bpf: Prevent memory disambiguation attack
[linux/fpc-iii.git] / drivers / usb / storage / karma.c
blobedcf2be0e0eb55fca9d89b488ed98903263406a8
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Driver for Rio Karma
5 * (c) 2006 Bob Copeland <me@bobcopeland.com>
6 * (c) 2006 Keith Bennett <keith@mcs.st-and.ac.uk>
7 */
9 #include <linux/module.h>
10 #include <linux/slab.h>
12 #include <scsi/scsi.h>
13 #include <scsi/scsi_cmnd.h>
14 #include <scsi/scsi_device.h>
16 #include "usb.h"
17 #include "transport.h"
18 #include "debug.h"
19 #include "scsiglue.h"
21 #define DRV_NAME "ums-karma"
23 MODULE_DESCRIPTION("Driver for Rio Karma");
24 MODULE_AUTHOR("Bob Copeland <me@bobcopeland.com>, Keith Bennett <keith@mcs.st-and.ac.uk>");
25 MODULE_LICENSE("GPL");
27 #define RIO_PREFIX "RIOP\x00"
28 #define RIO_PREFIX_LEN 5
29 #define RIO_SEND_LEN 40
30 #define RIO_RECV_LEN 0x200
32 #define RIO_ENTER_STORAGE 0x1
33 #define RIO_LEAVE_STORAGE 0x2
34 #define RIO_RESET 0xC
36 struct karma_data {
37 int in_storage;
38 char *recv;
41 static int rio_karma_init(struct us_data *us);
45 * The table of devices
47 #define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
48 vendorName, productName, useProtocol, useTransport, \
49 initFunction, flags) \
50 { USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
51 .driver_info = (flags) }
53 static struct usb_device_id karma_usb_ids[] = {
54 # include "unusual_karma.h"
55 { } /* Terminating entry */
57 MODULE_DEVICE_TABLE(usb, karma_usb_ids);
59 #undef UNUSUAL_DEV
62 * The flags table
64 #define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
65 vendor_name, product_name, use_protocol, use_transport, \
66 init_function, Flags) \
67 { \
68 .vendorName = vendor_name, \
69 .productName = product_name, \
70 .useProtocol = use_protocol, \
71 .useTransport = use_transport, \
72 .initFunction = init_function, \
75 static struct us_unusual_dev karma_unusual_dev_list[] = {
76 # include "unusual_karma.h"
77 { } /* Terminating entry */
80 #undef UNUSUAL_DEV
84 * Send commands to Rio Karma.
86 * For each command we send 40 bytes starting 'RIOP\0' followed by
87 * the command number and a sequence number, which the device will ack
88 * with a 512-byte packet with the high four bits set and everything
89 * else null. Then we send 'RIOP\x80' followed by a zero and the
90 * sequence number, until byte 5 in the response repeats the sequence
91 * number.
93 static int rio_karma_send_command(char cmd, struct us_data *us)
95 int result;
96 unsigned long timeout;
97 static unsigned char seq = 1;
98 struct karma_data *data = (struct karma_data *) us->extra;
100 usb_stor_dbg(us, "sending command %04x\n", cmd);
101 memset(us->iobuf, 0, RIO_SEND_LEN);
102 memcpy(us->iobuf, RIO_PREFIX, RIO_PREFIX_LEN);
103 us->iobuf[5] = cmd;
104 us->iobuf[6] = seq;
106 timeout = jiffies + msecs_to_jiffies(6000);
107 for (;;) {
108 result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe,
109 us->iobuf, RIO_SEND_LEN, NULL);
110 if (result != USB_STOR_XFER_GOOD)
111 goto err;
113 result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
114 data->recv, RIO_RECV_LEN, NULL);
115 if (result != USB_STOR_XFER_GOOD)
116 goto err;
118 if (data->recv[5] == seq)
119 break;
121 if (time_after(jiffies, timeout))
122 goto err;
124 us->iobuf[4] = 0x80;
125 us->iobuf[5] = 0;
126 msleep(50);
129 seq++;
130 if (seq == 0)
131 seq = 1;
133 usb_stor_dbg(us, "sent command %04x\n", cmd);
134 return 0;
135 err:
136 usb_stor_dbg(us, "command %04x failed\n", cmd);
137 return USB_STOR_TRANSPORT_FAILED;
141 * Trap START_STOP and READ_10 to leave/re-enter storage mode.
142 * Everything else is propagated to the normal bulk layer.
144 static int rio_karma_transport(struct scsi_cmnd *srb, struct us_data *us)
146 int ret;
147 struct karma_data *data = (struct karma_data *) us->extra;
149 if (srb->cmnd[0] == READ_10 && !data->in_storage) {
150 ret = rio_karma_send_command(RIO_ENTER_STORAGE, us);
151 if (ret)
152 return ret;
154 data->in_storage = 1;
155 return usb_stor_Bulk_transport(srb, us);
156 } else if (srb->cmnd[0] == START_STOP) {
157 ret = rio_karma_send_command(RIO_LEAVE_STORAGE, us);
158 if (ret)
159 return ret;
161 data->in_storage = 0;
162 return rio_karma_send_command(RIO_RESET, us);
164 return usb_stor_Bulk_transport(srb, us);
167 static void rio_karma_destructor(void *extra)
169 struct karma_data *data = (struct karma_data *) extra;
170 kfree(data->recv);
173 static int rio_karma_init(struct us_data *us)
175 int ret = 0;
176 struct karma_data *data = kzalloc(sizeof(struct karma_data), GFP_NOIO);
177 if (!data)
178 goto out;
180 data->recv = kmalloc(RIO_RECV_LEN, GFP_NOIO);
181 if (!data->recv) {
182 kfree(data);
183 goto out;
186 us->extra = data;
187 us->extra_destructor = rio_karma_destructor;
188 ret = rio_karma_send_command(RIO_ENTER_STORAGE, us);
189 data->in_storage = (ret == 0);
190 out:
191 return ret;
194 static struct scsi_host_template karma_host_template;
196 static int karma_probe(struct usb_interface *intf,
197 const struct usb_device_id *id)
199 struct us_data *us;
200 int result;
202 result = usb_stor_probe1(&us, intf, id,
203 (id - karma_usb_ids) + karma_unusual_dev_list,
204 &karma_host_template);
205 if (result)
206 return result;
208 us->transport_name = "Rio Karma/Bulk";
209 us->transport = rio_karma_transport;
210 us->transport_reset = usb_stor_Bulk_reset;
212 result = usb_stor_probe2(us);
213 return result;
216 static struct usb_driver karma_driver = {
217 .name = DRV_NAME,
218 .probe = karma_probe,
219 .disconnect = usb_stor_disconnect,
220 .suspend = usb_stor_suspend,
221 .resume = usb_stor_resume,
222 .reset_resume = usb_stor_reset_resume,
223 .pre_reset = usb_stor_pre_reset,
224 .post_reset = usb_stor_post_reset,
225 .id_table = karma_usb_ids,
226 .soft_unbind = 1,
227 .no_dynamic_id = 1,
230 module_usb_stor_driver(karma_driver, karma_host_template, DRV_NAME);