drivers/usb/gadget/file_storage.c

   1 /*
   2  * file_storage.c -- File-backed USB Storage Gadget, for USB development
   3  *
   4  * Copyright (C) 2003-2005 Alan Stern
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions, and the following disclaimer,
  12  *    without modification.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. The names of the above-listed copyright holders may not be used
  17  *    to endorse or promote products derived from this software without
  18  *    specific prior written permission.
  19  *
  20  * ALTERNATIVELY, this software may be distributed under the terms of the
  21  * GNU General Public License ("GPL") as published by the Free Software
  22  * Foundation, either version 2 of that License or (at your option) any
  23  * later version.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
  26  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  27  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  30  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  31  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  32  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  33  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  34  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  35  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38
  39 /*
  40  * The File-backed Storage Gadget acts as a USB Mass Storage device,
  41  * appearing to the host as a disk drive.  In addition to providing an
  42  * example of a genuinely useful gadget driver for a USB device, it also
  43  * illustrates a technique of double-buffering for increased throughput.
  44  * Last but not least, it gives an easy way to probe the behavior of the
  45  * Mass Storage drivers in a USB host.
  46  *
  47  * Backing storage is provided by a regular file or a block device, specified
  48  * by the "file" module parameter.  Access can be limited to read-only by
  49  * setting the optional "ro" module parameter.  The gadget will indicate that
  50  * it has removable media if the optional "removable" module parameter is set.
  51  *
  52  * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
  53  * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
  54  * by the optional "transport" module parameter.  It also supports the
  55  * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
  56  * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
  57  * the optional "protocol" module parameter.  In addition, the default
  58  * Vendor ID, Product ID, and release number can be overridden.
  59  *
  60  * There is support for multiple logical units (LUNs), each of which has
  61  * its own backing file.  The number of LUNs can be set using the optional
  62  * "luns" module parameter (anywhere from 1 to 8), and the corresponding
  63  * files are specified using comma-separated lists for "file" and "ro".
  64  * The default number of LUNs is taken from the number of "file" elements;
  65  * it is 1 if "file" is not given.  If "removable" is not set then a backing
  66  * file must be specified for each LUN.  If it is set, then an unspecified
  67  * or empty backing filename means the LUN's medium is not loaded.
  68  *
  69  * Requirements are modest; only a bulk-in and a bulk-out endpoint are
  70  * needed (an interrupt-out endpoint is also needed for CBI).  The memory
  71  * requirement amounts to two 16K buffers, size configurable by a parameter.
  72  * Support is included for both full-speed and high-speed operation.
  73  *
  74  * Note that the driver is slightly non-portable in that it assumes a
  75  * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
  76  * interrupt-in endpoints.  With most device controllers this isn't an
  77  * issue, but there may be some with hardware restrictions that prevent
  78  * a buffer from being used by more than one endpoint.
  79  *
  80  * Module options:
  81  *
  82  *      file=filename[,filename...]
  83  *                              Required if "removable" is not set, names of
  84  *                                      the files or block devices used for
  85  *                                      backing storage
  86  *      ro=b[,b...]             Default false, booleans for read-only access
  87  *      removable               Default false, boolean for removable media
  88  *      luns=N                  Default N = number of filenames, number of
  89  *                                      LUNs to support
  90  *      stall                   Default determined according to the type of
  91  *                                      USB device controller (usually true),
  92  *                                      boolean to permit the driver to halt
  93  *                                      bulk endpoints
  94  *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
  95  *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
  96  *                                      ATAPI, QIC, UFI, 8070, or SCSI;
  97  *                                      also 1 - 6)
  98  *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
  99  *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
 100  *      release=0xRRRR          Override the USB release number (bcdDevice)
 101  *      buflen=N                Default N=16384, buffer size used (will be
 102  *                                      rounded down to a multiple of
 103  *                                      PAGE_CACHE_SIZE)
 104  *
 105  * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
 106  * "removable", "luns", and "stall" options are available; default values
 107  * are used for everything else.
 108  *
 109  * The pathnames of the backing files and the ro settings are available in
 110  * the attribute files "file" and "ro" in the lun<n> subdirectory of the
 111  * gadget's sysfs directory.  If the "removable" option is set, writing to
 112  * these files will simulate ejecting/loading the medium (writing an empty
 113  * line means eject) and adjusting a write-enable tab.  Changes to the ro
 114  * setting are not allowed when the medium is loaded.
 115  *
 116  * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
 117  */
 118
 119
 120 /*
 121  *                              Driver Design
 122  *
 123  * The FSG driver is fairly straightforward.  There is a main kernel
 124  * thread that handles most of the work.  Interrupt routines field
 125  * callbacks from the controller driver: bulk- and interrupt-request
 126  * completion notifications, endpoint-0 events, and disconnect events.
 127  * Completion events are passed to the main thread by wakeup calls.  Many
 128  * ep0 requests are handled at interrupt time, but SetInterface,
 129  * SetConfiguration, and device reset requests are forwarded to the
 130  * thread in the form of "exceptions" using SIGUSR1 signals (since they
 131  * should interrupt any ongoing file I/O operations).
 132  *
 133  * The thread's main routine implements the standard command/data/status
 134  * parts of a SCSI interaction.  It and its subroutines are full of tests
 135  * for pending signals/exceptions -- all this polling is necessary since
 136  * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
 137  * indication that the driver really wants to be running in userspace.)
 138  * An important point is that so long as the thread is alive it keeps an
 139  * open reference to the backing file.  This will prevent unmounting
 140  * the backing file's underlying filesystem and could cause problems
 141  * during system shutdown, for example.  To prevent such problems, the
 142  * thread catches INT, TERM, and KILL signals and converts them into
 143  * an EXIT exception.
 144  *
 145  * In normal operation the main thread is started during the gadget's
 146  * fsg_bind() callback and stopped during fsg_unbind().  But it can also
 147  * exit when it receives a signal, and there's no point leaving the
 148  * gadget running when the thread is dead.  So just before the thread
 149  * exits, it deregisters the gadget driver.  This makes things a little
 150  * tricky: The driver is deregistered at two places, and the exiting
 151  * thread can indirectly call fsg_unbind() which in turn can tell the
 152  * thread to exit.  The first problem is resolved through the use of the
 153  * REGISTERED atomic bitflag; the driver will only be deregistered once.
 154  * The second problem is resolved by having fsg_unbind() check
 155  * fsg->state; it won't try to stop the thread if the state is already
 156  * FSG_STATE_TERMINATED.
 157  *
 158  * To provide maximum throughput, the driver uses a circular pipeline of
 159  * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
 160  * arbitrarily long; in practice the benefits don't justify having more
 161  * than 2 stages (i.e., double buffering).  But it helps to think of the
 162  * pipeline as being a long one.  Each buffer head contains a bulk-in and
 163  * a bulk-out request pointer (since the buffer can be used for both
 164  * output and input -- directions always are given from the host's
 165  * point of view) as well as a pointer to the buffer and various state
 166  * variables.
 167  *
 168  * Use of the pipeline follows a simple protocol.  There is a variable
 169  * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
 170  * At any time that buffer head may still be in use from an earlier
 171  * request, so each buffer head has a state variable indicating whether
 172  * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
 173  * buffer head to be EMPTY, filling the buffer either by file I/O or by
 174  * USB I/O (during which the buffer head is BUSY), and marking the buffer
 175  * head FULL when the I/O is complete.  Then the buffer will be emptied
 176  * (again possibly by USB I/O, during which it is marked BUSY) and
 177  * finally marked EMPTY again (possibly by a completion routine).
 178  *
 179  * A module parameter tells the driver to avoid stalling the bulk
 180  * endpoints wherever the transport specification allows.  This is
 181  * necessary for some UDCs like the SuperH, which cannot reliably clear a
 182  * halt on a bulk endpoint.  However, under certain circumstances the
 183  * Bulk-only specification requires a stall.  In such cases the driver
 184  * will halt the endpoint and set a flag indicating that it should clear
 185  * the halt in software during the next device reset.  Hopefully this
 186  * will permit everything to work correctly.  Furthermore, although the
 187  * specification allows the bulk-out endpoint to halt when the host sends
 188  * too much data, implementing this would cause an unavoidable race.
 189  * The driver will always use the "no-stall" approach for OUT transfers.
 190  *
 191  * One subtle point concerns sending status-stage responses for ep0
 192  * requests.  Some of these requests, such as device reset, can involve
 193  * interrupting an ongoing file I/O operation, which might take an
 194  * arbitrarily long time.  During that delay the host might give up on
 195  * the original ep0 request and issue a new one.  When that happens the
 196  * driver should not notify the host about completion of the original
 197  * request, as the host will no longer be waiting for it.  So the driver
 198  * assigns to each ep0 request a unique tag, and it keeps track of the
 199  * tag value of the request associated with a long-running exception
 200  * (device-reset, interface-change, or configuration-change).  When the
 201  * exception handler is finished, the status-stage response is submitted
 202  * only if the current ep0 request tag is equal to the exception request
 203  * tag.  Thus only the most recently received ep0 request will get a
 204  * status-stage response.
 205  *
 206  * Warning: This driver source file is too long.  It ought to be split up
 207  * into a header file plus about 3 separate .c files, to handle the details
 208  * of the Gadget, USB Mass Storage, and SCSI protocols.
 209  */
 210
 211
 212 #undef DEBUG
 213 #undef VERBOSE
 214 #undef DUMP_MSGS
 215
 216 #include <linux/config.h>
 217
 218 #include <asm/system.h>
 219 #include <asm/uaccess.h>
 220
 221 #include <linux/bitops.h>
 222 #include <linux/blkdev.h>
 223 #include <linux/compiler.h>
 224 #include <linux/completion.h>
 225 #include <linux/dcache.h>
 226 #include <linux/delay.h>
 227 #include <linux/device.h>
 228 #include <linux/fcntl.h>
 229 #include <linux/file.h>
 230 #include <linux/fs.h>
 231 #include <linux/init.h>
 232 #include <linux/kernel.h>
 233 #include <linux/kref.h>
 234 #include <linux/kthread.h>
 235 #include <linux/limits.h>
 236 #include <linux/list.h>
 237 #include <linux/module.h>
 238 #include <linux/moduleparam.h>
 239 #include <linux/pagemap.h>
 240 #include <linux/rwsem.h>
 241 #include <linux/sched.h>
 242 #include <linux/signal.h>
 243 #include <linux/slab.h>
 244 #include <linux/spinlock.h>
 245 #include <linux/string.h>
 246 #include <linux/suspend.h>
 247 #include <linux/utsname.h>
 248
 249 #include <linux/usb_ch9.h>
 250 #include <linux/usb_gadget.h>
 251
 252 #include "gadget_chips.h"
 253
 254
 255 /*-------------------------------------------------------------------------*/
 256
 257 #define DRIVER_DESC             "File-backed Storage Gadget"
 258 #define DRIVER_NAME             "g_file_storage"
 259 #define DRIVER_VERSION          "28 November 2005"
 260
 261 static const char longname[] = DRIVER_DESC;
 262 static const char shortname[] = DRIVER_NAME;
 263
 264 MODULE_DESCRIPTION(DRIVER_DESC);
 265 MODULE_AUTHOR("Alan Stern");
 266 MODULE_LICENSE("Dual BSD/GPL");
 267
 268 /* Thanks to NetChip Technologies for donating this product ID.
 269  *
 270  * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
 271  * Instead:  allocate your own, using normal USB-IF procedures. */
 272 #define DRIVER_VENDOR_ID        0x0525  // NetChip
 273 #define DRIVER_PRODUCT_ID       0xa4a5  // Linux-USB File-backed Storage Gadget
 274
 275
 276 /*
 277  * This driver assumes self-powered hardware and has no way for users to
 278  * trigger remote wakeup.  It uses autoconfiguration to select endpoints
 279  * and endpoint addresses.
 280  */
 281
 282
 283 /*-------------------------------------------------------------------------*/
 284
 285 #define xprintk(f,level,fmt,args...) \
 286         dev_printk(level , &(f)->gadget->dev , fmt , ## args)
 287 #define yprintk(l,level,fmt,args...) \
 288         dev_printk(level , &(l)->dev , fmt , ## args)
 289
 290 #ifdef DEBUG
 291 #define DBG(fsg,fmt,args...) \
 292         xprintk(fsg , KERN_DEBUG , fmt , ## args)
 293 #define LDBG(lun,fmt,args...) \
 294         yprintk(lun , KERN_DEBUG , fmt , ## args)
 295 #define MDBG(fmt,args...) \
 296         printk(KERN_DEBUG DRIVER_NAME ": " fmt , ## args)
 297 #else
 298 #define DBG(fsg,fmt,args...) \
 299         do { } while (0)
 300 #define LDBG(lun,fmt,args...) \
 301         do { } while (0)
 302 #define MDBG(fmt,args...) \
 303         do { } while (0)
 304 #undef VERBOSE
 305 #undef DUMP_MSGS
 306 #endif /* DEBUG */
 307
 308 #ifdef VERBOSE
 309 #define VDBG    DBG
 310 #define VLDBG   LDBG
 311 #else
 312 #define VDBG(fsg,fmt,args...) \
 313         do { } while (0)
 314 #define VLDBG(lun,fmt,args...) \
 315         do { } while (0)
 316 #endif /* VERBOSE */
 317
 318 #define ERROR(fsg,fmt,args...) \
 319         xprintk(fsg , KERN_ERR , fmt , ## args)
 320 #define LERROR(lun,fmt,args...) \
 321         yprintk(lun , KERN_ERR , fmt , ## args)
 322
 323 #define WARN(fsg,fmt,args...) \
 324         xprintk(fsg , KERN_WARNING , fmt , ## args)
 325 #define LWARN(lun,fmt,args...) \
 326         yprintk(lun , KERN_WARNING , fmt , ## args)
 327
 328 #define INFO(fsg,fmt,args...) \
 329         xprintk(fsg , KERN_INFO , fmt , ## args)
 330 #define LINFO(lun,fmt,args...) \
 331         yprintk(lun , KERN_INFO , fmt , ## args)
 332
 333 #define MINFO(fmt,args...) \
 334         printk(KERN_INFO DRIVER_NAME ": " fmt , ## args)
 335
 336
 337 /*-------------------------------------------------------------------------*/
 338
 339 /* Encapsulate the module parameter settings */
 340
 341 #define MAX_LUNS        8
 342
 343         /* Arggh!  There should be a module_param_array_named macro! */
 344 static char             *file[MAX_LUNS];
 345 static int              ro[MAX_LUNS];
 346
 347 static struct {
 348         int             num_filenames;
 349         int             num_ros;
 350         unsigned int    nluns;
 351
 352         int             removable;
 353         int             can_stall;
 354
 355         char            *transport_parm;
 356         char            *protocol_parm;
 357         unsigned short  vendor;
 358         unsigned short  product;
 359         unsigned short  release;
 360         unsigned int    buflen;
 361
 362         int             transport_type;
 363         char            *transport_name;
 364         int             protocol_type;
 365         char            *protocol_name;
 366
 367 } mod_data = {                                  // Default values
 368         .transport_parm         = "BBB",
 369         .protocol_parm          = "SCSI",
 370         .removable              = 0,
 371         .can_stall              = 1,
 372         .vendor                 = DRIVER_VENDOR_ID,
 373         .product                = DRIVER_PRODUCT_ID,
 374         .release                = 0xffff,       // Use controller chip type
 375         .buflen                 = 16384,
 376         };
 377
 378
 379 module_param_array(file, charp, &mod_data.num_filenames, S_IRUGO);
 380 MODULE_PARM_DESC(file, "names of backing files or devices");
 381
 382 module_param_array(ro, bool, &mod_data.num_ros, S_IRUGO);
 383 MODULE_PARM_DESC(ro, "true to force read-only");
 384
 385 module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
 386 MODULE_PARM_DESC(luns, "number of LUNs");
 387
 388 module_param_named(removable, mod_data.removable, bool, S_IRUGO);
 389 MODULE_PARM_DESC(removable, "true to simulate removable media");
 390
 391 module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
 392 MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
 393
 394
 395 /* In the non-TEST version, only the module parameters listed above
 396  * are available. */
 397 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 398
 399 module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
 400 MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
 401
 402 module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
 403 MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
 404                 "8070, or SCSI)");
 405
 406 module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
 407 MODULE_PARM_DESC(vendor, "USB Vendor ID");
 408
 409 module_param_named(product, mod_data.product, ushort, S_IRUGO);
 410 MODULE_PARM_DESC(product, "USB Product ID");
 411
 412 module_param_named(release, mod_data.release, ushort, S_IRUGO);
 413 MODULE_PARM_DESC(release, "USB release number");
 414
 415 module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
 416 MODULE_PARM_DESC(buflen, "I/O buffer size");
 417
 418 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 419
 420
 421 /*-------------------------------------------------------------------------*/
 422
 423 /* USB protocol value = the transport method */
 424 #define USB_PR_CBI      0x00            // Control/Bulk/Interrupt
 425 #define USB_PR_CB       0x01            // Control/Bulk w/o interrupt
 426 #define USB_PR_BULK     0x50            // Bulk-only
 427
 428 /* USB subclass value = the protocol encapsulation */
 429 #define USB_SC_RBC      0x01            // Reduced Block Commands (flash)
 430 #define USB_SC_8020     0x02            // SFF-8020i, MMC-2, ATAPI (CD-ROM)
 431 #define USB_SC_QIC      0x03            // QIC-157 (tape)
 432 #define USB_SC_UFI      0x04            // UFI (floppy)
 433 #define USB_SC_8070     0x05            // SFF-8070i (removable)
 434 #define USB_SC_SCSI     0x06            // Transparent SCSI
 435
 436 /* Bulk-only data structures */
 437
 438 /* Command Block Wrapper */
 439 struct bulk_cb_wrap {
 440         __le32  Signature;              // Contains 'USBC'
 441         u32     Tag;                    // Unique per command id
 442         __le32  DataTransferLength;     // Size of the data
 443         u8      Flags;                  // Direction in bit 7
 444         u8      Lun;                    // LUN (normally 0)
 445         u8      Length;                 // Of the CDB, <= MAX_COMMAND_SIZE
 446         u8      CDB[16];                // Command Data Block
 447 };
 448
 449 #define USB_BULK_CB_WRAP_LEN    31
 450 #define USB_BULK_CB_SIG         0x43425355      // Spells out USBC
 451 #define USB_BULK_IN_FLAG        0x80
 452
 453 /* Command Status Wrapper */
 454 struct bulk_cs_wrap {
 455         __le32  Signature;              // Should = 'USBS'
 456         u32     Tag;                    // Same as original command
 457         __le32  Residue;                // Amount not transferred
 458         u8      Status;                 // See below
 459 };
 460
 461 #define USB_BULK_CS_WRAP_LEN    13
 462 #define USB_BULK_CS_SIG         0x53425355      // Spells out 'USBS'
 463 #define USB_STATUS_PASS         0
 464 #define USB_STATUS_FAIL         1
 465 #define USB_STATUS_PHASE_ERROR  2
 466
 467 /* Bulk-only class specific requests */
 468 #define USB_BULK_RESET_REQUEST          0xff
 469 #define USB_BULK_GET_MAX_LUN_REQUEST    0xfe
 470
 471
 472 /* CBI Interrupt data structure */
 473 struct interrupt_data {
 474         u8      bType;
 475         u8      bValue;
 476 };
 477
 478 #define CBI_INTERRUPT_DATA_LEN          2
 479
 480 /* CBI Accept Device-Specific Command request */
 481 #define USB_CBI_ADSC_REQUEST            0x00
 482
 483
 484 #define MAX_COMMAND_SIZE        16      // Length of a SCSI Command Data Block
 485
 486 /* SCSI commands that we recognize */
 487 #define SC_FORMAT_UNIT                  0x04
 488 #define SC_INQUIRY                      0x12
 489 #define SC_MODE_SELECT_6                0x15
 490 #define SC_MODE_SELECT_10               0x55
 491 #define SC_MODE_SENSE_6                 0x1a
 492 #define SC_MODE_SENSE_10                0x5a
 493 #define SC_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
 494 #define SC_READ_6                       0x08
 495 #define SC_READ_10                      0x28
 496 #define SC_READ_12                      0xa8
 497 #define SC_READ_CAPACITY                0x25
 498 #define SC_READ_FORMAT_CAPACITIES       0x23
 499 #define SC_RELEASE                      0x17
 500 #define SC_REQUEST_SENSE                0x03
 501 #define SC_RESERVE                      0x16
 502 #define SC_SEND_DIAGNOSTIC              0x1d
 503 #define SC_START_STOP_UNIT              0x1b
 504 #define SC_SYNCHRONIZE_CACHE            0x35
 505 #define SC_TEST_UNIT_READY              0x00
 506 #define SC_VERIFY                       0x2f
 507 #define SC_WRITE_6                      0x0a
 508 #define SC_WRITE_10                     0x2a
 509 #define SC_WRITE_12                     0xaa
 510
 511 /* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
 512 #define SS_NO_SENSE                             0
 513 #define SS_COMMUNICATION_FAILURE                0x040800
 514 #define SS_INVALID_COMMAND                      0x052000
 515 #define SS_INVALID_FIELD_IN_CDB                 0x052400
 516 #define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE   0x052100
 517 #define SS_LOGICAL_UNIT_NOT_SUPPORTED           0x052500
 518 #define SS_MEDIUM_NOT_PRESENT                   0x023a00
 519 #define SS_MEDIUM_REMOVAL_PREVENTED             0x055302
 520 #define SS_NOT_READY_TO_READY_TRANSITION        0x062800
 521 #define SS_RESET_OCCURRED                       0x062900
 522 #define SS_SAVING_PARAMETERS_NOT_SUPPORTED      0x053900
 523 #define SS_UNRECOVERED_READ_ERROR               0x031100
 524 #define SS_WRITE_ERROR                          0x030c02
 525 #define SS_WRITE_PROTECTED                      0x072700
 526
 527 #define SK(x)           ((u8) ((x) >> 16))      // Sense Key byte, etc.
 528 #define ASC(x)          ((u8) ((x) >> 8))
 529 #define ASCQ(x)         ((u8) (x))
 530
 531
 532 /*-------------------------------------------------------------------------*/
 533
 534 /*
 535  * These definitions will permit the compiler to avoid generating code for
 536  * parts of the driver that aren't used in the non-TEST version.  Even gcc
 537  * can recognize when a test of a constant expression yields a dead code
 538  * path.
 539  */
 540
 541 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 542
 543 #define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
 544 #define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
 545 #define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
 546
 547 #else
 548
 549 #define transport_is_bbb()      1
 550 #define transport_is_cbi()      0
 551 #define protocol_is_scsi()      1
 552
 553 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 554
 555
 556 struct lun {
 557         struct file     *filp;
 558         loff_t          file_length;
 559         loff_t          num_sectors;
 560
 561         unsigned int    ro : 1;
 562         unsigned int    prevent_medium_removal : 1;
 563         unsigned int    registered : 1;
 564
 565         u32             sense_data;
 566         u32             sense_data_info;
 567         u32             unit_attention_data;
 568
 569         struct device   dev;
 570 };
 571
 572 #define backing_file_is_open(curlun)    ((curlun)->filp != NULL)
 573
 574 static inline struct lun *dev_to_lun(struct device *dev)
 575 {
 576         return container_of(dev, struct lun, dev);
 577 }
 578
 579
 580 /* Big enough to hold our biggest descriptor */
 581 #define EP0_BUFSIZE     256
 582 #define DELAYED_STATUS  (EP0_BUFSIZE + 999)     // An impossibly large value
 583
 584 /* Number of buffers we will use.  2 is enough for double-buffering */
 585 #define NUM_BUFFERS     2
 586
 587 enum fsg_buffer_state {
 588         BUF_STATE_EMPTY = 0,
 589         BUF_STATE_FULL,
 590         BUF_STATE_BUSY
 591 };
 592
 593 struct fsg_buffhd {
 594         void                            *buf;
 595         dma_addr_t                      dma;
 596         enum fsg_buffer_state           state;
 597         struct fsg_buffhd               *next;
 598
 599         /* The NetChip 2280 is faster, and handles some protocol faults
 600          * better, if we don't submit any short bulk-out read requests.
 601          * So we will record the intended request length here. */
 602         unsigned int                    bulk_out_intended_length;
 603
 604         struct usb_request              *inreq;
 605         int                             inreq_busy;
 606         struct usb_request              *outreq;
 607         int                             outreq_busy;
 608 };
 609
 610 enum fsg_state {
 611         FSG_STATE_COMMAND_PHASE = -10,          // This one isn't used anywhere
 612         FSG_STATE_DATA_PHASE,
 613         FSG_STATE_STATUS_PHASE,
 614
 615         FSG_STATE_IDLE = 0,
 616         FSG_STATE_ABORT_BULK_OUT,
 617         FSG_STATE_RESET,
 618         FSG_STATE_INTERFACE_CHANGE,
 619         FSG_STATE_CONFIG_CHANGE,
 620         FSG_STATE_DISCONNECT,
 621         FSG_STATE_EXIT,
 622         FSG_STATE_TERMINATED
 623 };
 624
 625 enum data_direction {
 626         DATA_DIR_UNKNOWN = 0,
 627         DATA_DIR_FROM_HOST,
 628         DATA_DIR_TO_HOST,
 629         DATA_DIR_NONE
 630 };
 631
 632 struct fsg_dev {
 633         /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
 634         spinlock_t              lock;
 635         struct usb_gadget       *gadget;
 636
 637         /* filesem protects: backing files in use */
 638         struct rw_semaphore     filesem;
 639
 640         /* reference counting: wait until all LUNs are released */
 641         struct kref             ref;
 642
 643         struct usb_ep           *ep0;           // Handy copy of gadget->ep0
 644         struct usb_request      *ep0req;        // For control responses
 645         unsigned int            ep0_req_tag;
 646         const char              *ep0req_name;
 647
 648         struct usb_request      *intreq;        // For interrupt responses
 649         int                     intreq_busy;
 650         struct fsg_buffhd       *intr_buffhd;
 651
 652         unsigned int            bulk_out_maxpacket;
 653         enum fsg_state          state;          // For exception handling
 654         unsigned int            exception_req_tag;
 655
 656         u8                      config, new_config;
 657
 658         unsigned int            running : 1;
 659         unsigned int            bulk_in_enabled : 1;
 660         unsigned int            bulk_out_enabled : 1;
 661         unsigned int            intr_in_enabled : 1;
 662         unsigned int            phase_error : 1;
 663         unsigned int            short_packet_received : 1;
 664         unsigned int            bad_lun_okay : 1;
 665
 666         unsigned long           atomic_bitflags;
 667 #define REGISTERED              0
 668 #define CLEAR_BULK_HALTS        1
 669 #define SUSPENDED               2
 670
 671         struct usb_ep           *bulk_in;
 672         struct usb_ep           *bulk_out;
 673         struct usb_ep           *intr_in;
 674
 675         struct fsg_buffhd       *next_buffhd_to_fill;
 676         struct fsg_buffhd       *next_buffhd_to_drain;
 677         struct fsg_buffhd       buffhds[NUM_BUFFERS];
 678
 679         int                     thread_wakeup_needed;
 680         struct completion       thread_notifier;
 681         struct task_struct      *thread_task;
 682         sigset_t                thread_signal_mask;
 683
 684         int                     cmnd_size;
 685         u8                      cmnd[MAX_COMMAND_SIZE];
 686         enum data_direction     data_dir;
 687         u32                     data_size;
 688         u32                     data_size_from_cmnd;
 689         u32                     tag;
 690         unsigned int            lun;
 691         u32                     residue;
 692         u32                     usb_amount_left;
 693
 694         /* The CB protocol offers no way for a host to know when a command
 695          * has completed.  As a result the next command may arrive early,
 696          * and we will still have to handle it.  For that reason we need
 697          * a buffer to store new commands when using CB (or CBI, which
 698          * does not oblige a host to wait for command completion either). */
 699         int                     cbbuf_cmnd_size;
 700         u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
 701
 702         unsigned int            nluns;
 703         struct lun              *luns;
 704         struct lun              *curlun;
 705 };
 706
 707 typedef void (*fsg_routine_t)(struct fsg_dev *);
 708
 709 static int inline exception_in_progress(struct fsg_dev *fsg)
 710 {
 711         return (fsg->state > FSG_STATE_IDLE);
 712 }
 713
 714 /* Make bulk-out requests be divisible by the maxpacket size */
 715 static void inline set_bulk_out_req_length(struct fsg_dev *fsg,
 716                 struct fsg_buffhd *bh, unsigned int length)
 717 {
 718         unsigned int    rem;
 719
 720         bh->bulk_out_intended_length = length;
 721         rem = length % fsg->bulk_out_maxpacket;
 722         if (rem > 0)
 723                 length += fsg->bulk_out_maxpacket - rem;
 724         bh->outreq->length = length;
 725 }
 726
 727 static struct fsg_dev                   *the_fsg;
 728 static struct usb_gadget_driver         fsg_driver;
 729
 730 static void     close_backing_file(struct lun *curlun);
 731 static void     close_all_backing_files(struct fsg_dev *fsg);
 732
 733
 734 /*-------------------------------------------------------------------------*/
 735
 736 #ifdef DUMP_MSGS
 737
 738 static void dump_msg(struct fsg_dev *fsg, const char *label,
 739                 const u8 *buf, unsigned int length)
 740 {
 741         unsigned int    start, num, i;
 742         char            line[52], *p;
 743
 744         if (length >= 512)
 745                 return;
 746         DBG(fsg, "%s, length %u:\n", label, length);
 747
 748         start = 0;
 749         while (length > 0) {
 750                 num = min(length, 16u);
 751                 p = line;
 752                 for (i = 0; i < num; ++i) {
 753                         if (i == 8)
 754                                 *p++ = ' ';
 755                         sprintf(p, " %02x", buf[i]);
 756                         p += 3;
 757                 }
 758                 *p = 0;
 759                 printk(KERN_DEBUG "%6x: %s\n", start, line);
 760                 buf += num;
 761                 start += num;
 762                 length -= num;
 763         }
 764 }
 765
 766 static void inline dump_cdb(struct fsg_dev *fsg)
 767 {}
 768
 769 #else
 770
 771 static void inline dump_msg(struct fsg_dev *fsg, const char *label,
 772                 const u8 *buf, unsigned int length)
 773 {}
 774
 775 static void inline dump_cdb(struct fsg_dev *fsg)
 776 {
 777         int     i;
 778         char    cmdbuf[3*MAX_COMMAND_SIZE + 1];
 779
 780         for (i = 0; i < fsg->cmnd_size; ++i)
 781                 sprintf(cmdbuf + i*3, " %02x", fsg->cmnd[i]);
 782         VDBG(fsg, "SCSI CDB: %s\n", cmdbuf);
 783 }
 784
 785 #endif /* DUMP_MSGS */
 786
 787
 788 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 789 {
 790         const char      *name;
 791
 792         if (ep == fsg->bulk_in)
 793                 name = "bulk-in";
 794         else if (ep == fsg->bulk_out)
 795                 name = "bulk-out";
 796         else
 797                 name = ep->name;
 798         DBG(fsg, "%s set halt\n", name);
 799         return usb_ep_set_halt(ep);
 800 }
 801
 802
 803 /*-------------------------------------------------------------------------*/
 804
 805 /* Routines for unaligned data access */
 806
 807 static u16 inline get_be16(u8 *buf)
 808 {
 809         return ((u16) buf[0] << 8) | ((u16) buf[1]);
 810 }
 811
 812 static u32 inline get_be32(u8 *buf)
 813 {
 814         return ((u32) buf[0] << 24) | ((u32) buf[1] << 16) |
 815                         ((u32) buf[2] << 8) | ((u32) buf[3]);
 816 }
 817
 818 static void inline put_be16(u8 *buf, u16 val)
 819 {
 820         buf[0] = val >> 8;
 821         buf[1] = val;
 822 }
 823
 824 static void inline put_be32(u8 *buf, u32 val)
 825 {
 826         buf[0] = val >> 24;
 827         buf[1] = val >> 16;
 828         buf[2] = val >> 8;
 829         buf[3] = val & 0xff;
 830 }
 831
 832
 833 /*-------------------------------------------------------------------------*/
 834
 835 /*
 836  * DESCRIPTORS ... most are static, but strings and (full) configuration
 837  * descriptors are built on demand.  Also the (static) config and interface
 838  * descriptors are adjusted during fsg_bind().
 839  */
 840 #define STRING_MANUFACTURER     1
 841 #define STRING_PRODUCT          2
 842 #define STRING_SERIAL           3
 843 #define STRING_CONFIG           4
 844 #define STRING_INTERFACE        5
 845
 846 /* There is only one configuration. */
 847 #define CONFIG_VALUE            1
 848
 849 static struct usb_device_descriptor
 850 device_desc = {
 851         .bLength =              sizeof device_desc,
 852         .bDescriptorType =      USB_DT_DEVICE,
 853
 854         .bcdUSB =               __constant_cpu_to_le16(0x0200),
 855         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
 856
 857         /* The next three values can be overridden by module parameters */
 858         .idVendor =             __constant_cpu_to_le16(DRIVER_VENDOR_ID),
 859         .idProduct =            __constant_cpu_to_le16(DRIVER_PRODUCT_ID),
 860         .bcdDevice =            __constant_cpu_to_le16(0xffff),
 861
 862         .iManufacturer =        STRING_MANUFACTURER,
 863         .iProduct =             STRING_PRODUCT,
 864         .iSerialNumber =        STRING_SERIAL,
 865         .bNumConfigurations =   1,
 866 };
 867
 868 static struct usb_config_descriptor
 869 config_desc = {
 870         .bLength =              sizeof config_desc,
 871         .bDescriptorType =      USB_DT_CONFIG,
 872
 873         /* wTotalLength computed by usb_gadget_config_buf() */
 874         .bNumInterfaces =       1,
 875         .bConfigurationValue =  CONFIG_VALUE,
 876         .iConfiguration =       STRING_CONFIG,
 877         .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
 878         .bMaxPower =            1,      // self-powered
 879 };
 880
 881 static struct usb_otg_descriptor
 882 otg_desc = {
 883         .bLength =              sizeof(otg_desc),
 884         .bDescriptorType =      USB_DT_OTG,
 885
 886         .bmAttributes =         USB_OTG_SRP,
 887 };
 888
 889 /* There is only one interface. */
 890
 891 static struct usb_interface_descriptor
 892 intf_desc = {
 893         .bLength =              sizeof intf_desc,
 894         .bDescriptorType =      USB_DT_INTERFACE,
 895
 896         .bNumEndpoints =        2,              // Adjusted during fsg_bind()
 897         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
 898         .bInterfaceSubClass =   USB_SC_SCSI,    // Adjusted during fsg_bind()
 899         .bInterfaceProtocol =   USB_PR_BULK,    // Adjusted during fsg_bind()
 900         .iInterface =           STRING_INTERFACE,
 901 };
 902
 903 /* Three full-speed endpoint descriptors: bulk-in, bulk-out,
 904  * and interrupt-in. */
 905
 906 static struct usb_endpoint_descriptor
 907 fs_bulk_in_desc = {
 908         .bLength =              USB_DT_ENDPOINT_SIZE,
 909         .bDescriptorType =      USB_DT_ENDPOINT,
 910
 911         .bEndpointAddress =     USB_DIR_IN,
 912         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 913         /* wMaxPacketSize set by autoconfiguration */
 914 };
 915
 916 static struct usb_endpoint_descriptor
 917 fs_bulk_out_desc = {
 918         .bLength =              USB_DT_ENDPOINT_SIZE,
 919         .bDescriptorType =      USB_DT_ENDPOINT,
 920
 921         .bEndpointAddress =     USB_DIR_OUT,
 922         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 923         /* wMaxPacketSize set by autoconfiguration */
 924 };
 925
 926 static struct usb_endpoint_descriptor
 927 fs_intr_in_desc = {
 928         .bLength =              USB_DT_ENDPOINT_SIZE,
 929         .bDescriptorType =      USB_DT_ENDPOINT,
 930
 931         .bEndpointAddress =     USB_DIR_IN,
 932         .bmAttributes =         USB_ENDPOINT_XFER_INT,
 933         .wMaxPacketSize =       __constant_cpu_to_le16(2),
 934         .bInterval =            32,     // frames -> 32 ms
 935 };
 936
 937 static const struct usb_descriptor_header *fs_function[] = {
 938         (struct usb_descriptor_header *) &otg_desc,
 939         (struct usb_descriptor_header *) &intf_desc,
 940         (struct usb_descriptor_header *) &fs_bulk_in_desc,
 941         (struct usb_descriptor_header *) &fs_bulk_out_desc,
 942         (struct usb_descriptor_header *) &fs_intr_in_desc,
 943         NULL,
 944 };
 945 #define FS_FUNCTION_PRE_EP_ENTRIES      2
 946
 947
 948 #ifdef  CONFIG_USB_GADGET_DUALSPEED
 949
 950 /*
 951  * USB 2.0 devices need to expose both high speed and full speed
 952  * descriptors, unless they only run at full speed.
 953  *
 954  * That means alternate endpoint descriptors (bigger packets)
 955  * and a "device qualifier" ... plus more construction options
 956  * for the config descriptor.
 957  */
 958 static struct usb_qualifier_descriptor
 959 dev_qualifier = {
 960         .bLength =              sizeof dev_qualifier,
 961         .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
 962
 963         .bcdUSB =               __constant_cpu_to_le16(0x0200),
 964         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
 965
 966         .bNumConfigurations =   1,
 967 };
 968
 969 static struct usb_endpoint_descriptor
 970 hs_bulk_in_desc = {
 971         .bLength =              USB_DT_ENDPOINT_SIZE,
 972         .bDescriptorType =      USB_DT_ENDPOINT,
 973
 974         /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
 975         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 976         .wMaxPacketSize =       __constant_cpu_to_le16(512),
 977 };
 978
 979 static struct usb_endpoint_descriptor
 980 hs_bulk_out_desc = {
 981         .bLength =              USB_DT_ENDPOINT_SIZE,
 982         .bDescriptorType =      USB_DT_ENDPOINT,
 983
 984         /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
 985         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 986         .wMaxPacketSize =       __constant_cpu_to_le16(512),
 987         .bInterval =            1,      // NAK every 1 uframe
 988 };
 989
 990 static struct usb_endpoint_descriptor
 991 hs_intr_in_desc = {
 992         .bLength =              USB_DT_ENDPOINT_SIZE,
 993         .bDescriptorType =      USB_DT_ENDPOINT,
 994
 995         /* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
 996         .bmAttributes =         USB_ENDPOINT_XFER_INT,
 997         .wMaxPacketSize =       __constant_cpu_to_le16(2),
 998         .bInterval =            9,      // 2**(9-1) = 256 uframes -> 32 ms
 999 };
1000
1001 static const struct usb_descriptor_header *hs_function[] = {
1002         (struct usb_descriptor_header *) &otg_desc,
1003         (struct usb_descriptor_header *) &intf_desc,
1004         (struct usb_descriptor_header *) &hs_bulk_in_desc,
1005         (struct usb_descriptor_header *) &hs_bulk_out_desc,
1006         (struct usb_descriptor_header *) &hs_intr_in_desc,
1007         NULL,
1008 };
1009 #define HS_FUNCTION_PRE_EP_ENTRIES      2
1010
1011 /* Maxpacket and other transfer characteristics vary by speed. */
1012 #define ep_desc(g,fs,hs)        (((g)->speed==USB_SPEED_HIGH) ? (hs) : (fs))
1013
1014 #else
1015
1016 /* If there's no high speed support, always use the full-speed descriptor. */
1017 #define ep_desc(g,fs,hs)        fs
1018
1019 #endif  /* !CONFIG_USB_GADGET_DUALSPEED */
1020
1021
1022 /* The CBI specification limits the serial string to 12 uppercase hexadecimal
1023  * characters. */
1024 static char                             manufacturer[64];
1025 static char                             serial[13];
1026
1027 /* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
1028 static struct usb_string                strings[] = {
1029         {STRING_MANUFACTURER,   manufacturer},
1030         {STRING_PRODUCT,        longname},
1031         {STRING_SERIAL,         serial},
1032         {STRING_CONFIG,         "Self-powered"},
1033         {STRING_INTERFACE,      "Mass Storage"},
1034         {}
1035 };
1036
1037 static struct usb_gadget_strings        stringtab = {
1038         .language       = 0x0409,               // en-us
1039         .strings        = strings,
1040 };
1041
1042
1043 /*
1044  * Config descriptors must agree with the code that sets configurations
1045  * and with code managing interfaces and their altsettings.  They must
1046  * also handle different speeds and other-speed requests.
1047  */
1048 static int populate_config_buf(struct usb_gadget *gadget,
1049                 u8 *buf, u8 type, unsigned index)
1050 {
1051 #ifdef CONFIG_USB_GADGET_DUALSPEED
1052         enum usb_device_speed                   speed = gadget->speed;
1053 #endif
1054         int                                     len;
1055         const struct usb_descriptor_header      **function;
1056
1057         if (index > 0)
1058                 return -EINVAL;
1059
1060 #ifdef CONFIG_USB_GADGET_DUALSPEED
1061         if (type == USB_DT_OTHER_SPEED_CONFIG)
1062                 speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
1063         if (speed == USB_SPEED_HIGH)
1064                 function = hs_function;
1065         else
1066 #endif
1067                 function = fs_function;
1068
1069         /* for now, don't advertise srp-only devices */
1070         if (!gadget->is_otg)
1071                 function++;
1072
1073         len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
1074         ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
1075         return len;
1076 }
1077
1078
1079 /*-------------------------------------------------------------------------*/
1080
1081 /* These routines may be called in process context or in_irq */
1082
1083 /* Caller must hold fsg->lock */
1084 static void wakeup_thread(struct fsg_dev *fsg)
1085 {
1086         /* Tell the main thread that something has happened */
1087         fsg->thread_wakeup_needed = 1;
1088         if (fsg->thread_task)
1089                 wake_up_process(fsg->thread_task);
1090 }
1091
1092
1093 static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
1094 {
1095         unsigned long           flags;
1096
1097         /* Do nothing if a higher-priority exception is already in progress.
1098          * If a lower-or-equal priority exception is in progress, preempt it
1099          * and notify the main thread by sending it a signal. */
1100         spin_lock_irqsave(&fsg->lock, flags);
1101         if (fsg->state <= new_state) {
1102                 fsg->exception_req_tag = fsg->ep0_req_tag;
1103                 fsg->state = new_state;
1104                 if (fsg->thread_task)
1105                         send_sig_info(SIGUSR1, SEND_SIG_FORCED,
1106                                         fsg->thread_task);
1107         }
1108         spin_unlock_irqrestore(&fsg->lock, flags);
1109 }
1110
1111
1112 /*-------------------------------------------------------------------------*/
1113
1114 /* The disconnect callback and ep0 routines.  These always run in_irq,
1115  * except that ep0_queue() is called in the main thread to acknowledge
1116  * completion of various requests: set config, set interface, and
1117  * Bulk-only device reset. */
1118
1119 static void fsg_disconnect(struct usb_gadget *gadget)
1120 {
1121         struct fsg_dev          *fsg = get_gadget_data(gadget);
1122
1123         DBG(fsg, "disconnect or port reset\n");
1124         raise_exception(fsg, FSG_STATE_DISCONNECT);
1125 }
1126
1127
1128 static int ep0_queue(struct fsg_dev *fsg)
1129 {
1130         int     rc;
1131
1132         rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
1133         if (rc != 0 && rc != -ESHUTDOWN) {
1134
1135                 /* We can't do much more than wait for a reset */
1136                 WARN(fsg, "error in submission: %s --> %d\n",
1137                                 fsg->ep0->name, rc);
1138         }
1139         return rc;
1140 }
1141
1142 static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
1143 {
1144         struct fsg_dev          *fsg = (struct fsg_dev *) ep->driver_data;
1145
1146         if (req->actual > 0)
1147                 dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
1148         if (req->status || req->actual != req->length)
1149                 DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
1150                                 req->status, req->actual, req->length);
1151         if (req->status == -ECONNRESET)         // Request was cancelled
1152                 usb_ep_fifo_flush(ep);
1153
1154         if (req->status == 0 && req->context)
1155                 ((fsg_routine_t) (req->context))(fsg);
1156 }
1157
1158
1159 /*-------------------------------------------------------------------------*/
1160
1161 /* Bulk and interrupt endpoint completion handlers.
1162  * These always run in_irq. */
1163
1164 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
1165 {
1166         struct fsg_dev          *fsg = (struct fsg_dev *) ep->driver_data;
1167         struct fsg_buffhd       *bh = (struct fsg_buffhd *) req->context;
1168
1169         if (req->status || req->actual != req->length)
1170                 DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
1171                                 req->status, req->actual, req->length);
1172         if (req->status == -ECONNRESET)         // Request was cancelled
1173                 usb_ep_fifo_flush(ep);
1174
1175         /* Hold the lock while we update the request and buffer states */
1176         smp_wmb();
1177         spin_lock(&fsg->lock);
1178         bh->inreq_busy = 0;
1179         bh->state = BUF_STATE_EMPTY;
1180         wakeup_thread(fsg);
1181         spin_unlock(&fsg->lock);
1182 }
1183
1184 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
1185 {
1186         struct fsg_dev          *fsg = (struct fsg_dev *) ep->driver_data;
1187         struct fsg_buffhd       *bh = (struct fsg_buffhd *) req->context;
1188
1189         dump_msg(fsg, "bulk-out", req->buf, req->actual);
1190         if (req->status || req->actual != bh->bulk_out_intended_length)
1191                 DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
1192                                 req->status, req->actual,
1193                                 bh->bulk_out_intended_length);
1194         if (req->status == -ECONNRESET)         // Request was cancelled
1195                 usb_ep_fifo_flush(ep);
1196
1197         /* Hold the lock while we update the request and buffer states */
1198         smp_wmb();
1199         spin_lock(&fsg->lock);
1200         bh->outreq_busy = 0;
1201         bh->state = BUF_STATE_FULL;
1202         wakeup_thread(fsg);
1203         spin_unlock(&fsg->lock);
1204 }
1205
1206
1207 #ifdef CONFIG_USB_FILE_STORAGE_TEST
1208 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1209 {
1210         struct fsg_dev          *fsg = (struct fsg_dev *) ep->driver_data;
1211         struct fsg_buffhd       *bh = (struct fsg_buffhd *) req->context;
1212
1213         if (req->status || req->actual != req->length)
1214                 DBG(fsg, "%s --> %d, %u/%u\n", __FUNCTION__,
1215                                 req->status, req->actual, req->length);
1216         if (req->status == -ECONNRESET)         // Request was cancelled
1217                 usb_ep_fifo_flush(ep);
1218
1219         /* Hold the lock while we update the request and buffer states */
1220         smp_wmb();
1221         spin_lock(&fsg->lock);
1222         fsg->intreq_busy = 0;
1223         bh->state = BUF_STATE_EMPTY;
1224         wakeup_thread(fsg);
1225         spin_unlock(&fsg->lock);
1226 }
1227
1228 #else
1229 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
1230 {}
1231 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
1232
1233
1234 /*-------------------------------------------------------------------------*/
1235
1236 /* Ep0 class-specific handlers.  These always run in_irq. */
1237
1238 #ifdef CONFIG_USB_FILE_STORAGE_TEST
1239 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1240 {
1241         struct usb_request      *req = fsg->ep0req;
1242         static u8               cbi_reset_cmnd[6] = {
1243                         SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
1244
1245         /* Error in command transfer? */
1246         if (req->status || req->length != req->actual ||
1247                         req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
1248
1249                 /* Not all controllers allow a protocol stall after
1250                  * receiving control-out data, but we'll try anyway. */
1251                 fsg_set_halt(fsg, fsg->ep0);
1252                 return;                 // Wait for reset
1253         }
1254
1255         /* Is it the special reset command? */
1256         if (req->actual >= sizeof cbi_reset_cmnd &&
1257                         memcmp(req->buf, cbi_reset_cmnd,
1258                                 sizeof cbi_reset_cmnd) == 0) {
1259
1260                 /* Raise an exception to stop the current operation
1261                  * and reinitialize our state. */
1262                 DBG(fsg, "cbi reset request\n");
1263                 raise_exception(fsg, FSG_STATE_RESET);
1264                 return;
1265         }
1266
1267         VDBG(fsg, "CB[I] accept device-specific command\n");
1268         spin_lock(&fsg->lock);
1269
1270         /* Save the command for later */
1271         if (fsg->cbbuf_cmnd_size)
1272                 WARN(fsg, "CB[I] overwriting previous command\n");
1273         fsg->cbbuf_cmnd_size = req->actual;
1274         memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
1275
1276         wakeup_thread(fsg);
1277         spin_unlock(&fsg->lock);
1278 }
1279
1280 #else
1281 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1282 {}
1283 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
1284
1285
1286 static int class_setup_req(struct fsg_dev *fsg,
1287                 const struct usb_ctrlrequest *ctrl)
1288 {
1289         struct usb_request      *req = fsg->ep0req;
1290         int                     value = -EOPNOTSUPP;
1291         u16                     w_index = le16_to_cpu(ctrl->wIndex);
1292         u16                     w_length = le16_to_cpu(ctrl->wLength);
1293
1294         if (!fsg->config)
1295                 return value;
1296
1297         /* Handle Bulk-only class-specific requests */
1298         if (transport_is_bbb()) {
1299                 switch (ctrl->bRequest) {
1300
1301                 case USB_BULK_RESET_REQUEST:
1302                         if (ctrl->bRequestType != (USB_DIR_OUT |
1303                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1304                                 break;
1305                         if (w_index != 0) {
1306                                 value = -EDOM;
1307                                 break;
1308                         }
1309
1310                         /* Raise an exception to stop the current operation
1311                          * and reinitialize our state. */
1312                         DBG(fsg, "bulk reset request\n");
1313                         raise_exception(fsg, FSG_STATE_RESET);
1314                         value = DELAYED_STATUS;
1315                         break;
1316
1317                 case USB_BULK_GET_MAX_LUN_REQUEST:
1318                         if (ctrl->bRequestType != (USB_DIR_IN |
1319                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1320                                 break;
1321                         if (w_index != 0) {
1322                                 value = -EDOM;
1323                                 break;
1324                         }
1325                         VDBG(fsg, "get max LUN\n");
1326                         *(u8 *) req->buf = fsg->nluns - 1;
1327                         value = 1;
1328                         break;
1329                 }
1330         }
1331
1332         /* Handle CBI class-specific requests */
1333         else {
1334                 switch (ctrl->bRequest) {
1335
1336                 case USB_CBI_ADSC_REQUEST:
1337                         if (ctrl->bRequestType != (USB_DIR_OUT |
1338                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1339                                 break;
1340                         if (w_index != 0) {
1341                                 value = -EDOM;
1342                                 break;
1343                         }
1344                         if (w_length > MAX_COMMAND_SIZE) {
1345                                 value = -EOVERFLOW;
1346                                 break;
1347                         }
1348                         value = w_length;
1349                         fsg->ep0req->context = received_cbi_adsc;
1350                         break;
1351                 }
1352         }
1353
1354         if (value == -EOPNOTSUPP)
1355                 VDBG(fsg,
1356                         "unknown class-specific control req "
1357                         "%02x.%02x v%04x i%04x l%u\n",
1358                         ctrl->bRequestType, ctrl->bRequest,
1359                         le16_to_cpu(ctrl->wValue), w_index, w_length);
1360         return value;
1361 }
1362
1363
1364 /*-------------------------------------------------------------------------*/
1365
1366 /* Ep0 standard request handlers.  These always run in_irq. */
1367
1368 static int standard_setup_req(struct fsg_dev *fsg,
1369                 const struct usb_ctrlrequest *ctrl)
1370 {
1371         struct usb_request      *req = fsg->ep0req;
1372         int                     value = -EOPNOTSUPP;
1373         u16                     w_index = le16_to_cpu(ctrl->wIndex);
1374         u16                     w_value = le16_to_cpu(ctrl->wValue);
1375
1376         /* Usually this just stores reply data in the pre-allocated ep0 buffer,
1377          * but config change events will also reconfigure hardware. */
1378         switch (ctrl->bRequest) {
1379
1380         case USB_REQ_GET_DESCRIPTOR:
1381                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1382                                 USB_RECIP_DEVICE))
1383                         break;
1384                 switch (w_value >> 8) {
1385
1386                 case USB_DT_DEVICE:
1387                         VDBG(fsg, "get device descriptor\n");
1388                         value = sizeof device_desc;
1389                         memcpy(req->buf, &device_desc, value);
1390                         break;
1391 #ifdef CONFIG_USB_GADGET_DUALSPEED
1392                 case USB_DT_DEVICE_QUALIFIER:
1393                         VDBG(fsg, "get device qualifier\n");
1394                         if (!fsg->gadget->is_dualspeed)
1395                                 break;
1396                         value = sizeof dev_qualifier;
1397                         memcpy(req->buf, &dev_qualifier, value);
1398                         break;
1399
1400                 case USB_DT_OTHER_SPEED_CONFIG:
1401                         VDBG(fsg, "get other-speed config descriptor\n");
1402                         if (!fsg->gadget->is_dualspeed)
1403                                 break;
1404                         goto get_config;
1405 #endif
1406                 case USB_DT_CONFIG:
1407                         VDBG(fsg, "get configuration descriptor\n");
1408 #ifdef CONFIG_USB_GADGET_DUALSPEED
1409                 get_config:
1410 #endif
1411                         value = populate_config_buf(fsg->gadget,
1412                                         req->buf,
1413                                         w_value >> 8,
1414                                         w_value & 0xff);
1415                         break;
1416
1417                 case USB_DT_STRING:
1418                         VDBG(fsg, "get string descriptor\n");
1419
1420                         /* wIndex == language code */
1421                         value = usb_gadget_get_string(&stringtab,
1422                                         w_value & 0xff, req->buf);
1423                         break;
1424                 }
1425                 break;
1426
1427         /* One config, two speeds */
1428         case USB_REQ_SET_CONFIGURATION:
1429                 if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
1430                                 USB_RECIP_DEVICE))
1431                         break;
1432                 VDBG(fsg, "set configuration\n");
1433                 if (w_value == CONFIG_VALUE || w_value == 0) {
1434                         fsg->new_config = w_value;
1435
1436                         /* Raise an exception to wipe out previous transaction
1437                          * state (queued bufs, etc) and set the new config. */
1438                         raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
1439                         value = DELAYED_STATUS;
1440                 }
1441                 break;
1442         case USB_REQ_GET_CONFIGURATION:
1443                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1444                                 USB_RECIP_DEVICE))
1445                         break;
1446                 VDBG(fsg, "get configuration\n");
1447                 *(u8 *) req->buf = fsg->config;
1448                 value = 1;
1449                 break;
1450
1451         case USB_REQ_SET_INTERFACE:
1452                 if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
1453                                 USB_RECIP_INTERFACE))
1454                         break;
1455                 if (fsg->config && w_index == 0) {
1456
1457                         /* Raise an exception to wipe out previous transaction
1458                          * state (queued bufs, etc) and install the new
1459                          * interface altsetting. */
1460                         raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
1461                         value = DELAYED_STATUS;
1462                 }
1463                 break;
1464         case USB_REQ_GET_INTERFACE:
1465                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1466                                 USB_RECIP_INTERFACE))
1467                         break;
1468                 if (!fsg->config)
1469                         break;
1470                 if (w_index != 0) {
1471                         value = -EDOM;
1472                         break;
1473                 }
1474                 VDBG(fsg, "get interface\n");
1475                 *(u8 *) req->buf = 0;
1476                 value = 1;
1477                 break;
1478
1479         default:
1480                 VDBG(fsg,
1481                         "unknown control req %02x.%02x v%04x i%04x l%u\n",
1482                         ctrl->bRequestType, ctrl->bRequest,
1483                         w_value, w_index, le16_to_cpu(ctrl->wLength));
1484         }
1485
1486         return value;
1487 }
1488
1489
1490 static int fsg_setup(struct usb_gadget *gadget,
1491                 const struct usb_ctrlrequest *ctrl)
1492 {
1493         struct fsg_dev          *fsg = get_gadget_data(gadget);
1494         int                     rc;
1495         int                     w_length = le16_to_cpu(ctrl->wLength);
1496
1497         ++fsg->ep0_req_tag;             // Record arrival of a new request
1498         fsg->ep0req->context = NULL;
1499         fsg->ep0req->length = 0;
1500         dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
1501
1502         if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
1503                 rc = class_setup_req(fsg, ctrl);
1504         else
1505                 rc = standard_setup_req(fsg, ctrl);
1506
1507         /* Respond with data/status or defer until later? */
1508         if (rc >= 0 && rc != DELAYED_STATUS) {
1509                 rc = min(rc, w_length);
1510                 fsg->ep0req->length = rc;
1511                 fsg->ep0req->zero = rc < w_length;
1512                 fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
1513                                 "ep0-in" : "ep0-out");
1514                 rc = ep0_queue(fsg);
1515         }
1516
1517         /* Device either stalls (rc < 0) or reports success */
1518         return rc;
1519 }
1520
1521
1522 /*-------------------------------------------------------------------------*/
1523
1524 /* All the following routines run in process context */
1525
1526
1527 /* Use this for bulk or interrupt transfers, not ep0 */
1528 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
1529                 struct usb_request *req, int *pbusy,
1530                 enum fsg_buffer_state *state)
1531 {
1532         int     rc;
1533
1534         if (ep == fsg->bulk_in)
1535                 dump_msg(fsg, "bulk-in", req->buf, req->length);
1536         else if (ep == fsg->intr_in)
1537                 dump_msg(fsg, "intr-in", req->buf, req->length);
1538
1539         spin_lock_irq(&fsg->lock);
1540         *pbusy = 1;
1541         *state = BUF_STATE_BUSY;
1542         spin_unlock_irq(&fsg->lock);
1543         rc = usb_ep_queue(ep, req, GFP_KERNEL);
1544         if (rc != 0) {
1545                 *pbusy = 0;
1546                 *state = BUF_STATE_EMPTY;
1547
1548                 /* We can't do much more than wait for a reset */
1549
1550                 /* Note: currently the net2280 driver fails zero-length
1551                  * submissions if DMA is enabled. */
1552                 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
1553                                                 req->length == 0))
1554                         WARN(fsg, "error in submission: %s --> %d\n",
1555                                         ep->name, rc);
1556         }
1557 }
1558
1559
1560 static int sleep_thread(struct fsg_dev *fsg)
1561 {
1562         int     rc = 0;
1563
1564         /* Wait until a signal arrives or we are woken up */
1565         for (;;) {
1566                 try_to_freeze();
1567                 set_current_state(TASK_INTERRUPTIBLE);
1568                 if (signal_pending(current)) {
1569                         rc = -EINTR;
1570                         break;
1571                 }
1572                 if (fsg->thread_wakeup_needed)
1573                         break;
1574                 schedule();
1575         }
1576         __set_current_state(TASK_RUNNING);
1577         fsg->thread_wakeup_needed = 0;
1578         return rc;
1579 }
1580
1581
1582 /*-------------------------------------------------------------------------*/
1583
1584 static int do_read(struct fsg_dev *fsg)
1585 {
1586         struct lun              *curlun = fsg->curlun;
1587         u32                     lba;
1588         struct fsg_buffhd       *bh;
1589         int                     rc;
1590         u32                     amount_left;
1591         loff_t                  file_offset, file_offset_tmp;
1592         unsigned int            amount;
1593         unsigned int            partial_page;
1594         ssize_t                 nread;
1595
1596         /* Get the starting Logical Block Address and check that it's
1597          * not too big */
1598         if (fsg->cmnd[0] == SC_READ_6)
1599                 lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
1600         else {
1601                 lba = get_be32(&fsg->cmnd[2]);
1602
1603                 /* We allow DPO (Disable Page Out = don't save data in the
1604                  * cache) and FUA (Force Unit Access = don't read from the
1605                  * cache), but we don't implement them. */
1606                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1607                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1608                         return -EINVAL;
1609                 }
1610         }
1611         if (lba >= curlun->num_sectors) {
1612                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1613                 return -EINVAL;
1614         }
1615         file_offset = ((loff_t) lba) << 9;
1616
1617         /* Carry out the file reads */
1618         amount_left = fsg->data_size_from_cmnd;
1619         if (unlikely(amount_left == 0))
1620                 return -EIO;            // No default reply
1621
1622         for (;;) {
1623
1624                 /* Figure out how much we need to read:
1625                  * Try to read the remaining amount.
1626                  * But don't read more than the buffer size.
1627                  * And don't try to read past the end of the file.
1628                  * Finally, if we're not at a page boundary, don't read past
1629                  *      the next page.
1630                  * If this means reading 0 then we were asked to read past
1631                  *      the end of file. */
1632                 amount = min((unsigned int) amount_left, mod_data.buflen);
1633                 amount = min((loff_t) amount,
1634                                 curlun->file_length - file_offset);
1635                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
1636                 if (partial_page > 0)
1637                         amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
1638                                         partial_page);
1639
1640                 /* Wait for the next buffer to become available */
1641                 bh = fsg->next_buffhd_to_fill;
1642                 while (bh->state != BUF_STATE_EMPTY) {
1643                         if ((rc = sleep_thread(fsg)) != 0)
1644                                 return rc;
1645                 }
1646
1647                 /* If we were asked to read past the end of file,
1648                  * end with an empty buffer. */
1649                 if (amount == 0) {
1650                         curlun->sense_data =
1651                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1652                         curlun->sense_data_info = file_offset >> 9;
1653                         bh->inreq->length = 0;
1654                         bh->state = BUF_STATE_FULL;
1655                         break;
1656                 }
1657
1658                 /* Perform the read */
1659                 file_offset_tmp = file_offset;
1660                 nread = vfs_read(curlun->filp,
1661                                 (char __user *) bh->buf,
1662                                 amount, &file_offset_tmp);
1663                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1664                                 (unsigned long long) file_offset,
1665                                 (int) nread);
1666                 if (signal_pending(current))
1667                         return -EINTR;
1668
1669                 if (nread < 0) {
1670                         LDBG(curlun, "error in file read: %d\n",
1671                                         (int) nread);
1672                         nread = 0;
1673                 } else if (nread < amount) {
1674                         LDBG(curlun, "partial file read: %d/%u\n",
1675                                         (int) nread, amount);
1676                         nread -= (nread & 511); // Round down to a block
1677                 }
1678                 file_offset  += nread;
1679                 amount_left  -= nread;
1680                 fsg->residue -= nread;
1681                 bh->inreq->length = nread;
1682                 bh->state = BUF_STATE_FULL;
1683
1684                 /* If an error occurred, report it and its position */
1685                 if (nread < amount) {
1686                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1687                         curlun->sense_data_info = file_offset >> 9;
1688                         break;
1689                 }
1690
1691                 if (amount_left == 0)
1692                         break;          // No more left to read
1693
1694                 /* Send this buffer and go read some more */
1695                 bh->inreq->zero = 0;
1696                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1697                                 &bh->inreq_busy, &bh->state);
1698                 fsg->next_buffhd_to_fill = bh->next;
1699         }
1700
1701         return -EIO;            // No default reply
1702 }
1703
1704
1705 /*-------------------------------------------------------------------------*/
1706
1707 static int do_write(struct fsg_dev *fsg)
1708 {
1709         struct lun              *curlun = fsg->curlun;
1710         u32                     lba;
1711         struct fsg_buffhd       *bh;
1712         int                     get_some_more;
1713         u32                     amount_left_to_req, amount_left_to_write;
1714         loff_t                  usb_offset, file_offset, file_offset_tmp;
1715         unsigned int            amount;
1716         unsigned int            partial_page;
1717         ssize_t                 nwritten;
1718         int                     rc;
1719
1720         if (curlun->ro) {
1721                 curlun->sense_data = SS_WRITE_PROTECTED;
1722                 return -EINVAL;
1723         }
1724         curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
1725
1726         /* Get the starting Logical Block Address and check that it's
1727          * not too big */
1728         if (fsg->cmnd[0] == SC_WRITE_6)
1729                 lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
1730         else {
1731                 lba = get_be32(&fsg->cmnd[2]);
1732
1733                 /* We allow DPO (Disable Page Out = don't save data in the
1734                  * cache) and FUA (Force Unit Access = write directly to the
1735                  * medium).  We don't implement DPO; we implement FUA by
1736                  * performing synchronous output. */
1737                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1738                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1739                         return -EINVAL;
1740                 }
1741                 if (fsg->cmnd[1] & 0x08)        // FUA
1742                         curlun->filp->f_flags |= O_SYNC;
1743         }
1744         if (lba >= curlun->num_sectors) {
1745                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1746                 return -EINVAL;
1747         }
1748
1749         /* Carry out the file writes */
1750         get_some_more = 1;
1751         file_offset = usb_offset = ((loff_t) lba) << 9;
1752         amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
1753
1754         while (amount_left_to_write > 0) {
1755
1756                 /* Queue a request for more data from the host */
1757                 bh = fsg->next_buffhd_to_fill;
1758                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
1759
1760                         /* Figure out how much we want to get:
1761                          * Try to get the remaining amount.
1762                          * But don't get more than the buffer size.
1763                          * And don't try to go past the end of the file.
1764                          * If we're not at a page boundary,
1765                          *      don't go past the next page.
1766                          * If this means getting 0, then we were asked
1767                          *      to write past the end of file.
1768                          * Finally, round down to a block boundary. */
1769                         amount = min(amount_left_to_req, mod_data.buflen);
1770                         amount = min((loff_t) amount, curlun->file_length -
1771                                         usb_offset);
1772                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
1773                         if (partial_page > 0)
1774                                 amount = min(amount,
1775         (unsigned int) PAGE_CACHE_SIZE - partial_page);
1776
1777                         if (amount == 0) {
1778                                 get_some_more = 0;
1779                                 curlun->sense_data =
1780                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1781                                 curlun->sense_data_info = usb_offset >> 9;
1782                                 continue;
1783                         }
1784                         amount -= (amount & 511);
1785                         if (amount == 0) {
1786
1787                                 /* Why were we were asked to transfer a
1788                                  * partial block? */
1789                                 get_some_more = 0;
1790                                 continue;
1791                         }
1792
1793                         /* Get the next buffer */
1794                         usb_offset += amount;
1795                         fsg->usb_amount_left -= amount;
1796                         amount_left_to_req -= amount;
1797                         if (amount_left_to_req == 0)
1798                                 get_some_more = 0;
1799
1800                         /* amount is always divisible by 512, hence by
1801                          * the bulk-out maxpacket size */
1802                         bh->outreq->length = bh->bulk_out_intended_length =
1803                                         amount;
1804                         bh->outreq->short_not_ok = 1;
1805                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
1806                                         &bh->outreq_busy, &bh->state);
1807                         fsg->next_buffhd_to_fill = bh->next;
1808                         continue;
1809                 }
1810
1811                 /* Write the received data to the backing file */
1812                 bh = fsg->next_buffhd_to_drain;
1813                 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
1814                         break;                  // We stopped early
1815                 if (bh->state == BUF_STATE_FULL) {
1816                         smp_rmb();
1817                         fsg->next_buffhd_to_drain = bh->next;
1818                         bh->state = BUF_STATE_EMPTY;
1819
1820                         /* Did something go wrong with the transfer? */
1821                         if (bh->outreq->status != 0) {
1822                                 curlun->sense_data = SS_COMMUNICATION_FAILURE;
1823                                 curlun->sense_data_info = file_offset >> 9;
1824                                 break;
1825                         }
1826
1827                         amount = bh->outreq->actual;
1828                         if (curlun->file_length - file_offset < amount) {
1829                                 LERROR(curlun,
1830         "write %u @ %llu beyond end %llu\n",
1831         amount, (unsigned long long) file_offset,
1832         (unsigned long long) curlun->file_length);
1833                                 amount = curlun->file_length - file_offset;
1834                         }
1835
1836                         /* Perform the write */
1837                         file_offset_tmp = file_offset;
1838                         nwritten = vfs_write(curlun->filp,
1839                                         (char __user *) bh->buf,
1840                                         amount, &file_offset_tmp);
1841                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
1842                                         (unsigned long long) file_offset,
1843                                         (int) nwritten);
1844                         if (signal_pending(current))
1845                                 return -EINTR;          // Interrupted!
1846
1847                         if (nwritten < 0) {
1848                                 LDBG(curlun, "error in file write: %d\n",
1849                                                 (int) nwritten);
1850                                 nwritten = 0;
1851                         } else if (nwritten < amount) {
1852                                 LDBG(curlun, "partial file write: %d/%u\n",
1853                                                 (int) nwritten, amount);
1854                                 nwritten -= (nwritten & 511);
1855                                                 // Round down to a block
1856                         }
1857                         file_offset += nwritten;
1858                         amount_left_to_write -= nwritten;
1859                         fsg->residue -= nwritten;
1860
1861                         /* If an error occurred, report it and its position */
1862                         if (nwritten < amount) {
1863                                 curlun->sense_data = SS_WRITE_ERROR;
1864                                 curlun->sense_data_info = file_offset >> 9;
1865                                 break;
1866                         }
1867
1868                         /* Did the host decide to stop early? */
1869                         if (bh->outreq->actual != bh->outreq->length) {
1870                                 fsg->short_packet_received = 1;
1871                                 break;
1872                         }
1873                         continue;
1874                 }
1875
1876                 /* Wait for something to happen */
1877                 if ((rc = sleep_thread(fsg)) != 0)
1878                         return rc;
1879         }
1880
1881         return -EIO;            // No default reply
1882 }
1883
1884
1885 /*-------------------------------------------------------------------------*/
1886
1887 /* Sync the file data, don't bother with the metadata.
1888  * This code was copied from fs/buffer.c:sys_fdatasync(). */
1889 static int fsync_sub(struct lun *curlun)
1890 {
1891         struct file     *filp = curlun->filp;
1892         struct inode    *inode;
1893         int             rc, err;
1894
1895         if (curlun->ro || !filp)
1896                 return 0;
1897         if (!filp->f_op->fsync)
1898                 return -EINVAL;
1899
1900         inode = filp->f_dentry->d_inode;
1901         mutex_lock(&inode->i_mutex);
1902         current->flags |= PF_SYNCWRITE;
1903         rc = filemap_fdatawrite(inode->i_mapping);
1904         err = filp->f_op->fsync(filp, filp->f_dentry, 1);
1905         if (!rc)
1906                 rc = err;
1907         err = filemap_fdatawait(inode->i_mapping);
1908         if (!rc)
1909                 rc = err;
1910         current->flags &= ~PF_SYNCWRITE;
1911         mutex_unlock(&inode->i_mutex);
1912         VLDBG(curlun, "fdatasync -> %d\n", rc);
1913         return rc;
1914 }
1915
1916 static void fsync_all(struct fsg_dev *fsg)
1917 {
1918         int     i;
1919
1920         for (i = 0; i < fsg->nluns; ++i)
1921                 fsync_sub(&fsg->luns[i]);
1922 }
1923
1924 static int do_synchronize_cache(struct fsg_dev *fsg)
1925 {
1926         struct lun      *curlun = fsg->curlun;
1927         int             rc;
1928
1929         /* We ignore the requested LBA and write out all file's
1930          * dirty data buffers. */
1931         rc = fsync_sub(curlun);
1932         if (rc)
1933                 curlun->sense_data = SS_WRITE_ERROR;
1934         return 0;
1935 }
1936
1937
1938 /*-------------------------------------------------------------------------*/
1939
1940 static void invalidate_sub(struct lun *curlun)
1941 {
1942         struct file     *filp = curlun->filp;
1943         struct inode    *inode = filp->f_dentry->d_inode;
1944         unsigned long   rc;
1945
1946         rc = invalidate_inode_pages(inode->i_mapping);
1947         VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
1948 }
1949
1950 static int do_verify(struct fsg_dev *fsg)
1951 {
1952         struct lun              *curlun = fsg->curlun;
1953         u32                     lba;
1954         u32                     verification_length;
1955         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
1956         loff_t                  file_offset, file_offset_tmp;
1957         u32                     amount_left;
1958         unsigned int            amount;
1959         ssize_t                 nread;
1960
1961         /* Get the starting Logical Block Address and check that it's
1962          * not too big */
1963         lba = get_be32(&fsg->cmnd[2]);
1964         if (lba >= curlun->num_sectors) {
1965                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1966                 return -EINVAL;
1967         }
1968
1969         /* We allow DPO (Disable Page Out = don't save data in the
1970          * cache) but we don't implement it. */
1971         if ((fsg->cmnd[1] & ~0x10) != 0) {
1972                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1973                 return -EINVAL;
1974         }
1975
1976         verification_length = get_be16(&fsg->cmnd[7]);
1977         if (unlikely(verification_length == 0))
1978                 return -EIO;            // No default reply
1979
1980         /* Prepare to carry out the file verify */
1981         amount_left = verification_length << 9;
1982         file_offset = ((loff_t) lba) << 9;
1983
1984         /* Write out all the dirty buffers before invalidating them */
1985         fsync_sub(curlun);
1986         if (signal_pending(current))
1987                 return -EINTR;
1988
1989         invalidate_sub(curlun);
1990         if (signal_pending(current))
1991                 return -EINTR;
1992
1993         /* Just try to read the requested blocks */
1994         while (amount_left > 0) {
1995
1996                 /* Figure out how much we need to read:
1997                  * Try to read the remaining amount, but not more than
1998                  * the buffer size.
1999                  * And don't try to read past the end of the file.
2000                  * If this means reading 0 then we were asked to read
2001                  * past the end of file. */
2002                 amount = min((unsigned int) amount_left, mod_data.buflen);
2003                 amount = min((loff_t) amount,
2004                                 curlun->file_length - file_offset);
2005                 if (amount == 0) {
2006                         curlun->sense_data =
2007                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2008                         curlun->sense_data_info = file_offset >> 9;
2009                         break;
2010                 }
2011
2012                 /* Perform the read */
2013                 file_offset_tmp = file_offset;
2014                 nread = vfs_read(curlun->filp,
2015                                 (char __user *) bh->buf,
2016                                 amount, &file_offset_tmp);
2017                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2018                                 (unsigned long long) file_offset,
2019                                 (int) nread);
2020                 if (signal_pending(current))
2021                         return -EINTR;
2022
2023                 if (nread < 0) {
2024                         LDBG(curlun, "error in file verify: %d\n",
2025                                         (int) nread);
2026                         nread = 0;
2027                 } else if (nread < amount) {
2028                         LDBG(curlun, "partial file verify: %d/%u\n",
2029                                         (int) nread, amount);
2030                         nread -= (nread & 511); // Round down to a sector
2031                 }
2032                 if (nread == 0) {
2033                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2034                         curlun->sense_data_info = file_offset >> 9;
2035                         break;
2036                 }
2037                 file_offset += nread;
2038                 amount_left -= nread;
2039         }
2040         return 0;
2041 }
2042
2043
2044 /*-------------------------------------------------------------------------*/
2045
2046 static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2047 {
2048         u8      *buf = (u8 *) bh->buf;
2049
2050         static char vendor_id[] = "Linux   ";
2051         static char product_id[] = "File-Stor Gadget";
2052
2053         if (!fsg->curlun) {             // Unsupported LUNs are okay
2054                 fsg->bad_lun_okay = 1;
2055                 memset(buf, 0, 36);
2056                 buf[0] = 0x7f;          // Unsupported, no device-type
2057                 return 36;
2058         }
2059
2060         memset(buf, 0, 8);      // Non-removable, direct-access device
2061         if (mod_data.removable)
2062                 buf[1] = 0x80;
2063         buf[2] = 2;             // ANSI SCSI level 2
2064         buf[3] = 2;             // SCSI-2 INQUIRY data format
2065         buf[4] = 31;            // Additional length
2066                                 // No special options
2067         sprintf(buf + 8, "%-8s%-16s%04x", vendor_id, product_id,
2068                         mod_data.release);
2069         return 36;
2070 }
2071
2072
2073 static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2074 {
2075         struct lun      *curlun = fsg->curlun;
2076         u8              *buf = (u8 *) bh->buf;
2077         u32             sd, sdinfo;
2078
2079         /*
2080          * From the SCSI-2 spec., section 7.9 (Unit attention condition):
2081          *
2082          * If a REQUEST SENSE command is received from an initiator
2083          * with a pending unit attention condition (before the target
2084          * generates the contingent allegiance condition), then the
2085          * target shall either:
2086          *   a) report any pending sense data and preserve the unit
2087          *      attention condition on the logical unit, or,
2088          *   b) report the unit attention condition, may discard any
2089          *      pending sense data, and clear the unit attention
2090          *      condition on the logical unit for that initiator.
2091          *
2092          * FSG normally uses option a); enable this code to use option b).
2093          */
2094 #if 0
2095         if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
2096                 curlun->sense_data = curlun->unit_attention_data;
2097                 curlun->unit_attention_data = SS_NO_SENSE;
2098         }
2099 #endif
2100
2101         if (!curlun) {          // Unsupported LUNs are okay
2102                 fsg->bad_lun_okay = 1;
2103                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2104                 sdinfo = 0;
2105         } else {
2106                 sd = curlun->sense_data;
2107                 sdinfo = curlun->sense_data_info;
2108                 curlun->sense_data = SS_NO_SENSE;
2109                 curlun->sense_data_info = 0;
2110         }
2111
2112         memset(buf, 0, 18);
2113         buf[0] = 0x80 | 0x70;                   // Valid, current error
2114         buf[2] = SK(sd);
2115         put_be32(&buf[3], sdinfo);              // Sense information
2116         buf[7] = 18 - 8;                        // Additional sense length
2117         buf[12] = ASC(sd);
2118         buf[13] = ASCQ(sd);
2119         return 18;
2120 }
2121
2122
2123 static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2124 {
2125         struct lun      *curlun = fsg->curlun;
2126         u32             lba = get_be32(&fsg->cmnd[2]);
2127         int             pmi = fsg->cmnd[8];
2128         u8              *buf = (u8 *) bh->buf;
2129
2130         /* Check the PMI and LBA fields */
2131         if (pmi > 1 || (pmi == 0 && lba != 0)) {
2132                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2133                 return -EINVAL;
2134         }
2135
2136         put_be32(&buf[0], curlun->num_sectors - 1);     // Max logical block
2137         put_be32(&buf[4], 512);                         // Block length
2138         return 8;
2139 }
2140
2141
2142 static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2143 {
2144         struct lun      *curlun = fsg->curlun;
2145         int             mscmnd = fsg->cmnd[0];
2146         u8              *buf = (u8 *) bh->buf;
2147         u8              *buf0 = buf;
2148         int             pc, page_code;
2149         int             changeable_values, all_pages;
2150         int             valid_page = 0;
2151         int             len, limit;
2152
2153         if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
2154                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2155                 return -EINVAL;
2156         }
2157         pc = fsg->cmnd[2] >> 6;
2158         page_code = fsg->cmnd[2] & 0x3f;
2159         if (pc == 3) {
2160                 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
2161                 return -EINVAL;
2162         }
2163         changeable_values = (pc == 1);
2164         all_pages = (page_code == 0x3f);
2165
2166         /* Write the mode parameter header.  Fixed values are: default
2167          * medium type, no cache control (DPOFUA), and no block descriptors.
2168          * The only variable value is the WriteProtect bit.  We will fill in
2169          * the mode data length later. */
2170         memset(buf, 0, 8);
2171         if (mscmnd == SC_MODE_SENSE_6) {
2172                 buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
2173                 buf += 4;
2174                 limit = 255;
2175         } else {                        // SC_MODE_SENSE_10
2176                 buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
2177                 buf += 8;
2178                 limit = 65535;          // Should really be mod_data.buflen
2179         }
2180
2181         /* No block descriptors */
2182
2183         /* The mode pages, in numerical order.  The only page we support
2184          * is the Caching page. */
2185         if (page_code == 0x08 || all_pages) {
2186                 valid_page = 1;
2187                 buf[0] = 0x08;          // Page code
2188                 buf[1] = 10;            // Page length
2189                 memset(buf+2, 0, 10);   // None of the fields are changeable
2190
2191                 if (!changeable_values) {
2192                         buf[2] = 0x04;  // Write cache enable,
2193                                         // Read cache not disabled
2194                                         // No cache retention priorities
2195                         put_be16(&buf[4], 0xffff);  // Don't disable prefetch
2196                                         // Minimum prefetch = 0
2197                         put_be16(&buf[8], 0xffff);  // Maximum prefetch
2198                         put_be16(&buf[10], 0xffff); // Maximum prefetch ceiling
2199                 }
2200                 buf += 12;
2201         }
2202
2203         /* Check that a valid page was requested and the mode data length
2204          * isn't too long. */
2205         len = buf - buf0;
2206         if (!valid_page || len > limit) {
2207                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2208                 return -EINVAL;
2209         }
2210
2211         /*  Store the mode data length */
2212         if (mscmnd == SC_MODE_SENSE_6)
2213                 buf0[0] = len - 1;
2214         else
2215                 put_be16(buf0, len - 2);
2216         return len;
2217 }
2218
2219
2220 static int do_start_stop(struct fsg_dev *fsg)
2221 {
2222         struct lun      *curlun = fsg->curlun;
2223         int             loej, start;
2224
2225         if (!mod_data.removable) {
2226                 curlun->sense_data = SS_INVALID_COMMAND;
2227                 return -EINVAL;
2228         }
2229
2230         // int immed = fsg->cmnd[1] & 0x01;
2231         loej = fsg->cmnd[4] & 0x02;
2232         start = fsg->cmnd[4] & 0x01;
2233
2234 #ifdef CONFIG_USB_FILE_STORAGE_TEST
2235         if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
2236                         (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
2237                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2238                 return -EINVAL;
2239         }
2240
2241         if (!start) {
2242
2243                 /* Are we allowed to unload the media? */
2244                 if (curlun->prevent_medium_removal) {
2245                         LDBG(curlun, "unload attempt prevented\n");
2246                         curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
2247                         return -EINVAL;
2248                 }
2249                 if (loej) {             // Simulate an unload/eject
2250                         up_read(&fsg->filesem);
2251                         down_write(&fsg->filesem);
2252                         close_backing_file(curlun);
2253                         up_write(&fsg->filesem);
2254                         down_read(&fsg->filesem);
2255                 }
2256         } else {
2257
2258                 /* Our emulation doesn't support mounting; the medium is
2259                  * available for use as soon as it is loaded. */
2260                 if (!backing_file_is_open(curlun)) {
2261                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2262                         return -EINVAL;
2263                 }
2264         }
2265 #endif
2266         return 0;
2267 }
2268
2269
2270 static int do_prevent_allow(struct fsg_dev *fsg)
2271 {
2272         struct lun      *curlun = fsg->curlun;
2273         int             prevent;
2274
2275         if (!mod_data.removable) {
2276                 curlun->sense_data = SS_INVALID_COMMAND;
2277                 return -EINVAL;
2278         }
2279
2280         prevent = fsg->cmnd[4] & 0x01;
2281         if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
2282                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2283                 return -EINVAL;
2284         }
2285
2286         if (curlun->prevent_medium_removal && !prevent)
2287                 fsync_sub(curlun);
2288         curlun->prevent_medium_removal = prevent;
2289         return 0;
2290 }
2291
2292
2293 static int do_read_format_capacities(struct fsg_dev *fsg,
2294                         struct fsg_buffhd *bh)
2295 {
2296         struct lun      *curlun = fsg->curlun;
2297         u8              *buf = (u8 *) bh->buf;
2298
2299         buf[0] = buf[1] = buf[2] = 0;
2300         buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
2301         buf += 4;
2302
2303         put_be32(&buf[0], curlun->num_sectors);         // Number of blocks
2304         put_be32(&buf[4], 512);                         // Block length
2305         buf[4] = 0x02;                                  // Current capacity
2306         return 12;
2307 }
2308
2309
2310 static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2311 {
2312         struct lun      *curlun = fsg->curlun;
2313
2314         /* We don't support MODE SELECT */
2315         curlun->sense_data = SS_INVALID_COMMAND;
2316         return -EINVAL;
2317 }
2318
2319
2320 /*-------------------------------------------------------------------------*/
2321
2322 static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
2323 {
2324         int     rc;
2325
2326         rc = fsg_set_halt(fsg, fsg->bulk_in);
2327         if (rc == -EAGAIN)
2328                 VDBG(fsg, "delayed bulk-in endpoint halt\n");
2329         while (rc != 0) {
2330                 if (rc != -EAGAIN) {
2331                         WARN(fsg, "usb_ep_set_halt -> %d\n", rc);
2332                         rc = 0;
2333                         break;
2334                 }
2335
2336                 /* Wait for a short time and then try again */
2337                 if (msleep_interruptible(100) != 0)
2338                         return -EINTR;
2339                 rc = usb_ep_set_halt(fsg->bulk_in);
2340         }
2341         return rc;
2342 }
2343
2344 static int pad_with_zeros(struct fsg_dev *fsg)
2345 {
2346         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2347         u32                     nkeep = bh->inreq->length;
2348         u32                     nsend;
2349         int                     rc;
2350
2351         bh->state = BUF_STATE_EMPTY;            // For the first iteration
2352         fsg->usb_amount_left = nkeep + fsg->residue;
2353         while (fsg->usb_amount_left > 0) {
2354
2355                 /* Wait for the next buffer to be free */
2356                 while (bh->state != BUF_STATE_EMPTY) {
2357                         if ((rc = sleep_thread(fsg)) != 0)
2358                                 return rc;
2359                 }
2360
2361                 nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
2362                 memset(bh->buf + nkeep, 0, nsend - nkeep);
2363                 bh->inreq->length = nsend;
2364                 bh->inreq->zero = 0;
2365                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2366                                 &bh->inreq_busy, &bh->state);
2367                 bh = fsg->next_buffhd_to_fill = bh->next;
2368                 fsg->usb_amount_left -= nsend;
2369                 nkeep = 0;
2370         }
2371         return 0;
2372 }
2373
2374 static int throw_away_data(struct fsg_dev *fsg)
2375 {
2376         struct fsg_buffhd       *bh;
2377         u32                     amount;
2378         int                     rc;
2379
2380         while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
2381                         fsg->usb_amount_left > 0) {
2382
2383                 /* Throw away the data in a filled buffer */
2384                 if (bh->state == BUF_STATE_FULL) {
2385                         smp_rmb();
2386                         bh->state = BUF_STATE_EMPTY;
2387                         fsg->next_buffhd_to_drain = bh->next;
2388
2389                         /* A short packet or an error ends everything */
2390                         if (bh->outreq->actual != bh->outreq->length ||
2391                                         bh->outreq->status != 0) {
2392                                 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2393                                 return -EINTR;
2394                         }
2395                         continue;
2396                 }
2397
2398                 /* Try to submit another request if we need one */
2399                 bh = fsg->next_buffhd_to_fill;
2400                 if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
2401                         amount = min(fsg->usb_amount_left,
2402                                         (u32) mod_data.buflen);
2403
2404                         /* amount is always divisible by 512, hence by
2405                          * the bulk-out maxpacket size */
2406                         bh->outreq->length = bh->bulk_out_intended_length =
2407                                         amount;
2408                         bh->outreq->short_not_ok = 1;
2409                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
2410                                         &bh->outreq_busy, &bh->state);
2411                         fsg->next_buffhd_to_fill = bh->next;
2412                         fsg->usb_amount_left -= amount;
2413                         continue;
2414                 }
2415
2416                 /* Otherwise wait for something to happen */
2417                 if ((rc = sleep_thread(fsg)) != 0)
2418                         return rc;
2419         }
2420         return 0;
2421 }
2422
2423
2424 static int finish_reply(struct fsg_dev *fsg)
2425 {
2426         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2427         int                     rc = 0;
2428
2429         switch (fsg->data_dir) {
2430         case DATA_DIR_NONE:
2431                 break;                  // Nothing to send
2432
2433         /* If we don't know whether the host wants to read or write,
2434          * this must be CB or CBI with an unknown command.  We mustn't
2435          * try to send or receive any data.  So stall both bulk pipes
2436          * if we can and wait for a reset. */
2437         case DATA_DIR_UNKNOWN:
2438                 if (mod_data.can_stall) {
2439                         fsg_set_halt(fsg, fsg->bulk_out);
2440                         rc = halt_bulk_in_endpoint(fsg);
2441                 }
2442                 break;
2443
2444         /* All but the last buffer of data must have already been sent */
2445         case DATA_DIR_TO_HOST:
2446                 if (fsg->data_size == 0)
2447                         ;               // Nothing to send
2448
2449                 /* If there's no residue, simply send the last buffer */
2450                 else if (fsg->residue == 0) {
2451                         bh->inreq->zero = 0;
2452                         start_transfer(fsg, fsg->bulk_in, bh->inreq,
2453                                         &bh->inreq_busy, &bh->state);
2454                         fsg->next_buffhd_to_fill = bh->next;
2455                 }
2456
2457                 /* There is a residue.  For CB and CBI, simply mark the end
2458                  * of the data with a short packet.  However, if we are
2459                  * allowed to stall, there was no data at all (residue ==
2460                  * data_size), and the command failed (invalid LUN or
2461                  * sense data is set), then halt the bulk-in endpoint
2462                  * instead. */
2463                 else if (!transport_is_bbb()) {
2464                         if (mod_data.can_stall &&
2465                                         fsg->residue == fsg->data_size &&
2466         (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
2467                                 bh->state = BUF_STATE_EMPTY;
2468                                 rc = halt_bulk_in_endpoint(fsg);
2469                         } else {
2470                                 bh->inreq->zero = 1;
2471                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2472                                                 &bh->inreq_busy, &bh->state);
2473                                 fsg->next_buffhd_to_fill = bh->next;
2474                         }
2475                 }
2476
2477                 /* For Bulk-only, if we're allowed to stall then send the
2478                  * short packet and halt the bulk-in endpoint.  If we can't
2479                  * stall, pad out the remaining data with 0's. */
2480                 else {
2481                         if (mod_data.can_stall) {
2482                                 bh->inreq->zero = 1;
2483                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2484                                                 &bh->inreq_busy, &bh->state);
2485                                 fsg->next_buffhd_to_fill = bh->next;
2486                                 rc = halt_bulk_in_endpoint(fsg);
2487                         } else
2488                                 rc = pad_with_zeros(fsg);
2489                 }
2490                 break;
2491
2492         /* We have processed all we want from the data the host has sent.
2493          * There may still be outstanding bulk-out requests. */
2494         case DATA_DIR_FROM_HOST:
2495                 if (fsg->residue == 0)
2496                         ;               // Nothing to receive
2497
2498                 /* Did the host stop sending unexpectedly early? */
2499                 else if (fsg->short_packet_received) {
2500                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2501                         rc = -EINTR;
2502                 }
2503
2504                 /* We haven't processed all the incoming data.  Even though
2505                  * we may be allowed to stall, doing so would cause a race.
2506                  * The controller may already have ACK'ed all the remaining
2507                  * bulk-out packets, in which case the host wouldn't see a
2508                  * STALL.  Not realizing the endpoint was halted, it wouldn't
2509                  * clear the halt -- leading to problems later on. */
2510 #if 0
2511                 else if (mod_data.can_stall) {
2512                         fsg_set_halt(fsg, fsg->bulk_out);
2513                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2514                         rc = -EINTR;
2515                 }
2516 #endif
2517
2518                 /* We can't stall.  Read in the excess data and throw it
2519                  * all away. */
2520                 else
2521                         rc = throw_away_data(fsg);
2522                 break;
2523         }
2524         return rc;
2525 }
2526
2527
2528 static int send_status(struct fsg_dev *fsg)
2529 {
2530         struct lun              *curlun = fsg->curlun;
2531         struct fsg_buffhd       *bh;
2532         int                     rc;
2533         u8                      status = USB_STATUS_PASS;
2534         u32                     sd, sdinfo = 0;
2535
2536         /* Wait for the next buffer to become available */
2537         bh = fsg->next_buffhd_to_fill;
2538         while (bh->state != BUF_STATE_EMPTY) {
2539                 if ((rc = sleep_thread(fsg)) != 0)
2540                         return rc;
2541         }
2542
2543         if (curlun) {
2544                 sd = curlun->sense_data;
2545                 sdinfo = curlun->sense_data_info;
2546         } else if (fsg->bad_lun_okay)
2547                 sd = SS_NO_SENSE;
2548         else
2549                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2550
2551         if (fsg->phase_error) {
2552                 DBG(fsg, "sending phase-error status\n");
2553                 status = USB_STATUS_PHASE_ERROR;
2554                 sd = SS_INVALID_COMMAND;
2555         } else if (sd != SS_NO_SENSE) {
2556                 DBG(fsg, "sending command-failure status\n");
2557                 status = USB_STATUS_FAIL;
2558                 VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2559                                 "  info x%x\n",
2560                                 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
2561         }
2562
2563         if (transport_is_bbb()) {
2564                 struct bulk_cs_wrap     *csw = (struct bulk_cs_wrap *) bh->buf;
2565
2566                 /* Store and send the Bulk-only CSW */
2567                 csw->Signature = __constant_cpu_to_le32(USB_BULK_CS_SIG);
2568                 csw->Tag = fsg->tag;
2569                 csw->Residue = cpu_to_le32(fsg->residue);
2570                 csw->Status = status;
2571
2572                 bh->inreq->length = USB_BULK_CS_WRAP_LEN;
2573                 bh->inreq->zero = 0;
2574                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2575                                 &bh->inreq_busy, &bh->state);
2576
2577         } else if (mod_data.transport_type == USB_PR_CB) {
2578
2579                 /* Control-Bulk transport has no status phase! */
2580                 return 0;
2581
2582         } else {                        // USB_PR_CBI
2583                 struct interrupt_data   *buf = (struct interrupt_data *)
2584                                                 bh->buf;
2585
2586                 /* Store and send the Interrupt data.  UFI sends the ASC
2587                  * and ASCQ bytes.  Everything else sends a Type (which
2588                  * is always 0) and the status Value. */
2589                 if (mod_data.protocol_type == USB_SC_UFI) {
2590                         buf->bType = ASC(sd);
2591                         buf->bValue = ASCQ(sd);
2592                 } else {
2593                         buf->bType = 0;
2594                         buf->bValue = status;
2595                 }
2596                 fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
2597
2598                 fsg->intr_buffhd = bh;          // Point to the right buffhd
2599                 fsg->intreq->buf = bh->inreq->buf;
2600                 fsg->intreq->dma = bh->inreq->dma;
2601                 fsg->intreq->context = bh;
2602                 start_transfer(fsg, fsg->intr_in, fsg->intreq,
2603                                 &fsg->intreq_busy, &bh->state);
2604         }
2605
2606         fsg->next_buffhd_to_fill = bh->next;
2607         return 0;
2608 }
2609
2610
2611 /*-------------------------------------------------------------------------*/
2612
2613 /* Check whether the command is properly formed and whether its data size
2614  * and direction agree with the values we already have. */
2615 static int check_command(struct fsg_dev *fsg, int cmnd_size,
2616                 enum data_direction data_dir, unsigned int mask,
2617                 int needs_medium, const char *name)
2618 {
2619         int                     i;
2620         int                     lun = fsg->cmnd[1] >> 5;
2621         static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
2622         char                    hdlen[20];
2623         struct lun              *curlun;
2624
2625         /* Adjust the expected cmnd_size for protocol encapsulation padding.
2626          * Transparent SCSI doesn't pad. */
2627         if (protocol_is_scsi())
2628                 ;
2629
2630         /* There's some disagreement as to whether RBC pads commands or not.
2631          * We'll play it safe and accept either form. */
2632         else if (mod_data.protocol_type == USB_SC_RBC) {
2633                 if (fsg->cmnd_size == 12)
2634                         cmnd_size = 12;
2635
2636         /* All the other protocols pad to 12 bytes */
2637         } else
2638                 cmnd_size = 12;
2639
2640         hdlen[0] = 0;
2641         if (fsg->data_dir != DATA_DIR_UNKNOWN)
2642                 sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
2643                                 fsg->data_size);
2644         VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
2645                         name, cmnd_size, dirletter[(int) data_dir],
2646                         fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
2647
2648         /* We can't reply at all until we know the correct data direction
2649          * and size. */
2650         if (fsg->data_size_from_cmnd == 0)
2651                 data_dir = DATA_DIR_NONE;
2652         if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
2653                 fsg->data_dir = data_dir;
2654                 fsg->data_size = fsg->data_size_from_cmnd;
2655
2656         } else {                                        // Bulk-only
2657                 if (fsg->data_size < fsg->data_size_from_cmnd) {
2658
2659                         /* Host data size < Device data size is a phase error.
2660                          * Carry out the command, but only transfer as much
2661                          * as we are allowed. */
2662                         fsg->data_size_from_cmnd = fsg->data_size;
2663                         fsg->phase_error = 1;
2664                 }
2665         }
2666         fsg->residue = fsg->usb_amount_left = fsg->data_size;
2667
2668         /* Conflicting data directions is a phase error */
2669         if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
2670                 fsg->phase_error = 1;
2671                 return -EINVAL;
2672         }
2673
2674         /* Verify the length of the command itself */
2675         if (cmnd_size != fsg->cmnd_size) {
2676
2677                 /* Special case workaround: MS-Windows issues REQUEST SENSE
2678                  * with cbw->Length == 12 (it should be 6). */
2679                 if (fsg->cmnd[0] == SC_REQUEST_SENSE && fsg->cmnd_size == 12)
2680                         cmnd_size = fsg->cmnd_size;
2681                 else {
2682                         fsg->phase_error = 1;
2683                         return -EINVAL;
2684                 }
2685         }
2686
2687         /* Check that the LUN values are consistent */
2688         if (transport_is_bbb()) {
2689                 if (fsg->lun != lun)
2690                         DBG(fsg, "using LUN %d from CBW, "
2691                                         "not LUN %d from CDB\n",
2692                                         fsg->lun, lun);
2693         } else
2694                 fsg->lun = lun;         // Use LUN from the command
2695
2696         /* Check the LUN */
2697         if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
2698                 fsg->curlun = curlun = &fsg->luns[fsg->lun];
2699                 if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
2700                         curlun->sense_data = SS_NO_SENSE;
2701                         curlun->sense_data_info = 0;
2702                 }
2703         } else {
2704                 fsg->curlun = curlun = NULL;
2705                 fsg->bad_lun_okay = 0;
2706
2707                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2708                  * to use unsupported LUNs; all others may not. */
2709                 if (fsg->cmnd[0] != SC_INQUIRY &&
2710                                 fsg->cmnd[0] != SC_REQUEST_SENSE) {
2711                         DBG(fsg, "unsupported LUN %d\n", fsg->lun);
2712                         return -EINVAL;
2713                 }
2714         }
2715
2716         /* If a unit attention condition exists, only INQUIRY and
2717          * REQUEST SENSE commands are allowed; anything else must fail. */
2718         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
2719                         fsg->cmnd[0] != SC_INQUIRY &&
2720                         fsg->cmnd[0] != SC_REQUEST_SENSE) {
2721                 curlun->sense_data = curlun->unit_attention_data;
2722                 curlun->unit_attention_data = SS_NO_SENSE;
2723                 return -EINVAL;
2724         }
2725
2726         /* Check that only command bytes listed in the mask are non-zero */
2727         fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
2728         for (i = 1; i < cmnd_size; ++i) {
2729                 if (fsg->cmnd[i] && !(mask & (1 << i))) {
2730                         if (curlun)
2731                                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2732                         return -EINVAL;
2733                 }
2734         }
2735
2736         /* If the medium isn't mounted and the command needs to access
2737          * it, return an error. */
2738         if (curlun && !backing_file_is_open(curlun) && needs_medium) {
2739                 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2740                 return -EINVAL;
2741         }
2742
2743         return 0;
2744 }
2745
2746
2747 static int do_scsi_command(struct fsg_dev *fsg)
2748 {
2749         struct fsg_buffhd       *bh;
2750         int                     rc;
2751         int                     reply = -EINVAL;
2752         int                     i;
2753         static char             unknown[16];
2754
2755         dump_cdb(fsg);
2756
2757         /* Wait for the next buffer to become available for data or status */
2758         bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
2759         while (bh->state != BUF_STATE_EMPTY) {
2760                 if ((rc = sleep_thread(fsg)) != 0)
2761                         return rc;
2762                 }
2763         fsg->phase_error = 0;
2764         fsg->short_packet_received = 0;
2765
2766         down_read(&fsg->filesem);       // We're using the backing file
2767         switch (fsg->cmnd[0]) {
2768
2769         case SC_INQUIRY:
2770                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2771                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2772                                 (1<<4), 0,
2773                                 "INQUIRY")) == 0)
2774                         reply = do_inquiry(fsg, bh);
2775                 break;
2776
2777         case SC_MODE_SELECT_6:
2778                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2779                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2780                                 (1<<1) | (1<<4), 0,
2781                                 "MODE SELECT(6)")) == 0)
2782                         reply = do_mode_select(fsg, bh);
2783                 break;
2784
2785         case SC_MODE_SELECT_10:
2786                 fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
2787                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2788                                 (1<<1) | (3<<7), 0,
2789                                 "MODE SELECT(10)")) == 0)
2790                         reply = do_mode_select(fsg, bh);
2791                 break;
2792
2793         case SC_MODE_SENSE_6:
2794                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2795                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2796                                 (1<<1) | (1<<2) | (1<<4), 0,
2797                                 "MODE SENSE(6)")) == 0)
2798                         reply = do_mode_sense(fsg, bh);
2799                 break;
2800
2801         case SC_MODE_SENSE_10:
2802                 fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
2803                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2804                                 (1<<1) | (1<<2) | (3<<7), 0,
2805                                 "MODE SENSE(10)")) == 0)
2806                         reply = do_mode_sense(fsg, bh);
2807                 break;
2808
2809         case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
2810                 fsg->data_size_from_cmnd = 0;
2811                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2812                                 (1<<4), 0,
2813                                 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2814                         reply = do_prevent_allow(fsg);
2815                 break;
2816
2817         case SC_READ_6:
2818                 i = fsg->cmnd[4];
2819                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2820                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2821                                 (7<<1) | (1<<4), 1,
2822                                 "READ(6)")) == 0)
2823                         reply = do_read(fsg);
2824                 break;
2825
2826         case SC_READ_10:
2827                 fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
2828                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2829                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2830                                 "READ(10)")) == 0)
2831                         reply = do_read(fsg);
2832                 break;
2833
2834         case SC_READ_12:
2835                 fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
2836                 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
2837                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2838                                 "READ(12)")) == 0)
2839                         reply = do_read(fsg);
2840                 break;
2841
2842         case SC_READ_CAPACITY:
2843                 fsg->data_size_from_cmnd = 8;
2844                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2845                                 (0xf<<2) | (1<<8), 1,
2846                                 "READ CAPACITY")) == 0)
2847                         reply = do_read_capacity(fsg, bh);
2848                 break;
2849
2850         case SC_READ_FORMAT_CAPACITIES:
2851                 fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
2852                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2853                                 (3<<7), 1,
2854                                 "READ FORMAT CAPACITIES")) == 0)
2855                         reply = do_read_format_capacities(fsg, bh);
2856                 break;
2857
2858         case SC_REQUEST_SENSE:
2859                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2860                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2861                                 (1<<4), 0,
2862                                 "REQUEST SENSE")) == 0)
2863                         reply = do_request_sense(fsg, bh);
2864                 break;
2865
2866         case SC_START_STOP_UNIT:
2867                 fsg->data_size_from_cmnd = 0;
2868                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2869                                 (1<<1) | (1<<4), 0,
2870                                 "START-STOP UNIT")) == 0)
2871                         reply = do_start_stop(fsg);
2872                 break;
2873
2874         case SC_SYNCHRONIZE_CACHE:
2875                 fsg->data_size_from_cmnd = 0;
2876                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2877                                 (0xf<<2) | (3<<7), 1,
2878                                 "SYNCHRONIZE CACHE")) == 0)
2879                         reply = do_synchronize_cache(fsg);
2880                 break;
2881
2882         case SC_TEST_UNIT_READY:
2883                 fsg->data_size_from_cmnd = 0;
2884                 reply = check_command(fsg, 6, DATA_DIR_NONE,
2885                                 0, 1,
2886                                 "TEST UNIT READY");
2887                 break;
2888
2889         /* Although optional, this command is used by MS-Windows.  We
2890          * support a minimal version: BytChk must be 0. */
2891         case SC_VERIFY:
2892                 fsg->data_size_from_cmnd = 0;
2893                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2894                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2895                                 "VERIFY")) == 0)
2896                         reply = do_verify(fsg);
2897                 break;
2898
2899         case SC_WRITE_6:
2900                 i = fsg->cmnd[4];
2901                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2902                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2903                                 (7<<1) | (1<<4), 1,
2904                                 "WRITE(6)")) == 0)
2905                         reply = do_write(fsg);
2906                 break;
2907
2908         case SC_WRITE_10:
2909                 fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
2910                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2911                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2912                                 "WRITE(10)")) == 0)
2913                         reply = do_write(fsg);
2914                 break;
2915
2916         case SC_WRITE_12:
2917                 fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
2918                 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
2919                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2920                                 "WRITE(12)")) == 0)
2921                         reply = do_write(fsg);
2922                 break;
2923
2924         /* Some mandatory commands that we recognize but don't implement.
2925          * They don't mean much in this setting.  It's left as an exercise
2926          * for anyone interested to implement RESERVE and RELEASE in terms
2927          * of Posix locks. */
2928         case SC_FORMAT_UNIT:
2929         case SC_RELEASE:
2930         case SC_RESERVE:
2931         case SC_SEND_DIAGNOSTIC:
2932                 // Fall through
2933
2934         default:
2935                 fsg->data_size_from_cmnd = 0;
2936                 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
2937                 if ((reply = check_command(fsg, fsg->cmnd_size,
2938                                 DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
2939                         fsg->curlun->sense_data = SS_INVALID_COMMAND;
2940                         reply = -EINVAL;
2941                 }
2942                 break;
2943         }
2944         up_read(&fsg->filesem);
2945
2946         if (reply == -EINTR || signal_pending(current))
2947                 return -EINTR;
2948
2949         /* Set up the single reply buffer for finish_reply() */
2950         if (reply == -EINVAL)
2951                 reply = 0;              // Error reply length
2952         if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
2953                 reply = min((u32) reply, fsg->data_size_from_cmnd);
2954                 bh->inreq->length = reply;
2955                 bh->state = BUF_STATE_FULL;
2956                 fsg->residue -= reply;
2957         }                               // Otherwise it's already set
2958
2959         return 0;
2960 }
2961
2962
2963 /*-------------------------------------------------------------------------*/
2964
2965 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2966 {
2967         struct usb_request      *req = bh->outreq;
2968         struct bulk_cb_wrap     *cbw = (struct bulk_cb_wrap *) req->buf;
2969
2970         /* Was this a real packet? */
2971         if (req->status)
2972                 return -EINVAL;
2973
2974         /* Is the CBW valid? */
2975         if (req->actual != USB_BULK_CB_WRAP_LEN ||
2976                         cbw->Signature != __constant_cpu_to_le32(
2977                                 USB_BULK_CB_SIG)) {
2978                 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2979                                 req->actual,
2980                                 le32_to_cpu(cbw->Signature));
2981
2982                 /* The Bulk-only spec says we MUST stall the bulk pipes!
2983                  * If we want to avoid stalls, set a flag so that we will
2984                  * clear the endpoint halts at the next reset. */
2985                 if (!mod_data.can_stall)
2986                         set_bit(CLEAR_BULK_HALTS, &fsg->atomic_bitflags);
2987                 fsg_set_halt(fsg, fsg->bulk_out);
2988                 halt_bulk_in_endpoint(fsg);
2989                 return -EINVAL;
2990         }
2991
2992         /* Is the CBW meaningful? */
2993         if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2994                         cbw->Length < 6 || cbw->Length > MAX_COMMAND_SIZE) {
2995                 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2996                                 "cmdlen %u\n",
2997                                 cbw->Lun, cbw->Flags, cbw->Length);
2998
2999                 /* We can do anything we want here, so let's stall the
3000                  * bulk pipes if we are allowed to. */
3001                 if (mod_data.can_stall) {
3002                         fsg_set_halt(fsg, fsg->bulk_out);
3003                         halt_bulk_in_endpoint(fsg);
3004                 }
3005                 return -EINVAL;
3006         }
3007
3008         /* Save the command for later */
3009         fsg->cmnd_size = cbw->Length;
3010         memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
3011         if (cbw->Flags & USB_BULK_IN_FLAG)
3012                 fsg->data_dir = DATA_DIR_TO_HOST;
3013         else
3014                 fsg->data_dir = DATA_DIR_FROM_HOST;
3015         fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
3016         if (fsg->data_size == 0)
3017                 fsg->data_dir = DATA_DIR_NONE;
3018         fsg->lun = cbw->Lun;
3019         fsg->tag = cbw->Tag;
3020         return 0;
3021 }
3022
3023
3024 static int get_next_command(struct fsg_dev *fsg)
3025 {
3026         struct fsg_buffhd       *bh;
3027         int                     rc = 0;
3028
3029         if (transport_is_bbb()) {
3030
3031                 /* Wait for the next buffer to become available */
3032                 bh = fsg->next_buffhd_to_fill;
3033                 while (bh->state != BUF_STATE_EMPTY) {
3034                         if ((rc = sleep_thread(fsg)) != 0)
3035                                 return rc;
3036                         }
3037
3038                 /* Queue a request to read a Bulk-only CBW */
3039                 set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
3040                 bh->outreq->short_not_ok = 1;
3041                 start_transfer(fsg, fsg->bulk_out, bh->outreq,
3042                                 &bh->outreq_busy, &bh->state);
3043
3044                 /* We will drain the buffer in software, which means we
3045                  * can reuse it for the next filling.  No need to advance
3046                  * next_buffhd_to_fill. */
3047
3048                 /* Wait for the CBW to arrive */
3049                 while (bh->state != BUF_STATE_FULL) {
3050                         if ((rc = sleep_thread(fsg)) != 0)
3051                                 return rc;
3052                         }
3053                 smp_rmb();
3054                 rc = received_cbw(fsg, bh);
3055                 bh->state = BUF_STATE_EMPTY;
3056
3057         } else {                // USB_PR_CB or USB_PR_CBI
3058
3059                 /* Wait for the next command to arrive */
3060                 while (fsg->cbbuf_cmnd_size == 0) {
3061                         if ((rc = sleep_thread(fsg)) != 0)
3062                                 return rc;
3063                         }
3064
3065                 /* Is the previous status interrupt request still busy?
3066                  * The host is allowed to skip reading the status,
3067                  * so we must cancel it. */
3068                 if (fsg->intreq_busy)
3069                         usb_ep_dequeue(fsg->intr_in, fsg->intreq);
3070
3071                 /* Copy the command and mark the buffer empty */
3072                 fsg->data_dir = DATA_DIR_UNKNOWN;
3073                 spin_lock_irq(&fsg->lock);
3074                 fsg->cmnd_size = fsg->cbbuf_cmnd_size;
3075                 memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
3076                 fsg->cbbuf_cmnd_size = 0;
3077                 spin_unlock_irq(&fsg->lock);
3078         }
3079         return rc;
3080 }
3081
3082
3083 /*-------------------------------------------------------------------------*/
3084
3085 static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
3086                 const struct usb_endpoint_descriptor *d)
3087 {
3088         int     rc;
3089
3090         ep->driver_data = fsg;
3091         rc = usb_ep_enable(ep, d);
3092         if (rc)
3093                 ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
3094         return rc;
3095 }
3096
3097 static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
3098                 struct usb_request **preq)
3099 {
3100         *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
3101         if (*preq)
3102                 return 0;
3103         ERROR(fsg, "can't allocate request for %s\n", ep->name);
3104         return -ENOMEM;
3105 }
3106
3107 /*
3108  * Reset interface setting and re-init endpoint state (toggle etc).
3109  * Call with altsetting < 0 to disable the interface.  The only other
3110  * available altsetting is 0, which enables the interface.
3111  */
3112 static int do_set_interface(struct fsg_dev *fsg, int altsetting)
3113 {
3114         int     rc = 0;
3115         int     i;
3116         const struct usb_endpoint_descriptor    *d;
3117
3118         if (fsg->running)
3119                 DBG(fsg, "reset interface\n");
3120
3121 reset:
3122         /* Deallocate the requests */
3123         for (i = 0; i < NUM_BUFFERS; ++i) {
3124                 struct fsg_buffhd *bh = &fsg->buffhds[i];
3125
3126                 if (bh->inreq) {
3127                         usb_ep_free_request(fsg->bulk_in, bh->inreq);
3128                         bh->inreq = NULL;
3129                 }
3130                 if (bh->outreq) {
3131                         usb_ep_free_request(fsg->bulk_out, bh->outreq);
3132                         bh->outreq = NULL;
3133                 }
3134         }
3135         if (fsg->intreq) {
3136                 usb_ep_free_request(fsg->intr_in, fsg->intreq);
3137                 fsg->intreq = NULL;
3138         }
3139
3140         /* Disable the endpoints */
3141         if (fsg->bulk_in_enabled) {
3142                 usb_ep_disable(fsg->bulk_in);
3143                 fsg->bulk_in_enabled = 0;
3144         }
3145         if (fsg->bulk_out_enabled) {
3146                 usb_ep_disable(fsg->bulk_out);
3147                 fsg->bulk_out_enabled = 0;
3148         }
3149         if (fsg->intr_in_enabled) {
3150                 usb_ep_disable(fsg->intr_in);
3151                 fsg->intr_in_enabled = 0;
3152         }
3153
3154         fsg->running = 0;
3155         if (altsetting < 0 || rc != 0)
3156                 return rc;
3157
3158         DBG(fsg, "set interface %d\n", altsetting);
3159
3160         /* Enable the endpoints */
3161         d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
3162         if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
3163                 goto reset;
3164         fsg->bulk_in_enabled = 1;
3165
3166         d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
3167         if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
3168                 goto reset;
3169         fsg->bulk_out_enabled = 1;
3170         fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
3171
3172         if (transport_is_cbi()) {
3173                 d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
3174                 if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
3175                         goto reset;
3176                 fsg->intr_in_enabled = 1;
3177         }
3178
3179         /* Allocate the requests */
3180         for (i = 0; i < NUM_BUFFERS; ++i) {
3181                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
3182
3183                 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
3184                         goto reset;
3185                 if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
3186                         goto reset;
3187                 bh->inreq->buf = bh->outreq->buf = bh->buf;
3188                 bh->inreq->dma = bh->outreq->dma = bh->dma;
3189                 bh->inreq->context = bh->outreq->context = bh;
3190                 bh->inreq->complete = bulk_in_complete;
3191                 bh->outreq->complete = bulk_out_complete;
3192         }
3193         if (transport_is_cbi()) {
3194                 if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
3195                         goto reset;
3196                 fsg->intreq->complete = intr_in_complete;
3197         }
3198
3199         fsg->running = 1;
3200         for (i = 0; i < fsg->nluns; ++i)
3201                 fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3202         return rc;
3203 }
3204
3205
3206 /*
3207  * Change our operational configuration.  This code must agree with the code
3208  * that returns config descriptors, and with interface altsetting code.
3209  *
3210  * It's also responsible for power management interactions.  Some
3211  * configurations might not work with our current power sources.
3212  * For now we just assume the gadget is always self-powered.
3213  */
3214 static int do_set_config(struct fsg_dev *fsg, u8 new_config)
3215 {
3216         int     rc = 0;
3217
3218         /* Disable the single interface */
3219         if (fsg->config != 0) {
3220                 DBG(fsg, "reset config\n");
3221                 fsg->config = 0;
3222                 rc = do_set_interface(fsg, -1);
3223         }
3224
3225         /* Enable the interface */
3226         if (new_config != 0) {
3227                 fsg->config = new_config;
3228                 if ((rc = do_set_interface(fsg, 0)) != 0)
3229                         fsg->config = 0;        // Reset on errors
3230                 else {
3231                         char *speed;
3232
3233                         switch (fsg->gadget->speed) {
3234                         case USB_SPEED_LOW:     speed = "low";  break;
3235                         case USB_SPEED_FULL:    speed = "full"; break;
3236                         case USB_SPEED_HIGH:    speed = "high"; break;
3237                         default:                speed = "?";    break;
3238                         }
3239                         INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
3240                 }
3241         }
3242         return rc;
3243 }
3244
3245
3246 /*-------------------------------------------------------------------------*/
3247
3248 static void handle_exception(struct fsg_dev *fsg)
3249 {
3250         siginfo_t               info;
3251         int                     sig;
3252         int                     i;
3253         int                     num_active;
3254         struct fsg_buffhd       *bh;
3255         enum fsg_state          old_state;
3256         u8                      new_config;
3257         struct lun              *curlun;
3258         unsigned int            exception_req_tag;
3259         int                     rc;
3260
3261         /* Clear the existing signals.  Anything but SIGUSR1 is converted
3262          * into a high-priority EXIT exception. */
3263         for (;;) {
3264                 sig = dequeue_signal_lock(current, &fsg->thread_signal_mask,
3265                                 &info);
3266                 if (!sig)
3267                         break;
3268                 if (sig != SIGUSR1) {
3269                         if (fsg->state < FSG_STATE_EXIT)
3270                                 DBG(fsg, "Main thread exiting on signal\n");
3271                         raise_exception(fsg, FSG_STATE_EXIT);
3272                 }
3273         }
3274
3275         /* Cancel all the pending transfers */
3276         if (fsg->intreq_busy)
3277                 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
3278         for (i = 0; i < NUM_BUFFERS; ++i) {
3279                 bh = &fsg->buffhds[i];
3280                 if (bh->inreq_busy)
3281                         usb_ep_dequeue(fsg->bulk_in, bh->inreq);
3282                 if (bh->outreq_busy)
3283                         usb_ep_dequeue(fsg->bulk_out, bh->outreq);
3284         }
3285
3286         /* Wait until everything is idle */
3287         for (;;) {
3288                 num_active = fsg->intreq_busy;
3289                 for (i = 0; i < NUM_BUFFERS; ++i) {
3290                         bh = &fsg->buffhds[i];
3291                         num_active += bh->inreq_busy + bh->outreq_busy;
3292                 }
3293                 if (num_active == 0)
3294                         break;
3295                 if (sleep_thread(fsg))
3296                         return;
3297         }
3298
3299         /* Clear out the controller's fifos */
3300         if (fsg->bulk_in_enabled)
3301                 usb_ep_fifo_flush(fsg->bulk_in);
3302         if (fsg->bulk_out_enabled)
3303                 usb_ep_fifo_flush(fsg->bulk_out);
3304         if (fsg->intr_in_enabled)
3305                 usb_ep_fifo_flush(fsg->intr_in);
3306
3307         /* Reset the I/O buffer states and pointers, the SCSI
3308          * state, and the exception.  Then invoke the handler. */
3309         spin_lock_irq(&fsg->lock);
3310
3311         for (i = 0; i < NUM_BUFFERS; ++i) {
3312                 bh = &fsg->buffhds[i];
3313                 bh->state = BUF_STATE_EMPTY;
3314         }
3315         fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
3316                         &fsg->buffhds[0];
3317
3318         exception_req_tag = fsg->exception_req_tag;
3319         new_config = fsg->new_config;
3320         old_state = fsg->state;
3321
3322         if (old_state == FSG_STATE_ABORT_BULK_OUT)
3323                 fsg->state = FSG_STATE_STATUS_PHASE;
3324         else {
3325                 for (i = 0; i < fsg->nluns; ++i) {
3326                         curlun = &fsg->luns[i];
3327                         curlun->prevent_medium_removal = 0;
3328                         curlun->sense_data = curlun->unit_attention_data =
3329                                         SS_NO_SENSE;
3330                         curlun->sense_data_info = 0;
3331                 }
3332                 fsg->state = FSG_STATE_IDLE;
3333         }
3334         spin_unlock_irq(&fsg->lock);
3335
3336         /* Carry out any extra actions required for the exception */
3337         switch (old_state) {
3338         default:
3339                 break;
3340
3341         case FSG_STATE_ABORT_BULK_OUT:
3342                 send_status(fsg);
3343                 spin_lock_irq(&fsg->lock);
3344                 if (fsg->state == FSG_STATE_STATUS_PHASE)
3345                         fsg->state = FSG_STATE_IDLE;
3346                 spin_unlock_irq(&fsg->lock);
3347                 break;
3348
3349         case FSG_STATE_RESET:
3350                 /* In case we were forced against our will to halt a
3351                  * bulk endpoint, clear the halt now.  (The SuperH UDC
3352                  * requires this.) */
3353                 if (test_and_clear_bit(CLEAR_BULK_HALTS,
3354                                 &fsg->atomic_bitflags)) {
3355                         usb_ep_clear_halt(fsg->bulk_in);
3356                         usb_ep_clear_halt(fsg->bulk_out);
3357                 }
3358
3359                 if (transport_is_bbb()) {
3360                         if (fsg->ep0_req_tag == exception_req_tag)
3361                                 ep0_queue(fsg); // Complete the status stage
3362
3363                 } else if (transport_is_cbi())
3364                         send_status(fsg);       // Status by interrupt pipe
3365
3366                 /* Technically this should go here, but it would only be
3367                  * a waste of time.  Ditto for the INTERFACE_CHANGE and
3368                  * CONFIG_CHANGE cases. */
3369                 // for (i = 0; i < fsg->nluns; ++i)
3370                 //      fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3371                 break;
3372
3373         case FSG_STATE_INTERFACE_CHANGE:
3374                 rc = do_set_interface(fsg, 0);
3375                 if (fsg->ep0_req_tag != exception_req_tag)
3376                         break;
3377                 if (rc != 0)                    // STALL on errors
3378                         fsg_set_halt(fsg, fsg->ep0);
3379                 else                            // Complete the status stage
3380                         ep0_queue(fsg);
3381                 break;
3382
3383         case FSG_STATE_CONFIG_CHANGE:
3384                 rc = do_set_config(fsg, new_config);
3385                 if (fsg->ep0_req_tag != exception_req_tag)
3386                         break;
3387                 if (rc != 0)                    // STALL on errors
3388                         fsg_set_halt(fsg, fsg->ep0);
3389                 else                            // Complete the status stage
3390                         ep0_queue(fsg);
3391                 break;
3392
3393         case FSG_STATE_DISCONNECT:
3394                 fsync_all(fsg);
3395                 do_set_config(fsg, 0);          // Unconfigured state
3396                 break;
3397
3398         case FSG_STATE_EXIT:
3399         case FSG_STATE_TERMINATED:
3400                 do_set_config(fsg, 0);                  // Free resources
3401                 spin_lock_irq(&fsg->lock);
3402                 fsg->state = FSG_STATE_TERMINATED;      // Stop the thread
3403                 spin_unlock_irq(&fsg->lock);
3404                 break;
3405         }
3406 }
3407
3408
3409 /*-------------------------------------------------------------------------*/
3410
3411 static int fsg_main_thread(void *fsg_)
3412 {
3413         struct fsg_dev          *fsg = (struct fsg_dev *) fsg_;
3414
3415         /* Allow the thread to be killed by a signal, but set the signal mask
3416          * to block everything but INT, TERM, KILL, and USR1. */
3417         siginitsetinv(&fsg->thread_signal_mask, sigmask(SIGINT) |
3418                         sigmask(SIGTERM) | sigmask(SIGKILL) |
3419                         sigmask(SIGUSR1));
3420         sigprocmask(SIG_SETMASK, &fsg->thread_signal_mask, NULL);
3421
3422         /* Arrange for userspace references to be interpreted as kernel
3423          * pointers.  That way we can pass a kernel pointer to a routine
3424          * that expects a __user pointer and it will work okay. */
3425         set_fs(get_ds());
3426
3427         /* The main loop */
3428         while (fsg->state != FSG_STATE_TERMINATED) {
3429                 if (exception_in_progress(fsg) || signal_pending(current)) {
3430                         handle_exception(fsg);
3431                         continue;
3432                 }
3433
3434                 if (!fsg->running) {
3435                         sleep_thread(fsg);
3436                         continue;
3437                 }
3438
3439                 if (get_next_command(fsg))
3440                         continue;
3441
3442                 spin_lock_irq(&fsg->lock);
3443                 if (!exception_in_progress(fsg))
3444                         fsg->state = FSG_STATE_DATA_PHASE;
3445                 spin_unlock_irq(&fsg->lock);
3446
3447                 if (do_scsi_command(fsg) || finish_reply(fsg))
3448                         continue;
3449
3450                 spin_lock_irq(&fsg->lock);
3451                 if (!exception_in_progress(fsg))
3452                         fsg->state = FSG_STATE_STATUS_PHASE;
3453                 spin_unlock_irq(&fsg->lock);
3454
3455                 if (send_status(fsg))
3456                         continue;
3457
3458                 spin_lock_irq(&fsg->lock);
3459                 if (!exception_in_progress(fsg))
3460                         fsg->state = FSG_STATE_IDLE;
3461                 spin_unlock_irq(&fsg->lock);
3462                 }
3463
3464         spin_lock_irq(&fsg->lock);
3465         fsg->thread_task = NULL;
3466         spin_unlock_irq(&fsg->lock);
3467
3468         /* In case we are exiting because of a signal, unregister the
3469          * gadget driver and close the backing file. */
3470         if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) {
3471                 usb_gadget_unregister_driver(&fsg_driver);
3472                 close_all_backing_files(fsg);
3473         }
3474
3475         /* Let the unbind and cleanup routines know the thread has exited */
3476         complete_and_exit(&fsg->thread_notifier, 0);
3477 }
3478
3479
3480 /*-------------------------------------------------------------------------*/
3481
3482 /* If the next two routines are called while the gadget is registered,
3483  * the caller must own fsg->filesem for writing. */
3484
3485 static int open_backing_file(struct lun *curlun, const char *filename)
3486 {
3487         int                             ro;
3488         struct file                     *filp = NULL;
3489         int                             rc = -EINVAL;
3490         struct inode                    *inode = NULL;
3491         loff_t                          size;
3492         loff_t                          num_sectors;
3493
3494         /* R/W if we can, R/O if we must */
3495         ro = curlun->ro;
3496         if (!ro) {
3497                 filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
3498                 if (-EROFS == PTR_ERR(filp))
3499                         ro = 1;
3500         }
3501         if (ro)
3502                 filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
3503         if (IS_ERR(filp)) {
3504                 LINFO(curlun, "unable to open backing file: %s\n", filename);
3505                 return PTR_ERR(filp);
3506         }
3507
3508         if (!(filp->f_mode & FMODE_WRITE))
3509                 ro = 1;
3510
3511         if (filp->f_dentry)
3512                 inode = filp->f_dentry->d_inode;
3513         if (inode && S_ISBLK(inode->i_mode)) {
3514                 if (bdev_read_only(inode->i_bdev))
3515                         ro = 1;
3516         } else if (!inode || !S_ISREG(inode->i_mode)) {
3517                 LINFO(curlun, "invalid file type: %s\n", filename);
3518                 goto out;
3519         }
3520
3521         /* If we can't read the file, it's no good.
3522          * If we can't write the file, use it read-only. */
3523         if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
3524                 LINFO(curlun, "file not readable: %s\n", filename);
3525                 goto out;
3526         }
3527         if (!(filp->f_op->write || filp->f_op->aio_write))
3528                 ro = 1;
3529
3530         size = i_size_read(inode->i_mapping->host);
3531         if (size < 0) {
3532                 LINFO(curlun, "unable to find file size: %s\n", filename);
3533                 rc = (int) size;
3534                 goto out;
3535         }
3536         num_sectors = size >> 9;        // File size in 512-byte sectors
3537         if (num_sectors == 0) {
3538                 LINFO(curlun, "file too small: %s\n", filename);
3539                 rc = -ETOOSMALL;
3540                 goto out;
3541         }
3542
3543         get_file(filp);
3544         curlun->ro = ro;
3545         curlun->filp = filp;
3546         curlun->file_length = size;
3547         curlun->num_sectors = num_sectors;
3548         LDBG(curlun, "open backing file: %s\n", filename);
3549         rc = 0;
3550
3551 out:
3552         filp_close(filp, current->files);
3553         return rc;
3554 }
3555
3556
3557 static void close_backing_file(struct lun *curlun)
3558 {
3559         if (curlun->filp) {
3560                 LDBG(curlun, "close backing file\n");
3561                 fput(curlun->filp);
3562                 curlun->filp = NULL;
3563         }
3564 }
3565
3566 static void close_all_backing_files(struct fsg_dev *fsg)
3567 {
3568         int     i;
3569
3570         for (i = 0; i < fsg->nluns; ++i)
3571                 close_backing_file(&fsg->luns[i]);
3572 }
3573
3574
3575 static ssize_t show_ro(struct device *dev, struct device_attribute *attr, char *buf)
3576 {
3577         struct lun      *curlun = dev_to_lun(dev);
3578
3579         return sprintf(buf, "%d\n", curlun->ro);
3580 }
3581
3582 static ssize_t show_file(struct device *dev, struct device_attribute *attr, char *buf)
3583 {
3584         struct lun      *curlun = dev_to_lun(dev);
3585         struct fsg_dev  *fsg = (struct fsg_dev *) dev_get_drvdata(dev);
3586         char            *p;
3587         ssize_t         rc;
3588
3589         down_read(&fsg->filesem);
3590         if (backing_file_is_open(curlun)) {     // Get the complete pathname
3591                 p = d_path(curlun->filp->f_dentry, curlun->filp->f_vfsmnt,
3592                                 buf, PAGE_SIZE - 1);
3593                 if (IS_ERR(p))
3594                         rc = PTR_ERR(p);
3595                 else {
3596                         rc = strlen(p);
3597                         memmove(buf, p, rc);
3598                         buf[rc] = '\n';         // Add a newline
3599                         buf[++rc] = 0;
3600                 }
3601         } else {                                // No file, return 0 bytes
3602                 *buf = 0;
3603                 rc = 0;
3604         }
3605         up_read(&fsg->filesem);
3606         return rc;
3607 }
3608
3609
3610 static ssize_t store_ro(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
3611 {
3612         ssize_t         rc = count;
3613         struct lun      *curlun = dev_to_lun(dev);
3614         struct fsg_dev  *fsg = (struct fsg_dev *) dev_get_drvdata(dev);
3615         int             i;
3616
3617         if (sscanf(buf, "%d", &i) != 1)
3618                 return -EINVAL;
3619
3620         /* Allow the write-enable status to change only while the backing file
3621          * is closed. */
3622         down_read(&fsg->filesem);
3623         if (backing_file_is_open(curlun)) {
3624                 LDBG(curlun, "read-only status change prevented\n");
3625                 rc = -EBUSY;
3626         } else {
3627                 curlun->ro = !!i;
3628                 LDBG(curlun, "read-only status set to %d\n", curlun->ro);
3629         }
3630         up_read(&fsg->filesem);
3631         return rc;
3632 }
3633
3634 static ssize_t store_file(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
3635 {
3636         struct lun      *curlun = dev_to_lun(dev);
3637         struct fsg_dev  *fsg = (struct fsg_dev *) dev_get_drvdata(dev);
3638         int             rc = 0;
3639
3640         if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
3641                 LDBG(curlun, "eject attempt prevented\n");
3642                 return -EBUSY;                          // "Door is locked"
3643         }
3644
3645         /* Remove a trailing newline */
3646         if (count > 0 && buf[count-1] == '\n')
3647                 ((char *) buf)[count-1] = 0;            // Ugh!
3648
3649         /* Eject current medium */
3650         down_write(&fsg->filesem);
3651         if (backing_file_is_open(curlun)) {
3652                 close_backing_file(curlun);
3653                 curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
3654         }
3655
3656         /* Load new medium */
3657         if (count > 0 && buf[0]) {
3658                 rc = open_backing_file(curlun, buf);
3659                 if (rc == 0)
3660                         curlun->unit_attention_data =
3661                                         SS_NOT_READY_TO_READY_TRANSITION;
3662         }
3663         up_write(&fsg->filesem);
3664         return (rc < 0 ? rc : count);
3665 }
3666
3667
3668 /* The write permissions and store_xxx pointers are set in fsg_bind() */
3669 static DEVICE_ATTR(ro, 0444, show_ro, NULL);
3670 static DEVICE_ATTR(file, 0444, show_file, NULL);
3671
3672
3673 /*-------------------------------------------------------------------------*/
3674
3675 static void fsg_release(struct kref *ref)
3676 {
3677         struct fsg_dev  *fsg = container_of(ref, struct fsg_dev, ref);
3678
3679         kfree(fsg->luns);
3680         kfree(fsg);
3681 }
3682
3683 static void lun_release(struct device *dev)
3684 {
3685         struct fsg_dev  *fsg = (struct fsg_dev *) dev_get_drvdata(dev);
3686
3687         kref_put(&fsg->ref, fsg_release);
3688 }
3689
3690 static void __exit fsg_unbind(struct usb_gadget *gadget)
3691 {
3692         struct fsg_dev          *fsg = get_gadget_data(gadget);
3693         int                     i;
3694         struct lun              *curlun;
3695         struct usb_request      *req = fsg->ep0req;
3696
3697         DBG(fsg, "unbind\n");
3698         clear_bit(REGISTERED, &fsg->atomic_bitflags);
3699
3700         /* Unregister the sysfs attribute files and the LUNs */
3701         for (i = 0; i < fsg->nluns; ++i) {
3702                 curlun = &fsg->luns[i];
3703                 if (curlun->registered) {
3704                         device_remove_file(&curlun->dev, &dev_attr_ro);
3705                         device_remove_file(&curlun->dev, &dev_attr_file);
3706                         device_unregister(&curlun->dev);
3707                         curlun->registered = 0;
3708                 }
3709         }
3710
3711         /* If the thread isn't already dead, tell it to exit now */
3712         if (fsg->state != FSG_STATE_TERMINATED) {
3713                 raise_exception(fsg, FSG_STATE_EXIT);
3714                 wait_for_completion(&fsg->thread_notifier);
3715
3716                 /* The cleanup routine waits for this completion also */
3717                 complete(&fsg->thread_notifier);
3718         }
3719
3720         /* Free the data buffers */
3721         for (i = 0; i < NUM_BUFFERS; ++i) {
3722                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
3723
3724                 if (bh->buf)
3725                         usb_ep_free_buffer(fsg->bulk_in, bh->buf, bh->dma,
3726                                         mod_data.buflen);
3727         }
3728
3729         /* Free the request and buffer for endpoint 0 */
3730         if (req) {
3731                 if (req->buf)
3732                         usb_ep_free_buffer(fsg->ep0, req->buf,
3733                                         req->dma, EP0_BUFSIZE);
3734                 usb_ep_free_request(fsg->ep0, req);
3735         }
3736
3737         set_gadget_data(gadget, NULL);
3738 }
3739
3740
3741 static int __init check_parameters(struct fsg_dev *fsg)
3742 {
3743         int     prot;
3744         int     gcnum;
3745
3746         /* Store the default values */
3747         mod_data.transport_type = USB_PR_BULK;
3748         mod_data.transport_name = "Bulk-only";
3749         mod_data.protocol_type = USB_SC_SCSI;
3750         mod_data.protocol_name = "Transparent SCSI";
3751
3752         if (gadget_is_sh(fsg->gadget))
3753                 mod_data.can_stall = 0;
3754
3755         if (mod_data.release == 0xffff) {       // Parameter wasn't set
3756                 /* The sa1100 controller is not supported */
3757                 if (gadget_is_sa1100(fsg->gadget))
3758                         gcnum = -1;
3759                 else
3760                         gcnum = usb_gadget_controller_number(fsg->gadget);
3761                 if (gcnum >= 0)
3762                         mod_data.release = 0x0300 + gcnum;
3763                 else {
3764                         WARN(fsg, "controller '%s' not recognized\n",
3765                                 fsg->gadget->name);
3766                         mod_data.release = 0x0399;
3767                 }
3768         }
3769
3770         prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
3771
3772 #ifdef CONFIG_USB_FILE_STORAGE_TEST
3773         if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
3774                 ;               // Use default setting
3775         } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
3776                 mod_data.transport_type = USB_PR_CB;
3777                 mod_data.transport_name = "Control-Bulk";
3778         } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
3779                 mod_data.transport_type = USB_PR_CBI;
3780                 mod_data.transport_name = "Control-Bulk-Interrupt";
3781         } else {
3782                 ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
3783                 return -EINVAL;
3784         }
3785
3786         if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
3787                         prot == USB_SC_SCSI) {
3788                 ;               // Use default setting
3789         } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
3790                         prot == USB_SC_RBC) {
3791                 mod_data.protocol_type = USB_SC_RBC;
3792                 mod_data.protocol_name = "RBC";
3793         } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
3794                         strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
3795                         prot == USB_SC_8020) {
3796                 mod_data.protocol_type = USB_SC_8020;
3797                 mod_data.protocol_name = "8020i (ATAPI)";
3798         } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
3799                         prot == USB_SC_QIC) {
3800                 mod_data.protocol_type = USB_SC_QIC;
3801                 mod_data.protocol_name = "QIC-157";
3802         } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
3803                         prot == USB_SC_UFI) {
3804                 mod_data.protocol_type = USB_SC_UFI;
3805                 mod_data.protocol_name = "UFI";
3806         } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
3807                         prot == USB_SC_8070) {
3808                 mod_data.protocol_type = USB_SC_8070;
3809                 mod_data.protocol_name = "8070i";
3810         } else {
3811                 ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
3812                 return -EINVAL;
3813         }
3814
3815         mod_data.buflen &= PAGE_CACHE_MASK;
3816         if (mod_data.buflen <= 0) {
3817                 ERROR(fsg, "invalid buflen\n");
3818                 return -ETOOSMALL;
3819         }
3820 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
3821
3822         return 0;
3823 }
3824
3825
3826 static int __init fsg_bind(struct usb_gadget *gadget)
3827 {
3828         struct fsg_dev          *fsg = the_fsg;
3829         int                     rc;
3830         int                     i;
3831         struct lun              *curlun;
3832         struct usb_ep           *ep;
3833         struct usb_request      *req;
3834         char                    *pathbuf, *p;
3835
3836         fsg->gadget = gadget;
3837         set_gadget_data(gadget, fsg);
3838         fsg->ep0 = gadget->ep0;
3839         fsg->ep0->driver_data = fsg;
3840
3841         if ((rc = check_parameters(fsg)) != 0)
3842                 goto out;
3843
3844         if (mod_data.removable) {       // Enable the store_xxx attributes
3845                 dev_attr_ro.attr.mode = dev_attr_file.attr.mode = 0644;
3846                 dev_attr_ro.store = store_ro;
3847                 dev_attr_file.store = store_file;
3848         }
3849
3850         /* Find out how many LUNs there should be */
3851         i = mod_data.nluns;
3852         if (i == 0)
3853                 i = max(mod_data.num_filenames, 1);
3854         if (i > MAX_LUNS) {
3855                 ERROR(fsg, "invalid number of LUNs: %d\n", i);
3856                 rc = -EINVAL;
3857                 goto out;
3858         }
3859
3860         /* Create the LUNs, open their backing files, and register the
3861          * LUN devices in sysfs. */
3862         fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
3863         if (!fsg->luns) {
3864                 rc = -ENOMEM;
3865                 goto out;
3866         }
3867         fsg->nluns = i;
3868
3869         for (i = 0; i < fsg->nluns; ++i) {
3870                 curlun = &fsg->luns[i];
3871                 curlun->ro = ro[i];
3872                 curlun->dev.parent = &gadget->dev;
3873                 curlun->dev.driver = &fsg_driver.driver;
3874                 dev_set_drvdata(&curlun->dev, fsg);
3875                 snprintf(curlun->dev.bus_id, BUS_ID_SIZE,
3876                                 "%s-lun%d", gadget->dev.bus_id, i);
3877
3878                 if ((rc = device_register(&curlun->dev)) != 0)
3879                         INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
3880                 else {
3881                         curlun->registered = 1;
3882                         curlun->dev.release = lun_release;
3883                         device_create_file(&curlun->dev, &dev_attr_ro);
3884                         device_create_file(&curlun->dev, &dev_attr_file);
3885                         kref_get(&fsg->ref);
3886                 }
3887
3888                 if (file[i] && *file[i]) {
3889                         if ((rc = open_backing_file(curlun, file[i])) != 0)
3890                                 goto out;
3891                 } else if (!mod_data.removable) {
3892                         ERROR(fsg, "no file given for LUN%d\n", i);
3893                         rc = -EINVAL;
3894                         goto out;
3895                 }
3896         }
3897
3898         /* Find all the endpoints we will use */
3899         usb_ep_autoconfig_reset(gadget);
3900         ep = usb_ep_autoconfig(gadget, &fs_bulk_in_desc);
3901         if (!ep)
3902                 goto autoconf_fail;
3903         ep->driver_data = fsg;          // claim the endpoint
3904         fsg->bulk_in = ep;
3905
3906         ep = usb_ep_autoconfig(gadget, &fs_bulk_out_desc);
3907         if (!ep)
3908                 goto autoconf_fail;
3909         ep->driver_data = fsg;          // claim the endpoint
3910         fsg->bulk_out = ep;
3911
3912         if (transport_is_cbi()) {
3913                 ep = usb_ep_autoconfig(gadget, &fs_intr_in_desc);
3914                 if (!ep)
3915                         goto autoconf_fail;
3916                 ep->driver_data = fsg;          // claim the endpoint
3917                 fsg->intr_in = ep;
3918         }
3919
3920         /* Fix up the descriptors */
3921         device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
3922         device_desc.idVendor = cpu_to_le16(mod_data.vendor);
3923         device_desc.idProduct = cpu_to_le16(mod_data.product);
3924         device_desc.bcdDevice = cpu_to_le16(mod_data.release);
3925
3926         i = (transport_is_cbi() ? 3 : 2);       // Number of endpoints
3927         intf_desc.bNumEndpoints = i;
3928         intf_desc.bInterfaceSubClass = mod_data.protocol_type;
3929         intf_desc.bInterfaceProtocol = mod_data.transport_type;
3930         fs_function[i + FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
3931
3932 #ifdef CONFIG_USB_GADGET_DUALSPEED
3933         hs_function[i + HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
3934
3935         /* Assume ep0 uses the same maxpacket value for both speeds */
3936         dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
3937
3938         /* Assume that all endpoint addresses are the same for both speeds */
3939         hs_bulk_in_desc.bEndpointAddress = fs_bulk_in_desc.bEndpointAddress;
3940         hs_bulk_out_desc.bEndpointAddress = fs_bulk_out_desc.bEndpointAddress;
3941         hs_intr_in_desc.bEndpointAddress = fs_intr_in_desc.bEndpointAddress;
3942 #endif
3943
3944         if (gadget->is_otg) {
3945                 otg_desc.bmAttributes |= USB_OTG_HNP,
3946                 config_desc.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
3947         }
3948
3949         rc = -ENOMEM;
3950
3951         /* Allocate the request and buffer for endpoint 0 */
3952         fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
3953         if (!req)
3954                 goto out;
3955         req->buf = usb_ep_alloc_buffer(fsg->ep0, EP0_BUFSIZE,
3956                         &req->dma, GFP_KERNEL);
3957         if (!req->buf)
3958                 goto out;
3959         req->complete = ep0_complete;
3960
3961         /* Allocate the data buffers */
3962         for (i = 0; i < NUM_BUFFERS; ++i) {
3963                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
3964
3965                 /* Allocate for the bulk-in endpoint.  We assume that
3966                  * the buffer will also work with the bulk-out (and
3967                  * interrupt-in) endpoint. */
3968                 bh->buf = usb_ep_alloc_buffer(fsg->bulk_in, mod_data.buflen,
3969                                 &bh->dma, GFP_KERNEL);
3970                 if (!bh->buf)
3971                         goto out;
3972                 bh->next = bh + 1;
3973         }
3974         fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
3975
3976         /* This should reflect the actual gadget power source */
3977         usb_gadget_set_selfpowered(gadget);
3978
3979         snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
3980                         system_utsname.sysname, system_utsname.release,
3981                         gadget->name);
3982
3983         /* On a real device, serial[] would be loaded from permanent
3984          * storage.  We just encode it from the driver version string. */
3985         for (i = 0; i < sizeof(serial) - 2; i += 2) {
3986                 unsigned char           c = DRIVER_VERSION[i / 2];
3987
3988                 if (!c)
3989                         break;
3990                 sprintf(&serial[i], "%02X", c);
3991         }
3992
3993         fsg->thread_task = kthread_create(fsg_main_thread, fsg,
3994                         "file-storage-gadget");
3995         if (IS_ERR(fsg->thread_task)) {
3996                 rc = PTR_ERR(fsg->thread_task);
3997                 goto out;
3998         }
3999
4000         INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
4001         INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
4002
4003         pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
4004         for (i = 0; i < fsg->nluns; ++i) {
4005                 curlun = &fsg->luns[i];
4006                 if (backing_file_is_open(curlun)) {
4007                         p = NULL;
4008                         if (pathbuf) {
4009                                 p = d_path(curlun->filp->f_dentry,
4010                                         curlun->filp->f_vfsmnt,
4011                                         pathbuf, PATH_MAX);
4012                                 if (IS_ERR(p))
4013                                         p = NULL;
4014                         }
4015                         LINFO(curlun, "ro=%d, file: %s\n",
4016                                         curlun->ro, (p ? p : "(error)"));
4017                 }
4018         }
4019         kfree(pathbuf);
4020
4021         DBG(fsg, "transport=%s (x%02x)\n",
4022                         mod_data.transport_name, mod_data.transport_type);
4023         DBG(fsg, "protocol=%s (x%02x)\n",
4024                         mod_data.protocol_name, mod_data.protocol_type);
4025         DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
4026                         mod_data.vendor, mod_data.product, mod_data.release);
4027         DBG(fsg, "removable=%d, stall=%d, buflen=%u\n",
4028                         mod_data.removable, mod_data.can_stall,
4029                         mod_data.buflen);
4030         DBG(fsg, "I/O thread pid: %d\n", fsg->thread_task->pid);
4031
4032         set_bit(REGISTERED, &fsg->atomic_bitflags);
4033
4034         /* Tell the thread to start working */
4035         wake_up_process(fsg->thread_task);
4036         return 0;
4037
4038 autoconf_fail:
4039         ERROR(fsg, "unable to autoconfigure all endpoints\n");
4040         rc = -ENOTSUPP;
4041
4042 out:
4043         fsg->state = FSG_STATE_TERMINATED;      // The thread is dead
4044         fsg_unbind(gadget);
4045         close_all_backing_files(fsg);
4046         return rc;
4047 }
4048
4049
4050 /*-------------------------------------------------------------------------*/
4051
4052 static void fsg_suspend(struct usb_gadget *gadget)
4053 {
4054         struct fsg_dev          *fsg = get_gadget_data(gadget);
4055
4056         DBG(fsg, "suspend\n");
4057         set_bit(SUSPENDED, &fsg->atomic_bitflags);
4058 }
4059
4060 static void fsg_resume(struct usb_gadget *gadget)
4061 {
4062         struct fsg_dev          *fsg = get_gadget_data(gadget);
4063
4064         DBG(fsg, "resume\n");
4065         clear_bit(SUSPENDED, &fsg->atomic_bitflags);
4066 }
4067
4068
4069 /*-------------------------------------------------------------------------*/
4070
4071 static struct usb_gadget_driver         fsg_driver = {
4072 #ifdef CONFIG_USB_GADGET_DUALSPEED
4073         .speed          = USB_SPEED_HIGH,
4074 #else
4075         .speed          = USB_SPEED_FULL,
4076 #endif
4077         .function       = (char *) longname,
4078         .bind           = fsg_bind,
4079         .unbind         = __exit_p(fsg_unbind),
4080         .disconnect     = fsg_disconnect,
4081         .setup          = fsg_setup,
4082         .suspend        = fsg_suspend,
4083         .resume         = fsg_resume,
4084
4085         .driver         = {
4086                 .name           = (char *) shortname,
4087                 .owner          = THIS_MODULE,
4088                 // .release = ...
4089                 // .suspend = ...
4090                 // .resume = ...
4091         },
4092 };
4093
4094
4095 static int __init fsg_alloc(void)
4096 {
4097         struct fsg_dev          *fsg;
4098
4099         fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
4100         if (!fsg)
4101                 return -ENOMEM;
4102         spin_lock_init(&fsg->lock);
4103         init_rwsem(&fsg->filesem);
4104         kref_init(&fsg->ref);
4105         init_completion(&fsg->thread_notifier);
4106
4107         the_fsg = fsg;
4108         return 0;
4109 }
4110
4111
4112 static int __init fsg_init(void)
4113 {
4114         int             rc;
4115         struct fsg_dev  *fsg;
4116
4117         if ((rc = fsg_alloc()) != 0)
4118                 return rc;
4119         fsg = the_fsg;
4120         if ((rc = usb_gadget_register_driver(&fsg_driver)) != 0)
4121                 kref_put(&fsg->ref, fsg_release);
4122         return rc;
4123 }
4124 module_init(fsg_init);
4125
4126
4127 static void __exit fsg_cleanup(void)
4128 {
4129         struct fsg_dev  *fsg = the_fsg;
4130
4131         /* Unregister the driver iff the thread hasn't already done so */
4132         if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
4133                 usb_gadget_unregister_driver(&fsg_driver);
4134
4135         /* Wait for the thread to finish up */
4136         wait_for_completion(&fsg->thread_notifier);
4137
4138         close_all_backing_files(fsg);
4139         kref_put(&fsg->ref, fsg_release);
4140 }
4141 module_exit(fsg_cleanup);