0a18d446e9dd26322c60d296c87a811616799e9b
[linux-2.6.git] / drivers / usb / gadget / f_mass_storage.c
1 /*
2  * f_mass_storage.c -- Mass Storage USB Composite Function
3  *
4  * Copyright (C) 2003-2008 Alan Stern
5  * Copyright (C) 2009 Samsung Electronics
6  *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions, and the following disclaimer,
14  *    without modification.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. The names of the above-listed copyright holders may not be used
19  *    to endorse or promote products derived from this software without
20  *    specific prior written permission.
21  *
22  * ALTERNATIVELY, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") as published by the Free Software
24  * Foundation, either version 2 of that License or (at your option) any
25  * later version.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
28  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
29  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
31  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
32  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
33  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
34  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
35  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
36  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
37  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38  */
39
40
41 /*
42  * The Mass Storage Function acts as a USB Mass Storage device,
43  * appearing to the host as a disk drive or as a CD-ROM drive.  In
44  * addition to providing an example of a genuinely useful composite
45  * function for a USB device, it also illustrates a technique of
46  * double-buffering for increased throughput.
47  *
48  * Function supports multiple logical units (LUNs).  Backing storage
49  * for each LUN is provided by a regular file or a block device.
50  * Access for each LUN can be limited to read-only.  Moreover, the
51  * function can indicate that LUN is removable and/or CD-ROM.  (The
52  * later implies read-only access.)
53  *
54  * MSF is configured by specifying a fsg_config structure.  It has the
55  * following fields:
56  *
57  *      nluns           Number of LUNs function have (anywhere from 1
58  *                              to FSG_MAX_LUNS which is 8).
59  *      luns            An array of LUN configuration values.  This
60  *                              should be filled for each LUN that
61  *                              function will include (ie. for "nluns"
62  *                              LUNs).  Each element of the array has
63  *                              the following fields:
64  *      ->filename      The path to the backing file for the LUN.
65  *                              Required if LUN is not marked as
66  *                              removable.
67  *      ->ro            Flag specifying access to the LUN shall be
68  *                              read-only.  This is implied if CD-ROM
69  *                              emulation is enabled as well as when
70  *                              it was impossible to open "filename"
71  *                              in R/W mode.
72  *      ->removable     Flag specifying that LUN shall be indicated as
73  *                              being removable.
74  *      ->cdrom         Flag specifying that LUN shall be reported as
75  *                              being a CD-ROM.
76  *
77  *      lun_name_format A printf-like format for names of the LUN
78  *                              devices.  This determines how the
79  *                              directory in sysfs will be named.
80  *                              Unless you are using several MSFs in
81  *                              a single gadget (as opposed to single
82  *                              MSF in many configurations) you may
83  *                              leave it as NULL (in which case
84  *                              "lun%d" will be used).  In the format
85  *                              you can use "%d" to index LUNs for
86  *                              MSF's with more than one LUN.  (Beware
87  *                              that there is only one integer given
88  *                              as an argument for the format and
89  *                              specifying invalid format may cause
90  *                              unspecified behaviour.)
91  *      thread_name     Name of the kernel thread process used by the
92  *                              MSF.  You can safely set it to NULL
93  *                              (in which case default "file-storage"
94  *                              will be used).
95  *
96  *      vendor_name
97  *      product_name
98  *      release         Information used as a reply to INQUIRY
99  *                              request.  To use default set to NULL,
100  *                              NULL, 0xffff respectively.  The first
101  *                              field should be 8 and the second 16
102  *                              characters or less.
103  *
104  *      can_stall       Set to permit function to halt bulk endpoints.
105  *                              Disabled on some USB devices known not
106  *                              to work correctly.  You should set it
107  *                              to true.
108  *
109  * If "removable" is not set for a LUN then a backing file must be
110  * specified.  If it is set, then NULL filename means the LUN's medium
111  * is not loaded (an empty string as "filename" in the fsg_config
112  * structure causes error).  The CD-ROM emulation includes a single
113  * data track and no audio tracks; hence there need be only one
114  * backing file per LUN.  Note also that the CD-ROM block length is
115  * set to 512 rather than the more common value 2048.
116  *
117  *
118  * MSF includes support for module parameters.  If gadget using it
119  * decides to use it, the following module parameters will be
120  * available:
121  *
122  *      file=filename[,filename...]
123  *                      Names of the files or block devices used for
124  *                              backing storage.
125  *      ro=b[,b...]     Default false, boolean for read-only access.
126  *      removable=b[,b...]
127  *                      Default true, boolean for removable media.
128  *      cdrom=b[,b...]  Default false, boolean for whether to emulate
129  *                              a CD-ROM drive.
130  *      luns=N          Default N = number of filenames, number of
131  *                              LUNs to support.
132  *      stall           Default determined according to the type of
133  *                              USB device controller (usually true),
134  *                              boolean to permit the driver to halt
135  *                              bulk endpoints.
136  *
137  * The module parameters may be prefixed with some string.  You need
138  * to consult gadget's documentation or source to verify whether it is
139  * using those module parameters and if it does what are the prefixes
140  * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
141  * the prefix).
142  *
143  *
144  * Requirements are modest; only a bulk-in and a bulk-out endpoint are
145  * needed.  The memory requirement amounts to two 16K buffers, size
146  * configurable by a parameter.  Support is included for both
147  * full-speed and high-speed operation.
148  *
149  * Note that the driver is slightly non-portable in that it assumes a
150  * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
151  * interrupt-in endpoints.  With most device controllers this isn't an
152  * issue, but there may be some with hardware restrictions that prevent
153  * a buffer from being used by more than one endpoint.
154  *
155  *
156  * The pathnames of the backing files and the ro settings are
157  * available in the attribute files "file" and "ro" in the lun<n> (or
158  * to be more precise in a directory which name comes from
159  * "lun_name_format" option!) subdirectory of the gadget's sysfs
160  * directory.  If the "removable" option is set, writing to these
161  * files will simulate ejecting/loading the medium (writing an empty
162  * line means eject) and adjusting a write-enable tab.  Changes to the
163  * ro setting are not allowed when the medium is loaded or if CD-ROM
164  * emulation is being used.
165  *
166  *
167  * This function is heavily based on "File-backed Storage Gadget" by
168  * Alan Stern which in turn is heavily based on "Gadget Zero" by David
169  * Brownell.  The driver's SCSI command interface was based on the
170  * "Information technology - Small Computer System Interface - 2"
171  * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
172  * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
173  * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
174  * was based on the "Universal Serial Bus Mass Storage Class UFI
175  * Command Specification" document, Revision 1.0, December 14, 1998,
176  * available at
177  * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
178  */
179
180
181 /*
182  *                              Driver Design
183  *
184  * The MSF is fairly straightforward.  There is a main kernel
185  * thread that handles most of the work.  Interrupt routines field
186  * callbacks from the controller driver: bulk- and interrupt-request
187  * completion notifications, endpoint-0 events, and disconnect events.
188  * Completion events are passed to the main thread by wakeup calls.  Many
189  * ep0 requests are handled at interrupt time, but SetInterface,
190  * SetConfiguration, and device reset requests are forwarded to the
191  * thread in the form of "exceptions" using SIGUSR1 signals (since they
192  * should interrupt any ongoing file I/O operations).
193  *
194  * The thread's main routine implements the standard command/data/status
195  * parts of a SCSI interaction.  It and its subroutines are full of tests
196  * for pending signals/exceptions -- all this polling is necessary since
197  * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
198  * indication that the driver really wants to be running in userspace.)
199  * An important point is that so long as the thread is alive it keeps an
200  * open reference to the backing file.  This will prevent unmounting
201  * the backing file's underlying filesystem and could cause problems
202  * during system shutdown, for example.  To prevent such problems, the
203  * thread catches INT, TERM, and KILL signals and converts them into
204  * an EXIT exception.
205  *
206  * In normal operation the main thread is started during the gadget's
207  * fsg_bind() callback and stopped during fsg_unbind().  But it can
208  * also exit when it receives a signal, and there's no point leaving
209  * the gadget running when the thread is dead.  At of this moment, MSF
210  * provides no way to deregister the gadget when thread dies -- maybe
211  * a callback functions is needed.
212  *
213  * To provide maximum throughput, the driver uses a circular pipeline of
214  * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
215  * arbitrarily long; in practice the benefits don't justify having more
216  * than 2 stages (i.e., double buffering).  But it helps to think of the
217  * pipeline as being a long one.  Each buffer head contains a bulk-in and
218  * a bulk-out request pointer (since the buffer can be used for both
219  * output and input -- directions always are given from the host's
220  * point of view) as well as a pointer to the buffer and various state
221  * variables.
222  *
223  * Use of the pipeline follows a simple protocol.  There is a variable
224  * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
225  * At any time that buffer head may still be in use from an earlier
226  * request, so each buffer head has a state variable indicating whether
227  * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
228  * buffer head to be EMPTY, filling the buffer either by file I/O or by
229  * USB I/O (during which the buffer head is BUSY), and marking the buffer
230  * head FULL when the I/O is complete.  Then the buffer will be emptied
231  * (again possibly by USB I/O, during which it is marked BUSY) and
232  * finally marked EMPTY again (possibly by a completion routine).
233  *
234  * A module parameter tells the driver to avoid stalling the bulk
235  * endpoints wherever the transport specification allows.  This is
236  * necessary for some UDCs like the SuperH, which cannot reliably clear a
237  * halt on a bulk endpoint.  However, under certain circumstances the
238  * Bulk-only specification requires a stall.  In such cases the driver
239  * will halt the endpoint and set a flag indicating that it should clear
240  * the halt in software during the next device reset.  Hopefully this
241  * will permit everything to work correctly.  Furthermore, although the
242  * specification allows the bulk-out endpoint to halt when the host sends
243  * too much data, implementing this would cause an unavoidable race.
244  * The driver will always use the "no-stall" approach for OUT transfers.
245  *
246  * One subtle point concerns sending status-stage responses for ep0
247  * requests.  Some of these requests, such as device reset, can involve
248  * interrupting an ongoing file I/O operation, which might take an
249  * arbitrarily long time.  During that delay the host might give up on
250  * the original ep0 request and issue a new one.  When that happens the
251  * driver should not notify the host about completion of the original
252  * request, as the host will no longer be waiting for it.  So the driver
253  * assigns to each ep0 request a unique tag, and it keeps track of the
254  * tag value of the request associated with a long-running exception
255  * (device-reset, interface-change, or configuration-change).  When the
256  * exception handler is finished, the status-stage response is submitted
257  * only if the current ep0 request tag is equal to the exception request
258  * tag.  Thus only the most recently received ep0 request will get a
259  * status-stage response.
260  *
261  * Warning: This driver source file is too long.  It ought to be split up
262  * into a header file plus about 3 separate .c files, to handle the details
263  * of the Gadget, USB Mass Storage, and SCSI protocols.
264  */
265
266
267 /* #define VERBOSE_DEBUG */
268 /* #define DUMP_MSGS */
269
270
271 #include <linux/blkdev.h>
272 #include <linux/completion.h>
273 #include <linux/dcache.h>
274 #include <linux/delay.h>
275 #include <linux/device.h>
276 #include <linux/fcntl.h>
277 #include <linux/file.h>
278 #include <linux/fs.h>
279 #include <linux/kref.h>
280 #include <linux/kthread.h>
281 #include <linux/limits.h>
282 #include <linux/rwsem.h>
283 #include <linux/slab.h>
284 #include <linux/spinlock.h>
285 #include <linux/string.h>
286 #include <linux/freezer.h>
287 #include <linux/utsname.h>
288
289 #include <linux/usb/ch9.h>
290 #include <linux/usb/gadget.h>
291
292 #include "gadget_chips.h"
293
294
295
296 /*------------------------------------------------------------------------*/
297
298 #define FSG_DRIVER_DESC         "Mass Storage Function"
299 #define FSG_DRIVER_VERSION      "2009/09/11"
300
301 static const char fsg_string_interface[] = "Mass Storage";
302
303
304 #define FSG_NO_INTR_EP 1
305 #define FSG_BUFFHD_STATIC_BUFFER 1
306 #define FSG_NO_DEVICE_STRINGS    1
307 #define FSG_NO_OTG               1
308 #define FSG_NO_INTR_EP           1
309
310 #include "storage_common.c"
311
312
313 /*-------------------------------------------------------------------------*/
314
315 struct fsg_dev;
316
317
318 /* Data shared by all the FSG instances. */
319 struct fsg_common {
320         struct usb_gadget       *gadget;
321         struct fsg_dev          *fsg;
322         struct fsg_dev          *prev_fsg;
323
324         /* filesem protects: backing files in use */
325         struct rw_semaphore     filesem;
326
327         /* lock protects: state, all the req_busy's */
328         spinlock_t              lock;
329
330         struct usb_ep           *ep0;           /* Copy of gadget->ep0 */
331         struct usb_request      *ep0req;        /* Copy of cdev->req */
332         unsigned int            ep0_req_tag;
333         const char              *ep0req_name;
334
335         struct fsg_buffhd       *next_buffhd_to_fill;
336         struct fsg_buffhd       *next_buffhd_to_drain;
337         struct fsg_buffhd       buffhds[FSG_NUM_BUFFERS];
338
339         int                     cmnd_size;
340         u8                      cmnd[MAX_COMMAND_SIZE];
341
342         unsigned int            nluns;
343         unsigned int            lun;
344         struct fsg_lun          *luns;
345         struct fsg_lun          *curlun;
346
347         unsigned int            bulk_out_maxpacket;
348         enum fsg_state          state;          /* For exception handling */
349         unsigned int            exception_req_tag;
350
351         u8                      config, new_config;
352         enum data_direction     data_dir;
353         u32                     data_size;
354         u32                     data_size_from_cmnd;
355         u32                     tag;
356         u32                     residue;
357         u32                     usb_amount_left;
358
359         unsigned int            can_stall:1;
360         unsigned int            free_storage_on_release:1;
361         unsigned int            phase_error:1;
362         unsigned int            short_packet_received:1;
363         unsigned int            bad_lun_okay:1;
364         unsigned int            running:1;
365
366         int                     thread_wakeup_needed;
367         struct completion       thread_notifier;
368         struct task_struct      *thread_task;
369
370         /* Callback function to call when thread exits. */
371         int                     (*thread_exits)(struct fsg_common *common);
372         /* Gadget's private data. */
373         void                    *private_data;
374
375         /* Vendor (8 chars), product (16 chars), release (4
376          * hexadecimal digits) and NUL byte */
377         char inquiry_string[8 + 16 + 4 + 1];
378
379         struct kref             ref;
380 };
381
382
383 struct fsg_config {
384         unsigned nluns;
385         struct fsg_lun_config {
386                 const char *filename;
387                 char ro;
388                 char removable;
389                 char cdrom;
390         } luns[FSG_MAX_LUNS];
391
392         const char              *lun_name_format;
393         const char              *thread_name;
394
395         /* Callback function to call when thread exits.  If no
396          * callback is set or it returns value lower then zero MSF
397          * will force eject all LUNs it operates on (including those
398          * marked as non-removable or with prevent_medium_removal flag
399          * set). */
400         int                     (*thread_exits)(struct fsg_common *common);
401         /* Gadget's private data. */
402         void                    *private_data;
403
404         const char *vendor_name;                /*  8 characters or less */
405         const char *product_name;               /* 16 characters or less */
406         u16 release;
407
408         char                    can_stall;
409 };
410
411
412 struct fsg_dev {
413         struct usb_function     function;
414         struct usb_gadget       *gadget;        /* Copy of cdev->gadget */
415         struct fsg_common       *common;
416
417         u16                     interface_number;
418
419         unsigned int            bulk_in_enabled:1;
420         unsigned int            bulk_out_enabled:1;
421
422         unsigned long           atomic_bitflags;
423 #define IGNORE_BULK_OUT         0
424
425         struct usb_ep           *bulk_in;
426         struct usb_ep           *bulk_out;
427 };
428
429
430 static inline int __fsg_is_set(struct fsg_common *common,
431                                const char *func, unsigned line)
432 {
433         if (common->fsg)
434                 return 1;
435         ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
436         return 0;
437 }
438
439 #define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
440
441
442 static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
443 {
444         return container_of(f, struct fsg_dev, function);
445 }
446
447
448 typedef void (*fsg_routine_t)(struct fsg_dev *);
449
450 static int exception_in_progress(struct fsg_common *common)
451 {
452         return common->state > FSG_STATE_IDLE;
453 }
454
455 /* Make bulk-out requests be divisible by the maxpacket size */
456 static void set_bulk_out_req_length(struct fsg_common *common,
457                 struct fsg_buffhd *bh, unsigned int length)
458 {
459         unsigned int    rem;
460
461         bh->bulk_out_intended_length = length;
462         rem = length % common->bulk_out_maxpacket;
463         if (rem > 0)
464                 length += common->bulk_out_maxpacket - rem;
465         bh->outreq->length = length;
466 }
467
468 /*-------------------------------------------------------------------------*/
469
470 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
471 {
472         const char      *name;
473
474         if (ep == fsg->bulk_in)
475                 name = "bulk-in";
476         else if (ep == fsg->bulk_out)
477                 name = "bulk-out";
478         else
479                 name = ep->name;
480         DBG(fsg, "%s set halt\n", name);
481         return usb_ep_set_halt(ep);
482 }
483
484
485 /*-------------------------------------------------------------------------*/
486
487 /* These routines may be called in process context or in_irq */
488
489 /* Caller must hold fsg->lock */
490 static void wakeup_thread(struct fsg_common *common)
491 {
492         /* Tell the main thread that something has happened */
493         common->thread_wakeup_needed = 1;
494         if (common->thread_task)
495                 wake_up_process(common->thread_task);
496 }
497
498
499 static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
500 {
501         unsigned long           flags;
502
503         /* Do nothing if a higher-priority exception is already in progress.
504          * If a lower-or-equal priority exception is in progress, preempt it
505          * and notify the main thread by sending it a signal. */
506         spin_lock_irqsave(&common->lock, flags);
507         if (common->state <= new_state) {
508                 common->exception_req_tag = common->ep0_req_tag;
509                 common->state = new_state;
510                 if (common->thread_task)
511                         send_sig_info(SIGUSR1, SEND_SIG_FORCED,
512                                       common->thread_task);
513         }
514         spin_unlock_irqrestore(&common->lock, flags);
515 }
516
517
518 /*-------------------------------------------------------------------------*/
519
520 static int ep0_queue(struct fsg_common *common)
521 {
522         int     rc;
523
524         rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC);
525         common->ep0->driver_data = common;
526         if (rc != 0 && rc != -ESHUTDOWN) {
527                 /* We can't do much more than wait for a reset */
528                 WARNING(common, "error in submission: %s --> %d\n",
529                         common->ep0->name, rc);
530         }
531         return rc;
532 }
533
534 /*-------------------------------------------------------------------------*/
535
536 /* Bulk and interrupt endpoint completion handlers.
537  * These always run in_irq. */
538
539 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
540 {
541         struct fsg_common       *common = ep->driver_data;
542         struct fsg_buffhd       *bh = req->context;
543
544         if (req->status || req->actual != req->length)
545                 DBG(common, "%s --> %d, %u/%u\n", __func__,
546                                 req->status, req->actual, req->length);
547         if (req->status == -ECONNRESET)         /* Request was cancelled */
548                 usb_ep_fifo_flush(ep);
549
550         /* Hold the lock while we update the request and buffer states */
551         smp_wmb();
552         spin_lock(&common->lock);
553         bh->inreq_busy = 0;
554         bh->state = BUF_STATE_EMPTY;
555         wakeup_thread(common);
556         spin_unlock(&common->lock);
557 }
558
559 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
560 {
561         struct fsg_common       *common = ep->driver_data;
562         struct fsg_buffhd       *bh = req->context;
563
564         dump_msg(common, "bulk-out", req->buf, req->actual);
565         if (req->status || req->actual != bh->bulk_out_intended_length)
566                 DBG(common, "%s --> %d, %u/%u\n", __func__,
567                                 req->status, req->actual,
568                                 bh->bulk_out_intended_length);
569         if (req->status == -ECONNRESET)         /* Request was cancelled */
570                 usb_ep_fifo_flush(ep);
571
572         /* Hold the lock while we update the request and buffer states */
573         smp_wmb();
574         spin_lock(&common->lock);
575         bh->outreq_busy = 0;
576         bh->state = BUF_STATE_FULL;
577         wakeup_thread(common);
578         spin_unlock(&common->lock);
579 }
580
581
582 /*-------------------------------------------------------------------------*/
583
584 /* Ep0 class-specific handlers.  These always run in_irq. */
585
586 static int fsg_setup(struct usb_function *f,
587                 const struct usb_ctrlrequest *ctrl)
588 {
589         struct fsg_dev          *fsg = fsg_from_func(f);
590         struct usb_request      *req = fsg->common->ep0req;
591         u16                     w_index = le16_to_cpu(ctrl->wIndex);
592         u16                     w_value = le16_to_cpu(ctrl->wValue);
593         u16                     w_length = le16_to_cpu(ctrl->wLength);
594
595         if (!fsg->common->config)
596                 return -EOPNOTSUPP;
597
598         switch (ctrl->bRequest) {
599
600         case USB_BULK_RESET_REQUEST:
601                 if (ctrl->bRequestType !=
602                     (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
603                         break;
604                 if (w_index != fsg->interface_number || w_value != 0)
605                         return -EDOM;
606
607                 /* Raise an exception to stop the current operation
608                  * and reinitialize our state. */
609                 DBG(fsg, "bulk reset request\n");
610                 raise_exception(fsg->common, FSG_STATE_RESET);
611                 return DELAYED_STATUS;
612
613         case USB_BULK_GET_MAX_LUN_REQUEST:
614                 if (ctrl->bRequestType !=
615                     (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
616                         break;
617                 if (w_index != fsg->interface_number || w_value != 0)
618                         return -EDOM;
619                 VDBG(fsg, "get max LUN\n");
620                 *(u8 *) req->buf = fsg->common->nluns - 1;
621                 return 1;
622         }
623
624         VDBG(fsg,
625              "unknown class-specific control req "
626              "%02x.%02x v%04x i%04x l%u\n",
627              ctrl->bRequestType, ctrl->bRequest,
628              le16_to_cpu(ctrl->wValue), w_index, w_length);
629         return -EOPNOTSUPP;
630 }
631
632
633 /*-------------------------------------------------------------------------*/
634
635 /* All the following routines run in process context */
636
637
638 /* Use this for bulk or interrupt transfers, not ep0 */
639 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
640                 struct usb_request *req, int *pbusy,
641                 enum fsg_buffer_state *state)
642 {
643         int     rc;
644
645         if (ep == fsg->bulk_in)
646                 dump_msg(fsg, "bulk-in", req->buf, req->length);
647
648         spin_lock_irq(&fsg->common->lock);
649         *pbusy = 1;
650         *state = BUF_STATE_BUSY;
651         spin_unlock_irq(&fsg->common->lock);
652         rc = usb_ep_queue(ep, req, GFP_KERNEL);
653         if (rc != 0) {
654                 *pbusy = 0;
655                 *state = BUF_STATE_EMPTY;
656
657                 /* We can't do much more than wait for a reset */
658
659                 /* Note: currently the net2280 driver fails zero-length
660                  * submissions if DMA is enabled. */
661                 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
662                                                 req->length == 0))
663                         WARNING(fsg, "error in submission: %s --> %d\n",
664                                         ep->name, rc);
665         }
666 }
667
668 #define START_TRANSFER_OR(common, ep_name, req, pbusy, state)           \
669         if (fsg_is_set(common))                                         \
670                 start_transfer((common)->fsg, (common)->fsg->ep_name,   \
671                                req, pbusy, state);                      \
672         else
673
674 #define START_TRANSFER(common, ep_name, req, pbusy, state)              \
675         START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
676
677
678
679 static int sleep_thread(struct fsg_common *common)
680 {
681         int     rc = 0;
682
683         /* Wait until a signal arrives or we are woken up */
684         for (;;) {
685                 try_to_freeze();
686                 set_current_state(TASK_INTERRUPTIBLE);
687                 if (signal_pending(current)) {
688                         rc = -EINTR;
689                         break;
690                 }
691                 if (common->thread_wakeup_needed)
692                         break;
693                 schedule();
694         }
695         __set_current_state(TASK_RUNNING);
696         common->thread_wakeup_needed = 0;
697         return rc;
698 }
699
700
701 /*-------------------------------------------------------------------------*/
702
703 static int do_read(struct fsg_common *common)
704 {
705         struct fsg_lun          *curlun = common->curlun;
706         u32                     lba;
707         struct fsg_buffhd       *bh;
708         int                     rc;
709         u32                     amount_left;
710         loff_t                  file_offset, file_offset_tmp;
711         unsigned int            amount;
712         unsigned int            partial_page;
713         ssize_t                 nread;
714
715         /* Get the starting Logical Block Address and check that it's
716          * not too big */
717         if (common->cmnd[0] == SC_READ_6)
718                 lba = get_unaligned_be24(&common->cmnd[1]);
719         else {
720                 lba = get_unaligned_be32(&common->cmnd[2]);
721
722                 /* We allow DPO (Disable Page Out = don't save data in the
723                  * cache) and FUA (Force Unit Access = don't read from the
724                  * cache), but we don't implement them. */
725                 if ((common->cmnd[1] & ~0x18) != 0) {
726                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
727                         return -EINVAL;
728                 }
729         }
730         if (lba >= curlun->num_sectors) {
731                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
732                 return -EINVAL;
733         }
734         file_offset = ((loff_t) lba) << 9;
735
736         /* Carry out the file reads */
737         amount_left = common->data_size_from_cmnd;
738         if (unlikely(amount_left == 0))
739                 return -EIO;            /* No default reply */
740
741         for (;;) {
742
743                 /* Figure out how much we need to read:
744                  * Try to read the remaining amount.
745                  * But don't read more than the buffer size.
746                  * And don't try to read past the end of the file.
747                  * Finally, if we're not at a page boundary, don't read past
748                  *      the next page.
749                  * If this means reading 0 then we were asked to read past
750                  *      the end of file. */
751                 amount = min(amount_left, FSG_BUFLEN);
752                 amount = min((loff_t) amount,
753                                 curlun->file_length - file_offset);
754                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
755                 if (partial_page > 0)
756                         amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
757                                         partial_page);
758
759                 /* Wait for the next buffer to become available */
760                 bh = common->next_buffhd_to_fill;
761                 while (bh->state != BUF_STATE_EMPTY) {
762                         rc = sleep_thread(common);
763                         if (rc)
764                                 return rc;
765                 }
766
767                 /* If we were asked to read past the end of file,
768                  * end with an empty buffer. */
769                 if (amount == 0) {
770                         curlun->sense_data =
771                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
772                         curlun->sense_data_info = file_offset >> 9;
773                         curlun->info_valid = 1;
774                         bh->inreq->length = 0;
775                         bh->state = BUF_STATE_FULL;
776                         break;
777                 }
778
779                 /* Perform the read */
780                 file_offset_tmp = file_offset;
781                 nread = vfs_read(curlun->filp,
782                                 (char __user *) bh->buf,
783                                 amount, &file_offset_tmp);
784                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
785                                 (unsigned long long) file_offset,
786                                 (int) nread);
787                 if (signal_pending(current))
788                         return -EINTR;
789
790                 if (nread < 0) {
791                         LDBG(curlun, "error in file read: %d\n",
792                                         (int) nread);
793                         nread = 0;
794                 } else if (nread < amount) {
795                         LDBG(curlun, "partial file read: %d/%u\n",
796                                         (int) nread, amount);
797                         nread -= (nread & 511); /* Round down to a block */
798                 }
799                 file_offset  += nread;
800                 amount_left  -= nread;
801                 common->residue -= nread;
802                 bh->inreq->length = nread;
803                 bh->state = BUF_STATE_FULL;
804
805                 /* If an error occurred, report it and its position */
806                 if (nread < amount) {
807                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
808                         curlun->sense_data_info = file_offset >> 9;
809                         curlun->info_valid = 1;
810                         break;
811                 }
812
813                 if (amount_left == 0)
814                         break;          /* No more left to read */
815
816                 /* Send this buffer and go read some more */
817                 bh->inreq->zero = 0;
818                 START_TRANSFER_OR(common, bulk_in, bh->inreq,
819                                &bh->inreq_busy, &bh->state)
820                         /* Don't know what to do if
821                          * common->fsg is NULL */
822                         return -EIO;
823                 common->next_buffhd_to_fill = bh->next;
824         }
825
826         return -EIO;            /* No default reply */
827 }
828
829
830 /*-------------------------------------------------------------------------*/
831
832 static int do_write(struct fsg_common *common)
833 {
834         struct fsg_lun          *curlun = common->curlun;
835         u32                     lba;
836         struct fsg_buffhd       *bh;
837         int                     get_some_more;
838         u32                     amount_left_to_req, amount_left_to_write;
839         loff_t                  usb_offset, file_offset, file_offset_tmp;
840         unsigned int            amount;
841         unsigned int            partial_page;
842         ssize_t                 nwritten;
843         int                     rc;
844
845         if (curlun->ro) {
846                 curlun->sense_data = SS_WRITE_PROTECTED;
847                 return -EINVAL;
848         }
849         spin_lock(&curlun->filp->f_lock);
850         curlun->filp->f_flags &= ~O_SYNC;       /* Default is not to wait */
851         spin_unlock(&curlun->filp->f_lock);
852
853         /* Get the starting Logical Block Address and check that it's
854          * not too big */
855         if (common->cmnd[0] == SC_WRITE_6)
856                 lba = get_unaligned_be24(&common->cmnd[1]);
857         else {
858                 lba = get_unaligned_be32(&common->cmnd[2]);
859
860                 /* We allow DPO (Disable Page Out = don't save data in the
861                  * cache) and FUA (Force Unit Access = write directly to the
862                  * medium).  We don't implement DPO; we implement FUA by
863                  * performing synchronous output. */
864                 if (common->cmnd[1] & ~0x18) {
865                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
866                         return -EINVAL;
867                 }
868                 if (common->cmnd[1] & 0x08) {   /* FUA */
869                         spin_lock(&curlun->filp->f_lock);
870                         curlun->filp->f_flags |= O_SYNC;
871                         spin_unlock(&curlun->filp->f_lock);
872                 }
873         }
874         if (lba >= curlun->num_sectors) {
875                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
876                 return -EINVAL;
877         }
878
879         /* Carry out the file writes */
880         get_some_more = 1;
881         file_offset = usb_offset = ((loff_t) lba) << 9;
882         amount_left_to_req = common->data_size_from_cmnd;
883         amount_left_to_write = common->data_size_from_cmnd;
884
885         while (amount_left_to_write > 0) {
886
887                 /* Queue a request for more data from the host */
888                 bh = common->next_buffhd_to_fill;
889                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
890
891                         /* Figure out how much we want to get:
892                          * Try to get the remaining amount.
893                          * But don't get more than the buffer size.
894                          * And don't try to go past the end of the file.
895                          * If we're not at a page boundary,
896                          *      don't go past the next page.
897                          * If this means getting 0, then we were asked
898                          *      to write past the end of file.
899                          * Finally, round down to a block boundary. */
900                         amount = min(amount_left_to_req, FSG_BUFLEN);
901                         amount = min((loff_t) amount, curlun->file_length -
902                                         usb_offset);
903                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
904                         if (partial_page > 0)
905                                 amount = min(amount,
906         (unsigned int) PAGE_CACHE_SIZE - partial_page);
907
908                         if (amount == 0) {
909                                 get_some_more = 0;
910                                 curlun->sense_data =
911                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
912                                 curlun->sense_data_info = usb_offset >> 9;
913                                 curlun->info_valid = 1;
914                                 continue;
915                         }
916                         amount -= (amount & 511);
917                         if (amount == 0) {
918
919                                 /* Why were we were asked to transfer a
920                                  * partial block? */
921                                 get_some_more = 0;
922                                 continue;
923                         }
924
925                         /* Get the next buffer */
926                         usb_offset += amount;
927                         common->usb_amount_left -= amount;
928                         amount_left_to_req -= amount;
929                         if (amount_left_to_req == 0)
930                                 get_some_more = 0;
931
932                         /* amount is always divisible by 512, hence by
933                          * the bulk-out maxpacket size */
934                         bh->outreq->length = amount;
935                         bh->bulk_out_intended_length = amount;
936                         bh->outreq->short_not_ok = 1;
937                         START_TRANSFER_OR(common, bulk_out, bh->outreq,
938                                           &bh->outreq_busy, &bh->state)
939                                 /* Don't know what to do if
940                                  * common->fsg is NULL */
941                                 return -EIO;
942                         common->next_buffhd_to_fill = bh->next;
943                         continue;
944                 }
945
946                 /* Write the received data to the backing file */
947                 bh = common->next_buffhd_to_drain;
948                 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
949                         break;                  /* We stopped early */
950                 if (bh->state == BUF_STATE_FULL) {
951                         smp_rmb();
952                         common->next_buffhd_to_drain = bh->next;
953                         bh->state = BUF_STATE_EMPTY;
954
955                         /* Did something go wrong with the transfer? */
956                         if (bh->outreq->status != 0) {
957                                 curlun->sense_data = SS_COMMUNICATION_FAILURE;
958                                 curlun->sense_data_info = file_offset >> 9;
959                                 curlun->info_valid = 1;
960                                 break;
961                         }
962
963                         amount = bh->outreq->actual;
964                         if (curlun->file_length - file_offset < amount) {
965                                 LERROR(curlun,
966         "write %u @ %llu beyond end %llu\n",
967         amount, (unsigned long long) file_offset,
968         (unsigned long long) curlun->file_length);
969                                 amount = curlun->file_length - file_offset;
970                         }
971
972                         /* Perform the write */
973                         file_offset_tmp = file_offset;
974                         nwritten = vfs_write(curlun->filp,
975                                         (char __user *) bh->buf,
976                                         amount, &file_offset_tmp);
977                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
978                                         (unsigned long long) file_offset,
979                                         (int) nwritten);
980                         if (signal_pending(current))
981                                 return -EINTR;          /* Interrupted! */
982
983                         if (nwritten < 0) {
984                                 LDBG(curlun, "error in file write: %d\n",
985                                                 (int) nwritten);
986                                 nwritten = 0;
987                         } else if (nwritten < amount) {
988                                 LDBG(curlun, "partial file write: %d/%u\n",
989                                                 (int) nwritten, amount);
990                                 nwritten -= (nwritten & 511);
991                                 /* Round down to a block */
992                         }
993                         file_offset += nwritten;
994                         amount_left_to_write -= nwritten;
995                         common->residue -= nwritten;
996
997                         /* If an error occurred, report it and its position */
998                         if (nwritten < amount) {
999                                 curlun->sense_data = SS_WRITE_ERROR;
1000                                 curlun->sense_data_info = file_offset >> 9;
1001                                 curlun->info_valid = 1;
1002                                 break;
1003                         }
1004
1005                         /* Did the host decide to stop early? */
1006                         if (bh->outreq->actual != bh->outreq->length) {
1007                                 common->short_packet_received = 1;
1008                                 break;
1009                         }
1010                         continue;
1011                 }
1012
1013                 /* Wait for something to happen */
1014                 rc = sleep_thread(common);
1015                 if (rc)
1016                         return rc;
1017         }
1018
1019         return -EIO;            /* No default reply */
1020 }
1021
1022
1023 /*-------------------------------------------------------------------------*/
1024
1025 static int do_synchronize_cache(struct fsg_common *common)
1026 {
1027         struct fsg_lun  *curlun = common->curlun;
1028         int             rc;
1029
1030         /* We ignore the requested LBA and write out all file's
1031          * dirty data buffers. */
1032         rc = fsg_lun_fsync_sub(curlun);
1033         if (rc)
1034                 curlun->sense_data = SS_WRITE_ERROR;
1035         return 0;
1036 }
1037
1038
1039 /*-------------------------------------------------------------------------*/
1040
1041 static void invalidate_sub(struct fsg_lun *curlun)
1042 {
1043         struct file     *filp = curlun->filp;
1044         struct inode    *inode = filp->f_path.dentry->d_inode;
1045         unsigned long   rc;
1046
1047         rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
1048         VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
1049 }
1050
1051 static int do_verify(struct fsg_common *common)
1052 {
1053         struct fsg_lun          *curlun = common->curlun;
1054         u32                     lba;
1055         u32                     verification_length;
1056         struct fsg_buffhd       *bh = common->next_buffhd_to_fill;
1057         loff_t                  file_offset, file_offset_tmp;
1058         u32                     amount_left;
1059         unsigned int            amount;
1060         ssize_t                 nread;
1061
1062         /* Get the starting Logical Block Address and check that it's
1063          * not too big */
1064         lba = get_unaligned_be32(&common->cmnd[2]);
1065         if (lba >= curlun->num_sectors) {
1066                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1067                 return -EINVAL;
1068         }
1069
1070         /* We allow DPO (Disable Page Out = don't save data in the
1071          * cache) but we don't implement it. */
1072         if (common->cmnd[1] & ~0x10) {
1073                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1074                 return -EINVAL;
1075         }
1076
1077         verification_length = get_unaligned_be16(&common->cmnd[7]);
1078         if (unlikely(verification_length == 0))
1079                 return -EIO;            /* No default reply */
1080
1081         /* Prepare to carry out the file verify */
1082         amount_left = verification_length << 9;
1083         file_offset = ((loff_t) lba) << 9;
1084
1085         /* Write out all the dirty buffers before invalidating them */
1086         fsg_lun_fsync_sub(curlun);
1087         if (signal_pending(current))
1088                 return -EINTR;
1089
1090         invalidate_sub(curlun);
1091         if (signal_pending(current))
1092                 return -EINTR;
1093
1094         /* Just try to read the requested blocks */
1095         while (amount_left > 0) {
1096
1097                 /* Figure out how much we need to read:
1098                  * Try to read the remaining amount, but not more than
1099                  * the buffer size.
1100                  * And don't try to read past the end of the file.
1101                  * If this means reading 0 then we were asked to read
1102                  * past the end of file. */
1103                 amount = min(amount_left, FSG_BUFLEN);
1104                 amount = min((loff_t) amount,
1105                                 curlun->file_length - file_offset);
1106                 if (amount == 0) {
1107                         curlun->sense_data =
1108                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1109                         curlun->sense_data_info = file_offset >> 9;
1110                         curlun->info_valid = 1;
1111                         break;
1112                 }
1113
1114                 /* Perform the read */
1115                 file_offset_tmp = file_offset;
1116                 nread = vfs_read(curlun->filp,
1117                                 (char __user *) bh->buf,
1118                                 amount, &file_offset_tmp);
1119                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1120                                 (unsigned long long) file_offset,
1121                                 (int) nread);
1122                 if (signal_pending(current))
1123                         return -EINTR;
1124
1125                 if (nread < 0) {
1126                         LDBG(curlun, "error in file verify: %d\n",
1127                                         (int) nread);
1128                         nread = 0;
1129                 } else if (nread < amount) {
1130                         LDBG(curlun, "partial file verify: %d/%u\n",
1131                                         (int) nread, amount);
1132                         nread -= (nread & 511); /* Round down to a sector */
1133                 }
1134                 if (nread == 0) {
1135                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1136                         curlun->sense_data_info = file_offset >> 9;
1137                         curlun->info_valid = 1;
1138                         break;
1139                 }
1140                 file_offset += nread;
1141                 amount_left -= nread;
1142         }
1143         return 0;
1144 }
1145
1146
1147 /*-------------------------------------------------------------------------*/
1148
1149 static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
1150 {
1151         struct fsg_lun *curlun = common->curlun;
1152         u8      *buf = (u8 *) bh->buf;
1153
1154         if (!curlun) {          /* Unsupported LUNs are okay */
1155                 common->bad_lun_okay = 1;
1156                 memset(buf, 0, 36);
1157                 buf[0] = 0x7f;          /* Unsupported, no device-type */
1158                 buf[4] = 31;            /* Additional length */
1159                 return 36;
1160         }
1161
1162         buf[0] = curlun->cdrom ? TYPE_CDROM : TYPE_DISK;
1163         buf[1] = curlun->removable ? 0x80 : 0;
1164         buf[2] = 2;             /* ANSI SCSI level 2 */
1165         buf[3] = 2;             /* SCSI-2 INQUIRY data format */
1166         buf[4] = 31;            /* Additional length */
1167         buf[5] = 0;             /* No special options */
1168         buf[6] = 0;
1169         buf[7] = 0;
1170         memcpy(buf + 8, common->inquiry_string, sizeof common->inquiry_string);
1171         return 36;
1172 }
1173
1174
1175 static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1176 {
1177         struct fsg_lun  *curlun = common->curlun;
1178         u8              *buf = (u8 *) bh->buf;
1179         u32             sd, sdinfo;
1180         int             valid;
1181
1182         /*
1183          * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1184          *
1185          * If a REQUEST SENSE command is received from an initiator
1186          * with a pending unit attention condition (before the target
1187          * generates the contingent allegiance condition), then the
1188          * target shall either:
1189          *   a) report any pending sense data and preserve the unit
1190          *      attention condition on the logical unit, or,
1191          *   b) report the unit attention condition, may discard any
1192          *      pending sense data, and clear the unit attention
1193          *      condition on the logical unit for that initiator.
1194          *
1195          * FSG normally uses option a); enable this code to use option b).
1196          */
1197 #if 0
1198         if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1199                 curlun->sense_data = curlun->unit_attention_data;
1200                 curlun->unit_attention_data = SS_NO_SENSE;
1201         }
1202 #endif
1203
1204         if (!curlun) {          /* Unsupported LUNs are okay */
1205                 common->bad_lun_okay = 1;
1206                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1207                 sdinfo = 0;
1208                 valid = 0;
1209         } else {
1210                 sd = curlun->sense_data;
1211                 sdinfo = curlun->sense_data_info;
1212                 valid = curlun->info_valid << 7;
1213                 curlun->sense_data = SS_NO_SENSE;
1214                 curlun->sense_data_info = 0;
1215                 curlun->info_valid = 0;
1216         }
1217
1218         memset(buf, 0, 18);
1219         buf[0] = valid | 0x70;                  /* Valid, current error */
1220         buf[2] = SK(sd);
1221         put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
1222         buf[7] = 18 - 8;                        /* Additional sense length */
1223         buf[12] = ASC(sd);
1224         buf[13] = ASCQ(sd);
1225         return 18;
1226 }
1227
1228
1229 static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
1230 {
1231         struct fsg_lun  *curlun = common->curlun;
1232         u32             lba = get_unaligned_be32(&common->cmnd[2]);
1233         int             pmi = common->cmnd[8];
1234         u8              *buf = (u8 *) bh->buf;
1235
1236         /* Check the PMI and LBA fields */
1237         if (pmi > 1 || (pmi == 0 && lba != 0)) {
1238                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1239                 return -EINVAL;
1240         }
1241
1242         put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1243                                                 /* Max logical block */
1244         put_unaligned_be32(512, &buf[4]);       /* Block length */
1245         return 8;
1246 }
1247
1248
1249 static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
1250 {
1251         struct fsg_lun  *curlun = common->curlun;
1252         int             msf = common->cmnd[1] & 0x02;
1253         u32             lba = get_unaligned_be32(&common->cmnd[2]);
1254         u8              *buf = (u8 *) bh->buf;
1255
1256         if (common->cmnd[1] & ~0x02) {          /* Mask away MSF */
1257                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1258                 return -EINVAL;
1259         }
1260         if (lba >= curlun->num_sectors) {
1261                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1262                 return -EINVAL;
1263         }
1264
1265         memset(buf, 0, 8);
1266         buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
1267         store_cdrom_address(&buf[4], msf, lba);
1268         return 8;
1269 }
1270
1271
1272 static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
1273 {
1274         struct fsg_lun  *curlun = common->curlun;
1275         int             msf = common->cmnd[1] & 0x02;
1276         int             start_track = common->cmnd[6];
1277         u8              *buf = (u8 *) bh->buf;
1278
1279         if ((common->cmnd[1] & ~0x02) != 0 ||   /* Mask away MSF */
1280                         start_track > 1) {
1281                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1282                 return -EINVAL;
1283         }
1284
1285         memset(buf, 0, 20);
1286         buf[1] = (20-2);                /* TOC data length */
1287         buf[2] = 1;                     /* First track number */
1288         buf[3] = 1;                     /* Last track number */
1289         buf[5] = 0x16;                  /* Data track, copying allowed */
1290         buf[6] = 0x01;                  /* Only track is number 1 */
1291         store_cdrom_address(&buf[8], msf, 0);
1292
1293         buf[13] = 0x16;                 /* Lead-out track is data */
1294         buf[14] = 0xAA;                 /* Lead-out track number */
1295         store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1296         return 20;
1297 }
1298
1299
1300 static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1301 {
1302         struct fsg_lun  *curlun = common->curlun;
1303         int             mscmnd = common->cmnd[0];
1304         u8              *buf = (u8 *) bh->buf;
1305         u8              *buf0 = buf;
1306         int             pc, page_code;
1307         int             changeable_values, all_pages;
1308         int             valid_page = 0;
1309         int             len, limit;
1310
1311         if ((common->cmnd[1] & ~0x08) != 0) {   /* Mask away DBD */
1312                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1313                 return -EINVAL;
1314         }
1315         pc = common->cmnd[2] >> 6;
1316         page_code = common->cmnd[2] & 0x3f;
1317         if (pc == 3) {
1318                 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1319                 return -EINVAL;
1320         }
1321         changeable_values = (pc == 1);
1322         all_pages = (page_code == 0x3f);
1323
1324         /* Write the mode parameter header.  Fixed values are: default
1325          * medium type, no cache control (DPOFUA), and no block descriptors.
1326          * The only variable value is the WriteProtect bit.  We will fill in
1327          * the mode data length later. */
1328         memset(buf, 0, 8);
1329         if (mscmnd == SC_MODE_SENSE_6) {
1330                 buf[2] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
1331                 buf += 4;
1332                 limit = 255;
1333         } else {                        /* SC_MODE_SENSE_10 */
1334                 buf[3] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
1335                 buf += 8;
1336                 limit = 65535;          /* Should really be FSG_BUFLEN */
1337         }
1338
1339         /* No block descriptors */
1340
1341         /* The mode pages, in numerical order.  The only page we support
1342          * is the Caching page. */
1343         if (page_code == 0x08 || all_pages) {
1344                 valid_page = 1;
1345                 buf[0] = 0x08;          /* Page code */
1346                 buf[1] = 10;            /* Page length */
1347                 memset(buf+2, 0, 10);   /* None of the fields are changeable */
1348
1349                 if (!changeable_values) {
1350                         buf[2] = 0x04;  /* Write cache enable, */
1351                                         /* Read cache not disabled */
1352                                         /* No cache retention priorities */
1353                         put_unaligned_be16(0xffff, &buf[4]);
1354                                         /* Don't disable prefetch */
1355                                         /* Minimum prefetch = 0 */
1356                         put_unaligned_be16(0xffff, &buf[8]);
1357                                         /* Maximum prefetch */
1358                         put_unaligned_be16(0xffff, &buf[10]);
1359                                         /* Maximum prefetch ceiling */
1360                 }
1361                 buf += 12;
1362         }
1363
1364         /* Check that a valid page was requested and the mode data length
1365          * isn't too long. */
1366         len = buf - buf0;
1367         if (!valid_page || len > limit) {
1368                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1369                 return -EINVAL;
1370         }
1371
1372         /*  Store the mode data length */
1373         if (mscmnd == SC_MODE_SENSE_6)
1374                 buf0[0] = len - 1;
1375         else
1376                 put_unaligned_be16(len - 2, buf0);
1377         return len;
1378 }
1379
1380
1381 static int do_start_stop(struct fsg_common *common)
1382 {
1383         if (!common->curlun) {
1384                 return -EINVAL;
1385         } else if (!common->curlun->removable) {
1386                 common->curlun->sense_data = SS_INVALID_COMMAND;
1387                 return -EINVAL;
1388         }
1389         return 0;
1390 }
1391
1392
1393 static int do_prevent_allow(struct fsg_common *common)
1394 {
1395         struct fsg_lun  *curlun = common->curlun;
1396         int             prevent;
1397
1398         if (!common->curlun) {
1399                 return -EINVAL;
1400         } else if (!common->curlun->removable) {
1401                 common->curlun->sense_data = SS_INVALID_COMMAND;
1402                 return -EINVAL;
1403         }
1404
1405         prevent = common->cmnd[4] & 0x01;
1406         if ((common->cmnd[4] & ~0x01) != 0) {   /* Mask away Prevent */
1407                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1408                 return -EINVAL;
1409         }
1410
1411         if (curlun->prevent_medium_removal && !prevent)
1412                 fsg_lun_fsync_sub(curlun);
1413         curlun->prevent_medium_removal = prevent;
1414         return 0;
1415 }
1416
1417
1418 static int do_read_format_capacities(struct fsg_common *common,
1419                         struct fsg_buffhd *bh)
1420 {
1421         struct fsg_lun  *curlun = common->curlun;
1422         u8              *buf = (u8 *) bh->buf;
1423
1424         buf[0] = buf[1] = buf[2] = 0;
1425         buf[3] = 8;     /* Only the Current/Maximum Capacity Descriptor */
1426         buf += 4;
1427
1428         put_unaligned_be32(curlun->num_sectors, &buf[0]);
1429                                                 /* Number of blocks */
1430         put_unaligned_be32(512, &buf[4]);       /* Block length */
1431         buf[4] = 0x02;                          /* Current capacity */
1432         return 12;
1433 }
1434
1435
1436 static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
1437 {
1438         struct fsg_lun  *curlun = common->curlun;
1439
1440         /* We don't support MODE SELECT */
1441         if (curlun)
1442                 curlun->sense_data = SS_INVALID_COMMAND;
1443         return -EINVAL;
1444 }
1445
1446
1447 /*-------------------------------------------------------------------------*/
1448
1449 static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1450 {
1451         int     rc;
1452
1453         rc = fsg_set_halt(fsg, fsg->bulk_in);
1454         if (rc == -EAGAIN)
1455                 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1456         while (rc != 0) {
1457                 if (rc != -EAGAIN) {
1458                         WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1459                         rc = 0;
1460                         break;
1461                 }
1462
1463                 /* Wait for a short time and then try again */
1464                 if (msleep_interruptible(100) != 0)
1465                         return -EINTR;
1466                 rc = usb_ep_set_halt(fsg->bulk_in);
1467         }
1468         return rc;
1469 }
1470
1471 static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1472 {
1473         int     rc;
1474
1475         DBG(fsg, "bulk-in set wedge\n");
1476         rc = usb_ep_set_wedge(fsg->bulk_in);
1477         if (rc == -EAGAIN)
1478                 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1479         while (rc != 0) {
1480                 if (rc != -EAGAIN) {
1481                         WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1482                         rc = 0;
1483                         break;
1484                 }
1485
1486                 /* Wait for a short time and then try again */
1487                 if (msleep_interruptible(100) != 0)
1488                         return -EINTR;
1489                 rc = usb_ep_set_wedge(fsg->bulk_in);
1490         }
1491         return rc;
1492 }
1493
1494 static int pad_with_zeros(struct fsg_dev *fsg)
1495 {
1496         struct fsg_buffhd       *bh = fsg->common->next_buffhd_to_fill;
1497         u32                     nkeep = bh->inreq->length;
1498         u32                     nsend;
1499         int                     rc;
1500
1501         bh->state = BUF_STATE_EMPTY;            /* For the first iteration */
1502         fsg->common->usb_amount_left = nkeep + fsg->common->residue;
1503         while (fsg->common->usb_amount_left > 0) {
1504
1505                 /* Wait for the next buffer to be free */
1506                 while (bh->state != BUF_STATE_EMPTY) {
1507                         rc = sleep_thread(fsg->common);
1508                         if (rc)
1509                                 return rc;
1510                 }
1511
1512                 nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
1513                 memset(bh->buf + nkeep, 0, nsend - nkeep);
1514                 bh->inreq->length = nsend;
1515                 bh->inreq->zero = 0;
1516                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1517                                 &bh->inreq_busy, &bh->state);
1518                 bh = fsg->common->next_buffhd_to_fill = bh->next;
1519                 fsg->common->usb_amount_left -= nsend;
1520                 nkeep = 0;
1521         }
1522         return 0;
1523 }
1524
1525 static int throw_away_data(struct fsg_common *common)
1526 {
1527         struct fsg_buffhd       *bh;
1528         u32                     amount;
1529         int                     rc;
1530
1531         for (bh = common->next_buffhd_to_drain;
1532              bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
1533              bh = common->next_buffhd_to_drain) {
1534
1535                 /* Throw away the data in a filled buffer */
1536                 if (bh->state == BUF_STATE_FULL) {
1537                         smp_rmb();
1538                         bh->state = BUF_STATE_EMPTY;
1539                         common->next_buffhd_to_drain = bh->next;
1540
1541                         /* A short packet or an error ends everything */
1542                         if (bh->outreq->actual != bh->outreq->length ||
1543                                         bh->outreq->status != 0) {
1544                                 raise_exception(common,
1545                                                 FSG_STATE_ABORT_BULK_OUT);
1546                                 return -EINTR;
1547                         }
1548                         continue;
1549                 }
1550
1551                 /* Try to submit another request if we need one */
1552                 bh = common->next_buffhd_to_fill;
1553                 if (bh->state == BUF_STATE_EMPTY
1554                  && common->usb_amount_left > 0) {
1555                         amount = min(common->usb_amount_left, FSG_BUFLEN);
1556
1557                         /* amount is always divisible by 512, hence by
1558                          * the bulk-out maxpacket size */
1559                         bh->outreq->length = amount;
1560                         bh->bulk_out_intended_length = amount;
1561                         bh->outreq->short_not_ok = 1;
1562                         START_TRANSFER_OR(common, bulk_out, bh->outreq,
1563                                           &bh->outreq_busy, &bh->state)
1564                                 /* Don't know what to do if
1565                                  * common->fsg is NULL */
1566                                 return -EIO;
1567                         common->next_buffhd_to_fill = bh->next;
1568                         common->usb_amount_left -= amount;
1569                         continue;
1570                 }
1571
1572                 /* Otherwise wait for something to happen */
1573                 rc = sleep_thread(common);
1574                 if (rc)
1575                         return rc;
1576         }
1577         return 0;
1578 }
1579
1580
1581 static int finish_reply(struct fsg_common *common)
1582 {
1583         struct fsg_buffhd       *bh = common->next_buffhd_to_fill;
1584         int                     rc = 0;
1585
1586         switch (common->data_dir) {
1587         case DATA_DIR_NONE:
1588                 break;                  /* Nothing to send */
1589
1590         /* If we don't know whether the host wants to read or write,
1591          * this must be CB or CBI with an unknown command.  We mustn't
1592          * try to send or receive any data.  So stall both bulk pipes
1593          * if we can and wait for a reset. */
1594         case DATA_DIR_UNKNOWN:
1595                 if (!common->can_stall) {
1596                         /* Nothing */
1597                 } else if (fsg_is_set(common)) {
1598                         fsg_set_halt(common->fsg, common->fsg->bulk_out);
1599                         rc = halt_bulk_in_endpoint(common->fsg);
1600                 } else {
1601                         /* Don't know what to do if common->fsg is NULL */
1602                         rc = -EIO;
1603                 }
1604                 break;
1605
1606         /* All but the last buffer of data must have already been sent */
1607         case DATA_DIR_TO_HOST:
1608                 if (common->data_size == 0) {
1609                         /* Nothing to send */
1610
1611                 /* If there's no residue, simply send the last buffer */
1612                 } else if (common->residue == 0) {
1613                         bh->inreq->zero = 0;
1614                         START_TRANSFER_OR(common, bulk_in, bh->inreq,
1615                                           &bh->inreq_busy, &bh->state)
1616                                 return -EIO;
1617                         common->next_buffhd_to_fill = bh->next;
1618
1619                 /* For Bulk-only, if we're allowed to stall then send the
1620                  * short packet and halt the bulk-in endpoint.  If we can't
1621                  * stall, pad out the remaining data with 0's. */
1622                 } else if (common->can_stall) {
1623                         bh->inreq->zero = 1;
1624                         START_TRANSFER_OR(common, bulk_in, bh->inreq,
1625                                           &bh->inreq_busy, &bh->state)
1626                                 /* Don't know what to do if
1627                                  * common->fsg is NULL */
1628                                 rc = -EIO;
1629                         common->next_buffhd_to_fill = bh->next;
1630                         if (common->fsg)
1631                                 rc = halt_bulk_in_endpoint(common->fsg);
1632                 } else if (fsg_is_set(common)) {
1633                         rc = pad_with_zeros(common->fsg);
1634                 } else {
1635                         /* Don't know what to do if common->fsg is NULL */
1636                         rc = -EIO;
1637                 }
1638                 break;
1639
1640         /* We have processed all we want from the data the host has sent.
1641          * There may still be outstanding bulk-out requests. */
1642         case DATA_DIR_FROM_HOST:
1643                 if (common->residue == 0) {
1644                         /* Nothing to receive */
1645
1646                 /* Did the host stop sending unexpectedly early? */
1647                 } else if (common->short_packet_received) {
1648                         raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1649                         rc = -EINTR;
1650
1651                 /* We haven't processed all the incoming data.  Even though
1652                  * we may be allowed to stall, doing so would cause a race.
1653                  * The controller may already have ACK'ed all the remaining
1654                  * bulk-out packets, in which case the host wouldn't see a
1655                  * STALL.  Not realizing the endpoint was halted, it wouldn't
1656                  * clear the halt -- leading to problems later on. */
1657 #if 0
1658                 } else if (common->can_stall) {
1659                         if (fsg_is_set(common))
1660                                 fsg_set_halt(common->fsg,
1661                                              common->fsg->bulk_out);
1662                         raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1663                         rc = -EINTR;
1664 #endif
1665
1666                 /* We can't stall.  Read in the excess data and throw it
1667                  * all away. */
1668                 } else {
1669                         rc = throw_away_data(common);
1670                 }
1671                 break;
1672         }
1673         return rc;
1674 }
1675
1676
1677 static int send_status(struct fsg_common *common)
1678 {
1679         struct fsg_lun          *curlun = common->curlun;
1680         struct fsg_buffhd       *bh;
1681         struct bulk_cs_wrap     *csw;
1682         int                     rc;
1683         u8                      status = USB_STATUS_PASS;
1684         u32                     sd, sdinfo = 0;
1685
1686         /* Wait for the next buffer to become available */
1687         bh = common->next_buffhd_to_fill;
1688         while (bh->state != BUF_STATE_EMPTY) {
1689                 rc = sleep_thread(common);
1690                 if (rc)
1691                         return rc;
1692         }
1693
1694         if (curlun) {
1695                 sd = curlun->sense_data;
1696                 sdinfo = curlun->sense_data_info;
1697         } else if (common->bad_lun_okay)
1698                 sd = SS_NO_SENSE;
1699         else
1700                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1701
1702         if (common->phase_error) {
1703                 DBG(common, "sending phase-error status\n");
1704                 status = USB_STATUS_PHASE_ERROR;
1705                 sd = SS_INVALID_COMMAND;
1706         } else if (sd != SS_NO_SENSE) {
1707                 DBG(common, "sending command-failure status\n");
1708                 status = USB_STATUS_FAIL;
1709                 VDBG(common, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
1710                                 "  info x%x\n",
1711                                 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
1712         }
1713
1714         /* Store and send the Bulk-only CSW */
1715         csw = (void *)bh->buf;
1716
1717         csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
1718         csw->Tag = common->tag;
1719         csw->Residue = cpu_to_le32(common->residue);
1720         csw->Status = status;
1721
1722         bh->inreq->length = USB_BULK_CS_WRAP_LEN;
1723         bh->inreq->zero = 0;
1724         START_TRANSFER_OR(common, bulk_in, bh->inreq,
1725                           &bh->inreq_busy, &bh->state)
1726                 /* Don't know what to do if common->fsg is NULL */
1727                 return -EIO;
1728
1729         common->next_buffhd_to_fill = bh->next;
1730         return 0;
1731 }
1732
1733
1734 /*-------------------------------------------------------------------------*/
1735
1736 /* Check whether the command is properly formed and whether its data size
1737  * and direction agree with the values we already have. */
1738 static int check_command(struct fsg_common *common, int cmnd_size,
1739                 enum data_direction data_dir, unsigned int mask,
1740                 int needs_medium, const char *name)
1741 {
1742         int                     i;
1743         int                     lun = common->cmnd[1] >> 5;
1744         static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
1745         char                    hdlen[20];
1746         struct fsg_lun          *curlun;
1747
1748         hdlen[0] = 0;
1749         if (common->data_dir != DATA_DIR_UNKNOWN)
1750                 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
1751                                 common->data_size);
1752         VDBG(common, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
1753              name, cmnd_size, dirletter[(int) data_dir],
1754              common->data_size_from_cmnd, common->cmnd_size, hdlen);
1755
1756         /* We can't reply at all until we know the correct data direction
1757          * and size. */
1758         if (common->data_size_from_cmnd == 0)
1759                 data_dir = DATA_DIR_NONE;
1760         if (common->data_size < common->data_size_from_cmnd) {
1761                 /* Host data size < Device data size is a phase error.
1762                  * Carry out the command, but only transfer as much as
1763                  * we are allowed. */
1764                 common->data_size_from_cmnd = common->data_size;
1765                 common->phase_error = 1;
1766         }
1767         common->residue = common->data_size;
1768         common->usb_amount_left = common->data_size;
1769
1770         /* Conflicting data directions is a phase error */
1771         if (common->data_dir != data_dir
1772          && common->data_size_from_cmnd > 0) {
1773                 common->phase_error = 1;
1774                 return -EINVAL;
1775         }
1776
1777         /* Verify the length of the command itself */
1778         if (cmnd_size != common->cmnd_size) {
1779
1780                 /* Special case workaround: There are plenty of buggy SCSI
1781                  * implementations. Many have issues with cbw->Length
1782                  * field passing a wrong command size. For those cases we
1783                  * always try to work around the problem by using the length
1784                  * sent by the host side provided it is at least as large
1785                  * as the correct command length.
1786                  * Examples of such cases would be MS-Windows, which issues
1787                  * REQUEST SENSE with cbw->Length == 12 where it should
1788                  * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
1789                  * REQUEST SENSE with cbw->Length == 10 where it should
1790                  * be 6 as well.
1791                  */
1792                 if (cmnd_size <= common->cmnd_size) {
1793                         DBG(common, "%s is buggy! Expected length %d "
1794                             "but we got %d\n", name,
1795                             cmnd_size, common->cmnd_size);
1796                         cmnd_size = common->cmnd_size;
1797                 } else {
1798                         common->phase_error = 1;
1799                         return -EINVAL;
1800                 }
1801         }
1802
1803         /* Check that the LUN values are consistent */
1804         if (common->lun != lun)
1805                 DBG(common, "using LUN %d from CBW, not LUN %d from CDB\n",
1806                     common->lun, lun);
1807
1808         /* Check the LUN */
1809         if (common->lun >= 0 && common->lun < common->nluns) {
1810                 curlun = &common->luns[common->lun];
1811                 common->curlun = curlun;
1812                 if (common->cmnd[0] != SC_REQUEST_SENSE) {
1813                         curlun->sense_data = SS_NO_SENSE;
1814                         curlun->sense_data_info = 0;
1815                         curlun->info_valid = 0;
1816                 }
1817         } else {
1818                 common->curlun = NULL;
1819                 curlun = NULL;
1820                 common->bad_lun_okay = 0;
1821
1822                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
1823                  * to use unsupported LUNs; all others may not. */
1824                 if (common->cmnd[0] != SC_INQUIRY &&
1825                     common->cmnd[0] != SC_REQUEST_SENSE) {
1826                         DBG(common, "unsupported LUN %d\n", common->lun);
1827                         return -EINVAL;
1828                 }
1829         }
1830
1831         /* If a unit attention condition exists, only INQUIRY and
1832          * REQUEST SENSE commands are allowed; anything else must fail. */
1833         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
1834                         common->cmnd[0] != SC_INQUIRY &&
1835                         common->cmnd[0] != SC_REQUEST_SENSE) {
1836                 curlun->sense_data = curlun->unit_attention_data;
1837                 curlun->unit_attention_data = SS_NO_SENSE;
1838                 return -EINVAL;
1839         }
1840
1841         /* Check that only command bytes listed in the mask are non-zero */
1842         common->cmnd[1] &= 0x1f;                        /* Mask away the LUN */
1843         for (i = 1; i < cmnd_size; ++i) {
1844                 if (common->cmnd[i] && !(mask & (1 << i))) {
1845                         if (curlun)
1846                                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1847                         return -EINVAL;
1848                 }
1849         }
1850
1851         /* If the medium isn't mounted and the command needs to access
1852          * it, return an error. */
1853         if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
1854                 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1855                 return -EINVAL;
1856         }
1857
1858         return 0;
1859 }
1860
1861
1862 static int do_scsi_command(struct fsg_common *common)
1863 {
1864         struct fsg_buffhd       *bh;
1865         int                     rc;
1866         int                     reply = -EINVAL;
1867         int                     i;
1868         static char             unknown[16];
1869
1870         dump_cdb(common);
1871
1872         /* Wait for the next buffer to become available for data or status */
1873         bh = common->next_buffhd_to_fill;
1874         common->next_buffhd_to_drain = bh;
1875         while (bh->state != BUF_STATE_EMPTY) {
1876                 rc = sleep_thread(common);
1877                 if (rc)
1878                         return rc;
1879         }
1880         common->phase_error = 0;
1881         common->short_packet_received = 0;
1882
1883         down_read(&common->filesem);    /* We're using the backing file */
1884         switch (common->cmnd[0]) {
1885
1886         case SC_INQUIRY:
1887                 common->data_size_from_cmnd = common->cmnd[4];
1888                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1889                                       (1<<4), 0,
1890                                       "INQUIRY");
1891                 if (reply == 0)
1892                         reply = do_inquiry(common, bh);
1893                 break;
1894
1895         case SC_MODE_SELECT_6:
1896                 common->data_size_from_cmnd = common->cmnd[4];
1897                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
1898                                       (1<<1) | (1<<4), 0,
1899                                       "MODE SELECT(6)");
1900                 if (reply == 0)
1901                         reply = do_mode_select(common, bh);
1902                 break;
1903
1904         case SC_MODE_SELECT_10:
1905                 common->data_size_from_cmnd =
1906                         get_unaligned_be16(&common->cmnd[7]);
1907                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
1908                                       (1<<1) | (3<<7), 0,
1909                                       "MODE SELECT(10)");
1910                 if (reply == 0)
1911                         reply = do_mode_select(common, bh);
1912                 break;
1913
1914         case SC_MODE_SENSE_6:
1915                 common->data_size_from_cmnd = common->cmnd[4];
1916                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1917                                       (1<<1) | (1<<2) | (1<<4), 0,
1918                                       "MODE SENSE(6)");
1919                 if (reply == 0)
1920                         reply = do_mode_sense(common, bh);
1921                 break;
1922
1923         case SC_MODE_SENSE_10:
1924                 common->data_size_from_cmnd =
1925                         get_unaligned_be16(&common->cmnd[7]);
1926                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1927                                       (1<<1) | (1<<2) | (3<<7), 0,
1928                                       "MODE SENSE(10)");
1929                 if (reply == 0)
1930                         reply = do_mode_sense(common, bh);
1931                 break;
1932
1933         case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
1934                 common->data_size_from_cmnd = 0;
1935                 reply = check_command(common, 6, DATA_DIR_NONE,
1936                                       (1<<4), 0,
1937                                       "PREVENT-ALLOW MEDIUM REMOVAL");
1938                 if (reply == 0)
1939                         reply = do_prevent_allow(common);
1940                 break;
1941
1942         case SC_READ_6:
1943                 i = common->cmnd[4];
1944                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
1945                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1946                                       (7<<1) | (1<<4), 1,
1947                                       "READ(6)");
1948                 if (reply == 0)
1949                         reply = do_read(common);
1950                 break;
1951
1952         case SC_READ_10:
1953                 common->data_size_from_cmnd =
1954                                 get_unaligned_be16(&common->cmnd[7]) << 9;
1955                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1956                                       (1<<1) | (0xf<<2) | (3<<7), 1,
1957                                       "READ(10)");
1958                 if (reply == 0)
1959                         reply = do_read(common);
1960                 break;
1961
1962         case SC_READ_12:
1963                 common->data_size_from_cmnd =
1964                                 get_unaligned_be32(&common->cmnd[6]) << 9;
1965                 reply = check_command(common, 12, DATA_DIR_TO_HOST,
1966                                       (1<<1) | (0xf<<2) | (0xf<<6), 1,
1967                                       "READ(12)");
1968                 if (reply == 0)
1969                         reply = do_read(common);
1970                 break;
1971
1972         case SC_READ_CAPACITY:
1973                 common->data_size_from_cmnd = 8;
1974                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1975                                       (0xf<<2) | (1<<8), 1,
1976                                       "READ CAPACITY");
1977                 if (reply == 0)
1978                         reply = do_read_capacity(common, bh);
1979                 break;
1980
1981         case SC_READ_HEADER:
1982                 if (!common->curlun || !common->curlun->cdrom)
1983                         goto unknown_cmnd;
1984                 common->data_size_from_cmnd =
1985                         get_unaligned_be16(&common->cmnd[7]);
1986                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1987                                       (3<<7) | (0x1f<<1), 1,
1988                                       "READ HEADER");
1989                 if (reply == 0)
1990                         reply = do_read_header(common, bh);
1991                 break;
1992
1993         case SC_READ_TOC:
1994                 if (!common->curlun || !common->curlun->cdrom)
1995                         goto unknown_cmnd;
1996                 common->data_size_from_cmnd =
1997                         get_unaligned_be16(&common->cmnd[7]);
1998                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
1999                                       (7<<6) | (1<<1), 1,
2000                                       "READ TOC");
2001                 if (reply == 0)
2002                         reply = do_read_toc(common, bh);
2003                 break;
2004
2005         case SC_READ_FORMAT_CAPACITIES:
2006                 common->data_size_from_cmnd =
2007                         get_unaligned_be16(&common->cmnd[7]);
2008                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2009                                       (3<<7), 1,
2010                                       "READ FORMAT CAPACITIES");
2011                 if (reply == 0)
2012                         reply = do_read_format_capacities(common, bh);
2013                 break;
2014
2015         case SC_REQUEST_SENSE:
2016                 common->data_size_from_cmnd = common->cmnd[4];
2017                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
2018                                       (1<<4), 0,
2019                                       "REQUEST SENSE");
2020                 if (reply == 0)
2021                         reply = do_request_sense(common, bh);
2022                 break;
2023
2024         case SC_START_STOP_UNIT:
2025                 common->data_size_from_cmnd = 0;
2026                 reply = check_command(common, 6, DATA_DIR_NONE,
2027                                       (1<<1) | (1<<4), 0,
2028                                       "START-STOP UNIT");
2029                 if (reply == 0)
2030                         reply = do_start_stop(common);
2031                 break;
2032
2033         case SC_SYNCHRONIZE_CACHE:
2034                 common->data_size_from_cmnd = 0;
2035                 reply = check_command(common, 10, DATA_DIR_NONE,
2036                                       (0xf<<2) | (3<<7), 1,
2037                                       "SYNCHRONIZE CACHE");
2038                 if (reply == 0)
2039                         reply = do_synchronize_cache(common);
2040                 break;
2041
2042         case SC_TEST_UNIT_READY:
2043                 common->data_size_from_cmnd = 0;
2044                 reply = check_command(common, 6, DATA_DIR_NONE,
2045                                 0, 1,
2046                                 "TEST UNIT READY");
2047                 break;
2048
2049         /* Although optional, this command is used by MS-Windows.  We
2050          * support a minimal version: BytChk must be 0. */
2051         case SC_VERIFY:
2052                 common->data_size_from_cmnd = 0;
2053                 reply = check_command(common, 10, DATA_DIR_NONE,
2054                                       (1<<1) | (0xf<<2) | (3<<7), 1,
2055                                       "VERIFY");
2056                 if (reply == 0)
2057                         reply = do_verify(common);
2058                 break;
2059
2060         case SC_WRITE_6:
2061                 i = common->cmnd[4];
2062                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2063                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
2064                                       (7<<1) | (1<<4), 1,
2065                                       "WRITE(6)");
2066                 if (reply == 0)
2067                         reply = do_write(common);
2068                 break;
2069
2070         case SC_WRITE_10:
2071                 common->data_size_from_cmnd =
2072                                 get_unaligned_be16(&common->cmnd[7]) << 9;
2073                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
2074                                       (1<<1) | (0xf<<2) | (3<<7), 1,
2075                                       "WRITE(10)");
2076                 if (reply == 0)
2077                         reply = do_write(common);
2078                 break;
2079
2080         case SC_WRITE_12:
2081                 common->data_size_from_cmnd =
2082                                 get_unaligned_be32(&common->cmnd[6]) << 9;
2083                 reply = check_command(common, 12, DATA_DIR_FROM_HOST,
2084                                       (1<<1) | (0xf<<2) | (0xf<<6), 1,
2085                                       "WRITE(12)");
2086                 if (reply == 0)
2087                         reply = do_write(common);
2088                 break;
2089
2090         /* Some mandatory commands that we recognize but don't implement.
2091          * They don't mean much in this setting.  It's left as an exercise
2092          * for anyone interested to implement RESERVE and RELEASE in terms
2093          * of Posix locks. */
2094         case SC_FORMAT_UNIT:
2095         case SC_RELEASE:
2096         case SC_RESERVE:
2097         case SC_SEND_DIAGNOSTIC:
2098                 /* Fall through */
2099
2100         default:
2101 unknown_cmnd:
2102                 common->data_size_from_cmnd = 0;
2103                 sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
2104                 reply = check_command(common, common->cmnd_size,
2105                                       DATA_DIR_UNKNOWN, 0xff, 0, unknown);
2106                 if (reply == 0) {
2107                         common->curlun->sense_data = SS_INVALID_COMMAND;
2108                         reply = -EINVAL;
2109                 }
2110                 break;
2111         }
2112         up_read(&common->filesem);
2113
2114         if (reply == -EINTR || signal_pending(current))
2115                 return -EINTR;
2116
2117         /* Set up the single reply buffer for finish_reply() */
2118         if (reply == -EINVAL)
2119                 reply = 0;              /* Error reply length */
2120         if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
2121                 reply = min((u32) reply, common->data_size_from_cmnd);
2122                 bh->inreq->length = reply;
2123                 bh->state = BUF_STATE_FULL;
2124                 common->residue -= reply;
2125         }                               /* Otherwise it's already set */
2126
2127         return 0;
2128 }
2129
2130
2131 /*-------------------------------------------------------------------------*/
2132
2133 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2134 {
2135         struct usb_request      *req = bh->outreq;
2136         struct fsg_bulk_cb_wrap *cbw = req->buf;
2137         struct fsg_common       *common = fsg->common;
2138
2139         /* Was this a real packet?  Should it be ignored? */
2140         if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2141                 return -EINVAL;
2142
2143         /* Is the CBW valid? */
2144         if (req->actual != USB_BULK_CB_WRAP_LEN ||
2145                         cbw->Signature != cpu_to_le32(
2146                                 USB_BULK_CB_SIG)) {
2147                 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2148                                 req->actual,
2149                                 le32_to_cpu(cbw->Signature));
2150
2151                 /* The Bulk-only spec says we MUST stall the IN endpoint
2152                  * (6.6.1), so it's unavoidable.  It also says we must
2153                  * retain this state until the next reset, but there's
2154                  * no way to tell the controller driver it should ignore
2155                  * Clear-Feature(HALT) requests.
2156                  *
2157                  * We aren't required to halt the OUT endpoint; instead
2158                  * we can simply accept and discard any data received
2159                  * until the next reset. */
2160                 wedge_bulk_in_endpoint(fsg);
2161                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2162                 return -EINVAL;
2163         }
2164
2165         /* Is the CBW meaningful? */
2166         if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2167                         cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
2168                 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2169                                 "cmdlen %u\n",
2170                                 cbw->Lun, cbw->Flags, cbw->Length);
2171
2172                 /* We can do anything we want here, so let's stall the
2173                  * bulk pipes if we are allowed to. */
2174                 if (common->can_stall) {
2175                         fsg_set_halt(fsg, fsg->bulk_out);
2176                         halt_bulk_in_endpoint(fsg);
2177                 }
2178                 return -EINVAL;
2179         }
2180
2181         /* Save the command for later */
2182         common->cmnd_size = cbw->Length;
2183         memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
2184         if (cbw->Flags & USB_BULK_IN_FLAG)
2185                 common->data_dir = DATA_DIR_TO_HOST;
2186         else
2187                 common->data_dir = DATA_DIR_FROM_HOST;
2188         common->data_size = le32_to_cpu(cbw->DataTransferLength);
2189         if (common->data_size == 0)
2190                 common->data_dir = DATA_DIR_NONE;
2191         common->lun = cbw->Lun;
2192         common->tag = cbw->Tag;
2193         return 0;
2194 }
2195
2196
2197 static int get_next_command(struct fsg_common *common)
2198 {
2199         struct fsg_buffhd       *bh;
2200         int                     rc = 0;
2201
2202         /* Wait for the next buffer to become available */
2203         bh = common->next_buffhd_to_fill;
2204         while (bh->state != BUF_STATE_EMPTY) {
2205                 rc = sleep_thread(common);
2206                 if (rc)
2207                         return rc;
2208         }
2209
2210         /* Queue a request to read a Bulk-only CBW */
2211         set_bulk_out_req_length(common, bh, USB_BULK_CB_WRAP_LEN);
2212         bh->outreq->short_not_ok = 1;
2213         START_TRANSFER_OR(common, bulk_out, bh->outreq,
2214                           &bh->outreq_busy, &bh->state)
2215                 /* Don't know what to do if common->fsg is NULL */
2216                 return -EIO;
2217
2218         /* We will drain the buffer in software, which means we
2219          * can reuse it for the next filling.  No need to advance
2220          * next_buffhd_to_fill. */
2221
2222         /* Wait for the CBW to arrive */
2223         while (bh->state != BUF_STATE_FULL) {
2224                 rc = sleep_thread(common);
2225                 if (rc)
2226                         return rc;
2227         }
2228         smp_rmb();
2229         rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
2230         bh->state = BUF_STATE_EMPTY;
2231
2232         return rc;
2233 }
2234
2235
2236 /*-------------------------------------------------------------------------*/
2237
2238 static int enable_endpoint(struct fsg_common *common, struct usb_ep *ep,
2239                 const struct usb_endpoint_descriptor *d)
2240 {
2241         int     rc;
2242
2243         ep->driver_data = common;
2244         rc = usb_ep_enable(ep, d);
2245         if (rc)
2246                 ERROR(common, "can't enable %s, result %d\n", ep->name, rc);
2247         return rc;
2248 }
2249
2250 static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
2251                 struct usb_request **preq)
2252 {
2253         *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2254         if (*preq)
2255                 return 0;
2256         ERROR(common, "can't allocate request for %s\n", ep->name);
2257         return -ENOMEM;
2258 }
2259
2260 /*
2261  * Reset interface setting and re-init endpoint state (toggle etc).
2262  * Call with altsetting < 0 to disable the interface.  The only other
2263  * available altsetting is 0, which enables the interface.
2264  */
2265 static int do_set_interface(struct fsg_common *common, int altsetting)
2266 {
2267         int     rc = 0;
2268         int     i;
2269         const struct usb_endpoint_descriptor    *d;
2270
2271         if (common->running)
2272                 DBG(common, "reset interface\n");
2273
2274 reset:
2275         /* Deallocate the requests */
2276         if (common->prev_fsg) {
2277                 struct fsg_dev *fsg = common->prev_fsg;
2278
2279                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2280                         struct fsg_buffhd *bh = &common->buffhds[i];
2281
2282                         if (bh->inreq) {
2283                                 usb_ep_free_request(fsg->bulk_in, bh->inreq);
2284                                 bh->inreq = NULL;
2285                         }
2286                         if (bh->outreq) {
2287                                 usb_ep_free_request(fsg->bulk_out, bh->outreq);
2288                                 bh->outreq = NULL;
2289                         }
2290                 }
2291
2292                 /* Disable the endpoints */
2293                 if (fsg->bulk_in_enabled) {
2294                         usb_ep_disable(fsg->bulk_in);
2295                         fsg->bulk_in_enabled = 0;
2296                 }
2297                 if (fsg->bulk_out_enabled) {
2298                         usb_ep_disable(fsg->bulk_out);
2299                         fsg->bulk_out_enabled = 0;
2300                 }
2301
2302                 common->prev_fsg = 0;
2303         }
2304
2305         common->running = 0;
2306         if (altsetting < 0 || rc != 0)
2307                 return rc;
2308
2309         DBG(common, "set interface %d\n", altsetting);
2310
2311         if (fsg_is_set(common)) {
2312                 struct fsg_dev *fsg = common->fsg;
2313                 common->prev_fsg = common->fsg;
2314
2315                 /* Enable the endpoints */
2316                 d = fsg_ep_desc(common->gadget,
2317                                 &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
2318                 rc = enable_endpoint(common, fsg->bulk_in, d);
2319                 if (rc)
2320                         goto reset;
2321                 fsg->bulk_in_enabled = 1;
2322
2323                 d = fsg_ep_desc(common->gadget,
2324                                 &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
2325                 rc = enable_endpoint(common, fsg->bulk_out, d);
2326                 if (rc)
2327                         goto reset;
2328                 fsg->bulk_out_enabled = 1;
2329                 common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
2330                 clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2331
2332                 /* Allocate the requests */
2333                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2334                         struct fsg_buffhd       *bh = &common->buffhds[i];
2335
2336                         rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
2337                         if (rc)
2338                                 goto reset;
2339                         rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
2340                         if (rc)
2341                                 goto reset;
2342                         bh->inreq->buf = bh->outreq->buf = bh->buf;
2343                         bh->inreq->context = bh->outreq->context = bh;
2344                         bh->inreq->complete = bulk_in_complete;
2345                         bh->outreq->complete = bulk_out_complete;
2346                 }
2347
2348                 common->running = 1;
2349                 for (i = 0; i < common->nluns; ++i)
2350                         common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
2351                 return rc;
2352         } else {
2353                 return -EIO;
2354         }
2355 }
2356
2357
2358 /*
2359  * Change our operational configuration.  This code must agree with the code
2360  * that returns config descriptors, and with interface altsetting code.
2361  *
2362  * It's also responsible for power management interactions.  Some
2363  * configurations might not work with our current power sources.
2364  * For now we just assume the gadget is always self-powered.
2365  */
2366 static int do_set_config(struct fsg_common *common, u8 new_config)
2367 {
2368         int     rc = 0;
2369
2370         /* Disable the single interface */
2371         if (common->config != 0) {
2372                 DBG(common, "reset config\n");
2373                 common->config = 0;
2374                 rc = do_set_interface(common, -1);
2375         }
2376
2377         /* Enable the interface */
2378         if (new_config != 0) {
2379                 common->config = new_config;
2380                 rc = do_set_interface(common, 0);
2381                 if (rc != 0)
2382                         common->config = 0;     /* Reset on errors */
2383         }
2384         return rc;
2385 }
2386
2387
2388 /****************************** ALT CONFIGS ******************************/
2389
2390
2391 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2392 {
2393         struct fsg_dev *fsg = fsg_from_func(f);
2394         fsg->common->prev_fsg = fsg->common->fsg;
2395         fsg->common->fsg = fsg;
2396         fsg->common->new_config = 1;
2397         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2398         return 0;
2399 }
2400
2401 static void fsg_disable(struct usb_function *f)
2402 {
2403         struct fsg_dev *fsg = fsg_from_func(f);
2404         fsg->common->prev_fsg = fsg->common->fsg;
2405         fsg->common->fsg = fsg;
2406         fsg->common->new_config = 0;
2407         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2408 }
2409
2410
2411 /*-------------------------------------------------------------------------*/
2412
2413 static void handle_exception(struct fsg_common *common)
2414 {
2415         siginfo_t               info;
2416         int                     sig;
2417         int                     i;
2418         struct fsg_buffhd       *bh;
2419         enum fsg_state          old_state;
2420         u8                      new_config;
2421         struct fsg_lun          *curlun;
2422         unsigned int            exception_req_tag;
2423         int                     rc;
2424
2425         /* Clear the existing signals.  Anything but SIGUSR1 is converted
2426          * into a high-priority EXIT exception. */
2427         for (;;) {
2428                 sig = dequeue_signal_lock(current, &current->blocked, &info);
2429                 if (!sig)
2430                         break;
2431                 if (sig != SIGUSR1) {
2432                         if (common->state < FSG_STATE_EXIT)
2433                                 DBG(common, "Main thread exiting on signal\n");
2434                         raise_exception(common, FSG_STATE_EXIT);
2435                 }
2436         }
2437
2438         /* Cancel all the pending transfers */
2439         if (fsg_is_set(common)) {
2440                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2441                         bh = &common->buffhds[i];
2442                         if (bh->inreq_busy)
2443                                 usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
2444                         if (bh->outreq_busy)
2445                                 usb_ep_dequeue(common->fsg->bulk_out,
2446                                                bh->outreq);
2447                 }
2448
2449                 /* Wait until everything is idle */
2450                 for (;;) {
2451                         int num_active = 0;
2452                         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2453                                 bh = &common->buffhds[i];
2454                                 num_active += bh->inreq_busy + bh->outreq_busy;
2455                         }
2456                         if (num_active == 0)
2457                                 break;
2458                         if (sleep_thread(common))
2459                                 return;
2460                 }
2461
2462                 /* Clear out the controller's fifos */
2463                 if (common->fsg->bulk_in_enabled)
2464                         usb_ep_fifo_flush(common->fsg->bulk_in);
2465                 if (common->fsg->bulk_out_enabled)
2466                         usb_ep_fifo_flush(common->fsg->bulk_out);
2467         }
2468
2469         /* Reset the I/O buffer states and pointers, the SCSI
2470          * state, and the exception.  Then invoke the handler. */
2471         spin_lock_irq(&common->lock);
2472
2473         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2474                 bh = &common->buffhds[i];
2475                 bh->state = BUF_STATE_EMPTY;
2476         }
2477         common->next_buffhd_to_fill = &common->buffhds[0];
2478         common->next_buffhd_to_drain = &common->buffhds[0];
2479         exception_req_tag = common->exception_req_tag;
2480         new_config = common->new_config;
2481         old_state = common->state;
2482
2483         if (old_state == FSG_STATE_ABORT_BULK_OUT)
2484                 common->state = FSG_STATE_STATUS_PHASE;
2485         else {
2486                 for (i = 0; i < common->nluns; ++i) {
2487                         curlun = &common->luns[i];
2488                         curlun->prevent_medium_removal = 0;
2489                         curlun->sense_data = SS_NO_SENSE;
2490                         curlun->unit_attention_data = SS_NO_SENSE;
2491                         curlun->sense_data_info = 0;
2492                         curlun->info_valid = 0;
2493                 }
2494                 common->state = FSG_STATE_IDLE;
2495         }
2496         spin_unlock_irq(&common->lock);
2497
2498         /* Carry out any extra actions required for the exception */
2499         switch (old_state) {
2500         case FSG_STATE_ABORT_BULK_OUT:
2501                 send_status(common);
2502                 spin_lock_irq(&common->lock);
2503                 if (common->state == FSG_STATE_STATUS_PHASE)
2504                         common->state = FSG_STATE_IDLE;
2505                 spin_unlock_irq(&common->lock);
2506                 break;
2507
2508         case FSG_STATE_RESET:
2509                 /* In case we were forced against our will to halt a
2510                  * bulk endpoint, clear the halt now.  (The SuperH UDC
2511                  * requires this.) */
2512                 if (!fsg_is_set(common))
2513                         break;
2514                 if (test_and_clear_bit(IGNORE_BULK_OUT,
2515                                        &common->fsg->atomic_bitflags))
2516                         usb_ep_clear_halt(common->fsg->bulk_in);
2517
2518                 if (common->ep0_req_tag == exception_req_tag)
2519                         ep0_queue(common);      /* Complete the status stage */
2520
2521                 /* Technically this should go here, but it would only be
2522                  * a waste of time.  Ditto for the INTERFACE_CHANGE and
2523                  * CONFIG_CHANGE cases. */
2524                 /* for (i = 0; i < common->nluns; ++i) */
2525                 /*      common->luns[i].unit_attention_data = */
2526                 /*              SS_RESET_OCCURRED;  */
2527                 break;
2528
2529         case FSG_STATE_CONFIG_CHANGE:
2530                 rc = do_set_config(common, new_config);
2531                 if (common->ep0_req_tag != exception_req_tag)
2532                         break;
2533                 if (rc != 0) {                  /* STALL on errors */
2534                         DBG(common, "ep0 set halt\n");
2535                         usb_ep_set_halt(common->ep0);
2536                 } else {                        /* Complete the status stage */
2537                         ep0_queue(common);
2538                 }
2539                 break;
2540
2541         case FSG_STATE_EXIT:
2542         case FSG_STATE_TERMINATED:
2543                 do_set_config(common, 0);               /* Free resources */
2544                 spin_lock_irq(&common->lock);
2545                 common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
2546                 spin_unlock_irq(&common->lock);
2547                 break;
2548
2549         case FSG_STATE_INTERFACE_CHANGE:
2550         case FSG_STATE_DISCONNECT:
2551         case FSG_STATE_COMMAND_PHASE:
2552         case FSG_STATE_DATA_PHASE:
2553         case FSG_STATE_STATUS_PHASE:
2554         case FSG_STATE_IDLE:
2555                 break;
2556         }
2557 }
2558
2559
2560 /*-------------------------------------------------------------------------*/
2561
2562 static int fsg_main_thread(void *common_)
2563 {
2564         struct fsg_common       *common = common_;
2565
2566         /* Allow the thread to be killed by a signal, but set the signal mask
2567          * to block everything but INT, TERM, KILL, and USR1. */
2568         allow_signal(SIGINT);
2569         allow_signal(SIGTERM);
2570         allow_signal(SIGKILL);
2571         allow_signal(SIGUSR1);
2572
2573         /* Allow the thread to be frozen */
2574         set_freezable();
2575
2576         /* Arrange for userspace references to be interpreted as kernel
2577          * pointers.  That way we can pass a kernel pointer to a routine
2578          * that expects a __user pointer and it will work okay. */
2579         set_fs(get_ds());
2580
2581         /* The main loop */
2582         while (common->state != FSG_STATE_TERMINATED) {
2583                 if (exception_in_progress(common) || signal_pending(current)) {
2584                         handle_exception(common);
2585                         continue;
2586                 }
2587
2588                 if (!common->running) {
2589                         sleep_thread(common);
2590                         continue;
2591                 }
2592
2593                 if (get_next_command(common))
2594                         continue;
2595
2596                 spin_lock_irq(&common->lock);
2597                 if (!exception_in_progress(common))
2598                         common->state = FSG_STATE_DATA_PHASE;
2599                 spin_unlock_irq(&common->lock);
2600
2601                 if (do_scsi_command(common) || finish_reply(common))
2602                         continue;
2603
2604                 spin_lock_irq(&common->lock);
2605                 if (!exception_in_progress(common))
2606                         common->state = FSG_STATE_STATUS_PHASE;
2607                 spin_unlock_irq(&common->lock);
2608
2609                 if (send_status(common))
2610                         continue;
2611
2612                 spin_lock_irq(&common->lock);
2613                 if (!exception_in_progress(common))
2614                         common->state = FSG_STATE_IDLE;
2615                 spin_unlock_irq(&common->lock);
2616         }
2617
2618         spin_lock_irq(&common->lock);
2619         common->thread_task = NULL;
2620         spin_unlock_irq(&common->lock);
2621
2622         if (!common->thread_exits || common->thread_exits(common) < 0) {
2623                 struct fsg_lun *curlun = common->luns;
2624                 unsigned i = common->nluns;
2625
2626                 down_write(&common->filesem);
2627                 for (; i--; ++curlun) {
2628                         if (!fsg_lun_is_open(curlun))
2629                                 continue;
2630
2631                         fsg_lun_close(curlun);
2632                         curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
2633                 }
2634                 up_write(&common->filesem);
2635         }
2636
2637         /* Let the unbind and cleanup routines know the thread has exited */
2638         complete_and_exit(&common->thread_notifier, 0);
2639 }
2640
2641
2642 /*************************** DEVICE ATTRIBUTES ***************************/
2643
2644 /* Write permission is checked per LUN in store_*() functions. */
2645 static DEVICE_ATTR(ro, 0644, fsg_show_ro, fsg_store_ro);
2646 static DEVICE_ATTR(file, 0644, fsg_show_file, fsg_store_file);
2647
2648
2649 /****************************** FSG COMMON ******************************/
2650
2651 static void fsg_common_release(struct kref *ref);
2652
2653 static void fsg_lun_release(struct device *dev)
2654 {
2655         /* Nothing needs to be done */
2656 }
2657
2658 static inline void fsg_common_get(struct fsg_common *common)
2659 {
2660         kref_get(&common->ref);
2661 }
2662
2663 static inline void fsg_common_put(struct fsg_common *common)
2664 {
2665         kref_put(&common->ref, fsg_common_release);
2666 }
2667
2668
2669 static struct fsg_common *fsg_common_init(struct fsg_common *common,
2670                                           struct usb_composite_dev *cdev,
2671                                           struct fsg_config *cfg)
2672 {
2673         struct usb_gadget *gadget = cdev->gadget;
2674         struct fsg_buffhd *bh;
2675         struct fsg_lun *curlun;
2676         struct fsg_lun_config *lcfg;
2677         int nluns, i, rc;
2678         char *pathbuf;
2679
2680         /* Find out how many LUNs there should be */
2681         nluns = cfg->nluns;
2682         if (nluns < 1 || nluns > FSG_MAX_LUNS) {
2683                 dev_err(&gadget->dev, "invalid number of LUNs: %u\n", nluns);
2684                 return ERR_PTR(-EINVAL);
2685         }
2686
2687         /* Allocate? */
2688         if (!common) {
2689                 common = kzalloc(sizeof *common, GFP_KERNEL);
2690                 if (!common)
2691                         return ERR_PTR(-ENOMEM);
2692                 common->free_storage_on_release = 1;
2693         } else {
2694                 memset(common, 0, sizeof common);
2695                 common->free_storage_on_release = 0;
2696         }
2697
2698         common->private_data = cfg->private_data;
2699
2700         common->gadget = gadget;
2701         common->ep0 = gadget->ep0;
2702         common->ep0req = cdev->req;
2703
2704         /* Maybe allocate device-global string IDs, and patch descriptors */
2705         if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
2706                 rc = usb_string_id(cdev);
2707                 if (rc < 0) {
2708                         kfree(common);
2709                         return ERR_PTR(rc);
2710                 }
2711                 fsg_strings[FSG_STRING_INTERFACE].id = rc;
2712                 fsg_intf_desc.iInterface = rc;
2713         }
2714
2715         /* Create the LUNs, open their backing files, and register the
2716          * LUN devices in sysfs. */
2717         curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
2718         if (!curlun) {
2719                 kfree(common);
2720                 return ERR_PTR(-ENOMEM);
2721         }
2722         common->luns = curlun;
2723
2724         init_rwsem(&common->filesem);
2725
2726         for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
2727                 curlun->cdrom = !!lcfg->cdrom;
2728                 curlun->ro = lcfg->cdrom || lcfg->ro;
2729                 curlun->removable = lcfg->removable;
2730                 curlun->dev.release = fsg_lun_release;
2731                 curlun->dev.parent = &gadget->dev;
2732                 /* curlun->dev.driver = &fsg_driver.driver; XXX */
2733                 dev_set_drvdata(&curlun->dev, &common->filesem);
2734                 dev_set_name(&curlun->dev,
2735                              cfg->lun_name_format
2736                            ? cfg->lun_name_format
2737                            : "lun%d",
2738                              i);
2739
2740                 rc = device_register(&curlun->dev);
2741                 if (rc) {
2742                         INFO(common, "failed to register LUN%d: %d\n", i, rc);
2743                         common->nluns = i;
2744                         goto error_release;
2745                 }
2746
2747                 rc = device_create_file(&curlun->dev, &dev_attr_ro);
2748                 if (rc)
2749                         goto error_luns;
2750                 rc = device_create_file(&curlun->dev, &dev_attr_file);
2751                 if (rc)
2752                         goto error_luns;
2753
2754                 if (lcfg->filename) {
2755                         rc = fsg_lun_open(curlun, lcfg->filename);
2756                         if (rc)
2757                                 goto error_luns;
2758                 } else if (!curlun->removable) {
2759                         ERROR(common, "no file given for LUN%d\n", i);
2760                         rc = -EINVAL;
2761                         goto error_luns;
2762                 }
2763         }
2764         common->nluns = nluns;
2765
2766
2767         /* Data buffers cyclic list */
2768         /* Buffers in buffhds are static -- no need for additional
2769          * allocation. */
2770         bh = common->buffhds;
2771         i = FSG_NUM_BUFFERS - 1;
2772         do {
2773                 bh->next = bh + 1;
2774         } while (++bh, --i);
2775         bh->next = common->buffhds;
2776
2777
2778         /* Prepare inquiryString */
2779         if (cfg->release != 0xffff) {
2780                 i = cfg->release;
2781         } else {
2782                 /* The sa1100 controller is not supported */
2783                 i = gadget_is_sa1100(gadget)
2784                         ? -1
2785                         : usb_gadget_controller_number(gadget);
2786                 if (i >= 0) {
2787                         i = 0x0300 + i;
2788                 } else {
2789                         WARNING(common, "controller '%s' not recognized\n",
2790                                 gadget->name);
2791                         i = 0x0399;
2792                 }
2793         }
2794 #define OR(x, y) ((x) ? (x) : (y))
2795         snprintf(common->inquiry_string, sizeof common->inquiry_string,
2796                  "%-8s%-16s%04x",
2797                  OR(cfg->vendor_name, "Linux   "),
2798                  /* Assume product name dependent on the first LUN */
2799                  OR(cfg->product_name, common->luns->cdrom
2800                                      ? "File-Stor Gadget"
2801                                      : "File-CD Gadget  "),
2802                  i);
2803
2804
2805         /* Some peripheral controllers are known not to be able to
2806          * halt bulk endpoints correctly.  If one of them is present,
2807          * disable stalls.
2808          */
2809         common->can_stall = cfg->can_stall &&
2810                 !(gadget_is_sh(common->gadget) ||
2811                   gadget_is_at91(common->gadget));
2812
2813
2814         spin_lock_init(&common->lock);
2815         kref_init(&common->ref);
2816
2817
2818         /* Tell the thread to start working */
2819         common->thread_exits = cfg->thread_exits;
2820         common->thread_task =
2821                 kthread_create(fsg_main_thread, common,
2822                                OR(cfg->thread_name, "file-storage"));
2823         if (IS_ERR(common->thread_task)) {
2824                 rc = PTR_ERR(common->thread_task);
2825                 goto error_release;
2826         }
2827         init_completion(&common->thread_notifier);
2828 #undef OR
2829
2830
2831         /* Information */
2832         INFO(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
2833         INFO(common, "Number of LUNs=%d\n", common->nluns);
2834
2835         pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
2836         for (i = 0, nluns = common->nluns, curlun = common->luns;
2837              i < nluns;
2838              ++curlun, ++i) {
2839                 char *p = "(no medium)";
2840                 if (fsg_lun_is_open(curlun)) {
2841                         p = "(error)";
2842                         if (pathbuf) {
2843                                 p = d_path(&curlun->filp->f_path,
2844                                            pathbuf, PATH_MAX);
2845                                 if (IS_ERR(p))
2846                                         p = "(error)";
2847                         }
2848                 }
2849                 LINFO(curlun, "LUN: %s%s%sfile: %s\n",
2850                       curlun->removable ? "removable " : "",
2851                       curlun->ro ? "read only " : "",
2852                       curlun->cdrom ? "CD-ROM " : "",
2853                       p);
2854         }
2855         kfree(pathbuf);
2856
2857         DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
2858
2859         wake_up_process(common->thread_task);
2860
2861         return common;
2862
2863
2864 error_luns:
2865         common->nluns = i + 1;
2866 error_release:
2867         common->state = FSG_STATE_TERMINATED;   /* The thread is dead */
2868         /* Call fsg_common_release() directly, ref might be not
2869          * initialised */
2870         fsg_common_release(&common->ref);
2871         complete(&common->thread_notifier);
2872         return ERR_PTR(rc);
2873 }
2874
2875
2876 static void fsg_common_release(struct kref *ref)
2877 {
2878         struct fsg_common *common =
2879                 container_of(ref, struct fsg_common, ref);
2880         unsigned i = common->nluns;
2881         struct fsg_lun *lun = common->luns;
2882
2883         /* If the thread isn't already dead, tell it to exit now */
2884         if (common->state != FSG_STATE_TERMINATED) {
2885                 raise_exception(common, FSG_STATE_EXIT);
2886                 wait_for_completion(&common->thread_notifier);
2887
2888                 /* The cleanup routine waits for this completion also */
2889                 complete(&common->thread_notifier);
2890         }
2891
2892         /* Beware tempting for -> do-while optimization: when in error
2893          * recovery nluns may be zero. */
2894
2895         for (; i; --i, ++lun) {
2896                 device_remove_file(&lun->dev, &dev_attr_ro);
2897                 device_remove_file(&lun->dev, &dev_attr_file);
2898                 fsg_lun_close(lun);
2899                 device_unregister(&lun->dev);
2900         }
2901
2902         kfree(common->luns);
2903         if (common->free_storage_on_release)
2904                 kfree(common);
2905 }
2906
2907
2908 /*-------------------------------------------------------------------------*/
2909
2910
2911 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
2912 {
2913         struct fsg_dev          *fsg = fsg_from_func(f);
2914
2915         DBG(fsg, "unbind\n");
2916         fsg_common_put(fsg->common);
2917         kfree(fsg);
2918 }
2919
2920
2921 static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
2922 {
2923         struct fsg_dev          *fsg = fsg_from_func(f);
2924         struct usb_gadget       *gadget = c->cdev->gadget;
2925         int                     rc;
2926         int                     i;
2927         struct usb_ep           *ep;
2928
2929         fsg->gadget = gadget;
2930
2931         /* New interface */
2932         i = usb_interface_id(c, f);
2933         if (i < 0)
2934                 return i;
2935         fsg_intf_desc.bInterfaceNumber = i;
2936         fsg->interface_number = i;
2937
2938         /* Find all the endpoints we will use */
2939         ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
2940         if (!ep)
2941                 goto autoconf_fail;
2942         ep->driver_data = fsg->common;  /* claim the endpoint */
2943         fsg->bulk_in = ep;
2944
2945         ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
2946         if (!ep)
2947                 goto autoconf_fail;
2948         ep->driver_data = fsg->common;  /* claim the endpoint */
2949         fsg->bulk_out = ep;
2950
2951         if (gadget_is_dualspeed(gadget)) {
2952                 /* Assume endpoint addresses are the same for both speeds */
2953                 fsg_hs_bulk_in_desc.bEndpointAddress =
2954                         fsg_fs_bulk_in_desc.bEndpointAddress;
2955                 fsg_hs_bulk_out_desc.bEndpointAddress =
2956                         fsg_fs_bulk_out_desc.bEndpointAddress;
2957                 f->hs_descriptors = fsg_hs_function;
2958         }
2959
2960         return 0;
2961
2962 autoconf_fail:
2963         ERROR(fsg, "unable to autoconfigure all endpoints\n");
2964         rc = -ENOTSUPP;
2965         fsg_unbind(c, f);
2966         return rc;
2967 }
2968
2969
2970 /****************************** ADD FUNCTION ******************************/
2971
2972 static struct usb_gadget_strings *fsg_strings_array[] = {
2973         &fsg_stringtab,
2974         NULL,
2975 };
2976
2977 static int fsg_add(struct usb_composite_dev *cdev,
2978                    struct usb_configuration *c,
2979                    struct fsg_common *common)
2980 {
2981         struct fsg_dev *fsg;
2982         int rc;
2983
2984         fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
2985         if (unlikely(!fsg))
2986                 return -ENOMEM;
2987
2988         fsg->function.name        = FSG_DRIVER_DESC;
2989         fsg->function.strings     = fsg_strings_array;
2990         fsg->function.descriptors = fsg_fs_function;
2991         fsg->function.bind        = fsg_bind;
2992         fsg->function.unbind      = fsg_unbind;
2993         fsg->function.setup       = fsg_setup;
2994         fsg->function.set_alt     = fsg_set_alt;
2995         fsg->function.disable     = fsg_disable;
2996
2997         fsg->common               = common;
2998         /* Our caller holds a reference to common structure so we
2999          * don't have to be worry about it being freed until we return
3000          * from this function.  So instead of incrementing counter now
3001          * and decrement in error recovery we increment it only when
3002          * call to usb_add_function() was successful. */
3003
3004         rc = usb_add_function(c, &fsg->function);
3005
3006         if (likely(rc == 0))
3007                 fsg_common_get(fsg->common);
3008         else
3009                 kfree(fsg);
3010
3011         return rc;
3012 }
3013
3014
3015
3016 /************************* Module parameters *************************/
3017
3018
3019 struct fsg_module_parameters {
3020         char            *file[FSG_MAX_LUNS];
3021         int             ro[FSG_MAX_LUNS];
3022         int             removable[FSG_MAX_LUNS];
3023         int             cdrom[FSG_MAX_LUNS];
3024
3025         unsigned int    file_count, ro_count, removable_count, cdrom_count;
3026         unsigned int    luns;   /* nluns */
3027         int             stall;  /* can_stall */
3028 };
3029
3030
3031 #define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)       \
3032         module_param_array_named(prefix ## name, params.name, type,     \
3033                                  &prefix ## params.name ## _count,      \
3034                                  S_IRUGO);                              \
3035         MODULE_PARM_DESC(prefix ## name, desc)
3036
3037 #define _FSG_MODULE_PARAM(prefix, params, name, type, desc)             \
3038         module_param_named(prefix ## name, params.name, type,           \
3039                            S_IRUGO);                                    \
3040         MODULE_PARM_DESC(prefix ## name, desc)
3041
3042 #define FSG_MODULE_PARAMETERS(prefix, params)                           \
3043         _FSG_MODULE_PARAM_ARRAY(prefix, params, file, charp,            \
3044                                 "names of backing files or devices");   \
3045         _FSG_MODULE_PARAM_ARRAY(prefix, params, ro, bool,               \
3046                                 "true to force read-only");             \
3047         _FSG_MODULE_PARAM_ARRAY(prefix, params, removable, bool,        \
3048                                 "true to simulate removable media");    \
3049         _FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,            \
3050                                 "true to simulate CD-ROM instead of disk"); \
3051         _FSG_MODULE_PARAM(prefix, params, luns, uint,                   \
3052                           "number of LUNs");                            \
3053         _FSG_MODULE_PARAM(prefix, params, stall, bool,                  \
3054                           "false to prevent bulk stalls")
3055
3056
3057 static void
3058 fsg_config_from_params(struct fsg_config *cfg,
3059                        const struct fsg_module_parameters *params)
3060 {
3061         struct fsg_lun_config *lun;
3062         unsigned i;
3063
3064         /* Configure LUNs */
3065         cfg->nluns =
3066                 min(params->luns ?: (params->file_count ?: 1u),
3067                     (unsigned)FSG_MAX_LUNS);
3068         for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) {
3069                 lun->ro = !!params->ro[i];
3070                 lun->cdrom = !!params->cdrom[i];
3071                 lun->removable = /* Removable by default */
3072                         params->removable_count <= i || params->removable[i];
3073                 lun->filename =
3074                         params->file_count > i && params->file[i][0]
3075                         ? params->file[i]
3076                         : 0;
3077         }
3078
3079         /* Let MSF use defaults */
3080         cfg->lun_name_format = 0;
3081         cfg->thread_name = 0;
3082         cfg->vendor_name = 0;
3083         cfg->product_name = 0;
3084         cfg->release = 0xffff;
3085
3086         cfg->thread_exits = 0;
3087         cfg->private_data = 0;
3088
3089         /* Finalise */
3090         cfg->can_stall = params->stall;
3091 }
3092
3093 static inline struct fsg_common *
3094 fsg_common_from_params(struct fsg_common *common,
3095                        struct usb_composite_dev *cdev,
3096                        const struct fsg_module_parameters *params)
3097         __attribute__((unused));
3098 static inline struct fsg_common *
3099 fsg_common_from_params(struct fsg_common *common,
3100                        struct usb_composite_dev *cdev,
3101                        const struct fsg_module_parameters *params)
3102 {
3103         struct fsg_config cfg;
3104         fsg_config_from_params(&cfg, params);
3105         return fsg_common_init(common, cdev, &cfg);
3106 }
3107