* [PATCH 0/3] usbgadget: add support for blocking USB mass storage gadget
@ 2021-02-15 10:27 Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 1/3] include: <linux/barebox-wrapper.h>: remove kthread 'replacements' Ahmad Fatoum
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Ahmad Fatoum @ 2021-02-15 10:27 UTC (permalink / raw)
To: barebox
The barebox model for USB gadgets is that the UDC gadget polling
is done in a poller. These are short sections of code that are
scheduled cooperatively whenever the main "thread" enters a delay loop.
When transfers are completed, callbacks are run, which trigger new
transfers and/or offload work into a workqueue.
The Linux driver for the USB mass storage gadget creates a state
machine thread. This threads runs as long as there's work to do and
then sleeps for new USB transfers to complete. As U-Boot doesn't
have a threading facility, the U-Boot driver based on it runs this
thread in a blocking loop.
This series adds this functionality to barebox as well. It can be used
by running e.g. ums /dev/mmc1(mmc),/dev/mmc2(sd). Until ctrl+C arrives,
this blocks anything else, except for pollers, from running.
The usual way to make this non-blocking, would be to break up the main
thread into chunks whereever it's sleeping and trigger a poller or
workqueue to continue, when new data arrives. Instead of reworking the
original code flow, I experimented with transforming pollers into actual
cooperative (green) threads. This will likely need some discussion to
decide on how to proceed with it, so this series adds the base, blocking,
funcionality.
Cheers,
Ahmad Fatoum (3):
include: <linux/barebox-wrapper.h>: remove kthread 'replacements'
console: unconditionally run poller_call in ctrlc()
usbgadget: add support for USB mass storage gadget
commands/Makefile | 1 +
commands/ums.c | 53 +
common/console.c | 4 +-
drivers/mtd/ubi/ubi-barebox.h | 2 -
drivers/usb/gadget/Kconfig | 11 +
drivers/usb/gadget/Makefile | 1 +
drivers/usb/gadget/f_mass_storage.c | 2936 +++++++++++++++++++++++++++
drivers/usb/gadget/storage_common.c | 173 ++
drivers/usb/gadget/storage_common.h | 245 +++
fs/ubifs/misc.h | 3 +
include/linux/barebox-wrapper.h | 4 -
include/scsi.h | 12 +
include/usb/mass_storage.h | 28 +
include/usb/storage.h | 87 +
14 files changed, 3552 insertions(+), 8 deletions(-)
create mode 100644 commands/ums.c
create mode 100644 drivers/usb/gadget/f_mass_storage.c
create mode 100644 drivers/usb/gadget/storage_common.c
create mode 100644 drivers/usb/gadget/storage_common.h
create mode 100644 include/usb/mass_storage.h
create mode 100644 include/usb/storage.h
--
2.29.2
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/3] include: <linux/barebox-wrapper.h>: remove kthread 'replacements'
2021-02-15 10:27 [PATCH 0/3] usbgadget: add support for blocking USB mass storage gadget Ahmad Fatoum
@ 2021-02-15 10:27 ` Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 2/3] console: unconditionally run poller_call in ctrlc() Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 3/3] usbgadget: add support for USB mass storage gadget Ahmad Fatoum
2 siblings, 0 replies; 5+ messages in thread
From: Ahmad Fatoum @ 2021-02-15 10:27 UTC (permalink / raw)
To: barebox; +Cc: Ahmad Fatoum
Replacing kthread_create, stop and wake_up_process with no-ops is not
always applicable. For example a threaded USB gadget could be ported
by blocking in kthread_run as external events come in via poller.
Allow porting kthread code that way by removing the noop
implementations. The only user is the UBIFS code, so move the
definitions there.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
drivers/mtd/ubi/ubi-barebox.h | 2 --
fs/ubifs/misc.h | 3 +++
include/linux/barebox-wrapper.h | 4 ----
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/mtd/ubi/ubi-barebox.h b/drivers/mtd/ubi/ubi-barebox.h
index 7ee87ffd3e10..01b84890f01e 100644
--- a/drivers/mtd/ubi/ubi-barebox.h
+++ b/drivers/mtd/ubi/ubi-barebox.h
@@ -42,8 +42,6 @@ static inline unsigned long copy_from_user(void *dest, const void *src,
/* common */
-#define wake_up_process(...) do { } while (0)
-
#define BUS_ID_SIZE 20
#define MAX_ERRNO 4095
diff --git a/fs/ubifs/misc.h b/fs/ubifs/misc.h
index 82f922565757..5dafe7518be0 100644
--- a/fs/ubifs/misc.h
+++ b/fs/ubifs/misc.h
@@ -27,6 +27,9 @@
#ifndef __UBIFS_MISC_H__
#define __UBIFS_MISC_H__
+#define kthread_stop(...) do { } while (0)
+#define wake_up_process(...) do { } while (0)
+
/**
* ubifs_zn_dirty - check if znode is dirty.
* @znode: znode to check
diff --git a/include/linux/barebox-wrapper.h b/include/linux/barebox-wrapper.h
index 82c52dd93309..dfaec7b8a9b9 100644
--- a/include/linux/barebox-wrapper.h
+++ b/include/linux/barebox-wrapper.h
@@ -38,10 +38,6 @@ static inline void vfree(const void *addr)
#define __init
#define __exit
-#define kthread_create(...) __builtin_return_address(0)
-#define kthread_stop(...) do { } while (0)
-#define wake_up_process(...) do { } while (0)
-
typedef int irqreturn_t;
#define IRQ_NONE 0
#define IRQ_HANDLED 0
--
2.29.2
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 2/3] console: unconditionally run poller_call in ctrlc()
2021-02-15 10:27 [PATCH 0/3] usbgadget: add support for blocking USB mass storage gadget Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 1/3] include: <linux/barebox-wrapper.h>: remove kthread 'replacements' Ahmad Fatoum
@ 2021-02-15 10:27 ` Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 3/3] usbgadget: add support for USB mass storage gadget Ahmad Fatoum
2 siblings, 0 replies; 5+ messages in thread
From: Ahmad Fatoum @ 2021-02-15 10:27 UTC (permalink / raw)
To: barebox; +Cc: Ahmad Fatoum
ctrlc is allowed only after init and reboot mode scripts have run, so
these scripts run uninterruptible. A side effect of this is that all
calls to ctrlc() will immediately return with false without running the
pollers. While init scripts shouldn't run too long, it's still
surprising behavior. Thus call poller_call() first thing in ctrlc().
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
common/console.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/common/console.c b/common/console.c
index 306149c99ea1..974d3de9e483 100644
--- a/common/console.c
+++ b/common/console.c
@@ -579,14 +579,14 @@ int ctrlc(void)
{
int ret = 0;
+ poller_call();
+
if (!ctrlc_allowed)
return 0;
if (ctrlc_abort)
return 1;
- poller_call();
-
#ifdef ARCH_HAS_CTRLC
ret = arch_ctrlc();
#else
--
2.29.2
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 3/3] usbgadget: add support for USB mass storage gadget
2021-02-15 10:27 [PATCH 0/3] usbgadget: add support for blocking USB mass storage gadget Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 1/3] include: <linux/barebox-wrapper.h>: remove kthread 'replacements' Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 2/3] console: unconditionally run poller_call in ctrlc() Ahmad Fatoum
@ 2021-02-15 10:27 ` Ahmad Fatoum
2021-02-17 11:48 ` Ahmad Fatoum
2 siblings, 1 reply; 5+ messages in thread
From: Ahmad Fatoum @ 2021-02-15 10:27 UTC (permalink / raw)
To: barebox; +Cc: Ahmad Fatoum
This driver is based on the f_mass_storage drivers in Linux v5.11 and
U-Boot v2021.01. Like with U-Boot, it's invoked with a blocking ums
command. During this time, no other processing, except for pollers, is
possible. The command can be aborted with ctrl+c.
The state machine to implement the mass storage gadget is quite
extensive, so import the functionality now and delay moving the state
machine into a poller for asynchronous operation as part of a composite
gadget for later.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
commands/Makefile | 1 +
commands/ums.c | 53 +
drivers/usb/gadget/Kconfig | 11 +
drivers/usb/gadget/Makefile | 1 +
drivers/usb/gadget/f_mass_storage.c | 2936 +++++++++++++++++++++++++++
drivers/usb/gadget/storage_common.c | 173 ++
drivers/usb/gadget/storage_common.h | 245 +++
include/scsi.h | 12 +
include/usb/mass_storage.h | 28 +
include/usb/storage.h | 87 +
10 files changed, 3547 insertions(+)
create mode 100644 commands/ums.c
create mode 100644 drivers/usb/gadget/f_mass_storage.c
create mode 100644 drivers/usb/gadget/storage_common.c
create mode 100644 drivers/usb/gadget/storage_common.h
create mode 100644 include/usb/mass_storage.h
create mode 100644 include/usb/storage.h
diff --git a/commands/Makefile b/commands/Makefile
index 034c0e6383d3..a31d5c877703 100644
--- a/commands/Makefile
+++ b/commands/Makefile
@@ -130,5 +130,6 @@ obj-$(CONFIG_CMD_NAND_BITFLIP) += nand-bitflip.o
obj-$(CONFIG_CMD_SEED) += seed.o
obj-$(CONFIG_CMD_IP_ROUTE_GET) += ip-route-get.o
obj-$(CONFIG_CMD_UBSAN) += ubsan.o
+obj-$(CONFIG_USB_GADGET_MASS_STORAGE) += ums.o
UBSAN_SANITIZE_ubsan.o := y
diff --git a/commands/ums.c b/commands/ums.c
new file mode 100644
index 000000000000..0bc2cfdf5e98
--- /dev/null
+++ b/commands/ums.c
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * Copyright (c) 2015, NVIDIA CORPORATION. All rights reserved.
+ */
+
+#include <common.h>
+#include <command.h>
+#include <errno.h>
+#include <malloc.h>
+#include <getopt.h>
+#include <fs.h>
+#include <xfuncs.h>
+#include <file-list.h>
+#include <usb/mass_storage.h>
+#include <linux/err.h>
+
+static int do_usb_mass_storage(int argc, char *argv[])
+{
+ struct f_ums_opts opts;
+ char *argstr;
+ int ret;
+
+ if (argc != optind + 1)
+ return COMMAND_ERROR_USAGE;
+
+ argstr = argv[optind];
+
+ opts.files = file_list_parse(argstr);
+ if (IS_ERR(opts.files)) {
+ ret = PTR_ERR(opts.files);
+ goto out;
+ }
+
+ ret = usb_ums_register(&opts);
+
+ file_list_free(opts.files);
+out:
+ return ret;
+}
+
+BAREBOX_CMD_HELP_START(usb)
+BAREBOX_CMD_HELP_TEXT("Turn's the USB host into a UMS (USB Mass storage) gadget")
+BAREBOX_CMD_HELP_END
+
+BAREBOX_CMD_START(ums)
+ .cmd = do_usb_mass_storage,
+ BAREBOX_CMD_DESC("USB mass storage gadget")
+ BAREBOX_CMD_GROUP(CMD_GRP_MISC)
+ BAREBOX_CMD_HELP(cmd_usb_help)
+BAREBOX_CMD_END
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 7e0c570914d7..90d2378b5b72 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -59,4 +59,15 @@ config USB_GADGET_FASTBOOT
select FILE_LIST
select FASTBOOT_BASE
prompt "Android Fastboot USB Gadget"
+
+config USB_GADGET_MASS_STORAGE
+ bool
+ select FILE_LIST
+ prompt "USB Mass Storage Gadget"
+ help
+ The Mass Storage Gadget acts as a USB Mass Storage disk drive.
+ As its storage repository it can use a regular file or a block
+ device. Multiple storages can be specified at once on
+ instantiation time.
+
endif
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 27673fcf0ef6..5ba4920c085a 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_USB_GADGET) += composite.o config.o usbstring.o epautoconf.o udc-co
obj-$(CONFIG_USB_GADGET_SERIAL) += u_serial.o serial.o f_serial.o f_acm.o
obj-$(CONFIG_USB_GADGET_DFU) += dfu.o
obj-$(CONFIG_USB_GADGET_FASTBOOT) += f_fastboot.o
+obj-$(CONFIG_USB_GADGET_MASS_STORAGE) += f_mass_storage.o storage_common.o
obj-$(CONFIG_USB_GADGET_DRIVER_ARC) += fsl_udc.o
pbl-$(CONFIG_USB_GADGET_DRIVER_ARC_PBL) += fsl_udc_pbl.o
obj-$(CONFIG_USB_GADGET_DRIVER_AT91) += at91_udc.o
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
new file mode 100644
index 000000000000..9c0076be26d1
--- /dev/null
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -0,0 +1,2936 @@
+// SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause
+/*
+ * f_mass_storage.c -- Mass Storage USB Composite Function
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * Copyright (C) 2009 Samsung Electronics
+ * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ * All rights reserved.
+ */
+
+/*
+ * The Mass Storage Function acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive. In
+ * addition to providing an example of a genuinely useful composite
+ * function for a USB device, it also illustrates a technique of
+ * double-buffering for increased throughput.
+ *
+ * Function supports multiple logical units (LUNs). Backing storage
+ * for each LUN is provided by a regular file or a block device.
+ * Access for each LUN can be limited to read-only. Moreover, the
+ * function can indicate that LUN is removable and/or CD-ROM. (The
+ * later implies read-only access.)
+ *
+ * MSF is configured by specifying a fsg_config structure. It has the
+ * following fields:
+ *
+ * nluns Number of LUNs function have (anywhere from 1
+ * to FSG_MAX_LUNS which is 8).
+ * luns An array of LUN configuration values. This
+ * should be filled for each LUN that
+ * function will include (ie. for "nluns"
+ * LUNs). Each element of the array has
+ * the following fields:
+ * ->filename The path to the backing file for the LUN.
+ * Required if LUN is not marked as
+ * removable.
+ * ->ro Flag specifying access to the LUN shall be
+ * read-only. This is implied if CD-ROM
+ * emulation is enabled as well as when
+ * it was impossible to open "filename"
+ * in R/W mode.
+ * ->removable Flag specifying that LUN shall be indicated as
+ * being removable.
+ * ->cdrom Flag specifying that LUN shall be reported as
+ * being a CD-ROM.
+ *
+ * lun_name_format A printf-like format for names of the LUN
+ * devices. This determines how the
+ * directory in sysfs will be named.
+ * Unless you are using several MSFs in
+ * a single gadget (as opposed to single
+ * MSF in many configurations) you may
+ * leave it as NULL (in which case
+ * "lun%d" will be used). In the format
+ * you can use "%d" to index LUNs for
+ * MSF's with more than one LUN. (Beware
+ * that there is only one integer given
+ * as an argument for the format and
+ * specifying invalid format may cause
+ * unspecified behaviour.)
+ * thread_name Name of the kernel thread process used by the
+ * MSF. You can safely set it to NULL
+ * (in which case default "file-storage"
+ * will be used).
+ *
+ * vendor_name
+ * product_name
+ * release Information used as a reply to INQUIRY
+ * request. To use default set to NULL,
+ * NULL, 0xffff respectively. The first
+ * field should be 8 and the second 16
+ * characters or less.
+ *
+ * can_stall Set to permit function to halt bulk endpoints.
+ * Disabled on some USB devices known not
+ * to work correctly. You should set it
+ * to true.
+ *
+ * If "removable" is not set for a LUN then a backing file must be
+ * specified. If it is set, then NULL filename means the LUN's medium
+ * is not loaded (an empty string as "filename" in the fsg_config
+ * structure causes error). The CD-ROM emulation includes a single
+ * data track and no audio tracks; hence there need be only one
+ * backing file per LUN. Note also that the CD-ROM block length is
+ * set to 512 rather than the more common value 2048.
+ *
+ *
+ * MSF includes support for module parameters. If gadget using it
+ * decides to use it, the following module parameters will be
+ * available:
+ *
+ * file=filename[,filename...]
+ * Names of the files or block devices used for
+ * backing storage.
+ * ro=b[,b...] Default false, boolean for read-only access.
+ * removable=b[,b...]
+ * Default true, boolean for removable media.
+ * cdrom=b[,b...] Default false, boolean for whether to emulate
+ * a CD-ROM drive.
+ * luns=N Default N = number of filenames, number of
+ * LUNs to support.
+ * stall Default determined according to the type of
+ * USB device controller (usually true),
+ * boolean to permit the driver to halt
+ * bulk endpoints.
+ *
+ * The module parameters may be prefixed with some string. You need
+ * to consult gadget's documentation or source to verify whether it is
+ * using those module parameters and if it does what are the prefixes
+ * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
+ * the prefix).
+ *
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed. The memory requirement amounts to two 16K buffers, size
+ * configurable by a parameter. Support is included for both
+ * full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints. With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ *
+ * The pathnames of the backing files and the ro settings are
+ * available in the attribute files "file" and "ro" in the lun<n> (or
+ * to be more precise in a directory which name comes from
+ * "lun_name_format" option!) subdirectory of the gadget's sysfs
+ * directory. If the "removable" option is set, writing to these
+ * files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab. Changes to the
+ * ro setting are not allowed when the medium is loaded or if CD-ROM
+ * emulation is being used.
+ *
+ * When a LUN receive an "eject" SCSI request (Start/Stop Unit),
+ * if the LUN is removable, the backing file is released to simulate
+ * ejection.
+ *
+ *
+ * This function is heavily based on "File-backed Storage Gadget" by
+ * Alan Stern which in turn is heavily based on "Gadget Zero" by David
+ * Brownell. The driver's SCSI command interface was based on the
+ * "Information technology - Small Computer System Interface - 2"
+ * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
+ * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
+ * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
+ * was based on the "Universal Serial Bus Mass Storage Class UFI
+ * Command Specification" document, Revision 1.0, December 14, 1998,
+ * available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+/*
+ * Driver Design
+ *
+ * The MSF is fairly straightforward. There is a main kernel
+ * thread that handles most of the work. Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls. Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction. It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file. This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example. To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind(). But it can
+ * also exit when it receives a signal, and there's no point leaving
+ * the gadget running when the thread is dead. At of this moment, MSF
+ * provides no way to deregister the gadget when thread dies -- maybe
+ * a callback functions is needed.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd). In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering). But it helps to think of the
+ * pipeline as being a long one. Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol. There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete. Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows. This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint. However, under certain circumstances the
+ * Bulk-only specification requires a stall. In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset. Hopefully this
+ * will permit everything to work correctly. Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests. Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time. During that delay the host might give up on
+ * the original ep0 request and issue a new one. When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it. So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change). When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag. Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long. It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+#define pr_fmt(fmt) "f_ums: " fmt
+
+#include <common.h>
+#include <unistd.h>
+#include <linux/stat.h>
+#include <linux/wait.h>
+#include <fcntl.h>
+#include <file-list.h>
+#include <dma.h>
+#include <linux/bug.h>
+#include <linux/rwsem.h>
+#include <linux/pagemap.h>
+#include <disks.h>
+#include <scsi.h>
+
+#include <linux/err.h>
+#include <usb/mass_storage.h>
+
+#include <asm/unaligned.h>
+#include <linux/bitops.h>
+#include <usb/gadget.h>
+#include <usb/composite.h>
+#include <linux/bitmap.h>
+
+/*------------------------------------------------------------------------*/
+
+#define FSG_DRIVER_DESC "ums"
+#define UMS_NAME_LEN 16
+
+#define FSG_DRIVER_VERSION "2012/06/5"
+
+static const char fsg_string_interface[] = "Mass Storage";
+
+#include "storage_common.h"
+
+/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
+struct usb_string fsg_strings[] = {
+ {FSG_STRING_INTERFACE, fsg_string_interface},
+ {}
+};
+
+static struct usb_gadget_strings fsg_stringtab = {
+ .language = 0x0409, /* en-us */
+ .strings = fsg_strings,
+};
+
+/*-------------------------------------------------------------------------*/
+
+struct completion { int done; };
+
+#define init_completion(x) do { (x)->done = 0; } while (0)
+#define reinit_completion(x) init_completion(x)
+static inline int wait_for_completion_interruptible(struct completion *x)
+{
+ int ret;
+
+ while (!x->done) {
+ ret = ctrlc();
+ if (ret)
+ return -ERESTARTSYS;
+ }
+
+ return 0;
+}
+#define complete_and_exit(...) return 0
+
+static inline void complete(struct completion *x)
+{
+ x->done = 1;
+}
+
+struct task_struct {
+ int (*threadfn)(void *);
+ void *arg;
+};
+
+static struct task_struct *kthread_run(int (*threadfn)(void *), void *arg,
+ const char *name)
+{
+ struct task_struct *task;
+
+ task = xmalloc(sizeof(*task));
+ task->threadfn = threadfn;
+ task->arg = arg;
+
+ return task;
+}
+
+#define free_kthread_struct(t) free(t)
+
+#define poll() thread_task->threadfn(thread_task->arg)
+
+#define wait_event(queue, cond) do { poll(); } while (!(cond))
+#define wake_up(...) do {} while (0)
+
+struct task_struct *thread_task;
+
+/*-------------------------------------------------------------------------*/
+
+struct kref {int x; };
+
+struct fsg_dev;
+
+static struct file_list *ums_files;
+
+static struct usb_device_descriptor ums_dev_descriptor = {
+ .bLength = USB_DT_DEVICE_SIZE,
+ .bDescriptorType = USB_DT_DEVICE,
+ .bcdUSB = __constant_cpu_to_le16(0x0200),
+ .bDeviceClass = USB_CLASS_PER_INTERFACE,
+ .bNumConfigurations = 1,
+};
+
+/* Data shared by all the FSG instances. */
+struct fsg_common {
+ struct usb_gadget *gadget;
+ struct fsg_dev *fsg, *new_fsg;
+
+ wait_queue_head_t fsg_wait;
+ struct usb_ep *ep0; /* Copy of gadget->ep0 */
+ struct usb_request *ep0req; /* Copy of cdev->req */
+ unsigned int ep0_req_tag;
+
+ struct fsg_buffhd *next_buffhd_to_fill;
+ struct fsg_buffhd *next_buffhd_to_drain;
+ struct fsg_buffhd buffhds[FSG_NUM_BUFFERS];
+
+ int cmnd_size;
+ u8 cmnd[MAX_COMMAND_SIZE];
+
+ unsigned int nluns;
+ unsigned int lun;
+ struct fsg_lun luns[FSG_MAX_LUNS];
+
+ unsigned int bulk_out_maxpacket;
+ enum fsg_state state; /* For exception handling */
+ unsigned int exception_req_tag;
+
+ enum data_direction data_dir;
+ u32 data_size;
+ u32 data_size_from_cmnd;
+ u32 tag;
+ u32 residue;
+ u32 usb_amount_left;
+
+ unsigned int can_stall:1;
+ unsigned int free_storage_on_release:1;
+ unsigned int phase_error:1;
+ unsigned int short_packet_received:1;
+ unsigned int bad_lun_okay:1;
+ unsigned int running:1;
+
+ struct completion thread_wakeup_needed;
+ struct completion thread_notifier;
+ bool shutdown;
+
+ /* Callback functions. */
+ const struct fsg_operations *ops;
+ /* Gadget's private data. */
+ void *private_data;
+
+ const char *vendor_name; /* 8 characters or less */
+ const char *product_name; /* 16 characters or less */
+ u16 release;
+
+ /* Vendor (8 chars), product (16 chars), release (4
+ * hexadecimal digits) and NUL byte */
+ char inquiry_string[8 + 16 + 4 + 1];
+
+ struct kref ref;
+};
+
+struct fsg_config {
+ unsigned nluns;
+ struct fsg_lun_config {
+ const char *filename;
+ char ro;
+ char removable;
+ char cdrom;
+ char nofua;
+ } luns[FSG_MAX_LUNS];
+
+ /* Callback functions. */
+ const struct fsg_operations *ops;
+ /* Gadget's private data. */
+ void *private_data;
+
+ const char *vendor_name; /* 8 characters or less */
+ const char *product_name; /* 16 characters or less */
+
+ char can_stall;
+};
+
+struct fsg_dev {
+ struct usb_function function;
+ struct usb_gadget *gadget; /* Copy of cdev->gadget */
+ struct fsg_common *common;
+
+ u16 interface_number;
+
+ unsigned int bulk_in_enabled:1;
+ unsigned int bulk_out_enabled:1;
+
+ unsigned long atomic_bitflags;
+#define IGNORE_BULK_OUT 0
+
+ struct usb_ep *bulk_in;
+ struct usb_ep *bulk_out;
+};
+
+
+static inline int __fsg_is_set(struct fsg_common *common,
+ const char *func, unsigned line)
+{
+ if (common->fsg)
+ return 1;
+ ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
+ WARN_ON(1);
+
+ return 0;
+}
+
+#define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
+
+
+static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
+{
+ return container_of(f, struct fsg_dev, function);
+}
+
+static inline struct f_ums_opts *
+fsg_opts_from_func_inst(const struct usb_function_instance *fi)
+{
+ return container_of(fi, struct f_ums_opts, func_inst);
+}
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_common *common)
+{
+ return common->state > FSG_STATE_IDLE;
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_common *common,
+ struct fsg_buffhd *bh, unsigned int length)
+{
+ unsigned int rem;
+
+ bh->bulk_out_intended_length = length;
+ rem = length % common->bulk_out_maxpacket;
+ if (rem > 0)
+ length += common->bulk_out_maxpacket - rem;
+ bh->outreq->length = length;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct f_ums_opts ums[14]; // FIXME
+static int ums_count;
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+ const char *name;
+
+ if (ep == fsg->bulk_in)
+ name = "bulk-in";
+ else if (ep == fsg->bulk_out)
+ name = "bulk-out";
+ else
+ name = ep->name;
+ DBG(fsg, "%s set halt\n", name);
+ return usb_ep_set_halt(ep);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_common *common)
+{
+ complete(&common->thread_wakeup_needed);
+}
+
+static void report_exception(const char *prefix, enum fsg_state state)
+{
+ const char *msg = "<unknown>";
+ switch (state) {
+ /* This one isn't used anywhere */
+ case FSG_STATE_COMMAND_PHASE:
+ msg = "Command Phase";
+ break;
+ case FSG_STATE_DATA_PHASE:
+ msg = "Data Phase";
+ break;
+ case FSG_STATE_STATUS_PHASE:
+ msg = "Status Phase";
+ break;
+
+ case FSG_STATE_IDLE:
+ msg = "Idle";
+ break;
+ case FSG_STATE_ABORT_BULK_OUT:
+ msg = "abort bulk out";
+ break;
+ case FSG_STATE_RESET:
+ msg = "reset";
+ break;
+ case FSG_STATE_INTERFACE_CHANGE:
+ msg = "interface change";
+ break;
+ case FSG_STATE_CONFIG_CHANGE:
+ msg = "config change";
+ break;
+ case FSG_STATE_DISCONNECT:
+ msg = "disconnect";
+ break;
+ case FSG_STATE_EXIT:
+ msg = "exit";
+ break;
+ case FSG_STATE_TERMINATED:
+ msg = "terminated";
+ break;
+ }
+
+ pr_debug("%s: %s\n", prefix, msg);
+}
+
+static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+{
+ /* Do nothing if a higher-priority exception is already in progress.
+ * If a lower-or-equal priority exception is in progress, preempt it
+ * and notify the main thread by sending it a signal. */
+ if (common->state <= new_state) {
+ report_exception("raising (preempted)", new_state);
+ common->exception_req_tag = common->ep0_req_tag;
+ common->state = new_state;
+ wakeup_thread(common);
+ }
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int ep0_queue(struct fsg_common *common)
+{
+ int rc;
+
+ rc = usb_ep_queue(common->ep0, common->ep0req);
+ common->ep0->driver_data = common;
+ if (rc != 0 && rc != -ESHUTDOWN) {
+ /* We can't do much more than wait for a reset */
+ WARNING(common, "error in submission: %s --> %d\n",
+ common->ep0->name, rc);
+ }
+ return rc;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+ struct fsg_common *common = ep->driver_data;
+ struct fsg_buffhd *bh = req->context;
+
+ if (req->status || req->actual != req->length)
+ DBG(common, "%s --> %d, %u/%u\n", __func__,
+ req->status, req->actual, req->length);
+ if (req->status == -ECONNRESET) /* Request was cancelled */
+ usb_ep_fifo_flush(ep);
+
+ /* Hold the lock while we update the request and buffer states */
+ bh->inreq_busy = 0;
+ bh->state = BUF_STATE_EMPTY;
+ wakeup_thread(common);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+ struct fsg_common *common = ep->driver_data;
+ struct fsg_buffhd *bh = req->context;
+
+ dump_msg(common, "bulk-out", req->buf, req->actual);
+ if (req->status || req->actual != bh->bulk_out_intended_length)
+ DBG(common, "%s --> %d, %u/%u\n", __func__,
+ req->status, req->actual,
+ bh->bulk_out_intended_length);
+ if (req->status == -ECONNRESET) /* Request was cancelled */
+ usb_ep_fifo_flush(ep);
+
+ /* Hold the lock while we update the request and buffer states */
+ bh->outreq_busy = 0;
+ bh->state = BUF_STATE_FULL;
+ wakeup_thread(common);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers. These always run in_irq. */
+
+static int fsg_setup(struct usb_function *f,
+ const struct usb_ctrlrequest *ctrl)
+{
+ struct fsg_dev *fsg = fsg_from_func(f);
+ struct usb_request *req = fsg->common->ep0req;
+ u16 w_index = get_unaligned_le16(&ctrl->wIndex);
+ u16 w_value = get_unaligned_le16(&ctrl->wValue);
+ u16 w_length = get_unaligned_le16(&ctrl->wLength);
+
+ if (!fsg_is_set(fsg->common))
+ return -EOPNOTSUPP;
+
+ switch (ctrl->bRequest) {
+
+ case US_BULK_RESET_REQUEST:
+ if (ctrl->bRequestType !=
+ (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+ break;
+ if (w_index != fsg->interface_number || w_value != 0)
+ return -EDOM;
+
+ /* Raise an exception to stop the current operation
+ * and reinitialize our state. */
+ DBG(fsg, "bulk reset request\n");
+ raise_exception(fsg->common, FSG_STATE_RESET);
+ return DELAYED_STATUS;
+
+ case US_BULK_GET_MAX_LUN:
+ if (ctrl->bRequestType !=
+ (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+ break;
+ if (w_index != fsg->interface_number || w_value != 0)
+ return -EDOM;
+ VDBG(fsg, "get max LUN\n");
+ *(u8 *) req->buf = fsg->common->nluns - 1;
+
+ /* Respond with data/status */
+ req->length = min((u16)1, w_length);
+ return ep0_queue(fsg->common);
+ }
+
+ VDBG(fsg,
+ "unknown class-specific control req "
+ "%02x.%02x v%04x i%04x l%u\n",
+ ctrl->bRequestType, ctrl->bRequest,
+ get_unaligned_le16(&ctrl->wValue), w_index, w_length);
+ return -EOPNOTSUPP;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+ struct usb_request *req, int *pbusy,
+ enum fsg_buffer_state *state)
+{
+ int rc;
+
+ if (ep == fsg->bulk_in)
+ dump_msg(fsg, "bulk-in", req->buf, req->length);
+
+ *pbusy = 1;
+ *state = BUF_STATE_BUSY;
+ rc = usb_ep_queue(ep, req);
+ if (rc != 0) {
+ *pbusy = 0;
+ *state = BUF_STATE_EMPTY;
+
+ /* We can't do much more than wait for a reset */
+
+ /* Note: currently the net2280 driver fails zero-length
+ * submissions if DMA is enabled. */
+ if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+ req->length == 0))
+ WARNING(fsg, "error in submission: %s --> %d\n",
+ ep->name, rc);
+ }
+}
+
+#define START_TRANSFER_OR(common, ep_name, req, pbusy, state) \
+ if (fsg_is_set(common)) \
+ start_transfer((common)->fsg, (common)->fsg->ep_name, \
+ req, pbusy, state); \
+ else
+
+#define START_TRANSFER(common, ep_name, req, pbusy, state) \
+ START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
+
+static int sleep_thread(struct fsg_common *common)
+{
+ int ret;
+
+ /* Wait until a signal arrives or we are woken up */
+ ret = wait_for_completion_interruptible(&common->thread_wakeup_needed);
+ if (ret) {
+ /* If we run outside of a poller, this ensures we exit the loop */
+ common->running = false;
+ return ret;
+ }
+
+ if (common->shutdown)
+ return -ERESTARTSYS;
+
+ reinit_completion(&common->thread_wakeup_needed);
+ return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u32 lba;
+ struct fsg_buffhd *bh;
+ int rc;
+ u32 amount_left;
+ loff_t file_offset;
+ unsigned int amount;
+ unsigned int partial_page;
+ ssize_t nread;
+
+ /* Get the starting Logical Block Address and check that it's
+ * not too big */
+ if (common->cmnd[0] == SCSI_READ6)
+ lba = get_unaligned_be24(&common->cmnd[1]);
+ else {
+ lba = get_unaligned_be32(&common->cmnd[2]);
+
+ /* We allow DPO (Disable Page Out = don't save data in the
+ * cache) and FUA (Force Unit Access = don't read from the
+ * cache), but we don't implement them. */
+ if ((common->cmnd[1] & ~0x18) != 0) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+ }
+ if (lba >= curlun->num_sectors) {
+ curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ return -EINVAL;
+ }
+ file_offset = ((loff_t) lba) << 9;
+
+ /* Carry out the file reads */
+ amount_left = common->data_size_from_cmnd;
+ if (unlikely(amount_left == 0))
+ return -EIO; /* No default reply */
+
+ for (;;) {
+ /* Wait for the next buffer to become available */
+ bh = common->next_buffhd_to_fill;
+ while (bh->state != BUF_STATE_EMPTY) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+ /* Figure out how much we need to read:
+ * Try to read the remaining amount.
+ * But don't read more than the buffer size.
+ * And don't try to read past the end of the file.
+ * Finally, if we're not at a page boundary, don't read past
+ * the next page.
+ * If this means reading 0 then we were asked to read past
+ * the end of file. */
+ amount = min(amount_left, FSG_BUFLEN);
+ partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
+ if (partial_page > 0)
+ amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
+ partial_page);
+
+
+ /* If we were asked to read past the end of file,
+ * end with an empty buffer. */
+ if (amount == 0) {
+ curlun->sense_data =
+ SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ curlun->info_valid = 1;
+ bh->inreq->length = 0;
+ bh->state = BUF_STATE_FULL;
+ break;
+ }
+
+ /* Perform the read */
+ nread = pread(ums[common->lun].fd, bh->buf, amount, file_offset);
+
+ VLDBG(curlun, "file read %u @ %llu -> %zd\n", amount,
+ (unsigned long long) file_offset,
+ nread);
+ if (nread <= 0) {
+ const char *err = nread ? strerror(-nread) : "EOF";
+ LDBG(curlun, "error in file read: %s\n", err);
+ nread = 0;
+ } else if (nread < amount) {
+ LDBG(curlun, "partial file read: %d/%u\n",
+ (int) nread, amount);
+ nread -= (nread & 511); /* Round down to a block */
+ }
+ file_offset += nread;
+ amount_left -= nread;
+ common->residue -= nread;
+ bh->inreq->length = nread;
+ bh->state = BUF_STATE_FULL;
+
+ /* If an error occurred, report it and its position */
+ if (nread < amount) {
+ curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+ curlun->info_valid = 1;
+ break;
+ }
+
+ if (amount_left == 0)
+ break; /* No more left to read */
+
+ /* Send this buffer and go read some more */
+ bh->inreq->zero = 0;
+ START_TRANSFER_OR(common, bulk_in, bh->inreq,
+ &bh->inreq_busy, &bh->state)
+ /* Don't know what to do if
+ * common->fsg is NULL */
+ return -EIO;
+ common->next_buffhd_to_fill = bh->next;
+ }
+
+ return -EIO; /* No default reply */
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u32 lba;
+ struct fsg_buffhd *bh;
+ int get_some_more;
+ u32 amount_left_to_req, amount_left_to_write;
+ loff_t usb_offset, file_offset;
+ unsigned int amount;
+ unsigned int partial_page;
+ ssize_t nwritten;
+ int rc;
+
+ if (curlun->ro) {
+ curlun->sense_data = SS_WRITE_PROTECTED;
+ return -EINVAL;
+ }
+
+ /* Get the starting Logical Block Address and check that it's
+ * not too big */
+ if (common->cmnd[0] == SCSI_WRITE6)
+ lba = get_unaligned_be24(&common->cmnd[1]);
+ else {
+ lba = get_unaligned_be32(&common->cmnd[2]);
+
+ /* We allow DPO (Disable Page Out = don't save data in the
+ * cache) and FUA (Force Unit Access = write directly to the
+ * medium). We don't implement DPO; we implement FUA by
+ * performing synchronous output. */
+ if (common->cmnd[1] & ~0x18) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+ }
+ if (lba >= curlun->num_sectors) {
+ curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ return -EINVAL;
+ }
+
+ /* Carry out the file writes */
+ get_some_more = 1;
+ file_offset = usb_offset = ((loff_t) lba) << 9;
+ amount_left_to_req = common->data_size_from_cmnd;
+ amount_left_to_write = common->data_size_from_cmnd;
+
+ while (amount_left_to_write > 0) {
+
+ /* Queue a request for more data from the host */
+ bh = common->next_buffhd_to_fill;
+ if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+ /* Figure out how much we want to get:
+ * Try to get the remaining amount.
+ * But don't get more than the buffer size.
+ * And don't try to go past the end of the file.
+ * If we're not at a page boundary,
+ * don't go past the next page.
+ * If this means getting 0, then we were asked
+ * to write past the end of file.
+ * Finally, round down to a block boundary. */
+ amount = min(amount_left_to_req, FSG_BUFLEN);
+ partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
+ if (partial_page > 0)
+ amount = min(amount,
+ (unsigned int) PAGE_CACHE_SIZE - partial_page);
+
+ if (amount == 0) {
+ get_some_more = 0;
+ curlun->sense_data =
+ SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ curlun->info_valid = 1;
+ continue;
+ }
+ amount -= (amount & 511);
+ if (amount == 0) {
+
+ /* Why were we were asked to transfer a
+ * partial block? */
+ get_some_more = 0;
+ continue;
+ }
+
+ /* Get the next buffer */
+ usb_offset += amount;
+ common->usb_amount_left -= amount;
+ amount_left_to_req -= amount;
+ if (amount_left_to_req == 0)
+ get_some_more = 0;
+
+ /* amount is always divisible by 512, hence by
+ * the bulk-out maxpacket size */
+ bh->outreq->length = amount;
+ bh->bulk_out_intended_length = amount;
+ bh->outreq->short_not_ok = 1;
+ START_TRANSFER_OR(common, bulk_out, bh->outreq,
+ &bh->outreq_busy, &bh->state)
+ /* Don't know what to do if
+ * common->fsg is NULL */
+ return -EIO;
+ common->next_buffhd_to_fill = bh->next;
+ continue;
+ }
+
+ /* Write the received data to the backing file */
+ bh = common->next_buffhd_to_drain;
+ if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+ break; /* We stopped early */
+ if (bh->state == BUF_STATE_FULL) {
+ common->next_buffhd_to_drain = bh->next;
+ bh->state = BUF_STATE_EMPTY;
+
+ /* Did something go wrong with the transfer? */
+ if (bh->outreq->status != 0) {
+ curlun->sense_data = SS_COMMUNICATION_FAILURE;
+ curlun->info_valid = 1;
+ break;
+ }
+
+ amount = bh->outreq->actual;
+
+ /* Perform the write */
+ nwritten = pwrite(ums[common->lun].fd, bh->buf, amount, file_offset);
+
+ VLDBG(curlun, "file write %u @ %llu -> %zd\n", amount,
+ (unsigned long long) file_offset,
+ nwritten);
+
+ if (nwritten < 0) {
+ LDBG(curlun, "error in file write: %pe\n", ERR_PTR(nwritten));
+ nwritten = 0;
+ } else if (nwritten < amount) {
+ LDBG(curlun, "partial file write: %d/%u\n",
+ (int) nwritten, amount);
+ nwritten -= (nwritten & 511);
+ /* Round down to a block */
+ }
+ file_offset += nwritten;
+ amount_left_to_write -= nwritten;
+ common->residue -= nwritten;
+
+ /* If an error occurred, report it and its position */
+ if (nwritten < amount) {
+ pr_warn("nwritten:%zd amount:%u\n", nwritten,
+ amount);
+ curlun->sense_data = SS_WRITE_ERROR;
+ curlun->info_valid = 1;
+ break;
+ }
+
+ /* Did the host decide to stop early? */
+ if (bh->outreq->actual != bh->outreq->length) {
+ common->short_packet_received = 1;
+ break;
+ }
+ continue;
+ }
+
+ /* Wait for something to happen */
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+ return -EIO; /* No default reply */
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_common *common)
+{
+ return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int do_verify(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u32 lba;
+ u32 verification_length;
+ struct fsg_buffhd *bh = common->next_buffhd_to_fill;
+ loff_t file_offset;
+ u32 amount_left;
+ unsigned int amount;
+ ssize_t nread;
+
+ /* Get the starting Logical Block Address and check that it's
+ * not too big */
+ lba = get_unaligned_be32(&common->cmnd[2]);
+ if (lba >= curlun->num_sectors) {
+ curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ return -EINVAL;
+ }
+
+ /* We allow DPO (Disable Page Out = don't save data in the
+ * cache) but we don't implement it. */
+ if (common->cmnd[1] & ~0x10) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+
+ verification_length = get_unaligned_be16(&common->cmnd[7]);
+ if (unlikely(verification_length == 0))
+ return -EIO; /* No default reply */
+
+ /* Prepare to carry out the file verify */
+ amount_left = verification_length << 9;
+ file_offset = ((loff_t) lba) << 9;
+
+ /* Write out all the dirty buffers before invalidating them */
+
+ /* Just try to read the requested blocks */
+ while (amount_left > 0) {
+
+ /* Figure out how much we need to read:
+ * Try to read the remaining amount, but not more than
+ * the buffer size.
+ * And don't try to read past the end of the file.
+ * If this means reading 0 then we were asked to read
+ * past the end of file. */
+ amount = min(amount_left, FSG_BUFLEN);
+ if (amount == 0) {
+ curlun->sense_data =
+ SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ curlun->info_valid = 1;
+ break;
+ }
+
+ /* Perform the read */
+ nread = pread(ums[common->lun].fd, bh->buf, amount, file_offset);
+
+ VLDBG(curlun, "file read %u @ %llu -> %zd\n", amount,
+ (unsigned long long) file_offset,
+ nread);
+ if (nread <= 0) {
+ const char *err = nread ? strerror(-nread) : "EOF";
+ LDBG(curlun, "error in file read: %s\n", err);
+ nread = 0;
+ } else if (nread < amount) {
+ LDBG(curlun, "partial file verify: %d/%u\n",
+ (int) nread, amount);
+ nread -= (nread & 511); /* Round down to a sector */
+ }
+ if (nread == 0) {
+ curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+ curlun->info_valid = 1;
+ break;
+ }
+ file_offset += nread;
+ amount_left -= nread;
+ }
+ return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ static const char vendor_id[] = "Linux ";
+ u8 *buf = (u8 *) bh->buf;
+
+ if (!curlun) { /* Unsupported LUNs are okay */
+ common->bad_lun_okay = 1;
+ memset(buf, 0, 36);
+ buf[0] = 0x7f; /* Unsupported, no device-type */
+ buf[4] = 31; /* Additional length */
+ return 36;
+ }
+
+ memset(buf, 0, 8);
+ buf[0] = TYPE_DISK;
+ buf[1] = curlun->removable ? 0x80 : 0;
+ buf[2] = 2; /* ANSI SCSI level 2 */
+ buf[3] = 2; /* SCSI-2 INQUIRY data format */
+ buf[4] = 31; /* Additional length */
+ /* No special options */
+ sprintf((char *) (buf + 8), "%-8s%-16s%04x", (char*) vendor_id ,
+ ums[common->lun].name, (u16) 0xffff);
+
+ return 36;
+}
+
+
+static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u8 *buf = (u8 *) bh->buf;
+ u32 sd, sdinfo = 0;
+ int valid;
+
+ /*
+ * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+ *
+ * If a REQUEST SENSE command is received from an initiator
+ * with a pending unit attention condition (before the target
+ * generates the contingent allegiance condition), then the
+ * target shall either:
+ * a) report any pending sense data and preserve the unit
+ * attention condition on the logical unit, or,
+ * b) report the unit attention condition, may discard any
+ * pending sense data, and clear the unit attention
+ * condition on the logical unit for that initiator.
+ *
+ * FSG normally uses option a); enable this code to use option b).
+ */
+#if 0
+ if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+ curlun->sense_data = curlun->unit_attention_data;
+ curlun->unit_attention_data = SS_NO_SENSE;
+ }
+#endif
+
+ if (!curlun) { /* Unsupported LUNs are okay */
+ common->bad_lun_okay = 1;
+ sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+ valid = 0;
+ } else {
+ sd = curlun->sense_data;
+ valid = curlun->info_valid << 7;
+ curlun->sense_data = SS_NO_SENSE;
+ curlun->info_valid = 0;
+ }
+
+ memset(buf, 0, 18);
+ buf[0] = valid | 0x70; /* Valid, current error */
+ buf[2] = SK(sd);
+ put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
+ buf[7] = 18 - 8; /* Additional sense length */
+ buf[12] = ASC(sd);
+ buf[13] = ASCQ(sd);
+ return 18;
+}
+
+static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u32 lba = get_unaligned_be32(&common->cmnd[2]);
+ int pmi = common->cmnd[8];
+ u8 *buf = (u8 *) bh->buf;
+
+ /* Check the PMI and LBA fields */
+ if (pmi > 1 || (pmi == 0 && lba != 0)) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+
+ put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+ /* Max logical block */
+ put_unaligned_be32(512, &buf[4]); /* Block length */
+ return 8;
+}
+
+static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ int msf = common->cmnd[1] & 0x02;
+ u32 lba = get_unaligned_be32(&common->cmnd[2]);
+ u8 *buf = (u8 *) bh->buf;
+
+ if (common->cmnd[1] & ~0x02) { /* Mask away MSF */
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+ if (lba >= curlun->num_sectors) {
+ curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+ return -EINVAL;
+ }
+
+ memset(buf, 0, 8);
+ buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
+ store_cdrom_address(&buf[4], msf, lba);
+ return 8;
+}
+
+
+static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ int msf = common->cmnd[1] & 0x02;
+ int start_track = common->cmnd[6];
+ u8 *buf = (u8 *) bh->buf;
+
+ if ((common->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
+ start_track > 1) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+
+ memset(buf, 0, 20);
+ buf[1] = (20-2); /* TOC data length */
+ buf[2] = 1; /* First track number */
+ buf[3] = 1; /* Last track number */
+ buf[5] = 0x16; /* Data track, copying allowed */
+ buf[6] = 0x01; /* Only track is number 1 */
+ store_cdrom_address(&buf[8], msf, 0);
+
+ buf[13] = 0x16; /* Lead-out track is data */
+ buf[14] = 0xAA; /* Lead-out track number */
+ store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+
+ return 20;
+}
+
+static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ int mscmnd = common->cmnd[0];
+ u8 *buf = (u8 *) bh->buf;
+ u8 *buf0 = buf;
+ int pc, page_code;
+ int changeable_values, all_pages;
+ int valid_page = 0;
+ int len, limit;
+
+ if ((common->cmnd[1] & ~0x08) != 0) { /* Mask away DBD */
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+ pc = common->cmnd[2] >> 6;
+ page_code = common->cmnd[2] & 0x3f;
+ if (pc == 3) {
+ curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+ return -EINVAL;
+ }
+ changeable_values = (pc == 1);
+ all_pages = (page_code == 0x3f);
+
+ /* Write the mode parameter header. Fixed values are: default
+ * medium type, no cache control (DPOFUA), and no block descriptors.
+ * The only variable value is the WriteProtect bit. We will fill in
+ * the mode data length later. */
+ memset(buf, 0, 8);
+ if (mscmnd == SCSI_MODE_SEN6) {
+ buf[2] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
+ buf += 4;
+ limit = 255;
+ } else { /* SCSI_MODE_SEN10 */
+ buf[3] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
+ buf += 8;
+ limit = 65535; /* Should really be FSG_BUFLEN */
+ }
+
+ /* No block descriptors */
+
+ /* The mode pages, in numerical order. The only page we support
+ * is the Caching page. */
+ if (page_code == 0x08 || all_pages) {
+ valid_page = 1;
+ buf[0] = 0x08; /* Page code */
+ buf[1] = 10; /* Page length */
+ memset(buf+2, 0, 10); /* None of the fields are changeable */
+
+ if (!changeable_values) {
+ buf[2] = 0x04; /* Write cache enable, */
+ /* Read cache not disabled */
+ /* No cache retention priorities */
+ put_unaligned_be16(0xffff, &buf[4]);
+ /* Don't disable prefetch */
+ /* Minimum prefetch = 0 */
+ put_unaligned_be16(0xffff, &buf[8]);
+ /* Maximum prefetch */
+ put_unaligned_be16(0xffff, &buf[10]);
+ /* Maximum prefetch ceiling */
+ }
+ buf += 12;
+ }
+
+ /* Check that a valid page was requested and the mode data length
+ * isn't too long. */
+ len = buf - buf0;
+ if (!valid_page || len > limit) {
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+
+ /* Store the mode data length */
+ if (mscmnd == SCSI_MODE_SEN6)
+ buf0[0] = len - 1;
+ else
+ put_unaligned_be16(len - 2, buf0);
+ return len;
+}
+
+
+static int do_start_stop(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+
+ if (!curlun) {
+ return -EINVAL;
+ } else if (!curlun->removable) {
+ curlun->sense_data = SS_INVALID_COMMAND;
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static int do_prevent_allow(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ int prevent;
+
+ if (!curlun->removable) {
+ curlun->sense_data = SS_INVALID_COMMAND;
+ return -EINVAL;
+ }
+
+ prevent = common->cmnd[4] & 0x01;
+ if ((common->cmnd[4] & ~0x01) != 0) { /* Mask away Prevent */
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+
+ if (curlun->prevent_medium_removal && !prevent)
+ fsg_lun_fsync_sub(curlun);
+ curlun->prevent_medium_removal = prevent;
+ return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_common *common,
+ struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ u8 *buf = (u8 *) bh->buf;
+
+ buf[0] = buf[1] = buf[2] = 0;
+ buf[3] = 8; /* Only the Current/Maximum Capacity Descriptor */
+ buf += 4;
+
+ put_unaligned_be32(curlun->num_sectors, &buf[0]);
+ /* Number of blocks */
+ put_unaligned_be32(512, &buf[4]); /* Block length */
+ buf[4] = 0x02; /* Current capacity */
+ return 12;
+}
+
+
+static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+
+ /* We don't support MODE SELECT */
+ if (curlun)
+ curlun->sense_data = SS_INVALID_COMMAND;
+ return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+ int rc;
+
+ rc = fsg_set_halt(fsg, fsg->bulk_in);
+ if (rc == -EAGAIN)
+ VDBG(fsg, "delayed bulk-in endpoint halt\n");
+ while (rc != 0) {
+ if (rc != -EAGAIN) {
+ WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+ rc = 0;
+ break;
+ }
+
+ rc = usb_ep_set_halt(fsg->bulk_in);
+ }
+ return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+ int rc;
+
+ DBG(fsg, "bulk-in set wedge\n");
+ rc = 0; /* usb_ep_set_wedge(fsg->bulk_in); */
+ if (rc == -EAGAIN)
+ VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+ while (rc != 0) {
+ if (rc != -EAGAIN) {
+ WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+ rc = 0;
+ break;
+ }
+ }
+ return rc;
+}
+
+static int pad_with_zeros(struct fsg_dev *fsg)
+{
+ struct fsg_buffhd *bh = fsg->common->next_buffhd_to_fill;
+ u32 nkeep = bh->inreq->length;
+ u32 nsend;
+ int rc;
+
+ bh->state = BUF_STATE_EMPTY; /* For the first iteration */
+ fsg->common->usb_amount_left = nkeep + fsg->common->residue;
+ while (fsg->common->usb_amount_left > 0) {
+
+ /* Wait for the next buffer to be free */
+ while (bh->state != BUF_STATE_EMPTY) {
+ rc = sleep_thread(fsg->common);
+ if (rc)
+ return rc;
+ }
+
+ nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
+ memset(bh->buf + nkeep, 0, nsend - nkeep);
+ bh->inreq->length = nsend;
+ bh->inreq->zero = 0;
+ start_transfer(fsg, fsg->bulk_in, bh->inreq,
+ &bh->inreq_busy, &bh->state);
+ bh = fsg->common->next_buffhd_to_fill = bh->next;
+ fsg->common->usb_amount_left -= nsend;
+ nkeep = 0;
+ }
+ return 0;
+}
+
+static int throw_away_data(struct fsg_common *common)
+{
+ struct fsg_buffhd *bh;
+ u32 amount;
+ int rc;
+
+ for (bh = common->next_buffhd_to_drain;
+ bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
+ bh = common->next_buffhd_to_drain) {
+
+ /* Throw away the data in a filled buffer */
+ if (bh->state == BUF_STATE_FULL) {
+ bh->state = BUF_STATE_EMPTY;
+ common->next_buffhd_to_drain = bh->next;
+
+ /* A short packet or an error ends everything */
+ if (bh->outreq->actual != bh->outreq->length ||
+ bh->outreq->status != 0) {
+ raise_exception(common,
+ FSG_STATE_ABORT_BULK_OUT);
+ return -EPIPE;
+ }
+ continue;
+ }
+
+ /* Try to submit another request if we need one */
+ bh = common->next_buffhd_to_fill;
+ if (bh->state == BUF_STATE_EMPTY
+ && common->usb_amount_left > 0) {
+ amount = min(common->usb_amount_left, FSG_BUFLEN);
+
+ /* amount is always divisible by 512, hence by
+ * the bulk-out maxpacket size */
+ bh->outreq->length = amount;
+ bh->bulk_out_intended_length = amount;
+ bh->outreq->short_not_ok = 1;
+ START_TRANSFER_OR(common, bulk_out, bh->outreq,
+ &bh->outreq_busy, &bh->state)
+ /* Don't know what to do if
+ * common->fsg is NULL */
+ return -EIO;
+ common->next_buffhd_to_fill = bh->next;
+ common->usb_amount_left -= amount;
+ continue;
+ }
+
+ /* Otherwise wait for something to happen */
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+ return 0;
+}
+
+
+static int finish_reply(struct fsg_common *common)
+{
+ struct fsg_buffhd *bh = common->next_buffhd_to_fill;
+ int rc = 0;
+
+ switch (common->data_dir) {
+ case DATA_DIR_NONE:
+ break; /* Nothing to send */
+
+ /* If we don't know whether the host wants to read or write,
+ * this must be CB or CBI with an unknown command. We mustn't
+ * try to send or receive any data. So stall both bulk pipes
+ * if we can and wait for a reset. */
+ case DATA_DIR_UNKNOWN:
+ if (!common->can_stall) {
+ /* Nothing */
+ } else if (fsg_is_set(common)) {
+ fsg_set_halt(common->fsg, common->fsg->bulk_out);
+ rc = halt_bulk_in_endpoint(common->fsg);
+ } else {
+ /* Don't know what to do if common->fsg is NULL */
+ rc = -EIO;
+ }
+ break;
+
+ /* All but the last buffer of data must have already been sent */
+ case DATA_DIR_TO_HOST:
+ if (common->data_size == 0) {
+ /* Nothing to send */
+
+ /* If there's no residue, simply send the last buffer */
+ } else if (common->residue == 0) {
+ bh->inreq->zero = 0;
+ START_TRANSFER_OR(common, bulk_in, bh->inreq,
+ &bh->inreq_busy, &bh->state)
+ return -EIO;
+ common->next_buffhd_to_fill = bh->next;
+
+ /* For Bulk-only, if we're allowed to stall then send the
+ * short packet and halt the bulk-in endpoint. If we can't
+ * stall, pad out the remaining data with 0's. */
+ } else if (common->can_stall) {
+ bh->inreq->zero = 1;
+ START_TRANSFER_OR(common, bulk_in, bh->inreq,
+ &bh->inreq_busy, &bh->state)
+ /* Don't know what to do if
+ * common->fsg is NULL */
+ rc = -EIO;
+ common->next_buffhd_to_fill = bh->next;
+ if (common->fsg)
+ rc = halt_bulk_in_endpoint(common->fsg);
+ } else if (fsg_is_set(common)) {
+ rc = pad_with_zeros(common->fsg);
+ } else {
+ /* Don't know what to do if common->fsg is NULL */
+ rc = -EIO;
+ }
+ break;
+
+ /* We have processed all we want from the data the host has sent.
+ * There may still be outstanding bulk-out requests. */
+ case DATA_DIR_FROM_HOST:
+ if (common->residue == 0) {
+ /* Nothing to receive */
+
+ /* Did the host stop sending unexpectedly early? */
+ } else if (common->short_packet_received) {
+ raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
+ rc = -EPIPE;
+
+ /* We haven't processed all the incoming data. Even though
+ * we may be allowed to stall, doing so would cause a race.
+ * The controller may already have ACK'ed all the remaining
+ * bulk-out packets, in which case the host wouldn't see a
+ * STALL. Not realizing the endpoint was halted, it wouldn't
+ * clear the halt -- leading to problems later on. */
+#if 0
+ } else if (common->can_stall) {
+ if (fsg_is_set(common))
+ fsg_set_halt(common->fsg,
+ common->fsg->bulk_out);
+ raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
+ rc = -EPIPE;
+#endif
+
+ /* We can't stall. Read in the excess data and throw it
+ * all away. */
+ } else {
+ rc = throw_away_data(common);
+ }
+ break;
+ }
+ return rc;
+}
+
+
+static int send_status(struct fsg_common *common)
+{
+ struct fsg_lun *curlun = &common->luns[common->lun];
+ struct fsg_buffhd *bh;
+ struct bulk_cs_wrap *csw;
+ int rc;
+ u8 status = US_BULK_STAT_OK;
+ u32 sd, sdinfo = 0;
+
+ /* Wait for the next buffer to become available */
+ bh = common->next_buffhd_to_fill;
+ while (bh->state != BUF_STATE_EMPTY) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+ if (curlun)
+ sd = curlun->sense_data;
+ else if (common->bad_lun_okay)
+ sd = SS_NO_SENSE;
+ else
+ sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+ if (common->phase_error) {
+ DBG(common, "sending phase-error status\n");
+ status = US_BULK_STAT_PHASE;
+ sd = SS_INVALID_COMMAND;
+ } else if (sd != SS_NO_SENSE) {
+ DBG(common, "sending command-failure status\n");
+ status = US_BULK_STAT_FAIL;
+ VDBG(common, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+ " info x%x\n",
+ SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+ }
+
+ /* Store and send the Bulk-only CSW */
+ csw = (void *)bh->buf;
+
+ csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
+ csw->Tag = common->tag;
+ csw->Residue = cpu_to_le32(common->residue);
+ csw->Status = status;
+
+ bh->inreq->length = US_BULK_CS_WRAP_LEN;
+ bh->inreq->zero = 0;
+ START_TRANSFER_OR(common, bulk_in, bh->inreq,
+ &bh->inreq_busy, &bh->state)
+ /* Don't know what to do if common->fsg is NULL */
+ return -EIO;
+
+ common->next_buffhd_to_fill = bh->next;
+ return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_common *common, int cmnd_size,
+ enum data_direction data_dir, unsigned int mask,
+ int needs_medium, const char *name)
+{
+ int i;
+ int lun = common->cmnd[1] >> 5;
+ static const char dirletter[4] = {'u', 'o', 'i', 'n'};
+ char hdlen[20];
+ struct fsg_lun *curlun;
+
+ hdlen[0] = 0;
+ if (common->data_dir != DATA_DIR_UNKNOWN)
+ sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
+ common->data_size);
+ VDBG(common, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
+ name, cmnd_size, dirletter[(int) data_dir],
+ common->data_size_from_cmnd, common->cmnd_size, hdlen);
+
+ /* We can't reply at all until we know the correct data direction
+ * and size. */
+ if (common->data_size_from_cmnd == 0)
+ data_dir = DATA_DIR_NONE;
+ if (common->data_size < common->data_size_from_cmnd) {
+ /* Host data size < Device data size is a phase error.
+ * Carry out the command, but only transfer as much as
+ * we are allowed. */
+ common->data_size_from_cmnd = common->data_size;
+ common->phase_error = 1;
+ }
+ common->residue = common->data_size;
+ common->usb_amount_left = common->data_size;
+
+ /* Conflicting data directions is a phase error */
+ if (common->data_dir != data_dir
+ && common->data_size_from_cmnd > 0) {
+ common->phase_error = 1;
+ return -EINVAL;
+ }
+
+ /* Verify the length of the command itself */
+ if (cmnd_size != common->cmnd_size) {
+
+ /* Special case workaround: There are plenty of buggy SCSI
+ * implementations. Many have issues with cbw->Length
+ * field passing a wrong command size. For those cases we
+ * always try to work around the problem by using the length
+ * sent by the host side provided it is at least as large
+ * as the correct command length.
+ * Examples of such cases would be MS-Windows, which issues
+ * REQUEST SENSE with cbw->Length == 12 where it should
+ * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+ * REQUEST SENSE with cbw->Length == 10 where it should
+ * be 6 as well.
+ */
+ if (cmnd_size <= common->cmnd_size) {
+ DBG(common, "%s is buggy! Expected length %d "
+ "but we got %d\n", name,
+ cmnd_size, common->cmnd_size);
+ cmnd_size = common->cmnd_size;
+ } else {
+ common->phase_error = 1;
+ return -EINVAL;
+ }
+ }
+
+ /* Check that the LUN values are consistent */
+ if (common->lun != lun)
+ DBG(common, "using LUN %d from CBW, not LUN %d from CDB\n",
+ common->lun, lun);
+
+ /* Check the LUN */
+ if (common->lun < common->nluns) {
+ curlun = &common->luns[common->lun];
+ if (common->cmnd[0] != SCSI_REQ_SENSE) {
+ curlun->sense_data = SS_NO_SENSE;
+ curlun->info_valid = 0;
+ }
+ } else {
+ curlun = NULL;
+ common->bad_lun_okay = 0;
+
+ /* INQUIRY and REQUEST SENSE commands are explicitly allowed
+ * to use unsupported LUNs; all others may not. */
+ if (common->cmnd[0] != SCSI_INQUIRY &&
+ common->cmnd[0] != SCSI_REQ_SENSE) {
+ DBG(common, "unsupported LUN %d\n", common->lun);
+ return -EINVAL;
+ }
+ }
+#if 0
+ /* If a unit attention condition exists, only INQUIRY and
+ * REQUEST SENSE commands are allowed; anything else must fail. */
+ if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+ common->cmnd[0] != SCSI_INQUIRY &&
+ common->cmnd[0] != SCSI_REQ_SENSE) {
+ curlun->sense_data = curlun->unit_attention_data;
+ curlun->unit_attention_data = SS_NO_SENSE;
+ return -EINVAL;
+ }
+#endif
+ /* Check that only command bytes listed in the mask are non-zero */
+ common->cmnd[1] &= 0x1f; /* Mask away the LUN */
+ for (i = 1; i < cmnd_size; ++i) {
+ if (common->cmnd[i] && !(mask & (1 << i))) {
+ if (curlun)
+ curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+ return -EINVAL;
+ }
+ }
+
+ return 0;
+}
+
+static int do_scsi_command(struct fsg_common *common)
+{
+ struct fsg_buffhd *bh;
+ int rc;
+ int reply = -EINVAL;
+ int i;
+ static char unknown[16];
+ struct fsg_lun *curlun = &common->luns[common->lun];
+
+ dump_cdb(common);
+
+ /* Wait for the next buffer to become available for data or status */
+ bh = common->next_buffhd_to_fill;
+ common->next_buffhd_to_drain = bh;
+ while (bh->state != BUF_STATE_EMPTY) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+ common->phase_error = 0;
+ common->short_packet_received = 0;
+
+ down_read(&common->filesem); /* We're using the backing file */
+ switch (common->cmnd[0]) {
+
+ case SCSI_INQUIRY:
+ common->data_size_from_cmnd = common->cmnd[4];
+ reply = check_command(common, 6, DATA_DIR_TO_HOST,
+ (1<<4), 0,
+ "INQUIRY");
+ if (reply == 0)
+ reply = do_inquiry(common, bh);
+ break;
+
+ case SCSI_MODE_SEL6:
+ common->data_size_from_cmnd = common->cmnd[4];
+ reply = check_command(common, 6, DATA_DIR_FROM_HOST,
+ (1<<1) | (1<<4), 0,
+ "MODE SELECT(6)");
+ if (reply == 0)
+ reply = do_mode_select(common, bh);
+ break;
+
+ case SCSI_MODE_SEL10:
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]);
+ reply = check_command(common, 10, DATA_DIR_FROM_HOST,
+ (1<<1) | (3<<7), 0,
+ "MODE SELECT(10)");
+ if (reply == 0)
+ reply = do_mode_select(common, bh);
+ break;
+
+ case SCSI_MODE_SEN6:
+ common->data_size_from_cmnd = common->cmnd[4];
+ reply = check_command(common, 6, DATA_DIR_TO_HOST,
+ (1<<1) | (1<<2) | (1<<4), 0,
+ "MODE SENSE(6)");
+ if (reply == 0)
+ reply = do_mode_sense(common, bh);
+ break;
+
+ case SCSI_MODE_SEN10:
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]);
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (1<<1) | (1<<2) | (3<<7), 0,
+ "MODE SENSE(10)");
+ if (reply == 0)
+ reply = do_mode_sense(common, bh);
+ break;
+
+ case SCSI_MED_REMOVL:
+ common->data_size_from_cmnd = 0;
+ reply = check_command(common, 6, DATA_DIR_NONE,
+ (1<<4), 0,
+ "PREVENT-ALLOW MEDIUM REMOVAL");
+ if (reply == 0)
+ reply = do_prevent_allow(common);
+ break;
+
+ case SCSI_READ6:
+ i = common->cmnd[4];
+ common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+ reply = check_command(common, 6, DATA_DIR_TO_HOST,
+ (7<<1) | (1<<4), 1,
+ "READ(6)");
+ if (reply == 0)
+ reply = do_read(common);
+ break;
+
+ case SCSI_READ10:
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]) << 9;
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (1<<1) | (0xf<<2) | (3<<7), 1,
+ "READ(10)");
+ if (reply == 0)
+ reply = do_read(common);
+ break;
+
+ case SCSI_READ12:
+ common->data_size_from_cmnd =
+ get_unaligned_be32(&common->cmnd[6]) << 9;
+ reply = check_command(common, 12, DATA_DIR_TO_HOST,
+ (1<<1) | (0xf<<2) | (0xf<<6), 1,
+ "READ(12)");
+ if (reply == 0)
+ reply = do_read(common);
+ break;
+
+ case SCSI_RD_CAPAC:
+ common->data_size_from_cmnd = 8;
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (0xf<<2) | (1<<8), 1,
+ "READ CAPACITY");
+ if (reply == 0)
+ reply = do_read_capacity(common, bh);
+ break;
+
+ case SCSI_RD_HEADER:
+ if (!common->luns[common->lun].cdrom)
+ goto unknown_cmnd;
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]);
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (3<<7) | (0x1f<<1), 1,
+ "READ HEADER");
+ if (reply == 0)
+ reply = do_read_header(common, bh);
+ break;
+
+ case SCSI_RD_TOC:
+ if (!common->luns[common->lun].cdrom)
+ goto unknown_cmnd;
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]);
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (7<<6) | (1<<1), 1,
+ "READ TOC");
+ if (reply == 0)
+ reply = do_read_toc(common, bh);
+ break;
+
+ case SCSI_RD_FMT_CAPAC:
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]);
+ reply = check_command(common, 10, DATA_DIR_TO_HOST,
+ (3<<7), 1,
+ "READ FORMAT CAPACITIES");
+ if (reply == 0)
+ reply = do_read_format_capacities(common, bh);
+ break;
+
+ case SCSI_REQ_SENSE:
+ common->data_size_from_cmnd = common->cmnd[4];
+ reply = check_command(common, 6, DATA_DIR_TO_HOST,
+ (1<<4), 0,
+ "REQUEST SENSE");
+ if (reply == 0)
+ reply = do_request_sense(common, bh);
+ break;
+
+ case SCSI_START_STP:
+ common->data_size_from_cmnd = 0;
+ reply = check_command(common, 6, DATA_DIR_NONE,
+ (1<<1) | (1<<4), 0,
+ "START-STOP UNIT");
+ if (reply == 0)
+ reply = do_start_stop(common);
+ break;
+
+ case SCSI_SYNC_CACHE:
+ common->data_size_from_cmnd = 0;
+ reply = check_command(common, 10, DATA_DIR_NONE,
+ (0xf<<2) | (3<<7), 1,
+ "SYNCHRONIZE CACHE");
+ if (reply == 0)
+ reply = do_synchronize_cache(common);
+ break;
+
+ case SCSI_TST_U_RDY:
+ common->data_size_from_cmnd = 0;
+ reply = check_command(common, 6, DATA_DIR_NONE,
+ 0, 1,
+ "TEST UNIT READY");
+ break;
+
+ /* Although optional, this command is used by MS-Windows. We
+ * support a minimal version: BytChk must be 0. */
+ case SCSI_VERIFY:
+ common->data_size_from_cmnd = 0;
+ reply = check_command(common, 10, DATA_DIR_NONE,
+ (1<<1) | (0xf<<2) | (3<<7), 1,
+ "VERIFY");
+ if (reply == 0)
+ reply = do_verify(common);
+ break;
+
+ case SCSI_WRITE6:
+ i = common->cmnd[4];
+ common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+ reply = check_command(common, 6, DATA_DIR_FROM_HOST,
+ (7<<1) | (1<<4), 1,
+ "WRITE(6)");
+ if (reply == 0)
+ reply = do_write(common);
+ break;
+
+ case SCSI_WRITE10:
+ common->data_size_from_cmnd =
+ get_unaligned_be16(&common->cmnd[7]) << 9;
+ reply = check_command(common, 10, DATA_DIR_FROM_HOST,
+ (1<<1) | (0xf<<2) | (3<<7), 1,
+ "WRITE(10)");
+ if (reply == 0)
+ reply = do_write(common);
+ break;
+
+ case SCSI_WRITE12:
+ common->data_size_from_cmnd =
+ get_unaligned_be32(&common->cmnd[6]) << 9;
+ reply = check_command(common, 12, DATA_DIR_FROM_HOST,
+ (1<<1) | (0xf<<2) | (0xf<<6), 1,
+ "WRITE(12)");
+ if (reply == 0)
+ reply = do_write(common);
+ break;
+
+ /* Some mandatory commands that we recognize but don't implement.
+ * They don't mean much in this setting. It's left as an exercise
+ * for anyone interested to implement RESERVE and RELEASE in terms
+ * of Posix locks. */
+ case SCSI_FORMAT:
+ case SCSI_RELEASE:
+ case SCSI_RESERVE:
+ case SCSI_SEND_DIAG:
+ /* Fall through */
+
+ default:
+unknown_cmnd:
+ common->data_size_from_cmnd = 0;
+ sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
+ reply = check_command(common, common->cmnd_size,
+ DATA_DIR_UNKNOWN, 0xff, 0, unknown);
+ if (reply == 0) {
+ curlun->sense_data = SS_INVALID_COMMAND;
+ reply = -EINVAL;
+ }
+ break;
+ }
+ up_read(&common->filesem);
+
+ if (reply == -EPIPE)
+ return -EPIPE;
+
+ /* Set up the single reply buffer for finish_reply() */
+ if (reply == -EINVAL)
+ reply = 0; /* Error reply length */
+ if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
+ reply = min((u32) reply, common->data_size_from_cmnd);
+ bh->inreq->length = reply;
+ bh->state = BUF_STATE_FULL;
+ common->residue -= reply;
+ } /* Otherwise it's already set */
+
+ return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+ struct usb_request *req = bh->outreq;
+ struct bulk_cb_wrap *cbw = req->buf;
+ struct fsg_common *common = fsg->common;
+
+ /* Was this a real packet? Should it be ignored? */
+ if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+ return -EINVAL;
+
+ /* Is the CBW valid? */
+ if (req->actual != US_BULK_CB_WRAP_LEN ||
+ cbw->Signature != cpu_to_le32(
+ US_BULK_CB_SIGN)) {
+ DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+ req->actual,
+ le32_to_cpu(cbw->Signature));
+
+ /* The Bulk-only spec says we MUST stall the IN endpoint
+ * (6.6.1), so it's unavoidable. It also says we must
+ * retain this state until the next reset, but there's
+ * no way to tell the controller driver it should ignore
+ * Clear-Feature(HALT) requests.
+ *
+ * We aren't required to halt the OUT endpoint; instead
+ * we can simply accept and discard any data received
+ * until the next reset. */
+ wedge_bulk_in_endpoint(fsg);
+ set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+ return -EINVAL;
+ }
+
+ /* Is the CBW meaningful? */
+ if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
+ cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+ DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+ "cmdlen %u\n",
+ cbw->Lun, cbw->Flags, cbw->Length);
+
+ /* We can do anything we want here, so let's stall the
+ * bulk pipes if we are allowed to. */
+ if (common->can_stall) {
+ fsg_set_halt(fsg, fsg->bulk_out);
+ halt_bulk_in_endpoint(fsg);
+ }
+ return -EINVAL;
+ }
+
+ /* Save the command for later */
+ common->cmnd_size = cbw->Length;
+ memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
+ if (cbw->Flags & US_BULK_FLAG_IN)
+ common->data_dir = DATA_DIR_TO_HOST;
+ else
+ common->data_dir = DATA_DIR_FROM_HOST;
+ common->data_size = le32_to_cpu(cbw->DataTransferLength);
+ if (common->data_size == 0)
+ common->data_dir = DATA_DIR_NONE;
+ common->lun = cbw->Lun;
+ common->tag = cbw->Tag;
+ return 0;
+}
+
+
+static int get_next_command(struct fsg_common *common)
+{
+ struct fsg_buffhd *bh;
+ int rc = 0;
+
+ /* Wait for the next buffer to become available */
+ bh = common->next_buffhd_to_fill;
+ while (bh->state != BUF_STATE_EMPTY) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+ /* Queue a request to read a Bulk-only CBW */
+ set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN);
+ bh->outreq->short_not_ok = 1;
+ START_TRANSFER_OR(common, bulk_out, bh->outreq,
+ &bh->outreq_busy, &bh->state)
+ /* Don't know what to do if common->fsg is NULL */
+ return -EIO;
+
+ /* We will drain the buffer in software, which means we
+ * can reuse it for the next filling. No need to advance
+ * next_buffhd_to_fill. */
+
+ /* Wait for the CBW to arrive */
+ while (bh->state != BUF_STATE_FULL) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+ rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
+ bh->state = BUF_STATE_EMPTY;
+
+ return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_common *common, struct usb_ep *ep)
+{
+ int rc;
+
+ ep->driver_data = common;
+ rc = usb_ep_enable(ep);
+ if (rc)
+ ERROR(common, "can't enable %s, result %d\n", ep->name, rc);
+ return rc;
+}
+
+static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
+ struct usb_request **preq)
+{
+ *preq = usb_ep_alloc_request(ep);
+ if (*preq)
+ return 0;
+ ERROR(common, "can't allocate request for %s\n", ep->name);
+ return -ENOMEM;
+}
+
+/* Reset interface setting and re-init endpoint state (toggle etc). */
+static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
+{
+ struct fsg_dev *fsg;
+ int i, rc = 0;
+
+ if (common->running)
+ DBG(common, "reset interface\n");
+
+reset:
+ /* Deallocate the requests */
+ if (common->fsg) {
+ fsg = common->fsg;
+
+ for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+ struct fsg_buffhd *bh = &common->buffhds[i];
+
+ if (bh->inreq) {
+ usb_ep_free_request(fsg->bulk_in, bh->inreq);
+ bh->inreq = NULL;
+ }
+ if (bh->outreq) {
+ usb_ep_free_request(fsg->bulk_out, bh->outreq);
+ bh->outreq = NULL;
+ }
+ }
+
+ /* Disable the endpoints */
+ if (fsg->bulk_in_enabled) {
+ usb_ep_disable(fsg->bulk_in);
+ fsg->bulk_in_enabled = 0;
+ }
+ if (fsg->bulk_out_enabled) {
+ usb_ep_disable(fsg->bulk_out);
+ fsg->bulk_out_enabled = 0;
+ }
+
+ common->fsg = NULL;
+ wake_up(&common->fsg_wait);
+ }
+
+ common->running = 0;
+ if (!new_fsg || rc)
+ return rc;
+
+ common->fsg = new_fsg;
+ fsg = common->fsg;
+
+ /* Enable the endpoints */
+ fsg->bulk_in->desc = fsg_ep_desc(common->gadget,
+ &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+ rc = enable_endpoint(common, fsg->bulk_in);
+ if (rc)
+ goto reset;
+ fsg->bulk_in_enabled = 1;
+
+ fsg->bulk_out->desc = fsg_ep_desc(common->gadget,
+ &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+ rc = enable_endpoint(common, fsg->bulk_out);
+ if (rc)
+ goto reset;
+ fsg->bulk_out_enabled = 1;
+ common->bulk_out_maxpacket = 512;
+ clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+ /* Allocate the requests */
+ for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+ struct fsg_buffhd *bh = &common->buffhds[i];
+
+ rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
+ if (rc)
+ goto reset;
+ rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
+ if (rc)
+ goto reset;
+ bh->inreq->buf = bh->outreq->buf = bh->buf;
+ bh->inreq->context = bh->outreq->context = bh;
+ bh->inreq->complete = bulk_in_complete;
+ bh->outreq->complete = bulk_out_complete;
+ }
+
+ common->running = 1;
+
+ return rc;
+}
+
+
+/****************************** ALT CONFIGS ******************************/
+
+
+static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+ struct fsg_dev *fsg = fsg_from_func(f);
+ fsg->common->new_fsg = fsg;
+ raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+ return 0;
+}
+
+static void fsg_disable(struct usb_function *f)
+{
+ struct fsg_dev *fsg = fsg_from_func(f);
+ fsg->common->new_fsg = NULL;
+ raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_common *common)
+{
+ int i;
+ struct fsg_buffhd *bh;
+ enum fsg_state old_state;
+ struct fsg_lun *curlun;
+ unsigned int exception_req_tag;
+
+ /* Cancel all the pending transfers */
+ if (common->fsg) {
+ for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+ bh = &common->buffhds[i];
+ if (bh->inreq_busy)
+ usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
+ if (bh->outreq_busy)
+ usb_ep_dequeue(common->fsg->bulk_out,
+ bh->outreq);
+ }
+
+ /* Wait until everything is idle */
+ for (;;) {
+ int num_active = 0;
+ for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+ bh = &common->buffhds[i];
+ num_active += bh->inreq_busy + bh->outreq_busy;
+ }
+ if (num_active == 0)
+ break;
+ if (sleep_thread(common))
+ return;
+ }
+
+ /* Clear out the controller's fifos */
+ if (common->fsg->bulk_in_enabled)
+ usb_ep_fifo_flush(common->fsg->bulk_in);
+ if (common->fsg->bulk_out_enabled)
+ usb_ep_fifo_flush(common->fsg->bulk_out);
+ }
+
+ /* Reset the I/O buffer states and pointers, the SCSI
+ * state, and the exception. Then invoke the handler. */
+
+ for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+ bh = &common->buffhds[i];
+ bh->state = BUF_STATE_EMPTY;
+ }
+ common->next_buffhd_to_fill = &common->buffhds[0];
+ common->next_buffhd_to_drain = &common->buffhds[0];
+ exception_req_tag = common->exception_req_tag;
+ old_state = common->state;
+
+ report_exception("handling", old_state);
+
+ if (old_state == FSG_STATE_ABORT_BULK_OUT)
+ common->state = FSG_STATE_STATUS_PHASE;
+ else {
+ for (i = 0; i < common->nluns; ++i) {
+ curlun = &common->luns[i];
+ curlun->sense_data = SS_NO_SENSE;
+ curlun->info_valid = 0;
+ }
+ common->state = FSG_STATE_IDLE;
+ }
+
+ /* Carry out any extra actions required for the exception */
+ switch (old_state) {
+ case FSG_STATE_ABORT_BULK_OUT:
+ send_status(common);
+
+ if (common->state == FSG_STATE_STATUS_PHASE)
+ common->state = FSG_STATE_IDLE;
+ break;
+
+ case FSG_STATE_RESET:
+ /* In case we were forced against our will to halt a
+ * bulk endpoint, clear the halt now. (The SuperH UDC
+ * requires this.) */
+ if (!fsg_is_set(common))
+ break;
+ if (test_and_clear_bit(IGNORE_BULK_OUT,
+ &common->fsg->atomic_bitflags))
+ usb_ep_clear_halt(common->fsg->bulk_in);
+
+ if (common->ep0_req_tag == exception_req_tag)
+ ep0_queue(common); /* Complete the status stage */
+
+ break;
+
+ case FSG_STATE_CONFIG_CHANGE:
+ do_set_interface(common, common->new_fsg);
+ break;
+
+ case FSG_STATE_EXIT:
+ case FSG_STATE_TERMINATED:
+ do_set_interface(common, NULL); /* Free resources */
+ common->state = FSG_STATE_TERMINATED; /* Stop the thread */
+ break;
+
+ case FSG_STATE_INTERFACE_CHANGE:
+ case FSG_STATE_DISCONNECT:
+ case FSG_STATE_COMMAND_PHASE:
+ case FSG_STATE_DATA_PHASE:
+ case FSG_STATE_STATUS_PHASE:
+ case FSG_STATE_IDLE:
+ break;
+ }
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *common_)
+{
+ struct fsg_common *common = common_;
+ int ret = 0;
+
+ /* The main loop */
+ while (common->state != FSG_STATE_TERMINATED) {
+ if (exception_in_progress(common)) {
+ handle_exception(common);
+ continue;
+ }
+
+ if (!common->running) {
+ ret = sleep_thread(common);
+ if (ret)
+ break;
+ continue;
+ }
+
+ ret = get_next_command(common);
+ if (ret)
+ continue;
+
+ if (!exception_in_progress(common))
+ common->state = FSG_STATE_DATA_PHASE;
+
+ if (do_scsi_command(common) || finish_reply(common))
+ continue;
+
+ if (!exception_in_progress(common))
+ common->state = FSG_STATE_STATUS_PHASE;
+
+ if (send_status(common))
+ continue;
+
+ if (!exception_in_progress(common))
+ common->state = FSG_STATE_IDLE;
+ }
+
+ if (ret && ret != -ERESTARTSYS)
+ pr_warn("%s: error %pe\n", __func__, ERR_PTR(ret));
+
+ complete_and_exit(&common->thread_notifier, 0);
+}
+
+static void fsg_common_release(struct kref *ref);
+
+static struct fsg_common *fsg_common_setup(void)
+{
+ struct fsg_common *common;
+
+ /* Allocate? */
+ common = calloc(sizeof(*common), 1);
+ if (!common)
+ return NULL;
+ common->free_storage_on_release = 1;
+
+ init_completion(&common->thread_notifier);
+
+ common->ops = NULL;
+ common->private_data = NULL;
+
+ return common;
+}
+
+static int fsg_common_init(struct fsg_common *common,
+ struct usb_composite_dev *cdev)
+{
+ struct usb_gadget *gadget = cdev->gadget;
+ struct file_list_entry *fentry;
+ struct fsg_buffhd *bh;
+ struct fsg_lun *curlun;
+ int nluns, i, fd = -1, rc;
+
+ ums_count = 0;
+
+ common->gadget = gadget;
+ common->ep0 = gadget->ep0;
+ common->ep0req = cdev->req;
+
+ file_list_for_each_entry(ums_files, fentry) {
+ unsigned flags = O_RDWR;
+ struct stat st;
+
+ if (fentry->flags) {
+ pr_err("flags not supported\n");
+ return -ENOSYS;
+ }
+
+ fd = open(fentry->filename, flags);
+ if (fd < 0) {
+ pr_err("open('%s') failed: %pe\n",
+ fentry->filename, ERR_PTR(fd));
+ return fd;
+ }
+
+ rc = fstat(fd, &st);
+ if (rc < 0) {
+ pr_err("stat('%s') failed: %pe\n",
+ fentry->filename, ERR_PTR(rc));
+ goto close;
+ }
+
+ if (st.st_size % SECTOR_SIZE != 0) {
+ pr_err("exporting '%s' failed: invalid block size\n",
+ fentry->filename);
+ goto close;
+ }
+
+ ums[ums_count].fd = fd;
+ ums[ums_count].num_sectors = st.st_size / SECTOR_SIZE;
+
+ strlcpy(ums[ums_count].name, fentry->name, sizeof(ums[ums_count].name));
+
+ DBG(common, "LUN %d, %s sector_count %#x\n",
+ ums_count, fentry->name, ums[ums_count].num_sectors);
+
+ ums_count++;
+ }
+
+ /* Find out how many LUNs there should be */
+ nluns = ums_count;
+ if (nluns < 1 || nluns > FSG_MAX_LUNS) {
+ pr_warn("invalid number of LUNs: %u\n", nluns);
+ rc = -EINVAL;
+ goto close;
+ }
+
+ /* Maybe allocate device-global string IDs, and patch descriptors */
+ if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
+ rc = usb_string_id(cdev);
+ if (unlikely(rc < 0))
+ goto error_release;
+ fsg_strings[FSG_STRING_INTERFACE].id = rc;
+ fsg_intf_desc.iInterface = rc;
+ }
+
+ /* Create the LUNs, open their backing files, and register the
+ * LUN devices in sysfs. */
+ curlun = calloc(nluns, sizeof *curlun);
+ if (!curlun) {
+ rc = -ENOMEM;
+ goto error_release;
+ }
+ common->nluns = nluns;
+
+ for (i = 0; i < nluns; i++) {
+ common->luns[i].removable = 1;
+
+ rc = fsg_lun_open(&common->luns[i], ums[i].num_sectors, "");
+ if (rc)
+ goto error_luns;
+ }
+ common->lun = 0;
+
+ /* Data buffers cyclic list */
+ bh = common->buffhds;
+
+ i = FSG_NUM_BUFFERS;
+ goto buffhds_first_it;
+ do {
+ bh->next = bh + 1;
+ ++bh;
+buffhds_first_it:
+ bh->inreq_busy = 0;
+ bh->outreq_busy = 0;
+ bh->buf = dma_alloc(FSG_BUFLEN);
+ if (unlikely(!bh->buf)) {
+ rc = -ENOMEM;
+ goto error_release;
+ }
+ } while (--i);
+ bh->next = common->buffhds;
+
+ snprintf(common->inquiry_string, sizeof common->inquiry_string,
+ "%-8s%-16s%04x",
+ "Linux ",
+ "File-Store Gadget",
+ 0xffff);
+
+ /* Some peripheral controllers are known not to be able to
+ * halt bulk endpoints correctly. If one of them is present,
+ * disable stalls.
+ */
+
+ /* Information */
+ DBG(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
+ DBG(common, "Number of LUNs=%d\n", common->nluns);
+
+ return 0;
+
+error_luns:
+ common->nluns = i + 1;
+error_release:
+ common->state = FSG_STATE_TERMINATED; /* The thread is dead */
+ /* Call fsg_common_release() directly, ref might be not
+ * initialised */
+ fsg_common_release(&common->ref);
+close:
+ close(fd);
+ return rc;
+}
+
+static void fsg_common_release(struct kref *ref)
+{
+ struct fsg_common *common = container_of(ref, struct fsg_common, ref);
+ struct fsg_buffhd *bh;
+ unsigned i;
+
+ /* If the thread isn't already dead, tell it to exit now */
+ if (common->state != FSG_STATE_TERMINATED) {
+ raise_exception(common, FSG_STATE_EXIT);
+ wait_for_completion_interruptible(&common->thread_notifier);
+ free_kthread_struct(thread_task);
+ }
+
+ bh = common->buffhds;
+ i = FSG_NUM_BUFFERS;
+
+ do {
+ dma_free(bh->buf);
+ } while (++bh, --i);
+
+ if (common->free_storage_on_release)
+ kfree(common);
+}
+
+
+static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+ struct fsg_dev *fsg = fsg_from_func(f);
+ struct fsg_common *common = fsg->common;
+ int i;
+
+ DBG(fsg, "unbind\n");
+
+ if (fsg->common->fsg == fsg) {
+ fsg->common->new_fsg = NULL;
+ fsg->common->shutdown = true;
+ raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+ wait_event(common->fsg_wait, common->fsg != fsg);
+ }
+
+ for (i = 0; i < ums_count; i++)
+ close(ums[i].fd);
+
+ usb_free_all_descriptors(&fsg->function);
+
+ ums_files = NULL;
+}
+
+static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
+{
+ struct fsg_dev *fsg = fsg_from_func(f);
+ struct usb_gadget *gadget = c->cdev->gadget;
+ int i = -EINVAL;
+ struct usb_ep *ep;
+ struct usb_descriptor_header **hs_function = NULL;
+ struct fsg_common *common = fsg->common;
+
+ if (!ums_files) {
+ struct f_ums_opts *opts = container_of(f->fi, struct f_ums_opts, func_inst);
+
+ ums_files = opts->files;
+ }
+
+ fsg->gadget = gadget;
+
+ DBG(fsg, "bind\n");
+
+ i = fsg_common_init(common, c->cdev);
+ if (i)
+ return i;
+
+ thread_task = kthread_run(fsg_main_thread, common, "file-storage");
+ if (IS_ERR(thread_task))
+ return PTR_ERR(thread_task);
+
+ /* New interface */
+ i = usb_interface_id(c, f);
+ if (i < 0)
+ return i;
+ fsg_intf_desc.bInterfaceNumber = i;
+ fsg->interface_number = i;
+
+ /* Find all the endpoints we will use */
+ ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+ if (!ep)
+ goto autoconf_fail;
+ ep->driver_data = common; /* claim the endpoint */
+ fsg->bulk_in = ep;
+
+ ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+ if (!ep)
+ goto autoconf_fail;
+ ep->driver_data = common; /* claim the endpoint */
+ fsg->bulk_out = ep;
+
+ if (gadget_is_dualspeed(gadget)) {
+ /* Assume endpoint addresses are the same for both speeds */
+ fsg_hs_bulk_in_desc.bEndpointAddress =
+ fsg_fs_bulk_in_desc.bEndpointAddress;
+ fsg_hs_bulk_out_desc.bEndpointAddress =
+ fsg_fs_bulk_out_desc.bEndpointAddress;
+ hs_function = fsg_hs_function;
+ }
+
+ /* Copy descriptors */
+ return usb_assign_descriptors(f, fsg_fs_function, hs_function, NULL);
+
+autoconf_fail:
+ ERROR(fsg, "unable to autoconfigure all endpoints\n");
+ return -ENOTSUPP;
+}
+
+
+/****************************** ADD FUNCTION ******************************/
+
+static struct usb_gadget_strings *fsg_strings_array[] = {
+ &fsg_stringtab,
+ NULL,
+};
+
+static void fsg_free(struct usb_function *f)
+{
+ struct fsg_dev *fsg;
+
+ fsg = container_of(f, struct fsg_dev, function);
+
+ kfree(fsg);
+}
+
+static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
+{
+ struct f_ums_opts *opts = fsg_opts_from_func_inst(fi);
+ struct fsg_common *common = opts->common;
+ struct fsg_dev *fsg;
+
+ fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
+ if (!fsg)
+ return ERR_PTR(-ENOMEM);
+
+ fsg->function.name = FSG_DRIVER_DESC;
+ fsg->function.strings = fsg_strings_array;
+ /* descriptors are per-instance copies */
+ fsg->function.bind = fsg_bind;
+ fsg->function.set_alt = fsg_set_alt;
+ fsg->function.setup = fsg_setup;
+ fsg->function.disable = fsg_disable;
+ fsg->function.unbind = fsg_unbind;
+ fsg->function.free_func = fsg_free;
+
+ fsg->common = common;
+ common->fsg = fsg;
+
+ return &fsg->function;
+}
+
+static void fsg_free_instance(struct usb_function_instance *fi)
+{
+ struct f_ums_opts *opts = fsg_opts_from_func_inst(fi);
+
+ fsg_common_release(&opts->common->ref);
+
+ kfree(opts);
+}
+
+static struct usb_function_instance *fsg_alloc_inst(void)
+{
+ struct f_ums_opts *opts;
+
+ opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+ if (!opts)
+ return ERR_PTR(-ENOMEM);
+
+ opts->func_inst.free_func_inst = fsg_free_instance;
+
+ opts->common = fsg_common_setup();
+ if (!opts->common) {
+ free(opts);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ return &opts->func_inst;
+}
+
+DECLARE_USB_FUNCTION_INIT(ums, fsg_alloc_inst, fsg_alloc);
+
+#define STRING_MANUFACTURER_IDX 0
+#define STRING_PRODUCT_IDX 1
+#define STRING_DESCRIPTION_IDX 2
+
+static struct usb_string strings_dev[] = {
+ [STRING_MANUFACTURER_IDX].s = NULL,
+ [STRING_PRODUCT_IDX].s = NULL,
+ [STRING_DESCRIPTION_IDX].s = "USB Mass Storage",
+ { } /* end of list */
+};
+
+static struct usb_function_instance *fi_fsg;
+static struct usb_function *f_fsg;
+
+static struct usb_configuration config = {
+ .label = "USB Mass Storage",
+ .bConfigurationValue = 1,
+ .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
+ .iConfiguration = 2,
+};
+
+static int ums_driver_bind(struct usb_composite_dev *cdev)
+{
+ struct usb_gadget *gadget = cdev->gadget;
+ int id;
+
+ if (gadget->vendor_id && gadget->product_id) {
+ ums_dev_descriptor.idVendor = cpu_to_le16(gadget->vendor_id);
+ ums_dev_descriptor.idProduct = cpu_to_le16(gadget->product_id);
+ } else {
+ ums_dev_descriptor.idVendor = cpu_to_le16(FSG_VENDOR_ID);
+ ums_dev_descriptor.idProduct = cpu_to_le16(FSG_PRODUCT_ID);
+ }
+
+ strings_dev[STRING_MANUFACTURER_IDX].s = gadget->manufacturer;
+ strings_dev[STRING_PRODUCT_IDX].s = gadget->productname;
+
+ id = usb_string_id(cdev);
+ if (id < 0)
+ goto fail;
+
+ strings_dev[STRING_MANUFACTURER_IDX].id = id;
+ ums_dev_descriptor.iManufacturer = id;
+
+ id = usb_string_id(cdev);
+ if (id < 0)
+ goto fail;
+
+ strings_dev[STRING_PRODUCT_IDX].id = id;
+ ums_dev_descriptor.iProduct = id;
+
+ id = usb_add_config_only(cdev, &config);
+ if (id)
+ return id;
+
+ fi_fsg = usb_get_function_instance("ums");
+ if (IS_ERR(fi_fsg)) {
+ id = PTR_ERR(fi_fsg);
+ goto fail;
+ }
+
+ f_fsg = usb_get_function(fi_fsg);
+ if (IS_ERR(f_fsg)) {
+ id = PTR_ERR(f_fsg);
+ goto fail;
+ }
+
+ id = usb_add_function(&config, f_fsg);
+ if (id)
+ goto fail;
+
+ return 0;
+fail:
+ return id;
+}
+
+static int ums_driver_unbind(struct usb_composite_dev *cdev)
+{
+ usb_put_function(f_fsg);
+ usb_put_function_instance(fi_fsg);
+
+ return 0;
+}
+
+static struct usb_composite_driver ums_driver = {
+ .name = "ums",
+ .dev = &ums_dev_descriptor,
+ .strings = fsg_strings_array,
+ .max_speed = USB_SPEED_HIGH,
+ .bind = ums_driver_bind,
+ .unbind = ums_driver_unbind,
+};
+
+int usb_ums_register(struct f_ums_opts *opts)
+{
+ int ret;
+
+ if (ums_files)
+ return -EBUSY;
+
+ ums_files = opts->files;
+
+ ret = usb_composite_probe(&ums_driver);
+ if (ret)
+ goto out;
+
+ while (poll())
+ ;
+
+ usb_composite_unregister(&ums_driver);
+out:
+ ums_files = NULL;
+
+ return ret;
+}
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
new file mode 100644
index 000000000000..88cd745063e4
--- /dev/null
+++ b/drivers/usb/gadget/storage_common.c
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * storage_common.c -- Common definitions for mass storage functionality
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * Copyeight (C) 2009 Samsung Electronics
+ * Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
+ *
+ * Ported to u-boot:
+ * Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+ *
+ * Code refactoring & cleanup:
+ * Łukasz Majewski <l.majewski@samsung.com>
+ */
+
+#include "storage_common.h"
+
+/*
+ * This file requires the following identifiers used in USB strings to
+ * be defined (each of type pointer to char):
+ * - fsg_string_manufacturer -- name of the manufacturer
+ * - fsg_string_product -- name of the product
+ * - fsg_string_serial -- product's serial
+ * - fsg_string_config -- name of the configuration
+ * - fsg_string_interface -- name of the interface
+ * The first four are only needed when FSG_DESCRIPTORS_DEVICE_STRINGS
+ * macro is defined prior to including this file.
+ */
+
+/* There is only one interface. */
+
+struct usb_interface_descriptor fsg_intf_desc = {
+ .bLength = sizeof fsg_intf_desc,
+ .bDescriptorType = USB_DT_INTERFACE,
+
+ .bNumEndpoints = 2, /* Adjusted during fsg_bind() */
+ .bInterfaceClass = USB_CLASS_MASS_STORAGE,
+ .bInterfaceSubClass = USB_SC_SCSI, /* Adjusted during fsg_bind() */
+ .bInterfaceProtocol = USB_PR_BULK, /* Adjusted during fsg_bind() */
+ .iInterface = FSG_STRING_INTERFACE,
+};
+
+/*
+ * Three full-speed endpoint descriptors: bulk-in, bulk-out, and
+ * interrupt-in.
+ */
+
+struct usb_endpoint_descriptor fsg_fs_bulk_in_desc = {
+ .bLength = USB_DT_ENDPOINT_SIZE,
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ .bEndpointAddress = USB_DIR_IN,
+ .bmAttributes = USB_ENDPOINT_XFER_BULK,
+ /* wMaxPacketSize set by autoconfiguration */
+};
+
+struct usb_endpoint_descriptor fsg_fs_bulk_out_desc = {
+ .bLength = USB_DT_ENDPOINT_SIZE,
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ .bEndpointAddress = USB_DIR_OUT,
+ .bmAttributes = USB_ENDPOINT_XFER_BULK,
+ /* wMaxPacketSize set by autoconfiguration */
+};
+
+struct usb_descriptor_header *fsg_fs_function[] = {
+ (struct usb_descriptor_header *) &fsg_intf_desc,
+ (struct usb_descriptor_header *) &fsg_fs_bulk_in_desc,
+ (struct usb_descriptor_header *) &fsg_fs_bulk_out_desc,
+ NULL,
+};
+
+/*
+ * USB 2.0 devices need to expose both high speed and full speed
+ * descriptors, unless they only run at full speed.
+ *
+ * That means alternate endpoint descriptors (bigger packets)
+ * and a "device qualifier" ... plus more construction options
+ * for the configuration descriptor.
+ */
+struct usb_endpoint_descriptor fsg_hs_bulk_in_desc = {
+ .bLength = USB_DT_ENDPOINT_SIZE,
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
+ .bmAttributes = USB_ENDPOINT_XFER_BULK,
+ .wMaxPacketSize = cpu_to_le16(512),
+};
+
+struct usb_endpoint_descriptor fsg_hs_bulk_out_desc = {
+ .bLength = USB_DT_ENDPOINT_SIZE,
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
+ .bmAttributes = USB_ENDPOINT_XFER_BULK,
+ .wMaxPacketSize = cpu_to_le16(512),
+ .bInterval = 1, /* NAK every 1 uframe */
+};
+
+struct usb_descriptor_header *fsg_hs_function[] = {
+ (struct usb_descriptor_header *) &fsg_intf_desc,
+ (struct usb_descriptor_header *) &fsg_hs_bulk_in_desc,
+ (struct usb_descriptor_header *) &fsg_hs_bulk_out_desc,
+ NULL,
+};
+
+/* Maxpacket and other transfer characteristics vary by speed. */
+struct usb_endpoint_descriptor *
+fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
+ struct usb_endpoint_descriptor *hs)
+{
+ if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+ return hs;
+ return fs;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * If the next two routines are called while the gadget is registered,
+ * the caller must own fsg->filesem for writing.
+ */
+
+int fsg_lun_open(struct fsg_lun *curlun, unsigned int num_sectors,
+ const char *filename)
+{
+ int ro;
+
+ /* R/W if we can, R/O if we must */
+ ro = curlun->initially_ro;
+
+ curlun->ro = ro;
+ curlun->file_length = num_sectors << 9;
+ curlun->num_sectors = num_sectors;
+ debug("open backing file: %s\n", filename);
+
+ return 0;
+}
+
+void fsg_lun_close(struct fsg_lun *curlun)
+{
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * Sync the file data, don't bother with the metadata.
+ * This code was copied from fs/buffer.c:sys_fdatasync().
+ */
+int fsg_lun_fsync_sub(struct fsg_lun *curlun)
+{
+ return 0;
+}
+
+void store_cdrom_address(u8 *dest, int msf, u32 addr)
+{
+ if (msf) {
+ /* Convert to Minutes-Seconds-Frames */
+ addr >>= 2; /* Convert to 2048-byte frames */
+ addr += 2*75; /* Lead-in occupies 2 seconds */
+ dest[3] = addr % 75; /* Frames */
+ addr /= 75;
+ dest[2] = addr % 60; /* Seconds */
+ addr /= 60;
+ dest[1] = addr; /* Minutes */
+ dest[0] = 0; /* Reserved */
+ } else {
+ /* Absolute sector */
+ put_unaligned_be32(addr, dest);
+ }
+}
+
+/*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
new file mode 100644
index 000000000000..ce07a7dac72c
--- /dev/null
+++ b/drivers/usb/gadget/storage_common.h
@@ -0,0 +1,245 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef USB_STORAGE_COMMON_H
+#define USB_STORAGE_COMMON_H
+
+#include <driver.h>
+#include <usb/storage.h>
+#include <asm/unaligned.h>
+#include <usb/mass_storage.h>
+
+#ifndef DEBUG
+#undef VERBOSE_DEBUG
+#undef DUMP_MSGS
+#endif /* !DEBUG */
+
+#define VLDBG(lun, fmt, args...) dev_vdbg(&(lun)->dev, fmt, ## args)
+#define LDBG(lun, fmt, args...) dev_dbg (&(lun)->dev, fmt, ## args)
+#define LERROR(lun, fmt, args...) dev_err (&(lun)->dev, fmt, ## args)
+#define LWARN(lun, fmt, args...) dev_warn(&(lun)->dev, fmt, ## args)
+#define LINFO(lun, fmt, args...) dev_info(&(lun)->dev, fmt, ## args)
+
+/*
+ * Keep those macros in sync with those in
+ * include/linux/usb/composite.h or else GCC will complain. If they
+ * are identical (the same names of arguments, white spaces in the
+ * same places) GCC will allow redefinition otherwise (even if some
+ * white space is removed or added) warning will be issued.
+ *
+ * Those macros are needed here because File Storage Gadget does not
+ * include the composite.h header. For composite gadgets those macros
+ * are redundant since composite.h is included any way.
+ *
+ * One could check whether those macros are already defined (which
+ * would indicate composite.h had been included) or not (which would
+ * indicate we were in FSG) but this is not done because a warning is
+ * desired if definitions here differ from the ones in composite.h.
+ *
+ * We want the definitions to match and be the same in File Storage
+ * Gadget as well as Mass Storage Function (and so composite gadgets
+ * using MSF). If someone changes them in composite.h it will produce
+ * a warning in this file when building MSF.
+ */
+
+#define DBG(d, fmt, args...) \
+ dev_dbg(&(d)->gadget->dev , fmt , ## args)
+#define VDBG(d, fmt, args...) \
+ dev_vdbg(&(d)->gadget->dev , fmt , ## args)
+#define ERROR(d, fmt, args...) \
+ dev_err(&(d)->gadget->dev , fmt , ## args)
+#define WARNING(d, fmt, args...) \
+ dev_warn(&(d)->gadget->dev , fmt , ## args)
+#define INFO(d, fmt, args...) \
+ dev_info(&(d)->gadget->dev , fmt , ## args)
+
+#ifdef DUMP_MSGS
+
+/* dump_msg(fsg, const char * label, const u8 * buf, unsigned length); */
+# define dump_msg(fsg, label, buf, length) do { \
+ if (length < 512) { \
+ DBG(fsg, "%s, length %u:\n", label, length); \
+ print_hex_dump("", DUMP_PREFIX_OFFSET, \
+ 16, 1, buf, length, 0); \
+ } \
+} while (0)
+
+# define dump_cdb(fsg) do { } while (0)
+
+#else
+
+# define dump_msg(fsg, /* const char * */ label, \
+ /* const u8 * */ buf, /* unsigned */ length) do { } while (0)
+
+# ifdef VERBOSE_DEBUG
+
+# define dump_cdb(fsg) \
+ print_hex_dump("SCSI CDB: ", DUMP_PREFIX_NONE, \
+ 16, 1, (fsg)->cmnd, (fsg)->cmnd_size, 0) \
+
+# else
+
+# define dump_cdb(fsg) do { } while (0)
+
+# endif /* VERBOSE_DEBUG */
+
+#endif /* DUMP_MSGS */
+
+/*
+ * Thanks to NetChip Technologies for donating this product ID.
+ *
+ * DO NOT REUSE THESE IDs with any other driver!! Ever!!
+ * Instead: allocate your own, using normal USB-IF procedures.
+ */
+
+#define FSG_VENDOR_ID 0x0525 /* NetChip */
+#define FSG_PRODUCT_ID 0xa4a5 /* Linux-USB File-backed Storage Gadget */
+
+/* Length of a SCSI Command Data Block */
+#define MAX_COMMAND_SIZE 16
+
+/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
+#define SS_NO_SENSE 0
+#define SS_COMMUNICATION_FAILURE 0x040800
+#define SS_INVALID_COMMAND 0x052000
+#define SS_INVALID_FIELD_IN_CDB 0x052400
+#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE 0x052100
+#define SS_LOGICAL_UNIT_NOT_SUPPORTED 0x052500
+#define SS_MEDIUM_NOT_PRESENT 0x023a00
+#define SS_MEDIUM_REMOVAL_PREVENTED 0x055302
+#define SS_NOT_READY_TO_READY_TRANSITION 0x062800
+#define SS_RESET_OCCURRED 0x062900
+#define SS_SAVING_PARAMETERS_NOT_SUPPORTED 0x053900
+#define SS_UNRECOVERED_READ_ERROR 0x031100
+#define SS_WRITE_ERROR 0x030c02
+#define SS_WRITE_PROTECTED 0x072700
+
+#define SK(x) ((u8) ((x) >> 16)) /* Sense Key byte, etc. */
+#define ASC(x) ((u8) ((x) >> 8))
+#define ASCQ(x) ((u8) (x))
+
+/*-------------------------------------------------------------------------*/
+
+struct fsg_lun {
+ loff_t file_length;
+ loff_t num_sectors;
+
+ unsigned int initially_ro:1;
+ unsigned int ro:1;
+ unsigned int removable:1;
+ unsigned int cdrom:1;
+ unsigned int prevent_medium_removal:1;
+ unsigned int registered:1;
+ unsigned int info_valid:1;
+ unsigned int nofua:1;
+
+ u32 sense_data;
+ u32 sense_data_info;
+ u32 unit_attention_data;
+
+ struct device_d dev;
+};
+
+#define fsg_lun_is_open(curlun) ((curlun)->filp != NULL)
+
+/* Big enough to hold our biggest descriptor */
+#define EP0_BUFSIZE 256
+#define DELAYED_STATUS (EP0_BUFSIZE + 999) /* An impossibly large value */
+
+/* Number of buffers we will use. 2 is enough for double-buffering */
+#define FSG_NUM_BUFFERS 2
+
+/* Default size of buffer length. */
+#define FSG_BUFLEN ((u32)131072)
+
+/* Maximal number of LUNs supported in mass storage function */
+#define FSG_MAX_LUNS 8
+
+enum fsg_buffer_state {
+ BUF_STATE_EMPTY = 0,
+ BUF_STATE_FULL,
+ BUF_STATE_BUSY
+};
+
+/*
+ * When FSG_BUFFHD_STATIC_BUFFER is defined when this file is included
+ * the fsg_buffhd structure's buf field will be an array of FSG_BUFLEN
+ * characters rather then a pointer to void.
+ */
+
+struct fsg_buffhd {
+ void *buf;
+ enum fsg_buffer_state state;
+ struct fsg_buffhd *next;
+
+ /*
+ * The NetChip 2280 is faster, and handles some protocol faults
+ * better, if we don't submit any short bulk-out read requests.
+ * So we will record the intended request length here.
+ */
+ unsigned int bulk_out_intended_length;
+
+ struct usb_request *inreq;
+ int inreq_busy;
+ struct usb_request *outreq;
+ int outreq_busy;
+};
+
+enum fsg_state {
+ /* This one isn't used anywhere */
+ FSG_STATE_COMMAND_PHASE = -10,
+ FSG_STATE_DATA_PHASE,
+ FSG_STATE_STATUS_PHASE,
+
+ FSG_STATE_IDLE = 0,
+ FSG_STATE_ABORT_BULK_OUT,
+ FSG_STATE_RESET,
+ FSG_STATE_INTERFACE_CHANGE,
+ FSG_STATE_CONFIG_CHANGE,
+ FSG_STATE_DISCONNECT,
+ FSG_STATE_EXIT,
+ FSG_STATE_TERMINATED
+};
+
+enum data_direction {
+ DATA_DIR_UNKNOWN = 0,
+ DATA_DIR_FROM_HOST,
+ DATA_DIR_TO_HOST,
+ DATA_DIR_NONE
+};
+
+/*-------------------------------------------------------------------------*/
+
+static inline u32 get_unaligned_be24(u8 *buf)
+{
+ return 0xffffff & (u32) get_unaligned_be32(buf - 1);
+}
+
+/*-------------------------------------------------------------------------*/
+
+enum {
+ FSG_STRING_INTERFACE
+};
+
+/*-------------------------------------------------------------------------*/
+
+extern struct usb_interface_descriptor fsg_intf_desc;
+
+extern struct usb_endpoint_descriptor fsg_fs_bulk_in_desc;
+extern struct usb_endpoint_descriptor fsg_fs_bulk_out_desc;
+extern struct usb_descriptor_header *fsg_fs_function[];
+
+extern struct usb_endpoint_descriptor fsg_hs_bulk_in_desc;
+extern struct usb_endpoint_descriptor fsg_hs_bulk_out_desc;
+extern struct usb_descriptor_header *fsg_hs_function[];
+
+int fsg_lun_open(struct fsg_lun *curlun, unsigned int num_sectors,
+ const char *filename);
+void fsg_lun_close(struct fsg_lun *curlun);
+
+struct usb_endpoint_descriptor *
+fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
+ struct usb_endpoint_descriptor *hs);
+int fsg_lun_fsync_sub(struct fsg_lun *curlun);
+void store_cdrom_address(u8 *dest, int msf, u32 addr);
+
+#endif /* USB_STORAGE_COMMON_H */
diff --git a/include/scsi.h b/include/scsi.h
index e2397489ead9..7252b8ce3b62 100644
--- a/include/scsi.h
+++ b/include/scsi.h
@@ -109,11 +109,14 @@
#define SCSI_MED_REMOVL 0x1E /* Prevent/Allow medium Removal (O) */
#define SCSI_READ6 0x08 /* Read 6-byte (MANDATORY) */
#define SCSI_READ10 0x28 /* Read 10-byte (MANDATORY) */
+#define SCSI_READ12 0xA8 /* Read 12-byte (O) */
#define SCSI_RD_CAPAC 0x25 /* Read Capacity (MANDATORY) */
+#define SCSI_RD_FMT_CAPAC 0x23
#define SCSI_RD_DEFECT 0x37 /* Read Defect Data (O) */
#define SCSI_READ_LONG 0x3E /* Read Long (O) */
#define SCSI_REASS_BLK 0x07 /* Reassign Blocks (O) */
#define SCSI_RCV_DIAG 0x1C /* Receive Diagnostic Results (O) */
+#define SCSI_RESERVE 0x16
#define SCSI_RELEASE 0x17 /* Release Unit (MANDATORY) */
#define SCSI_REZERO 0x01 /* Rezero Unit (O) */
#define SCSI_SRCH_DAT_E 0x31 /* Search Data Equal (O) */
@@ -128,9 +131,12 @@
#define SCSI_VERIFY 0x2F /* Verify (O) */
#define SCSI_WRITE6 0x0A /* Write 6-Byte (MANDATORY) */
#define SCSI_WRITE10 0x2A /* Write 10-Byte (MANDATORY) */
+#define SCSI_WRITE12 0xAA /* Write 12-Byte (O) */
#define SCSI_WRT_VERIFY 0x2E /* Write and Verify (O) */
#define SCSI_WRITE_LONG 0x3F /* Write Long (O) */
#define SCSI_WRITE_SAME 0x41 /* Write Same (O) */
+#define SCSI_RD_TOC 0x43
+#define SCSI_RD_HEADER 0x44
/****************************************************************************
@@ -165,4 +171,10 @@ void scsi_init(void);
#define FALSE 0
#endif
+/*
+ * DEVICE TYPES
+ */
+
+#define TYPE_DISK 0x00
+
#endif /* _SCSI_H */
diff --git a/include/usb/mass_storage.h b/include/usb/mass_storage.h
new file mode 100644
index 000000000000..084b3c8e8f31
--- /dev/null
+++ b/include/usb/mass_storage.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (C) 2011 Samsung Electrnoics
+ * Lukasz Majewski <l.majewski@samsung.com>
+ */
+
+#ifndef __USB_MASS_STORAGE_H__
+#define __USB_MASS_STORAGE_H__
+
+#include <usb/composite.h>
+
+/* Wait at maximum 60 seconds for cable connection */
+#define UMS_CABLE_READY_TIMEOUT 60
+
+struct fsg_common;
+
+struct f_ums_opts {
+ struct usb_function_instance func_inst;
+ struct fsg_common *common;
+ struct file_list *files;
+ unsigned int num_sectors;
+ int fd;
+ char name[16];
+};
+
+int usb_ums_register(struct f_ums_opts *);
+
+#endif /* __USB_MASS_STORAGE_H__ */
diff --git a/include/usb/storage.h b/include/usb/storage.h
new file mode 100644
index 000000000000..e0240f864548
--- /dev/null
+++ b/include/usb/storage.h
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0
+#ifndef __LINUX_USB_STORAGE_H
+#define __LINUX_USB_STORAGE_H
+
+/*
+ * linux/usb/storage.h
+ *
+ * Copyright Matthew Wilcox for Intel Corp, 2010
+ *
+ * This file contains definitions taken from the
+ * USB Mass Storage Class Specification Overview
+ *
+ * Distributed under the terms of the GNU GPL, version two.
+ */
+
+/* Storage subclass codes */
+
+#define USB_SC_RBC 0x01 /* Typically, flash devices */
+#define USB_SC_8020 0x02 /* CD-ROM */
+#define USB_SC_QIC 0x03 /* QIC-157 Tapes */
+#define USB_SC_UFI 0x04 /* Floppy */
+#define USB_SC_8070 0x05 /* Removable media */
+#define USB_SC_SCSI 0x06 /* Transparent */
+#define USB_SC_LOCKABLE 0x07 /* Password-protected */
+
+#define USB_SC_ISD200 0xf0 /* ISD200 ATA */
+#define USB_SC_CYP_ATACB 0xf1 /* Cypress ATACB */
+#define USB_SC_DEVICE 0xff /* Use device's value */
+
+/* Storage protocol codes */
+
+#define USB_PR_CBI 0x00 /* Control/Bulk/Interrupt */
+#define USB_PR_CB 0x01 /* Control/Bulk w/o interrupt */
+#define USB_PR_BULK 0x50 /* bulk only */
+#define USB_PR_UAS 0x62 /* USB Attached SCSI */
+
+#define USB_PR_USBAT 0x80 /* SCM-ATAPI bridge */
+#define USB_PR_EUSB_SDDR09 0x81 /* SCM-SCSI bridge for SDDR-09 */
+#define USB_PR_SDDR55 0x82 /* SDDR-55 (made up) */
+#define USB_PR_DPCM_USB 0xf0 /* Combination CB/SDDR09 */
+#define USB_PR_FREECOM 0xf1 /* Freecom */
+#define USB_PR_DATAFAB 0xf2 /* Datafab chipsets */
+#define USB_PR_JUMPSHOT 0xf3 /* Lexar Jumpshot */
+#define USB_PR_ALAUDA 0xf4 /* Alauda chipsets */
+#define USB_PR_KARMA 0xf5 /* Rio Karma */
+
+#define USB_PR_DEVICE 0xff /* Use device's value */
+
+/*
+ * Bulk only data structures
+ */
+
+/* command block wrapper */
+struct bulk_cb_wrap {
+ __le32 Signature; /* contains 'USBC' */
+ __u32 Tag; /* unique per command id */
+ __le32 DataTransferLength; /* size of data */
+ __u8 Flags; /* direction in bit 0 */
+ __u8 Lun; /* LUN normally 0 */
+ __u8 Length; /* length of the CDB */
+ __u8 CDB[16]; /* max command */
+};
+
+#define US_BULK_CB_WRAP_LEN 31
+#define US_BULK_CB_SIGN 0x43425355 /* spells out 'USBC' */
+#define US_BULK_FLAG_IN (1 << 7)
+#define US_BULK_FLAG_OUT 0
+
+/* command status wrapper */
+struct bulk_cs_wrap {
+ __le32 Signature; /* contains 'USBS' */
+ __u32 Tag; /* same as original command */
+ __le32 Residue; /* amount not transferred */
+ __u8 Status; /* see below */
+};
+
+#define US_BULK_CS_WRAP_LEN 13
+#define US_BULK_CS_SIGN 0x53425355 /* spells out 'USBS' */
+#define US_BULK_STAT_OK 0
+#define US_BULK_STAT_FAIL 1
+#define US_BULK_STAT_PHASE 2
+
+/* bulk-only class specific requests */
+#define US_BULK_RESET_REQUEST 0xff
+#define US_BULK_GET_MAX_LUN 0xfe
+
+#endif
--
2.29.2
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 3/3] usbgadget: add support for USB mass storage gadget
2021-02-15 10:27 ` [PATCH 3/3] usbgadget: add support for USB mass storage gadget Ahmad Fatoum
@ 2021-02-17 11:48 ` Ahmad Fatoum
0 siblings, 0 replies; 5+ messages in thread
From: Ahmad Fatoum @ 2021-02-17 11:48 UTC (permalink / raw)
To: Ahmad Fatoum, barebox
On 15.02.21 11:27, Ahmad Fatoum wrote:
> This driver is based on the f_mass_storage drivers in Linux v5.11 and
> U-Boot v2021.01. Like with U-Boot, it's invoked with a blocking ums
> command. During this time, no other processing, except for pollers, is
> possible. The command can be aborted with ctrl+c.
>
> The state machine to implement the mass storage gadget is quite
> extensive, so import the functionality now and delay moving the state
> machine into a poller for asynchronous operation as part of a composite
> gadget for later.
I noticed some brokenness in handling error condition.
I'll respin later this week.
>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
> commands/Makefile | 1 +
> commands/ums.c | 53 +
> drivers/usb/gadget/Kconfig | 11 +
> drivers/usb/gadget/Makefile | 1 +
> drivers/usb/gadget/f_mass_storage.c | 2936 +++++++++++++++++++++++++++
> drivers/usb/gadget/storage_common.c | 173 ++
> drivers/usb/gadget/storage_common.h | 245 +++
> include/scsi.h | 12 +
> include/usb/mass_storage.h | 28 +
> include/usb/storage.h | 87 +
> 10 files changed, 3547 insertions(+)
> create mode 100644 commands/ums.c
> create mode 100644 drivers/usb/gadget/f_mass_storage.c
> create mode 100644 drivers/usb/gadget/storage_common.c
> create mode 100644 drivers/usb/gadget/storage_common.h
> create mode 100644 include/usb/mass_storage.h
> create mode 100644 include/usb/storage.h
>
> diff --git a/commands/Makefile b/commands/Makefile
> index 034c0e6383d3..a31d5c877703 100644
> --- a/commands/Makefile
> +++ b/commands/Makefile
> @@ -130,5 +130,6 @@ obj-$(CONFIG_CMD_NAND_BITFLIP) += nand-bitflip.o
> obj-$(CONFIG_CMD_SEED) += seed.o
> obj-$(CONFIG_CMD_IP_ROUTE_GET) += ip-route-get.o
> obj-$(CONFIG_CMD_UBSAN) += ubsan.o
> +obj-$(CONFIG_USB_GADGET_MASS_STORAGE) += ums.o
>
> UBSAN_SANITIZE_ubsan.o := y
> diff --git a/commands/ums.c b/commands/ums.c
> new file mode 100644
> index 000000000000..0bc2cfdf5e98
> --- /dev/null
> +++ b/commands/ums.c
> @@ -0,0 +1,53 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +/*
> + * Copyright (C) 2011 Samsung Electronics
> + * Lukasz Majewski <l.majewski@samsung.com>
> + *
> + * Copyright (c) 2015, NVIDIA CORPORATION. All rights reserved.
> + */
> +
> +#include <common.h>
> +#include <command.h>
> +#include <errno.h>
> +#include <malloc.h>
> +#include <getopt.h>
> +#include <fs.h>
> +#include <xfuncs.h>
> +#include <file-list.h>
> +#include <usb/mass_storage.h>
> +#include <linux/err.h>
> +
> +static int do_usb_mass_storage(int argc, char *argv[])
> +{
> + struct f_ums_opts opts;
> + char *argstr;
> + int ret;
> +
> + if (argc != optind + 1)
> + return COMMAND_ERROR_USAGE;
> +
> + argstr = argv[optind];
> +
> + opts.files = file_list_parse(argstr);
> + if (IS_ERR(opts.files)) {
> + ret = PTR_ERR(opts.files);
> + goto out;
> + }
> +
> + ret = usb_ums_register(&opts);
> +
> + file_list_free(opts.files);
> +out:
> + return ret;
> +}
> +
> +BAREBOX_CMD_HELP_START(usb)
> +BAREBOX_CMD_HELP_TEXT("Turn's the USB host into a UMS (USB Mass storage) gadget")
> +BAREBOX_CMD_HELP_END
> +
> +BAREBOX_CMD_START(ums)
> + .cmd = do_usb_mass_storage,
> + BAREBOX_CMD_DESC("USB mass storage gadget")
> + BAREBOX_CMD_GROUP(CMD_GRP_MISC)
> + BAREBOX_CMD_HELP(cmd_usb_help)
> +BAREBOX_CMD_END
> diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
> index 7e0c570914d7..90d2378b5b72 100644
> --- a/drivers/usb/gadget/Kconfig
> +++ b/drivers/usb/gadget/Kconfig
> @@ -59,4 +59,15 @@ config USB_GADGET_FASTBOOT
> select FILE_LIST
> select FASTBOOT_BASE
> prompt "Android Fastboot USB Gadget"
> +
> +config USB_GADGET_MASS_STORAGE
> + bool
> + select FILE_LIST
> + prompt "USB Mass Storage Gadget"
> + help
> + The Mass Storage Gadget acts as a USB Mass Storage disk drive.
> + As its storage repository it can use a regular file or a block
> + device. Multiple storages can be specified at once on
> + instantiation time.
> +
> endif
> diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
> index 27673fcf0ef6..5ba4920c085a 100644
> --- a/drivers/usb/gadget/Makefile
> +++ b/drivers/usb/gadget/Makefile
> @@ -3,6 +3,7 @@ obj-$(CONFIG_USB_GADGET) += composite.o config.o usbstring.o epautoconf.o udc-co
> obj-$(CONFIG_USB_GADGET_SERIAL) += u_serial.o serial.o f_serial.o f_acm.o
> obj-$(CONFIG_USB_GADGET_DFU) += dfu.o
> obj-$(CONFIG_USB_GADGET_FASTBOOT) += f_fastboot.o
> +obj-$(CONFIG_USB_GADGET_MASS_STORAGE) += f_mass_storage.o storage_common.o
> obj-$(CONFIG_USB_GADGET_DRIVER_ARC) += fsl_udc.o
> pbl-$(CONFIG_USB_GADGET_DRIVER_ARC_PBL) += fsl_udc_pbl.o
> obj-$(CONFIG_USB_GADGET_DRIVER_AT91) += at91_udc.o
> diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
> new file mode 100644
> index 000000000000..9c0076be26d1
> --- /dev/null
> +++ b/drivers/usb/gadget/f_mass_storage.c
> @@ -0,0 +1,2936 @@
> +// SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause
> +/*
> + * f_mass_storage.c -- Mass Storage USB Composite Function
> + *
> + * Copyright (C) 2003-2008 Alan Stern
> + * Copyright (C) 2009 Samsung Electronics
> + * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
> + * All rights reserved.
> + */
> +
> +/*
> + * The Mass Storage Function acts as a USB Mass Storage device,
> + * appearing to the host as a disk drive or as a CD-ROM drive. In
> + * addition to providing an example of a genuinely useful composite
> + * function for a USB device, it also illustrates a technique of
> + * double-buffering for increased throughput.
> + *
> + * Function supports multiple logical units (LUNs). Backing storage
> + * for each LUN is provided by a regular file or a block device.
> + * Access for each LUN can be limited to read-only. Moreover, the
> + * function can indicate that LUN is removable and/or CD-ROM. (The
> + * later implies read-only access.)
> + *
> + * MSF is configured by specifying a fsg_config structure. It has the
> + * following fields:
> + *
> + * nluns Number of LUNs function have (anywhere from 1
> + * to FSG_MAX_LUNS which is 8).
> + * luns An array of LUN configuration values. This
> + * should be filled for each LUN that
> + * function will include (ie. for "nluns"
> + * LUNs). Each element of the array has
> + * the following fields:
> + * ->filename The path to the backing file for the LUN.
> + * Required if LUN is not marked as
> + * removable.
> + * ->ro Flag specifying access to the LUN shall be
> + * read-only. This is implied if CD-ROM
> + * emulation is enabled as well as when
> + * it was impossible to open "filename"
> + * in R/W mode.
> + * ->removable Flag specifying that LUN shall be indicated as
> + * being removable.
> + * ->cdrom Flag specifying that LUN shall be reported as
> + * being a CD-ROM.
> + *
> + * lun_name_format A printf-like format for names of the LUN
> + * devices. This determines how the
> + * directory in sysfs will be named.
> + * Unless you are using several MSFs in
> + * a single gadget (as opposed to single
> + * MSF in many configurations) you may
> + * leave it as NULL (in which case
> + * "lun%d" will be used). In the format
> + * you can use "%d" to index LUNs for
> + * MSF's with more than one LUN. (Beware
> + * that there is only one integer given
> + * as an argument for the format and
> + * specifying invalid format may cause
> + * unspecified behaviour.)
> + * thread_name Name of the kernel thread process used by the
> + * MSF. You can safely set it to NULL
> + * (in which case default "file-storage"
> + * will be used).
> + *
> + * vendor_name
> + * product_name
> + * release Information used as a reply to INQUIRY
> + * request. To use default set to NULL,
> + * NULL, 0xffff respectively. The first
> + * field should be 8 and the second 16
> + * characters or less.
> + *
> + * can_stall Set to permit function to halt bulk endpoints.
> + * Disabled on some USB devices known not
> + * to work correctly. You should set it
> + * to true.
> + *
> + * If "removable" is not set for a LUN then a backing file must be
> + * specified. If it is set, then NULL filename means the LUN's medium
> + * is not loaded (an empty string as "filename" in the fsg_config
> + * structure causes error). The CD-ROM emulation includes a single
> + * data track and no audio tracks; hence there need be only one
> + * backing file per LUN. Note also that the CD-ROM block length is
> + * set to 512 rather than the more common value 2048.
> + *
> + *
> + * MSF includes support for module parameters. If gadget using it
> + * decides to use it, the following module parameters will be
> + * available:
> + *
> + * file=filename[,filename...]
> + * Names of the files or block devices used for
> + * backing storage.
> + * ro=b[,b...] Default false, boolean for read-only access.
> + * removable=b[,b...]
> + * Default true, boolean for removable media.
> + * cdrom=b[,b...] Default false, boolean for whether to emulate
> + * a CD-ROM drive.
> + * luns=N Default N = number of filenames, number of
> + * LUNs to support.
> + * stall Default determined according to the type of
> + * USB device controller (usually true),
> + * boolean to permit the driver to halt
> + * bulk endpoints.
> + *
> + * The module parameters may be prefixed with some string. You need
> + * to consult gadget's documentation or source to verify whether it is
> + * using those module parameters and if it does what are the prefixes
> + * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
> + * the prefix).
> + *
> + *
> + * Requirements are modest; only a bulk-in and a bulk-out endpoint are
> + * needed. The memory requirement amounts to two 16K buffers, size
> + * configurable by a parameter. Support is included for both
> + * full-speed and high-speed operation.
> + *
> + * Note that the driver is slightly non-portable in that it assumes a
> + * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
> + * interrupt-in endpoints. With most device controllers this isn't an
> + * issue, but there may be some with hardware restrictions that prevent
> + * a buffer from being used by more than one endpoint.
> + *
> + *
> + * The pathnames of the backing files and the ro settings are
> + * available in the attribute files "file" and "ro" in the lun<n> (or
> + * to be more precise in a directory which name comes from
> + * "lun_name_format" option!) subdirectory of the gadget's sysfs
> + * directory. If the "removable" option is set, writing to these
> + * files will simulate ejecting/loading the medium (writing an empty
> + * line means eject) and adjusting a write-enable tab. Changes to the
> + * ro setting are not allowed when the medium is loaded or if CD-ROM
> + * emulation is being used.
> + *
> + * When a LUN receive an "eject" SCSI request (Start/Stop Unit),
> + * if the LUN is removable, the backing file is released to simulate
> + * ejection.
> + *
> + *
> + * This function is heavily based on "File-backed Storage Gadget" by
> + * Alan Stern which in turn is heavily based on "Gadget Zero" by David
> + * Brownell. The driver's SCSI command interface was based on the
> + * "Information technology - Small Computer System Interface - 2"
> + * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
> + * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
> + * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
> + * was based on the "Universal Serial Bus Mass Storage Class UFI
> + * Command Specification" document, Revision 1.0, December 14, 1998,
> + * available at
> + * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
> + */
> +
> +/*
> + * Driver Design
> + *
> + * The MSF is fairly straightforward. There is a main kernel
> + * thread that handles most of the work. Interrupt routines field
> + * callbacks from the controller driver: bulk- and interrupt-request
> + * completion notifications, endpoint-0 events, and disconnect events.
> + * Completion events are passed to the main thread by wakeup calls. Many
> + * ep0 requests are handled at interrupt time, but SetInterface,
> + * SetConfiguration, and device reset requests are forwarded to the
> + * thread in the form of "exceptions" using SIGUSR1 signals (since they
> + * should interrupt any ongoing file I/O operations).
> + *
> + * The thread's main routine implements the standard command/data/status
> + * parts of a SCSI interaction. It and its subroutines are full of tests
> + * for pending signals/exceptions -- all this polling is necessary since
> + * the kernel has no setjmp/longjmp equivalents. (Maybe this is an
> + * indication that the driver really wants to be running in userspace.)
> + * An important point is that so long as the thread is alive it keeps an
> + * open reference to the backing file. This will prevent unmounting
> + * the backing file's underlying filesystem and could cause problems
> + * during system shutdown, for example. To prevent such problems, the
> + * thread catches INT, TERM, and KILL signals and converts them into
> + * an EXIT exception.
> + *
> + * In normal operation the main thread is started during the gadget's
> + * fsg_bind() callback and stopped during fsg_unbind(). But it can
> + * also exit when it receives a signal, and there's no point leaving
> + * the gadget running when the thread is dead. At of this moment, MSF
> + * provides no way to deregister the gadget when thread dies -- maybe
> + * a callback functions is needed.
> + *
> + * To provide maximum throughput, the driver uses a circular pipeline of
> + * buffer heads (struct fsg_buffhd). In principle the pipeline can be
> + * arbitrarily long; in practice the benefits don't justify having more
> + * than 2 stages (i.e., double buffering). But it helps to think of the
> + * pipeline as being a long one. Each buffer head contains a bulk-in and
> + * a bulk-out request pointer (since the buffer can be used for both
> + * output and input -- directions always are given from the host's
> + * point of view) as well as a pointer to the buffer and various state
> + * variables.
> + *
> + * Use of the pipeline follows a simple protocol. There is a variable
> + * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
> + * At any time that buffer head may still be in use from an earlier
> + * request, so each buffer head has a state variable indicating whether
> + * it is EMPTY, FULL, or BUSY. Typical use involves waiting for the
> + * buffer head to be EMPTY, filling the buffer either by file I/O or by
> + * USB I/O (during which the buffer head is BUSY), and marking the buffer
> + * head FULL when the I/O is complete. Then the buffer will be emptied
> + * (again possibly by USB I/O, during which it is marked BUSY) and
> + * finally marked EMPTY again (possibly by a completion routine).
> + *
> + * A module parameter tells the driver to avoid stalling the bulk
> + * endpoints wherever the transport specification allows. This is
> + * necessary for some UDCs like the SuperH, which cannot reliably clear a
> + * halt on a bulk endpoint. However, under certain circumstances the
> + * Bulk-only specification requires a stall. In such cases the driver
> + * will halt the endpoint and set a flag indicating that it should clear
> + * the halt in software during the next device reset. Hopefully this
> + * will permit everything to work correctly. Furthermore, although the
> + * specification allows the bulk-out endpoint to halt when the host sends
> + * too much data, implementing this would cause an unavoidable race.
> + * The driver will always use the "no-stall" approach for OUT transfers.
> + *
> + * One subtle point concerns sending status-stage responses for ep0
> + * requests. Some of these requests, such as device reset, can involve
> + * interrupting an ongoing file I/O operation, which might take an
> + * arbitrarily long time. During that delay the host might give up on
> + * the original ep0 request and issue a new one. When that happens the
> + * driver should not notify the host about completion of the original
> + * request, as the host will no longer be waiting for it. So the driver
> + * assigns to each ep0 request a unique tag, and it keeps track of the
> + * tag value of the request associated with a long-running exception
> + * (device-reset, interface-change, or configuration-change). When the
> + * exception handler is finished, the status-stage response is submitted
> + * only if the current ep0 request tag is equal to the exception request
> + * tag. Thus only the most recently received ep0 request will get a
> + * status-stage response.
> + *
> + * Warning: This driver source file is too long. It ought to be split up
> + * into a header file plus about 3 separate .c files, to handle the details
> + * of the Gadget, USB Mass Storage, and SCSI protocols.
> + */
> +
> +/* #define VERBOSE_DEBUG */
> +/* #define DUMP_MSGS */
> +
> +#define pr_fmt(fmt) "f_ums: " fmt
> +
> +#include <common.h>
> +#include <unistd.h>
> +#include <linux/stat.h>
> +#include <linux/wait.h>
> +#include <fcntl.h>
> +#include <file-list.h>
> +#include <dma.h>
> +#include <linux/bug.h>
> +#include <linux/rwsem.h>
> +#include <linux/pagemap.h>
> +#include <disks.h>
> +#include <scsi.h>
> +
> +#include <linux/err.h>
> +#include <usb/mass_storage.h>
> +
> +#include <asm/unaligned.h>
> +#include <linux/bitops.h>
> +#include <usb/gadget.h>
> +#include <usb/composite.h>
> +#include <linux/bitmap.h>
> +
> +/*------------------------------------------------------------------------*/
> +
> +#define FSG_DRIVER_DESC "ums"
> +#define UMS_NAME_LEN 16
> +
> +#define FSG_DRIVER_VERSION "2012/06/5"
> +
> +static const char fsg_string_interface[] = "Mass Storage";
> +
> +#include "storage_common.h"
> +
> +/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
> +struct usb_string fsg_strings[] = {
> + {FSG_STRING_INTERFACE, fsg_string_interface},
> + {}
> +};
> +
> +static struct usb_gadget_strings fsg_stringtab = {
> + .language = 0x0409, /* en-us */
> + .strings = fsg_strings,
> +};
> +
> +/*-------------------------------------------------------------------------*/
> +
> +struct completion { int done; };
> +
> +#define init_completion(x) do { (x)->done = 0; } while (0)
> +#define reinit_completion(x) init_completion(x)
> +static inline int wait_for_completion_interruptible(struct completion *x)
> +{
> + int ret;
> +
> + while (!x->done) {
> + ret = ctrlc();
> + if (ret)
> + return -ERESTARTSYS;
> + }
> +
> + return 0;
> +}
> +#define complete_and_exit(...) return 0
> +
> +static inline void complete(struct completion *x)
> +{
> + x->done = 1;
> +}
> +
> +struct task_struct {
> + int (*threadfn)(void *);
> + void *arg;
> +};
> +
> +static struct task_struct *kthread_run(int (*threadfn)(void *), void *arg,
> + const char *name)
> +{
> + struct task_struct *task;
> +
> + task = xmalloc(sizeof(*task));
> + task->threadfn = threadfn;
> + task->arg = arg;
> +
> + return task;
> +}
> +
> +#define free_kthread_struct(t) free(t)
> +
> +#define poll() thread_task->threadfn(thread_task->arg)
> +
> +#define wait_event(queue, cond) do { poll(); } while (!(cond))
> +#define wake_up(...) do {} while (0)
> +
> +struct task_struct *thread_task;
> +
> +/*-------------------------------------------------------------------------*/
> +
> +struct kref {int x; };
> +
> +struct fsg_dev;
> +
> +static struct file_list *ums_files;
> +
> +static struct usb_device_descriptor ums_dev_descriptor = {
> + .bLength = USB_DT_DEVICE_SIZE,
> + .bDescriptorType = USB_DT_DEVICE,
> + .bcdUSB = __constant_cpu_to_le16(0x0200),
> + .bDeviceClass = USB_CLASS_PER_INTERFACE,
> + .bNumConfigurations = 1,
> +};
> +
> +/* Data shared by all the FSG instances. */
> +struct fsg_common {
> + struct usb_gadget *gadget;
> + struct fsg_dev *fsg, *new_fsg;
> +
> + wait_queue_head_t fsg_wait;
> + struct usb_ep *ep0; /* Copy of gadget->ep0 */
> + struct usb_request *ep0req; /* Copy of cdev->req */
> + unsigned int ep0_req_tag;
> +
> + struct fsg_buffhd *next_buffhd_to_fill;
> + struct fsg_buffhd *next_buffhd_to_drain;
> + struct fsg_buffhd buffhds[FSG_NUM_BUFFERS];
> +
> + int cmnd_size;
> + u8 cmnd[MAX_COMMAND_SIZE];
> +
> + unsigned int nluns;
> + unsigned int lun;
> + struct fsg_lun luns[FSG_MAX_LUNS];
> +
> + unsigned int bulk_out_maxpacket;
> + enum fsg_state state; /* For exception handling */
> + unsigned int exception_req_tag;
> +
> + enum data_direction data_dir;
> + u32 data_size;
> + u32 data_size_from_cmnd;
> + u32 tag;
> + u32 residue;
> + u32 usb_amount_left;
> +
> + unsigned int can_stall:1;
> + unsigned int free_storage_on_release:1;
> + unsigned int phase_error:1;
> + unsigned int short_packet_received:1;
> + unsigned int bad_lun_okay:1;
> + unsigned int running:1;
> +
> + struct completion thread_wakeup_needed;
> + struct completion thread_notifier;
> + bool shutdown;
> +
> + /* Callback functions. */
> + const struct fsg_operations *ops;
> + /* Gadget's private data. */
> + void *private_data;
> +
> + const char *vendor_name; /* 8 characters or less */
> + const char *product_name; /* 16 characters or less */
> + u16 release;
> +
> + /* Vendor (8 chars), product (16 chars), release (4
> + * hexadecimal digits) and NUL byte */
> + char inquiry_string[8 + 16 + 4 + 1];
> +
> + struct kref ref;
> +};
> +
> +struct fsg_config {
> + unsigned nluns;
> + struct fsg_lun_config {
> + const char *filename;
> + char ro;
> + char removable;
> + char cdrom;
> + char nofua;
> + } luns[FSG_MAX_LUNS];
> +
> + /* Callback functions. */
> + const struct fsg_operations *ops;
> + /* Gadget's private data. */
> + void *private_data;
> +
> + const char *vendor_name; /* 8 characters or less */
> + const char *product_name; /* 16 characters or less */
> +
> + char can_stall;
> +};
> +
> +struct fsg_dev {
> + struct usb_function function;
> + struct usb_gadget *gadget; /* Copy of cdev->gadget */
> + struct fsg_common *common;
> +
> + u16 interface_number;
> +
> + unsigned int bulk_in_enabled:1;
> + unsigned int bulk_out_enabled:1;
> +
> + unsigned long atomic_bitflags;
> +#define IGNORE_BULK_OUT 0
> +
> + struct usb_ep *bulk_in;
> + struct usb_ep *bulk_out;
> +};
> +
> +
> +static inline int __fsg_is_set(struct fsg_common *common,
> + const char *func, unsigned line)
> +{
> + if (common->fsg)
> + return 1;
> + ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
> + WARN_ON(1);
> +
> + return 0;
> +}
> +
> +#define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
> +
> +
> +static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
> +{
> + return container_of(f, struct fsg_dev, function);
> +}
> +
> +static inline struct f_ums_opts *
> +fsg_opts_from_func_inst(const struct usb_function_instance *fi)
> +{
> + return container_of(fi, struct f_ums_opts, func_inst);
> +}
> +
> +typedef void (*fsg_routine_t)(struct fsg_dev *);
> +
> +static int exception_in_progress(struct fsg_common *common)
> +{
> + return common->state > FSG_STATE_IDLE;
> +}
> +
> +/* Make bulk-out requests be divisible by the maxpacket size */
> +static void set_bulk_out_req_length(struct fsg_common *common,
> + struct fsg_buffhd *bh, unsigned int length)
> +{
> + unsigned int rem;
> +
> + bh->bulk_out_intended_length = length;
> + rem = length % common->bulk_out_maxpacket;
> + if (rem > 0)
> + length += common->bulk_out_maxpacket - rem;
> + bh->outreq->length = length;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static struct f_ums_opts ums[14]; // FIXME
> +static int ums_count;
> +
> +static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
> +{
> + const char *name;
> +
> + if (ep == fsg->bulk_in)
> + name = "bulk-in";
> + else if (ep == fsg->bulk_out)
> + name = "bulk-out";
> + else
> + name = ep->name;
> + DBG(fsg, "%s set halt\n", name);
> + return usb_ep_set_halt(ep);
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/* These routines may be called in process context or in_irq */
> +
> +/* Caller must hold fsg->lock */
> +static void wakeup_thread(struct fsg_common *common)
> +{
> + complete(&common->thread_wakeup_needed);
> +}
> +
> +static void report_exception(const char *prefix, enum fsg_state state)
> +{
> + const char *msg = "<unknown>";
> + switch (state) {
> + /* This one isn't used anywhere */
> + case FSG_STATE_COMMAND_PHASE:
> + msg = "Command Phase";
> + break;
> + case FSG_STATE_DATA_PHASE:
> + msg = "Data Phase";
> + break;
> + case FSG_STATE_STATUS_PHASE:
> + msg = "Status Phase";
> + break;
> +
> + case FSG_STATE_IDLE:
> + msg = "Idle";
> + break;
> + case FSG_STATE_ABORT_BULK_OUT:
> + msg = "abort bulk out";
> + break;
> + case FSG_STATE_RESET:
> + msg = "reset";
> + break;
> + case FSG_STATE_INTERFACE_CHANGE:
> + msg = "interface change";
> + break;
> + case FSG_STATE_CONFIG_CHANGE:
> + msg = "config change";
> + break;
> + case FSG_STATE_DISCONNECT:
> + msg = "disconnect";
> + break;
> + case FSG_STATE_EXIT:
> + msg = "exit";
> + break;
> + case FSG_STATE_TERMINATED:
> + msg = "terminated";
> + break;
> + }
> +
> + pr_debug("%s: %s\n", prefix, msg);
> +}
> +
> +static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
> +{
> + /* Do nothing if a higher-priority exception is already in progress.
> + * If a lower-or-equal priority exception is in progress, preempt it
> + * and notify the main thread by sending it a signal. */
> + if (common->state <= new_state) {
> + report_exception("raising (preempted)", new_state);
> + common->exception_req_tag = common->ep0_req_tag;
> + common->state = new_state;
> + wakeup_thread(common);
> + }
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int ep0_queue(struct fsg_common *common)
> +{
> + int rc;
> +
> + rc = usb_ep_queue(common->ep0, common->ep0req);
> + common->ep0->driver_data = common;
> + if (rc != 0 && rc != -ESHUTDOWN) {
> + /* We can't do much more than wait for a reset */
> + WARNING(common, "error in submission: %s --> %d\n",
> + common->ep0->name, rc);
> + }
> + return rc;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/* Bulk and interrupt endpoint completion handlers.
> + * These always run in_irq. */
> +
> +static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
> +{
> + struct fsg_common *common = ep->driver_data;
> + struct fsg_buffhd *bh = req->context;
> +
> + if (req->status || req->actual != req->length)
> + DBG(common, "%s --> %d, %u/%u\n", __func__,
> + req->status, req->actual, req->length);
> + if (req->status == -ECONNRESET) /* Request was cancelled */
> + usb_ep_fifo_flush(ep);
> +
> + /* Hold the lock while we update the request and buffer states */
> + bh->inreq_busy = 0;
> + bh->state = BUF_STATE_EMPTY;
> + wakeup_thread(common);
> +}
> +
> +static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
> +{
> + struct fsg_common *common = ep->driver_data;
> + struct fsg_buffhd *bh = req->context;
> +
> + dump_msg(common, "bulk-out", req->buf, req->actual);
> + if (req->status || req->actual != bh->bulk_out_intended_length)
> + DBG(common, "%s --> %d, %u/%u\n", __func__,
> + req->status, req->actual,
> + bh->bulk_out_intended_length);
> + if (req->status == -ECONNRESET) /* Request was cancelled */
> + usb_ep_fifo_flush(ep);
> +
> + /* Hold the lock while we update the request and buffer states */
> + bh->outreq_busy = 0;
> + bh->state = BUF_STATE_FULL;
> + wakeup_thread(common);
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/* Ep0 class-specific handlers. These always run in_irq. */
> +
> +static int fsg_setup(struct usb_function *f,
> + const struct usb_ctrlrequest *ctrl)
> +{
> + struct fsg_dev *fsg = fsg_from_func(f);
> + struct usb_request *req = fsg->common->ep0req;
> + u16 w_index = get_unaligned_le16(&ctrl->wIndex);
> + u16 w_value = get_unaligned_le16(&ctrl->wValue);
> + u16 w_length = get_unaligned_le16(&ctrl->wLength);
> +
> + if (!fsg_is_set(fsg->common))
> + return -EOPNOTSUPP;
> +
> + switch (ctrl->bRequest) {
> +
> + case US_BULK_RESET_REQUEST:
> + if (ctrl->bRequestType !=
> + (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
> + break;
> + if (w_index != fsg->interface_number || w_value != 0)
> + return -EDOM;
> +
> + /* Raise an exception to stop the current operation
> + * and reinitialize our state. */
> + DBG(fsg, "bulk reset request\n");
> + raise_exception(fsg->common, FSG_STATE_RESET);
> + return DELAYED_STATUS;
> +
> + case US_BULK_GET_MAX_LUN:
> + if (ctrl->bRequestType !=
> + (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
> + break;
> + if (w_index != fsg->interface_number || w_value != 0)
> + return -EDOM;
> + VDBG(fsg, "get max LUN\n");
> + *(u8 *) req->buf = fsg->common->nluns - 1;
> +
> + /* Respond with data/status */
> + req->length = min((u16)1, w_length);
> + return ep0_queue(fsg->common);
> + }
> +
> + VDBG(fsg,
> + "unknown class-specific control req "
> + "%02x.%02x v%04x i%04x l%u\n",
> + ctrl->bRequestType, ctrl->bRequest,
> + get_unaligned_le16(&ctrl->wValue), w_index, w_length);
> + return -EOPNOTSUPP;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/* All the following routines run in process context */
> +
> +/* Use this for bulk or interrupt transfers, not ep0 */
> +static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
> + struct usb_request *req, int *pbusy,
> + enum fsg_buffer_state *state)
> +{
> + int rc;
> +
> + if (ep == fsg->bulk_in)
> + dump_msg(fsg, "bulk-in", req->buf, req->length);
> +
> + *pbusy = 1;
> + *state = BUF_STATE_BUSY;
> + rc = usb_ep_queue(ep, req);
> + if (rc != 0) {
> + *pbusy = 0;
> + *state = BUF_STATE_EMPTY;
> +
> + /* We can't do much more than wait for a reset */
> +
> + /* Note: currently the net2280 driver fails zero-length
> + * submissions if DMA is enabled. */
> + if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
> + req->length == 0))
> + WARNING(fsg, "error in submission: %s --> %d\n",
> + ep->name, rc);
> + }
> +}
> +
> +#define START_TRANSFER_OR(common, ep_name, req, pbusy, state) \
> + if (fsg_is_set(common)) \
> + start_transfer((common)->fsg, (common)->fsg->ep_name, \
> + req, pbusy, state); \
> + else
> +
> +#define START_TRANSFER(common, ep_name, req, pbusy, state) \
> + START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
> +
> +static int sleep_thread(struct fsg_common *common)
> +{
> + int ret;
> +
> + /* Wait until a signal arrives or we are woken up */
> + ret = wait_for_completion_interruptible(&common->thread_wakeup_needed);
> + if (ret) {
> + /* If we run outside of a poller, this ensures we exit the loop */
> + common->running = false;
> + return ret;
> + }
> +
> + if (common->shutdown)
> + return -ERESTARTSYS;
> +
> + reinit_completion(&common->thread_wakeup_needed);
> + return 0;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int do_read(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u32 lba;
> + struct fsg_buffhd *bh;
> + int rc;
> + u32 amount_left;
> + loff_t file_offset;
> + unsigned int amount;
> + unsigned int partial_page;
> + ssize_t nread;
> +
> + /* Get the starting Logical Block Address and check that it's
> + * not too big */
> + if (common->cmnd[0] == SCSI_READ6)
> + lba = get_unaligned_be24(&common->cmnd[1]);
> + else {
> + lba = get_unaligned_be32(&common->cmnd[2]);
> +
> + /* We allow DPO (Disable Page Out = don't save data in the
> + * cache) and FUA (Force Unit Access = don't read from the
> + * cache), but we don't implement them. */
> + if ((common->cmnd[1] & ~0x18) != 0) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> + }
> + if (lba >= curlun->num_sectors) {
> + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + return -EINVAL;
> + }
> + file_offset = ((loff_t) lba) << 9;
> +
> + /* Carry out the file reads */
> + amount_left = common->data_size_from_cmnd;
> + if (unlikely(amount_left == 0))
> + return -EIO; /* No default reply */
> +
> + for (;;) {
> + /* Wait for the next buffer to become available */
> + bh = common->next_buffhd_to_fill;
> + while (bh->state != BUF_STATE_EMPTY) {
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> +
> + /* Figure out how much we need to read:
> + * Try to read the remaining amount.
> + * But don't read more than the buffer size.
> + * And don't try to read past the end of the file.
> + * Finally, if we're not at a page boundary, don't read past
> + * the next page.
> + * If this means reading 0 then we were asked to read past
> + * the end of file. */
> + amount = min(amount_left, FSG_BUFLEN);
> + partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
> + if (partial_page > 0)
> + amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
> + partial_page);
> +
> +
> + /* If we were asked to read past the end of file,
> + * end with an empty buffer. */
> + if (amount == 0) {
> + curlun->sense_data =
> + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + curlun->info_valid = 1;
> + bh->inreq->length = 0;
> + bh->state = BUF_STATE_FULL;
> + break;
> + }
> +
> + /* Perform the read */
> + nread = pread(ums[common->lun].fd, bh->buf, amount, file_offset);
> +
> + VLDBG(curlun, "file read %u @ %llu -> %zd\n", amount,
> + (unsigned long long) file_offset,
> + nread);
> + if (nread <= 0) {
> + const char *err = nread ? strerror(-nread) : "EOF";
> + LDBG(curlun, "error in file read: %s\n", err);
> + nread = 0;
> + } else if (nread < amount) {
> + LDBG(curlun, "partial file read: %d/%u\n",
> + (int) nread, amount);
> + nread -= (nread & 511); /* Round down to a block */
> + }
> + file_offset += nread;
> + amount_left -= nread;
> + common->residue -= nread;
> + bh->inreq->length = nread;
> + bh->state = BUF_STATE_FULL;
> +
> + /* If an error occurred, report it and its position */
> + if (nread < amount) {
> + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
> + curlun->info_valid = 1;
> + break;
> + }
> +
> + if (amount_left == 0)
> + break; /* No more left to read */
> +
> + /* Send this buffer and go read some more */
> + bh->inreq->zero = 0;
> + START_TRANSFER_OR(common, bulk_in, bh->inreq,
> + &bh->inreq_busy, &bh->state)
> + /* Don't know what to do if
> + * common->fsg is NULL */
> + return -EIO;
> + common->next_buffhd_to_fill = bh->next;
> + }
> +
> + return -EIO; /* No default reply */
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int do_write(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u32 lba;
> + struct fsg_buffhd *bh;
> + int get_some_more;
> + u32 amount_left_to_req, amount_left_to_write;
> + loff_t usb_offset, file_offset;
> + unsigned int amount;
> + unsigned int partial_page;
> + ssize_t nwritten;
> + int rc;
> +
> + if (curlun->ro) {
> + curlun->sense_data = SS_WRITE_PROTECTED;
> + return -EINVAL;
> + }
> +
> + /* Get the starting Logical Block Address and check that it's
> + * not too big */
> + if (common->cmnd[0] == SCSI_WRITE6)
> + lba = get_unaligned_be24(&common->cmnd[1]);
> + else {
> + lba = get_unaligned_be32(&common->cmnd[2]);
> +
> + /* We allow DPO (Disable Page Out = don't save data in the
> + * cache) and FUA (Force Unit Access = write directly to the
> + * medium). We don't implement DPO; we implement FUA by
> + * performing synchronous output. */
> + if (common->cmnd[1] & ~0x18) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> + }
> + if (lba >= curlun->num_sectors) {
> + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + return -EINVAL;
> + }
> +
> + /* Carry out the file writes */
> + get_some_more = 1;
> + file_offset = usb_offset = ((loff_t) lba) << 9;
> + amount_left_to_req = common->data_size_from_cmnd;
> + amount_left_to_write = common->data_size_from_cmnd;
> +
> + while (amount_left_to_write > 0) {
> +
> + /* Queue a request for more data from the host */
> + bh = common->next_buffhd_to_fill;
> + if (bh->state == BUF_STATE_EMPTY && get_some_more) {
> +
> + /* Figure out how much we want to get:
> + * Try to get the remaining amount.
> + * But don't get more than the buffer size.
> + * And don't try to go past the end of the file.
> + * If we're not at a page boundary,
> + * don't go past the next page.
> + * If this means getting 0, then we were asked
> + * to write past the end of file.
> + * Finally, round down to a block boundary. */
> + amount = min(amount_left_to_req, FSG_BUFLEN);
> + partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
> + if (partial_page > 0)
> + amount = min(amount,
> + (unsigned int) PAGE_CACHE_SIZE - partial_page);
> +
> + if (amount == 0) {
> + get_some_more = 0;
> + curlun->sense_data =
> + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + curlun->info_valid = 1;
> + continue;
> + }
> + amount -= (amount & 511);
> + if (amount == 0) {
> +
> + /* Why were we were asked to transfer a
> + * partial block? */
> + get_some_more = 0;
> + continue;
> + }
> +
> + /* Get the next buffer */
> + usb_offset += amount;
> + common->usb_amount_left -= amount;
> + amount_left_to_req -= amount;
> + if (amount_left_to_req == 0)
> + get_some_more = 0;
> +
> + /* amount is always divisible by 512, hence by
> + * the bulk-out maxpacket size */
> + bh->outreq->length = amount;
> + bh->bulk_out_intended_length = amount;
> + bh->outreq->short_not_ok = 1;
> + START_TRANSFER_OR(common, bulk_out, bh->outreq,
> + &bh->outreq_busy, &bh->state)
> + /* Don't know what to do if
> + * common->fsg is NULL */
> + return -EIO;
> + common->next_buffhd_to_fill = bh->next;
> + continue;
> + }
> +
> + /* Write the received data to the backing file */
> + bh = common->next_buffhd_to_drain;
> + if (bh->state == BUF_STATE_EMPTY && !get_some_more)
> + break; /* We stopped early */
> + if (bh->state == BUF_STATE_FULL) {
> + common->next_buffhd_to_drain = bh->next;
> + bh->state = BUF_STATE_EMPTY;
> +
> + /* Did something go wrong with the transfer? */
> + if (bh->outreq->status != 0) {
> + curlun->sense_data = SS_COMMUNICATION_FAILURE;
> + curlun->info_valid = 1;
> + break;
> + }
> +
> + amount = bh->outreq->actual;
> +
> + /* Perform the write */
> + nwritten = pwrite(ums[common->lun].fd, bh->buf, amount, file_offset);
> +
> + VLDBG(curlun, "file write %u @ %llu -> %zd\n", amount,
> + (unsigned long long) file_offset,
> + nwritten);
> +
> + if (nwritten < 0) {
> + LDBG(curlun, "error in file write: %pe\n", ERR_PTR(nwritten));
> + nwritten = 0;
> + } else if (nwritten < amount) {
> + LDBG(curlun, "partial file write: %d/%u\n",
> + (int) nwritten, amount);
> + nwritten -= (nwritten & 511);
> + /* Round down to a block */
> + }
> + file_offset += nwritten;
> + amount_left_to_write -= nwritten;
> + common->residue -= nwritten;
> +
> + /* If an error occurred, report it and its position */
> + if (nwritten < amount) {
> + pr_warn("nwritten:%zd amount:%u\n", nwritten,
> + amount);
> + curlun->sense_data = SS_WRITE_ERROR;
> + curlun->info_valid = 1;
> + break;
> + }
> +
> + /* Did the host decide to stop early? */
> + if (bh->outreq->actual != bh->outreq->length) {
> + common->short_packet_received = 1;
> + break;
> + }
> + continue;
> + }
> +
> + /* Wait for something to happen */
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> +
> + return -EIO; /* No default reply */
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int do_synchronize_cache(struct fsg_common *common)
> +{
> + return 0;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int do_verify(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u32 lba;
> + u32 verification_length;
> + struct fsg_buffhd *bh = common->next_buffhd_to_fill;
> + loff_t file_offset;
> + u32 amount_left;
> + unsigned int amount;
> + ssize_t nread;
> +
> + /* Get the starting Logical Block Address and check that it's
> + * not too big */
> + lba = get_unaligned_be32(&common->cmnd[2]);
> + if (lba >= curlun->num_sectors) {
> + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + return -EINVAL;
> + }
> +
> + /* We allow DPO (Disable Page Out = don't save data in the
> + * cache) but we don't implement it. */
> + if (common->cmnd[1] & ~0x10) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> +
> + verification_length = get_unaligned_be16(&common->cmnd[7]);
> + if (unlikely(verification_length == 0))
> + return -EIO; /* No default reply */
> +
> + /* Prepare to carry out the file verify */
> + amount_left = verification_length << 9;
> + file_offset = ((loff_t) lba) << 9;
> +
> + /* Write out all the dirty buffers before invalidating them */
> +
> + /* Just try to read the requested blocks */
> + while (amount_left > 0) {
> +
> + /* Figure out how much we need to read:
> + * Try to read the remaining amount, but not more than
> + * the buffer size.
> + * And don't try to read past the end of the file.
> + * If this means reading 0 then we were asked to read
> + * past the end of file. */
> + amount = min(amount_left, FSG_BUFLEN);
> + if (amount == 0) {
> + curlun->sense_data =
> + SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + curlun->info_valid = 1;
> + break;
> + }
> +
> + /* Perform the read */
> + nread = pread(ums[common->lun].fd, bh->buf, amount, file_offset);
> +
> + VLDBG(curlun, "file read %u @ %llu -> %zd\n", amount,
> + (unsigned long long) file_offset,
> + nread);
> + if (nread <= 0) {
> + const char *err = nread ? strerror(-nread) : "EOF";
> + LDBG(curlun, "error in file read: %s\n", err);
> + nread = 0;
> + } else if (nread < amount) {
> + LDBG(curlun, "partial file verify: %d/%u\n",
> + (int) nread, amount);
> + nread -= (nread & 511); /* Round down to a sector */
> + }
> + if (nread == 0) {
> + curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
> + curlun->info_valid = 1;
> + break;
> + }
> + file_offset += nread;
> + amount_left -= nread;
> + }
> + return 0;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + static const char vendor_id[] = "Linux ";
> + u8 *buf = (u8 *) bh->buf;
> +
> + if (!curlun) { /* Unsupported LUNs are okay */
> + common->bad_lun_okay = 1;
> + memset(buf, 0, 36);
> + buf[0] = 0x7f; /* Unsupported, no device-type */
> + buf[4] = 31; /* Additional length */
> + return 36;
> + }
> +
> + memset(buf, 0, 8);
> + buf[0] = TYPE_DISK;
> + buf[1] = curlun->removable ? 0x80 : 0;
> + buf[2] = 2; /* ANSI SCSI level 2 */
> + buf[3] = 2; /* SCSI-2 INQUIRY data format */
> + buf[4] = 31; /* Additional length */
> + /* No special options */
> + sprintf((char *) (buf + 8), "%-8s%-16s%04x", (char*) vendor_id ,
> + ums[common->lun].name, (u16) 0xffff);
> +
> + return 36;
> +}
> +
> +
> +static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u8 *buf = (u8 *) bh->buf;
> + u32 sd, sdinfo = 0;
> + int valid;
> +
> + /*
> + * From the SCSI-2 spec., section 7.9 (Unit attention condition):
> + *
> + * If a REQUEST SENSE command is received from an initiator
> + * with a pending unit attention condition (before the target
> + * generates the contingent allegiance condition), then the
> + * target shall either:
> + * a) report any pending sense data and preserve the unit
> + * attention condition on the logical unit, or,
> + * b) report the unit attention condition, may discard any
> + * pending sense data, and clear the unit attention
> + * condition on the logical unit for that initiator.
> + *
> + * FSG normally uses option a); enable this code to use option b).
> + */
> +#if 0
> + if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
> + curlun->sense_data = curlun->unit_attention_data;
> + curlun->unit_attention_data = SS_NO_SENSE;
> + }
> +#endif
> +
> + if (!curlun) { /* Unsupported LUNs are okay */
> + common->bad_lun_okay = 1;
> + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
> + valid = 0;
> + } else {
> + sd = curlun->sense_data;
> + valid = curlun->info_valid << 7;
> + curlun->sense_data = SS_NO_SENSE;
> + curlun->info_valid = 0;
> + }
> +
> + memset(buf, 0, 18);
> + buf[0] = valid | 0x70; /* Valid, current error */
> + buf[2] = SK(sd);
> + put_unaligned_be32(sdinfo, &buf[3]); /* Sense information */
> + buf[7] = 18 - 8; /* Additional sense length */
> + buf[12] = ASC(sd);
> + buf[13] = ASCQ(sd);
> + return 18;
> +}
> +
> +static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u32 lba = get_unaligned_be32(&common->cmnd[2]);
> + int pmi = common->cmnd[8];
> + u8 *buf = (u8 *) bh->buf;
> +
> + /* Check the PMI and LBA fields */
> + if (pmi > 1 || (pmi == 0 && lba != 0)) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> +
> + put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
> + /* Max logical block */
> + put_unaligned_be32(512, &buf[4]); /* Block length */
> + return 8;
> +}
> +
> +static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + int msf = common->cmnd[1] & 0x02;
> + u32 lba = get_unaligned_be32(&common->cmnd[2]);
> + u8 *buf = (u8 *) bh->buf;
> +
> + if (common->cmnd[1] & ~0x02) { /* Mask away MSF */
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> + if (lba >= curlun->num_sectors) {
> + curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
> + return -EINVAL;
> + }
> +
> + memset(buf, 0, 8);
> + buf[0] = 0x01; /* 2048 bytes of user data, rest is EC */
> + store_cdrom_address(&buf[4], msf, lba);
> + return 8;
> +}
> +
> +
> +static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + int msf = common->cmnd[1] & 0x02;
> + int start_track = common->cmnd[6];
> + u8 *buf = (u8 *) bh->buf;
> +
> + if ((common->cmnd[1] & ~0x02) != 0 || /* Mask away MSF */
> + start_track > 1) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> +
> + memset(buf, 0, 20);
> + buf[1] = (20-2); /* TOC data length */
> + buf[2] = 1; /* First track number */
> + buf[3] = 1; /* Last track number */
> + buf[5] = 0x16; /* Data track, copying allowed */
> + buf[6] = 0x01; /* Only track is number 1 */
> + store_cdrom_address(&buf[8], msf, 0);
> +
> + buf[13] = 0x16; /* Lead-out track is data */
> + buf[14] = 0xAA; /* Lead-out track number */
> + store_cdrom_address(&buf[16], msf, curlun->num_sectors);
> +
> + return 20;
> +}
> +
> +static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + int mscmnd = common->cmnd[0];
> + u8 *buf = (u8 *) bh->buf;
> + u8 *buf0 = buf;
> + int pc, page_code;
> + int changeable_values, all_pages;
> + int valid_page = 0;
> + int len, limit;
> +
> + if ((common->cmnd[1] & ~0x08) != 0) { /* Mask away DBD */
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> + pc = common->cmnd[2] >> 6;
> + page_code = common->cmnd[2] & 0x3f;
> + if (pc == 3) {
> + curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
> + return -EINVAL;
> + }
> + changeable_values = (pc == 1);
> + all_pages = (page_code == 0x3f);
> +
> + /* Write the mode parameter header. Fixed values are: default
> + * medium type, no cache control (DPOFUA), and no block descriptors.
> + * The only variable value is the WriteProtect bit. We will fill in
> + * the mode data length later. */
> + memset(buf, 0, 8);
> + if (mscmnd == SCSI_MODE_SEN6) {
> + buf[2] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
> + buf += 4;
> + limit = 255;
> + } else { /* SCSI_MODE_SEN10 */
> + buf[3] = (curlun->ro ? 0x80 : 0x00); /* WP, DPOFUA */
> + buf += 8;
> + limit = 65535; /* Should really be FSG_BUFLEN */
> + }
> +
> + /* No block descriptors */
> +
> + /* The mode pages, in numerical order. The only page we support
> + * is the Caching page. */
> + if (page_code == 0x08 || all_pages) {
> + valid_page = 1;
> + buf[0] = 0x08; /* Page code */
> + buf[1] = 10; /* Page length */
> + memset(buf+2, 0, 10); /* None of the fields are changeable */
> +
> + if (!changeable_values) {
> + buf[2] = 0x04; /* Write cache enable, */
> + /* Read cache not disabled */
> + /* No cache retention priorities */
> + put_unaligned_be16(0xffff, &buf[4]);
> + /* Don't disable prefetch */
> + /* Minimum prefetch = 0 */
> + put_unaligned_be16(0xffff, &buf[8]);
> + /* Maximum prefetch */
> + put_unaligned_be16(0xffff, &buf[10]);
> + /* Maximum prefetch ceiling */
> + }
> + buf += 12;
> + }
> +
> + /* Check that a valid page was requested and the mode data length
> + * isn't too long. */
> + len = buf - buf0;
> + if (!valid_page || len > limit) {
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> +
> + /* Store the mode data length */
> + if (mscmnd == SCSI_MODE_SEN6)
> + buf0[0] = len - 1;
> + else
> + put_unaligned_be16(len - 2, buf0);
> + return len;
> +}
> +
> +
> +static int do_start_stop(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> +
> + if (!curlun) {
> + return -EINVAL;
> + } else if (!curlun->removable) {
> + curlun->sense_data = SS_INVALID_COMMAND;
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
> +static int do_prevent_allow(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + int prevent;
> +
> + if (!curlun->removable) {
> + curlun->sense_data = SS_INVALID_COMMAND;
> + return -EINVAL;
> + }
> +
> + prevent = common->cmnd[4] & 0x01;
> + if ((common->cmnd[4] & ~0x01) != 0) { /* Mask away Prevent */
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> +
> + if (curlun->prevent_medium_removal && !prevent)
> + fsg_lun_fsync_sub(curlun);
> + curlun->prevent_medium_removal = prevent;
> + return 0;
> +}
> +
> +
> +static int do_read_format_capacities(struct fsg_common *common,
> + struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + u8 *buf = (u8 *) bh->buf;
> +
> + buf[0] = buf[1] = buf[2] = 0;
> + buf[3] = 8; /* Only the Current/Maximum Capacity Descriptor */
> + buf += 4;
> +
> + put_unaligned_be32(curlun->num_sectors, &buf[0]);
> + /* Number of blocks */
> + put_unaligned_be32(512, &buf[4]); /* Block length */
> + buf[4] = 0x02; /* Current capacity */
> + return 12;
> +}
> +
> +
> +static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> +
> + /* We don't support MODE SELECT */
> + if (curlun)
> + curlun->sense_data = SS_INVALID_COMMAND;
> + return -EINVAL;
> +}
> +
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
> +{
> + int rc;
> +
> + rc = fsg_set_halt(fsg, fsg->bulk_in);
> + if (rc == -EAGAIN)
> + VDBG(fsg, "delayed bulk-in endpoint halt\n");
> + while (rc != 0) {
> + if (rc != -EAGAIN) {
> + WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
> + rc = 0;
> + break;
> + }
> +
> + rc = usb_ep_set_halt(fsg->bulk_in);
> + }
> + return rc;
> +}
> +
> +static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
> +{
> + int rc;
> +
> + DBG(fsg, "bulk-in set wedge\n");
> + rc = 0; /* usb_ep_set_wedge(fsg->bulk_in); */
> + if (rc == -EAGAIN)
> + VDBG(fsg, "delayed bulk-in endpoint wedge\n");
> + while (rc != 0) {
> + if (rc != -EAGAIN) {
> + WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
> + rc = 0;
> + break;
> + }
> + }
> + return rc;
> +}
> +
> +static int pad_with_zeros(struct fsg_dev *fsg)
> +{
> + struct fsg_buffhd *bh = fsg->common->next_buffhd_to_fill;
> + u32 nkeep = bh->inreq->length;
> + u32 nsend;
> + int rc;
> +
> + bh->state = BUF_STATE_EMPTY; /* For the first iteration */
> + fsg->common->usb_amount_left = nkeep + fsg->common->residue;
> + while (fsg->common->usb_amount_left > 0) {
> +
> + /* Wait for the next buffer to be free */
> + while (bh->state != BUF_STATE_EMPTY) {
> + rc = sleep_thread(fsg->common);
> + if (rc)
> + return rc;
> + }
> +
> + nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
> + memset(bh->buf + nkeep, 0, nsend - nkeep);
> + bh->inreq->length = nsend;
> + bh->inreq->zero = 0;
> + start_transfer(fsg, fsg->bulk_in, bh->inreq,
> + &bh->inreq_busy, &bh->state);
> + bh = fsg->common->next_buffhd_to_fill = bh->next;
> + fsg->common->usb_amount_left -= nsend;
> + nkeep = 0;
> + }
> + return 0;
> +}
> +
> +static int throw_away_data(struct fsg_common *common)
> +{
> + struct fsg_buffhd *bh;
> + u32 amount;
> + int rc;
> +
> + for (bh = common->next_buffhd_to_drain;
> + bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
> + bh = common->next_buffhd_to_drain) {
> +
> + /* Throw away the data in a filled buffer */
> + if (bh->state == BUF_STATE_FULL) {
> + bh->state = BUF_STATE_EMPTY;
> + common->next_buffhd_to_drain = bh->next;
> +
> + /* A short packet or an error ends everything */
> + if (bh->outreq->actual != bh->outreq->length ||
> + bh->outreq->status != 0) {
> + raise_exception(common,
> + FSG_STATE_ABORT_BULK_OUT);
> + return -EPIPE;
> + }
> + continue;
> + }
> +
> + /* Try to submit another request if we need one */
> + bh = common->next_buffhd_to_fill;
> + if (bh->state == BUF_STATE_EMPTY
> + && common->usb_amount_left > 0) {
> + amount = min(common->usb_amount_left, FSG_BUFLEN);
> +
> + /* amount is always divisible by 512, hence by
> + * the bulk-out maxpacket size */
> + bh->outreq->length = amount;
> + bh->bulk_out_intended_length = amount;
> + bh->outreq->short_not_ok = 1;
> + START_TRANSFER_OR(common, bulk_out, bh->outreq,
> + &bh->outreq_busy, &bh->state)
> + /* Don't know what to do if
> + * common->fsg is NULL */
> + return -EIO;
> + common->next_buffhd_to_fill = bh->next;
> + common->usb_amount_left -= amount;
> + continue;
> + }
> +
> + /* Otherwise wait for something to happen */
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> + return 0;
> +}
> +
> +
> +static int finish_reply(struct fsg_common *common)
> +{
> + struct fsg_buffhd *bh = common->next_buffhd_to_fill;
> + int rc = 0;
> +
> + switch (common->data_dir) {
> + case DATA_DIR_NONE:
> + break; /* Nothing to send */
> +
> + /* If we don't know whether the host wants to read or write,
> + * this must be CB or CBI with an unknown command. We mustn't
> + * try to send or receive any data. So stall both bulk pipes
> + * if we can and wait for a reset. */
> + case DATA_DIR_UNKNOWN:
> + if (!common->can_stall) {
> + /* Nothing */
> + } else if (fsg_is_set(common)) {
> + fsg_set_halt(common->fsg, common->fsg->bulk_out);
> + rc = halt_bulk_in_endpoint(common->fsg);
> + } else {
> + /* Don't know what to do if common->fsg is NULL */
> + rc = -EIO;
> + }
> + break;
> +
> + /* All but the last buffer of data must have already been sent */
> + case DATA_DIR_TO_HOST:
> + if (common->data_size == 0) {
> + /* Nothing to send */
> +
> + /* If there's no residue, simply send the last buffer */
> + } else if (common->residue == 0) {
> + bh->inreq->zero = 0;
> + START_TRANSFER_OR(common, bulk_in, bh->inreq,
> + &bh->inreq_busy, &bh->state)
> + return -EIO;
> + common->next_buffhd_to_fill = bh->next;
> +
> + /* For Bulk-only, if we're allowed to stall then send the
> + * short packet and halt the bulk-in endpoint. If we can't
> + * stall, pad out the remaining data with 0's. */
> + } else if (common->can_stall) {
> + bh->inreq->zero = 1;
> + START_TRANSFER_OR(common, bulk_in, bh->inreq,
> + &bh->inreq_busy, &bh->state)
> + /* Don't know what to do if
> + * common->fsg is NULL */
> + rc = -EIO;
> + common->next_buffhd_to_fill = bh->next;
> + if (common->fsg)
> + rc = halt_bulk_in_endpoint(common->fsg);
> + } else if (fsg_is_set(common)) {
> + rc = pad_with_zeros(common->fsg);
> + } else {
> + /* Don't know what to do if common->fsg is NULL */
> + rc = -EIO;
> + }
> + break;
> +
> + /* We have processed all we want from the data the host has sent.
> + * There may still be outstanding bulk-out requests. */
> + case DATA_DIR_FROM_HOST:
> + if (common->residue == 0) {
> + /* Nothing to receive */
> +
> + /* Did the host stop sending unexpectedly early? */
> + } else if (common->short_packet_received) {
> + raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
> + rc = -EPIPE;
> +
> + /* We haven't processed all the incoming data. Even though
> + * we may be allowed to stall, doing so would cause a race.
> + * The controller may already have ACK'ed all the remaining
> + * bulk-out packets, in which case the host wouldn't see a
> + * STALL. Not realizing the endpoint was halted, it wouldn't
> + * clear the halt -- leading to problems later on. */
> +#if 0
> + } else if (common->can_stall) {
> + if (fsg_is_set(common))
> + fsg_set_halt(common->fsg,
> + common->fsg->bulk_out);
> + raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
> + rc = -EPIPE;
> +#endif
> +
> + /* We can't stall. Read in the excess data and throw it
> + * all away. */
> + } else {
> + rc = throw_away_data(common);
> + }
> + break;
> + }
> + return rc;
> +}
> +
> +
> +static int send_status(struct fsg_common *common)
> +{
> + struct fsg_lun *curlun = &common->luns[common->lun];
> + struct fsg_buffhd *bh;
> + struct bulk_cs_wrap *csw;
> + int rc;
> + u8 status = US_BULK_STAT_OK;
> + u32 sd, sdinfo = 0;
> +
> + /* Wait for the next buffer to become available */
> + bh = common->next_buffhd_to_fill;
> + while (bh->state != BUF_STATE_EMPTY) {
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> +
> + if (curlun)
> + sd = curlun->sense_data;
> + else if (common->bad_lun_okay)
> + sd = SS_NO_SENSE;
> + else
> + sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
> +
> + if (common->phase_error) {
> + DBG(common, "sending phase-error status\n");
> + status = US_BULK_STAT_PHASE;
> + sd = SS_INVALID_COMMAND;
> + } else if (sd != SS_NO_SENSE) {
> + DBG(common, "sending command-failure status\n");
> + status = US_BULK_STAT_FAIL;
> + VDBG(common, " sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
> + " info x%x\n",
> + SK(sd), ASC(sd), ASCQ(sd), sdinfo);
> + }
> +
> + /* Store and send the Bulk-only CSW */
> + csw = (void *)bh->buf;
> +
> + csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
> + csw->Tag = common->tag;
> + csw->Residue = cpu_to_le32(common->residue);
> + csw->Status = status;
> +
> + bh->inreq->length = US_BULK_CS_WRAP_LEN;
> + bh->inreq->zero = 0;
> + START_TRANSFER_OR(common, bulk_in, bh->inreq,
> + &bh->inreq_busy, &bh->state)
> + /* Don't know what to do if common->fsg is NULL */
> + return -EIO;
> +
> + common->next_buffhd_to_fill = bh->next;
> + return 0;
> +}
> +
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/* Check whether the command is properly formed and whether its data size
> + * and direction agree with the values we already have. */
> +static int check_command(struct fsg_common *common, int cmnd_size,
> + enum data_direction data_dir, unsigned int mask,
> + int needs_medium, const char *name)
> +{
> + int i;
> + int lun = common->cmnd[1] >> 5;
> + static const char dirletter[4] = {'u', 'o', 'i', 'n'};
> + char hdlen[20];
> + struct fsg_lun *curlun;
> +
> + hdlen[0] = 0;
> + if (common->data_dir != DATA_DIR_UNKNOWN)
> + sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
> + common->data_size);
> + VDBG(common, "SCSI command: %s; Dc=%d, D%c=%u; Hc=%d%s\n",
> + name, cmnd_size, dirletter[(int) data_dir],
> + common->data_size_from_cmnd, common->cmnd_size, hdlen);
> +
> + /* We can't reply at all until we know the correct data direction
> + * and size. */
> + if (common->data_size_from_cmnd == 0)
> + data_dir = DATA_DIR_NONE;
> + if (common->data_size < common->data_size_from_cmnd) {
> + /* Host data size < Device data size is a phase error.
> + * Carry out the command, but only transfer as much as
> + * we are allowed. */
> + common->data_size_from_cmnd = common->data_size;
> + common->phase_error = 1;
> + }
> + common->residue = common->data_size;
> + common->usb_amount_left = common->data_size;
> +
> + /* Conflicting data directions is a phase error */
> + if (common->data_dir != data_dir
> + && common->data_size_from_cmnd > 0) {
> + common->phase_error = 1;
> + return -EINVAL;
> + }
> +
> + /* Verify the length of the command itself */
> + if (cmnd_size != common->cmnd_size) {
> +
> + /* Special case workaround: There are plenty of buggy SCSI
> + * implementations. Many have issues with cbw->Length
> + * field passing a wrong command size. For those cases we
> + * always try to work around the problem by using the length
> + * sent by the host side provided it is at least as large
> + * as the correct command length.
> + * Examples of such cases would be MS-Windows, which issues
> + * REQUEST SENSE with cbw->Length == 12 where it should
> + * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
> + * REQUEST SENSE with cbw->Length == 10 where it should
> + * be 6 as well.
> + */
> + if (cmnd_size <= common->cmnd_size) {
> + DBG(common, "%s is buggy! Expected length %d "
> + "but we got %d\n", name,
> + cmnd_size, common->cmnd_size);
> + cmnd_size = common->cmnd_size;
> + } else {
> + common->phase_error = 1;
> + return -EINVAL;
> + }
> + }
> +
> + /* Check that the LUN values are consistent */
> + if (common->lun != lun)
> + DBG(common, "using LUN %d from CBW, not LUN %d from CDB\n",
> + common->lun, lun);
> +
> + /* Check the LUN */
> + if (common->lun < common->nluns) {
> + curlun = &common->luns[common->lun];
> + if (common->cmnd[0] != SCSI_REQ_SENSE) {
> + curlun->sense_data = SS_NO_SENSE;
> + curlun->info_valid = 0;
> + }
> + } else {
> + curlun = NULL;
> + common->bad_lun_okay = 0;
> +
> + /* INQUIRY and REQUEST SENSE commands are explicitly allowed
> + * to use unsupported LUNs; all others may not. */
> + if (common->cmnd[0] != SCSI_INQUIRY &&
> + common->cmnd[0] != SCSI_REQ_SENSE) {
> + DBG(common, "unsupported LUN %d\n", common->lun);
> + return -EINVAL;
> + }
> + }
> +#if 0
> + /* If a unit attention condition exists, only INQUIRY and
> + * REQUEST SENSE commands are allowed; anything else must fail. */
> + if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
> + common->cmnd[0] != SCSI_INQUIRY &&
> + common->cmnd[0] != SCSI_REQ_SENSE) {
> + curlun->sense_data = curlun->unit_attention_data;
> + curlun->unit_attention_data = SS_NO_SENSE;
> + return -EINVAL;
> + }
> +#endif
> + /* Check that only command bytes listed in the mask are non-zero */
> + common->cmnd[1] &= 0x1f; /* Mask away the LUN */
> + for (i = 1; i < cmnd_size; ++i) {
> + if (common->cmnd[i] && !(mask & (1 << i))) {
> + if (curlun)
> + curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
> + return -EINVAL;
> + }
> + }
> +
> + return 0;
> +}
> +
> +static int do_scsi_command(struct fsg_common *common)
> +{
> + struct fsg_buffhd *bh;
> + int rc;
> + int reply = -EINVAL;
> + int i;
> + static char unknown[16];
> + struct fsg_lun *curlun = &common->luns[common->lun];
> +
> + dump_cdb(common);
> +
> + /* Wait for the next buffer to become available for data or status */
> + bh = common->next_buffhd_to_fill;
> + common->next_buffhd_to_drain = bh;
> + while (bh->state != BUF_STATE_EMPTY) {
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> + common->phase_error = 0;
> + common->short_packet_received = 0;
> +
> + down_read(&common->filesem); /* We're using the backing file */
> + switch (common->cmnd[0]) {
> +
> + case SCSI_INQUIRY:
> + common->data_size_from_cmnd = common->cmnd[4];
> + reply = check_command(common, 6, DATA_DIR_TO_HOST,
> + (1<<4), 0,
> + "INQUIRY");
> + if (reply == 0)
> + reply = do_inquiry(common, bh);
> + break;
> +
> + case SCSI_MODE_SEL6:
> + common->data_size_from_cmnd = common->cmnd[4];
> + reply = check_command(common, 6, DATA_DIR_FROM_HOST,
> + (1<<1) | (1<<4), 0,
> + "MODE SELECT(6)");
> + if (reply == 0)
> + reply = do_mode_select(common, bh);
> + break;
> +
> + case SCSI_MODE_SEL10:
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]);
> + reply = check_command(common, 10, DATA_DIR_FROM_HOST,
> + (1<<1) | (3<<7), 0,
> + "MODE SELECT(10)");
> + if (reply == 0)
> + reply = do_mode_select(common, bh);
> + break;
> +
> + case SCSI_MODE_SEN6:
> + common->data_size_from_cmnd = common->cmnd[4];
> + reply = check_command(common, 6, DATA_DIR_TO_HOST,
> + (1<<1) | (1<<2) | (1<<4), 0,
> + "MODE SENSE(6)");
> + if (reply == 0)
> + reply = do_mode_sense(common, bh);
> + break;
> +
> + case SCSI_MODE_SEN10:
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]);
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (1<<1) | (1<<2) | (3<<7), 0,
> + "MODE SENSE(10)");
> + if (reply == 0)
> + reply = do_mode_sense(common, bh);
> + break;
> +
> + case SCSI_MED_REMOVL:
> + common->data_size_from_cmnd = 0;
> + reply = check_command(common, 6, DATA_DIR_NONE,
> + (1<<4), 0,
> + "PREVENT-ALLOW MEDIUM REMOVAL");
> + if (reply == 0)
> + reply = do_prevent_allow(common);
> + break;
> +
> + case SCSI_READ6:
> + i = common->cmnd[4];
> + common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
> + reply = check_command(common, 6, DATA_DIR_TO_HOST,
> + (7<<1) | (1<<4), 1,
> + "READ(6)");
> + if (reply == 0)
> + reply = do_read(common);
> + break;
> +
> + case SCSI_READ10:
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]) << 9;
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (1<<1) | (0xf<<2) | (3<<7), 1,
> + "READ(10)");
> + if (reply == 0)
> + reply = do_read(common);
> + break;
> +
> + case SCSI_READ12:
> + common->data_size_from_cmnd =
> + get_unaligned_be32(&common->cmnd[6]) << 9;
> + reply = check_command(common, 12, DATA_DIR_TO_HOST,
> + (1<<1) | (0xf<<2) | (0xf<<6), 1,
> + "READ(12)");
> + if (reply == 0)
> + reply = do_read(common);
> + break;
> +
> + case SCSI_RD_CAPAC:
> + common->data_size_from_cmnd = 8;
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (0xf<<2) | (1<<8), 1,
> + "READ CAPACITY");
> + if (reply == 0)
> + reply = do_read_capacity(common, bh);
> + break;
> +
> + case SCSI_RD_HEADER:
> + if (!common->luns[common->lun].cdrom)
> + goto unknown_cmnd;
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]);
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (3<<7) | (0x1f<<1), 1,
> + "READ HEADER");
> + if (reply == 0)
> + reply = do_read_header(common, bh);
> + break;
> +
> + case SCSI_RD_TOC:
> + if (!common->luns[common->lun].cdrom)
> + goto unknown_cmnd;
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]);
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (7<<6) | (1<<1), 1,
> + "READ TOC");
> + if (reply == 0)
> + reply = do_read_toc(common, bh);
> + break;
> +
> + case SCSI_RD_FMT_CAPAC:
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]);
> + reply = check_command(common, 10, DATA_DIR_TO_HOST,
> + (3<<7), 1,
> + "READ FORMAT CAPACITIES");
> + if (reply == 0)
> + reply = do_read_format_capacities(common, bh);
> + break;
> +
> + case SCSI_REQ_SENSE:
> + common->data_size_from_cmnd = common->cmnd[4];
> + reply = check_command(common, 6, DATA_DIR_TO_HOST,
> + (1<<4), 0,
> + "REQUEST SENSE");
> + if (reply == 0)
> + reply = do_request_sense(common, bh);
> + break;
> +
> + case SCSI_START_STP:
> + common->data_size_from_cmnd = 0;
> + reply = check_command(common, 6, DATA_DIR_NONE,
> + (1<<1) | (1<<4), 0,
> + "START-STOP UNIT");
> + if (reply == 0)
> + reply = do_start_stop(common);
> + break;
> +
> + case SCSI_SYNC_CACHE:
> + common->data_size_from_cmnd = 0;
> + reply = check_command(common, 10, DATA_DIR_NONE,
> + (0xf<<2) | (3<<7), 1,
> + "SYNCHRONIZE CACHE");
> + if (reply == 0)
> + reply = do_synchronize_cache(common);
> + break;
> +
> + case SCSI_TST_U_RDY:
> + common->data_size_from_cmnd = 0;
> + reply = check_command(common, 6, DATA_DIR_NONE,
> + 0, 1,
> + "TEST UNIT READY");
> + break;
> +
> + /* Although optional, this command is used by MS-Windows. We
> + * support a minimal version: BytChk must be 0. */
> + case SCSI_VERIFY:
> + common->data_size_from_cmnd = 0;
> + reply = check_command(common, 10, DATA_DIR_NONE,
> + (1<<1) | (0xf<<2) | (3<<7), 1,
> + "VERIFY");
> + if (reply == 0)
> + reply = do_verify(common);
> + break;
> +
> + case SCSI_WRITE6:
> + i = common->cmnd[4];
> + common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
> + reply = check_command(common, 6, DATA_DIR_FROM_HOST,
> + (7<<1) | (1<<4), 1,
> + "WRITE(6)");
> + if (reply == 0)
> + reply = do_write(common);
> + break;
> +
> + case SCSI_WRITE10:
> + common->data_size_from_cmnd =
> + get_unaligned_be16(&common->cmnd[7]) << 9;
> + reply = check_command(common, 10, DATA_DIR_FROM_HOST,
> + (1<<1) | (0xf<<2) | (3<<7), 1,
> + "WRITE(10)");
> + if (reply == 0)
> + reply = do_write(common);
> + break;
> +
> + case SCSI_WRITE12:
> + common->data_size_from_cmnd =
> + get_unaligned_be32(&common->cmnd[6]) << 9;
> + reply = check_command(common, 12, DATA_DIR_FROM_HOST,
> + (1<<1) | (0xf<<2) | (0xf<<6), 1,
> + "WRITE(12)");
> + if (reply == 0)
> + reply = do_write(common);
> + break;
> +
> + /* Some mandatory commands that we recognize but don't implement.
> + * They don't mean much in this setting. It's left as an exercise
> + * for anyone interested to implement RESERVE and RELEASE in terms
> + * of Posix locks. */
> + case SCSI_FORMAT:
> + case SCSI_RELEASE:
> + case SCSI_RESERVE:
> + case SCSI_SEND_DIAG:
> + /* Fall through */
> +
> + default:
> +unknown_cmnd:
> + common->data_size_from_cmnd = 0;
> + sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
> + reply = check_command(common, common->cmnd_size,
> + DATA_DIR_UNKNOWN, 0xff, 0, unknown);
> + if (reply == 0) {
> + curlun->sense_data = SS_INVALID_COMMAND;
> + reply = -EINVAL;
> + }
> + break;
> + }
> + up_read(&common->filesem);
> +
> + if (reply == -EPIPE)
> + return -EPIPE;
> +
> + /* Set up the single reply buffer for finish_reply() */
> + if (reply == -EINVAL)
> + reply = 0; /* Error reply length */
> + if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
> + reply = min((u32) reply, common->data_size_from_cmnd);
> + bh->inreq->length = reply;
> + bh->state = BUF_STATE_FULL;
> + common->residue -= reply;
> + } /* Otherwise it's already set */
> +
> + return 0;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
> +{
> + struct usb_request *req = bh->outreq;
> + struct bulk_cb_wrap *cbw = req->buf;
> + struct fsg_common *common = fsg->common;
> +
> + /* Was this a real packet? Should it be ignored? */
> + if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
> + return -EINVAL;
> +
> + /* Is the CBW valid? */
> + if (req->actual != US_BULK_CB_WRAP_LEN ||
> + cbw->Signature != cpu_to_le32(
> + US_BULK_CB_SIGN)) {
> + DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
> + req->actual,
> + le32_to_cpu(cbw->Signature));
> +
> + /* The Bulk-only spec says we MUST stall the IN endpoint
> + * (6.6.1), so it's unavoidable. It also says we must
> + * retain this state until the next reset, but there's
> + * no way to tell the controller driver it should ignore
> + * Clear-Feature(HALT) requests.
> + *
> + * We aren't required to halt the OUT endpoint; instead
> + * we can simply accept and discard any data received
> + * until the next reset. */
> + wedge_bulk_in_endpoint(fsg);
> + set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
> + return -EINVAL;
> + }
> +
> + /* Is the CBW meaningful? */
> + if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
> + cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
> + DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
> + "cmdlen %u\n",
> + cbw->Lun, cbw->Flags, cbw->Length);
> +
> + /* We can do anything we want here, so let's stall the
> + * bulk pipes if we are allowed to. */
> + if (common->can_stall) {
> + fsg_set_halt(fsg, fsg->bulk_out);
> + halt_bulk_in_endpoint(fsg);
> + }
> + return -EINVAL;
> + }
> +
> + /* Save the command for later */
> + common->cmnd_size = cbw->Length;
> + memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
> + if (cbw->Flags & US_BULK_FLAG_IN)
> + common->data_dir = DATA_DIR_TO_HOST;
> + else
> + common->data_dir = DATA_DIR_FROM_HOST;
> + common->data_size = le32_to_cpu(cbw->DataTransferLength);
> + if (common->data_size == 0)
> + common->data_dir = DATA_DIR_NONE;
> + common->lun = cbw->Lun;
> + common->tag = cbw->Tag;
> + return 0;
> +}
> +
> +
> +static int get_next_command(struct fsg_common *common)
> +{
> + struct fsg_buffhd *bh;
> + int rc = 0;
> +
> + /* Wait for the next buffer to become available */
> + bh = common->next_buffhd_to_fill;
> + while (bh->state != BUF_STATE_EMPTY) {
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> +
> + /* Queue a request to read a Bulk-only CBW */
> + set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN);
> + bh->outreq->short_not_ok = 1;
> + START_TRANSFER_OR(common, bulk_out, bh->outreq,
> + &bh->outreq_busy, &bh->state)
> + /* Don't know what to do if common->fsg is NULL */
> + return -EIO;
> +
> + /* We will drain the buffer in software, which means we
> + * can reuse it for the next filling. No need to advance
> + * next_buffhd_to_fill. */
> +
> + /* Wait for the CBW to arrive */
> + while (bh->state != BUF_STATE_FULL) {
> + rc = sleep_thread(common);
> + if (rc)
> + return rc;
> + }
> +
> + rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
> + bh->state = BUF_STATE_EMPTY;
> +
> + return rc;
> +}
> +
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int enable_endpoint(struct fsg_common *common, struct usb_ep *ep)
> +{
> + int rc;
> +
> + ep->driver_data = common;
> + rc = usb_ep_enable(ep);
> + if (rc)
> + ERROR(common, "can't enable %s, result %d\n", ep->name, rc);
> + return rc;
> +}
> +
> +static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
> + struct usb_request **preq)
> +{
> + *preq = usb_ep_alloc_request(ep);
> + if (*preq)
> + return 0;
> + ERROR(common, "can't allocate request for %s\n", ep->name);
> + return -ENOMEM;
> +}
> +
> +/* Reset interface setting and re-init endpoint state (toggle etc). */
> +static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
> +{
> + struct fsg_dev *fsg;
> + int i, rc = 0;
> +
> + if (common->running)
> + DBG(common, "reset interface\n");
> +
> +reset:
> + /* Deallocate the requests */
> + if (common->fsg) {
> + fsg = common->fsg;
> +
> + for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
> + struct fsg_buffhd *bh = &common->buffhds[i];
> +
> + if (bh->inreq) {
> + usb_ep_free_request(fsg->bulk_in, bh->inreq);
> + bh->inreq = NULL;
> + }
> + if (bh->outreq) {
> + usb_ep_free_request(fsg->bulk_out, bh->outreq);
> + bh->outreq = NULL;
> + }
> + }
> +
> + /* Disable the endpoints */
> + if (fsg->bulk_in_enabled) {
> + usb_ep_disable(fsg->bulk_in);
> + fsg->bulk_in_enabled = 0;
> + }
> + if (fsg->bulk_out_enabled) {
> + usb_ep_disable(fsg->bulk_out);
> + fsg->bulk_out_enabled = 0;
> + }
> +
> + common->fsg = NULL;
> + wake_up(&common->fsg_wait);
> + }
> +
> + common->running = 0;
> + if (!new_fsg || rc)
> + return rc;
> +
> + common->fsg = new_fsg;
> + fsg = common->fsg;
> +
> + /* Enable the endpoints */
> + fsg->bulk_in->desc = fsg_ep_desc(common->gadget,
> + &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
> + rc = enable_endpoint(common, fsg->bulk_in);
> + if (rc)
> + goto reset;
> + fsg->bulk_in_enabled = 1;
> +
> + fsg->bulk_out->desc = fsg_ep_desc(common->gadget,
> + &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
> + rc = enable_endpoint(common, fsg->bulk_out);
> + if (rc)
> + goto reset;
> + fsg->bulk_out_enabled = 1;
> + common->bulk_out_maxpacket = 512;
> + clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
> +
> + /* Allocate the requests */
> + for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
> + struct fsg_buffhd *bh = &common->buffhds[i];
> +
> + rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
> + if (rc)
> + goto reset;
> + rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
> + if (rc)
> + goto reset;
> + bh->inreq->buf = bh->outreq->buf = bh->buf;
> + bh->inreq->context = bh->outreq->context = bh;
> + bh->inreq->complete = bulk_in_complete;
> + bh->outreq->complete = bulk_out_complete;
> + }
> +
> + common->running = 1;
> +
> + return rc;
> +}
> +
> +
> +/****************************** ALT CONFIGS ******************************/
> +
> +
> +static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
> +{
> + struct fsg_dev *fsg = fsg_from_func(f);
> + fsg->common->new_fsg = fsg;
> + raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
> + return 0;
> +}
> +
> +static void fsg_disable(struct usb_function *f)
> +{
> + struct fsg_dev *fsg = fsg_from_func(f);
> + fsg->common->new_fsg = NULL;
> + raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static void handle_exception(struct fsg_common *common)
> +{
> + int i;
> + struct fsg_buffhd *bh;
> + enum fsg_state old_state;
> + struct fsg_lun *curlun;
> + unsigned int exception_req_tag;
> +
> + /* Cancel all the pending transfers */
> + if (common->fsg) {
> + for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
> + bh = &common->buffhds[i];
> + if (bh->inreq_busy)
> + usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
> + if (bh->outreq_busy)
> + usb_ep_dequeue(common->fsg->bulk_out,
> + bh->outreq);
> + }
> +
> + /* Wait until everything is idle */
> + for (;;) {
> + int num_active = 0;
> + for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
> + bh = &common->buffhds[i];
> + num_active += bh->inreq_busy + bh->outreq_busy;
> + }
> + if (num_active == 0)
> + break;
> + if (sleep_thread(common))
> + return;
> + }
> +
> + /* Clear out the controller's fifos */
> + if (common->fsg->bulk_in_enabled)
> + usb_ep_fifo_flush(common->fsg->bulk_in);
> + if (common->fsg->bulk_out_enabled)
> + usb_ep_fifo_flush(common->fsg->bulk_out);
> + }
> +
> + /* Reset the I/O buffer states and pointers, the SCSI
> + * state, and the exception. Then invoke the handler. */
> +
> + for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
> + bh = &common->buffhds[i];
> + bh->state = BUF_STATE_EMPTY;
> + }
> + common->next_buffhd_to_fill = &common->buffhds[0];
> + common->next_buffhd_to_drain = &common->buffhds[0];
> + exception_req_tag = common->exception_req_tag;
> + old_state = common->state;
> +
> + report_exception("handling", old_state);
> +
> + if (old_state == FSG_STATE_ABORT_BULK_OUT)
> + common->state = FSG_STATE_STATUS_PHASE;
> + else {
> + for (i = 0; i < common->nluns; ++i) {
> + curlun = &common->luns[i];
> + curlun->sense_data = SS_NO_SENSE;
> + curlun->info_valid = 0;
> + }
> + common->state = FSG_STATE_IDLE;
> + }
> +
> + /* Carry out any extra actions required for the exception */
> + switch (old_state) {
> + case FSG_STATE_ABORT_BULK_OUT:
> + send_status(common);
> +
> + if (common->state == FSG_STATE_STATUS_PHASE)
> + common->state = FSG_STATE_IDLE;
> + break;
> +
> + case FSG_STATE_RESET:
> + /* In case we were forced against our will to halt a
> + * bulk endpoint, clear the halt now. (The SuperH UDC
> + * requires this.) */
> + if (!fsg_is_set(common))
> + break;
> + if (test_and_clear_bit(IGNORE_BULK_OUT,
> + &common->fsg->atomic_bitflags))
> + usb_ep_clear_halt(common->fsg->bulk_in);
> +
> + if (common->ep0_req_tag == exception_req_tag)
> + ep0_queue(common); /* Complete the status stage */
> +
> + break;
> +
> + case FSG_STATE_CONFIG_CHANGE:
> + do_set_interface(common, common->new_fsg);
> + break;
> +
> + case FSG_STATE_EXIT:
> + case FSG_STATE_TERMINATED:
> + do_set_interface(common, NULL); /* Free resources */
> + common->state = FSG_STATE_TERMINATED; /* Stop the thread */
> + break;
> +
> + case FSG_STATE_INTERFACE_CHANGE:
> + case FSG_STATE_DISCONNECT:
> + case FSG_STATE_COMMAND_PHASE:
> + case FSG_STATE_DATA_PHASE:
> + case FSG_STATE_STATUS_PHASE:
> + case FSG_STATE_IDLE:
> + break;
> + }
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static int fsg_main_thread(void *common_)
> +{
> + struct fsg_common *common = common_;
> + int ret = 0;
> +
> + /* The main loop */
> + while (common->state != FSG_STATE_TERMINATED) {
> + if (exception_in_progress(common)) {
> + handle_exception(common);
> + continue;
> + }
> +
> + if (!common->running) {
> + ret = sleep_thread(common);
> + if (ret)
> + break;
> + continue;
> + }
> +
> + ret = get_next_command(common);
> + if (ret)
> + continue;
> +
> + if (!exception_in_progress(common))
> + common->state = FSG_STATE_DATA_PHASE;
> +
> + if (do_scsi_command(common) || finish_reply(common))
> + continue;
> +
> + if (!exception_in_progress(common))
> + common->state = FSG_STATE_STATUS_PHASE;
> +
> + if (send_status(common))
> + continue;
> +
> + if (!exception_in_progress(common))
> + common->state = FSG_STATE_IDLE;
> + }
> +
> + if (ret && ret != -ERESTARTSYS)
> + pr_warn("%s: error %pe\n", __func__, ERR_PTR(ret));
> +
> + complete_and_exit(&common->thread_notifier, 0);
> +}
> +
> +static void fsg_common_release(struct kref *ref);
> +
> +static struct fsg_common *fsg_common_setup(void)
> +{
> + struct fsg_common *common;
> +
> + /* Allocate? */
> + common = calloc(sizeof(*common), 1);
> + if (!common)
> + return NULL;
> + common->free_storage_on_release = 1;
> +
> + init_completion(&common->thread_notifier);
> +
> + common->ops = NULL;
> + common->private_data = NULL;
> +
> + return common;
> +}
> +
> +static int fsg_common_init(struct fsg_common *common,
> + struct usb_composite_dev *cdev)
> +{
> + struct usb_gadget *gadget = cdev->gadget;
> + struct file_list_entry *fentry;
> + struct fsg_buffhd *bh;
> + struct fsg_lun *curlun;
> + int nluns, i, fd = -1, rc;
> +
> + ums_count = 0;
> +
> + common->gadget = gadget;
> + common->ep0 = gadget->ep0;
> + common->ep0req = cdev->req;
> +
> + file_list_for_each_entry(ums_files, fentry) {
> + unsigned flags = O_RDWR;
> + struct stat st;
> +
> + if (fentry->flags) {
> + pr_err("flags not supported\n");
> + return -ENOSYS;
> + }
> +
> + fd = open(fentry->filename, flags);
> + if (fd < 0) {
> + pr_err("open('%s') failed: %pe\n",
> + fentry->filename, ERR_PTR(fd));
> + return fd;
> + }
> +
> + rc = fstat(fd, &st);
> + if (rc < 0) {
> + pr_err("stat('%s') failed: %pe\n",
> + fentry->filename, ERR_PTR(rc));
> + goto close;
> + }
> +
> + if (st.st_size % SECTOR_SIZE != 0) {
> + pr_err("exporting '%s' failed: invalid block size\n",
> + fentry->filename);
> + goto close;
> + }
> +
> + ums[ums_count].fd = fd;
> + ums[ums_count].num_sectors = st.st_size / SECTOR_SIZE;
> +
> + strlcpy(ums[ums_count].name, fentry->name, sizeof(ums[ums_count].name));
> +
> + DBG(common, "LUN %d, %s sector_count %#x\n",
> + ums_count, fentry->name, ums[ums_count].num_sectors);
> +
> + ums_count++;
> + }
> +
> + /* Find out how many LUNs there should be */
> + nluns = ums_count;
> + if (nluns < 1 || nluns > FSG_MAX_LUNS) {
> + pr_warn("invalid number of LUNs: %u\n", nluns);
> + rc = -EINVAL;
> + goto close;
> + }
> +
> + /* Maybe allocate device-global string IDs, and patch descriptors */
> + if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
> + rc = usb_string_id(cdev);
> + if (unlikely(rc < 0))
> + goto error_release;
> + fsg_strings[FSG_STRING_INTERFACE].id = rc;
> + fsg_intf_desc.iInterface = rc;
> + }
> +
> + /* Create the LUNs, open their backing files, and register the
> + * LUN devices in sysfs. */
> + curlun = calloc(nluns, sizeof *curlun);
> + if (!curlun) {
> + rc = -ENOMEM;
> + goto error_release;
> + }
> + common->nluns = nluns;
> +
> + for (i = 0; i < nluns; i++) {
> + common->luns[i].removable = 1;
> +
> + rc = fsg_lun_open(&common->luns[i], ums[i].num_sectors, "");
> + if (rc)
> + goto error_luns;
> + }
> + common->lun = 0;
> +
> + /* Data buffers cyclic list */
> + bh = common->buffhds;
> +
> + i = FSG_NUM_BUFFERS;
> + goto buffhds_first_it;
> + do {
> + bh->next = bh + 1;
> + ++bh;
> +buffhds_first_it:
> + bh->inreq_busy = 0;
> + bh->outreq_busy = 0;
> + bh->buf = dma_alloc(FSG_BUFLEN);
> + if (unlikely(!bh->buf)) {
> + rc = -ENOMEM;
> + goto error_release;
> + }
> + } while (--i);
> + bh->next = common->buffhds;
> +
> + snprintf(common->inquiry_string, sizeof common->inquiry_string,
> + "%-8s%-16s%04x",
> + "Linux ",
> + "File-Store Gadget",
> + 0xffff);
> +
> + /* Some peripheral controllers are known not to be able to
> + * halt bulk endpoints correctly. If one of them is present,
> + * disable stalls.
> + */
> +
> + /* Information */
> + DBG(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
> + DBG(common, "Number of LUNs=%d\n", common->nluns);
> +
> + return 0;
> +
> +error_luns:
> + common->nluns = i + 1;
> +error_release:
> + common->state = FSG_STATE_TERMINATED; /* The thread is dead */
> + /* Call fsg_common_release() directly, ref might be not
> + * initialised */
> + fsg_common_release(&common->ref);
> +close:
> + close(fd);
> + return rc;
> +}
> +
> +static void fsg_common_release(struct kref *ref)
> +{
> + struct fsg_common *common = container_of(ref, struct fsg_common, ref);
> + struct fsg_buffhd *bh;
> + unsigned i;
> +
> + /* If the thread isn't already dead, tell it to exit now */
> + if (common->state != FSG_STATE_TERMINATED) {
> + raise_exception(common, FSG_STATE_EXIT);
> + wait_for_completion_interruptible(&common->thread_notifier);
> + free_kthread_struct(thread_task);
> + }
> +
> + bh = common->buffhds;
> + i = FSG_NUM_BUFFERS;
> +
> + do {
> + dma_free(bh->buf);
> + } while (++bh, --i);
> +
> + if (common->free_storage_on_release)
> + kfree(common);
> +}
> +
> +
> +static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
> +{
> + struct fsg_dev *fsg = fsg_from_func(f);
> + struct fsg_common *common = fsg->common;
> + int i;
> +
> + DBG(fsg, "unbind\n");
> +
> + if (fsg->common->fsg == fsg) {
> + fsg->common->new_fsg = NULL;
> + fsg->common->shutdown = true;
> + raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
> + wait_event(common->fsg_wait, common->fsg != fsg);
> + }
> +
> + for (i = 0; i < ums_count; i++)
> + close(ums[i].fd);
> +
> + usb_free_all_descriptors(&fsg->function);
> +
> + ums_files = NULL;
> +}
> +
> +static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
> +{
> + struct fsg_dev *fsg = fsg_from_func(f);
> + struct usb_gadget *gadget = c->cdev->gadget;
> + int i = -EINVAL;
> + struct usb_ep *ep;
> + struct usb_descriptor_header **hs_function = NULL;
> + struct fsg_common *common = fsg->common;
> +
> + if (!ums_files) {
> + struct f_ums_opts *opts = container_of(f->fi, struct f_ums_opts, func_inst);
> +
> + ums_files = opts->files;
> + }
> +
> + fsg->gadget = gadget;
> +
> + DBG(fsg, "bind\n");
> +
> + i = fsg_common_init(common, c->cdev);
> + if (i)
> + return i;
> +
> + thread_task = kthread_run(fsg_main_thread, common, "file-storage");
> + if (IS_ERR(thread_task))
> + return PTR_ERR(thread_task);
> +
> + /* New interface */
> + i = usb_interface_id(c, f);
> + if (i < 0)
> + return i;
> + fsg_intf_desc.bInterfaceNumber = i;
> + fsg->interface_number = i;
> +
> + /* Find all the endpoints we will use */
> + ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
> + if (!ep)
> + goto autoconf_fail;
> + ep->driver_data = common; /* claim the endpoint */
> + fsg->bulk_in = ep;
> +
> + ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
> + if (!ep)
> + goto autoconf_fail;
> + ep->driver_data = common; /* claim the endpoint */
> + fsg->bulk_out = ep;
> +
> + if (gadget_is_dualspeed(gadget)) {
> + /* Assume endpoint addresses are the same for both speeds */
> + fsg_hs_bulk_in_desc.bEndpointAddress =
> + fsg_fs_bulk_in_desc.bEndpointAddress;
> + fsg_hs_bulk_out_desc.bEndpointAddress =
> + fsg_fs_bulk_out_desc.bEndpointAddress;
> + hs_function = fsg_hs_function;
> + }
> +
> + /* Copy descriptors */
> + return usb_assign_descriptors(f, fsg_fs_function, hs_function, NULL);
> +
> +autoconf_fail:
> + ERROR(fsg, "unable to autoconfigure all endpoints\n");
> + return -ENOTSUPP;
> +}
> +
> +
> +/****************************** ADD FUNCTION ******************************/
> +
> +static struct usb_gadget_strings *fsg_strings_array[] = {
> + &fsg_stringtab,
> + NULL,
> +};
> +
> +static void fsg_free(struct usb_function *f)
> +{
> + struct fsg_dev *fsg;
> +
> + fsg = container_of(f, struct fsg_dev, function);
> +
> + kfree(fsg);
> +}
> +
> +static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
> +{
> + struct f_ums_opts *opts = fsg_opts_from_func_inst(fi);
> + struct fsg_common *common = opts->common;
> + struct fsg_dev *fsg;
> +
> + fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
> + if (!fsg)
> + return ERR_PTR(-ENOMEM);
> +
> + fsg->function.name = FSG_DRIVER_DESC;
> + fsg->function.strings = fsg_strings_array;
> + /* descriptors are per-instance copies */
> + fsg->function.bind = fsg_bind;
> + fsg->function.set_alt = fsg_set_alt;
> + fsg->function.setup = fsg_setup;
> + fsg->function.disable = fsg_disable;
> + fsg->function.unbind = fsg_unbind;
> + fsg->function.free_func = fsg_free;
> +
> + fsg->common = common;
> + common->fsg = fsg;
> +
> + return &fsg->function;
> +}
> +
> +static void fsg_free_instance(struct usb_function_instance *fi)
> +{
> + struct f_ums_opts *opts = fsg_opts_from_func_inst(fi);
> +
> + fsg_common_release(&opts->common->ref);
> +
> + kfree(opts);
> +}
> +
> +static struct usb_function_instance *fsg_alloc_inst(void)
> +{
> + struct f_ums_opts *opts;
> +
> + opts = kzalloc(sizeof(*opts), GFP_KERNEL);
> + if (!opts)
> + return ERR_PTR(-ENOMEM);
> +
> + opts->func_inst.free_func_inst = fsg_free_instance;
> +
> + opts->common = fsg_common_setup();
> + if (!opts->common) {
> + free(opts);
> + return ERR_PTR(-ENOMEM);
> + }
> +
> + return &opts->func_inst;
> +}
> +
> +DECLARE_USB_FUNCTION_INIT(ums, fsg_alloc_inst, fsg_alloc);
> +
> +#define STRING_MANUFACTURER_IDX 0
> +#define STRING_PRODUCT_IDX 1
> +#define STRING_DESCRIPTION_IDX 2
> +
> +static struct usb_string strings_dev[] = {
> + [STRING_MANUFACTURER_IDX].s = NULL,
> + [STRING_PRODUCT_IDX].s = NULL,
> + [STRING_DESCRIPTION_IDX].s = "USB Mass Storage",
> + { } /* end of list */
> +};
> +
> +static struct usb_function_instance *fi_fsg;
> +static struct usb_function *f_fsg;
> +
> +static struct usb_configuration config = {
> + .label = "USB Mass Storage",
> + .bConfigurationValue = 1,
> + .bmAttributes = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
> + .iConfiguration = 2,
> +};
> +
> +static int ums_driver_bind(struct usb_composite_dev *cdev)
> +{
> + struct usb_gadget *gadget = cdev->gadget;
> + int id;
> +
> + if (gadget->vendor_id && gadget->product_id) {
> + ums_dev_descriptor.idVendor = cpu_to_le16(gadget->vendor_id);
> + ums_dev_descriptor.idProduct = cpu_to_le16(gadget->product_id);
> + } else {
> + ums_dev_descriptor.idVendor = cpu_to_le16(FSG_VENDOR_ID);
> + ums_dev_descriptor.idProduct = cpu_to_le16(FSG_PRODUCT_ID);
> + }
> +
> + strings_dev[STRING_MANUFACTURER_IDX].s = gadget->manufacturer;
> + strings_dev[STRING_PRODUCT_IDX].s = gadget->productname;
> +
> + id = usb_string_id(cdev);
> + if (id < 0)
> + goto fail;
> +
> + strings_dev[STRING_MANUFACTURER_IDX].id = id;
> + ums_dev_descriptor.iManufacturer = id;
> +
> + id = usb_string_id(cdev);
> + if (id < 0)
> + goto fail;
> +
> + strings_dev[STRING_PRODUCT_IDX].id = id;
> + ums_dev_descriptor.iProduct = id;
> +
> + id = usb_add_config_only(cdev, &config);
> + if (id)
> + return id;
> +
> + fi_fsg = usb_get_function_instance("ums");
> + if (IS_ERR(fi_fsg)) {
> + id = PTR_ERR(fi_fsg);
> + goto fail;
> + }
> +
> + f_fsg = usb_get_function(fi_fsg);
> + if (IS_ERR(f_fsg)) {
> + id = PTR_ERR(f_fsg);
> + goto fail;
> + }
> +
> + id = usb_add_function(&config, f_fsg);
> + if (id)
> + goto fail;
> +
> + return 0;
> +fail:
> + return id;
> +}
> +
> +static int ums_driver_unbind(struct usb_composite_dev *cdev)
> +{
> + usb_put_function(f_fsg);
> + usb_put_function_instance(fi_fsg);
> +
> + return 0;
> +}
> +
> +static struct usb_composite_driver ums_driver = {
> + .name = "ums",
> + .dev = &ums_dev_descriptor,
> + .strings = fsg_strings_array,
> + .max_speed = USB_SPEED_HIGH,
> + .bind = ums_driver_bind,
> + .unbind = ums_driver_unbind,
> +};
> +
> +int usb_ums_register(struct f_ums_opts *opts)
> +{
> + int ret;
> +
> + if (ums_files)
> + return -EBUSY;
> +
> + ums_files = opts->files;
> +
> + ret = usb_composite_probe(&ums_driver);
> + if (ret)
> + goto out;
> +
> + while (poll())
> + ;
> +
> + usb_composite_unregister(&ums_driver);
> +out:
> + ums_files = NULL;
> +
> + return ret;
> +}
> diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
> new file mode 100644
> index 000000000000..88cd745063e4
> --- /dev/null
> +++ b/drivers/usb/gadget/storage_common.c
> @@ -0,0 +1,173 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +/*
> + * storage_common.c -- Common definitions for mass storage functionality
> + *
> + * Copyright (C) 2003-2008 Alan Stern
> + * Copyeight (C) 2009 Samsung Electronics
> + * Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
> + *
> + * Ported to u-boot:
> + * Andrzej Pietrasiewicz <andrzej.p@samsung.com>
> + *
> + * Code refactoring & cleanup:
> + * Łukasz Majewski <l.majewski@samsung.com>
> + */
> +
> +#include "storage_common.h"
> +
> +/*
> + * This file requires the following identifiers used in USB strings to
> + * be defined (each of type pointer to char):
> + * - fsg_string_manufacturer -- name of the manufacturer
> + * - fsg_string_product -- name of the product
> + * - fsg_string_serial -- product's serial
> + * - fsg_string_config -- name of the configuration
> + * - fsg_string_interface -- name of the interface
> + * The first four are only needed when FSG_DESCRIPTORS_DEVICE_STRINGS
> + * macro is defined prior to including this file.
> + */
> +
> +/* There is only one interface. */
> +
> +struct usb_interface_descriptor fsg_intf_desc = {
> + .bLength = sizeof fsg_intf_desc,
> + .bDescriptorType = USB_DT_INTERFACE,
> +
> + .bNumEndpoints = 2, /* Adjusted during fsg_bind() */
> + .bInterfaceClass = USB_CLASS_MASS_STORAGE,
> + .bInterfaceSubClass = USB_SC_SCSI, /* Adjusted during fsg_bind() */
> + .bInterfaceProtocol = USB_PR_BULK, /* Adjusted during fsg_bind() */
> + .iInterface = FSG_STRING_INTERFACE,
> +};
> +
> +/*
> + * Three full-speed endpoint descriptors: bulk-in, bulk-out, and
> + * interrupt-in.
> + */
> +
> +struct usb_endpoint_descriptor fsg_fs_bulk_in_desc = {
> + .bLength = USB_DT_ENDPOINT_SIZE,
> + .bDescriptorType = USB_DT_ENDPOINT,
> +
> + .bEndpointAddress = USB_DIR_IN,
> + .bmAttributes = USB_ENDPOINT_XFER_BULK,
> + /* wMaxPacketSize set by autoconfiguration */
> +};
> +
> +struct usb_endpoint_descriptor fsg_fs_bulk_out_desc = {
> + .bLength = USB_DT_ENDPOINT_SIZE,
> + .bDescriptorType = USB_DT_ENDPOINT,
> +
> + .bEndpointAddress = USB_DIR_OUT,
> + .bmAttributes = USB_ENDPOINT_XFER_BULK,
> + /* wMaxPacketSize set by autoconfiguration */
> +};
> +
> +struct usb_descriptor_header *fsg_fs_function[] = {
> + (struct usb_descriptor_header *) &fsg_intf_desc,
> + (struct usb_descriptor_header *) &fsg_fs_bulk_in_desc,
> + (struct usb_descriptor_header *) &fsg_fs_bulk_out_desc,
> + NULL,
> +};
> +
> +/*
> + * USB 2.0 devices need to expose both high speed and full speed
> + * descriptors, unless they only run at full speed.
> + *
> + * That means alternate endpoint descriptors (bigger packets)
> + * and a "device qualifier" ... plus more construction options
> + * for the configuration descriptor.
> + */
> +struct usb_endpoint_descriptor fsg_hs_bulk_in_desc = {
> + .bLength = USB_DT_ENDPOINT_SIZE,
> + .bDescriptorType = USB_DT_ENDPOINT,
> +
> + /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
> + .bmAttributes = USB_ENDPOINT_XFER_BULK,
> + .wMaxPacketSize = cpu_to_le16(512),
> +};
> +
> +struct usb_endpoint_descriptor fsg_hs_bulk_out_desc = {
> + .bLength = USB_DT_ENDPOINT_SIZE,
> + .bDescriptorType = USB_DT_ENDPOINT,
> +
> + /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
> + .bmAttributes = USB_ENDPOINT_XFER_BULK,
> + .wMaxPacketSize = cpu_to_le16(512),
> + .bInterval = 1, /* NAK every 1 uframe */
> +};
> +
> +struct usb_descriptor_header *fsg_hs_function[] = {
> + (struct usb_descriptor_header *) &fsg_intf_desc,
> + (struct usb_descriptor_header *) &fsg_hs_bulk_in_desc,
> + (struct usb_descriptor_header *) &fsg_hs_bulk_out_desc,
> + NULL,
> +};
> +
> +/* Maxpacket and other transfer characteristics vary by speed. */
> +struct usb_endpoint_descriptor *
> +fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
> + struct usb_endpoint_descriptor *hs)
> +{
> + if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
> + return hs;
> + return fs;
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/*
> + * If the next two routines are called while the gadget is registered,
> + * the caller must own fsg->filesem for writing.
> + */
> +
> +int fsg_lun_open(struct fsg_lun *curlun, unsigned int num_sectors,
> + const char *filename)
> +{
> + int ro;
> +
> + /* R/W if we can, R/O if we must */
> + ro = curlun->initially_ro;
> +
> + curlun->ro = ro;
> + curlun->file_length = num_sectors << 9;
> + curlun->num_sectors = num_sectors;
> + debug("open backing file: %s\n", filename);
> +
> + return 0;
> +}
> +
> +void fsg_lun_close(struct fsg_lun *curlun)
> +{
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +/*
> + * Sync the file data, don't bother with the metadata.
> + * This code was copied from fs/buffer.c:sys_fdatasync().
> + */
> +int fsg_lun_fsync_sub(struct fsg_lun *curlun)
> +{
> + return 0;
> +}
> +
> +void store_cdrom_address(u8 *dest, int msf, u32 addr)
> +{
> + if (msf) {
> + /* Convert to Minutes-Seconds-Frames */
> + addr >>= 2; /* Convert to 2048-byte frames */
> + addr += 2*75; /* Lead-in occupies 2 seconds */
> + dest[3] = addr % 75; /* Frames */
> + addr /= 75;
> + dest[2] = addr % 60; /* Seconds */
> + addr /= 60;
> + dest[1] = addr; /* Minutes */
> + dest[0] = 0; /* Reserved */
> + } else {
> + /* Absolute sector */
> + put_unaligned_be32(addr, dest);
> + }
> +}
> +
> +/*-------------------------------------------------------------------------*/
> diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
> new file mode 100644
> index 000000000000..ce07a7dac72c
> --- /dev/null
> +++ b/drivers/usb/gadget/storage_common.h
> @@ -0,0 +1,245 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#ifndef USB_STORAGE_COMMON_H
> +#define USB_STORAGE_COMMON_H
> +
> +#include <driver.h>
> +#include <usb/storage.h>
> +#include <asm/unaligned.h>
> +#include <usb/mass_storage.h>
> +
> +#ifndef DEBUG
> +#undef VERBOSE_DEBUG
> +#undef DUMP_MSGS
> +#endif /* !DEBUG */
> +
> +#define VLDBG(lun, fmt, args...) dev_vdbg(&(lun)->dev, fmt, ## args)
> +#define LDBG(lun, fmt, args...) dev_dbg (&(lun)->dev, fmt, ## args)
> +#define LERROR(lun, fmt, args...) dev_err (&(lun)->dev, fmt, ## args)
> +#define LWARN(lun, fmt, args...) dev_warn(&(lun)->dev, fmt, ## args)
> +#define LINFO(lun, fmt, args...) dev_info(&(lun)->dev, fmt, ## args)
> +
> +/*
> + * Keep those macros in sync with those in
> + * include/linux/usb/composite.h or else GCC will complain. If they
> + * are identical (the same names of arguments, white spaces in the
> + * same places) GCC will allow redefinition otherwise (even if some
> + * white space is removed or added) warning will be issued.
> + *
> + * Those macros are needed here because File Storage Gadget does not
> + * include the composite.h header. For composite gadgets those macros
> + * are redundant since composite.h is included any way.
> + *
> + * One could check whether those macros are already defined (which
> + * would indicate composite.h had been included) or not (which would
> + * indicate we were in FSG) but this is not done because a warning is
> + * desired if definitions here differ from the ones in composite.h.
> + *
> + * We want the definitions to match and be the same in File Storage
> + * Gadget as well as Mass Storage Function (and so composite gadgets
> + * using MSF). If someone changes them in composite.h it will produce
> + * a warning in this file when building MSF.
> + */
> +
> +#define DBG(d, fmt, args...) \
> + dev_dbg(&(d)->gadget->dev , fmt , ## args)
> +#define VDBG(d, fmt, args...) \
> + dev_vdbg(&(d)->gadget->dev , fmt , ## args)
> +#define ERROR(d, fmt, args...) \
> + dev_err(&(d)->gadget->dev , fmt , ## args)
> +#define WARNING(d, fmt, args...) \
> + dev_warn(&(d)->gadget->dev , fmt , ## args)
> +#define INFO(d, fmt, args...) \
> + dev_info(&(d)->gadget->dev , fmt , ## args)
> +
> +#ifdef DUMP_MSGS
> +
> +/* dump_msg(fsg, const char * label, const u8 * buf, unsigned length); */
> +# define dump_msg(fsg, label, buf, length) do { \
> + if (length < 512) { \
> + DBG(fsg, "%s, length %u:\n", label, length); \
> + print_hex_dump("", DUMP_PREFIX_OFFSET, \
> + 16, 1, buf, length, 0); \
> + } \
> +} while (0)
> +
> +# define dump_cdb(fsg) do { } while (0)
> +
> +#else
> +
> +# define dump_msg(fsg, /* const char * */ label, \
> + /* const u8 * */ buf, /* unsigned */ length) do { } while (0)
> +
> +# ifdef VERBOSE_DEBUG
> +
> +# define dump_cdb(fsg) \
> + print_hex_dump("SCSI CDB: ", DUMP_PREFIX_NONE, \
> + 16, 1, (fsg)->cmnd, (fsg)->cmnd_size, 0) \
> +
> +# else
> +
> +# define dump_cdb(fsg) do { } while (0)
> +
> +# endif /* VERBOSE_DEBUG */
> +
> +#endif /* DUMP_MSGS */
> +
> +/*
> + * Thanks to NetChip Technologies for donating this product ID.
> + *
> + * DO NOT REUSE THESE IDs with any other driver!! Ever!!
> + * Instead: allocate your own, using normal USB-IF procedures.
> + */
> +
> +#define FSG_VENDOR_ID 0x0525 /* NetChip */
> +#define FSG_PRODUCT_ID 0xa4a5 /* Linux-USB File-backed Storage Gadget */
> +
> +/* Length of a SCSI Command Data Block */
> +#define MAX_COMMAND_SIZE 16
> +
> +/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
> +#define SS_NO_SENSE 0
> +#define SS_COMMUNICATION_FAILURE 0x040800
> +#define SS_INVALID_COMMAND 0x052000
> +#define SS_INVALID_FIELD_IN_CDB 0x052400
> +#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE 0x052100
> +#define SS_LOGICAL_UNIT_NOT_SUPPORTED 0x052500
> +#define SS_MEDIUM_NOT_PRESENT 0x023a00
> +#define SS_MEDIUM_REMOVAL_PREVENTED 0x055302
> +#define SS_NOT_READY_TO_READY_TRANSITION 0x062800
> +#define SS_RESET_OCCURRED 0x062900
> +#define SS_SAVING_PARAMETERS_NOT_SUPPORTED 0x053900
> +#define SS_UNRECOVERED_READ_ERROR 0x031100
> +#define SS_WRITE_ERROR 0x030c02
> +#define SS_WRITE_PROTECTED 0x072700
> +
> +#define SK(x) ((u8) ((x) >> 16)) /* Sense Key byte, etc. */
> +#define ASC(x) ((u8) ((x) >> 8))
> +#define ASCQ(x) ((u8) (x))
> +
> +/*-------------------------------------------------------------------------*/
> +
> +struct fsg_lun {
> + loff_t file_length;
> + loff_t num_sectors;
> +
> + unsigned int initially_ro:1;
> + unsigned int ro:1;
> + unsigned int removable:1;
> + unsigned int cdrom:1;
> + unsigned int prevent_medium_removal:1;
> + unsigned int registered:1;
> + unsigned int info_valid:1;
> + unsigned int nofua:1;
> +
> + u32 sense_data;
> + u32 sense_data_info;
> + u32 unit_attention_data;
> +
> + struct device_d dev;
> +};
> +
> +#define fsg_lun_is_open(curlun) ((curlun)->filp != NULL)
> +
> +/* Big enough to hold our biggest descriptor */
> +#define EP0_BUFSIZE 256
> +#define DELAYED_STATUS (EP0_BUFSIZE + 999) /* An impossibly large value */
> +
> +/* Number of buffers we will use. 2 is enough for double-buffering */
> +#define FSG_NUM_BUFFERS 2
> +
> +/* Default size of buffer length. */
> +#define FSG_BUFLEN ((u32)131072)
> +
> +/* Maximal number of LUNs supported in mass storage function */
> +#define FSG_MAX_LUNS 8
> +
> +enum fsg_buffer_state {
> + BUF_STATE_EMPTY = 0,
> + BUF_STATE_FULL,
> + BUF_STATE_BUSY
> +};
> +
> +/*
> + * When FSG_BUFFHD_STATIC_BUFFER is defined when this file is included
> + * the fsg_buffhd structure's buf field will be an array of FSG_BUFLEN
> + * characters rather then a pointer to void.
> + */
> +
> +struct fsg_buffhd {
> + void *buf;
> + enum fsg_buffer_state state;
> + struct fsg_buffhd *next;
> +
> + /*
> + * The NetChip 2280 is faster, and handles some protocol faults
> + * better, if we don't submit any short bulk-out read requests.
> + * So we will record the intended request length here.
> + */
> + unsigned int bulk_out_intended_length;
> +
> + struct usb_request *inreq;
> + int inreq_busy;
> + struct usb_request *outreq;
> + int outreq_busy;
> +};
> +
> +enum fsg_state {
> + /* This one isn't used anywhere */
> + FSG_STATE_COMMAND_PHASE = -10,
> + FSG_STATE_DATA_PHASE,
> + FSG_STATE_STATUS_PHASE,
> +
> + FSG_STATE_IDLE = 0,
> + FSG_STATE_ABORT_BULK_OUT,
> + FSG_STATE_RESET,
> + FSG_STATE_INTERFACE_CHANGE,
> + FSG_STATE_CONFIG_CHANGE,
> + FSG_STATE_DISCONNECT,
> + FSG_STATE_EXIT,
> + FSG_STATE_TERMINATED
> +};
> +
> +enum data_direction {
> + DATA_DIR_UNKNOWN = 0,
> + DATA_DIR_FROM_HOST,
> + DATA_DIR_TO_HOST,
> + DATA_DIR_NONE
> +};
> +
> +/*-------------------------------------------------------------------------*/
> +
> +static inline u32 get_unaligned_be24(u8 *buf)
> +{
> + return 0xffffff & (u32) get_unaligned_be32(buf - 1);
> +}
> +
> +/*-------------------------------------------------------------------------*/
> +
> +enum {
> + FSG_STRING_INTERFACE
> +};
> +
> +/*-------------------------------------------------------------------------*/
> +
> +extern struct usb_interface_descriptor fsg_intf_desc;
> +
> +extern struct usb_endpoint_descriptor fsg_fs_bulk_in_desc;
> +extern struct usb_endpoint_descriptor fsg_fs_bulk_out_desc;
> +extern struct usb_descriptor_header *fsg_fs_function[];
> +
> +extern struct usb_endpoint_descriptor fsg_hs_bulk_in_desc;
> +extern struct usb_endpoint_descriptor fsg_hs_bulk_out_desc;
> +extern struct usb_descriptor_header *fsg_hs_function[];
> +
> +int fsg_lun_open(struct fsg_lun *curlun, unsigned int num_sectors,
> + const char *filename);
> +void fsg_lun_close(struct fsg_lun *curlun);
> +
> +struct usb_endpoint_descriptor *
> +fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
> + struct usb_endpoint_descriptor *hs);
> +int fsg_lun_fsync_sub(struct fsg_lun *curlun);
> +void store_cdrom_address(u8 *dest, int msf, u32 addr);
> +
> +#endif /* USB_STORAGE_COMMON_H */
> diff --git a/include/scsi.h b/include/scsi.h
> index e2397489ead9..7252b8ce3b62 100644
> --- a/include/scsi.h
> +++ b/include/scsi.h
> @@ -109,11 +109,14 @@
> #define SCSI_MED_REMOVL 0x1E /* Prevent/Allow medium Removal (O) */
> #define SCSI_READ6 0x08 /* Read 6-byte (MANDATORY) */
> #define SCSI_READ10 0x28 /* Read 10-byte (MANDATORY) */
> +#define SCSI_READ12 0xA8 /* Read 12-byte (O) */
> #define SCSI_RD_CAPAC 0x25 /* Read Capacity (MANDATORY) */
> +#define SCSI_RD_FMT_CAPAC 0x23
> #define SCSI_RD_DEFECT 0x37 /* Read Defect Data (O) */
> #define SCSI_READ_LONG 0x3E /* Read Long (O) */
> #define SCSI_REASS_BLK 0x07 /* Reassign Blocks (O) */
> #define SCSI_RCV_DIAG 0x1C /* Receive Diagnostic Results (O) */
> +#define SCSI_RESERVE 0x16
> #define SCSI_RELEASE 0x17 /* Release Unit (MANDATORY) */
> #define SCSI_REZERO 0x01 /* Rezero Unit (O) */
> #define SCSI_SRCH_DAT_E 0x31 /* Search Data Equal (O) */
> @@ -128,9 +131,12 @@
> #define SCSI_VERIFY 0x2F /* Verify (O) */
> #define SCSI_WRITE6 0x0A /* Write 6-Byte (MANDATORY) */
> #define SCSI_WRITE10 0x2A /* Write 10-Byte (MANDATORY) */
> +#define SCSI_WRITE12 0xAA /* Write 12-Byte (O) */
> #define SCSI_WRT_VERIFY 0x2E /* Write and Verify (O) */
> #define SCSI_WRITE_LONG 0x3F /* Write Long (O) */
> #define SCSI_WRITE_SAME 0x41 /* Write Same (O) */
> +#define SCSI_RD_TOC 0x43
> +#define SCSI_RD_HEADER 0x44
>
>
> /****************************************************************************
> @@ -165,4 +171,10 @@ void scsi_init(void);
> #define FALSE 0
> #endif
>
> +/*
> + * DEVICE TYPES
> + */
> +
> +#define TYPE_DISK 0x00
> +
> #endif /* _SCSI_H */
> diff --git a/include/usb/mass_storage.h b/include/usb/mass_storage.h
> new file mode 100644
> index 000000000000..084b3c8e8f31
> --- /dev/null
> +++ b/include/usb/mass_storage.h
> @@ -0,0 +1,28 @@
> +/* SPDX-License-Identifier: GPL-2.0+ */
> +/*
> + * Copyright (C) 2011 Samsung Electrnoics
> + * Lukasz Majewski <l.majewski@samsung.com>
> + */
> +
> +#ifndef __USB_MASS_STORAGE_H__
> +#define __USB_MASS_STORAGE_H__
> +
> +#include <usb/composite.h>
> +
> +/* Wait at maximum 60 seconds for cable connection */
> +#define UMS_CABLE_READY_TIMEOUT 60
> +
> +struct fsg_common;
> +
> +struct f_ums_opts {
> + struct usb_function_instance func_inst;
> + struct fsg_common *common;
> + struct file_list *files;
> + unsigned int num_sectors;
> + int fd;
> + char name[16];
> +};
> +
> +int usb_ums_register(struct f_ums_opts *);
> +
> +#endif /* __USB_MASS_STORAGE_H__ */
> diff --git a/include/usb/storage.h b/include/usb/storage.h
> new file mode 100644
> index 000000000000..e0240f864548
> --- /dev/null
> +++ b/include/usb/storage.h
> @@ -0,0 +1,87 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#ifndef __LINUX_USB_STORAGE_H
> +#define __LINUX_USB_STORAGE_H
> +
> +/*
> + * linux/usb/storage.h
> + *
> + * Copyright Matthew Wilcox for Intel Corp, 2010
> + *
> + * This file contains definitions taken from the
> + * USB Mass Storage Class Specification Overview
> + *
> + * Distributed under the terms of the GNU GPL, version two.
> + */
> +
> +/* Storage subclass codes */
> +
> +#define USB_SC_RBC 0x01 /* Typically, flash devices */
> +#define USB_SC_8020 0x02 /* CD-ROM */
> +#define USB_SC_QIC 0x03 /* QIC-157 Tapes */
> +#define USB_SC_UFI 0x04 /* Floppy */
> +#define USB_SC_8070 0x05 /* Removable media */
> +#define USB_SC_SCSI 0x06 /* Transparent */
> +#define USB_SC_LOCKABLE 0x07 /* Password-protected */
> +
> +#define USB_SC_ISD200 0xf0 /* ISD200 ATA */
> +#define USB_SC_CYP_ATACB 0xf1 /* Cypress ATACB */
> +#define USB_SC_DEVICE 0xff /* Use device's value */
> +
> +/* Storage protocol codes */
> +
> +#define USB_PR_CBI 0x00 /* Control/Bulk/Interrupt */
> +#define USB_PR_CB 0x01 /* Control/Bulk w/o interrupt */
> +#define USB_PR_BULK 0x50 /* bulk only */
> +#define USB_PR_UAS 0x62 /* USB Attached SCSI */
> +
> +#define USB_PR_USBAT 0x80 /* SCM-ATAPI bridge */
> +#define USB_PR_EUSB_SDDR09 0x81 /* SCM-SCSI bridge for SDDR-09 */
> +#define USB_PR_SDDR55 0x82 /* SDDR-55 (made up) */
> +#define USB_PR_DPCM_USB 0xf0 /* Combination CB/SDDR09 */
> +#define USB_PR_FREECOM 0xf1 /* Freecom */
> +#define USB_PR_DATAFAB 0xf2 /* Datafab chipsets */
> +#define USB_PR_JUMPSHOT 0xf3 /* Lexar Jumpshot */
> +#define USB_PR_ALAUDA 0xf4 /* Alauda chipsets */
> +#define USB_PR_KARMA 0xf5 /* Rio Karma */
> +
> +#define USB_PR_DEVICE 0xff /* Use device's value */
> +
> +/*
> + * Bulk only data structures
> + */
> +
> +/* command block wrapper */
> +struct bulk_cb_wrap {
> + __le32 Signature; /* contains 'USBC' */
> + __u32 Tag; /* unique per command id */
> + __le32 DataTransferLength; /* size of data */
> + __u8 Flags; /* direction in bit 0 */
> + __u8 Lun; /* LUN normally 0 */
> + __u8 Length; /* length of the CDB */
> + __u8 CDB[16]; /* max command */
> +};
> +
> +#define US_BULK_CB_WRAP_LEN 31
> +#define US_BULK_CB_SIGN 0x43425355 /* spells out 'USBC' */
> +#define US_BULK_FLAG_IN (1 << 7)
> +#define US_BULK_FLAG_OUT 0
> +
> +/* command status wrapper */
> +struct bulk_cs_wrap {
> + __le32 Signature; /* contains 'USBS' */
> + __u32 Tag; /* same as original command */
> + __le32 Residue; /* amount not transferred */
> + __u8 Status; /* see below */
> +};
> +
> +#define US_BULK_CS_WRAP_LEN 13
> +#define US_BULK_CS_SIGN 0x53425355 /* spells out 'USBS' */
> +#define US_BULK_STAT_OK 0
> +#define US_BULK_STAT_FAIL 1
> +#define US_BULK_STAT_PHASE 2
> +
> +/* bulk-only class specific requests */
> +#define US_BULK_RESET_REQUEST 0xff
> +#define US_BULK_GET_MAX_LUN 0xfe
> +
> +#endif
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-17 11:48 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-15 10:27 [PATCH 0/3] usbgadget: add support for blocking USB mass storage gadget Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 1/3] include: <linux/barebox-wrapper.h>: remove kthread 'replacements' Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 2/3] console: unconditionally run poller_call in ctrlc() Ahmad Fatoum
2021-02-15 10:27 ` [PATCH 3/3] usbgadget: add support for USB mass storage gadget Ahmad Fatoum
2021-02-17 11:48 ` Ahmad Fatoum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox