usb: kbd: Prevent out of bound access
[platform/kernel/u-boot.git] / common / usb_storage.c
1 /*
2  * Most of this source has been derived from the Linux USB
3  * project:
4  *   (c) 1999-2002 Matthew Dharm (mdharm-usb@one-eyed-alien.net)
5  *   (c) 2000 David L. Brown, Jr. (usb-storage@davidb.org)
6  *   (c) 1999 Michael Gee (michael@linuxspecific.com)
7  *   (c) 2000 Yggdrasil Computing, Inc.
8  *
9  *
10  * Adapted for U-Boot:
11  *   (C) Copyright 2001 Denis Peter, MPL AG Switzerland
12  * Driver model conversion:
13  *   (C) Copyright 2015 Google, Inc
14  *
15  * For BBB support (C) Copyright 2003
16  * Gary Jennejohn, DENX Software Engineering <garyj@denx.de>
17  *
18  * BBB support based on /sys/dev/usb/umass.c from
19  * FreeBSD.
20  *
21  * SPDX-License-Identifier:     GPL-2.0+
22  */
23
24 /* Note:
25  * Currently only the CBI transport protocoll has been implemented, and it
26  * is only tested with a TEAC USB Floppy. Other Massstorages with CBI or CB
27  * transport protocoll may work as well.
28  */
29 /*
30  * New Note:
31  * Support for USB Mass Storage Devices (BBB) has been added. It has
32  * only been tested with USB memory sticks.
33  */
34
35
36 #include <common.h>
37 #include <command.h>
38 #include <dm.h>
39 #include <errno.h>
40 #include <inttypes.h>
41 #include <mapmem.h>
42 #include <memalign.h>
43 #include <asm/byteorder.h>
44 #include <asm/processor.h>
45 #include <dm/device-internal.h>
46
47 #include <part.h>
48 #include <usb.h>
49
50 #undef BBB_COMDAT_TRACE
51 #undef BBB_XPORT_TRACE
52
53 #include <scsi.h>
54 /* direction table -- this indicates the direction of the data
55  * transfer for each command code -- a 1 indicates input
56  */
57 static const unsigned char us_direction[256/8] = {
58         0x28, 0x81, 0x14, 0x14, 0x20, 0x01, 0x90, 0x77,
59         0x0C, 0x20, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
60         0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01,
61         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
62 };
63 #define US_DIRECTION(x) ((us_direction[x>>3] >> (x & 7)) & 1)
64
65 static ccb usb_ccb __attribute__((aligned(ARCH_DMA_MINALIGN)));
66 static __u32 CBWTag;
67
68 static int usb_max_devs; /* number of highest available usb device */
69
70 static block_dev_desc_t usb_dev_desc[USB_MAX_STOR_DEV];
71
72 struct us_data;
73 typedef int (*trans_cmnd)(ccb *cb, struct us_data *data);
74 typedef int (*trans_reset)(struct us_data *data);
75
76 struct us_data {
77         struct usb_device *pusb_dev;     /* this usb_device */
78
79         unsigned int    flags;                  /* from filter initially */
80 #       define USB_READY        (1 << 0)
81         unsigned char   ifnum;                  /* interface number */
82         unsigned char   ep_in;                  /* in endpoint */
83         unsigned char   ep_out;                 /* out ....... */
84         unsigned char   ep_int;                 /* interrupt . */
85         unsigned char   subclass;               /* as in overview */
86         unsigned char   protocol;               /* .............. */
87         unsigned char   attention_done;         /* force attn on first cmd */
88         unsigned short  ip_data;                /* interrupt data */
89         int             action;                 /* what to do */
90         int             ip_wanted;              /* needed */
91         int             *irq_handle;            /* for USB int requests */
92         unsigned int    irqpipe;                /* pipe for release_irq */
93         unsigned char   irqmaxp;                /* max packed for irq Pipe */
94         unsigned char   irqinterval;            /* Intervall for IRQ Pipe */
95         ccb             *srb;                   /* current srb */
96         trans_reset     transport_reset;        /* reset routine */
97         trans_cmnd      transport;              /* transport routine */
98 };
99
100 #ifdef CONFIG_USB_EHCI
101 /*
102  * The U-Boot EHCI driver can handle any transfer length as long as there is
103  * enough free heap space left, but the SCSI READ(10) and WRITE(10) commands are
104  * limited to 65535 blocks.
105  */
106 #define USB_MAX_XFER_BLK        65535
107 #else
108 #define USB_MAX_XFER_BLK        20
109 #endif
110
111 static struct us_data usb_stor[USB_MAX_STOR_DEV];
112
113 #define USB_STOR_TRANSPORT_GOOD    0
114 #define USB_STOR_TRANSPORT_FAILED -1
115 #define USB_STOR_TRANSPORT_ERROR  -2
116
117 int usb_stor_get_info(struct usb_device *dev, struct us_data *us,
118                       block_dev_desc_t *dev_desc);
119 int usb_storage_probe(struct usb_device *dev, unsigned int ifnum,
120                       struct us_data *ss);
121 static unsigned long usb_stor_read(block_dev_desc_t *block_dev, lbaint_t blknr,
122                                    lbaint_t blkcnt, void *buffer);
123 static unsigned long usb_stor_write(block_dev_desc_t *block_dev, lbaint_t blknr,
124                                     lbaint_t blkcnt, const void *buffer);
125 void uhci_show_temp_int_td(void);
126
127 #ifdef CONFIG_PARTITIONS
128 block_dev_desc_t *usb_stor_get_dev(int index)
129 {
130         return (index < usb_max_devs) ? &usb_dev_desc[index] : NULL;
131 }
132 #endif
133
134 static void usb_show_progress(void)
135 {
136         debug(".");
137 }
138
139 /*******************************************************************************
140  * show info on storage devices; 'usb start/init' must be invoked earlier
141  * as we only retrieve structures populated during devices initialization
142  */
143 int usb_stor_info(void)
144 {
145         int i;
146
147         if (usb_max_devs > 0) {
148                 for (i = 0; i < usb_max_devs; i++) {
149                         printf("  Device %d: ", i);
150                         dev_print(&usb_dev_desc[i]);
151                 }
152                 return 0;
153         }
154
155         printf("No storage devices, perhaps not 'usb start'ed..?\n");
156         return 1;
157 }
158
159 static unsigned int usb_get_max_lun(struct us_data *us)
160 {
161         int len;
162         ALLOC_CACHE_ALIGN_BUFFER(unsigned char, result, 1);
163         len = usb_control_msg(us->pusb_dev,
164                               usb_rcvctrlpipe(us->pusb_dev, 0),
165                               US_BBB_GET_MAX_LUN,
166                               USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
167                               0, us->ifnum,
168                               result, sizeof(char),
169                               USB_CNTL_TIMEOUT * 5);
170         debug("Get Max LUN -> len = %i, result = %i\n", len, (int) *result);
171         return (len > 0) ? *result : 0;
172 }
173
174 static int usb_stor_probe_device(struct usb_device *dev)
175 {
176         if (dev == NULL)
177                 return -ENOENT; /* no more devices available */
178
179         debug("\n\nProbing for storage\n");
180         if (usb_storage_probe(dev, 0, &usb_stor[usb_max_devs])) {
181                 /* OK, it's a storage device.  Iterate over its LUNs
182                         * and populate `usb_dev_desc'.
183                         */
184                 int lun, max_lun, start = usb_max_devs;
185
186                 max_lun = usb_get_max_lun(&usb_stor[usb_max_devs]);
187                 for (lun = 0;
188                         lun <= max_lun && usb_max_devs < USB_MAX_STOR_DEV;
189                         lun++) {
190                         struct block_dev_desc *blkdev;
191
192                         blkdev = &usb_dev_desc[usb_max_devs];
193                         memset(blkdev, '\0', sizeof(block_dev_desc_t));
194                         blkdev->if_type = IF_TYPE_USB;
195                         blkdev->dev = usb_max_devs;
196                         blkdev->part_type = PART_TYPE_UNKNOWN;
197                         blkdev->target = 0xff;
198                         blkdev->type = DEV_TYPE_UNKNOWN;
199                         blkdev->block_read = usb_stor_read;
200                         blkdev->block_write = usb_stor_write;
201                         blkdev->lun = lun;
202                         blkdev->priv = dev;
203
204                         if (usb_stor_get_info(dev, &usb_stor[start],
205                                               &usb_dev_desc[usb_max_devs]) ==
206                                               1) {
207                                 usb_max_devs++;
208                                 debug("%s: Found device %p\n", __func__, dev);
209                         }
210                 }
211         }
212
213         /* if storage device */
214         if (usb_max_devs == USB_MAX_STOR_DEV) {
215                 printf("max USB Storage Device reached: %d stopping\n",
216                        usb_max_devs);
217                 return -ENOSPC;
218         }
219
220         return 0;
221 }
222
223 void usb_stor_reset(void)
224 {
225         usb_max_devs = 0;
226 }
227
228 #ifndef CONFIG_DM_USB
229 /*******************************************************************************
230  * scan the usb and reports device info
231  * to the user if mode = 1
232  * returns current device or -1 if no
233  */
234 int usb_stor_scan(int mode)
235 {
236         unsigned char i;
237
238         if (mode == 1)
239                 printf("       scanning usb for storage devices... ");
240
241         usb_disable_asynch(1); /* asynch transfer not allowed */
242
243         usb_stor_reset();
244         for (i = 0; i < USB_MAX_DEVICE; i++) {
245                 struct usb_device *dev;
246
247                 dev = usb_get_dev_index(i); /* get device */
248                 debug("i=%d\n", i);
249                 if (usb_stor_probe_device(dev))
250                         break;
251         } /* for */
252
253         usb_disable_asynch(0); /* asynch transfer allowed */
254         printf("%d Storage Device(s) found\n", usb_max_devs);
255         if (usb_max_devs > 0)
256                 return 0;
257         return -1;
258 }
259 #endif
260
261 static int usb_stor_irq(struct usb_device *dev)
262 {
263         struct us_data *us;
264         us = (struct us_data *)dev->privptr;
265
266         if (us->ip_wanted)
267                 us->ip_wanted = 0;
268         return 0;
269 }
270
271
272 #ifdef  DEBUG
273
274 static void usb_show_srb(ccb *pccb)
275 {
276         int i;
277         printf("SRB: len %d datalen 0x%lX\n ", pccb->cmdlen, pccb->datalen);
278         for (i = 0; i < 12; i++)
279                 printf("%02X ", pccb->cmd[i]);
280         printf("\n");
281 }
282
283 static void display_int_status(unsigned long tmp)
284 {
285         printf("Status: %s %s %s %s %s %s %s\n",
286                 (tmp & USB_ST_ACTIVE) ? "Active" : "",
287                 (tmp & USB_ST_STALLED) ? "Stalled" : "",
288                 (tmp & USB_ST_BUF_ERR) ? "Buffer Error" : "",
289                 (tmp & USB_ST_BABBLE_DET) ? "Babble Det" : "",
290                 (tmp & USB_ST_NAK_REC) ? "NAKed" : "",
291                 (tmp & USB_ST_CRC_ERR) ? "CRC Error" : "",
292                 (tmp & USB_ST_BIT_ERR) ? "Bitstuff Error" : "");
293 }
294 #endif
295 /***********************************************************************
296  * Data transfer routines
297  ***********************************************************************/
298
299 static int us_one_transfer(struct us_data *us, int pipe, char *buf, int length)
300 {
301         int max_size;
302         int this_xfer;
303         int result;
304         int partial;
305         int maxtry;
306         int stat;
307
308         /* determine the maximum packet size for these transfers */
309         max_size = usb_maxpacket(us->pusb_dev, pipe) * 16;
310
311         /* while we have data left to transfer */
312         while (length) {
313
314                 /* calculate how long this will be -- maximum or a remainder */
315                 this_xfer = length > max_size ? max_size : length;
316                 length -= this_xfer;
317
318                 /* setup the retry counter */
319                 maxtry = 10;
320
321                 /* set up the transfer loop */
322                 do {
323                         /* transfer the data */
324                         debug("Bulk xfer 0x%lx(%d) try #%d\n",
325                               (ulong)map_to_sysmem(buf), this_xfer,
326                               11 - maxtry);
327                         result = usb_bulk_msg(us->pusb_dev, pipe, buf,
328                                               this_xfer, &partial,
329                                               USB_CNTL_TIMEOUT * 5);
330                         debug("bulk_msg returned %d xferred %d/%d\n",
331                               result, partial, this_xfer);
332                         if (us->pusb_dev->status != 0) {
333                                 /* if we stall, we need to clear it before
334                                  * we go on
335                                  */
336 #ifdef DEBUG
337                                 display_int_status(us->pusb_dev->status);
338 #endif
339                                 if (us->pusb_dev->status & USB_ST_STALLED) {
340                                         debug("stalled ->clearing endpoint" \
341                                               "halt for pipe 0x%x\n", pipe);
342                                         stat = us->pusb_dev->status;
343                                         usb_clear_halt(us->pusb_dev, pipe);
344                                         us->pusb_dev->status = stat;
345                                         if (this_xfer == partial) {
346                                                 debug("bulk transferred" \
347                                                       "with error %lX," \
348                                                       " but data ok\n",
349                                                       us->pusb_dev->status);
350                                                 return 0;
351                                         }
352                                         else
353                                                 return result;
354                                 }
355                                 if (us->pusb_dev->status & USB_ST_NAK_REC) {
356                                         debug("Device NAKed bulk_msg\n");
357                                         return result;
358                                 }
359                                 debug("bulk transferred with error");
360                                 if (this_xfer == partial) {
361                                         debug(" %ld, but data ok\n",
362                                               us->pusb_dev->status);
363                                         return 0;
364                                 }
365                                 /* if our try counter reaches 0, bail out */
366                                         debug(" %ld, data %d\n",
367                                               us->pusb_dev->status, partial);
368                                 if (!maxtry--)
369                                                 return result;
370                         }
371                         /* update to show what data was transferred */
372                         this_xfer -= partial;
373                         buf += partial;
374                         /* continue until this transfer is done */
375                 } while (this_xfer);
376         }
377
378         /* if we get here, we're done and successful */
379         return 0;
380 }
381
382 static int usb_stor_BBB_reset(struct us_data *us)
383 {
384         int result;
385         unsigned int pipe;
386
387         /*
388          * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
389          *
390          * For Reset Recovery the host shall issue in the following order:
391          * a) a Bulk-Only Mass Storage Reset
392          * b) a Clear Feature HALT to the Bulk-In endpoint
393          * c) a Clear Feature HALT to the Bulk-Out endpoint
394          *
395          * This is done in 3 steps.
396          *
397          * If the reset doesn't succeed, the device should be port reset.
398          *
399          * This comment stolen from FreeBSD's /sys/dev/usb/umass.c.
400          */
401         debug("BBB_reset\n");
402         result = usb_control_msg(us->pusb_dev, usb_sndctrlpipe(us->pusb_dev, 0),
403                                  US_BBB_RESET,
404                                  USB_TYPE_CLASS | USB_RECIP_INTERFACE,
405                                  0, us->ifnum, NULL, 0, USB_CNTL_TIMEOUT * 5);
406
407         if ((result < 0) && (us->pusb_dev->status & USB_ST_STALLED)) {
408                 debug("RESET:stall\n");
409                 return -1;
410         }
411
412         /* long wait for reset */
413         mdelay(150);
414         debug("BBB_reset result %d: status %lX reset\n",
415               result, us->pusb_dev->status);
416         pipe = usb_rcvbulkpipe(us->pusb_dev, us->ep_in);
417         result = usb_clear_halt(us->pusb_dev, pipe);
418         /* long wait for reset */
419         mdelay(150);
420         debug("BBB_reset result %d: status %lX clearing IN endpoint\n",
421               result, us->pusb_dev->status);
422         /* long wait for reset */
423         pipe = usb_sndbulkpipe(us->pusb_dev, us->ep_out);
424         result = usb_clear_halt(us->pusb_dev, pipe);
425         mdelay(150);
426         debug("BBB_reset result %d: status %lX clearing OUT endpoint\n",
427               result, us->pusb_dev->status);
428         debug("BBB_reset done\n");
429         return 0;
430 }
431
432 /* FIXME: this reset function doesn't really reset the port, and it
433  * should. Actually it should probably do what it's doing here, and
434  * reset the port physically
435  */
436 static int usb_stor_CB_reset(struct us_data *us)
437 {
438         unsigned char cmd[12];
439         int result;
440
441         debug("CB_reset\n");
442         memset(cmd, 0xff, sizeof(cmd));
443         cmd[0] = SCSI_SEND_DIAG;
444         cmd[1] = 4;
445         result = usb_control_msg(us->pusb_dev, usb_sndctrlpipe(us->pusb_dev, 0),
446                                  US_CBI_ADSC,
447                                  USB_TYPE_CLASS | USB_RECIP_INTERFACE,
448                                  0, us->ifnum, cmd, sizeof(cmd),
449                                  USB_CNTL_TIMEOUT * 5);
450
451         /* long wait for reset */
452         mdelay(1500);
453         debug("CB_reset result %d: status %lX clearing endpoint halt\n",
454               result, us->pusb_dev->status);
455         usb_clear_halt(us->pusb_dev, usb_rcvbulkpipe(us->pusb_dev, us->ep_in));
456         usb_clear_halt(us->pusb_dev, usb_rcvbulkpipe(us->pusb_dev, us->ep_out));
457
458         debug("CB_reset done\n");
459         return 0;
460 }
461
462 /*
463  * Set up the command for a BBB device. Note that the actual SCSI
464  * command is copied into cbw.CBWCDB.
465  */
466 static int usb_stor_BBB_comdat(ccb *srb, struct us_data *us)
467 {
468         int result;
469         int actlen;
470         int dir_in;
471         unsigned int pipe;
472         ALLOC_CACHE_ALIGN_BUFFER(struct umass_bbb_cbw, cbw, 1);
473
474         dir_in = US_DIRECTION(srb->cmd[0]);
475
476 #ifdef BBB_COMDAT_TRACE
477         printf("dir %d lun %d cmdlen %d cmd %p datalen %lu pdata %p\n",
478                 dir_in, srb->lun, srb->cmdlen, srb->cmd, srb->datalen,
479                 srb->pdata);
480         if (srb->cmdlen) {
481                 for (result = 0; result < srb->cmdlen; result++)
482                         printf("cmd[%d] %#x ", result, srb->cmd[result]);
483                 printf("\n");
484         }
485 #endif
486         /* sanity checks */
487         if (!(srb->cmdlen <= CBWCDBLENGTH)) {
488                 debug("usb_stor_BBB_comdat:cmdlen too large\n");
489                 return -1;
490         }
491
492         /* always OUT to the ep */
493         pipe = usb_sndbulkpipe(us->pusb_dev, us->ep_out);
494
495         cbw->dCBWSignature = cpu_to_le32(CBWSIGNATURE);
496         cbw->dCBWTag = cpu_to_le32(CBWTag++);
497         cbw->dCBWDataTransferLength = cpu_to_le32(srb->datalen);
498         cbw->bCBWFlags = (dir_in ? CBWFLAGS_IN : CBWFLAGS_OUT);
499         cbw->bCBWLUN = srb->lun;
500         cbw->bCDBLength = srb->cmdlen;
501         /* copy the command data into the CBW command data buffer */
502         /* DST SRC LEN!!! */
503
504         memcpy(cbw->CBWCDB, srb->cmd, srb->cmdlen);
505         result = usb_bulk_msg(us->pusb_dev, pipe, cbw, UMASS_BBB_CBW_SIZE,
506                               &actlen, USB_CNTL_TIMEOUT * 5);
507         if (result < 0)
508                 debug("usb_stor_BBB_comdat:usb_bulk_msg error\n");
509         return result;
510 }
511
512 /* FIXME: we also need a CBI_command which sets up the completion
513  * interrupt, and waits for it
514  */
515 static int usb_stor_CB_comdat(ccb *srb, struct us_data *us)
516 {
517         int result = 0;
518         int dir_in, retry;
519         unsigned int pipe;
520         unsigned long status;
521
522         retry = 5;
523         dir_in = US_DIRECTION(srb->cmd[0]);
524
525         if (dir_in)
526                 pipe = usb_rcvbulkpipe(us->pusb_dev, us->ep_in);
527         else
528                 pipe = usb_sndbulkpipe(us->pusb_dev, us->ep_out);
529
530         while (retry--) {
531                 debug("CBI gets a command: Try %d\n", 5 - retry);
532 #ifdef DEBUG
533                 usb_show_srb(srb);
534 #endif
535                 /* let's send the command via the control pipe */
536                 result = usb_control_msg(us->pusb_dev,
537                                          usb_sndctrlpipe(us->pusb_dev , 0),
538                                          US_CBI_ADSC,
539                                          USB_TYPE_CLASS | USB_RECIP_INTERFACE,
540                                          0, us->ifnum,
541                                          srb->cmd, srb->cmdlen,
542                                          USB_CNTL_TIMEOUT * 5);
543                 debug("CB_transport: control msg returned %d, status %lX\n",
544                       result, us->pusb_dev->status);
545                 /* check the return code for the command */
546                 if (result < 0) {
547                         if (us->pusb_dev->status & USB_ST_STALLED) {
548                                 status = us->pusb_dev->status;
549                                 debug(" stall during command found," \
550                                       " clear pipe\n");
551                                 usb_clear_halt(us->pusb_dev,
552                                               usb_sndctrlpipe(us->pusb_dev, 0));
553                                 us->pusb_dev->status = status;
554                         }
555                         debug(" error during command %02X" \
556                               " Stat = %lX\n", srb->cmd[0],
557                               us->pusb_dev->status);
558                         return result;
559                 }
560                 /* transfer the data payload for this command, if one exists*/
561
562                 debug("CB_transport: control msg returned %d," \
563                       " direction is %s to go 0x%lx\n", result,
564                       dir_in ? "IN" : "OUT", srb->datalen);
565                 if (srb->datalen) {
566                         result = us_one_transfer(us, pipe, (char *)srb->pdata,
567                                                  srb->datalen);
568                         debug("CBI attempted to transfer data," \
569                               " result is %d status %lX, len %d\n",
570                               result, us->pusb_dev->status,
571                                 us->pusb_dev->act_len);
572                         if (!(us->pusb_dev->status & USB_ST_NAK_REC))
573                                 break;
574                 } /* if (srb->datalen) */
575                 else
576                         break;
577         }
578         /* return result */
579
580         return result;
581 }
582
583
584 static int usb_stor_CBI_get_status(ccb *srb, struct us_data *us)
585 {
586         int timeout;
587
588         us->ip_wanted = 1;
589         submit_int_msg(us->pusb_dev, us->irqpipe,
590                         (void *) &us->ip_data, us->irqmaxp, us->irqinterval);
591         timeout = 1000;
592         while (timeout--) {
593                 if (us->ip_wanted == 0)
594                         break;
595                 mdelay(10);
596         }
597         if (us->ip_wanted) {
598                 printf("        Did not get interrupt on CBI\n");
599                 us->ip_wanted = 0;
600                 return USB_STOR_TRANSPORT_ERROR;
601         }
602         debug("Got interrupt data 0x%x, transfered %d status 0x%lX\n",
603               us->ip_data, us->pusb_dev->irq_act_len,
604               us->pusb_dev->irq_status);
605         /* UFI gives us ASC and ASCQ, like a request sense */
606         if (us->subclass == US_SC_UFI) {
607                 if (srb->cmd[0] == SCSI_REQ_SENSE ||
608                     srb->cmd[0] == SCSI_INQUIRY)
609                         return USB_STOR_TRANSPORT_GOOD; /* Good */
610                 else if (us->ip_data)
611                         return USB_STOR_TRANSPORT_FAILED;
612                 else
613                         return USB_STOR_TRANSPORT_GOOD;
614         }
615         /* otherwise, we interpret the data normally */
616         switch (us->ip_data) {
617         case 0x0001:
618                 return USB_STOR_TRANSPORT_GOOD;
619         case 0x0002:
620                 return USB_STOR_TRANSPORT_FAILED;
621         default:
622                 return USB_STOR_TRANSPORT_ERROR;
623         }                       /* switch */
624         return USB_STOR_TRANSPORT_ERROR;
625 }
626
627 #define USB_TRANSPORT_UNKNOWN_RETRY 5
628 #define USB_TRANSPORT_NOT_READY_RETRY 10
629
630 /* clear a stall on an endpoint - special for BBB devices */
631 static int usb_stor_BBB_clear_endpt_stall(struct us_data *us, __u8 endpt)
632 {
633         int result;
634
635         /* ENDPOINT_HALT = 0, so set value to 0 */
636         result = usb_control_msg(us->pusb_dev, usb_sndctrlpipe(us->pusb_dev, 0),
637                                 USB_REQ_CLEAR_FEATURE, USB_RECIP_ENDPOINT,
638                                 0, endpt, NULL, 0, USB_CNTL_TIMEOUT * 5);
639         return result;
640 }
641
642 static int usb_stor_BBB_transport(ccb *srb, struct us_data *us)
643 {
644         int result, retry;
645         int dir_in;
646         int actlen, data_actlen;
647         unsigned int pipe, pipein, pipeout;
648         ALLOC_CACHE_ALIGN_BUFFER(struct umass_bbb_csw, csw, 1);
649 #ifdef BBB_XPORT_TRACE
650         unsigned char *ptr;
651         int index;
652 #endif
653
654         dir_in = US_DIRECTION(srb->cmd[0]);
655
656         /* COMMAND phase */
657         debug("COMMAND phase\n");
658         result = usb_stor_BBB_comdat(srb, us);
659         if (result < 0) {
660                 debug("failed to send CBW status %ld\n",
661                       us->pusb_dev->status);
662                 usb_stor_BBB_reset(us);
663                 return USB_STOR_TRANSPORT_FAILED;
664         }
665         if (!(us->flags & USB_READY))
666                 mdelay(5);
667         pipein = usb_rcvbulkpipe(us->pusb_dev, us->ep_in);
668         pipeout = usb_sndbulkpipe(us->pusb_dev, us->ep_out);
669         /* DATA phase + error handling */
670         data_actlen = 0;
671         /* no data, go immediately to the STATUS phase */
672         if (srb->datalen == 0)
673                 goto st;
674         debug("DATA phase\n");
675         if (dir_in)
676                 pipe = pipein;
677         else
678                 pipe = pipeout;
679
680         result = usb_bulk_msg(us->pusb_dev, pipe, srb->pdata, srb->datalen,
681                               &data_actlen, USB_CNTL_TIMEOUT * 5);
682         /* special handling of STALL in DATA phase */
683         if ((result < 0) && (us->pusb_dev->status & USB_ST_STALLED)) {
684                 debug("DATA:stall\n");
685                 /* clear the STALL on the endpoint */
686                 result = usb_stor_BBB_clear_endpt_stall(us,
687                                         dir_in ? us->ep_in : us->ep_out);
688                 if (result >= 0)
689                         /* continue on to STATUS phase */
690                         goto st;
691         }
692         if (result < 0) {
693                 debug("usb_bulk_msg error status %ld\n",
694                       us->pusb_dev->status);
695                 usb_stor_BBB_reset(us);
696                 return USB_STOR_TRANSPORT_FAILED;
697         }
698 #ifdef BBB_XPORT_TRACE
699         for (index = 0; index < data_actlen; index++)
700                 printf("pdata[%d] %#x ", index, srb->pdata[index]);
701         printf("\n");
702 #endif
703         /* STATUS phase + error handling */
704 st:
705         retry = 0;
706 again:
707         debug("STATUS phase\n");
708         result = usb_bulk_msg(us->pusb_dev, pipein, csw, UMASS_BBB_CSW_SIZE,
709                                 &actlen, USB_CNTL_TIMEOUT*5);
710
711         /* special handling of STALL in STATUS phase */
712         if ((result < 0) && (retry < 1) &&
713             (us->pusb_dev->status & USB_ST_STALLED)) {
714                 debug("STATUS:stall\n");
715                 /* clear the STALL on the endpoint */
716                 result = usb_stor_BBB_clear_endpt_stall(us, us->ep_in);
717                 if (result >= 0 && (retry++ < 1))
718                         /* do a retry */
719                         goto again;
720         }
721         if (result < 0) {
722                 debug("usb_bulk_msg error status %ld\n",
723                       us->pusb_dev->status);
724                 usb_stor_BBB_reset(us);
725                 return USB_STOR_TRANSPORT_FAILED;
726         }
727 #ifdef BBB_XPORT_TRACE
728         ptr = (unsigned char *)csw;
729         for (index = 0; index < UMASS_BBB_CSW_SIZE; index++)
730                 printf("ptr[%d] %#x ", index, ptr[index]);
731         printf("\n");
732 #endif
733         /* misuse pipe to get the residue */
734         pipe = le32_to_cpu(csw->dCSWDataResidue);
735         if (pipe == 0 && srb->datalen != 0 && srb->datalen - data_actlen != 0)
736                 pipe = srb->datalen - data_actlen;
737         if (CSWSIGNATURE != le32_to_cpu(csw->dCSWSignature)) {
738                 debug("!CSWSIGNATURE\n");
739                 usb_stor_BBB_reset(us);
740                 return USB_STOR_TRANSPORT_FAILED;
741         } else if ((CBWTag - 1) != le32_to_cpu(csw->dCSWTag)) {
742                 debug("!Tag\n");
743                 usb_stor_BBB_reset(us);
744                 return USB_STOR_TRANSPORT_FAILED;
745         } else if (csw->bCSWStatus > CSWSTATUS_PHASE) {
746                 debug(">PHASE\n");
747                 usb_stor_BBB_reset(us);
748                 return USB_STOR_TRANSPORT_FAILED;
749         } else if (csw->bCSWStatus == CSWSTATUS_PHASE) {
750                 debug("=PHASE\n");
751                 usb_stor_BBB_reset(us);
752                 return USB_STOR_TRANSPORT_FAILED;
753         } else if (data_actlen > srb->datalen) {
754                 debug("transferred %dB instead of %ldB\n",
755                       data_actlen, srb->datalen);
756                 return USB_STOR_TRANSPORT_FAILED;
757         } else if (csw->bCSWStatus == CSWSTATUS_FAILED) {
758                 debug("FAILED\n");
759                 return USB_STOR_TRANSPORT_FAILED;
760         }
761
762         return result;
763 }
764
765 static int usb_stor_CB_transport(ccb *srb, struct us_data *us)
766 {
767         int result, status;
768         ccb *psrb;
769         ccb reqsrb;
770         int retry, notready;
771
772         psrb = &reqsrb;
773         status = USB_STOR_TRANSPORT_GOOD;
774         retry = 0;
775         notready = 0;
776         /* issue the command */
777 do_retry:
778         result = usb_stor_CB_comdat(srb, us);
779         debug("command / Data returned %d, status %lX\n",
780               result, us->pusb_dev->status);
781         /* if this is an CBI Protocol, get IRQ */
782         if (us->protocol == US_PR_CBI) {
783                 status = usb_stor_CBI_get_status(srb, us);
784                 /* if the status is error, report it */
785                 if (status == USB_STOR_TRANSPORT_ERROR) {
786                         debug(" USB CBI Command Error\n");
787                         return status;
788                 }
789                 srb->sense_buf[12] = (unsigned char)(us->ip_data >> 8);
790                 srb->sense_buf[13] = (unsigned char)(us->ip_data & 0xff);
791                 if (!us->ip_data) {
792                         /* if the status is good, report it */
793                         if (status == USB_STOR_TRANSPORT_GOOD) {
794                                 debug(" USB CBI Command Good\n");
795                                 return status;
796                         }
797                 }
798         }
799         /* do we have to issue an auto request? */
800         /* HERE we have to check the result */
801         if ((result < 0) && !(us->pusb_dev->status & USB_ST_STALLED)) {
802                 debug("ERROR %lX\n", us->pusb_dev->status);
803                 us->transport_reset(us);
804                 return USB_STOR_TRANSPORT_ERROR;
805         }
806         if ((us->protocol == US_PR_CBI) &&
807             ((srb->cmd[0] == SCSI_REQ_SENSE) ||
808             (srb->cmd[0] == SCSI_INQUIRY))) {
809                 /* do not issue an autorequest after request sense */
810                 debug("No auto request and good\n");
811                 return USB_STOR_TRANSPORT_GOOD;
812         }
813         /* issue an request_sense */
814         memset(&psrb->cmd[0], 0, 12);
815         psrb->cmd[0] = SCSI_REQ_SENSE;
816         psrb->cmd[1] = srb->lun << 5;
817         psrb->cmd[4] = 18;
818         psrb->datalen = 18;
819         psrb->pdata = &srb->sense_buf[0];
820         psrb->cmdlen = 12;
821         /* issue the command */
822         result = usb_stor_CB_comdat(psrb, us);
823         debug("auto request returned %d\n", result);
824         /* if this is an CBI Protocol, get IRQ */
825         if (us->protocol == US_PR_CBI)
826                 status = usb_stor_CBI_get_status(psrb, us);
827
828         if ((result < 0) && !(us->pusb_dev->status & USB_ST_STALLED)) {
829                 debug(" AUTO REQUEST ERROR %ld\n",
830                       us->pusb_dev->status);
831                 return USB_STOR_TRANSPORT_ERROR;
832         }
833         debug("autorequest returned 0x%02X 0x%02X 0x%02X 0x%02X\n",
834               srb->sense_buf[0], srb->sense_buf[2],
835               srb->sense_buf[12], srb->sense_buf[13]);
836         /* Check the auto request result */
837         if ((srb->sense_buf[2] == 0) &&
838             (srb->sense_buf[12] == 0) &&
839             (srb->sense_buf[13] == 0)) {
840                 /* ok, no sense */
841                 return USB_STOR_TRANSPORT_GOOD;
842         }
843
844         /* Check the auto request result */
845         switch (srb->sense_buf[2]) {
846         case 0x01:
847                 /* Recovered Error */
848                 return USB_STOR_TRANSPORT_GOOD;
849                 break;
850         case 0x02:
851                 /* Not Ready */
852                 if (notready++ > USB_TRANSPORT_NOT_READY_RETRY) {
853                         printf("cmd 0x%02X returned 0x%02X 0x%02X 0x%02X"
854                                " 0x%02X (NOT READY)\n", srb->cmd[0],
855                                 srb->sense_buf[0], srb->sense_buf[2],
856                                 srb->sense_buf[12], srb->sense_buf[13]);
857                         return USB_STOR_TRANSPORT_FAILED;
858                 } else {
859                         mdelay(100);
860                         goto do_retry;
861                 }
862                 break;
863         default:
864                 if (retry++ > USB_TRANSPORT_UNKNOWN_RETRY) {
865                         printf("cmd 0x%02X returned 0x%02X 0x%02X 0x%02X"
866                                " 0x%02X\n", srb->cmd[0], srb->sense_buf[0],
867                                 srb->sense_buf[2], srb->sense_buf[12],
868                                 srb->sense_buf[13]);
869                         return USB_STOR_TRANSPORT_FAILED;
870                 } else
871                         goto do_retry;
872                 break;
873         }
874         return USB_STOR_TRANSPORT_FAILED;
875 }
876
877
878 static int usb_inquiry(ccb *srb, struct us_data *ss)
879 {
880         int retry, i;
881         retry = 5;
882         do {
883                 memset(&srb->cmd[0], 0, 12);
884                 srb->cmd[0] = SCSI_INQUIRY;
885                 srb->cmd[1] = srb->lun << 5;
886                 srb->cmd[4] = 36;
887                 srb->datalen = 36;
888                 srb->cmdlen = 12;
889                 i = ss->transport(srb, ss);
890                 debug("inquiry returns %d\n", i);
891                 if (i == 0)
892                         break;
893         } while (--retry);
894
895         if (!retry) {
896                 printf("error in inquiry\n");
897                 return -1;
898         }
899         return 0;
900 }
901
902 static int usb_request_sense(ccb *srb, struct us_data *ss)
903 {
904         char *ptr;
905
906         ptr = (char *)srb->pdata;
907         memset(&srb->cmd[0], 0, 12);
908         srb->cmd[0] = SCSI_REQ_SENSE;
909         srb->cmd[1] = srb->lun << 5;
910         srb->cmd[4] = 18;
911         srb->datalen = 18;
912         srb->pdata = &srb->sense_buf[0];
913         srb->cmdlen = 12;
914         ss->transport(srb, ss);
915         debug("Request Sense returned %02X %02X %02X\n",
916               srb->sense_buf[2], srb->sense_buf[12],
917               srb->sense_buf[13]);
918         srb->pdata = (uchar *)ptr;
919         return 0;
920 }
921
922 static int usb_test_unit_ready(ccb *srb, struct us_data *ss)
923 {
924         int retries = 10;
925
926         do {
927                 memset(&srb->cmd[0], 0, 12);
928                 srb->cmd[0] = SCSI_TST_U_RDY;
929                 srb->cmd[1] = srb->lun << 5;
930                 srb->datalen = 0;
931                 srb->cmdlen = 12;
932                 if (ss->transport(srb, ss) == USB_STOR_TRANSPORT_GOOD) {
933                         ss->flags |= USB_READY;
934                         return 0;
935                 }
936                 usb_request_sense(srb, ss);
937                 /*
938                  * Check the Key Code Qualifier, if it matches
939                  * "Not Ready - medium not present"
940                  * (the sense Key equals 0x2 and the ASC is 0x3a)
941                  * return immediately as the medium being absent won't change
942                  * unless there is a user action.
943                  */
944                 if ((srb->sense_buf[2] == 0x02) &&
945                     (srb->sense_buf[12] == 0x3a))
946                         return -1;
947                 mdelay(100);
948         } while (retries--);
949
950         return -1;
951 }
952
953 static int usb_read_capacity(ccb *srb, struct us_data *ss)
954 {
955         int retry;
956         /* XXX retries */
957         retry = 3;
958         do {
959                 memset(&srb->cmd[0], 0, 12);
960                 srb->cmd[0] = SCSI_RD_CAPAC;
961                 srb->cmd[1] = srb->lun << 5;
962                 srb->datalen = 8;
963                 srb->cmdlen = 12;
964                 if (ss->transport(srb, ss) == USB_STOR_TRANSPORT_GOOD)
965                         return 0;
966         } while (retry--);
967
968         return -1;
969 }
970
971 static int usb_read_10(ccb *srb, struct us_data *ss, unsigned long start,
972                        unsigned short blocks)
973 {
974         memset(&srb->cmd[0], 0, 12);
975         srb->cmd[0] = SCSI_READ10;
976         srb->cmd[1] = srb->lun << 5;
977         srb->cmd[2] = ((unsigned char) (start >> 24)) & 0xff;
978         srb->cmd[3] = ((unsigned char) (start >> 16)) & 0xff;
979         srb->cmd[4] = ((unsigned char) (start >> 8)) & 0xff;
980         srb->cmd[5] = ((unsigned char) (start)) & 0xff;
981         srb->cmd[7] = ((unsigned char) (blocks >> 8)) & 0xff;
982         srb->cmd[8] = (unsigned char) blocks & 0xff;
983         srb->cmdlen = 12;
984         debug("read10: start %lx blocks %x\n", start, blocks);
985         return ss->transport(srb, ss);
986 }
987
988 static int usb_write_10(ccb *srb, struct us_data *ss, unsigned long start,
989                         unsigned short blocks)
990 {
991         memset(&srb->cmd[0], 0, 12);
992         srb->cmd[0] = SCSI_WRITE10;
993         srb->cmd[1] = srb->lun << 5;
994         srb->cmd[2] = ((unsigned char) (start >> 24)) & 0xff;
995         srb->cmd[3] = ((unsigned char) (start >> 16)) & 0xff;
996         srb->cmd[4] = ((unsigned char) (start >> 8)) & 0xff;
997         srb->cmd[5] = ((unsigned char) (start)) & 0xff;
998         srb->cmd[7] = ((unsigned char) (blocks >> 8)) & 0xff;
999         srb->cmd[8] = (unsigned char) blocks & 0xff;
1000         srb->cmdlen = 12;
1001         debug("write10: start %lx blocks %x\n", start, blocks);
1002         return ss->transport(srb, ss);
1003 }
1004
1005
1006 #ifdef CONFIG_USB_BIN_FIXUP
1007 /*
1008  * Some USB storage devices queried for SCSI identification data respond with
1009  * binary strings, which if output to the console freeze the terminal. The
1010  * workaround is to modify the vendor and product strings read from such
1011  * device with proper values (as reported by 'usb info').
1012  *
1013  * Vendor and product length limits are taken from the definition of
1014  * block_dev_desc_t in include/part.h.
1015  */
1016 static void usb_bin_fixup(struct usb_device_descriptor descriptor,
1017                                 unsigned char vendor[],
1018                                 unsigned char product[]) {
1019         const unsigned char max_vendor_len = 40;
1020         const unsigned char max_product_len = 20;
1021         if (descriptor.idVendor == 0x0424 && descriptor.idProduct == 0x223a) {
1022                 strncpy((char *)vendor, "SMSC", max_vendor_len);
1023                 strncpy((char *)product, "Flash Media Cntrller",
1024                         max_product_len);
1025         }
1026 }
1027 #endif /* CONFIG_USB_BIN_FIXUP */
1028
1029 static unsigned long usb_stor_read(block_dev_desc_t *block_dev, lbaint_t blknr,
1030                                    lbaint_t blkcnt, void *buffer)
1031 {
1032         int device = block_dev->dev;
1033         lbaint_t start, blks;
1034         uintptr_t buf_addr;
1035         unsigned short smallblks;
1036         struct usb_device *dev;
1037         struct us_data *ss;
1038         int retry;
1039         ccb *srb = &usb_ccb;
1040
1041         if (blkcnt == 0)
1042                 return 0;
1043
1044         device &= 0xff;
1045         /* Setup  device */
1046         debug("\nusb_read: dev %d\n", device);
1047         dev = usb_dev_desc[device].priv;
1048         if (!dev) {
1049                 debug("%s: No device\n", __func__);
1050                 return 0;
1051         }
1052         ss = (struct us_data *)dev->privptr;
1053
1054         usb_disable_asynch(1); /* asynch transfer not allowed */
1055         srb->lun = usb_dev_desc[device].lun;
1056         buf_addr = (uintptr_t)buffer;
1057         start = blknr;
1058         blks = blkcnt;
1059
1060         debug("\nusb_read: dev %d startblk " LBAF ", blccnt " LBAF
1061               " buffer %" PRIxPTR "\n", device, start, blks, buf_addr);
1062
1063         do {
1064                 /* XXX need some comment here */
1065                 retry = 2;
1066                 srb->pdata = (unsigned char *)buf_addr;
1067                 if (blks > USB_MAX_XFER_BLK)
1068                         smallblks = USB_MAX_XFER_BLK;
1069                 else
1070                         smallblks = (unsigned short) blks;
1071 retry_it:
1072                 if (smallblks == USB_MAX_XFER_BLK)
1073                         usb_show_progress();
1074                 srb->datalen = usb_dev_desc[device].blksz * smallblks;
1075                 srb->pdata = (unsigned char *)buf_addr;
1076                 if (usb_read_10(srb, ss, start, smallblks)) {
1077                         debug("Read ERROR\n");
1078                         usb_request_sense(srb, ss);
1079                         if (retry--)
1080                                 goto retry_it;
1081                         blkcnt -= blks;
1082                         break;
1083                 }
1084                 start += smallblks;
1085                 blks -= smallblks;
1086                 buf_addr += srb->datalen;
1087         } while (blks != 0);
1088         ss->flags &= ~USB_READY;
1089
1090         debug("usb_read: end startblk " LBAF
1091               ", blccnt %x buffer %" PRIxPTR "\n",
1092               start, smallblks, buf_addr);
1093
1094         usb_disable_asynch(0); /* asynch transfer allowed */
1095         if (blkcnt >= USB_MAX_XFER_BLK)
1096                 debug("\n");
1097         return blkcnt;
1098 }
1099
1100 static unsigned long usb_stor_write(block_dev_desc_t *block_dev, lbaint_t blknr,
1101                                     lbaint_t blkcnt, const void *buffer)
1102 {
1103         int device = block_dev->dev;
1104         lbaint_t start, blks;
1105         uintptr_t buf_addr;
1106         unsigned short smallblks;
1107         struct usb_device *dev;
1108         struct us_data *ss;
1109         int retry;
1110         ccb *srb = &usb_ccb;
1111
1112         if (blkcnt == 0)
1113                 return 0;
1114
1115         device &= 0xff;
1116         /* Setup  device */
1117         debug("\nusb_write: dev %d\n", device);
1118         dev = usb_dev_desc[device].priv;
1119         if (!dev)
1120                 return 0;
1121         ss = (struct us_data *)dev->privptr;
1122
1123         usb_disable_asynch(1); /* asynch transfer not allowed */
1124
1125         srb->lun = usb_dev_desc[device].lun;
1126         buf_addr = (uintptr_t)buffer;
1127         start = blknr;
1128         blks = blkcnt;
1129
1130         debug("\nusb_write: dev %d startblk " LBAF ", blccnt " LBAF
1131               " buffer %" PRIxPTR "\n", device, start, blks, buf_addr);
1132
1133         do {
1134                 /* If write fails retry for max retry count else
1135                  * return with number of blocks written successfully.
1136                  */
1137                 retry = 2;
1138                 srb->pdata = (unsigned char *)buf_addr;
1139                 if (blks > USB_MAX_XFER_BLK)
1140                         smallblks = USB_MAX_XFER_BLK;
1141                 else
1142                         smallblks = (unsigned short) blks;
1143 retry_it:
1144                 if (smallblks == USB_MAX_XFER_BLK)
1145                         usb_show_progress();
1146                 srb->datalen = usb_dev_desc[device].blksz * smallblks;
1147                 srb->pdata = (unsigned char *)buf_addr;
1148                 if (usb_write_10(srb, ss, start, smallblks)) {
1149                         debug("Write ERROR\n");
1150                         usb_request_sense(srb, ss);
1151                         if (retry--)
1152                                 goto retry_it;
1153                         blkcnt -= blks;
1154                         break;
1155                 }
1156                 start += smallblks;
1157                 blks -= smallblks;
1158                 buf_addr += srb->datalen;
1159         } while (blks != 0);
1160         ss->flags &= ~USB_READY;
1161
1162         debug("usb_write: end startblk " LBAF ", blccnt %x buffer %"
1163               PRIxPTR "\n", start, smallblks, buf_addr);
1164
1165         usb_disable_asynch(0); /* asynch transfer allowed */
1166         if (blkcnt >= USB_MAX_XFER_BLK)
1167                 debug("\n");
1168         return blkcnt;
1169
1170 }
1171
1172 /* Probe to see if a new device is actually a Storage device */
1173 int usb_storage_probe(struct usb_device *dev, unsigned int ifnum,
1174                       struct us_data *ss)
1175 {
1176         struct usb_interface *iface;
1177         int i;
1178         struct usb_endpoint_descriptor *ep_desc;
1179         unsigned int flags = 0;
1180
1181         /* let's examine the device now */
1182         iface = &dev->config.if_desc[ifnum];
1183
1184         if (dev->descriptor.bDeviceClass != 0 ||
1185                         iface->desc.bInterfaceClass != USB_CLASS_MASS_STORAGE ||
1186                         iface->desc.bInterfaceSubClass < US_SC_MIN ||
1187                         iface->desc.bInterfaceSubClass > US_SC_MAX) {
1188                 debug("Not mass storage\n");
1189                 /* if it's not a mass storage, we go no further */
1190                 return 0;
1191         }
1192
1193         memset(ss, 0, sizeof(struct us_data));
1194
1195         /* At this point, we know we've got a live one */
1196         debug("\n\nUSB Mass Storage device detected\n");
1197
1198         /* Initialize the us_data structure with some useful info */
1199         ss->flags = flags;
1200         ss->ifnum = ifnum;
1201         ss->pusb_dev = dev;
1202         ss->attention_done = 0;
1203         ss->subclass = iface->desc.bInterfaceSubClass;
1204         ss->protocol = iface->desc.bInterfaceProtocol;
1205
1206         /* set the handler pointers based on the protocol */
1207         debug("Transport: ");
1208         switch (ss->protocol) {
1209         case US_PR_CB:
1210                 debug("Control/Bulk\n");
1211                 ss->transport = usb_stor_CB_transport;
1212                 ss->transport_reset = usb_stor_CB_reset;
1213                 break;
1214
1215         case US_PR_CBI:
1216                 debug("Control/Bulk/Interrupt\n");
1217                 ss->transport = usb_stor_CB_transport;
1218                 ss->transport_reset = usb_stor_CB_reset;
1219                 break;
1220         case US_PR_BULK:
1221                 debug("Bulk/Bulk/Bulk\n");
1222                 ss->transport = usb_stor_BBB_transport;
1223                 ss->transport_reset = usb_stor_BBB_reset;
1224                 break;
1225         default:
1226                 printf("USB Storage Transport unknown / not yet implemented\n");
1227                 return 0;
1228                 break;
1229         }
1230
1231         /*
1232          * We are expecting a minimum of 2 endpoints - in and out (bulk).
1233          * An optional interrupt is OK (necessary for CBI protocol).
1234          * We will ignore any others.
1235          */
1236         for (i = 0; i < iface->desc.bNumEndpoints; i++) {
1237                 ep_desc = &iface->ep_desc[i];
1238                 /* is it an BULK endpoint? */
1239                 if ((ep_desc->bmAttributes &
1240                      USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_BULK) {
1241                         if (ep_desc->bEndpointAddress & USB_DIR_IN)
1242                                 ss->ep_in = ep_desc->bEndpointAddress &
1243                                                 USB_ENDPOINT_NUMBER_MASK;
1244                         else
1245                                 ss->ep_out =
1246                                         ep_desc->bEndpointAddress &
1247                                         USB_ENDPOINT_NUMBER_MASK;
1248                 }
1249
1250                 /* is it an interrupt endpoint? */
1251                 if ((ep_desc->bmAttributes &
1252                      USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_INT) {
1253                         ss->ep_int = ep_desc->bEndpointAddress &
1254                                                 USB_ENDPOINT_NUMBER_MASK;
1255                         ss->irqinterval = ep_desc->bInterval;
1256                 }
1257         }
1258         debug("Endpoints In %d Out %d Int %d\n",
1259               ss->ep_in, ss->ep_out, ss->ep_int);
1260
1261         /* Do some basic sanity checks, and bail if we find a problem */
1262         if (usb_set_interface(dev, iface->desc.bInterfaceNumber, 0) ||
1263             !ss->ep_in || !ss->ep_out ||
1264             (ss->protocol == US_PR_CBI && ss->ep_int == 0)) {
1265                 debug("Problems with device\n");
1266                 return 0;
1267         }
1268         /* set class specific stuff */
1269         /* We only handle certain protocols.  Currently, these are
1270          * the only ones.
1271          * The SFF8070 accepts the requests used in u-boot
1272          */
1273         if (ss->subclass != US_SC_UFI && ss->subclass != US_SC_SCSI &&
1274             ss->subclass != US_SC_8070) {
1275                 printf("Sorry, protocol %d not yet supported.\n", ss->subclass);
1276                 return 0;
1277         }
1278         if (ss->ep_int) {
1279                 /* we had found an interrupt endpoint, prepare irq pipe
1280                  * set up the IRQ pipe and handler
1281                  */
1282                 ss->irqinterval = (ss->irqinterval > 0) ? ss->irqinterval : 255;
1283                 ss->irqpipe = usb_rcvintpipe(ss->pusb_dev, ss->ep_int);
1284                 ss->irqmaxp = usb_maxpacket(dev, ss->irqpipe);
1285                 dev->irq_handle = usb_stor_irq;
1286         }
1287         dev->privptr = (void *)ss;
1288         return 1;
1289 }
1290
1291 int usb_stor_get_info(struct usb_device *dev, struct us_data *ss,
1292                       block_dev_desc_t *dev_desc)
1293 {
1294         unsigned char perq, modi;
1295         ALLOC_CACHE_ALIGN_BUFFER(u32, cap, 2);
1296         ALLOC_CACHE_ALIGN_BUFFER(u8, usb_stor_buf, 36);
1297         u32 capacity, blksz;
1298         ccb *pccb = &usb_ccb;
1299
1300         pccb->pdata = usb_stor_buf;
1301
1302         dev_desc->target = dev->devnum;
1303         pccb->lun = dev_desc->lun;
1304         debug(" address %d\n", dev_desc->target);
1305
1306         if (usb_inquiry(pccb, ss)) {
1307                 debug("%s: usb_inquiry() failed\n", __func__);
1308                 return -1;
1309         }
1310
1311         perq = usb_stor_buf[0];
1312         modi = usb_stor_buf[1];
1313
1314         /*
1315          * Skip unknown devices (0x1f) and enclosure service devices (0x0d),
1316          * they would not respond to test_unit_ready .
1317          */
1318         if (((perq & 0x1f) == 0x1f) || ((perq & 0x1f) == 0x0d)) {
1319                 debug("%s: unknown/unsupported device\n", __func__);
1320                 return 0;
1321         }
1322         if ((modi&0x80) == 0x80) {
1323                 /* drive is removable */
1324                 dev_desc->removable = 1;
1325         }
1326         memcpy(dev_desc->vendor, (const void *)&usb_stor_buf[8], 8);
1327         memcpy(dev_desc->product, (const void *)&usb_stor_buf[16], 16);
1328         memcpy(dev_desc->revision, (const void *)&usb_stor_buf[32], 4);
1329         dev_desc->vendor[8] = 0;
1330         dev_desc->product[16] = 0;
1331         dev_desc->revision[4] = 0;
1332 #ifdef CONFIG_USB_BIN_FIXUP
1333         usb_bin_fixup(dev->descriptor, (uchar *)dev_desc->vendor,
1334                       (uchar *)dev_desc->product);
1335 #endif /* CONFIG_USB_BIN_FIXUP */
1336         debug("ISO Vers %X, Response Data %X\n", usb_stor_buf[2],
1337               usb_stor_buf[3]);
1338         if (usb_test_unit_ready(pccb, ss)) {
1339                 printf("Device NOT ready\n"
1340                        "   Request Sense returned %02X %02X %02X\n",
1341                        pccb->sense_buf[2], pccb->sense_buf[12],
1342                        pccb->sense_buf[13]);
1343                 if (dev_desc->removable == 1) {
1344                         dev_desc->type = perq;
1345                         return 1;
1346                 }
1347                 return 0;
1348         }
1349         pccb->pdata = (unsigned char *)cap;
1350         memset(pccb->pdata, 0, 8);
1351         if (usb_read_capacity(pccb, ss) != 0) {
1352                 printf("READ_CAP ERROR\n");
1353                 cap[0] = 2880;
1354                 cap[1] = 0x200;
1355         }
1356         ss->flags &= ~USB_READY;
1357         debug("Read Capacity returns: 0x%08x, 0x%08x\n", cap[0], cap[1]);
1358 #if 0
1359         if (cap[0] > (0x200000 * 10)) /* greater than 10 GByte */
1360                 cap[0] >>= 16;
1361
1362         cap[0] = cpu_to_be32(cap[0]);
1363         cap[1] = cpu_to_be32(cap[1]);
1364 #endif
1365
1366         capacity = be32_to_cpu(cap[0]) + 1;
1367         blksz = be32_to_cpu(cap[1]);
1368
1369         debug("Capacity = 0x%08x, blocksz = 0x%08x\n", capacity, blksz);
1370         dev_desc->lba = capacity;
1371         dev_desc->blksz = blksz;
1372         dev_desc->log2blksz = LOG2(dev_desc->blksz);
1373         dev_desc->type = perq;
1374         debug(" address %d\n", dev_desc->target);
1375         debug("partype: %d\n", dev_desc->part_type);
1376
1377         init_part(dev_desc);
1378
1379         debug("partype: %d\n", dev_desc->part_type);
1380         return 1;
1381 }
1382
1383 #ifdef CONFIG_DM_USB
1384
1385 static int usb_mass_storage_probe(struct udevice *dev)
1386 {
1387         struct usb_device *udev = dev_get_parent_priv(dev);
1388         int ret;
1389
1390         usb_disable_asynch(1); /* asynch transfer not allowed */
1391         ret = usb_stor_probe_device(udev);
1392         usb_disable_asynch(0); /* asynch transfer allowed */
1393
1394         return ret;
1395 }
1396
1397 static const struct udevice_id usb_mass_storage_ids[] = {
1398         { .compatible = "usb-mass-storage" },
1399         { }
1400 };
1401
1402 U_BOOT_DRIVER(usb_mass_storage) = {
1403         .name   = "usb_mass_storage",
1404         .id     = UCLASS_MASS_STORAGE,
1405         .of_match = usb_mass_storage_ids,
1406         .probe = usb_mass_storage_probe,
1407 };
1408
1409 UCLASS_DRIVER(usb_mass_storage) = {
1410         .id             = UCLASS_MASS_STORAGE,
1411         .name           = "usb_mass_storage",
1412 };
1413
1414 static const struct usb_device_id mass_storage_id_table[] = {
1415         {
1416                 .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1417                 .bInterfaceClass = USB_CLASS_MASS_STORAGE
1418         },
1419         { }             /* Terminating entry */
1420 };
1421
1422 U_BOOT_USB_DEVICE(usb_mass_storage, mass_storage_id_table);
1423
1424 #endif