respect to linking separately
260 * compiled library objects into one module. So for now we won't use
261 * separate compilation ... ensuring init/exit sections work to shrink
262 * the runtime footprint, and giving us at least some parts of what
263 * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
265 #include "usbstring.c"
267 #include "epautoconf.c"
269 /*-------------------------------------------------------------------------*/
271 #define DRIVER_DESC "File-backed Storage Gadget"
272 #define DRIVER_NAME "g_file_storage"
273 #define DRIVER_VERSION "20 November 2008"
275 static char fsg_string_manufacturer
[64];
276 static const char fsg_string_product
[] = DRIVER_DESC
;
277 static char fsg_string_serial
[13];
278 static const char fsg_string_config
[] = "Self-powered";
279 static const char fsg_string_interface
[] = "Mass Storage";
282 #include "storage_common.c"
285 MODULE_DESCRIPTION(DRIVER_DESC
);
286 MODULE_AUTHOR("Alan Stern");
287 MODULE_LICENSE("Dual BSD/GPL");
290 * This driver assumes self-powered hardware and has no way for users to
291 * trigger remote wakeup. It uses autoconfiguration to select endpoints
292 * and endpoint addresses.
296 /*-------------------------------------------------------------------------*/
299 /* Encapsulate the module parameter settings */
302 char *file
[FSG_MAX_LUNS
];
303 int ro
[FSG_MAX_LUNS
];
304 unsigned int num_filenames
;
305 unsigned int num_ros
;
312 char *transport_parm
;
314 unsigned short vendor
;
315 unsigned short product
;
316 unsigned short release
;
320 char *transport_name
;
324 } mod_data
= { // Default values
325 .transport_parm
= "BBB",
326 .protocol_parm
= "SCSI",
330 .vendor
= FSG_VENDOR_ID
,
331 .product
= FSG_PRODUCT_ID
,
332 .release
= 0xffff, // Use controller chip type
337 module_param_array_named(file
, mod_data
.file
, charp
, &mod_data
.num_filenames
,
339 MODULE_PARM_DESC(file
, "names of backing files or devices");
341 module_param_array_named(ro
, mod_data
.ro
, bool, &mod_data
.num_ros
, S_IRUGO
);
342 MODULE_PARM_DESC(ro
, "true to force read-only");
344 module_param_named(luns
, mod_data
.nluns
, uint
, S_IRUGO
);
345 MODULE_PARM_DESC(luns
, "number of LUNs");
347 module_param_named(removable
, mod_data
.removable
, bool, S_IRUGO
);
348 MODULE_PARM_DESC(removable
, "true to simulate removable media");
350 module_param_named(stall
, mod_data
.can_stall
, bool, S_IRUGO
);
351 MODULE_PARM_DESC(stall
, "false to prevent bulk stalls");
353 module_param_named(cdrom
, mod_data
.cdrom
, bool, S_IRUGO
);
354 MODULE_PARM_DESC(cdrom
, "true to emulate cdrom instead of disk");
357 /* In the non-TEST version, only the module parameters listed above
359 #ifdef CONFIG_USB_FILE_STORAGE_TEST
361 module_param_named(transport
, mod_data
.transport_parm
, charp
, S_IRUGO
);
362 MODULE_PARM_DESC(transport
, "type of transport (BBB, CBI, or CB)");
364 module_param_named(protocol
, mod_data
.protocol_parm
, charp
, S_IRUGO
);
365 MODULE_PARM_DESC(protocol
, "type of protocol (RBC, 8020, QIC, UFI, "
368 module_param_named(vendor
, mod_data
.vendor
, ushort
, S_IRUGO
);
369 MODULE_PARM_DESC(vendor
, "USB Vendor ID");
371 module_param_named(product
, mod_data
.product
, ushort
, S_IRUGO
);
372 MODULE_PARM_DESC(product
, "USB Product ID");
374 module_param_named(release
, mod_data
.release
, ushort
, S_IRUGO
);
375 MODULE_PARM_DESC(release
, "USB release number");
377 module_param_named(buflen
, mod_data
.buflen
, uint
, S_IRUGO
);
378 MODULE_PARM_DESC(buflen
, "I/O buffer size");
380 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
384 * These definitions will permit the compiler to avoid generating code for
385 * parts of the driver that aren't used in the non-TEST version. Even gcc
386 * can recognize when a test of a constant expression yields a dead code
390 #ifdef CONFIG_USB_FILE_STORAGE_TEST
392 #define transport_is_bbb() (mod_data.transport_type == USB_PR_BULK)
393 #define transport_is_cbi() (mod_data.transport_type == USB_PR_CBI)
394 #define protocol_is_scsi() (mod_data.protocol_type == USB_SC_SCSI)
398 #define transport_is_bbb() 1
399 #define transport_is_cbi() 0
400 #define protocol_is_scsi() 1
402 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
405 /*-------------------------------------------------------------------------*/
409 /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
411 struct usb_gadget
*gadget
;
413 /* filesem protects: backing files in use */
414 struct rw_semaphore filesem
;
416 /* reference counting: wait until all LUNs are released */
419 struct usb_ep
*ep0
; // Handy copy of gadget->ep0
420 struct usb_request
*ep0req
; // For control responses
421 unsigned int ep0_req_tag
;
422 const char *ep0req_name
;
424 struct usb_request
*intreq
; // For interrupt responses
426 struct fsg_buffhd
*intr_buffhd
;
428 unsigned int bulk_out_maxpacket
;
429 enum fsg_state state
; // For exception handling
430 unsigned int exception_req_tag
;
432 u8 config
, new_config
;
434 unsigned int running
: 1;
435 unsigned int bulk_in_enabled
: 1;
436 unsigned int bulk_out_enabled
: 1;
437 unsigned int intr_in_enabled
: 1;
438 unsigned int phase_error
: 1;
439 unsigned int short_packet_received
: 1;
440 unsigned int bad_lun_okay
: 1;
442 unsigned long atomic_bitflags
;
444 #define IGNORE_BULK_OUT 1
447 struct usb_ep
*bulk_in
;
448 struct usb_ep
*bulk_out
;
449 struct usb_ep
*intr_in
;
451 struct fsg_buffhd
*next_buffhd_to_fill
;
452 struct fsg_buffhd
*next_buffhd_to_drain
;
453 struct fsg_buffhd buffhds
[FSG_NUM_BUFFERS
];
455 int thread_wakeup_needed
;
456 struct completion thread_notifier
;
457 struct task_struct
*thread_task
;
460 u8 cmnd
[MAX_COMMAND_SIZE
];
461 enum data_direction data_dir
;
463 u32 data_size_from_cmnd
;
469 /* The CB protocol offers no way for a host to know when a command
470 * has completed. As a result the next command may arrive early,
471 * and we will still have to handle it. For that reason we need
472 * a buffer to store new commands when using CB (or CBI, which
473 * does not oblige a host to wait for command completion either). */
475 u8 cbbuf_cmnd
[MAX_COMMAND_SIZE
];
478 struct fsg_lun
*luns
;
479 struct fsg_lun
*curlun
;
482 typedef void (*fsg_routine_t
)(struct fsg_dev
*);
484 static int exception_in_progress(struct fsg_dev
*fsg
)
486 return (fsg
->state
> FSG_STATE_IDLE
);
489 /* Make bulk-out requests be divisible by the maxpacket size */
490 static void set_bulk_out_req_length(struct fsg_dev
*fsg
,
491 struct fsg_buffhd
*bh
, unsigned int length
)
495 bh
->bulk_out_intended_length
= length
;
496 rem
= length
% fsg
->bulk_out_maxpacket
;
498 length
+= fsg
->bulk_out_maxpacket
- rem
;
499 bh
->outreq
->length
= length
;
502 static struct fsg_dev
*the_fsg
;
503 static struct usb_gadget_driver fsg_driver
;
506 /*-------------------------------------------------------------------------*/
508 static int fsg_set_halt(struct fsg_dev
*fsg
, struct usb_ep
*ep
)
512 if (ep
== fsg
->bulk_in
)
514 else if (ep
== fsg
->bulk_out
)
518 DBG(fsg
, "%s set halt\n", name
);
519 return usb_ep_set_halt(ep
);
523 /*-------------------------------------------------------------------------*/
526 * DESCRIPTORS ... most are static, but strings and (full) configuration
527 * descriptors are built on demand. Also the (static) config and interface
528 * descriptors are adjusted during fsg_bind().
531 /* There is only one configuration. */
532 #define CONFIG_VALUE 1
534 static struct usb_device_descriptor
536 .bLength
= sizeof device_desc
,
537 .bDescriptorType
= USB_DT_DEVICE
,
539 .bcdUSB
= cpu_to_le16(0x0200),
540 .bDeviceClass
= USB_CLASS_PER_INTERFACE
,
542 /* The next three values can be overridden by module parameters */
543 .idVendor
= cpu_to_le16(FSG_VENDOR_ID
),
544 .idProduct
= cpu_to_le16(FSG_PRODUCT_ID
),
545 .bcdDevice
= cpu_to_le16(0xffff),
547 .iManufacturer
= FSG_STRING_MANUFACTURER
,
548 .iProduct
= FSG_STRING_PRODUCT
,
549 .iSerialNumber
= FSG_STRING_SERIAL
,
550 .bNumConfigurations
= 1,
553 static struct usb_config_descriptor
555 .bLength
= sizeof config_desc
,
556 .bDescriptorType
= USB_DT_CONFIG
,
558 /* wTotalLength computed by usb_gadget_config_buf() */
560 .bConfigurationValue
= CONFIG_VALUE
,
561 .iConfiguration
= FSG_STRING_CONFIG
,
562 .bmAttributes
= USB_CONFIG_ATT_ONE
| USB_CONFIG_ATT_SELFPOWER
,
563 .bMaxPower
= CONFIG_USB_GADGET_VBUS_DRAW
/ 2,
567 static struct usb_qualifier_descriptor
569 .bLength
= sizeof dev_qualifier
,
570 .bDescriptorType
= USB_DT_DEVICE_QUALIFIER
,
572 .bcdUSB
= cpu_to_le16(0x0200),
573 .bDeviceClass
= USB_CLASS_PER_INTERFACE
,
575 .bNumConfigurations
= 1,
581 * Config descriptors must agree with the code that sets configurations
582 * and with code managing interfaces and their altsettings. They must
583 * also handle different speeds and other-speed requests.
585 static int populate_config_buf(struct usb_gadget
*gadget
,
586 u8
*buf
, u8 type
, unsigned index
)
588 enum usb_device_speed speed
= gadget
->speed
;
590 const struct usb_descriptor_header
**function
;
595 if (gadget_is_dualspeed(gadget
) && type
== USB_DT_OTHER_SPEED_CONFIG
)
596 speed
= (USB_SPEED_FULL
+ USB_SPEED_HIGH
) - speed
;
597 function
= gadget_is_dualspeed(gadget
) && speed
== USB_SPEED_HIGH
598 ? (const struct usb_descriptor_header
**)fsg_hs_function
599 : (const struct usb_descriptor_header
**)fsg_fs_function
;
601 /* for now, don't advertise srp-only devices */
602 if (!gadget_is_otg(gadget
))
605 len
= usb_gadget_config_buf(&config_desc
, buf
, EP0_BUFSIZE
, function
);
606 ((struct usb_config_descriptor
*) buf
)->bDescriptorType
= type
;
611 /*-------------------------------------------------------------------------*/
613 /* These routines may be called in process context or in_irq */
615 /* Caller must hold fsg->lock */
616 static void wakeup_thread(struct fsg_dev
*fsg
)
618 /* Tell the main thread that something has happened */
619 fsg
->thread_wakeup_needed
= 1;
620 if (fsg
->thread_task
)
621 wake_up_process(fsg
->thread_task
);
625 static void raise_exception(struct fsg_dev
*fsg
, enum fsg_state new_state
)
629 /* Do nothing if a higher-priority exception is already in progress.
630 * If a lower-or-equal priority exception is in progress, preempt it
631 * and notify the main thread by sending it a signal. */
632 spin_lock_irqsave(&fsg
->lock
, flags
);
633 if (fsg
->state
<= new_state
) {
634 fsg
->exception_req_tag
= fsg
->ep0_req_tag
;
635 fsg
->state
= new_state
;
636 if (fsg
->thread_task
)
637 send_sig_info(SIGUSR1
, SEND_SIG_FORCED
,
640 spin_unlock_irqrestore(&fsg
->lock
, flags
);
644 /*-------------------------------------------------------------------------*/
646 /* The disconnect callback and ep0 routines. These always run in_irq,
647 * except that ep0_queue() is called in the main thread to acknowledge
648 * completion of various requests: set config, set interface, and
649 * Bulk-only device reset. */
651 static void fsg_disconnect(struct usb_gadget
*gadget
)
653 struct fsg_dev
*fsg
= get_gadget_data(gadget
);
655 DBG(fsg
, "disconnect or port reset\n");
656 raise_exception(fsg
, FSG_STATE_DISCONNECT
);
660 static int ep0_queue(struct fsg_dev
*fsg
)
664 rc
= usb_ep_queue(fsg
->ep0
, fsg
->ep0req
, GFP_ATOMIC
);
665 if (rc
!= 0 && rc
!= -ESHUTDOWN
) {
667 /* We can't do much more than wait for a reset */
668 WARNING(fsg
, "error in submission: %s --> %d\n",
674 static void ep0_complete(struct usb_ep
*ep
, struct usb_request
*req
)
676 struct fsg_dev
*fsg
= ep
->driver_data
;
679 dump_msg(fsg
, fsg
->ep0req_name
, req
->buf
, req
->actual
);
680 if (req
->status
|| req
->actual
!= req
->length
)
681 DBG(fsg
, "%s --> %d, %u/%u\n", __func__
,
682 req
->status
, req
->actual
, req
->length
);
683 if (req
->status
== -ECONNRESET
) // Request was cancelled
684 usb_ep_fifo_flush(ep
);
686 if (req
->status
== 0 && req
->context
)
687 ((fsg_routine_t
) (req
->context
))(fsg
);
691 /*-------------------------------------------------------------------------*/
693 /* Bulk and interrupt endpoint completion handlers.
694 * These always run in_irq. */
696 static void bulk_in_complete(struct usb_ep
*ep
, struct usb_request
*req
)
698 struct fsg_dev
*fsg
= ep
->driver_data
;
699 struct fsg_buffhd
*bh
= req
->context
;
701 if (req
->status
|| req
->actual
!= req
->length
)
702 DBG(fsg
, "%s --> %d, %u/%u\n", __func__
,
703 req
->status
, req
->actual
, req
->length
);
704 if (req
->status
== -ECONNRESET
) // Request was cancelled
705 usb_ep_fifo_flush(ep
);
707 /* Hold the lock while we update the request and buffer states */
709 spin_lock(&fsg
->lock
);
711 bh
->state
= BUF_STATE_EMPTY
;
713 spin_unlock(&fsg
->lock
);
716 static void bulk_out_complete(struct usb_ep
*ep
, struct usb_request
*req
)
718 struct fsg_dev
*fsg
= ep
->driver_data
;
719 struct fsg_buffhd
*bh
= req
->context
;
721 dump_msg(fsg
, "bulk-out", req
->buf
, req
->actual
);
722 if (req
->status
|| req
->actual
!= bh
->bulk_out_intended_length
)
723 DBG(fsg
, "%s --> %d, %u/%u\n", __func__
,
724 req
->status
, req
->actual
,
725 bh
->bulk_out_intended_length
);
726 if (req
->status
== -ECONNRESET
) // Request was cancelled
727 usb_ep_fifo_flush(ep
);
729 /* Hold the lock while we update the request and buffer states */
731 spin_lock(&fsg
->lock
);
733 bh
->state
= BUF_STATE_FULL
;
735 spin_unlock(&fsg
->lock
);
739 #ifdef CONFIG_USB_FILE_STORAGE_TEST
740 static void intr_in_complete(struct usb_ep
*ep
, struct usb_request
*req
)
742 struct fsg_dev
*fsg
= ep
->driver_data
;
743 struct fsg_buffhd
*bh
= req
->context
;
745 if (req
->status
|| req
->actual
!= req
->length
)
746 DBG(fsg
, "%s --> %d, %u/%u\n", __func__
,
747 req
->status
, req
->actual
, req
->length
);
748 if (req
->status
== -ECONNRESET
) // Request was cancelled
749 usb_ep_fifo_flush(ep
);
751 /* Hold the lock while we update the request and buffer states */
753 spin_lock(&fsg
->lock
);
754 fsg
->intreq_busy
= 0;
755 bh
->state
= BUF_STATE_EMPTY
;
757 spin_unlock(&fsg
->lock
);
761 static void intr_in_complete(struct usb_ep
*ep
, struct usb_request
*req
)
763 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
766 /*-------------------------------------------------------------------------*/
768 /* Ep0 class-specific handlers. These always run in_irq. */
770 #ifdef CONFIG_USB_FILE_STORAGE_TEST
771 static void received_cbi_adsc(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
773 struct usb_request
*req
= fsg
->ep0req
;
774 static u8 cbi_reset_cmnd
[6] = {
775 SC_SEND_DIAGNOSTIC
, 4, 0xff, 0xff, 0xff, 0xff};
777 /* Error in command transfer? */
778 if (req
->status
|| req
->length
!= req
->actual
||
779 req
->actual
< 6 || req
->actual
> MAX_COMMAND_SIZE
) {
781 /* Not all controllers allow a protocol stall after
782 * receiving control-out data, but we'll try anyway. */
783 fsg_set_halt(fsg
, fsg
->ep0
);
784 return; // Wait for reset
787 /* Is it the special reset command? */
788 if (req
->actual
>= sizeof cbi_reset_cmnd
&&
789 memcmp(req
->buf
, cbi_reset_cmnd
,
790 sizeof cbi_reset_cmnd
) == 0) {
792 /* Raise an exception to stop the current operation
793 * and reinitialize our state. */
794 DBG(fsg
, "cbi reset request\n");
795 raise_exception(fsg
, FSG_STATE_RESET
);
799 VDBG(fsg
, "CB[I] accept device-specific command\n");
800 spin_lock(&fsg
->lock
);
802 /* Save the command for later */
803 if (fsg
->cbbuf_cmnd_size
)
804 WARNING(fsg
, "CB[I] overwriting previous command\n");
805 fsg
->cbbuf_cmnd_size
= req
->actual
;
806 memcpy(fsg
->cbbuf_cmnd
, req
->buf
, fsg
->cbbuf_cmnd_size
);
809 spin_unlock(&fsg
->lock
);
813 static void received_cbi_adsc(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
815 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
818 static int class_setup_req(struct fsg_dev
*fsg
,
819 const struct usb_ctrlrequest
*ctrl
)
821 struct usb_request
*req
= fsg
->ep0req
;
822 int value
= -EOPNOTSUPP
;
823 u16 w_index
= le16_to_cpu(ctrl
->wIndex
);
824 u16 w_value
= le16_to_cpu(ctrl
->wValue
);
825 u16 w_length
= le16_to_cpu(ctrl
->wLength
);
830 /* Handle Bulk-only class-specific requests */
831 if (transport_is_bbb()) {
832 switch (ctrl
->bRequest
) {
834 case USB_BULK_RESET_REQUEST
:
835 if (ctrl
->bRequestType
!= (USB_DIR_OUT
|
836 USB_TYPE_CLASS
| USB_RECIP_INTERFACE
))
838 if (w_index
!= 0 || w_value
!= 0) {
843 /* Raise an exception to stop the current operation
844 * and reinitialize our state. */
845 DBG(fsg
, "bulk reset request\n");
846 raise_exception(fsg
, FSG_STATE_RESET
);
847 value
= DELAYED_STATUS
;
850 case USB_BULK_GET_MAX_LUN_REQUEST
:
851 if (ctrl
->bRequestType
!= (USB_DIR_IN
|
852 USB_TYPE_CLASS
| USB_RECIP_INTERFACE
))
854 if (w_index
!= 0 || w_value
!= 0) {
858 VDBG(fsg
, "get max LUN\n");
859 *(u8
*) req
->buf
= fsg
->nluns
- 1;
865 /* Handle CBI class-specific requests */
867 switch (ctrl
->bRequest
) {
869 case USB_CBI_ADSC_REQUEST
:
870 if (ctrl
->bRequestType
!= (USB_DIR_OUT
|
871 USB_TYPE_CLASS
| USB_RECIP_INTERFACE
))
873 if (w_index
!= 0 || w_value
!= 0) {
877 if (w_length
> MAX_COMMAND_SIZE
) {
882 fsg
->ep0req
->context
= received_cbi_adsc
;
887 if (value
== -EOPNOTSUPP
)
889 "unknown class-specific control req "
890 "%02x.%02x v%04x i%04x l%u\n",
891 ctrl
->bRequestType
, ctrl
->bRequest
,
892 le16_to_cpu(ctrl
->wValue
), w_index
, w_length
);
897 /*-------------------------------------------------------------------------*/
899 /* Ep0 standard request handlers. These always run in_irq. */
901 static int standard_setup_req(struct fsg_dev
*fsg
,
902 const struct usb_ctrlrequest
*ctrl
)
904 struct usb_request
*req
= fsg
->ep0req
;
905 int value
= -EOPNOTSUPP
;
906 u16 w_index
= le16_to_cpu(ctrl
->wIndex
);
907 u16 w_value
= le16_to_cpu(ctrl
->wValue
);
909 /* Usually this just stores reply data in the pre-allocated ep0 buffer,
910 * but config change events will also reconfigure hardware. */
911 switch (ctrl
->bRequest
) {
913 case USB_REQ_GET_DESCRIPTOR
:
914 if (ctrl
->bRequestType
!= (USB_DIR_IN
| USB_TYPE_STANDARD
|
917 switch (w_value
>> 8) {
920 VDBG(fsg
, "get device descriptor\n");
921 value
= sizeof device_desc
;
922 memcpy(req
->buf
, &device_desc
, value
);
924 case USB_DT_DEVICE_QUALIFIER
:
925 VDBG(fsg
, "get device qualifier\n");
926 if (!gadget_is_dualspeed(fsg
->gadget
))
928 value
= sizeof dev_qualifier
;
929 memcpy(req
->buf
, &dev_qualifier
, value
);
932 case USB_DT_OTHER_SPEED_CONFIG
:
933 VDBG(fsg
, "get other-speed config descriptor\n");
934 if (!gadget_is_dualspeed(fsg
->gadget
))
938 VDBG(fsg
, "get configuration descriptor\n");
940 value
= populate_config_buf(fsg
->gadget
,
947 VDBG(fsg
, "get string descriptor\n");
949 /* wIndex == language code */
950 value
= usb_gadget_get_string(&fsg_stringtab
,
951 w_value
& 0xff, req
->buf
);
956 /* One config, two speeds */
957 case USB_REQ_SET_CONFIGURATION
:
958 if (ctrl
->bRequestType
!= (USB_DIR_OUT
| USB_TYPE_STANDARD
|
961 VDBG(fsg
, "set configuration\n");
962 if (w_value
== CONFIG_VALUE
|| w_value
== 0) {
963 fsg
->new_config
= w_value
;
965 /* Raise an exception to wipe out previous transaction
966 * state (queued bufs, etc) and set the new config. */
967 raise_exception(fsg
, FSG_STATE_CONFIG_CHANGE
);
968 value
= DELAYED_STATUS
;
971 case USB_REQ_GET_CONFIGURATION
:
972 if (ctrl
->bRequestType
!= (USB_DIR_IN
| USB_TYPE_STANDARD
|
975 VDBG(fsg
, "get configuration\n");
976 *(u8
*) req
->buf
= fsg
->config
;
980 case USB_REQ_SET_INTERFACE
:
981 if (ctrl
->bRequestType
!= (USB_DIR_OUT
| USB_TYPE_STANDARD
|
982 USB_RECIP_INTERFACE
))
984 if (fsg
->config
&& w_index
== 0) {
986 /* Raise an exception to wipe out previous transaction
987 * state (queued bufs, etc) and install the new
988 * interface altsetting. */
989 raise_exception(fsg
, FSG_STATE_INTERFACE_CHANGE
);
990 value
= DELAYED_STATUS
;
993 case USB_REQ_GET_INTERFACE
:
994 if (ctrl
->bRequestType
!= (USB_DIR_IN
| USB_TYPE_STANDARD
|
995 USB_RECIP_INTERFACE
))
1003 VDBG(fsg
, "get interface\n");
1004 *(u8
*) req
->buf
= 0;
1010 "unknown control req %02x.%02x v%04x i%04x l%u\n",
1011 ctrl
->bRequestType
, ctrl
->bRequest
,
1012 w_value
, w_index
, le16_to_cpu(ctrl
->wLength
));
1019 static int fsg_setup(struct usb_gadget
*gadget
,
1020 const struct usb_ctrlrequest
*ctrl
)
1022 struct fsg_dev
*fsg
= get_gadget_data(gadget
);
1024 int w_length
= le16_to_cpu(ctrl
->wLength
);
1026 ++fsg
->ep0_req_tag
; // Record arrival of a new request
1027 fsg
->ep0req
->context
= NULL
;
1028 fsg
->ep0req
->length
= 0;
1029 dump_msg(fsg
, "ep0-setup", (u8
*) ctrl
, sizeof(*ctrl
));
1031 if ((ctrl
->bRequestType
& USB_TYPE_MASK
) == USB_TYPE_CLASS
)
1032 rc
= class_setup_req(fsg
, ctrl
);
1034 rc
= standard_setup_req(fsg
, ctrl
);
1036 /* Respond with data/status or defer until later? */
1037 if (rc
>= 0 && rc
!= DELAYED_STATUS
) {
1038 rc
= min(rc
, w_length
);
1039 fsg
->ep0req
->length
= rc
;
1040 fsg
->ep0req
->zero
= rc
< w_length
;
1041 fsg
->ep0req_name
= (ctrl
->bRequestType
& USB_DIR_IN
?
1042 "ep0-in" : "ep0-out");
1043 rc
= ep0_queue(fsg
);
1046 /* Device either stalls (rc < 0) or reports success */
1051 /*-------------------------------------------------------------------------*/
1053 /* All the following routines run in process context */
1056 /* Use this for bulk or interrupt transfers, not ep0 */
1057 static void start_transfer(struct fsg_dev
*fsg
, struct usb_ep
*ep
,
1058 struct usb_request
*req
, int *pbusy
,
1059 enum fsg_buffer_state
*state
)
1063 if (ep
== fsg
->bulk_in
)
1064 dump_msg(fsg
, "bulk-in", req
->buf
, req
->length
);
1065 else if (ep
== fsg
->intr_in
)
1066 dump_msg(fsg
, "intr-in", req
->buf
, req
->length
);
1068 spin_lock_irq(&fsg
->lock
);
1070 *state
= BUF_STATE_BUSY
;
1071 spin_unlock_irq(&fsg
->lock
);
1072 rc
= usb_ep_queue(ep
, req
, GFP_KERNEL
);
1075 *state
= BUF_STATE_EMPTY
;
1077 /* We can't do much more than wait for a reset */
1079 /* Note: currently the net2280 driver fails zero-length
1080 * submissions if DMA is enabled. */
1081 if (rc
!= -ESHUTDOWN
&& !(rc
== -EOPNOTSUPP
&&
1083 WARNING(fsg
, "error in submission: %s --> %d\n",
1089 static int sleep_thread(struct fsg_dev
*fsg
)
1093 /* Wait until a signal arrives or we are woken up */
1096 set_current_state(TASK_INTERRUPTIBLE
);
1097 if (signal_pending(current
)) {
1101 if (fsg
->thread_wakeup_needed
)
1105 __set_current_state(TASK_RUNNING
);
1106 fsg
->thread_wakeup_needed
= 0;
1111 /*-------------------------------------------------------------------------*/
1113 static int do_read(struct fsg_dev
*fsg
)
1115 struct fsg_lun
*curlun
= fsg
->curlun
;
1117 struct fsg_buffhd
*bh
;
1120 loff_t file_offset
, file_offset_tmp
;
1121 unsigned int amount
;
1122 unsigned int partial_page
;
1125 /* Get the starting Logical Block Address and check that it's
1127 if (fsg
->cmnd
[0] == SC_READ_6
)
1128 lba
= get_unaligned_be24(&fsg
->cmnd
[1]);
1130 lba
= get_unaligned_be32(&fsg
->cmnd
[2]);
1132 /* We allow DPO (Disable Page Out = don't save data in the
1133 * cache) and FUA (Force Unit Access = don't read from the
1134 * cache), but we don't implement them. */
1135 if ((fsg
->cmnd
[1] & ~0x18) != 0) {
1136 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1140 if (lba
>= curlun
->num_sectors
) {
1141 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1144 file_offset
= ((loff_t
) lba
) << 9;
1146 /* Carry out the file reads */
1147 amount_left
= fsg
->data_size_from_cmnd
;
1148 if (unlikely(amount_left
== 0))
1149 return -EIO
; // No default reply
1153 /* Figure out how much we need to read:
1154 * Try to read the remaining amount.
1155 * But don't read more than the buffer size.
1156 * And don't try to read past the end of the file.
1157 * Finally, if we're not at a page boundary, don't read past
1159 * If this means reading 0 then we were asked to read past
1160 * the end of file. */
1161 amount
= min((unsigned int) amount_left
, mod_data
.buflen
);
1162 amount
= min((loff_t
) amount
,
1163 curlun
->file_length
- file_offset
);
1164 partial_page
= file_offset
& (PAGE_CACHE_SIZE
- 1);
1165 if (partial_page
> 0)
1166 amount
= min(amount
, (unsigned int) PAGE_CACHE_SIZE
-
1169 /* Wait for the next buffer to become available */
1170 bh
= fsg
->next_buffhd_to_fill
;
1171 while (bh
->state
!= BUF_STATE_EMPTY
) {
1172 rc
= sleep_thread(fsg
);
1177 /* If we were asked to read past the end of file,
1178 * end with an empty buffer. */
1180 curlun
->sense_data
=
1181 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1182 curlun
->sense_data_info
= file_offset
>> 9;
1183 curlun
->info_valid
= 1;
1184 bh
->inreq
->length
= 0;
1185 bh
->state
= BUF_STATE_FULL
;
1189 /* Perform the read */
1190 file_offset_tmp
= file_offset
;
1191 nread
= vfs_read(curlun
->filp
,
1192 (char __user
*) bh
->buf
,
1193 amount
, &file_offset_tmp
);
1194 VLDBG(curlun
, "file read %u @ %llu -> %d\n", amount
,
1195 (unsigned long long) file_offset
,
1197 if (signal_pending(current
))
1201 LDBG(curlun
, "error in file read: %d\n",
1204 } else if (nread
< amount
) {
1205 LDBG(curlun
, "partial file read: %d/%u\n",
1206 (int) nread
, amount
);
1207 nread
-= (nread
& 511); // Round down to a block
1209 file_offset
+= nread
;
1210 amount_left
-= nread
;
1211 fsg
->residue
-= nread
;
1212 bh
->inreq
->length
= nread
;
1213 bh
->state
= BUF_STATE_FULL
;
1215 /* If an error occurred, report it and its position */
1216 if (nread
< amount
) {
1217 curlun
->sense_data
= SS_UNRECOVERED_READ_ERROR
;
1218 curlun
->sense_data_info
= file_offset
>> 9;
1219 curlun
->info_valid
= 1;
1223 if (amount_left
== 0)
1224 break; // No more left to read
1226 /* Send this buffer and go read some more */
1227 bh
->inreq
->zero
= 0;
1228 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
1229 &bh
->inreq_busy
, &bh
->state
);
1230 fsg
->next_buffhd_to_fill
= bh
->next
;
1233 return -EIO
; // No default reply
1237 /*-------------------------------------------------------------------------*/
1239 static int do_write(struct fsg_dev
*fsg
)
1241 struct fsg_lun
*curlun
= fsg
->curlun
;
1243 struct fsg_buffhd
*bh
;
1245 u32 amount_left_to_req
, amount_left_to_write
;
1246 loff_t usb_offset
, file_offset
, file_offset_tmp
;
1247 unsigned int amount
;
1248 unsigned int partial_page
;
1253 curlun
->sense_data
= SS_WRITE_PROTECTED
;
1256 spin_lock(&curlun
->filp
->f_lock
);
1257 curlun
->filp
->f_flags
&= ~O_SYNC
; // Default is not to wait
1258 spin_unlock(&curlun
->filp
->f_lock
);
1260 /* Get the starting Logical Block Address and check that it's
1262 if (fsg
->cmnd
[0] == SC_WRITE_6
)
1263 lba
= get_unaligned_be24(&fsg
->cmnd
[1]);
1265 lba
= get_unaligned_be32(&fsg
->cmnd
[2]);
1267 /* We allow DPO (Disable Page Out = don't save data in the
1268 * cache) and FUA (Force Unit Access = write directly to the
1269 * medium). We don't implement DPO; we implement FUA by
1270 * performing synchronous output. */
1271 if ((fsg
->cmnd
[1] & ~0x18) != 0) {
1272 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1275 if (fsg
->cmnd
[1] & 0x08) { // FUA
1276 spin_lock(&curlun
->filp
->f_lock
);
1277 curlun
->filp
->f_flags
|= O_DSYNC
;
1278 spin_unlock(&curlun
->filp
->f_lock
);
1281 if (lba
>= curlun
->num_sectors
) {
1282 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1286 /* Carry out the file writes */
1288 file_offset
= usb_offset
= ((loff_t
) lba
) << 9;
1289 amount_left_to_req
= amount_left_to_write
= fsg
->data_size_from_cmnd
;
1291 while (amount_left_to_write
> 0) {
1293 /* Queue a request for more data from the host */
1294 bh
= fsg
->next_buffhd_to_fill
;
1295 if (bh
->state
== BUF_STATE_EMPTY
&& get_some_more
) {
1297 /* Figure out how much we want to get:
1298 * Try to get the remaining amount.
1299 * But don't get more than the buffer size.
1300 * And don't try to go past the end of the file.
1301 * If we're not at a page boundary,
1302 * don't go past the next page.
1303 * If this means getting 0, then we were asked
1304 * to write past the end of file.
1305 * Finally, round down to a block boundary. */
1306 amount
= min(amount_left_to_req
, mod_data
.buflen
);
1307 amount
= min((loff_t
) amount
, curlun
->file_length
-
1309 partial_page
= usb_offset
& (PAGE_CACHE_SIZE
- 1);
1310 if (partial_page
> 0)
1311 amount
= min(amount
,
1312 (unsigned int) PAGE_CACHE_SIZE
- partial_page
);
1316 curlun
->sense_data
=
1317 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1318 curlun
->sense_data_info
= usb_offset
>> 9;
1319 curlun
->info_valid
= 1;
1322 amount
-= (amount
& 511);
1325 /* Why were we were asked to transfer a
1331 /* Get the next buffer */
1332 usb_offset
+= amount
;
1333 fsg
->usb_amount_left
-= amount
;
1334 amount_left_to_req
-= amount
;
1335 if (amount_left_to_req
== 0)
1338 /* amount is always divisible by 512, hence by
1339 * the bulk-out maxpacket size */
1340 bh
->outreq
->length
= bh
->bulk_out_intended_length
=
1342 bh
->outreq
->short_not_ok
= 1;
1343 start_transfer(fsg
, fsg
->bulk_out
, bh
->outreq
,
1344 &bh
->outreq_busy
, &bh
->state
);
1345 fsg
->next_buffhd_to_fill
= bh
->next
;
1349 /* Write the received data to the backing file */
1350 bh
= fsg
->next_buffhd_to_drain
;
1351 if (bh
->state
== BUF_STATE_EMPTY
&& !get_some_more
)
1352 break; // We stopped early
1353 if (bh
->state
== BUF_STATE_FULL
) {
1355 fsg
->next_buffhd_to_drain
= bh
->next
;
1356 bh
->state
= BUF_STATE_EMPTY
;
1358 /* Did something go wrong with the transfer? */
1359 if (bh
->outreq
->status
!= 0) {
1360 curlun
->sense_data
= SS_COMMUNICATION_FAILURE
;
1361 curlun
->sense_data_info
= file_offset
>> 9;
1362 curlun
->info_valid
= 1;
1366 amount
= bh
->outreq
->actual
;
1367 if (curlun
->file_length
- file_offset
< amount
) {
1369 "write %u @ %llu beyond end %llu\n",
1370 amount
, (unsigned long long) file_offset
,
1371 (unsigned long long) curlun
->file_length
);
1372 amount
= curlun
->file_length
- file_offset
;
1375 /* Perform the write */
1376 file_offset_tmp
= file_offset
;
1377 nwritten
= vfs_write(curlun
->filp
,
1378 (char __user
*) bh
->buf
,
1379 amount
, &file_offset_tmp
);
1380 VLDBG(curlun
, "file write %u @ %llu -> %d\n", amount
,
1381 (unsigned long long) file_offset
,
1383 if (signal_pending(current
))
1384 return -EINTR
; // Interrupted!
1387 LDBG(curlun
, "error in file write: %d\n",
1390 } else if (nwritten
< amount
) {
1391 LDBG(curlun
, "partial file write: %d/%u\n",
1392 (int) nwritten
, amount
);
1393 nwritten
-= (nwritten
& 511);
1394 // Round down to a block
1396 file_offset
+= nwritten
;
1397 amount_left_to_write
-= nwritten
;
1398 fsg
->residue
-= nwritten
;
1400 /* If an error occurred, report it and its position */
1401 if (nwritten
< amount
) {
1402 curlun
->sense_data
= SS_WRITE_ERROR
;
1403 curlun
->sense_data_info
= file_offset
>> 9;
1404 curlun
->info_valid
= 1;
1408 /* Did the host decide to stop early? */
1409 if (bh
->outreq
->actual
!= bh
->outreq
->length
) {
1410 fsg
->short_packet_received
= 1;
1416 /* Wait for something to happen */
1417 rc
= sleep_thread(fsg
);
1422 return -EIO
; // No default reply
1426 /*-------------------------------------------------------------------------*/
1428 static int do_synchronize_cache(struct fsg_dev
*fsg
)
1430 struct fsg_lun
*curlun
= fsg
->curlun
;
1433 /* We ignore the requested LBA and write out all file's
1434 * dirty data buffers. */
1435 rc
= fsg_lun_fsync_sub(curlun
);
1437 curlun
->sense_data
= SS_WRITE_ERROR
;
1442 /*-------------------------------------------------------------------------*/
1444 static void invalidate_sub(struct fsg_lun
*curlun
)
1446 struct file
*filp
= curlun
->filp
;
1447 struct inode
*inode
= filp
->f_path
.dentry
->d_inode
;
1450 rc
= invalidate_mapping_pages(inode
->i_mapping
, 0, -1);
1451 VLDBG(curlun
, "invalidate_mapping_pages -> %ld\n", rc
);
1454 static int do_verify(struct fsg_dev
*fsg
)
1456 struct fsg_lun
*curlun
= fsg
->curlun
;
1458 u32 verification_length
;
1459 struct fsg_buffhd
*bh
= fsg
->next_buffhd_to_fill
;
1460 loff_t file_offset
, file_offset_tmp
;
1462 unsigned int amount
;
1465 /* Get the starting Logical Block Address and check that it's
1467 lba
= get_unaligned_be32(&fsg
->cmnd
[2]);
1468 if (lba
>= curlun
->num_sectors
) {
1469 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1473 /* We allow DPO (Disable Page Out = don't save data in the
1474 * cache) but we don't implement it. */
1475 if ((fsg
->cmnd
[1] & ~0x10) != 0) {
1476 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1480 verification_length
= get_unaligned_be16(&fsg
->cmnd
[7]);
1481 if (unlikely(verification_length
== 0))
1482 return -EIO
; // No default reply
1484 /* Prepare to carry out the file verify */
1485 amount_left
= verification_length
<< 9;
1486 file_offset
= ((loff_t
) lba
) << 9;
1488 /* Write out all the dirty buffers before invalidating them */
1489 fsg_lun_fsync_sub(curlun
);
1490 if (signal_pending(current
))
1493 invalidate_sub(curlun
);
1494 if (signal_pending(current
))
1497 /* Just try to read the requested blocks */
1498 while (amount_left
> 0) {
1500 /* Figure out how much we need to read:
1501 * Try to read the remaining amount, but not more than
1503 * And don't try to read past the end of the file.
1504 * If this means reading 0 then we were asked to read
1505 * past the end of file. */
1506 amount
= min((unsigned int) amount_left
, mod_data
.buflen
);
1507 amount
= min((loff_t
) amount
,
1508 curlun
->file_length
- file_offset
);
1510 curlun
->sense_data
=
1511 SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1512 curlun
->sense_data_info
= file_offset
>> 9;
1513 curlun
->info_valid
= 1;
1517 /* Perform the read */
1518 file_offset_tmp
= file_offset
;
1519 nread
= vfs_read(curlun
->filp
,
1520 (char __user
*) bh
->buf
,
1521 amount
, &file_offset_tmp
);
1522 VLDBG(curlun
, "file read %u @ %llu -> %d\n", amount
,
1523 (unsigned long long) file_offset
,
1525 if (signal_pending(current
))
1529 LDBG(curlun
, "error in file verify: %d\n",
1532 } else if (nread
< amount
) {
1533 LDBG(curlun
, "partial file verify: %d/%u\n",
1534 (int) nread
, amount
);
1535 nread
-= (nread
& 511); // Round down to a sector
1538 curlun
->sense_data
= SS_UNRECOVERED_READ_ERROR
;
1539 curlun
->sense_data_info
= file_offset
>> 9;
1540 curlun
->info_valid
= 1;
1543 file_offset
+= nread
;
1544 amount_left
-= nread
;
1550 /*-------------------------------------------------------------------------*/
1552 static int do_inquiry(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1554 u8
*buf
= (u8
*) bh
->buf
;
1556 static char vendor_id
[] = "Linux ";
1557 static char product_disk_id
[] = "File-Stor Gadget";
1558 static char product_cdrom_id
[] = "File-CD Gadget ";
1560 if (!fsg
->curlun
) { // Unsupported LUNs are okay
1561 fsg
->bad_lun_okay
= 1;
1563 buf
[0] = 0x7f; // Unsupported, no device-type
1564 buf
[4] = 31; // Additional length
1569 buf
[0] = (mod_data
.cdrom
? TYPE_CDROM
: TYPE_DISK
);
1570 if (mod_data
.removable
)
1572 buf
[2] = 2; // ANSI SCSI level 2
1573 buf
[3] = 2; // SCSI-2 INQUIRY data format
1574 buf
[4] = 31; // Additional length
1575 // No special options
1576 sprintf(buf
+ 8, "%-8s%-16s%04x", vendor_id
,
1577 (mod_data
.cdrom
? product_cdrom_id
:
1584 static int do_request_sense(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1586 struct fsg_lun
*curlun
= fsg
->curlun
;
1587 u8
*buf
= (u8
*) bh
->buf
;
1592 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1594 * If a REQUEST SENSE command is received from an initiator
1595 * with a pending unit attention condition (before the target
1596 * generates the contingent allegiance condition), then the
1597 * target shall either:
1598 * a) report any pending sense data and preserve the unit
1599 * attention condition on the logical unit, or,
1600 * b) report the unit attention condition, may discard any
1601 * pending sense data, and clear the unit attention
1602 * condition on the logical unit for that initiator.
1604 * FSG normally uses option a); enable this code to use option b).
1607 if (curlun
&& curlun
->unit_attention_data
!= SS_NO_SENSE
) {
1608 curlun
->sense_data
= curlun
->unit_attention_data
;
1609 curlun
->unit_attention_data
= SS_NO_SENSE
;
1613 if (!curlun
) { // Unsupported LUNs are okay
1614 fsg
->bad_lun_okay
= 1;
1615 sd
= SS_LOGICAL_UNIT_NOT_SUPPORTED
;
1619 sd
= curlun
->sense_data
;
1620 sdinfo
= curlun
->sense_data_info
;
1621 valid
= curlun
->info_valid
<< 7;
1622 curlun
->sense_data
= SS_NO_SENSE
;
1623 curlun
->sense_data_info
= 0;
1624 curlun
->info_valid
= 0;
1628 buf
[0] = valid
| 0x70; // Valid, current error
1630 put_unaligned_be32(sdinfo
, &buf
[3]); /* Sense information */
1631 buf
[7] = 18 - 8; // Additional sense length
1638 static int do_read_capacity(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1640 struct fsg_lun
*curlun
= fsg
->curlun
;
1641 u32 lba
= get_unaligned_be32(&fsg
->cmnd
[2]);
1642 int pmi
= fsg
->cmnd
[8];
1643 u8
*buf
= (u8
*) bh
->buf
;
1645 /* Check the PMI and LBA fields */
1646 if (pmi
> 1 || (pmi
== 0 && lba
!= 0)) {
1647 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1651 put_unaligned_be32(curlun
->num_sectors
- 1, &buf
[0]);
1652 /* Max logical block */
1653 put_unaligned_be32(512, &buf
[4]); /* Block length */
1658 static int do_read_header(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1660 struct fsg_lun
*curlun
= fsg
->curlun
;
1661 int msf
= fsg
->cmnd
[1] & 0x02;
1662 u32 lba
= get_unaligned_be32(&fsg
->cmnd
[2]);
1663 u8
*buf
= (u8
*) bh
->buf
;
1665 if ((fsg
->cmnd
[1] & ~0x02) != 0) { /* Mask away MSF */
1666 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1669 if (lba
>= curlun
->num_sectors
) {
1670 curlun
->sense_data
= SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE
;
1675 buf
[0] = 0x01; /* 2048 bytes of user data, rest is EC */
1676 store_cdrom_address(&buf
[4], msf
, lba
);
1681 static int do_read_toc(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1683 struct fsg_lun
*curlun
= fsg
->curlun
;
1684 int msf
= fsg
->cmnd
[1] & 0x02;
1685 int start_track
= fsg
->cmnd
[6];
1686 u8
*buf
= (u8
*) bh
->buf
;
1688 if ((fsg
->cmnd
[1] & ~0x02) != 0 || /* Mask away MSF */
1690 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1695 buf
[1] = (20-2); /* TOC data length */
1696 buf
[2] = 1; /* First track number */
1697 buf
[3] = 1; /* Last track number */
1698 buf
[5] = 0x16; /* Data track, copying allowed */
1699 buf
[6] = 0x01; /* Only track is number 1 */
1700 store_cdrom_address(&buf
[8], msf
, 0);
1702 buf
[13] = 0x16; /* Lead-out track is data */
1703 buf
[14] = 0xAA; /* Lead-out track number */
1704 store_cdrom_address(&buf
[16], msf
, curlun
->num_sectors
);
1709 static int do_mode_sense(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1711 struct fsg_lun
*curlun
= fsg
->curlun
;
1712 int mscmnd
= fsg
->cmnd
[0];
1713 u8
*buf
= (u8
*) bh
->buf
;
1716 int changeable_values
, all_pages
;
1720 if ((fsg
->cmnd
[1] & ~0x08) != 0) { // Mask away DBD
1721 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1724 pc
= fsg
->cmnd
[2] >> 6;
1725 page_code
= fsg
->cmnd
[2] & 0x3f;
1727 curlun
->sense_data
= SS_SAVING_PARAMETERS_NOT_SUPPORTED
;
1730 changeable_values
= (pc
== 1);
1731 all_pages
= (page_code
== 0x3f);
1733 /* Write the mode parameter header. Fixed values are: default
1734 * medium type, no cache control (DPOFUA), and no block descriptors.
1735 * The only variable value is the WriteProtect bit. We will fill in
1736 * the mode data length later. */
1738 if (mscmnd
== SC_MODE_SENSE_6
) {
1739 buf
[2] = (curlun
->ro
? 0x80 : 0x00); // WP, DPOFUA
1742 } else { // SC_MODE_SENSE_10
1743 buf
[3] = (curlun
->ro
? 0x80 : 0x00); // WP, DPOFUA
1745 limit
= 65535; // Should really be mod_data.buflen
1748 /* No block descriptors */
1750 /* The mode pages, in numerical order. The only page we support
1751 * is the Caching page. */
1752 if (page_code
== 0x08 || all_pages
) {
1754 buf
[0] = 0x08; // Page code
1755 buf
[1] = 10; // Page length
1756 memset(buf
+2, 0, 10); // None of the fields are changeable
1758 if (!changeable_values
) {
1759 buf
[2] = 0x04; // Write cache enable,
1760 // Read cache not disabled
1761 // No cache retention priorities
1762 put_unaligned_be16(0xffff, &buf
[4]);
1763 /* Don't disable prefetch */
1764 /* Minimum prefetch = 0 */
1765 put_unaligned_be16(0xffff, &buf
[8]);
1766 /* Maximum prefetch */
1767 put_unaligned_be16(0xffff, &buf
[10]);
1768 /* Maximum prefetch ceiling */
1773 /* Check that a valid page was requested and the mode data length
1774 * isn't too long. */
1776 if (!valid_page
|| len
> limit
) {
1777 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1781 /* Store the mode data length */
1782 if (mscmnd
== SC_MODE_SENSE_6
)
1785 put_unaligned_be16(len
- 2, buf0
);
1790 static int do_start_stop(struct fsg_dev
*fsg
)
1792 struct fsg_lun
*curlun
= fsg
->curlun
;
1795 if (!mod_data
.removable
) {
1796 curlun
->sense_data
= SS_INVALID_COMMAND
;
1800 // int immed = fsg->cmnd[1] & 0x01;
1801 loej
= fsg
->cmnd
[4] & 0x02;
1802 start
= fsg
->cmnd
[4] & 0x01;
1804 #ifdef CONFIG_USB_FILE_STORAGE_TEST
1805 if ((fsg
->cmnd
[1] & ~0x01) != 0 || // Mask away Immed
1806 (fsg
->cmnd
[4] & ~0x03) != 0) { // Mask LoEj, Start
1807 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1813 /* Are we allowed to unload the media? */
1814 if (curlun
->prevent_medium_removal
) {
1815 LDBG(curlun
, "unload attempt prevented\n");
1816 curlun
->sense_data
= SS_MEDIUM_REMOVAL_PREVENTED
;
1819 if (loej
) { // Simulate an unload/eject
1820 up_read(&fsg
->filesem
);
1821 down_write(&fsg
->filesem
);
1822 fsg_lun_close(curlun
);
1823 up_write(&fsg
->filesem
);
1824 down_read(&fsg
->filesem
);
1828 /* Our emulation doesn't support mounting; the medium is
1829 * available for use as soon as it is loaded. */
1830 if (!fsg_lun_is_open(curlun
)) {
1831 curlun
->sense_data
= SS_MEDIUM_NOT_PRESENT
;
1840 static int do_prevent_allow(struct fsg_dev
*fsg
)
1842 struct fsg_lun
*curlun
= fsg
->curlun
;
1845 if (!mod_data
.removable
) {
1846 curlun
->sense_data
= SS_INVALID_COMMAND
;
1850 prevent
= fsg
->cmnd
[4] & 0x01;
1851 if ((fsg
->cmnd
[4] & ~0x01) != 0) { // Mask away Prevent
1852 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
1856 if (curlun
->prevent_medium_removal
&& !prevent
)
1857 fsg_lun_fsync_sub(curlun
);
1858 curlun
->prevent_medium_removal
= prevent
;
1863 static int do_read_format_capacities(struct fsg_dev
*fsg
,
1864 struct fsg_buffhd
*bh
)
1866 struct fsg_lun
*curlun
= fsg
->curlun
;
1867 u8
*buf
= (u8
*) bh
->buf
;
1869 buf
[0] = buf
[1] = buf
[2] = 0;
1870 buf
[3] = 8; // Only the Current/Maximum Capacity Descriptor
1873 put_unaligned_be32(curlun
->num_sectors
, &buf
[0]);
1874 /* Number of blocks */
1875 put_unaligned_be32(512, &buf
[4]); /* Block length */
1876 buf
[4] = 0x02; /* Current capacity */
1881 static int do_mode_select(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
1883 struct fsg_lun
*curlun
= fsg
->curlun
;
1885 /* We don't support MODE SELECT */
1886 curlun
->sense_data
= SS_INVALID_COMMAND
;
1891 /*-------------------------------------------------------------------------*/
1893 static int halt_bulk_in_endpoint(struct fsg_dev
*fsg
)
1897 rc
= fsg_set_halt(fsg
, fsg
->bulk_in
);
1899 VDBG(fsg
, "delayed bulk-in endpoint halt\n");
1901 if (rc
!= -EAGAIN
) {
1902 WARNING(fsg
, "usb_ep_set_halt -> %d\n", rc
);
1907 /* Wait for a short time and then try again */
1908 if (msleep_interruptible(100) != 0)
1910 rc
= usb_ep_set_halt(fsg
->bulk_in
);
1915 static int wedge_bulk_in_endpoint(struct fsg_dev
*fsg
)
1919 DBG(fsg
, "bulk-in set wedge\n");
1920 rc
= usb_ep_set_wedge(fsg
->bulk_in
);
1922 VDBG(fsg
, "delayed bulk-in endpoint wedge\n");
1924 if (rc
!= -EAGAIN
) {
1925 WARNING(fsg
, "usb_ep_set_wedge -> %d\n", rc
);
1930 /* Wait for a short time and then try again */
1931 if (msleep_interruptible(100) != 0)
1933 rc
= usb_ep_set_wedge(fsg
->bulk_in
);
1938 static int pad_with_zeros(struct fsg_dev
*fsg
)
1940 struct fsg_buffhd
*bh
= fsg
->next_buffhd_to_fill
;
1941 u32 nkeep
= bh
->inreq
->length
;
1945 bh
->state
= BUF_STATE_EMPTY
; // For the first iteration
1946 fsg
->usb_amount_left
= nkeep
+ fsg
->residue
;
1947 while (fsg
->usb_amount_left
> 0) {
1949 /* Wait for the next buffer to be free */
1950 while (bh
->state
!= BUF_STATE_EMPTY
) {
1951 rc
= sleep_thread(fsg
);
1956 nsend
= min(fsg
->usb_amount_left
, (u32
) mod_data
.buflen
);
1957 memset(bh
->buf
+ nkeep
, 0, nsend
- nkeep
);
1958 bh
->inreq
->length
= nsend
;
1959 bh
->inreq
->zero
= 0;
1960 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
1961 &bh
->inreq_busy
, &bh
->state
);
1962 bh
= fsg
->next_buffhd_to_fill
= bh
->next
;
1963 fsg
->usb_amount_left
-= nsend
;
1969 static int throw_away_data(struct fsg_dev
*fsg
)
1971 struct fsg_buffhd
*bh
;
1975 while ((bh
= fsg
->next_buffhd_to_drain
)->state
!= BUF_STATE_EMPTY
||
1976 fsg
->usb_amount_left
> 0) {
1978 /* Throw away the data in a filled buffer */
1979 if (bh
->state
== BUF_STATE_FULL
) {
1981 bh
->state
= BUF_STATE_EMPTY
;
1982 fsg
->next_buffhd_to_drain
= bh
->next
;
1984 /* A short packet or an error ends everything */
1985 if (bh
->outreq
->actual
!= bh
->outreq
->length
||
1986 bh
->outreq
->status
!= 0) {
1987 raise_exception(fsg
, FSG_STATE_ABORT_BULK_OUT
);
1993 /* Try to submit another request if we need one */
1994 bh
= fsg
->next_buffhd_to_fill
;
1995 if (bh
->state
== BUF_STATE_EMPTY
&& fsg
->usb_amount_left
> 0) {
1996 amount
= min(fsg
->usb_amount_left
,
1997 (u32
) mod_data
.buflen
);
1999 /* amount is always divisible by 512, hence by
2000 * the bulk-out maxpacket size */
2001 bh
->outreq
->length
= bh
->bulk_out_intended_length
=
2003 bh
->outreq
->short_not_ok
= 1;
2004 start_transfer(fsg
, fsg
->bulk_out
, bh
->outreq
,
2005 &bh
->outreq_busy
, &bh
->state
);
2006 fsg
->next_buffhd_to_fill
= bh
->next
;
2007 fsg
->usb_amount_left
-= amount
;
2011 /* Otherwise wait for something to happen */
2012 rc
= sleep_thread(fsg
);
2020 static int finish_reply(struct fsg_dev
*fsg
)
2022 struct fsg_buffhd
*bh
= fsg
->next_buffhd_to_fill
;
2025 switch (fsg
->data_dir
) {
2027 break; // Nothing to send
2029 /* If we don't know whether the host wants to read or write,
2030 * this must be CB or CBI with an unknown command. We mustn't
2031 * try to send or receive any data. So stall both bulk pipes
2032 * if we can and wait for a reset. */
2033 case DATA_DIR_UNKNOWN
:
2034 if (mod_data
.can_stall
) {
2035 fsg_set_halt(fsg
, fsg
->bulk_out
);
2036 rc
= halt_bulk_in_endpoint(fsg
);
2040 /* All but the last buffer of data must have already been sent */
2041 case DATA_DIR_TO_HOST
:
2042 if (fsg
->data_size
== 0)
2043 ; // Nothing to send
2045 /* If there's no residue, simply send the last buffer */
2046 else if (fsg
->residue
== 0) {
2047 bh
->inreq
->zero
= 0;
2048 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
2049 &bh
->inreq_busy
, &bh
->state
);
2050 fsg
->next_buffhd_to_fill
= bh
->next
;
2053 /* There is a residue. For CB and CBI, simply mark the end
2054 * of the data with a short packet. However, if we are
2055 * allowed to stall, there was no data at all (residue ==
2056 * data_size), and the command failed (invalid LUN or
2057 * sense data is set), then halt the bulk-in endpoint
2059 else if (!transport_is_bbb()) {
2060 if (mod_data
.can_stall
&&
2061 fsg
->residue
== fsg
->data_size
&&
2062 (!fsg
->curlun
|| fsg
->curlun
->sense_data
!= SS_NO_SENSE
)) {
2063 bh
->state
= BUF_STATE_EMPTY
;
2064 rc
= halt_bulk_in_endpoint(fsg
);
2066 bh
->inreq
->zero
= 1;
2067 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
2068 &bh
->inreq_busy
, &bh
->state
);
2069 fsg
->next_buffhd_to_fill
= bh
->next
;
2073 /* For Bulk-only, if we're allowed to stall then send the
2074 * short packet and halt the bulk-in endpoint. If we can't
2075 * stall, pad out the remaining data with 0's. */
2077 if (mod_data
.can_stall
) {
2078 bh
->inreq
->zero
= 1;
2079 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
2080 &bh
->inreq_busy
, &bh
->state
);
2081 fsg
->next_buffhd_to_fill
= bh
->next
;
2082 rc
= halt_bulk_in_endpoint(fsg
);
2084 rc
= pad_with_zeros(fsg
);
2088 /* We have processed all we want from the data the host has sent.
2089 * There may still be outstanding bulk-out requests. */
2090 case DATA_DIR_FROM_HOST
:
2091 if (fsg
->residue
== 0)
2092 ; // Nothing to receive
2094 /* Did the host stop sending unexpectedly early? */
2095 else if (fsg
->short_packet_received
) {
2096 raise_exception(fsg
, FSG_STATE_ABORT_BULK_OUT
);
2100 /* We haven't processed all the incoming data. Even though
2101 * we may be allowed to stall, doing so would cause a race.
2102 * The controller may already have ACK'ed all the remaining
2103 * bulk-out packets, in which case the host wouldn't see a
2104 * STALL. Not realizing the endpoint was halted, it wouldn't
2105 * clear the halt -- leading to problems later on. */
2107 else if (mod_data
.can_stall
) {
2108 fsg_set_halt(fsg
, fsg
->bulk_out
);
2109 raise_exception(fsg
, FSG_STATE_ABORT_BULK_OUT
);
2114 /* We can't stall. Read in the excess data and throw it
2117 rc
= throw_away_data(fsg
);
2124 static int send_status(struct fsg_dev
*fsg
)
2126 struct fsg_lun
*curlun
= fsg
->curlun
;
2127 struct fsg_buffhd
*bh
;
2129 u8 status
= USB_STATUS_PASS
;
2132 /* Wait for the next buffer to become available */
2133 bh
= fsg
->next_buffhd_to_fill
;
2134 while (bh
->state
!= BUF_STATE_EMPTY
) {
2135 rc
= sleep_thread(fsg
);
2141 sd
= curlun
->sense_data
;
2142 sdinfo
= curlun
->sense_data_info
;
2143 } else if (fsg
->bad_lun_okay
)
2146 sd
= SS_LOGICAL_UNIT_NOT_SUPPORTED
;
2148 if (fsg
->phase_error
) {
2149 DBG(fsg
, "sending phase-error status\n");
2150 status
= USB_STATUS_PHASE_ERROR
;
2151 sd
= SS_INVALID_COMMAND
;
2152 } else if (sd
!= SS_NO_SENSE
) {
2153 DBG(fsg
, "sending command-failure status\n");
2154 status
= USB_STATUS_FAIL
;
2155 VDBG(fsg
, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2157 SK(sd
), ASC(sd
), ASCQ(sd
), sdinfo
);
2160 if (transport_is_bbb()) {
2161 struct bulk_cs_wrap
*csw
= bh
->buf
;
2163 /* Store and send the Bulk-only CSW */
2164 csw
->Signature
= cpu_to_le32(USB_BULK_CS_SIG
);
2165 csw
->Tag
= fsg
->tag
;
2166 csw
->Residue
= cpu_to_le32(fsg
->residue
);
2167 csw
->Status
= status
;
2169 bh
->inreq
->length
= USB_BULK_CS_WRAP_LEN
;
2170 bh
->inreq
->zero
= 0;
2171 start_transfer(fsg
, fsg
->bulk_in
, bh
->inreq
,
2172 &bh
->inreq_busy
, &bh
->state
);
2174 } else if (mod_data
.transport_type
== USB_PR_CB
) {
2176 /* Control-Bulk transport has no status phase! */
2179 } else { // USB_PR_CBI
2180 struct interrupt_data
*buf
= bh
->buf
;
2182 /* Store and send the Interrupt data. UFI sends the ASC
2183 * and ASCQ bytes. Everything else sends a Type (which
2184 * is always 0) and the status Value. */
2185 if (mod_data
.protocol_type
== USB_SC_UFI
) {
2186 buf
->bType
= ASC(sd
);
2187 buf
->bValue
= ASCQ(sd
);
2190 buf
->bValue
= status
;
2192 fsg
->intreq
->length
= CBI_INTERRUPT_DATA_LEN
;
2194 fsg
->intr_buffhd
= bh
; // Point to the right buffhd
2195 fsg
->intreq
->buf
= bh
->inreq
->buf
;
2196 fsg
->intreq
->context
= bh
;
2197 start_transfer(fsg
, fsg
->intr_in
, fsg
->intreq
,
2198 &fsg
->intreq_busy
, &bh
->state
);
2201 fsg
->next_buffhd_to_fill
= bh
->next
;
2206 /*-------------------------------------------------------------------------*/
2208 /* Check whether the command is properly formed and whether its data size
2209 * and direction agree with the values we already have. */
2210 static int check_command(struct fsg_dev
*fsg
, int cmnd_size
,
2211 enum data_direction data_dir
, unsigned int mask
,
2212 int needs_medium
, const char *name
)
2215 int lun
= fsg
->cmnd
[1] >> 5;
2216 static const char dirletter
[4] = {'u', 'o', 'i', 'n'};
2218 struct fsg_lun
*curlun
;
2220 /* Adjust the expected cmnd_size for protocol encapsulation padding.
2221 * Transparent SCSI doesn't pad. */
2222 if (protocol_is_scsi())
2225 /* There's some disagreement as to whether RBC pads commands or not.
2226 * We'll play it safe and accept either form. */
2227 else if (mod_data
.protocol_type
== USB_SC_RBC
) {
2228 if (fsg
->cmnd_size
== 12)
2231 /* All the other protocols pad to 12 bytes */
2236 if (fsg
->data_dir
!= DATA_DIR_UNKNOWN
)
2237 sprintf(hdlen
, ", H%c=%u", dirletter
[(int) fsg
->data_dir
],
2239 VDBG(fsg
, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
2240 name
, cmnd_size
, dirletter
[(int) data_dir
],
2241 fsg
->data_size_from_cmnd
, fsg
->cmnd_size
, hdlen
);
2243 /* We can't reply at all until we know the correct data direction
2245 if (fsg
->data_size_from_cmnd
== 0)
2246 data_dir
= DATA_DIR_NONE
;
2247 if (fsg
->data_dir
== DATA_DIR_UNKNOWN
) { // CB or CBI
2248 fsg
->data_dir
= data_dir
;
2249 fsg
->data_size
= fsg
->data_size_from_cmnd
;
2251 } else { // Bulk-only
2252 if (fsg
->data_size
< fsg
->data_size_from_cmnd
) {
2254 /* Host data size < Device data size is a phase error.
2255 * Carry out the command, but only transfer as much
2256 * as we are allowed. */
2257 fsg
->data_size_from_cmnd
= fsg
->data_size
;
2258 fsg
->phase_error
= 1;
2261 fsg
->residue
= fsg
->usb_amount_left
= fsg
->data_size
;
2263 /* Conflicting data directions is a phase error */
2264 if (fsg
->data_dir
!= data_dir
&& fsg
->data_size_from_cmnd
> 0) {
2265 fsg
->phase_error
= 1;
2269 /* Verify the length of the command itself */
2270 if (cmnd_size
!= fsg
->cmnd_size
) {
2272 /* Special case workaround: There are plenty of buggy SCSI
2273 * implementations. Many have issues with cbw->Length
2274 * field passing a wrong command size. For those cases we
2275 * always try to work around the problem by using the length
2276 * sent by the host side provided it is at least as large
2277 * as the correct command length.
2278 * Examples of such cases would be MS-Windows, which issues
2279 * REQUEST SENSE with cbw->Length == 12 where it should
2280 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
2281 * REQUEST SENSE with cbw->Length == 10 where it should
2284 if (cmnd_size
<= fsg
->cmnd_size
) {
2285 DBG(fsg
, "%s is buggy! Expected length %d "
2286 "but we got %d\n", name
,
2287 cmnd_size
, fsg
->cmnd_size
);
2288 cmnd_size
= fsg
->cmnd_size
;
2290 fsg
->phase_error
= 1;
2295 /* Check that the LUN values are consistent */
2296 if (transport_is_bbb()) {
2297 if (fsg
->lun
!= lun
)
2298 DBG(fsg
, "using LUN %d from CBW, "
2299 "not LUN %d from CDB\n",
2302 fsg
->lun
= lun
; // Use LUN from the command
2305 if (fsg
->lun
>= 0 && fsg
->lun
< fsg
->nluns
) {
2306 fsg
->curlun
= curlun
= &fsg
->luns
[fsg
->lun
];
2307 if (fsg
->cmnd
[0] != SC_REQUEST_SENSE
) {
2308 curlun
->sense_data
= SS_NO_SENSE
;
2309 curlun
->sense_data_info
= 0;
2310 curlun
->info_valid
= 0;
2313 fsg
->curlun
= curlun
= NULL
;
2314 fsg
->bad_lun_okay
= 0;
2316 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2317 * to use unsupported LUNs; all others may not. */
2318 if (fsg
->cmnd
[0] != SC_INQUIRY
&&
2319 fsg
->cmnd
[0] != SC_REQUEST_SENSE
) {
2320 DBG(fsg
, "unsupported LUN %d\n", fsg
->lun
);
2325 /* If a unit attention condition exists, only INQUIRY and
2326 * REQUEST SENSE commands are allowed; anything else must fail. */
2327 if (curlun
&& curlun
->unit_attention_data
!= SS_NO_SENSE
&&
2328 fsg
->cmnd
[0] != SC_INQUIRY
&&
2329 fsg
->cmnd
[0] != SC_REQUEST_SENSE
) {
2330 curlun
->sense_data
= curlun
->unit_attention_data
;
2331 curlun
->unit_attention_data
= SS_NO_SENSE
;
2335 /* Check that only command bytes listed in the mask are non-zero */
2336 fsg
->cmnd
[1] &= 0x1f; // Mask away the LUN
2337 for (i
= 1; i
< cmnd_size
; ++i
) {
2338 if (fsg
->cmnd
[i
] && !(mask
& (1 << i
))) {
2340 curlun
->sense_data
= SS_INVALID_FIELD_IN_CDB
;
2345 /* If the medium isn't mounted and the command needs to access
2346 * it, return an error. */
2347 if (curlun
&& !fsg_lun_is_open(curlun
) && needs_medium
) {
2348 curlun
->sense_data
= SS_MEDIUM_NOT_PRESENT
;
2356 static int do_scsi_command(struct fsg_dev
*fsg
)
2358 struct fsg_buffhd
*bh
;
2360 int reply
= -EINVAL
;
2362 static char unknown
[16];
2366 /* Wait for the next buffer to become available for data or status */
2367 bh
= fsg
->next_buffhd_to_drain
= fsg
->next_buffhd_to_fill
;
2368 while (bh
->state
!= BUF_STATE_EMPTY
) {
2369 rc
= sleep_thread(fsg
);
2373 fsg
->phase_error
= 0;
2374 fsg
->short_packet_received
= 0;
2376 down_read(&fsg
->filesem
); // We're using the backing file
2377 switch (fsg
->cmnd
[0]) {
2380 fsg
->data_size_from_cmnd
= fsg
->cmnd
[4];
2381 if ((reply
= check_command(fsg
, 6, DATA_DIR_TO_HOST
,
2384 reply
= do_inquiry(fsg
, bh
);
2387 case SC_MODE_SELECT_6
:
2388 fsg
->data_size_from_cmnd
= fsg
->cmnd
[4];
2389 if ((reply
= check_command(fsg
, 6, DATA_DIR_FROM_HOST
,
2391 "MODE SELECT(6)")) == 0)
2392 reply
= do_mode_select(fsg
, bh
);
2395 case SC_MODE_SELECT_10
:
2396 fsg
->data_size_from_cmnd
= get_unaligned_be16(&fsg
->cmnd
[7]);
2397 if ((reply
= check_command(fsg
, 10, DATA_DIR_FROM_HOST
,
2399 "MODE SELECT(10)")) == 0)
2400 reply
= do_mode_select(fsg
, bh
);
2403 case SC_MODE_SENSE_6
:
2404 fsg
->data_size_from_cmnd
= fsg
->cmnd
[4];
2405 if ((reply
= check_command(fsg
, 6, DATA_DIR_TO_HOST
,
2406 (1<<1) | (1<<2) | (1<<4), 0,
2407 "MODE SENSE(6)")) == 0)
2408 reply
= do_mode_sense(fsg
, bh
);
2411 case SC_MODE_SENSE_10
:
2412 fsg
->data_size_from_cmnd
= get_unaligned_be16(&fsg
->cmnd
[7]);
2413 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2414 (1<<1) | (1<<2) | (3<<7), 0,
2415 "MODE SENSE(10)")) == 0)
2416 reply
= do_mode_sense(fsg
, bh
);
2419 case SC_PREVENT_ALLOW_MEDIUM_REMOVAL
:
2420 fsg
->data_size_from_cmnd
= 0;
2421 if ((reply
= check_command(fsg
, 6, DATA_DIR_NONE
,
2423 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2424 reply
= do_prevent_allow(fsg
);
2429 fsg
->data_size_from_cmnd
= (i
== 0 ? 256 : i
) << 9;
2430 if ((reply
= check_command(fsg
, 6, DATA_DIR_TO_HOST
,
2433 reply
= do_read(fsg
);
2437 fsg
->data_size_from_cmnd
=
2438 get_unaligned_be16(&fsg
->cmnd
[7]) << 9;
2439 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2440 (1<<1) | (0xf<<2) | (3<<7), 1,
2442 reply
= do_read(fsg
);
2446 fsg
->data_size_from_cmnd
=
2447 get_unaligned_be32(&fsg
->cmnd
[6]) << 9;
2448 if ((reply
= check_command(fsg
, 12, DATA_DIR_TO_HOST
,
2449 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2451 reply
= do_read(fsg
);
2454 case SC_READ_CAPACITY
:
2455 fsg
->data_size_from_cmnd
= 8;
2456 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2457 (0xf<<2) | (1<<8), 1,
2458 "READ CAPACITY")) == 0)
2459 reply
= do_read_capacity(fsg
, bh
);
2462 case SC_READ_HEADER
:
2463 if (!mod_data
.cdrom
)
2465 fsg
->data_size_from_cmnd
= get_unaligned_be16(&fsg
->cmnd
[7]);
2466 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2467 (3<<7) | (0x1f<<1), 1,
2468 "READ HEADER")) == 0)
2469 reply
= do_read_header(fsg
, bh
);
2473 if (!mod_data
.cdrom
)
2475 fsg
->data_size_from_cmnd
= get_unaligned_be16(&fsg
->cmnd
[7]);
2476 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2479 reply
= do_read_toc(fsg
, bh
);
2482 case SC_READ_FORMAT_CAPACITIES
:
2483 fsg
->data_size_from_cmnd
= get_unaligned_be16(&fsg
->cmnd
[7]);
2484 if ((reply
= check_command(fsg
, 10, DATA_DIR_TO_HOST
,
2486 "READ FORMAT CAPACITIES")) == 0)
2487 reply
= do_read_format_capacities(fsg
, bh
);
2490 case SC_REQUEST_SENSE
:
2491 fsg
->data_size_from_cmnd
= fsg
->cmnd
[4];
2492 if ((reply
= check_command(fsg
, 6, DATA_DIR_TO_HOST
,
2494 "REQUEST SENSE")) == 0)
2495 reply
= do_request_sense(fsg
, bh
);
2498 case SC_START_STOP_UNIT
:
2499 fsg
->data_size_from_cmnd
= 0;
2500 if ((reply
= check_command(fsg
, 6, DATA_DIR_NONE
,
2502 "START-STOP UNIT")) == 0)
2503 reply
= do_start_stop(fsg
);
2506 case SC_SYNCHRONIZE_CACHE
:
2507 fsg
->data_size_from_cmnd
= 0;
2508 if ((reply
= check_command(fsg
, 10, DATA_DIR_NONE
,
2509 (0xf<<2) | (3<<7), 1,
2510 "SYNCHRONIZE CACHE")) == 0)
2511 reply
= do_synchronize_cache(fsg
);
2514 case SC_TEST_UNIT_READY
:
2515 fsg
->data_size_from_cmnd
= 0;
2516 reply
= check_command(fsg
, 6, DATA_DIR_NONE
,
2521 /* Although optional, this command is used by MS-Windows. We
2522 * support a minimal version: BytChk must be 0. */
2524 fsg
->data_size_from_cmnd
= 0;
2525 if ((reply
= check_command(fsg
, 10, DATA_DIR_NONE
,
2526 (1<<1) | (0xf<<2) | (3<<7), 1,
2528 reply
= do_verify(fsg
);
2533 fsg
->data_size_from_cmnd
= (i
== 0 ? 256 : i
) << 9;
2534 if ((reply
= check_command(fsg
, 6, DATA_DIR_FROM_HOST
,
2537 reply
= do_write(fsg
);
2541 fsg
->data_size_from_cmnd
=
2542 get_unaligned_be16(&fsg
->cmnd
[7]) << 9;
2543 if ((reply
= check_command(fsg
, 10, DATA_DIR_FROM_HOST
,
2544 (1<<1) | (0xf<<2) | (3<<7), 1,
2546 reply
= do_write(fsg
);
2550 fsg
->data_size_from_cmnd
=
2551 get_unaligned_be32(&fsg
->cmnd
[6]) << 9;
2552 if ((reply
= check_command(fsg
, 12, DATA_DIR_FROM_HOST
,
2553 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2555 reply
= do_write(fsg
);
2558 /* Some mandatory commands that we recognize but don't implement.
2559 * They don't mean much in this setting. It's left as an exercise
2560 * for anyone interested to implement RESERVE and RELEASE in terms
2561 * of Posix locks. */
2562 case SC_FORMAT_UNIT
:
2565 case SC_SEND_DIAGNOSTIC
:
2570 fsg
->data_size_from_cmnd
= 0;
2571 sprintf(unknown
, "Unknown x%02x", fsg
->cmnd
[0]);
2572 if ((reply
= check_command(fsg
, fsg
->cmnd_size
,
2573 DATA_DIR_UNKNOWN
, 0xff, 0, unknown
)) == 0) {
2574 fsg
->curlun
->sense_data
= SS_INVALID_COMMAND
;
2579 up_read(&fsg
->filesem
);
2581 if (reply
== -EINTR
|| signal_pending(current
))
2584 /* Set up the single reply buffer for finish_reply() */
2585 if (reply
== -EINVAL
)
2586 reply
= 0; // Error reply length
2587 if (reply
>= 0 && fsg
->data_dir
== DATA_DIR_TO_HOST
) {
2588 reply
= min((u32
) reply
, fsg
->data_size_from_cmnd
);
2589 bh
->inreq
->length
= reply
;
2590 bh
->state
= BUF_STATE_FULL
;
2591 fsg
->residue
-= reply
;
2592 } // Otherwise it's already set
2598 /*-------------------------------------------------------------------------*/
2600 static int received_cbw(struct fsg_dev
*fsg
, struct fsg_buffhd
*bh
)
2602 struct usb_request
*req
= bh
->outreq
;
2603 struct fsg_bulk_cb_wrap
*cbw
= req
->buf
;
2605 /* Was this a real packet? Should it be ignored? */
2606 if (req
->status
|| test_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
))
2609 /* Is the CBW valid? */
2610 if (req
->actual
!= USB_BULK_CB_WRAP_LEN
||
2611 cbw
->Signature
!= cpu_to_le32(
2613 DBG(fsg
, "invalid CBW: len %u sig 0x%x\n",
2615 le32_to_cpu(cbw
->Signature
));
2617 /* The Bulk-only spec says we MUST stall the IN endpoint
2618 * (6.6.1), so it's unavoidable. It also says we must
2619 * retain this state until the next reset, but there's
2620 * no way to tell the controller driver it should ignore
2621 * Clear-Feature(HALT) requests.
2623 * We aren't required to halt the OUT endpoint; instead
2624 * we can simply accept and discard any data received
2625 * until the next reset. */
2626 wedge_bulk_in_endpoint(fsg
);
2627 set_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
);
2631 /* Is the CBW meaningful? */
2632 if (cbw
->Lun
>= FSG_MAX_LUNS
|| cbw
->Flags
& ~USB_BULK_IN_FLAG
||
2633 cbw
->Length
<= 0 || cbw
->Length
> MAX_COMMAND_SIZE
) {
2634 DBG(fsg
, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2636 cbw
->Lun
, cbw
->Flags
, cbw
->Length
);
2638 /* We can do anything we want here, so let's stall the
2639 * bulk pipes if we are allowed to. */
2640 if (mod_data
.can_stall
) {
2641 fsg_set_halt(fsg
, fsg
->bulk_out
);
2642 halt_bulk_in_endpoint(fsg
);
2647 /* Save the command for later */
2648 fsg
->cmnd_size
= cbw
->Length
;
2649 memcpy(fsg
->cmnd
, cbw
->CDB
, fsg
->cmnd_size
);
2650 if (cbw
->Flags
& USB_BULK_IN_FLAG
)
2651 fsg
->data_dir
= DATA_DIR_TO_HOST
;
2653 fsg
->data_dir
= DATA_DIR_FROM_HOST
;
2654 fsg
->data_size
= le32_to_cpu(cbw
->DataTransferLength
);
2655 if (fsg
->data_size
== 0)
2656 fsg
->data_dir
= DATA_DIR_NONE
;
2657 fsg
->lun
= cbw
->Lun
;
2658 fsg
->tag
= cbw
->Tag
;
2663 static int get_next_command(struct fsg_dev
*fsg
)
2665 struct fsg_buffhd
*bh
;
2668 if (transport_is_bbb()) {
2670 /* Wait for the next buffer to become available */
2671 bh
= fsg
->next_buffhd_to_fill
;
2672 while (bh
->state
!= BUF_STATE_EMPTY
) {
2673 rc
= sleep_thread(fsg
);
2678 /* Queue a request to read a Bulk-only CBW */
2679 set_bulk_out_req_length(fsg
, bh
, USB_BULK_CB_WRAP_LEN
);
2680 bh
->outreq
->short_not_ok
= 1;
2681 start_transfer(fsg
, fsg
->bulk_out
, bh
->outreq
,
2682 &bh
->outreq_busy
, &bh
->state
);
2684 /* We will drain the buffer in software, which means we
2685 * can reuse it for the next filling. No need to advance
2686 * next_buffhd_to_fill. */
2688 /* Wait for the CBW to arrive */
2689 while (bh
->state
!= BUF_STATE_FULL
) {
2690 rc
= sleep_thread(fsg
);
2695 rc
= received_cbw(fsg
, bh
);
2696 bh
->state
= BUF_STATE_EMPTY
;
2698 } else { // USB_PR_CB or USB_PR_CBI
2700 /* Wait for the next command to arrive */
2701 while (fsg
->cbbuf_cmnd_size
== 0) {
2702 rc
= sleep_thread(fsg
);
2707 /* Is the previous status interrupt request still busy?
2708 * The host is allowed to skip reading the status,
2709 * so we must cancel it. */
2710 if (fsg
->intreq_busy
)
2711 usb_ep_dequeue(fsg
->intr_in
, fsg
->intreq
);
2713 /* Copy the command and mark the buffer empty */
2714 fsg
->data_dir
= DATA_DIR_UNKNOWN
;
2715 spin_lock_irq(&fsg
->lock
);
2716 fsg
->cmnd_size
= fsg
->cbbuf_cmnd_size
;
2717 memcpy(fsg
->cmnd
, fsg
->cbbuf_cmnd
, fsg
->cmnd_size
);
2718 fsg
->cbbuf_cmnd_size
= 0;
2719 spin_unlock_irq(&fsg
->lock
);
2725 /*-------------------------------------------------------------------------*/
2727 static int enable_endpoint(struct fsg_dev
*fsg
, struct usb_ep
*ep
,
2728 const struct usb_endpoint_descriptor
*d
)
2732 ep
->driver_data
= fsg
;
2733 rc
= usb_ep_enable(ep
, d
);
2735 ERROR(fsg
, "can't enable %s, result %d\n", ep
->name
, rc
);
2739 static int alloc_request(struct fsg_dev
*fsg
, struct usb_ep
*ep
,
2740 struct usb_request
**preq
)
2742 *preq
= usb_ep_alloc_request(ep
, GFP_ATOMIC
);
2745 ERROR(fsg
, "can't allocate request for %s\n", ep
->name
);
2750 * Reset interface setting and re-init endpoint state (toggle etc).
2751 * Call with altsetting < 0 to disable the interface. The only other
2752 * available altsetting is 0, which enables the interface.
2754 static int do_set_interface(struct fsg_dev
*fsg
, int altsetting
)
2758 const struct usb_endpoint_descriptor
*d
;
2761 DBG(fsg
, "reset interface\n");
2764 /* Deallocate the requests */
2765 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2766 struct fsg_buffhd
*bh
= &fsg
->buffhds
[i
];
2769 usb_ep_free_request(fsg
->bulk_in
, bh
->inreq
);
2773 usb_ep_free_request(fsg
->bulk_out
, bh
->outreq
);
2778 usb_ep_free_request(fsg
->intr_in
, fsg
->intreq
);
2782 /* Disable the endpoints */
2783 if (fsg
->bulk_in_enabled
) {
2784 usb_ep_disable(fsg
->bulk_in
);
2785 fsg
->bulk_in_enabled
= 0;
2787 if (fsg
->bulk_out_enabled
) {
2788 usb_ep_disable(fsg
->bulk_out
);
2789 fsg
->bulk_out_enabled
= 0;
2791 if (fsg
->intr_in_enabled
) {
2792 usb_ep_disable(fsg
->intr_in
);
2793 fsg
->intr_in_enabled
= 0;
2797 if (altsetting
< 0 || rc
!= 0)
2800 DBG(fsg
, "set interface %d\n", altsetting
);
2802 /* Enable the endpoints */
2803 d
= fsg_ep_desc(fsg
->gadget
,
2804 &fsg_fs_bulk_in_desc
, &fsg_hs_bulk_in_desc
);
2805 if ((rc
= enable_endpoint(fsg
, fsg
->bulk_in
, d
)) != 0)
2807 fsg
->bulk_in_enabled
= 1;
2809 d
= fsg_ep_desc(fsg
->gadget
,
2810 &fsg_fs_bulk_out_desc
, &fsg_hs_bulk_out_desc
);
2811 if ((rc
= enable_endpoint(fsg
, fsg
->bulk_out
, d
)) != 0)
2813 fsg
->bulk_out_enabled
= 1;
2814 fsg
->bulk_out_maxpacket
= le16_to_cpu(d
->wMaxPacketSize
);
2815 clear_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
);
2817 if (transport_is_cbi()) {
2818 d
= fsg_ep_desc(fsg
->gadget
,
2819 &fsg_fs_intr_in_desc
, &fsg_hs_intr_in_desc
);
2820 if ((rc
= enable_endpoint(fsg
, fsg
->intr_in
, d
)) != 0)
2822 fsg
->intr_in_enabled
= 1;
2825 /* Allocate the requests */
2826 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2827 struct fsg_buffhd
*bh
= &fsg
->buffhds
[i
];
2829 if ((rc
= alloc_request(fsg
, fsg
->bulk_in
, &bh
->inreq
)) != 0)
2831 if ((rc
= alloc_request(fsg
, fsg
->bulk_out
, &bh
->outreq
)) != 0)
2833 bh
->inreq
->buf
= bh
->outreq
->buf
= bh
->buf
;
2834 bh
->inreq
->context
= bh
->outreq
->context
= bh
;
2835 bh
->inreq
->complete
= bulk_in_complete
;
2836 bh
->outreq
->complete
= bulk_out_complete
;
2838 if (transport_is_cbi()) {
2839 if ((rc
= alloc_request(fsg
, fsg
->intr_in
, &fsg
->intreq
)) != 0)
2841 fsg
->intreq
->complete
= intr_in_complete
;
2845 for (i
= 0; i
< fsg
->nluns
; ++i
)
2846 fsg
->luns
[i
].unit_attention_data
= SS_RESET_OCCURRED
;
2852 * Change our operational configuration. This code must agree with the code
2853 * that returns config descriptors, and with interface altsetting code.
2855 * It's also responsible for power management interactions. Some
2856 * configurations might not work with our current power sources.
2857 * For now we just assume the gadget is always self-powered.
2859 static int do_set_config(struct fsg_dev
*fsg
, u8 new_config
)
2863 /* Disable the single interface */
2864 if (fsg
->config
!= 0) {
2865 DBG(fsg
, "reset config\n");
2867 rc
= do_set_interface(fsg
, -1);
2870 /* Enable the interface */
2871 if (new_config
!= 0) {
2872 fsg
->config
= new_config
;
2873 if ((rc
= do_set_interface(fsg
, 0)) != 0)
2874 fsg
->config
= 0; // Reset on errors
2878 switch (fsg
->gadget
->speed
) {
2879 case USB_SPEED_LOW
: speed
= "low"; break;
2880 case USB_SPEED_FULL
: speed
= "full"; break;
2881 case USB_SPEED_HIGH
: speed
= "high"; break;
2882 default: speed
= "?"; break;
2884 INFO(fsg
, "%s speed config #%d\n", speed
, fsg
->config
);
2891 /*-------------------------------------------------------------------------*/
2893 static void handle_exception(struct fsg_dev
*fsg
)
2899 struct fsg_buffhd
*bh
;
2900 enum fsg_state old_state
;
2902 struct fsg_lun
*curlun
;
2903 unsigned int exception_req_tag
;
2906 /* Clear the existing signals. Anything but SIGUSR1 is converted
2907 * into a high-priority EXIT exception. */
2909 sig
= dequeue_signal_lock(current
, ¤t
->blocked
, &info
);
2912 if (sig
!= SIGUSR1
) {
2913 if (fsg
->state
< FSG_STATE_EXIT
)
2914 DBG(fsg
, "Main thread exiting on signal\n");
2915 raise_exception(fsg
, FSG_STATE_EXIT
);
2919 /* Cancel all the pending transfers */
2920 if (fsg
->intreq_busy
)
2921 usb_ep_dequeue(fsg
->intr_in
, fsg
->intreq
);
2922 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2923 bh
= &fsg
->buffhds
[i
];
2925 usb_ep_dequeue(fsg
->bulk_in
, bh
->inreq
);
2926 if (bh
->outreq_busy
)
2927 usb_ep_dequeue(fsg
->bulk_out
, bh
->outreq
);
2930 /* Wait until everything is idle */
2932 num_active
= fsg
->intreq_busy
;
2933 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2934 bh
= &fsg
->buffhds
[i
];
2935 num_active
+= bh
->inreq_busy
+ bh
->outreq_busy
;
2937 if (num_active
== 0)
2939 if (sleep_thread(fsg
))
2943 /* Clear out the controller's fifos */
2944 if (fsg
->bulk_in_enabled
)
2945 usb_ep_fifo_flush(fsg
->bulk_in
);
2946 if (fsg
->bulk_out_enabled
)
2947 usb_ep_fifo_flush(fsg
->bulk_out
);
2948 if (fsg
->intr_in_enabled
)
2949 usb_ep_fifo_flush(fsg
->intr_in
);
2951 /* Reset the I/O buffer states and pointers, the SCSI
2952 * state, and the exception. Then invoke the handler. */
2953 spin_lock_irq(&fsg
->lock
);
2955 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
2956 bh
= &fsg
->buffhds
[i
];
2957 bh
->state
= BUF_STATE_EMPTY
;
2959 fsg
->next_buffhd_to_fill
= fsg
->next_buffhd_to_drain
=
2962 exception_req_tag
= fsg
->exception_req_tag
;
2963 new_config
= fsg
->new_config
;
2964 old_state
= fsg
->state
;
2966 if (old_state
== FSG_STATE_ABORT_BULK_OUT
)
2967 fsg
->state
= FSG_STATE_STATUS_PHASE
;
2969 for (i
= 0; i
< fsg
->nluns
; ++i
) {
2970 curlun
= &fsg
->luns
[i
];
2971 curlun
->prevent_medium_removal
= 0;
2972 curlun
->sense_data
= curlun
->unit_attention_data
=
2974 curlun
->sense_data_info
= 0;
2975 curlun
->info_valid
= 0;
2977 fsg
->state
= FSG_STATE_IDLE
;
2979 spin_unlock_irq(&fsg
->lock
);
2981 /* Carry out any extra actions required for the exception */
2982 switch (old_state
) {
2986 case FSG_STATE_ABORT_BULK_OUT
:
2988 spin_lock_irq(&fsg
->lock
);
2989 if (fsg
->state
== FSG_STATE_STATUS_PHASE
)
2990 fsg
->state
= FSG_STATE_IDLE
;
2991 spin_unlock_irq(&fsg
->lock
);
2994 case FSG_STATE_RESET
:
2995 /* In case we were forced against our will to halt a
2996 * bulk endpoint, clear the halt now. (The SuperH UDC
2997 * requires this.) */
2998 if (test_and_clear_bit(IGNORE_BULK_OUT
, &fsg
->atomic_bitflags
))
2999 usb_ep_clear_halt(fsg
->bulk_in
);
3001 if (transport_is_bbb()) {
3002 if (fsg
->ep0_req_tag
== exception_req_tag
)
3003 ep0_queue(fsg
); // Complete the status stage
3005 } else if (transport_is_cbi())
3006 send_status(fsg
); // Status by interrupt pipe
3008 /* Technically this should go here, but it would only be
3009 * a waste of time. Ditto for the INTERFACE_CHANGE and
3010 * CONFIG_CHANGE cases. */
3011 // for (i = 0; i < fsg->nluns; ++i)
3012 // fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3015 case FSG_STATE_INTERFACE_CHANGE
:
3016 rc
= do_set_interface(fsg
, 0);
3017 if (fsg
->ep0_req_tag
!= exception_req_tag
)
3019 if (rc
!= 0) // STALL on errors
3020 fsg_set_halt(fsg
, fsg
->ep0
);
3021 else // Complete the status stage
3025 case FSG_STATE_CONFIG_CHANGE
:
3026 rc
= do_set_config(fsg
, new_config
);
3027 if (fsg
->ep0_req_tag
!= exception_req_tag
)
3029 if (rc
!= 0) // STALL on errors
3030 fsg_set_halt(fsg
, fsg
->ep0
);
3031 else // Complete the status stage
3035 case FSG_STATE_DISCONNECT
:
3036 for (i
= 0; i
< fsg
->nluns
; ++i
)
3037 fsg_lun_fsync_sub(fsg
->luns
+ i
);
3038 do_set_config(fsg
, 0); // Unconfigured state
3041 case FSG_STATE_EXIT
:
3042 case FSG_STATE_TERMINATED
:
3043 do_set_config(fsg
, 0); // Free resources
3044 spin_lock_irq(&fsg
->lock
);
3045 fsg
->state
= FSG_STATE_TERMINATED
; // Stop the thread
3046 spin_unlock_irq(&fsg
->lock
);
3052 /*-------------------------------------------------------------------------*/
3054 static int fsg_main_thread(void *fsg_
)
3056 struct fsg_dev
*fsg
= fsg_
;
3058 /* Allow the thread to be killed by a signal, but set the signal mask
3059 * to block everything but INT, TERM, KILL, and USR1. */
3060 allow_signal(SIGINT
);
3061 allow_signal(SIGTERM
);
3062 allow_signal(SIGKILL
);
3063 allow_signal(SIGUSR1
);
3065 /* Allow the thread to be frozen */
3068 /* Arrange for userspace references to be interpreted as kernel
3069 * pointers. That way we can pass a kernel pointer to a routine
3070 * that expects a __user pointer and it will work okay. */
3074 while (fsg
->state
!= FSG_STATE_TERMINATED
) {
3075 if (exception_in_progress(fsg
) || signal_pending(current
)) {
3076 handle_exception(fsg
);
3080 if (!fsg
->running
) {
3085 if (get_next_command(fsg
))
3088 spin_lock_irq(&fsg
->lock
);
3089 if (!exception_in_progress(fsg
))
3090 fsg
->state
= FSG_STATE_DATA_PHASE
;
3091 spin_unlock_irq(&fsg
->lock
);
3093 if (do_scsi_command(fsg
) || finish_reply(fsg
))
3096 spin_lock_irq(&fsg
->lock
);
3097 if (!exception_in_progress(fsg
))
3098 fsg
->state
= FSG_STATE_STATUS_PHASE
;
3099 spin_unlock_irq(&fsg
->lock
);
3101 if (send_status(fsg
))
3104 spin_lock_irq(&fsg
->lock
);
3105 if (!exception_in_progress(fsg
))
3106 fsg
->state
= FSG_STATE_IDLE
;
3107 spin_unlock_irq(&fsg
->lock
);
3110 spin_lock_irq(&fsg
->lock
);
3111 fsg
->thread_task
= NULL
;
3112 spin_unlock_irq(&fsg
->lock
);
3114 /* If we are exiting because of a signal, unregister the
3116 if (test_and_clear_bit(REGISTERED
, &fsg
->atomic_bitflags
))
3117 usb_gadget_unregister_driver(&fsg_driver
);
3119 /* Let the unbind and cleanup routines know the thread has exited */
3120 complete_and_exit(&fsg
->thread_notifier
, 0);
3124 /*-------------------------------------------------------------------------*/
3127 /* The write permissions and store_xxx pointers are set in fsg_bind() */
3128 static DEVICE_ATTR(ro
, 0444, fsg_show_ro
, NULL
);
3129 static DEVICE_ATTR(file
, 0444, fsg_show_file
, NULL
);
3132 /*-------------------------------------------------------------------------*/
3134 static void fsg_release(struct kref
*ref
)
3136 struct fsg_dev
*fsg
= container_of(ref
, struct fsg_dev
, ref
);
3142 static void lun_release(struct device
*dev
)
3144 struct rw_semaphore
*filesem
= dev_get_drvdata(dev
);
3145 struct fsg_dev
*fsg
=
3146 container_of(filesem
, struct fsg_dev
, filesem
);
3148 kref_put(&fsg
->ref
, fsg_release
);
3151 static void /* __init_or_exit */ fsg_unbind(struct usb_gadget
*gadget
)
3153 struct fsg_dev
*fsg
= get_gadget_data(gadget
);
3155 struct fsg_lun
*curlun
;
3156 struct usb_request
*req
= fsg
->ep0req
;
3158 DBG(fsg
, "unbind\n");
3159 clear_bit(REGISTERED
, &fsg
->atomic_bitflags
);
3161 /* Unregister the sysfs attribute files and the LUNs */
3162 for (i
= 0; i
< fsg
->nluns
; ++i
) {
3163 curlun
= &fsg
->luns
[i
];
3164 if (curlun
->registered
) {
3165 device_remove_file(&curlun
->dev
, &dev_attr_ro
);
3166 device_remove_file(&curlun
->dev
, &dev_attr_file
);
3167 fsg_lun_close(curlun
);
3168 device_unregister(&curlun
->dev
);
3169 curlun
->registered
= 0;
3173 /* If the thread isn't already dead, tell it to exit now */
3174 if (fsg
->state
!= FSG_STATE_TERMINATED
) {
3175 raise_exception(fsg
, FSG_STATE_EXIT
);
3176 wait_for_completion(&fsg
->thread_notifier
);
3178 /* The cleanup routine waits for this completion also */
3179 complete(&fsg
->thread_notifier
);
3182 /* Free the data buffers */
3183 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
)
3184 kfree(fsg
->buffhds
[i
].buf
);
3186 /* Free the request and buffer for endpoint 0 */
3189 usb_ep_free_request(fsg
->ep0
, req
);
3192 set_gadget_data(gadget
, NULL
);
3196 static int __init
check_parameters(struct fsg_dev
*fsg
)
3201 /* Store the default values */
3202 mod_data
.transport_type
= USB_PR_BULK
;
3203 mod_data
.transport_name
= "Bulk-only";
3204 mod_data
.protocol_type
= USB_SC_SCSI
;
3205 mod_data
.protocol_name
= "Transparent SCSI";
3207 /* Some peripheral controllers are known not to be able to
3208 * halt bulk endpoints correctly. If one of them is present,
3211 if (gadget_is_at91(fsg
->gadget
))
3212 mod_data
.can_stall
= 0;
3214 if (mod_data
.release
== 0xffff) { // Parameter wasn't set
3215 gcnum
= usb_gadget_controller_number(fsg
->gadget
);
3217 mod_data
.release
= 0x0300 + gcnum
;
3219 WARNING(fsg
, "controller '%s' not recognized\n",
3221 mod_data
.release
= 0x0399;
3225 prot
= simple_strtol(mod_data
.protocol_parm
, NULL
, 0);
3227 #ifdef CONFIG_USB_FILE_STORAGE_TEST
3228 if (strnicmp(mod_data
.transport_parm
, "BBB", 10) == 0) {
3229 ; // Use default setting
3230 } else if (strnicmp(mod_data
.transport_parm
, "CB", 10) == 0) {
3231 mod_data
.transport_type
= USB_PR_CB
;
3232 mod_data
.transport_name
= "Control-Bulk";
3233 } else if (strnicmp(mod_data
.transport_parm
, "CBI", 10) == 0) {
3234 mod_data
.transport_type
= USB_PR_CBI
;
3235 mod_data
.transport_name
= "Control-Bulk-Interrupt";
3237 ERROR(fsg
, "invalid transport: %s\n", mod_data
.transport_parm
);
3241 if (strnicmp(mod_data
.protocol_parm
, "SCSI", 10) == 0 ||
3242 prot
== USB_SC_SCSI
) {
3243 ; // Use default setting
3244 } else if (strnicmp(mod_data
.protocol_parm
, "RBC", 10) == 0 ||
3245 prot
== USB_SC_RBC
) {
3246 mod_data
.protocol_type
= USB_SC_RBC
;
3247 mod_data
.protocol_name
= "RBC";
3248 } else if (strnicmp(mod_data
.protocol_parm
, "8020", 4) == 0 ||
3249 strnicmp(mod_data
.protocol_parm
, "ATAPI", 10) == 0 ||
3250 prot
== USB_SC_8020
) {
3251 mod_data
.protocol_type
= USB_SC_8020
;
3252 mod_data
.protocol_name
= "8020i (ATAPI)";
3253 } else if (strnicmp(mod_data
.protocol_parm
, "QIC", 3) == 0 ||
3254 prot
== USB_SC_QIC
) {
3255 mod_data
.protocol_type
= USB_SC_QIC
;
3256 mod_data
.protocol_name
= "QIC-157";
3257 } else if (strnicmp(mod_data
.protocol_parm
, "UFI", 10) == 0 ||
3258 prot
== USB_SC_UFI
) {
3259 mod_data
.protocol_type
= USB_SC_UFI
;
3260 mod_data
.protocol_name
= "UFI";
3261 } else if (strnicmp(mod_data
.protocol_parm
, "8070", 4) == 0 ||
3262 prot
== USB_SC_8070
) {
3263 mod_data
.protocol_type
= USB_SC_8070
;
3264 mod_data
.protocol_name
= "8070i";
3266 ERROR(fsg
, "invalid protocol: %s\n", mod_data
.protocol_parm
);
3270 mod_data
.buflen
&= PAGE_CACHE_MASK
;
3271 if (mod_data
.buflen
<= 0) {
3272 ERROR(fsg
, "invalid buflen\n");
3275 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
3281 static int __init
fsg_bind(struct usb_gadget
*gadget
)
3283 struct fsg_dev
*fsg
= the_fsg
;
3286 struct fsg_lun
*curlun
;
3288 struct usb_request
*req
;
3291 fsg
->gadget
= gadget
;
3292 set_gadget_data(gadget
, fsg
);
3293 fsg
->ep0
= gadget
->ep0
;
3294 fsg
->ep0
->driver_data
= fsg
;
3296 if ((rc
= check_parameters(fsg
)) != 0)
3299 if (mod_data
.removable
) { // Enable the store_xxx attributes
3300 dev_attr_file
.attr
.mode
= 0644;
3301 dev_attr_file
.store
= fsg_store_file
;
3302 if (!mod_data
.cdrom
) {
3303 dev_attr_ro
.attr
.mode
= 0644;
3304 dev_attr_ro
.store
= fsg_store_ro
;
3308 /* Find out how many LUNs there should be */
3311 i
= max(mod_data
.num_filenames
, 1u);
3312 if (i
> FSG_MAX_LUNS
) {
3313 ERROR(fsg
, "invalid number of LUNs: %d\n", i
);
3318 /* Create the LUNs, open their backing files, and register the
3319 * LUN devices in sysfs. */
3320 fsg
->luns
= kzalloc(i
* sizeof(struct fsg_lun
), GFP_KERNEL
);
3327 for (i
= 0; i
< fsg
->nluns
; ++i
) {
3328 curlun
= &fsg
->luns
[i
];
3329 curlun
->cdrom
= !!mod_data
.cdrom
;
3330 curlun
->ro
= mod_data
.cdrom
|| mod_data
.ro
[i
];
3331 curlun
->initially_ro
= curlun
->ro
;
3332 curlun
->removable
= mod_data
.removable
;
3333 curlun
->dev
.release
= lun_release
;
3334 curlun
->dev
.parent
= &gadget
->dev
;
3335 curlun
->dev
.driver
= &fsg_driver
.driver
;
3336 dev_set_drvdata(&curlun
->dev
, &fsg
->filesem
);
3337 dev_set_name(&curlun
->dev
,"%s-lun%d",
3338 dev_name(&gadget
->dev
), i
);
3340 if ((rc
= device_register(&curlun
->dev
)) != 0) {
3341 INFO(fsg
, "failed to register LUN%d: %d\n", i
, rc
);
3344 if ((rc
= device_create_file(&curlun
->dev
,
3345 &dev_attr_ro
)) != 0 ||
3346 (rc
= device_create_file(&curlun
->dev
,
3347 &dev_attr_file
)) != 0) {
3348 device_unregister(&curlun
->dev
);
3351 curlun
->registered
= 1;
3352 kref_get(&fsg
->ref
);
3354 if (mod_data
.file
[i
] && *mod_data
.file
[i
]) {
3355 if ((rc
= fsg_lun_open(curlun
,
3356 mod_data
.file
[i
])) != 0)
3358 } else if (!mod_data
.removable
) {
3359 ERROR(fsg
, "no file given for LUN%d\n", i
);
3365 /* Find all the endpoints we will use */
3366 usb_ep_autoconfig_reset(gadget
);
3367 ep
= usb_ep_autoconfig(gadget
, &fsg_fs_bulk_in_desc
);
3370 ep
->driver_data
= fsg
; // claim the endpoint
3373 ep
= usb_ep_autoconfig(gadget
, &fsg_fs_bulk_out_desc
);
3376 ep
->driver_data
= fsg
; // claim the endpoint
3379 if (transport_is_cbi()) {
3380 ep
= usb_ep_autoconfig(gadget
, &fsg_fs_intr_in_desc
);
3383 ep
->driver_data
= fsg
; // claim the endpoint
3387 /* Fix up the descriptors */
3388 device_desc
.bMaxPacketSize0
= fsg
->ep0
->maxpacket
;
3389 device_desc
.idVendor
= cpu_to_le16(mod_data
.vendor
);
3390 device_desc
.idProduct
= cpu_to_le16(mod_data
.product
);
3391 device_desc
.bcdDevice
= cpu_to_le16(mod_data
.release
);
3393 i
= (transport_is_cbi() ? 3 : 2); // Number of endpoints
3394 fsg_intf_desc
.bNumEndpoints
= i
;
3395 fsg_intf_desc
.bInterfaceSubClass
= mod_data
.protocol_type
;
3396 fsg_intf_desc
.bInterfaceProtocol
= mod_data
.transport_type
;
3397 fsg_fs_function
[i
+ FSG_FS_FUNCTION_PRE_EP_ENTRIES
] = NULL
;
3399 if (gadget_is_dualspeed(gadget
)) {
3400 fsg_hs_function
[i
+ FSG_HS_FUNCTION_PRE_EP_ENTRIES
] = NULL
;
3402 /* Assume ep0 uses the same maxpacket value for both speeds */
3403 dev_qualifier
.bMaxPacketSize0
= fsg
->ep0
->maxpacket
;
3405 /* Assume endpoint addresses are the same for both speeds */
3406 fsg_hs_bulk_in_desc
.bEndpointAddress
=
3407 fsg_fs_bulk_in_desc
.bEndpointAddress
;
3408 fsg_hs_bulk_out_desc
.bEndpointAddress
=
3409 fsg_fs_bulk_out_desc
.bEndpointAddress
;
3410 fsg_hs_intr_in_desc
.bEndpointAddress
=
3411 fsg_fs_intr_in_desc
.bEndpointAddress
;
3414 if (gadget_is_otg(gadget
))
3415 fsg_otg_desc
.bmAttributes
|= USB_OTG_HNP
;
3419 /* Allocate the request and buffer for endpoint 0 */
3420 fsg
->ep0req
= req
= usb_ep_alloc_request(fsg
->ep0
, GFP_KERNEL
);
3423 req
->buf
= kmalloc(EP0_BUFSIZE
, GFP_KERNEL
);
3426 req
->complete
= ep0_complete
;
3428 /* Allocate the data buffers */
3429 for (i
= 0; i
< FSG_NUM_BUFFERS
; ++i
) {
3430 struct fsg_buffhd
*bh
= &fsg
->buffhds
[i
];
3432 /* Allocate for the bulk-in endpoint. We assume that
3433 * the buffer will also work with the bulk-out (and
3434 * interrupt-in) endpoint. */
3435 bh
->buf
= kmalloc(mod_data
.buflen
, GFP_KERNEL
);
3440 fsg
->buffhds
[FSG_NUM_BUFFERS
- 1].next
= &fsg
->buffhds
[0];
3442 /* This should reflect the actual gadget power source */
3443 usb_gadget_set_selfpowered(gadget
);
3445 snprintf(fsg_string_manufacturer
, sizeof fsg_string_manufacturer
,
3447 init_utsname()->sysname
, init_utsname()->release
,
3450 /* On a real device, serial[] would be loaded from permanent
3451 * storage. We just encode it from the driver version string. */
3452 for (i
= 0; i
< sizeof fsg_string_serial
- 2; i
+= 2) {
3453 unsigned char c
= DRIVER_VERSION
[i
/ 2];
3457 sprintf(&fsg_string_serial
[i
], "%02X", c
);
3460 fsg
->thread_task
= kthread_create(fsg_main_thread
, fsg
,
3461 "file-storage-gadget");
3462 if (IS_ERR(fsg
->thread_task
)) {
3463 rc
= PTR_ERR(fsg
->thread_task
);
3467 INFO(fsg
, DRIVER_DESC
", version: " DRIVER_VERSION
"\n");
3468 INFO(fsg
, "Number of LUNs=%d\n", fsg
->nluns
);
3470 pathbuf
= kmalloc(PATH_MAX
, GFP_KERNEL
);
3471 for (i
= 0; i
< fsg
->nluns
; ++i
) {
3472 curlun
= &fsg
->luns
[i
];
3473 if (fsg_lun_is_open(curlun
)) {
3476 p
= d_path(&curlun
->filp
->f_path
,
3481 LINFO(curlun
, "ro=%d, file: %s\n",
3482 curlun
->ro
, (p
? p
: "(error)"));
3487 DBG(fsg
, "transport=%s (x%02x)\n",
3488 mod_data
.transport_name
, mod_data
.transport_type
);
3489 DBG(fsg
, "protocol=%s (x%02x)\n",
3490 mod_data
.protocol_name
, mod_data
.protocol_type
);
3491 DBG(fsg
, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
3492 mod_data
.vendor
, mod_data
.product
, mod_data
.release
);
3493 DBG(fsg
, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
3494 mod_data
.removable
, mod_data
.can_stall
,
3495 mod_data
.cdrom
, mod_data
.buflen
);
3496 DBG(fsg
, "I/O thread pid: %d\n", task_pid_nr(fsg
->thread_task
));
3498 set_bit(REGISTERED
, &fsg
->atomic_bitflags
);
3500 /* Tell the thread to start working */
3501 wake_up_process(fsg
->thread_task
);
3505 ERROR(fsg
, "unable to autoconfigure all endpoints\n");
3509 fsg
->state
= FSG_STATE_TERMINATED
; // The thread is dead
3511 complete(&fsg
->thread_notifier
);
3516 /*-------------------------------------------------------------------------*/
3518 static void fsg_suspend(struct usb_gadget
*gadget
)
3520 struct fsg_dev
*fsg
= get_gadget_data(gadget
);
3522 DBG(fsg
, "suspend\n");
3523 set_bit(SUSPENDED
, &fsg
->atomic_bitflags
);
3526 static void fsg_resume(struct usb_gadget
*gadget
)
3528 struct fsg_dev
*fsg
= get_gadget_data(gadget
);
3530 DBG(fsg
, "resume\n");
3531 clear_bit(SUSPENDED
, &fsg
->atomic_bitflags
);
3535 /*-------------------------------------------------------------------------*/
3537 static struct usb_gadget_driver fsg_driver
= {
3538 #ifdef CONFIG_USB_GADGET_DUALSPEED
3539 .speed
= USB_SPEED_HIGH
,
3541 .speed
= USB_SPEED_FULL
,
3543 .function
= (char *) fsg_string_product
,
3545 .unbind
= fsg_unbind
,
3546 .disconnect
= fsg_disconnect
,
3548 .suspend
= fsg_suspend
,
3549 .resume
= fsg_resume
,
3552 .name
= DRIVER_NAME
,
3553 .owner
= THIS_MODULE
,
3561 static int __init
fsg_alloc(void)
3563 struct fsg_dev
*fsg
;
3565 fsg
= kzalloc(sizeof *fsg
, GFP_KERNEL
);
3568 spin_lock_init(&fsg
->lock
);
3569 init_rwsem(&fsg
->filesem
);
3570 kref_init(&fsg
->ref
);
3571 init_completion(&fsg
->thread_notifier
);
3578 static int __init
fsg_init(void)
3581 struct fsg_dev
*fsg
;
3583 if ((rc
= fsg_alloc()) != 0)
3586 if ((rc
= usb_gadget_register_driver(&fsg_driver
)) != 0)
3587 kref_put(&fsg
->ref
, fsg_release
);
3590 module_init(fsg_init
);
3593 static void __exit
fsg_cleanup(void)
3595 struct fsg_dev
*fsg
= the_fsg
;
3597 /* Unregister the driver iff the thread hasn't already done so */
3598 if (test_and_clear_bit(REGISTERED
, &fsg
->atomic_bitflags
))
3599 usb_gadget_unregister_driver(&fsg_driver
);
3601 /* Wait for the thread to finish up */
3602 wait_for_completion(&fsg
->thread_notifier
);
3604 kref_put(&fsg
->ref
, fsg_release
);
3606 module_exit(fsg_cleanup
);