drivers/usb/gadget/file_storage.c

   1 /*
   2  * file_storage.c -- File-backed USB Storage Gadget, for USB development
   3  *
   4  * Copyright (C) 2003-2008 Alan Stern
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions, and the following disclaimer,
  12  *    without modification.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. The names of the above-listed copyright holders may not be used
  17  *    to endorse or promote products derived from this software without
  18  *    specific prior written permission.
  19  *
  20  * ALTERNATIVELY, this software may be distributed under the terms of the
  21  * GNU General Public License ("GPL") as published by the Free Software
  22  * Foundation, either version 2 of that License or (at your option) any
  23  * later version.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
  26  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  27  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  30  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  31  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  32  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  33  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  34  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  35  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38
  39 /*
  40  * The File-backed Storage Gadget acts as a USB Mass Storage device,
  41  * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
  42  * to providing an example of a genuinely useful gadget driver for a USB
  43  * device, it also illustrates a technique of double-buffering for increased
  44  * throughput.  Last but not least, it gives an easy way to probe the
  45  * behavior of the Mass Storage drivers in a USB host.
  46  *
  47  * Backing storage is provided by a regular file or a block device, specified
  48  * by the "file" module parameter.  Access can be limited to read-only by
  49  * setting the optional "ro" module parameter.  (For CD-ROM emulation,
  50  * access is always read-only.)  The gadget will indicate that it has
  51  * removable media if the optional "removable" module parameter is set.
  52  *
  53  * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
  54  * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
  55  * by the optional "transport" module parameter.  It also supports the
  56  * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
  57  * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
  58  * the optional "protocol" module parameter.  In addition, the default
  59  * Vendor ID, Product ID, and release number can be overridden.
  60  *
  61  * There is support for multiple logical units (LUNs), each of which has
  62  * its own backing file.  The number of LUNs can be set using the optional
  63  * "luns" module parameter (anywhere from 1 to 8), and the corresponding
  64  * files are specified using comma-separated lists for "file" and "ro".
  65  * The default number of LUNs is taken from the number of "file" elements;
  66  * it is 1 if "file" is not given.  If "removable" is not set then a backing
  67  * file must be specified for each LUN.  If it is set, then an unspecified
  68  * or empty backing filename means the LUN's medium is not loaded.  Ideally
  69  * each LUN would be settable independently as a disk drive or a CD-ROM
  70  * drive, but currently all LUNs have to be the same type.  The CD-ROM
  71  * emulation includes a single data track and no audio tracks; hence there
  72  * need be only one backing file per LUN.  Note also that the CD-ROM block
  73  * length is set to 512 rather than the more common value 2048.
  74  *
  75  * Requirements are modest; only a bulk-in and a bulk-out endpoint are
  76  * needed (an interrupt-out endpoint is also needed for CBI).  The memory
  77  * requirement amounts to two 16K buffers, size configurable by a parameter.
  78  * Support is included for both full-speed and high-speed operation.
  79  *
  80  * Note that the driver is slightly non-portable in that it assumes a
  81  * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
  82  * interrupt-in endpoints.  With most device controllers this isn't an
  83  * issue, but there may be some with hardware restrictions that prevent
  84  * a buffer from being used by more than one endpoint.
  85  *
  86  * Module options:
  87  *
  88  *      file=filename[,filename...]
  89  *                              Required if "removable" is not set, names of
  90  *                                      the files or block devices used for
  91  *                                      backing storage
  92  *      ro=b[,b...]             Default false, booleans for read-only access
  93  *      removable               Default false, boolean for removable media
  94  *      luns=N                  Default N = number of filenames, number of
  95  *                                      LUNs to support
  96  *      stall                   Default determined according to the type of
  97  *                                      USB device controller (usually true),
  98  *                                      boolean to permit the driver to halt
  99  *                                      bulk endpoints
 100  *      cdrom                   Default false, boolean for whether to emulate
 101  *                                      a CD-ROM drive
 102  *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
 103  *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
 104  *                                      ATAPI, QIC, UFI, 8070, or SCSI;
 105  *                                      also 1 - 6)
 106  *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
 107  *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
 108  *      release=0xRRRR          Override the USB release number (bcdDevice)
 109  *      buflen=N                Default N=16384, buffer size used (will be
 110  *                                      rounded down to a multiple of
 111  *                                      PAGE_CACHE_SIZE)
 112  *
 113  * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
 114  * "removable", "luns", "stall", and "cdrom" options are available; default
 115  * values are used for everything else.
 116  *
 117  * The pathnames of the backing files and the ro settings are available in
 118  * the attribute files "file" and "ro" in the lun<n> subdirectory of the
 119  * gadget's sysfs directory.  If the "removable" option is set, writing to
 120  * these files will simulate ejecting/loading the medium (writing an empty
 121  * line means eject) and adjusting a write-enable tab.  Changes to the ro
 122  * setting are not allowed when the medium is loaded or if CD-ROM emulation
 123  * is being used.
 124  *
 125  * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
 126  * The driver's SCSI command interface was based on the "Information
 127  * technology - Small Computer System Interface - 2" document from
 128  * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
 129  * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
 130  * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
 131  * "Universal Serial Bus Mass Storage Class UFI Command Specification"
 132  * document, Revision 1.0, December 14, 1998, available at
 133  * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
 134  */
 135
 136
 137 /*
 138  *                              Driver Design
 139  *
 140  * The FSG driver is fairly straightforward.  There is a main kernel
 141  * thread that handles most of the work.  Interrupt routines field
 142  * callbacks from the controller driver: bulk- and interrupt-request
 143  * completion notifications, endpoint-0 events, and disconnect events.
 144  * Completion events are passed to the main thread by wakeup calls.  Many
 145  * ep0 requests are handled at interrupt time, but SetInterface,
 146  * SetConfiguration, and device reset requests are forwarded to the
 147  * thread in the form of "exceptions" using SIGUSR1 signals (since they
 148  * should interrupt any ongoing file I/O operations).
 149  *
 150  * The thread's main routine implements the standard command/data/status
 151  * parts of a SCSI interaction.  It and its subroutines are full of tests
 152  * for pending signals/exceptions -- all this polling is necessary since
 153  * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
 154  * indication that the driver really wants to be running in userspace.)
 155  * An important point is that so long as the thread is alive it keeps an
 156  * open reference to the backing file.  This will prevent unmounting
 157  * the backing file's underlying filesystem and could cause problems
 158  * during system shutdown, for example.  To prevent such problems, the
 159  * thread catches INT, TERM, and KILL signals and converts them into
 160  * an EXIT exception.
 161  *
 162  * In normal operation the main thread is started during the gadget's
 163  * fsg_bind() callback and stopped during fsg_unbind().  But it can also
 164  * exit when it receives a signal, and there's no point leaving the
 165  * gadget running when the thread is dead.  So just before the thread
 166  * exits, it deregisters the gadget driver.  This makes things a little
 167  * tricky: The driver is deregistered at two places, and the exiting
 168  * thread can indirectly call fsg_unbind() which in turn can tell the
 169  * thread to exit.  The first problem is resolved through the use of the
 170  * REGISTERED atomic bitflag; the driver will only be deregistered once.
 171  * The second problem is resolved by having fsg_unbind() check
 172  * fsg->state; it won't try to stop the thread if the state is already
 173  * FSG_STATE_TERMINATED.
 174  *
 175  * To provide maximum throughput, the driver uses a circular pipeline of
 176  * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
 177  * arbitrarily long; in practice the benefits don't justify having more
 178  * than 2 stages (i.e., double buffering).  But it helps to think of the
 179  * pipeline as being a long one.  Each buffer head contains a bulk-in and
 180  * a bulk-out request pointer (since the buffer can be used for both
 181  * output and input -- directions always are given from the host's
 182  * point of view) as well as a pointer to the buffer and various state
 183  * variables.
 184  *
 185  * Use of the pipeline follows a simple protocol.  There is a variable
 186  * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
 187  * At any time that buffer head may still be in use from an earlier
 188  * request, so each buffer head has a state variable indicating whether
 189  * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
 190  * buffer head to be EMPTY, filling the buffer either by file I/O or by
 191  * USB I/O (during which the buffer head is BUSY), and marking the buffer
 192  * head FULL when the I/O is complete.  Then the buffer will be emptied
 193  * (again possibly by USB I/O, during which it is marked BUSY) and
 194  * finally marked EMPTY again (possibly by a completion routine).
 195  *
 196  * A module parameter tells the driver to avoid stalling the bulk
 197  * endpoints wherever the transport specification allows.  This is
 198  * necessary for some UDCs like the SuperH, which cannot reliably clear a
 199  * halt on a bulk endpoint.  However, under certain circumstances the
 200  * Bulk-only specification requires a stall.  In such cases the driver
 201  * will halt the endpoint and set a flag indicating that it should clear
 202  * the halt in software during the next device reset.  Hopefully this
 203  * will permit everything to work correctly.  Furthermore, although the
 204  * specification allows the bulk-out endpoint to halt when the host sends
 205  * too much data, implementing this would cause an unavoidable race.
 206  * The driver will always use the "no-stall" approach for OUT transfers.
 207  *
 208  * One subtle point concerns sending status-stage responses for ep0
 209  * requests.  Some of these requests, such as device reset, can involve
 210  * interrupting an ongoing file I/O operation, which might take an
 211  * arbitrarily long time.  During that delay the host might give up on
 212  * the original ep0 request and issue a new one.  When that happens the
 213  * driver should not notify the host about completion of the original
 214  * request, as the host will no longer be waiting for it.  So the driver
 215  * assigns to each ep0 request a unique tag, and it keeps track of the
 216  * tag value of the request associated with a long-running exception
 217  * (device-reset, interface-change, or configuration-change).  When the
 218  * exception handler is finished, the status-stage response is submitted
 219  * only if the current ep0 request tag is equal to the exception request
 220  * tag.  Thus only the most recently received ep0 request will get a
 221  * status-stage response.
 222  *
 223  * Warning: This driver source file is too long.  It ought to be split up
 224  * into a header file plus about 3 separate .c files, to handle the details
 225  * of the Gadget, USB Mass Storage, and SCSI protocols.
 226  */
 227
 228
 229 /* #define VERBOSE_DEBUG */
 230 /* #define DUMP_MSGS */
 231
 232
 233 #include <linux/blkdev.h>
 234 #include <linux/completion.h>
 235 #include <linux/dcache.h>
 236 #include <linux/delay.h>
 237 #include <linux/device.h>
 238 #include <linux/fcntl.h>
 239 #include <linux/file.h>
 240 #include <linux/fs.h>
 241 #include <linux/kref.h>
 242 #include <linux/kthread.h>
 243 #include <linux/limits.h>
 244 #include <linux/rwsem.h>
 245 #include <linux/slab.h>
 246 #include <linux/spinlock.h>
 247 #include <linux/string.h>
 248 #include <linux/freezer.h>
 249 #include <linux/utsname.h>
 250
 251 #include <asm/unaligned.h>
 252
 253 #include <linux/usb/ch9.h>
 254 #include <linux/usb/gadget.h>
 255
 256 #include "gadget_chips.h"
 257
 258
 259
 260 /*
 261  * Kbuild is not very cooperative with respect to linking separately
 262  * compiled library objects into one module.  So for now we won't use
 263  * separate compilation ... ensuring init/exit sections work to shrink
 264  * the runtime footprint, and giving us at least some parts of what
 265  * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
 266  */
 267 #include "usbstring.c"
 268 #include "config.c"
 269 #include "epautoconf.c"
 270
 271 /*-------------------------------------------------------------------------*/
 272
 273 #define DRIVER_DESC             "File-backed Storage Gadget"
 274 #define DRIVER_NAME             "g_file_storage"
 275 #define DRIVER_VERSION          "20 November 2008"
 276
 277 static const char longname[] = DRIVER_DESC;
 278 static const char shortname[] = DRIVER_NAME;
 279
 280 MODULE_DESCRIPTION(DRIVER_DESC);
 281 MODULE_AUTHOR("Alan Stern");
 282 MODULE_LICENSE("Dual BSD/GPL");
 283
 284 /* Thanks to NetChip Technologies for donating this product ID.
 285  *
 286  * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
 287  * Instead:  allocate your own, using normal USB-IF procedures. */
 288 #define DRIVER_VENDOR_ID        0x0525  // NetChip
 289 #define DRIVER_PRODUCT_ID       0xa4a5  // Linux-USB File-backed Storage Gadget
 290
 291
 292 /*
 293  * This driver assumes self-powered hardware and has no way for users to
 294  * trigger remote wakeup.  It uses autoconfiguration to select endpoints
 295  * and endpoint addresses.
 296  */
 297
 298
 299 /*-------------------------------------------------------------------------*/
 300
 301
 302 /* Encapsulate the module parameter settings */
 303
 304 #define MAX_LUNS        8
 305
 306 static struct {
 307         char            *file[MAX_LUNS];
 308         int             ro[MAX_LUNS];
 309         unsigned int    num_filenames;
 310         unsigned int    num_ros;
 311         unsigned int    nluns;
 312
 313         int             removable;
 314         int             can_stall;
 315         int             cdrom;
 316
 317         char            *transport_parm;
 318         char            *protocol_parm;
 319         unsigned short  vendor;
 320         unsigned short  product;
 321         unsigned short  release;
 322         unsigned int    buflen;
 323
 324         int             transport_type;
 325         char            *transport_name;
 326         int             protocol_type;
 327         char            *protocol_name;
 328
 329 } mod_data = {                                  // Default values
 330         .transport_parm         = "BBB",
 331         .protocol_parm          = "SCSI",
 332         .removable              = 0,
 333         .can_stall              = 1,
 334         .cdrom                  = 0,
 335         .vendor                 = DRIVER_VENDOR_ID,
 336         .product                = DRIVER_PRODUCT_ID,
 337         .release                = 0xffff,       // Use controller chip type
 338         .buflen                 = 16384,
 339         };
 340
 341
 342 module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
 343                 S_IRUGO);
 344 MODULE_PARM_DESC(file, "names of backing files or devices");
 345
 346 module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
 347 MODULE_PARM_DESC(ro, "true to force read-only");
 348
 349 module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
 350 MODULE_PARM_DESC(luns, "number of LUNs");
 351
 352 module_param_named(removable, mod_data.removable, bool, S_IRUGO);
 353 MODULE_PARM_DESC(removable, "true to simulate removable media");
 354
 355 module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
 356 MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
 357
 358 module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
 359 MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
 360
 361
 362 /* In the non-TEST version, only the module parameters listed above
 363  * are available. */
 364 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 365
 366 module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
 367 MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
 368
 369 module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
 370 MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
 371                 "8070, or SCSI)");
 372
 373 module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
 374 MODULE_PARM_DESC(vendor, "USB Vendor ID");
 375
 376 module_param_named(product, mod_data.product, ushort, S_IRUGO);
 377 MODULE_PARM_DESC(product, "USB Product ID");
 378
 379 module_param_named(release, mod_data.release, ushort, S_IRUGO);
 380 MODULE_PARM_DESC(release, "USB release number");
 381
 382 module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
 383 MODULE_PARM_DESC(buflen, "I/O buffer size");
 384
 385 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 386
 387
 388 /*
 389  * These definitions will permit the compiler to avoid generating code for
 390  * parts of the driver that aren't used in the non-TEST version.  Even gcc
 391  * can recognize when a test of a constant expression yields a dead code
 392  * path.
 393  */
 394
 395 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 396
 397 #define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
 398 #define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
 399 #define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
 400
 401 #else
 402
 403 #define transport_is_bbb()      1
 404 #define transport_is_cbi()      0
 405 #define protocol_is_scsi()      1
 406
 407 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 408
 409
 410 /*-------------------------------------------------------------------------*/
 411
 412 #include "storage_common.c"
 413
 414 /*-------------------------------------------------------------------------*/
 415
 416
 417 struct fsg_dev {
 418         /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
 419         spinlock_t              lock;
 420         struct usb_gadget       *gadget;
 421
 422         /* filesem protects: backing files in use */
 423         struct rw_semaphore     filesem;
 424
 425         /* reference counting: wait until all LUNs are released */
 426         struct kref             ref;
 427
 428         struct usb_ep           *ep0;           // Handy copy of gadget->ep0
 429         struct usb_request      *ep0req;        // For control responses
 430         unsigned int            ep0_req_tag;
 431         const char              *ep0req_name;
 432
 433         struct usb_request      *intreq;        // For interrupt responses
 434         int                     intreq_busy;
 435         struct fsg_buffhd       *intr_buffhd;
 436
 437         unsigned int            bulk_out_maxpacket;
 438         enum fsg_state          state;          // For exception handling
 439         unsigned int            exception_req_tag;
 440
 441         u8                      config, new_config;
 442
 443         unsigned int            running : 1;
 444         unsigned int            bulk_in_enabled : 1;
 445         unsigned int            bulk_out_enabled : 1;
 446         unsigned int            intr_in_enabled : 1;
 447         unsigned int            phase_error : 1;
 448         unsigned int            short_packet_received : 1;
 449         unsigned int            bad_lun_okay : 1;
 450
 451         unsigned long           atomic_bitflags;
 452 #define REGISTERED              0
 453 #define IGNORE_BULK_OUT         1
 454 #define SUSPENDED               2
 455
 456         struct usb_ep           *bulk_in;
 457         struct usb_ep           *bulk_out;
 458         struct usb_ep           *intr_in;
 459
 460         struct fsg_buffhd       *next_buffhd_to_fill;
 461         struct fsg_buffhd       *next_buffhd_to_drain;
 462         struct fsg_buffhd       buffhds[NUM_BUFFERS];
 463
 464         int                     thread_wakeup_needed;
 465         struct completion       thread_notifier;
 466         struct task_struct      *thread_task;
 467
 468         int                     cmnd_size;
 469         u8                      cmnd[MAX_COMMAND_SIZE];
 470         enum data_direction     data_dir;
 471         u32                     data_size;
 472         u32                     data_size_from_cmnd;
 473         u32                     tag;
 474         unsigned int            lun;
 475         u32                     residue;
 476         u32                     usb_amount_left;
 477
 478         /* The CB protocol offers no way for a host to know when a command
 479          * has completed.  As a result the next command may arrive early,
 480          * and we will still have to handle it.  For that reason we need
 481          * a buffer to store new commands when using CB (or CBI, which
 482          * does not oblige a host to wait for command completion either). */
 483         int                     cbbuf_cmnd_size;
 484         u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
 485
 486         unsigned int            nluns;
 487         struct lun              *luns;
 488         struct lun              *curlun;
 489 };
 490
 491 typedef void (*fsg_routine_t)(struct fsg_dev *);
 492
 493 static int exception_in_progress(struct fsg_dev *fsg)
 494 {
 495         return (fsg->state > FSG_STATE_IDLE);
 496 }
 497
 498 /* Make bulk-out requests be divisible by the maxpacket size */
 499 static void set_bulk_out_req_length(struct fsg_dev *fsg,
 500                 struct fsg_buffhd *bh, unsigned int length)
 501 {
 502         unsigned int    rem;
 503
 504         bh->bulk_out_intended_length = length;
 505         rem = length % fsg->bulk_out_maxpacket;
 506         if (rem > 0)
 507                 length += fsg->bulk_out_maxpacket - rem;
 508         bh->outreq->length = length;
 509 }
 510
 511 static struct fsg_dev                   *the_fsg;
 512 static struct usb_gadget_driver         fsg_driver;
 513
 514
 515 /*-------------------------------------------------------------------------*/
 516
 517 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 518 {
 519         const char      *name;
 520
 521         if (ep == fsg->bulk_in)
 522                 name = "bulk-in";
 523         else if (ep == fsg->bulk_out)
 524                 name = "bulk-out";
 525         else
 526                 name = ep->name;
 527         DBG(fsg, "%s set halt\n", name);
 528         return usb_ep_set_halt(ep);
 529 }
 530
 531
 532 /*-------------------------------------------------------------------------*/
 533
 534 /*
 535  * DESCRIPTORS ... most are static, but strings and (full) configuration
 536  * descriptors are built on demand.  Also the (static) config and interface
 537  * descriptors are adjusted during fsg_bind().
 538  */
 539
 540 /* There is only one configuration. */
 541 #define CONFIG_VALUE            1
 542
 543 static struct usb_device_descriptor
 544 device_desc = {
 545         .bLength =              sizeof device_desc,
 546         .bDescriptorType =      USB_DT_DEVICE,
 547
 548         .bcdUSB =               cpu_to_le16(0x0200),
 549         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
 550
 551         /* The next three values can be overridden by module parameters */
 552         .idVendor =             cpu_to_le16(DRIVER_VENDOR_ID),
 553         .idProduct =            cpu_to_le16(DRIVER_PRODUCT_ID),
 554         .bcdDevice =            cpu_to_le16(0xffff),
 555
 556         .iManufacturer =        STRING_MANUFACTURER,
 557         .iProduct =             STRING_PRODUCT,
 558         .iSerialNumber =        STRING_SERIAL,
 559         .bNumConfigurations =   1,
 560 };
 561
 562 static struct usb_config_descriptor
 563 config_desc = {
 564         .bLength =              sizeof config_desc,
 565         .bDescriptorType =      USB_DT_CONFIG,
 566
 567         /* wTotalLength computed by usb_gadget_config_buf() */
 568         .bNumInterfaces =       1,
 569         .bConfigurationValue =  CONFIG_VALUE,
 570         .iConfiguration =       STRING_CONFIG,
 571         .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
 572         .bMaxPower =            CONFIG_USB_GADGET_VBUS_DRAW / 2,
 573 };
 574
 575
 576 static struct usb_qualifier_descriptor
 577 dev_qualifier = {
 578         .bLength =              sizeof dev_qualifier,
 579         .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
 580
 581         .bcdUSB =               cpu_to_le16(0x0200),
 582         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
 583
 584         .bNumConfigurations =   1,
 585 };
 586
 587
 588
 589 /*
 590  * Config descriptors must agree with the code that sets configurations
 591  * and with code managing interfaces and their altsettings.  They must
 592  * also handle different speeds and other-speed requests.
 593  */
 594 static int populate_config_buf(struct usb_gadget *gadget,
 595                 u8 *buf, u8 type, unsigned index)
 596 {
 597         enum usb_device_speed                   speed = gadget->speed;
 598         int                                     len;
 599         const struct usb_descriptor_header      **function;
 600
 601         if (index > 0)
 602                 return -EINVAL;
 603
 604         if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
 605                 speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
 606         if (gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH)
 607                 function = hs_function;
 608         else
 609                 function = fs_function;
 610
 611         /* for now, don't advertise srp-only devices */
 612         if (!gadget_is_otg(gadget))
 613                 function++;
 614
 615         len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
 616         ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
 617         return len;
 618 }
 619
 620
 621 /*-------------------------------------------------------------------------*/
 622
 623 /* These routines may be called in process context or in_irq */
 624
 625 /* Caller must hold fsg->lock */
 626 static void wakeup_thread(struct fsg_dev *fsg)
 627 {
 628         /* Tell the main thread that something has happened */
 629         fsg->thread_wakeup_needed = 1;
 630         if (fsg->thread_task)
 631                 wake_up_process(fsg->thread_task);
 632 }
 633
 634
 635 static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
 636 {
 637         unsigned long           flags;
 638
 639         /* Do nothing if a higher-priority exception is already in progress.
 640          * If a lower-or-equal priority exception is in progress, preempt it
 641          * and notify the main thread by sending it a signal. */
 642         spin_lock_irqsave(&fsg->lock, flags);
 643         if (fsg->state <= new_state) {
 644                 fsg->exception_req_tag = fsg->ep0_req_tag;
 645                 fsg->state = new_state;
 646                 if (fsg->thread_task)
 647                         send_sig_info(SIGUSR1, SEND_SIG_FORCED,
 648                                         fsg->thread_task);
 649         }
 650         spin_unlock_irqrestore(&fsg->lock, flags);
 651 }
 652
 653
 654 /*-------------------------------------------------------------------------*/
 655
 656 /* The disconnect callback and ep0 routines.  These always run in_irq,
 657  * except that ep0_queue() is called in the main thread to acknowledge
 658  * completion of various requests: set config, set interface, and
 659  * Bulk-only device reset. */
 660
 661 static void fsg_disconnect(struct usb_gadget *gadget)
 662 {
 663         struct fsg_dev          *fsg = get_gadget_data(gadget);
 664
 665         DBG(fsg, "disconnect or port reset\n");
 666         raise_exception(fsg, FSG_STATE_DISCONNECT);
 667 }
 668
 669
 670 static int ep0_queue(struct fsg_dev *fsg)
 671 {
 672         int     rc;
 673
 674         rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
 675         if (rc != 0 && rc != -ESHUTDOWN) {
 676
 677                 /* We can't do much more than wait for a reset */
 678                 WARNING(fsg, "error in submission: %s --> %d\n",
 679                                 fsg->ep0->name, rc);
 680         }
 681         return rc;
 682 }
 683
 684 static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
 685 {
 686         struct fsg_dev          *fsg = ep->driver_data;
 687
 688         if (req->actual > 0)
 689                 dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
 690         if (req->status || req->actual != req->length)
 691                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
 692                                 req->status, req->actual, req->length);
 693         if (req->status == -ECONNRESET)         // Request was cancelled
 694                 usb_ep_fifo_flush(ep);
 695
 696         if (req->status == 0 && req->context)
 697                 ((fsg_routine_t) (req->context))(fsg);
 698 }
 699
 700
 701 /*-------------------------------------------------------------------------*/
 702
 703 /* Bulk and interrupt endpoint completion handlers.
 704  * These always run in_irq. */
 705
 706 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
 707 {
 708         struct fsg_dev          *fsg = ep->driver_data;
 709         struct fsg_buffhd       *bh = req->context;
 710
 711         if (req->status || req->actual != req->length)
 712                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
 713                                 req->status, req->actual, req->length);
 714         if (req->status == -ECONNRESET)         // Request was cancelled
 715                 usb_ep_fifo_flush(ep);
 716
 717         /* Hold the lock while we update the request and buffer states */
 718         smp_wmb();
 719         spin_lock(&fsg->lock);
 720         bh->inreq_busy = 0;
 721         bh->state = BUF_STATE_EMPTY;
 722         wakeup_thread(fsg);
 723         spin_unlock(&fsg->lock);
 724 }
 725
 726 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
 727 {
 728         struct fsg_dev          *fsg = ep->driver_data;
 729         struct fsg_buffhd       *bh = req->context;
 730
 731         dump_msg(fsg, "bulk-out", req->buf, req->actual);
 732         if (req->status || req->actual != bh->bulk_out_intended_length)
 733                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
 734                                 req->status, req->actual,
 735                                 bh->bulk_out_intended_length);
 736         if (req->status == -ECONNRESET)         // Request was cancelled
 737                 usb_ep_fifo_flush(ep);
 738
 739         /* Hold the lock while we update the request and buffer states */
 740         smp_wmb();
 741         spin_lock(&fsg->lock);
 742         bh->outreq_busy = 0;
 743         bh->state = BUF_STATE_FULL;
 744         wakeup_thread(fsg);
 745         spin_unlock(&fsg->lock);
 746 }
 747
 748
 749 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 750 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
 751 {
 752         struct fsg_dev          *fsg = ep->driver_data;
 753         struct fsg_buffhd       *bh = req->context;
 754
 755         if (req->status || req->actual != req->length)
 756                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
 757                                 req->status, req->actual, req->length);
 758         if (req->status == -ECONNRESET)         // Request was cancelled
 759                 usb_ep_fifo_flush(ep);
 760
 761         /* Hold the lock while we update the request and buffer states */
 762         smp_wmb();
 763         spin_lock(&fsg->lock);
 764         fsg->intreq_busy = 0;
 765         bh->state = BUF_STATE_EMPTY;
 766         wakeup_thread(fsg);
 767         spin_unlock(&fsg->lock);
 768 }
 769
 770 #else
 771 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
 772 {}
 773 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 774
 775
 776 /*-------------------------------------------------------------------------*/
 777
 778 /* Ep0 class-specific handlers.  These always run in_irq. */
 779
 780 #ifdef CONFIG_USB_FILE_STORAGE_TEST
 781 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 782 {
 783         struct usb_request      *req = fsg->ep0req;
 784         static u8               cbi_reset_cmnd[6] = {
 785                         SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
 786
 787         /* Error in command transfer? */
 788         if (req->status || req->length != req->actual ||
 789                         req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
 790
 791                 /* Not all controllers allow a protocol stall after
 792                  * receiving control-out data, but we'll try anyway. */
 793                 fsg_set_halt(fsg, fsg->ep0);
 794                 return;                 // Wait for reset
 795         }
 796
 797         /* Is it the special reset command? */
 798         if (req->actual >= sizeof cbi_reset_cmnd &&
 799                         memcmp(req->buf, cbi_reset_cmnd,
 800                                 sizeof cbi_reset_cmnd) == 0) {
 801
 802                 /* Raise an exception to stop the current operation
 803                  * and reinitialize our state. */
 804                 DBG(fsg, "cbi reset request\n");
 805                 raise_exception(fsg, FSG_STATE_RESET);
 806                 return;
 807         }
 808
 809         VDBG(fsg, "CB[I] accept device-specific command\n");
 810         spin_lock(&fsg->lock);
 811
 812         /* Save the command for later */
 813         if (fsg->cbbuf_cmnd_size)
 814                 WARNING(fsg, "CB[I] overwriting previous command\n");
 815         fsg->cbbuf_cmnd_size = req->actual;
 816         memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
 817
 818         wakeup_thread(fsg);
 819         spin_unlock(&fsg->lock);
 820 }
 821
 822 #else
 823 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 824 {}
 825 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 826
 827
 828 static int class_setup_req(struct fsg_dev *fsg,
 829                 const struct usb_ctrlrequest *ctrl)
 830 {
 831         struct usb_request      *req = fsg->ep0req;
 832         int                     value = -EOPNOTSUPP;
 833         u16                     w_index = le16_to_cpu(ctrl->wIndex);
 834         u16                     w_value = le16_to_cpu(ctrl->wValue);
 835         u16                     w_length = le16_to_cpu(ctrl->wLength);
 836
 837         if (!fsg->config)
 838                 return value;
 839
 840         /* Handle Bulk-only class-specific requests */
 841         if (transport_is_bbb()) {
 842                 switch (ctrl->bRequest) {
 843
 844                 case USB_BULK_RESET_REQUEST:
 845                         if (ctrl->bRequestType != (USB_DIR_OUT |
 846                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
 847                                 break;
 848                         if (w_index != 0 || w_value != 0) {
 849                                 value = -EDOM;
 850                                 break;
 851                         }
 852
 853                         /* Raise an exception to stop the current operation
 854                          * and reinitialize our state. */
 855                         DBG(fsg, "bulk reset request\n");
 856                         raise_exception(fsg, FSG_STATE_RESET);
 857                         value = DELAYED_STATUS;
 858                         break;
 859
 860                 case USB_BULK_GET_MAX_LUN_REQUEST:
 861                         if (ctrl->bRequestType != (USB_DIR_IN |
 862                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
 863                                 break;
 864                         if (w_index != 0 || w_value != 0) {
 865                                 value = -EDOM;
 866                                 break;
 867                         }
 868                         VDBG(fsg, "get max LUN\n");
 869                         *(u8 *) req->buf = fsg->nluns - 1;
 870                         value = 1;
 871                         break;
 872                 }
 873         }
 874
 875         /* Handle CBI class-specific requests */
 876         else {
 877                 switch (ctrl->bRequest) {
 878
 879                 case USB_CBI_ADSC_REQUEST:
 880                         if (ctrl->bRequestType != (USB_DIR_OUT |
 881                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
 882                                 break;
 883                         if (w_index != 0 || w_value != 0) {
 884                                 value = -EDOM;
 885                                 break;
 886                         }
 887                         if (w_length > MAX_COMMAND_SIZE) {
 888                                 value = -EOVERFLOW;
 889                                 break;
 890                         }
 891                         value = w_length;
 892                         fsg->ep0req->context = received_cbi_adsc;
 893                         break;
 894                 }
 895         }
 896
 897         if (value == -EOPNOTSUPP)
 898                 VDBG(fsg,
 899                         "unknown class-specific control req "
 900                         "%02x.%02x v%04x i%04x l%u\n",
 901                         ctrl->bRequestType, ctrl->bRequest,
 902                         le16_to_cpu(ctrl->wValue), w_index, w_length);
 903         return value;
 904 }
 905
 906
 907 /*-------------------------------------------------------------------------*/
 908
 909 /* Ep0 standard request handlers.  These always run in_irq. */
 910
 911 static int standard_setup_req(struct fsg_dev *fsg,
 912                 const struct usb_ctrlrequest *ctrl)
 913 {
 914         struct usb_request      *req = fsg->ep0req;
 915         int                     value = -EOPNOTSUPP;
 916         u16                     w_index = le16_to_cpu(ctrl->wIndex);
 917         u16                     w_value = le16_to_cpu(ctrl->wValue);
 918
 919         /* Usually this just stores reply data in the pre-allocated ep0 buffer,
 920          * but config change events will also reconfigure hardware. */
 921         switch (ctrl->bRequest) {
 922
 923         case USB_REQ_GET_DESCRIPTOR:
 924                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
 925                                 USB_RECIP_DEVICE))
 926                         break;
 927                 switch (w_value >> 8) {
 928
 929                 case USB_DT_DEVICE:
 930                         VDBG(fsg, "get device descriptor\n");
 931                         value = sizeof device_desc;
 932                         memcpy(req->buf, &device_desc, value);
 933                         break;
 934                 case USB_DT_DEVICE_QUALIFIER:
 935                         VDBG(fsg, "get device qualifier\n");
 936                         if (!gadget_is_dualspeed(fsg->gadget))
 937                                 break;
 938                         value = sizeof dev_qualifier;
 939                         memcpy(req->buf, &dev_qualifier, value);
 940                         break;
 941
 942                 case USB_DT_OTHER_SPEED_CONFIG:
 943                         VDBG(fsg, "get other-speed config descriptor\n");
 944                         if (!gadget_is_dualspeed(fsg->gadget))
 945                                 break;
 946                         goto get_config;
 947                 case USB_DT_CONFIG:
 948                         VDBG(fsg, "get configuration descriptor\n");
 949 get_config:
 950                         value = populate_config_buf(fsg->gadget,
 951                                         req->buf,
 952                                         w_value >> 8,
 953                                         w_value & 0xff);
 954                         break;
 955
 956                 case USB_DT_STRING:
 957                         VDBG(fsg, "get string descriptor\n");
 958
 959                         /* wIndex == language code */
 960                         value = usb_gadget_get_string(&stringtab,
 961                                         w_value & 0xff, req->buf);
 962                         break;
 963                 }
 964                 break;
 965
 966         /* One config, two speeds */
 967         case USB_REQ_SET_CONFIGURATION:
 968                 if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
 969                                 USB_RECIP_DEVICE))
 970                         break;
 971                 VDBG(fsg, "set configuration\n");
 972                 if (w_value == CONFIG_VALUE || w_value == 0) {
 973                         fsg->new_config = w_value;
 974
 975                         /* Raise an exception to wipe out previous transaction
 976                          * state (queued bufs, etc) and set the new config. */
 977                         raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
 978                         value = DELAYED_STATUS;
 979                 }
 980                 break;
 981         case USB_REQ_GET_CONFIGURATION:
 982                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
 983                                 USB_RECIP_DEVICE))
 984                         break;
 985                 VDBG(fsg, "get configuration\n");
 986                 *(u8 *) req->buf = fsg->config;
 987                 value = 1;
 988                 break;
 989
 990         case USB_REQ_SET_INTERFACE:
 991                 if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
 992                                 USB_RECIP_INTERFACE))
 993                         break;
 994                 if (fsg->config && w_index == 0) {
 995
 996                         /* Raise an exception to wipe out previous transaction
 997                          * state (queued bufs, etc) and install the new
 998                          * interface altsetting. */
 999                         raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
1000                         value = DELAYED_STATUS;
1001                 }
1002                 break;
1003         case USB_REQ_GET_INTERFACE:
1004                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1005                                 USB_RECIP_INTERFACE))
1006                         break;
1007                 if (!fsg->config)
1008                         break;
1009                 if (w_index != 0) {
1010                         value = -EDOM;
1011                         break;
1012                 }
1013                 VDBG(fsg, "get interface\n");
1014                 *(u8 *) req->buf = 0;
1015                 value = 1;
1016                 break;
1017
1018         default:
1019                 VDBG(fsg,
1020                         "unknown control req %02x.%02x v%04x i%04x l%u\n",
1021                         ctrl->bRequestType, ctrl->bRequest,
1022                         w_value, w_index, le16_to_cpu(ctrl->wLength));
1023         }
1024
1025         return value;
1026 }
1027
1028
1029 static int fsg_setup(struct usb_gadget *gadget,
1030                 const struct usb_ctrlrequest *ctrl)
1031 {
1032         struct fsg_dev          *fsg = get_gadget_data(gadget);
1033         int                     rc;
1034         int                     w_length = le16_to_cpu(ctrl->wLength);
1035
1036         ++fsg->ep0_req_tag;             // Record arrival of a new request
1037         fsg->ep0req->context = NULL;
1038         fsg->ep0req->length = 0;
1039         dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
1040
1041         if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
1042                 rc = class_setup_req(fsg, ctrl);
1043         else
1044                 rc = standard_setup_req(fsg, ctrl);
1045
1046         /* Respond with data/status or defer until later? */
1047         if (rc >= 0 && rc != DELAYED_STATUS) {
1048                 rc = min(rc, w_length);
1049                 fsg->ep0req->length = rc;
1050                 fsg->ep0req->zero = rc < w_length;
1051                 fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
1052                                 "ep0-in" : "ep0-out");
1053                 rc = ep0_queue(fsg);
1054         }
1055
1056         /* Device either stalls (rc < 0) or reports success */
1057         return rc;
1058 }
1059
1060
1061 /*-------------------------------------------------------------------------*/
1062
1063 /* All the following routines run in process context */
1064
1065
1066 /* Use this for bulk or interrupt transfers, not ep0 */
1067 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
1068                 struct usb_request *req, int *pbusy,
1069                 enum fsg_buffer_state *state)
1070 {
1071         int     rc;
1072
1073         if (ep == fsg->bulk_in)
1074                 dump_msg(fsg, "bulk-in", req->buf, req->length);
1075         else if (ep == fsg->intr_in)
1076                 dump_msg(fsg, "intr-in", req->buf, req->length);
1077
1078         spin_lock_irq(&fsg->lock);
1079         *pbusy = 1;
1080         *state = BUF_STATE_BUSY;
1081         spin_unlock_irq(&fsg->lock);
1082         rc = usb_ep_queue(ep, req, GFP_KERNEL);
1083         if (rc != 0) {
1084                 *pbusy = 0;
1085                 *state = BUF_STATE_EMPTY;
1086
1087                 /* We can't do much more than wait for a reset */
1088
1089                 /* Note: currently the net2280 driver fails zero-length
1090                  * submissions if DMA is enabled. */
1091                 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
1092                                                 req->length == 0))
1093                         WARNING(fsg, "error in submission: %s --> %d\n",
1094                                         ep->name, rc);
1095         }
1096 }
1097
1098
1099 static int sleep_thread(struct fsg_dev *fsg)
1100 {
1101         int     rc = 0;
1102
1103         /* Wait until a signal arrives or we are woken up */
1104         for (;;) {
1105                 try_to_freeze();
1106                 set_current_state(TASK_INTERRUPTIBLE);
1107                 if (signal_pending(current)) {
1108                         rc = -EINTR;
1109                         break;
1110                 }
1111                 if (fsg->thread_wakeup_needed)
1112                         break;
1113                 schedule();
1114         }
1115         __set_current_state(TASK_RUNNING);
1116         fsg->thread_wakeup_needed = 0;
1117         return rc;
1118 }
1119
1120
1121 /*-------------------------------------------------------------------------*/
1122
1123 static int do_read(struct fsg_dev *fsg)
1124 {
1125         struct lun              *curlun = fsg->curlun;
1126         u32                     lba;
1127         struct fsg_buffhd       *bh;
1128         int                     rc;
1129         u32                     amount_left;
1130         loff_t                  file_offset, file_offset_tmp;
1131         unsigned int            amount;
1132         unsigned int            partial_page;
1133         ssize_t                 nread;
1134
1135         /* Get the starting Logical Block Address and check that it's
1136          * not too big */
1137         if (fsg->cmnd[0] == SC_READ_6)
1138                 lba = get_unaligned_be24(&fsg->cmnd[1]);
1139         else {
1140                 lba = get_unaligned_be32(&fsg->cmnd[2]);
1141
1142                 /* We allow DPO (Disable Page Out = don't save data in the
1143                  * cache) and FUA (Force Unit Access = don't read from the
1144                  * cache), but we don't implement them. */
1145                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1146                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1147                         return -EINVAL;
1148                 }
1149         }
1150         if (lba >= curlun->num_sectors) {
1151                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1152                 return -EINVAL;
1153         }
1154         file_offset = ((loff_t) lba) << 9;
1155
1156         /* Carry out the file reads */
1157         amount_left = fsg->data_size_from_cmnd;
1158         if (unlikely(amount_left == 0))
1159                 return -EIO;            // No default reply
1160
1161         for (;;) {
1162
1163                 /* Figure out how much we need to read:
1164                  * Try to read the remaining amount.
1165                  * But don't read more than the buffer size.
1166                  * And don't try to read past the end of the file.
1167                  * Finally, if we're not at a page boundary, don't read past
1168                  *      the next page.
1169                  * If this means reading 0 then we were asked to read past
1170                  *      the end of file. */
1171                 amount = min((unsigned int) amount_left, mod_data.buflen);
1172                 amount = min((loff_t) amount,
1173                                 curlun->file_length - file_offset);
1174                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
1175                 if (partial_page > 0)
1176                         amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
1177                                         partial_page);
1178
1179                 /* Wait for the next buffer to become available */
1180                 bh = fsg->next_buffhd_to_fill;
1181                 while (bh->state != BUF_STATE_EMPTY) {
1182                         rc = sleep_thread(fsg);
1183                         if (rc)
1184                                 return rc;
1185                 }
1186
1187                 /* If we were asked to read past the end of file,
1188                  * end with an empty buffer. */
1189                 if (amount == 0) {
1190                         curlun->sense_data =
1191                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1192                         curlun->sense_data_info = file_offset >> 9;
1193                         curlun->info_valid = 1;
1194                         bh->inreq->length = 0;
1195                         bh->state = BUF_STATE_FULL;
1196                         break;
1197                 }
1198
1199                 /* Perform the read */
1200                 file_offset_tmp = file_offset;
1201                 nread = vfs_read(curlun->filp,
1202                                 (char __user *) bh->buf,
1203                                 amount, &file_offset_tmp);
1204                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1205                                 (unsigned long long) file_offset,
1206                                 (int) nread);
1207                 if (signal_pending(current))
1208                         return -EINTR;
1209
1210                 if (nread < 0) {
1211                         LDBG(curlun, "error in file read: %d\n",
1212                                         (int) nread);
1213                         nread = 0;
1214                 } else if (nread < amount) {
1215                         LDBG(curlun, "partial file read: %d/%u\n",
1216                                         (int) nread, amount);
1217                         nread -= (nread & 511); // Round down to a block
1218                 }
1219                 file_offset  += nread;
1220                 amount_left  -= nread;
1221                 fsg->residue -= nread;
1222                 bh->inreq->length = nread;
1223                 bh->state = BUF_STATE_FULL;
1224
1225                 /* If an error occurred, report it and its position */
1226                 if (nread < amount) {
1227                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1228                         curlun->sense_data_info = file_offset >> 9;
1229                         curlun->info_valid = 1;
1230                         break;
1231                 }
1232
1233                 if (amount_left == 0)
1234                         break;          // No more left to read
1235
1236                 /* Send this buffer and go read some more */
1237                 bh->inreq->zero = 0;
1238                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1239                                 &bh->inreq_busy, &bh->state);
1240                 fsg->next_buffhd_to_fill = bh->next;
1241         }
1242
1243         return -EIO;            // No default reply
1244 }
1245
1246
1247 /*-------------------------------------------------------------------------*/
1248
1249 static int do_write(struct fsg_dev *fsg)
1250 {
1251         struct lun              *curlun = fsg->curlun;
1252         u32                     lba;
1253         struct fsg_buffhd       *bh;
1254         int                     get_some_more;
1255         u32                     amount_left_to_req, amount_left_to_write;
1256         loff_t                  usb_offset, file_offset, file_offset_tmp;
1257         unsigned int            amount;
1258         unsigned int            partial_page;
1259         ssize_t                 nwritten;
1260         int                     rc;
1261
1262         if (curlun->ro) {
1263                 curlun->sense_data = SS_WRITE_PROTECTED;
1264                 return -EINVAL;
1265         }
1266         spin_lock(&curlun->filp->f_lock);
1267         curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
1268         spin_unlock(&curlun->filp->f_lock);
1269
1270         /* Get the starting Logical Block Address and check that it's
1271          * not too big */
1272         if (fsg->cmnd[0] == SC_WRITE_6)
1273                 lba = get_unaligned_be24(&fsg->cmnd[1]);
1274         else {
1275                 lba = get_unaligned_be32(&fsg->cmnd[2]);
1276
1277                 /* We allow DPO (Disable Page Out = don't save data in the
1278                  * cache) and FUA (Force Unit Access = write directly to the
1279                  * medium).  We don't implement DPO; we implement FUA by
1280                  * performing synchronous output. */
1281                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1282                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1283                         return -EINVAL;
1284                 }
1285                 if (fsg->cmnd[1] & 0x08) {      // FUA
1286                         spin_lock(&curlun->filp->f_lock);
1287                         curlun->filp->f_flags |= O_SYNC;
1288                         spin_unlock(&curlun->filp->f_lock);
1289                 }
1290         }
1291         if (lba >= curlun->num_sectors) {
1292                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1293                 return -EINVAL;
1294         }
1295
1296         /* Carry out the file writes */
1297         get_some_more = 1;
1298         file_offset = usb_offset = ((loff_t) lba) << 9;
1299         amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
1300
1301         while (amount_left_to_write > 0) {
1302
1303                 /* Queue a request for more data from the host */
1304                 bh = fsg->next_buffhd_to_fill;
1305                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
1306
1307                         /* Figure out how much we want to get:
1308                          * Try to get the remaining amount.
1309                          * But don't get more than the buffer size.
1310                          * And don't try to go past the end of the file.
1311                          * If we're not at a page boundary,
1312                          *      don't go past the next page.
1313                          * If this means getting 0, then we were asked
1314                          *      to write past the end of file.
1315                          * Finally, round down to a block boundary. */
1316                         amount = min(amount_left_to_req, mod_data.buflen);
1317                         amount = min((loff_t) amount, curlun->file_length -
1318                                         usb_offset);
1319                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
1320                         if (partial_page > 0)
1321                                 amount = min(amount,
1322         (unsigned int) PAGE_CACHE_SIZE - partial_page);
1323
1324                         if (amount == 0) {
1325                                 get_some_more = 0;
1326                                 curlun->sense_data =
1327                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1328                                 curlun->sense_data_info = usb_offset >> 9;
1329                                 curlun->info_valid = 1;
1330                                 continue;
1331                         }
1332                         amount -= (amount & 511);
1333                         if (amount == 0) {
1334
1335                                 /* Why were we were asked to transfer a
1336                                  * partial block? */
1337                                 get_some_more = 0;
1338                                 continue;
1339                         }
1340
1341                         /* Get the next buffer */
1342                         usb_offset += amount;
1343                         fsg->usb_amount_left -= amount;
1344                         amount_left_to_req -= amount;
1345                         if (amount_left_to_req == 0)
1346                                 get_some_more = 0;
1347
1348                         /* amount is always divisible by 512, hence by
1349                          * the bulk-out maxpacket size */
1350                         bh->outreq->length = bh->bulk_out_intended_length =
1351                                         amount;
1352                         bh->outreq->short_not_ok = 1;
1353                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
1354                                         &bh->outreq_busy, &bh->state);
1355                         fsg->next_buffhd_to_fill = bh->next;
1356                         continue;
1357                 }
1358
1359                 /* Write the received data to the backing file */
1360                 bh = fsg->next_buffhd_to_drain;
1361                 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
1362                         break;                  // We stopped early
1363                 if (bh->state == BUF_STATE_FULL) {
1364                         smp_rmb();
1365                         fsg->next_buffhd_to_drain = bh->next;
1366                         bh->state = BUF_STATE_EMPTY;
1367
1368                         /* Did something go wrong with the transfer? */
1369                         if (bh->outreq->status != 0) {
1370                                 curlun->sense_data = SS_COMMUNICATION_FAILURE;
1371                                 curlun->sense_data_info = file_offset >> 9;
1372                                 curlun->info_valid = 1;
1373                                 break;
1374                         }
1375
1376                         amount = bh->outreq->actual;
1377                         if (curlun->file_length - file_offset < amount) {
1378                                 LERROR(curlun,
1379         "write %u @ %llu beyond end %llu\n",
1380         amount, (unsigned long long) file_offset,
1381         (unsigned long long) curlun->file_length);
1382                                 amount = curlun->file_length - file_offset;
1383                         }
1384
1385                         /* Perform the write */
1386                         file_offset_tmp = file_offset;
1387                         nwritten = vfs_write(curlun->filp,
1388                                         (char __user *) bh->buf,
1389                                         amount, &file_offset_tmp);
1390                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
1391                                         (unsigned long long) file_offset,
1392                                         (int) nwritten);
1393                         if (signal_pending(current))
1394                                 return -EINTR;          // Interrupted!
1395
1396                         if (nwritten < 0) {
1397                                 LDBG(curlun, "error in file write: %d\n",
1398                                                 (int) nwritten);
1399                                 nwritten = 0;
1400                         } else if (nwritten < amount) {
1401                                 LDBG(curlun, "partial file write: %d/%u\n",
1402                                                 (int) nwritten, amount);
1403                                 nwritten -= (nwritten & 511);
1404                                                 // Round down to a block
1405                         }
1406                         file_offset += nwritten;
1407                         amount_left_to_write -= nwritten;
1408                         fsg->residue -= nwritten;
1409
1410                         /* If an error occurred, report it and its position */
1411                         if (nwritten < amount) {
1412                                 curlun->sense_data = SS_WRITE_ERROR;
1413                                 curlun->sense_data_info = file_offset >> 9;
1414                                 curlun->info_valid = 1;
1415                                 break;
1416                         }
1417
1418                         /* Did the host decide to stop early? */
1419                         if (bh->outreq->actual != bh->outreq->length) {
1420                                 fsg->short_packet_received = 1;
1421                                 break;
1422                         }
1423                         continue;
1424                 }
1425
1426                 /* Wait for something to happen */
1427                 rc = sleep_thread(fsg);
1428                 if (rc)
1429                         return rc;
1430         }
1431
1432         return -EIO;            // No default reply
1433 }
1434
1435
1436 /*-------------------------------------------------------------------------*/
1437
1438 static int do_synchronize_cache(struct fsg_dev *fsg)
1439 {
1440         struct lun      *curlun = fsg->curlun;
1441         int             rc;
1442
1443         /* We ignore the requested LBA and write out all file's
1444          * dirty data buffers. */
1445         rc = fsync_sub(curlun);
1446         if (rc)
1447                 curlun->sense_data = SS_WRITE_ERROR;
1448         return 0;
1449 }
1450
1451
1452 /*-------------------------------------------------------------------------*/
1453
1454 static void invalidate_sub(struct lun *curlun)
1455 {
1456         struct file     *filp = curlun->filp;
1457         struct inode    *inode = filp->f_path.dentry->d_inode;
1458         unsigned long   rc;
1459
1460         rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
1461         VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
1462 }
1463
1464 static int do_verify(struct fsg_dev *fsg)
1465 {
1466         struct lun              *curlun = fsg->curlun;
1467         u32                     lba;
1468         u32                     verification_length;
1469         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
1470         loff_t                  file_offset, file_offset_tmp;
1471         u32                     amount_left;
1472         unsigned int            amount;
1473         ssize_t                 nread;
1474
1475         /* Get the starting Logical Block Address and check that it's
1476          * not too big */
1477         lba = get_unaligned_be32(&fsg->cmnd[2]);
1478         if (lba >= curlun->num_sectors) {
1479                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1480                 return -EINVAL;
1481         }
1482
1483         /* We allow DPO (Disable Page Out = don't save data in the
1484          * cache) but we don't implement it. */
1485         if ((fsg->cmnd[1] & ~0x10) != 0) {
1486                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1487                 return -EINVAL;
1488         }
1489
1490         verification_length = get_unaligned_be16(&fsg->cmnd[7]);
1491         if (unlikely(verification_length == 0))
1492                 return -EIO;            // No default reply
1493
1494         /* Prepare to carry out the file verify */
1495         amount_left = verification_length << 9;
1496         file_offset = ((loff_t) lba) << 9;
1497
1498         /* Write out all the dirty buffers before invalidating them */
1499         fsync_sub(curlun);
1500         if (signal_pending(current))
1501                 return -EINTR;
1502
1503         invalidate_sub(curlun);
1504         if (signal_pending(current))
1505                 return -EINTR;
1506
1507         /* Just try to read the requested blocks */
1508         while (amount_left > 0) {
1509
1510                 /* Figure out how much we need to read:
1511                  * Try to read the remaining amount, but not more than
1512                  * the buffer size.
1513                  * And don't try to read past the end of the file.
1514                  * If this means reading 0 then we were asked to read
1515                  * past the end of file. */
1516                 amount = min((unsigned int) amount_left, mod_data.buflen);
1517                 amount = min((loff_t) amount,
1518                                 curlun->file_length - file_offset);
1519                 if (amount == 0) {
1520                         curlun->sense_data =
1521                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1522                         curlun->sense_data_info = file_offset >> 9;
1523                         curlun->info_valid = 1;
1524                         break;
1525                 }
1526
1527                 /* Perform the read */
1528                 file_offset_tmp = file_offset;
1529                 nread = vfs_read(curlun->filp,
1530                                 (char __user *) bh->buf,
1531                                 amount, &file_offset_tmp);
1532                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1533                                 (unsigned long long) file_offset,
1534                                 (int) nread);
1535                 if (signal_pending(current))
1536                         return -EINTR;
1537
1538                 if (nread < 0) {
1539                         LDBG(curlun, "error in file verify: %d\n",
1540                                         (int) nread);
1541                         nread = 0;
1542                 } else if (nread < amount) {
1543                         LDBG(curlun, "partial file verify: %d/%u\n",
1544                                         (int) nread, amount);
1545                         nread -= (nread & 511); // Round down to a sector
1546                 }
1547                 if (nread == 0) {
1548                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1549                         curlun->sense_data_info = file_offset >> 9;
1550                         curlun->info_valid = 1;
1551                         break;
1552                 }
1553                 file_offset += nread;
1554                 amount_left -= nread;
1555         }
1556         return 0;
1557 }
1558
1559
1560 /*-------------------------------------------------------------------------*/
1561
1562 static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1563 {
1564         u8      *buf = (u8 *) bh->buf;
1565
1566         static char vendor_id[] = "Linux   ";
1567         static char product_disk_id[] = "File-Stor Gadget";
1568         static char product_cdrom_id[] = "File-CD Gadget  ";
1569
1570         if (!fsg->curlun) {             // Unsupported LUNs are okay
1571                 fsg->bad_lun_okay = 1;
1572                 memset(buf, 0, 36);
1573                 buf[0] = 0x7f;          // Unsupported, no device-type
1574                 buf[4] = 31;            // Additional length
1575                 return 36;
1576         }
1577
1578         memset(buf, 0, 8);
1579         buf[0] = (mod_data.cdrom ? TYPE_CDROM : TYPE_DISK);
1580         if (mod_data.removable)
1581                 buf[1] = 0x80;
1582         buf[2] = 2;             // ANSI SCSI level 2
1583         buf[3] = 2;             // SCSI-2 INQUIRY data format
1584         buf[4] = 31;            // Additional length
1585                                 // No special options
1586         sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
1587                         (mod_data.cdrom ? product_cdrom_id :
1588                                 product_disk_id),
1589                         mod_data.release);
1590         return 36;
1591 }
1592
1593
1594 static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1595 {
1596         struct lun      *curlun = fsg->curlun;
1597         u8              *buf = (u8 *) bh->buf;
1598         u32             sd, sdinfo;
1599         int             valid;
1600
1601         /*
1602          * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1603          *
1604          * If a REQUEST SENSE command is received from an initiator
1605          * with a pending unit attention condition (before the target
1606          * generates the contingent allegiance condition), then the
1607          * target shall either:
1608          *   a) report any pending sense data and preserve the unit
1609          *      attention condition on the logical unit, or,
1610          *   b) report the unit attention condition, may discard any
1611          *      pending sense data, and clear the unit attention
1612          *      condition on the logical unit for that initiator.
1613          *
1614          * FSG normally uses option a); enable this code to use option b).
1615          */
1616 #if 0
1617         if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1618                 curlun->sense_data = curlun->unit_attention_data;
1619                 curlun->unit_attention_data = SS_NO_SENSE;
1620         }
1621 #endif
1622
1623         if (!curlun) {          // Unsupported LUNs are okay
1624                 fsg->bad_lun_okay = 1;
1625                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1626                 sdinfo = 0;
1627                 valid = 0;
1628         } else {
1629                 sd = curlun->sense_data;
1630                 sdinfo = curlun->sense_data_info;
1631                 valid = curlun->info_valid << 7;
1632                 curlun->sense_data = SS_NO_SENSE;
1633                 curlun->sense_data_info = 0;
1634                 curlun->info_valid = 0;
1635         }
1636
1637         memset(buf, 0, 18);
1638         buf[0] = valid | 0x70;                  // Valid, current error
1639         buf[2] = SK(sd);
1640         put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
1641         buf[7] = 18 - 8;                        // Additional sense length
1642         buf[12] = ASC(sd);
1643         buf[13] = ASCQ(sd);
1644         return 18;
1645 }
1646
1647
1648 static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1649 {
1650         struct lun      *curlun = fsg->curlun;
1651         u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
1652         int             pmi = fsg->cmnd[8];
1653         u8              *buf = (u8 *) bh->buf;
1654
1655         /* Check the PMI and LBA fields */
1656         if (pmi > 1 || (pmi == 0 && lba != 0)) {
1657                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1658                 return -EINVAL;
1659         }
1660
1661         put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1662                                                 /* Max logical block */
1663         put_unaligned_be32(512, &buf[4]);       /* Block length */
1664         return 8;
1665 }
1666
1667
1668 static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1669 {
1670         struct lun      *curlun = fsg->curlun;
1671         int             msf = fsg->cmnd[1] & 0x02;
1672         u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
1673         u8              *buf = (u8 *) bh->buf;
1674
1675         if ((fsg->cmnd[1] & ~0x02) != 0) {              /* Mask away MSF */
1676                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1677                 return -EINVAL;
1678         }
1679         if (lba >= curlun->num_sectors) {
1680                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1681                 return -EINVAL;
1682         }
1683
1684         memset(buf, 0, 8);
1685         buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
1686         store_cdrom_address(&buf[4], msf, lba);
1687         return 8;
1688 }
1689
1690
1691 static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1692 {
1693         struct lun      *curlun = fsg->curlun;
1694         int             msf = fsg->cmnd[1] & 0x02;
1695         int             start_track = fsg->cmnd[6];
1696         u8              *buf = (u8 *) bh->buf;
1697
1698         if ((fsg->cmnd[1] & ~0x02) != 0 ||              /* Mask away MSF */
1699                         start_track > 1) {
1700                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1701                 return -EINVAL;
1702         }
1703
1704         memset(buf, 0, 20);
1705         buf[1] = (20-2);                /* TOC data length */
1706         buf[2] = 1;                     /* First track number */
1707         buf[3] = 1;                     /* Last track number */
1708         buf[5] = 0x16;                  /* Data track, copying allowed */
1709         buf[6] = 0x01;                  /* Only track is number 1 */
1710         store_cdrom_address(&buf[8], msf, 0);
1711
1712         buf[13] = 0x16;                 /* Lead-out track is data */
1713         buf[14] = 0xAA;                 /* Lead-out track number */
1714         store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1715         return 20;
1716 }
1717
1718
1719 static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1720 {
1721         struct lun      *curlun = fsg->curlun;
1722         int             mscmnd = fsg->cmnd[0];
1723         u8              *buf = (u8 *) bh->buf;
1724         u8              *buf0 = buf;
1725         int             pc, page_code;
1726         int             changeable_values, all_pages;
1727         int             valid_page = 0;
1728         int             len, limit;
1729
1730         if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
1731                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1732                 return -EINVAL;
1733         }
1734         pc = fsg->cmnd[2] >> 6;
1735         page_code = fsg->cmnd[2] & 0x3f;
1736         if (pc == 3) {
1737                 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1738                 return -EINVAL;
1739         }
1740         changeable_values = (pc == 1);
1741         all_pages = (page_code == 0x3f);
1742
1743         /* Write the mode parameter header.  Fixed values are: default
1744          * medium type, no cache control (DPOFUA), and no block descriptors.
1745          * The only variable value is the WriteProtect bit.  We will fill in
1746          * the mode data length later. */
1747         memset(buf, 0, 8);
1748         if (mscmnd == SC_MODE_SENSE_6) {
1749                 buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
1750                 buf += 4;
1751                 limit = 255;
1752         } else {                        // SC_MODE_SENSE_10
1753                 buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
1754                 buf += 8;
1755                 limit = 65535;          // Should really be mod_data.buflen
1756         }
1757
1758         /* No block descriptors */
1759
1760         /* The mode pages, in numerical order.  The only page we support
1761          * is the Caching page. */
1762         if (page_code == 0x08 || all_pages) {
1763                 valid_page = 1;
1764                 buf[0] = 0x08;          // Page code
1765                 buf[1] = 10;            // Page length
1766                 memset(buf+2, 0, 10);   // None of the fields are changeable
1767
1768                 if (!changeable_values) {
1769                         buf[2] = 0x04;  // Write cache enable,
1770                                         // Read cache not disabled
1771                                         // No cache retention priorities
1772                         put_unaligned_be16(0xffff, &buf[4]);
1773                                         /* Don't disable prefetch */
1774                                         /* Minimum prefetch = 0 */
1775                         put_unaligned_be16(0xffff, &buf[8]);
1776                                         /* Maximum prefetch */
1777                         put_unaligned_be16(0xffff, &buf[10]);
1778                                         /* Maximum prefetch ceiling */
1779                 }
1780                 buf += 12;
1781         }
1782
1783         /* Check that a valid page was requested and the mode data length
1784          * isn't too long. */
1785         len = buf - buf0;
1786         if (!valid_page || len > limit) {
1787                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1788                 return -EINVAL;
1789         }
1790
1791         /*  Store the mode data length */
1792         if (mscmnd == SC_MODE_SENSE_6)
1793                 buf0[0] = len - 1;
1794         else
1795                 put_unaligned_be16(len - 2, buf0);
1796         return len;
1797 }
1798
1799
1800 static int do_start_stop(struct fsg_dev *fsg)
1801 {
1802         struct lun      *curlun = fsg->curlun;
1803         int             loej, start;
1804
1805         if (!mod_data.removable) {
1806                 curlun->sense_data = SS_INVALID_COMMAND;
1807                 return -EINVAL;
1808         }
1809
1810         // int immed = fsg->cmnd[1] & 0x01;
1811         loej = fsg->cmnd[4] & 0x02;
1812         start = fsg->cmnd[4] & 0x01;
1813
1814 #ifdef CONFIG_USB_FILE_STORAGE_TEST
1815         if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
1816                         (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
1817                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1818                 return -EINVAL;
1819         }
1820
1821         if (!start) {
1822
1823                 /* Are we allowed to unload the media? */
1824                 if (curlun->prevent_medium_removal) {
1825                         LDBG(curlun, "unload attempt prevented\n");
1826                         curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1827                         return -EINVAL;
1828                 }
1829                 if (loej) {             // Simulate an unload/eject
1830                         up_read(&fsg->filesem);
1831                         down_write(&fsg->filesem);
1832                         close_backing_file(curlun);
1833                         up_write(&fsg->filesem);
1834                         down_read(&fsg->filesem);
1835                 }
1836         } else {
1837
1838                 /* Our emulation doesn't support mounting; the medium is
1839                  * available for use as soon as it is loaded. */
1840                 if (!backing_file_is_open(curlun)) {
1841                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1842                         return -EINVAL;
1843                 }
1844         }
1845 #endif
1846         return 0;
1847 }
1848
1849
1850 static int do_prevent_allow(struct fsg_dev *fsg)
1851 {
1852         struct lun      *curlun = fsg->curlun;
1853         int             prevent;
1854
1855         if (!mod_data.removable) {
1856                 curlun->sense_data = SS_INVALID_COMMAND;
1857                 return -EINVAL;
1858         }
1859
1860         prevent = fsg->cmnd[4] & 0x01;
1861         if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
1862                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1863                 return -EINVAL;
1864         }
1865
1866         if (curlun->prevent_medium_removal && !prevent)
1867                 fsync_sub(curlun);
1868         curlun->prevent_medium_removal = prevent;
1869         return 0;
1870 }
1871
1872
1873 static int do_read_format_capacities(struct fsg_dev *fsg,
1874                         struct fsg_buffhd *bh)
1875 {
1876         struct lun      *curlun = fsg->curlun;
1877         u8              *buf = (u8 *) bh->buf;
1878
1879         buf[0] = buf[1] = buf[2] = 0;
1880         buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
1881         buf += 4;
1882
1883         put_unaligned_be32(curlun->num_sectors, &buf[0]);
1884                                                 /* Number of blocks */
1885         put_unaligned_be32(512, &buf[4]);       /* Block length */
1886         buf[4] = 0x02;                          /* Current capacity */
1887         return 12;
1888 }
1889
1890
1891 static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1892 {
1893         struct lun      *curlun = fsg->curlun;
1894
1895         /* We don't support MODE SELECT */
1896         curlun->sense_data = SS_INVALID_COMMAND;
1897         return -EINVAL;
1898 }
1899
1900
1901 /*-------------------------------------------------------------------------*/
1902
1903 static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1904 {
1905         int     rc;
1906
1907         rc = fsg_set_halt(fsg, fsg->bulk_in);
1908         if (rc == -EAGAIN)
1909                 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1910         while (rc != 0) {
1911                 if (rc != -EAGAIN) {
1912                         WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1913                         rc = 0;
1914                         break;
1915                 }
1916
1917                 /* Wait for a short time and then try again */
1918                 if (msleep_interruptible(100) != 0)
1919                         return -EINTR;
1920                 rc = usb_ep_set_halt(fsg->bulk_in);
1921         }
1922         return rc;
1923 }
1924
1925 static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1926 {
1927         int     rc;
1928
1929         DBG(fsg, "bulk-in set wedge\n");
1930         rc = usb_ep_set_wedge(fsg->bulk_in);
1931         if (rc == -EAGAIN)
1932                 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1933         while (rc != 0) {
1934                 if (rc != -EAGAIN) {
1935                         WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1936                         rc = 0;
1937                         break;
1938                 }
1939
1940                 /* Wait for a short time and then try again */
1941                 if (msleep_interruptible(100) != 0)
1942                         return -EINTR;
1943                 rc = usb_ep_set_wedge(fsg->bulk_in);
1944         }
1945         return rc;
1946 }
1947
1948 static int pad_with_zeros(struct fsg_dev *fsg)
1949 {
1950         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
1951         u32                     nkeep = bh->inreq->length;
1952         u32                     nsend;
1953         int                     rc;
1954
1955         bh->state = BUF_STATE_EMPTY;            // For the first iteration
1956         fsg->usb_amount_left = nkeep + fsg->residue;
1957         while (fsg->usb_amount_left > 0) {
1958
1959                 /* Wait for the next buffer to be free */
1960                 while (bh->state != BUF_STATE_EMPTY) {
1961                         rc = sleep_thread(fsg);
1962                         if (rc)
1963                                 return rc;
1964                 }
1965
1966                 nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
1967                 memset(bh->buf + nkeep, 0, nsend - nkeep);
1968                 bh->inreq->length = nsend;
1969                 bh->inreq->zero = 0;
1970                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1971                                 &bh->inreq_busy, &bh->state);
1972                 bh = fsg->next_buffhd_to_fill = bh->next;
1973                 fsg->usb_amount_left -= nsend;
1974                 nkeep = 0;
1975         }
1976         return 0;
1977 }
1978
1979 static int throw_away_data(struct fsg_dev *fsg)
1980 {
1981         struct fsg_buffhd       *bh;
1982         u32                     amount;
1983         int                     rc;
1984
1985         while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
1986                         fsg->usb_amount_left > 0) {
1987
1988                 /* Throw away the data in a filled buffer */
1989                 if (bh->state == BUF_STATE_FULL) {
1990                         smp_rmb();
1991                         bh->state = BUF_STATE_EMPTY;
1992                         fsg->next_buffhd_to_drain = bh->next;
1993
1994                         /* A short packet or an error ends everything */
1995                         if (bh->outreq->actual != bh->outreq->length ||
1996                                         bh->outreq->status != 0) {
1997                                 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
1998                                 return -EINTR;
1999                         }
2000                         continue;
2001                 }
2002
2003                 /* Try to submit another request if we need one */
2004                 bh = fsg->next_buffhd_to_fill;
2005                 if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
2006                         amount = min(fsg->usb_amount_left,
2007                                         (u32) mod_data.buflen);
2008
2009                         /* amount is always divisible by 512, hence by
2010                          * the bulk-out maxpacket size */
2011                         bh->outreq->length = bh->bulk_out_intended_length =
2012                                         amount;
2013                         bh->outreq->short_not_ok = 1;
2014                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
2015                                         &bh->outreq_busy, &bh->state);
2016                         fsg->next_buffhd_to_fill = bh->next;
2017                         fsg->usb_amount_left -= amount;
2018                         continue;
2019                 }
2020
2021                 /* Otherwise wait for something to happen */
2022                 rc = sleep_thread(fsg);
2023                 if (rc)
2024                         return rc;
2025         }
2026         return 0;
2027 }
2028
2029
2030 static int finish_reply(struct fsg_dev *fsg)
2031 {
2032         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2033         int                     rc = 0;
2034
2035         switch (fsg->data_dir) {
2036         case DATA_DIR_NONE:
2037                 break;                  // Nothing to send
2038
2039         /* If we don't know whether the host wants to read or write,
2040          * this must be CB or CBI with an unknown command.  We mustn't
2041          * try to send or receive any data.  So stall both bulk pipes
2042          * if we can and wait for a reset. */
2043         case DATA_DIR_UNKNOWN:
2044                 if (mod_data.can_stall) {
2045                         fsg_set_halt(fsg, fsg->bulk_out);
2046                         rc = halt_bulk_in_endpoint(fsg);
2047                 }
2048                 break;
2049
2050         /* All but the last buffer of data must have already been sent */
2051         case DATA_DIR_TO_HOST:
2052                 if (fsg->data_size == 0)
2053                         ;               // Nothing to send
2054
2055                 /* If there's no residue, simply send the last buffer */
2056                 else if (fsg->residue == 0) {
2057                         bh->inreq->zero = 0;
2058                         start_transfer(fsg, fsg->bulk_in, bh->inreq,
2059                                         &bh->inreq_busy, &bh->state);
2060                         fsg->next_buffhd_to_fill = bh->next;
2061                 }
2062
2063                 /* There is a residue.  For CB and CBI, simply mark the end
2064                  * of the data with a short packet.  However, if we are
2065                  * allowed to stall, there was no data at all (residue ==
2066                  * data_size), and the command failed (invalid LUN or
2067                  * sense data is set), then halt the bulk-in endpoint
2068                  * instead. */
2069                 else if (!transport_is_bbb()) {
2070                         if (mod_data.can_stall &&
2071                                         fsg->residue == fsg->data_size &&
2072         (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
2073                                 bh->state = BUF_STATE_EMPTY;
2074                                 rc = halt_bulk_in_endpoint(fsg);
2075                         } else {
2076                                 bh->inreq->zero = 1;
2077                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2078                                                 &bh->inreq_busy, &bh->state);
2079                                 fsg->next_buffhd_to_fill = bh->next;
2080                         }
2081                 }
2082
2083                 /* For Bulk-only, if we're allowed to stall then send the
2084                  * short packet and halt the bulk-in endpoint.  If we can't
2085                  * stall, pad out the remaining data with 0's. */
2086                 else {
2087                         if (mod_data.can_stall) {
2088                                 bh->inreq->zero = 1;
2089                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2090                                                 &bh->inreq_busy, &bh->state);
2091                                 fsg->next_buffhd_to_fill = bh->next;
2092                                 rc = halt_bulk_in_endpoint(fsg);
2093                         } else
2094                                 rc = pad_with_zeros(fsg);
2095                 }
2096                 break;
2097
2098         /* We have processed all we want from the data the host has sent.
2099          * There may still be outstanding bulk-out requests. */
2100         case DATA_DIR_FROM_HOST:
2101                 if (fsg->residue == 0)
2102                         ;               // Nothing to receive
2103
2104                 /* Did the host stop sending unexpectedly early? */
2105                 else if (fsg->short_packet_received) {
2106                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2107                         rc = -EINTR;
2108                 }
2109
2110                 /* We haven't processed all the incoming data.  Even though
2111                  * we may be allowed to stall, doing so would cause a race.
2112                  * The controller may already have ACK'ed all the remaining
2113                  * bulk-out packets, in which case the host wouldn't see a
2114                  * STALL.  Not realizing the endpoint was halted, it wouldn't
2115                  * clear the halt -- leading to problems later on. */
2116 #if 0
2117                 else if (mod_data.can_stall) {
2118                         fsg_set_halt(fsg, fsg->bulk_out);
2119                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2120                         rc = -EINTR;
2121                 }
2122 #endif
2123
2124                 /* We can't stall.  Read in the excess data and throw it
2125                  * all away. */
2126                 else
2127                         rc = throw_away_data(fsg);
2128                 break;
2129         }
2130         return rc;
2131 }
2132
2133
2134 static int send_status(struct fsg_dev *fsg)
2135 {
2136         struct lun              *curlun = fsg->curlun;
2137         struct fsg_buffhd       *bh;
2138         int                     rc;
2139         u8                      status = USB_STATUS_PASS;
2140         u32                     sd, sdinfo = 0;
2141
2142         /* Wait for the next buffer to become available */
2143         bh = fsg->next_buffhd_to_fill;
2144         while (bh->state != BUF_STATE_EMPTY) {
2145                 rc = sleep_thread(fsg);
2146                 if (rc)
2147                         return rc;
2148         }
2149
2150         if (curlun) {
2151                 sd = curlun->sense_data;
2152                 sdinfo = curlun->sense_data_info;
2153         } else if (fsg->bad_lun_okay)
2154                 sd = SS_NO_SENSE;
2155         else
2156                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2157
2158         if (fsg->phase_error) {
2159                 DBG(fsg, "sending phase-error status\n");
2160                 status = USB_STATUS_PHASE_ERROR;
2161                 sd = SS_INVALID_COMMAND;
2162         } else if (sd != SS_NO_SENSE) {
2163                 DBG(fsg, "sending command-failure status\n");
2164                 status = USB_STATUS_FAIL;
2165                 VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2166                                 "  info x%x\n",
2167                                 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
2168         }
2169
2170         if (transport_is_bbb()) {
2171                 struct bulk_cs_wrap     *csw = bh->buf;
2172
2173                 /* Store and send the Bulk-only CSW */
2174                 csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
2175                 csw->Tag = fsg->tag;
2176                 csw->Residue = cpu_to_le32(fsg->residue);
2177                 csw->Status = status;
2178
2179                 bh->inreq->length = USB_BULK_CS_WRAP_LEN;
2180                 bh->inreq->zero = 0;
2181                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2182                                 &bh->inreq_busy, &bh->state);
2183
2184         } else if (mod_data.transport_type == USB_PR_CB) {
2185
2186                 /* Control-Bulk transport has no status phase! */
2187                 return 0;
2188
2189         } else {                        // USB_PR_CBI
2190                 struct interrupt_data   *buf = bh->buf;
2191
2192                 /* Store and send the Interrupt data.  UFI sends the ASC
2193                  * and ASCQ bytes.  Everything else sends a Type (which
2194                  * is always 0) and the status Value. */
2195                 if (mod_data.protocol_type == USB_SC_UFI) {
2196                         buf->bType = ASC(sd);
2197                         buf->bValue = ASCQ(sd);
2198                 } else {
2199                         buf->bType = 0;
2200                         buf->bValue = status;
2201                 }
2202                 fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
2203
2204                 fsg->intr_buffhd = bh;          // Point to the right buffhd
2205                 fsg->intreq->buf = bh->inreq->buf;
2206                 fsg->intreq->context = bh;
2207                 start_transfer(fsg, fsg->intr_in, fsg->intreq,
2208                                 &fsg->intreq_busy, &bh->state);
2209         }
2210
2211         fsg->next_buffhd_to_fill = bh->next;
2212         return 0;
2213 }
2214
2215
2216 /*-------------------------------------------------------------------------*/
2217
2218 /* Check whether the command is properly formed and whether its data size
2219  * and direction agree with the values we already have. */
2220 static int check_command(struct fsg_dev *fsg, int cmnd_size,
2221                 enum data_direction data_dir, unsigned int mask,
2222                 int needs_medium, const char *name)
2223 {
2224         int                     i;
2225         int                     lun = fsg->cmnd[1] >> 5;
2226         static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
2227         char                    hdlen[20];
2228         struct lun              *curlun;
2229
2230         /* Adjust the expected cmnd_size for protocol encapsulation padding.
2231          * Transparent SCSI doesn't pad. */
2232         if (protocol_is_scsi())
2233                 ;
2234
2235         /* There's some disagreement as to whether RBC pads commands or not.
2236          * We'll play it safe and accept either form. */
2237         else if (mod_data.protocol_type == USB_SC_RBC) {
2238                 if (fsg->cmnd_size == 12)
2239                         cmnd_size = 12;
2240
2241         /* All the other protocols pad to 12 bytes */
2242         } else
2243                 cmnd_size = 12;
2244
2245         hdlen[0] = 0;
2246         if (fsg->data_dir != DATA_DIR_UNKNOWN)
2247                 sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
2248                                 fsg->data_size);
2249         VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
2250                         name, cmnd_size, dirletter[(int) data_dir],
2251                         fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
2252
2253         /* We can't reply at all until we know the correct data direction
2254          * and size. */
2255         if (fsg->data_size_from_cmnd == 0)
2256                 data_dir = DATA_DIR_NONE;
2257         if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
2258                 fsg->data_dir = data_dir;
2259                 fsg->data_size = fsg->data_size_from_cmnd;
2260
2261         } else {                                        // Bulk-only
2262                 if (fsg->data_size < fsg->data_size_from_cmnd) {
2263
2264                         /* Host data size < Device data size is a phase error.
2265                          * Carry out the command, but only transfer as much
2266                          * as we are allowed. */
2267                         fsg->data_size_from_cmnd = fsg->data_size;
2268                         fsg->phase_error = 1;
2269                 }
2270         }
2271         fsg->residue = fsg->usb_amount_left = fsg->data_size;
2272
2273         /* Conflicting data directions is a phase error */
2274         if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
2275                 fsg->phase_error = 1;
2276                 return -EINVAL;
2277         }
2278
2279         /* Verify the length of the command itself */
2280         if (cmnd_size != fsg->cmnd_size) {
2281
2282                 /* Special case workaround: There are plenty of buggy SCSI
2283                  * implementations. Many have issues with cbw->Length
2284                  * field passing a wrong command size. For those cases we
2285                  * always try to work around the problem by using the length
2286                  * sent by the host side provided it is at least as large
2287                  * as the correct command length.
2288                  * Examples of such cases would be MS-Windows, which issues
2289                  * REQUEST SENSE with cbw->Length == 12 where it should
2290                  * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
2291                  * REQUEST SENSE with cbw->Length == 10 where it should
2292                  * be 6 as well.
2293                  */
2294                 if (cmnd_size <= fsg->cmnd_size) {
2295                         DBG(fsg, "%s is buggy! Expected length %d "
2296                                         "but we got %d\n", name,
2297                                         cmnd_size, fsg->cmnd_size);
2298                         cmnd_size = fsg->cmnd_size;
2299                 } else {
2300                         fsg->phase_error = 1;
2301                         return -EINVAL;
2302                 }
2303         }
2304
2305         /* Check that the LUN values are consistent */
2306         if (transport_is_bbb()) {
2307                 if (fsg->lun != lun)
2308                         DBG(fsg, "using LUN %d from CBW, "
2309                                         "not LUN %d from CDB\n",
2310                                         fsg->lun, lun);
2311         } else
2312                 fsg->lun = lun;         // Use LUN from the command
2313
2314         /* Check the LUN */
2315         if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
2316                 fsg->curlun = curlun = &fsg->luns[fsg->lun];
2317                 if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
2318                         curlun->sense_data = SS_NO_SENSE;
2319                         curlun->sense_data_info = 0;
2320                         curlun->info_valid = 0;
2321                 }
2322         } else {
2323                 fsg->curlun = curlun = NULL;
2324                 fsg->bad_lun_okay = 0;
2325
2326                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2327                  * to use unsupported LUNs; all others may not. */
2328                 if (fsg->cmnd[0] != SC_INQUIRY &&
2329                                 fsg->cmnd[0] != SC_REQUEST_SENSE) {
2330                         DBG(fsg, "unsupported LUN %d\n", fsg->lun);
2331                         return -EINVAL;
2332                 }
2333         }
2334
2335         /* If a unit attention condition exists, only INQUIRY and
2336          * REQUEST SENSE commands are allowed; anything else must fail. */
2337         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
2338                         fsg->cmnd[0] != SC_INQUIRY &&
2339                         fsg->cmnd[0] != SC_REQUEST_SENSE) {
2340                 curlun->sense_data = curlun->unit_attention_data;
2341                 curlun->unit_attention_data = SS_NO_SENSE;
2342                 return -EINVAL;
2343         }
2344
2345         /* Check that only command bytes listed in the mask are non-zero */
2346         fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
2347         for (i = 1; i < cmnd_size; ++i) {
2348                 if (fsg->cmnd[i] && !(mask & (1 << i))) {
2349                         if (curlun)
2350                                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2351                         return -EINVAL;
2352                 }
2353         }
2354
2355         /* If the medium isn't mounted and the command needs to access
2356          * it, return an error. */
2357         if (curlun && !backing_file_is_open(curlun) && needs_medium) {
2358                 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2359                 return -EINVAL;
2360         }
2361
2362         return 0;
2363 }
2364
2365
2366 static int do_scsi_command(struct fsg_dev *fsg)
2367 {
2368         struct fsg_buffhd       *bh;
2369         int                     rc;
2370         int                     reply = -EINVAL;
2371         int                     i;
2372         static char             unknown[16];
2373
2374         dump_cdb(fsg);
2375
2376         /* Wait for the next buffer to become available for data or status */
2377         bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
2378         while (bh->state != BUF_STATE_EMPTY) {
2379                 rc = sleep_thread(fsg);
2380                 if (rc)
2381                         return rc;
2382         }
2383         fsg->phase_error = 0;
2384         fsg->short_packet_received = 0;
2385
2386         down_read(&fsg->filesem);       // We're using the backing file
2387         switch (fsg->cmnd[0]) {
2388
2389         case SC_INQUIRY:
2390                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2391                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2392                                 (1<<4), 0,
2393                                 "INQUIRY")) == 0)
2394                         reply = do_inquiry(fsg, bh);
2395                 break;
2396
2397         case SC_MODE_SELECT_6:
2398                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2399                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2400                                 (1<<1) | (1<<4), 0,
2401                                 "MODE SELECT(6)")) == 0)
2402                         reply = do_mode_select(fsg, bh);
2403                 break;
2404
2405         case SC_MODE_SELECT_10:
2406                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2407                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2408                                 (1<<1) | (3<<7), 0,
2409                                 "MODE SELECT(10)")) == 0)
2410                         reply = do_mode_select(fsg, bh);
2411                 break;
2412
2413         case SC_MODE_SENSE_6:
2414                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2415                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2416                                 (1<<1) | (1<<2) | (1<<4), 0,
2417                                 "MODE SENSE(6)")) == 0)
2418                         reply = do_mode_sense(fsg, bh);
2419                 break;
2420
2421         case SC_MODE_SENSE_10:
2422                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2423                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2424                                 (1<<1) | (1<<2) | (3<<7), 0,
2425                                 "MODE SENSE(10)")) == 0)
2426                         reply = do_mode_sense(fsg, bh);
2427                 break;
2428
2429         case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
2430                 fsg->data_size_from_cmnd = 0;
2431                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2432                                 (1<<4), 0,
2433                                 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2434                         reply = do_prevent_allow(fsg);
2435                 break;
2436
2437         case SC_READ_6:
2438                 i = fsg->cmnd[4];
2439                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2440                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2441                                 (7<<1) | (1<<4), 1,
2442                                 "READ(6)")) == 0)
2443                         reply = do_read(fsg);
2444                 break;
2445
2446         case SC_READ_10:
2447                 fsg->data_size_from_cmnd =
2448                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2449                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2450                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2451                                 "READ(10)")) == 0)
2452                         reply = do_read(fsg);
2453                 break;
2454
2455         case SC_READ_12:
2456                 fsg->data_size_from_cmnd =
2457                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2458                 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
2459                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2460                                 "READ(12)")) == 0)
2461                         reply = do_read(fsg);
2462                 break;
2463
2464         case SC_READ_CAPACITY:
2465                 fsg->data_size_from_cmnd = 8;
2466                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2467                                 (0xf<<2) | (1<<8), 1,
2468                                 "READ CAPACITY")) == 0)
2469                         reply = do_read_capacity(fsg, bh);
2470                 break;
2471
2472         case SC_READ_HEADER:
2473                 if (!mod_data.cdrom)
2474                         goto unknown_cmnd;
2475                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2476                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2477                                 (3<<7) | (0x1f<<1), 1,
2478                                 "READ HEADER")) == 0)
2479                         reply = do_read_header(fsg, bh);
2480                 break;
2481
2482         case SC_READ_TOC:
2483                 if (!mod_data.cdrom)
2484                         goto unknown_cmnd;
2485                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2486                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2487                                 (7<<6) | (1<<1), 1,
2488                                 "READ TOC")) == 0)
2489                         reply = do_read_toc(fsg, bh);
2490                 break;
2491
2492         case SC_READ_FORMAT_CAPACITIES:
2493                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2494                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2495                                 (3<<7), 1,
2496                                 "READ FORMAT CAPACITIES")) == 0)
2497                         reply = do_read_format_capacities(fsg, bh);
2498                 break;
2499
2500         case SC_REQUEST_SENSE:
2501                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2502                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2503                                 (1<<4), 0,
2504                                 "REQUEST SENSE")) == 0)
2505                         reply = do_request_sense(fsg, bh);
2506                 break;
2507
2508         case SC_START_STOP_UNIT:
2509                 fsg->data_size_from_cmnd = 0;
2510                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2511                                 (1<<1) | (1<<4), 0,
2512                                 "START-STOP UNIT")) == 0)
2513                         reply = do_start_stop(fsg);
2514                 break;
2515
2516         case SC_SYNCHRONIZE_CACHE:
2517                 fsg->data_size_from_cmnd = 0;
2518                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2519                                 (0xf<<2) | (3<<7), 1,
2520                                 "SYNCHRONIZE CACHE")) == 0)
2521                         reply = do_synchronize_cache(fsg);
2522                 break;
2523
2524         case SC_TEST_UNIT_READY:
2525                 fsg->data_size_from_cmnd = 0;
2526                 reply = check_command(fsg, 6, DATA_DIR_NONE,
2527                                 0, 1,
2528                                 "TEST UNIT READY");
2529                 break;
2530
2531         /* Although optional, this command is used by MS-Windows.  We
2532          * support a minimal version: BytChk must be 0. */
2533         case SC_VERIFY:
2534                 fsg->data_size_from_cmnd = 0;
2535                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2536                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2537                                 "VERIFY")) == 0)
2538                         reply = do_verify(fsg);
2539                 break;
2540
2541         case SC_WRITE_6:
2542                 i = fsg->cmnd[4];
2543                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2544                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2545                                 (7<<1) | (1<<4), 1,
2546                                 "WRITE(6)")) == 0)
2547                         reply = do_write(fsg);
2548                 break;
2549
2550         case SC_WRITE_10:
2551                 fsg->data_size_from_cmnd =
2552                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2553                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2554                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2555                                 "WRITE(10)")) == 0)
2556                         reply = do_write(fsg);
2557                 break;
2558
2559         case SC_WRITE_12:
2560                 fsg->data_size_from_cmnd =
2561                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2562                 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
2563                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2564                                 "WRITE(12)")) == 0)
2565                         reply = do_write(fsg);
2566                 break;
2567
2568         /* Some mandatory commands that we recognize but don't implement.
2569          * They don't mean much in this setting.  It's left as an exercise
2570          * for anyone interested to implement RESERVE and RELEASE in terms
2571          * of Posix locks. */
2572         case SC_FORMAT_UNIT:
2573         case SC_RELEASE:
2574         case SC_RESERVE:
2575         case SC_SEND_DIAGNOSTIC:
2576                 // Fall through
2577
2578         default:
2579  unknown_cmnd:
2580                 fsg->data_size_from_cmnd = 0;
2581                 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
2582                 if ((reply = check_command(fsg, fsg->cmnd_size,
2583                                 DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
2584                         fsg->curlun->sense_data = SS_INVALID_COMMAND;
2585                         reply = -EINVAL;
2586                 }
2587                 break;
2588         }
2589         up_read(&fsg->filesem);
2590
2591         if (reply == -EINTR || signal_pending(current))
2592                 return -EINTR;
2593
2594         /* Set up the single reply buffer for finish_reply() */
2595         if (reply == -EINVAL)
2596                 reply = 0;              // Error reply length
2597         if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
2598                 reply = min((u32) reply, fsg->data_size_from_cmnd);
2599                 bh->inreq->length = reply;
2600                 bh->state = BUF_STATE_FULL;
2601                 fsg->residue -= reply;
2602         }                               // Otherwise it's already set
2603
2604         return 0;
2605 }
2606
2607
2608 /*-------------------------------------------------------------------------*/
2609
2610 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2611 {
2612         struct usb_request      *req = bh->outreq;
2613         struct bulk_cb_wrap     *cbw = req->buf;
2614
2615         /* Was this a real packet?  Should it be ignored? */
2616         if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2617                 return -EINVAL;
2618
2619         /* Is the CBW valid? */
2620         if (req->actual != USB_BULK_CB_WRAP_LEN ||
2621                         cbw->Signature != cpu_to_le32(
2622                                 USB_BULK_CB_SIG)) {
2623                 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2624                                 req->actual,
2625                                 le32_to_cpu(cbw->Signature));
2626
2627                 /* The Bulk-only spec says we MUST stall the IN endpoint
2628                  * (6.6.1), so it's unavoidable.  It also says we must
2629                  * retain this state until the next reset, but there's
2630                  * no way to tell the controller driver it should ignore
2631                  * Clear-Feature(HALT) requests.
2632                  *
2633                  * We aren't required to halt the OUT endpoint; instead
2634                  * we can simply accept and discard any data received
2635                  * until the next reset. */
2636                 wedge_bulk_in_endpoint(fsg);
2637                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2638                 return -EINVAL;
2639         }
2640
2641         /* Is the CBW meaningful? */
2642         if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2643                         cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
2644                 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2645                                 "cmdlen %u\n",
2646                                 cbw->Lun, cbw->Flags, cbw->Length);
2647
2648                 /* We can do anything we want here, so let's stall the
2649                  * bulk pipes if we are allowed to. */
2650                 if (mod_data.can_stall) {
2651                         fsg_set_halt(fsg, fsg->bulk_out);
2652                         halt_bulk_in_endpoint(fsg);
2653                 }
2654                 return -EINVAL;
2655         }
2656
2657         /* Save the command for later */
2658         fsg->cmnd_size = cbw->Length;
2659         memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
2660         if (cbw->Flags & USB_BULK_IN_FLAG)
2661                 fsg->data_dir = DATA_DIR_TO_HOST;
2662         else
2663                 fsg->data_dir = DATA_DIR_FROM_HOST;
2664         fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
2665         if (fsg->data_size == 0)
2666                 fsg->data_dir = DATA_DIR_NONE;
2667         fsg->lun = cbw->Lun;
2668         fsg->tag = cbw->Tag;
2669         return 0;
2670 }
2671
2672
2673 static int get_next_command(struct fsg_dev *fsg)
2674 {
2675         struct fsg_buffhd       *bh;
2676         int                     rc = 0;
2677
2678         if (transport_is_bbb()) {
2679
2680                 /* Wait for the next buffer to become available */
2681                 bh = fsg->next_buffhd_to_fill;
2682                 while (bh->state != BUF_STATE_EMPTY) {
2683                         rc = sleep_thread(fsg);
2684                         if (rc)
2685                                 return rc;
2686                 }
2687
2688                 /* Queue a request to read a Bulk-only CBW */
2689                 set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
2690                 bh->outreq->short_not_ok = 1;
2691                 start_transfer(fsg, fsg->bulk_out, bh->outreq,
2692                                 &bh->outreq_busy, &bh->state);
2693
2694                 /* We will drain the buffer in software, which means we
2695                  * can reuse it for the next filling.  No need to advance
2696                  * next_buffhd_to_fill. */
2697
2698                 /* Wait for the CBW to arrive */
2699                 while (bh->state != BUF_STATE_FULL) {
2700                         rc = sleep_thread(fsg);
2701                         if (rc)
2702                                 return rc;
2703                 }
2704                 smp_rmb();
2705                 rc = received_cbw(fsg, bh);
2706                 bh->state = BUF_STATE_EMPTY;
2707
2708         } else {                // USB_PR_CB or USB_PR_CBI
2709
2710                 /* Wait for the next command to arrive */
2711                 while (fsg->cbbuf_cmnd_size == 0) {
2712                         rc = sleep_thread(fsg);
2713                         if (rc)
2714                                 return rc;
2715                 }
2716
2717                 /* Is the previous status interrupt request still busy?
2718                  * The host is allowed to skip reading the status,
2719                  * so we must cancel it. */
2720                 if (fsg->intreq_busy)
2721                         usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2722
2723                 /* Copy the command and mark the buffer empty */
2724                 fsg->data_dir = DATA_DIR_UNKNOWN;
2725                 spin_lock_irq(&fsg->lock);
2726                 fsg->cmnd_size = fsg->cbbuf_cmnd_size;
2727                 memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
2728                 fsg->cbbuf_cmnd_size = 0;
2729                 spin_unlock_irq(&fsg->lock);
2730         }
2731         return rc;
2732 }
2733
2734
2735 /*-------------------------------------------------------------------------*/
2736
2737 static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
2738                 const struct usb_endpoint_descriptor *d)
2739 {
2740         int     rc;
2741
2742         ep->driver_data = fsg;
2743         rc = usb_ep_enable(ep, d);
2744         if (rc)
2745                 ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
2746         return rc;
2747 }
2748
2749 static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
2750                 struct usb_request **preq)
2751 {
2752         *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2753         if (*preq)
2754                 return 0;
2755         ERROR(fsg, "can't allocate request for %s\n", ep->name);
2756         return -ENOMEM;
2757 }
2758
2759 /*
2760  * Reset interface setting and re-init endpoint state (toggle etc).
2761  * Call with altsetting < 0 to disable the interface.  The only other
2762  * available altsetting is 0, which enables the interface.
2763  */
2764 static int do_set_interface(struct fsg_dev *fsg, int altsetting)
2765 {
2766         int     rc = 0;
2767         int     i;
2768         const struct usb_endpoint_descriptor    *d;
2769
2770         if (fsg->running)
2771                 DBG(fsg, "reset interface\n");
2772
2773 reset:
2774         /* Deallocate the requests */
2775         for (i = 0; i < NUM_BUFFERS; ++i) {
2776                 struct fsg_buffhd *bh = &fsg->buffhds[i];
2777
2778                 if (bh->inreq) {
2779                         usb_ep_free_request(fsg->bulk_in, bh->inreq);
2780                         bh->inreq = NULL;
2781                 }
2782                 if (bh->outreq) {
2783                         usb_ep_free_request(fsg->bulk_out, bh->outreq);
2784                         bh->outreq = NULL;
2785                 }
2786         }
2787         if (fsg->intreq) {
2788                 usb_ep_free_request(fsg->intr_in, fsg->intreq);
2789                 fsg->intreq = NULL;
2790         }
2791
2792         /* Disable the endpoints */
2793         if (fsg->bulk_in_enabled) {
2794                 usb_ep_disable(fsg->bulk_in);
2795                 fsg->bulk_in_enabled = 0;
2796         }
2797         if (fsg->bulk_out_enabled) {
2798                 usb_ep_disable(fsg->bulk_out);
2799                 fsg->bulk_out_enabled = 0;
2800         }
2801         if (fsg->intr_in_enabled) {
2802                 usb_ep_disable(fsg->intr_in);
2803                 fsg->intr_in_enabled = 0;
2804         }
2805
2806         fsg->running = 0;
2807         if (altsetting < 0 || rc != 0)
2808                 return rc;
2809
2810         DBG(fsg, "set interface %d\n", altsetting);
2811
2812         /* Enable the endpoints */
2813         d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
2814         if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
2815                 goto reset;
2816         fsg->bulk_in_enabled = 1;
2817
2818         d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
2819         if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
2820                 goto reset;
2821         fsg->bulk_out_enabled = 1;
2822         fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
2823         clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2824
2825         if (transport_is_cbi()) {
2826                 d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
2827                 if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
2828                         goto reset;
2829                 fsg->intr_in_enabled = 1;
2830         }
2831
2832         /* Allocate the requests */
2833         for (i = 0; i < NUM_BUFFERS; ++i) {
2834                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
2835
2836                 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
2837                         goto reset;
2838                 if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
2839                         goto reset;
2840                 bh->inreq->buf = bh->outreq->buf = bh->buf;
2841                 bh->inreq->context = bh->outreq->context = bh;
2842                 bh->inreq->complete = bulk_in_complete;
2843                 bh->outreq->complete = bulk_out_complete;
2844         }
2845         if (transport_is_cbi()) {
2846                 if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
2847                         goto reset;
2848                 fsg->intreq->complete = intr_in_complete;
2849         }
2850
2851         fsg->running = 1;
2852         for (i = 0; i < fsg->nluns; ++i)
2853                 fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
2854         return rc;
2855 }
2856
2857
2858 /*
2859  * Change our operational configuration.  This code must agree with the code
2860  * that returns config descriptors, and with interface altsetting code.
2861  *
2862  * It's also responsible for power management interactions.  Some
2863  * configurations might not work with our current power sources.
2864  * For now we just assume the gadget is always self-powered.
2865  */
2866 static int do_set_config(struct fsg_dev *fsg, u8 new_config)
2867 {
2868         int     rc = 0;
2869
2870         /* Disable the single interface */
2871         if (fsg->config != 0) {
2872                 DBG(fsg, "reset config\n");
2873                 fsg->config = 0;
2874                 rc = do_set_interface(fsg, -1);
2875         }
2876
2877         /* Enable the interface */
2878         if (new_config != 0) {
2879                 fsg->config = new_config;
2880                 if ((rc = do_set_interface(fsg, 0)) != 0)
2881                         fsg->config = 0;        // Reset on errors
2882                 else {
2883                         char *speed;
2884
2885                         switch (fsg->gadget->speed) {
2886                         case USB_SPEED_LOW:     speed = "low";  break;
2887                         case USB_SPEED_FULL:    speed = "full"; break;
2888                         case USB_SPEED_HIGH:    speed = "high"; break;
2889                         default:                speed = "?";    break;
2890                         }
2891                         INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
2892                 }
2893         }
2894         return rc;
2895 }
2896
2897
2898 /*-------------------------------------------------------------------------*/
2899
2900 static void handle_exception(struct fsg_dev *fsg)
2901 {
2902         siginfo_t               info;
2903         int                     sig;
2904         int                     i;
2905         int                     num_active;
2906         struct fsg_buffhd       *bh;
2907         enum fsg_state          old_state;
2908         u8                      new_config;
2909         struct lun              *curlun;
2910         unsigned int            exception_req_tag;
2911         int                     rc;
2912
2913         /* Clear the existing signals.  Anything but SIGUSR1 is converted
2914          * into a high-priority EXIT exception. */
2915         for (;;) {
2916                 sig = dequeue_signal_lock(current, &current->blocked, &info);
2917                 if (!sig)
2918                         break;
2919                 if (sig != SIGUSR1) {
2920                         if (fsg->state < FSG_STATE_EXIT)
2921                                 DBG(fsg, "Main thread exiting on signal\n");
2922                         raise_exception(fsg, FSG_STATE_EXIT);
2923                 }
2924         }
2925
2926         /* Cancel all the pending transfers */
2927         if (fsg->intreq_busy)
2928                 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2929         for (i = 0; i < NUM_BUFFERS; ++i) {
2930                 bh = &fsg->buffhds[i];
2931                 if (bh->inreq_busy)
2932                         usb_ep_dequeue(fsg->bulk_in, bh->inreq);
2933                 if (bh->outreq_busy)
2934                         usb_ep_dequeue(fsg->bulk_out, bh->outreq);
2935         }
2936
2937         /* Wait until everything is idle */
2938         for (;;) {
2939                 num_active = fsg->intreq_busy;
2940                 for (i = 0; i < NUM_BUFFERS; ++i) {
2941                         bh = &fsg->buffhds[i];
2942                         num_active += bh->inreq_busy + bh->outreq_busy;
2943                 }
2944                 if (num_active == 0)
2945                         break;
2946                 if (sleep_thread(fsg))
2947                         return;
2948         }
2949
2950         /* Clear out the controller's fifos */
2951         if (fsg->bulk_in_enabled)
2952                 usb_ep_fifo_flush(fsg->bulk_in);
2953         if (fsg->bulk_out_enabled)
2954                 usb_ep_fifo_flush(fsg->bulk_out);
2955         if (fsg->intr_in_enabled)
2956                 usb_ep_fifo_flush(fsg->intr_in);
2957
2958         /* Reset the I/O buffer states and pointers, the SCSI
2959          * state, and the exception.  Then invoke the handler. */
2960         spin_lock_irq(&fsg->lock);
2961
2962         for (i = 0; i < NUM_BUFFERS; ++i) {
2963                 bh = &fsg->buffhds[i];
2964                 bh->state = BUF_STATE_EMPTY;
2965         }
2966         fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
2967                         &fsg->buffhds[0];
2968
2969         exception_req_tag = fsg->exception_req_tag;
2970         new_config = fsg->new_config;
2971         old_state = fsg->state;
2972
2973         if (old_state == FSG_STATE_ABORT_BULK_OUT)
2974                 fsg->state = FSG_STATE_STATUS_PHASE;
2975         else {
2976                 for (i = 0; i < fsg->nluns; ++i) {
2977                         curlun = &fsg->luns[i];
2978                         curlun->prevent_medium_removal = 0;
2979                         curlun->sense_data = curlun->unit_attention_data =
2980                                         SS_NO_SENSE;
2981                         curlun->sense_data_info = 0;
2982                         curlun->info_valid = 0;
2983                 }
2984                 fsg->state = FSG_STATE_IDLE;
2985         }
2986         spin_unlock_irq(&fsg->lock);
2987
2988         /* Carry out any extra actions required for the exception */
2989         switch (old_state) {
2990         default:
2991                 break;
2992
2993         case FSG_STATE_ABORT_BULK_OUT:
2994                 send_status(fsg);
2995                 spin_lock_irq(&fsg->lock);
2996                 if (fsg->state == FSG_STATE_STATUS_PHASE)
2997                         fsg->state = FSG_STATE_IDLE;
2998                 spin_unlock_irq(&fsg->lock);
2999                 break;
3000
3001         case FSG_STATE_RESET:
3002                 /* In case we were forced against our will to halt a
3003                  * bulk endpoint, clear the halt now.  (The SuperH UDC
3004                  * requires this.) */
3005                 if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
3006                         usb_ep_clear_halt(fsg->bulk_in);
3007
3008                 if (transport_is_bbb()) {
3009                         if (fsg->ep0_req_tag == exception_req_tag)
3010                                 ep0_queue(fsg); // Complete the status stage
3011
3012                 } else&