USB: g_file_storage: parts of file_storage.c moved to separate file
[linux-2.6.git] / drivers / usb / gadget / file_storage.c
1 /*
2  * file_storage.c -- File-backed USB Storage Gadget, for USB development
3  *
4  * Copyright (C) 2003-2008 Alan Stern
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions, and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The names of the above-listed copyright holders may not be used
17  *    to endorse or promote products derived from this software without
18  *    specific prior written permission.
19  *
20  * ALTERNATIVELY, this software may be distributed under the terms of the
21  * GNU General Public License ("GPL") as published by the Free Software
22  * Foundation, either version 2 of that License or (at your option) any
23  * later version.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
26  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
27  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
30  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
31  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
32  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
34  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
35  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37
38
39 /*
40  * The File-backed Storage Gadget acts as a USB Mass Storage device,
41  * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
42  * to providing an example of a genuinely useful gadget driver for a USB
43  * device, it also illustrates a technique of double-buffering for increased
44  * throughput.  Last but not least, it gives an easy way to probe the
45  * behavior of the Mass Storage drivers in a USB host.
46  *
47  * Backing storage is provided by a regular file or a block device, specified
48  * by the "file" module parameter.  Access can be limited to read-only by
49  * setting the optional "ro" module parameter.  (For CD-ROM emulation,
50  * access is always read-only.)  The gadget will indicate that it has
51  * removable media if the optional "removable" module parameter is set.
52  *
53  * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
54  * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
55  * by the optional "transport" module parameter.  It also supports the
56  * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
57  * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
58  * the optional "protocol" module parameter.  In addition, the default
59  * Vendor ID, Product ID, and release number can be overridden.
60  *
61  * There is support for multiple logical units (LUNs), each of which has
62  * its own backing file.  The number of LUNs can be set using the optional
63  * "luns" module parameter (anywhere from 1 to 8), and the corresponding
64  * files are specified using comma-separated lists for "file" and "ro".
65  * The default number of LUNs is taken from the number of "file" elements;
66  * it is 1 if "file" is not given.  If "removable" is not set then a backing
67  * file must be specified for each LUN.  If it is set, then an unspecified
68  * or empty backing filename means the LUN's medium is not loaded.  Ideally
69  * each LUN would be settable independently as a disk drive or a CD-ROM
70  * drive, but currently all LUNs have to be the same type.  The CD-ROM
71  * emulation includes a single data track and no audio tracks; hence there
72  * need be only one backing file per LUN.  Note also that the CD-ROM block
73  * length is set to 512 rather than the more common value 2048.
74  *
75  * Requirements are modest; only a bulk-in and a bulk-out endpoint are
76  * needed (an interrupt-out endpoint is also needed for CBI).  The memory
77  * requirement amounts to two 16K buffers, size configurable by a parameter.
78  * Support is included for both full-speed and high-speed operation.
79  *
80  * Note that the driver is slightly non-portable in that it assumes a
81  * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
82  * interrupt-in endpoints.  With most device controllers this isn't an
83  * issue, but there may be some with hardware restrictions that prevent
84  * a buffer from being used by more than one endpoint.
85  *
86  * Module options:
87  *
88  *      file=filename[,filename...]
89  *                              Required if "removable" is not set, names of
90  *                                      the files or block devices used for
91  *                                      backing storage
92  *      ro=b[,b...]             Default false, booleans for read-only access
93  *      removable               Default false, boolean for removable media
94  *      luns=N                  Default N = number of filenames, number of
95  *                                      LUNs to support
96  *      stall                   Default determined according to the type of
97  *                                      USB device controller (usually true),
98  *                                      boolean to permit the driver to halt
99  *                                      bulk endpoints
100  *      cdrom                   Default false, boolean for whether to emulate
101  *                                      a CD-ROM drive
102  *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
103  *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
104  *                                      ATAPI, QIC, UFI, 8070, or SCSI;
105  *                                      also 1 - 6)
106  *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
107  *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
108  *      release=0xRRRR          Override the USB release number (bcdDevice)
109  *      buflen=N                Default N=16384, buffer size used (will be
110  *                                      rounded down to a multiple of
111  *                                      PAGE_CACHE_SIZE)
112  *
113  * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
114  * "removable", "luns", "stall", and "cdrom" options are available; default
115  * values are used for everything else.
116  *
117  * The pathnames of the backing files and the ro settings are available in
118  * the attribute files "file" and "ro" in the lun<n> subdirectory of the
119  * gadget's sysfs directory.  If the "removable" option is set, writing to
120  * these files will simulate ejecting/loading the medium (writing an empty
121  * line means eject) and adjusting a write-enable tab.  Changes to the ro
122  * setting are not allowed when the medium is loaded or if CD-ROM emulation
123  * is being used.
124  *
125  * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
126  * The driver's SCSI command interface was based on the "Information
127  * technology - Small Computer System Interface - 2" document from
128  * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
129  * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
130  * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
131  * "Universal Serial Bus Mass Storage Class UFI Command Specification"
132  * document, Revision 1.0, December 14, 1998, available at
133  * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
134  */
135
136
137 /*
138  *                              Driver Design
139  *
140  * The FSG driver is fairly straightforward.  There is a main kernel
141  * thread that handles most of the work.  Interrupt routines field
142  * callbacks from the controller driver: bulk- and interrupt-request
143  * completion notifications, endpoint-0 events, and disconnect events.
144  * Completion events are passed to the main thread by wakeup calls.  Many
145  * ep0 requests are handled at interrupt time, but SetInterface,
146  * SetConfiguration, and device reset requests are forwarded to the
147  * thread in the form of "exceptions" using SIGUSR1 signals (since they
148  * should interrupt any ongoing file I/O operations).
149  *
150  * The thread's main routine implements the standard command/data/status
151  * parts of a SCSI interaction.  It and its subroutines are full of tests
152  * for pending signals/exceptions -- all this polling is necessary since
153  * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
154  * indication that the driver really wants to be running in userspace.)
155  * An important point is that so long as the thread is alive it keeps an
156  * open reference to the backing file.  This will prevent unmounting
157  * the backing file's underlying filesystem and could cause problems
158  * during system shutdown, for example.  To prevent such problems, the
159  * thread catches INT, TERM, and KILL signals and converts them into
160  * an EXIT exception.
161  *
162  * In normal operation the main thread is started during the gadget's
163  * fsg_bind() callback and stopped during fsg_unbind().  But it can also
164  * exit when it receives a signal, and there's no point leaving the
165  * gadget running when the thread is dead.  So just before the thread
166  * exits, it deregisters the gadget driver.  This makes things a little
167  * tricky: The driver is deregistered at two places, and the exiting
168  * thread can indirectly call fsg_unbind() which in turn can tell the
169  * thread to exit.  The first problem is resolved through the use of the
170  * REGISTERED atomic bitflag; the driver will only be deregistered once.
171  * The second problem is resolved by having fsg_unbind() check
172  * fsg->state; it won't try to stop the thread if the state is already
173  * FSG_STATE_TERMINATED.
174  *
175  * To provide maximum throughput, the driver uses a circular pipeline of
176  * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
177  * arbitrarily long; in practice the benefits don't justify having more
178  * than 2 stages (i.e., double buffering).  But it helps to think of the
179  * pipeline as being a long one.  Each buffer head contains a bulk-in and
180  * a bulk-out request pointer (since the buffer can be used for both
181  * output and input -- directions always are given from the host's
182  * point of view) as well as a pointer to the buffer and various state
183  * variables.
184  *
185  * Use of the pipeline follows a simple protocol.  There is a variable
186  * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
187  * At any time that buffer head may still be in use from an earlier
188  * request, so each buffer head has a state variable indicating whether
189  * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
190  * buffer head to be EMPTY, filling the buffer either by file I/O or by
191  * USB I/O (during which the buffer head is BUSY), and marking the buffer
192  * head FULL when the I/O is complete.  Then the buffer will be emptied
193  * (again possibly by USB I/O, during which it is marked BUSY) and
194  * finally marked EMPTY again (possibly by a completion routine).
195  *
196  * A module parameter tells the driver to avoid stalling the bulk
197  * endpoints wherever the transport specification allows.  This is
198  * necessary for some UDCs like the SuperH, which cannot reliably clear a
199  * halt on a bulk endpoint.  However, under certain circumstances the
200  * Bulk-only specification requires a stall.  In such cases the driver
201  * will halt the endpoint and set a flag indicating that it should clear
202  * the halt in software during the next device reset.  Hopefully this
203  * will permit everything to work correctly.  Furthermore, although the
204  * specification allows the bulk-out endpoint to halt when the host sends
205  * too much data, implementing this would cause an unavoidable race.
206  * The driver will always use the "no-stall" approach for OUT transfers.
207  *
208  * One subtle point concerns sending status-stage responses for ep0
209  * requests.  Some of these requests, such as device reset, can involve
210  * interrupting an ongoing file I/O operation, which might take an
211  * arbitrarily long time.  During that delay the host might give up on
212  * the original ep0 request and issue a new one.  When that happens the
213  * driver should not notify the host about completion of the original
214  * request, as the host will no longer be waiting for it.  So the driver
215  * assigns to each ep0 request a unique tag, and it keeps track of the
216  * tag value of the request associated with a long-running exception
217  * (device-reset, interface-change, or configuration-change).  When the
218  * exception handler is finished, the status-stage response is submitted
219  * only if the current ep0 request tag is equal to the exception request
220  * tag.  Thus only the most recently received ep0 request will get a
221  * status-stage response.
222  *
223  * Warning: This driver source file is too long.  It ought to be split up
224  * into a header file plus about 3 separate .c files, to handle the details
225  * of the Gadget, USB Mass Storage, and SCSI protocols.
226  */
227
228
229 /* #define VERBOSE_DEBUG */
230 /* #define DUMP_MSGS */
231
232
233 #include <linux/blkdev.h>
234 #include <linux/completion.h>
235 #include <linux/dcache.h>
236 #include <linux/delay.h>
237 #include <linux/device.h>
238 #include <linux/fcntl.h>
239 #include <linux/file.h>
240 #include <linux/fs.h>
241 #include <linux/kref.h>
242 #include <linux/kthread.h>
243 #include <linux/limits.h>
244 #include <linux/rwsem.h>
245 #include <linux/slab.h>
246 #include <linux/spinlock.h>
247 #include <linux/string.h>
248 #include <linux/freezer.h>
249 #include <linux/utsname.h>
250
251 #include <asm/unaligned.h>
252
253 #include <linux/usb/ch9.h>
254 #include <linux/usb/gadget.h>
255
256 #include "gadget_chips.h"
257
258
259
260 /*
261  * Kbuild is not very cooperative with respect to linking separately
262  * compiled library objects into one module.  So for now we won't use
263  * separate compilation ... ensuring init/exit sections work to shrink
264  * the runtime footprint, and giving us at least some parts of what
265  * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
266  */
267 #include "usbstring.c"
268 #include "config.c"
269 #include "epautoconf.c"
270
271 /*-------------------------------------------------------------------------*/
272
273 #define DRIVER_DESC             "File-backed Storage Gadget"
274 #define DRIVER_NAME             "g_file_storage"
275 #define DRIVER_VERSION          "20 November 2008"
276
277 static const char longname[] = DRIVER_DESC;
278 static const char shortname[] = DRIVER_NAME;
279
280 MODULE_DESCRIPTION(DRIVER_DESC);
281 MODULE_AUTHOR("Alan Stern");
282 MODULE_LICENSE("Dual BSD/GPL");
283
284 /* Thanks to NetChip Technologies for donating this product ID.
285  *
286  * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
287  * Instead:  allocate your own, using normal USB-IF procedures. */
288 #define DRIVER_VENDOR_ID        0x0525  // NetChip
289 #define DRIVER_PRODUCT_ID       0xa4a5  // Linux-USB File-backed Storage Gadget
290
291
292 /*
293  * This driver assumes self-powered hardware and has no way for users to
294  * trigger remote wakeup.  It uses autoconfiguration to select endpoints
295  * and endpoint addresses.
296  */
297
298
299 /*-------------------------------------------------------------------------*/
300
301
302 /* Encapsulate the module parameter settings */
303
304 #define MAX_LUNS        8
305
306 static struct {
307         char            *file[MAX_LUNS];
308         int             ro[MAX_LUNS];
309         unsigned int    num_filenames;
310         unsigned int    num_ros;
311         unsigned int    nluns;
312
313         int             removable;
314         int             can_stall;
315         int             cdrom;
316
317         char            *transport_parm;
318         char            *protocol_parm;
319         unsigned short  vendor;
320         unsigned short  product;
321         unsigned short  release;
322         unsigned int    buflen;
323
324         int             transport_type;
325         char            *transport_name;
326         int             protocol_type;
327         char            *protocol_name;
328
329 } mod_data = {                                  // Default values
330         .transport_parm         = "BBB",
331         .protocol_parm          = "SCSI",
332         .removable              = 0,
333         .can_stall              = 1,
334         .cdrom                  = 0,
335         .vendor                 = DRIVER_VENDOR_ID,
336         .product                = DRIVER_PRODUCT_ID,
337         .release                = 0xffff,       // Use controller chip type
338         .buflen                 = 16384,
339         };
340
341
342 module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
343                 S_IRUGO);
344 MODULE_PARM_DESC(file, "names of backing files or devices");
345
346 module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
347 MODULE_PARM_DESC(ro, "true to force read-only");
348
349 module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
350 MODULE_PARM_DESC(luns, "number of LUNs");
351
352 module_param_named(removable, mod_data.removable, bool, S_IRUGO);
353 MODULE_PARM_DESC(removable, "true to simulate removable media");
354
355 module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
356 MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
357
358 module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
359 MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
360
361
362 /* In the non-TEST version, only the module parameters listed above
363  * are available. */
364 #ifdef CONFIG_USB_FILE_STORAGE_TEST
365
366 module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
367 MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
368
369 module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
370 MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
371                 "8070, or SCSI)");
372
373 module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
374 MODULE_PARM_DESC(vendor, "USB Vendor ID");
375
376 module_param_named(product, mod_data.product, ushort, S_IRUGO);
377 MODULE_PARM_DESC(product, "USB Product ID");
378
379 module_param_named(release, mod_data.release, ushort, S_IRUGO);
380 MODULE_PARM_DESC(release, "USB release number");
381
382 module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
383 MODULE_PARM_DESC(buflen, "I/O buffer size");
384
385 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
386
387
388 /*
389  * These definitions will permit the compiler to avoid generating code for
390  * parts of the driver that aren't used in the non-TEST version.  Even gcc
391  * can recognize when a test of a constant expression yields a dead code
392  * path.
393  */
394
395 #ifdef CONFIG_USB_FILE_STORAGE_TEST
396
397 #define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
398 #define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
399 #define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
400
401 #else
402
403 #define transport_is_bbb()      1
404 #define transport_is_cbi()      0
405 #define protocol_is_scsi()      1
406
407 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
408
409
410 /*-------------------------------------------------------------------------*/
411
412 #include "storage_common.c"
413
414 /*-------------------------------------------------------------------------*/
415
416
417 struct fsg_dev {
418         /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
419         spinlock_t              lock;
420         struct usb_gadget       *gadget;
421
422         /* filesem protects: backing files in use */
423         struct rw_semaphore     filesem;
424
425         /* reference counting: wait until all LUNs are released */
426         struct kref             ref;
427
428         struct usb_ep           *ep0;           // Handy copy of gadget->ep0
429         struct usb_request      *ep0req;        // For control responses
430         unsigned int            ep0_req_tag;
431         const char              *ep0req_name;
432
433         struct usb_request      *intreq;        // For interrupt responses
434         int                     intreq_busy;
435         struct fsg_buffhd       *intr_buffhd;
436
437         unsigned int            bulk_out_maxpacket;
438         enum fsg_state          state;          // For exception handling
439         unsigned int            exception_req_tag;
440
441         u8                      config, new_config;
442
443         unsigned int            running : 1;
444         unsigned int            bulk_in_enabled : 1;
445         unsigned int            bulk_out_enabled : 1;
446         unsigned int            intr_in_enabled : 1;
447         unsigned int            phase_error : 1;
448         unsigned int            short_packet_received : 1;
449         unsigned int            bad_lun_okay : 1;
450
451         unsigned long           atomic_bitflags;
452 #define REGISTERED              0
453 #define IGNORE_BULK_OUT         1
454 #define SUSPENDED               2
455
456         struct usb_ep           *bulk_in;
457         struct usb_ep           *bulk_out;
458         struct usb_ep           *intr_in;
459
460         struct fsg_buffhd       *next_buffhd_to_fill;
461         struct fsg_buffhd       *next_buffhd_to_drain;
462         struct fsg_buffhd       buffhds[NUM_BUFFERS];
463
464         int                     thread_wakeup_needed;
465         struct completion       thread_notifier;
466         struct task_struct      *thread_task;
467
468         int                     cmnd_size;
469         u8                      cmnd[MAX_COMMAND_SIZE];
470         enum data_direction     data_dir;
471         u32                     data_size;
472         u32                     data_size_from_cmnd;
473         u32                     tag;
474         unsigned int            lun;
475         u32                     residue;
476         u32                     usb_amount_left;
477
478         /* The CB protocol offers no way for a host to know when a command
479          * has completed.  As a result the next command may arrive early,
480          * and we will still have to handle it.  For that reason we need
481          * a buffer to store new commands when using CB (or CBI, which
482          * does not oblige a host to wait for command completion either). */
483         int                     cbbuf_cmnd_size;
484         u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
485
486         unsigned int            nluns;
487         struct lun              *luns;
488         struct lun              *curlun;
489 };
490
491 typedef void (*fsg_routine_t)(struct fsg_dev *);
492
493 static int exception_in_progress(struct fsg_dev *fsg)
494 {
495         return (fsg->state > FSG_STATE_IDLE);
496 }
497
498 /* Make bulk-out requests be divisible by the maxpacket size */
499 static void set_bulk_out_req_length(struct fsg_dev *fsg,
500                 struct fsg_buffhd *bh, unsigned int length)
501 {
502         unsigned int    rem;
503
504         bh->bulk_out_intended_length = length;
505         rem = length % fsg->bulk_out_maxpacket;
506         if (rem > 0)
507                 length += fsg->bulk_out_maxpacket - rem;
508         bh->outreq->length = length;
509 }
510
511 static struct fsg_dev                   *the_fsg;
512 static struct usb_gadget_driver         fsg_driver;
513
514
515 /*-------------------------------------------------------------------------*/
516
517 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
518 {
519         const char      *name;
520
521         if (ep == fsg->bulk_in)
522                 name = "bulk-in";
523         else if (ep == fsg->bulk_out)
524                 name = "bulk-out";
525         else
526                 name = ep->name;
527         DBG(fsg, "%s set halt\n", name);
528         return usb_ep_set_halt(ep);
529 }
530
531
532 /*-------------------------------------------------------------------------*/
533
534 /*
535  * DESCRIPTORS ... most are static, but strings and (full) configuration
536  * descriptors are built on demand.  Also the (static) config and interface
537  * descriptors are adjusted during fsg_bind().
538  */
539
540 /* There is only one configuration. */
541 #define CONFIG_VALUE            1
542
543 static struct usb_device_descriptor
544 device_desc = {
545         .bLength =              sizeof device_desc,
546         .bDescriptorType =      USB_DT_DEVICE,
547
548         .bcdUSB =               cpu_to_le16(0x0200),
549         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
550
551         /* The next three values can be overridden by module parameters */
552         .idVendor =             cpu_to_le16(DRIVER_VENDOR_ID),
553         .idProduct =            cpu_to_le16(DRIVER_PRODUCT_ID),
554         .bcdDevice =            cpu_to_le16(0xffff),
555
556         .iManufacturer =        STRING_MANUFACTURER,
557         .iProduct =             STRING_PRODUCT,
558         .iSerialNumber =        STRING_SERIAL,
559         .bNumConfigurations =   1,
560 };
561
562 static struct usb_config_descriptor
563 config_desc = {
564         .bLength =              sizeof config_desc,
565         .bDescriptorType =      USB_DT_CONFIG,
566
567         /* wTotalLength computed by usb_gadget_config_buf() */
568         .bNumInterfaces =       1,
569         .bConfigurationValue =  CONFIG_VALUE,
570         .iConfiguration =       STRING_CONFIG,
571         .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
572         .bMaxPower =            CONFIG_USB_GADGET_VBUS_DRAW / 2,
573 };
574
575
576 static struct usb_qualifier_descriptor
577 dev_qualifier = {
578         .bLength =              sizeof dev_qualifier,
579         .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
580
581         .bcdUSB =               cpu_to_le16(0x0200),
582         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
583
584         .bNumConfigurations =   1,
585 };
586
587
588
589 /*
590  * Config descriptors must agree with the code that sets configurations
591  * and with code managing interfaces and their altsettings.  They must
592  * also handle different speeds and other-speed requests.
593  */
594 static int populate_config_buf(struct usb_gadget *gadget,
595                 u8 *buf, u8 type, unsigned index)
596 {
597         enum usb_device_speed                   speed = gadget->speed;
598         int                                     len;
599         const struct usb_descriptor_header      **function;
600
601         if (index > 0)
602                 return -EINVAL;
603
604         if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
605                 speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
606         if (gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH)
607                 function = hs_function;
608         else
609                 function = fs_function;
610
611         /* for now, don't advertise srp-only devices */
612         if (!gadget_is_otg(gadget))
613                 function++;
614
615         len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
616         ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
617         return len;
618 }
619
620
621 /*-------------------------------------------------------------------------*/
622
623 /* These routines may be called in process context or in_irq */
624
625 /* Caller must hold fsg->lock */
626 static void wakeup_thread(struct fsg_dev *fsg)
627 {
628         /* Tell the main thread that something has happened */
629         fsg->thread_wakeup_needed = 1;
630         if (fsg->thread_task)
631                 wake_up_process(fsg->thread_task);
632 }
633
634
635 static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
636 {
637         unsigned long           flags;
638
639         /* Do nothing if a higher-priority exception is already in progress.
640          * If a lower-or-equal priority exception is in progress, preempt it
641          * and notify the main thread by sending it a signal. */
642         spin_lock_irqsave(&fsg->lock, flags);
643         if (fsg->state <= new_state) {
644                 fsg->exception_req_tag = fsg->ep0_req_tag;
645                 fsg->state = new_state;
646                 if (fsg->thread_task)
647                         send_sig_info(SIGUSR1, SEND_SIG_FORCED,
648                                         fsg->thread_task);
649         }
650         spin_unlock_irqrestore(&fsg->lock, flags);
651 }
652
653
654 /*-------------------------------------------------------------------------*/
655
656 /* The disconnect callback and ep0 routines.  These always run in_irq,
657  * except that ep0_queue() is called in the main thread to acknowledge
658  * completion of various requests: set config, set interface, and
659  * Bulk-only device reset. */
660
661 static void fsg_disconnect(struct usb_gadget *gadget)
662 {
663         struct fsg_dev          *fsg = get_gadget_data(gadget);
664
665         DBG(fsg, "disconnect or port reset\n");
666         raise_exception(fsg, FSG_STATE_DISCONNECT);
667 }
668
669
670 static int ep0_queue(struct fsg_dev *fsg)
671 {
672         int     rc;
673
674         rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
675         if (rc != 0 && rc != -ESHUTDOWN) {
676
677                 /* We can't do much more than wait for a reset */
678                 WARNING(fsg, "error in submission: %s --> %d\n",
679                                 fsg->ep0->name, rc);
680         }
681         return rc;
682 }
683
684 static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
685 {
686         struct fsg_dev          *fsg = ep->driver_data;
687
688         if (req->actual > 0)
689                 dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
690         if (req->status || req->actual != req->length)
691                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
692                                 req->status, req->actual, req->length);
693         if (req->status == -ECONNRESET)         // Request was cancelled
694                 usb_ep_fifo_flush(ep);
695
696         if (req->status == 0 && req->context)
697                 ((fsg_routine_t) (req->context))(fsg);
698 }
699
700
701 /*-------------------------------------------------------------------------*/
702
703 /* Bulk and interrupt endpoint completion handlers.
704  * These always run in_irq. */
705
706 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
707 {
708         struct fsg_dev          *fsg = ep->driver_data;
709         struct fsg_buffhd       *bh = req->context;
710
711         if (req->status || req->actual != req->length)
712                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
713                                 req->status, req->actual, req->length);
714         if (req->status == -ECONNRESET)         // Request was cancelled
715                 usb_ep_fifo_flush(ep);
716
717         /* Hold the lock while we update the request and buffer states */
718         smp_wmb();
719         spin_lock(&fsg->lock);
720         bh->inreq_busy = 0;
721         bh->state = BUF_STATE_EMPTY;
722         wakeup_thread(fsg);
723         spin_unlock(&fsg->lock);
724 }
725
726 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
727 {
728         struct fsg_dev          *fsg = ep->driver_data;
729         struct fsg_buffhd       *bh = req->context;
730
731         dump_msg(fsg, "bulk-out", req->buf, req->actual);
732         if (req->status || req->actual != bh->bulk_out_intended_length)
733                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
734                                 req->status, req->actual,
735                                 bh->bulk_out_intended_length);
736         if (req->status == -ECONNRESET)         // Request was cancelled
737                 usb_ep_fifo_flush(ep);
738
739         /* Hold the lock while we update the request and buffer states */
740         smp_wmb();
741         spin_lock(&fsg->lock);
742         bh->outreq_busy = 0;
743         bh->state = BUF_STATE_FULL;
744         wakeup_thread(fsg);
745         spin_unlock(&fsg->lock);
746 }
747
748
749 #ifdef CONFIG_USB_FILE_STORAGE_TEST
750 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
751 {
752         struct fsg_dev          *fsg = ep->driver_data;
753         struct fsg_buffhd       *bh = req->context;
754
755         if (req->status || req->actual != req->length)
756                 DBG(fsg, "%s --> %d, %u/%u\n", __func__,
757                                 req->status, req->actual, req->length);
758         if (req->status == -ECONNRESET)         // Request was cancelled
759                 usb_ep_fifo_flush(ep);
760
761         /* Hold the lock while we update the request and buffer states */
762         smp_wmb();
763         spin_lock(&fsg->lock);
764         fsg->intreq_busy = 0;
765         bh->state = BUF_STATE_EMPTY;
766         wakeup_thread(fsg);
767         spin_unlock(&fsg->lock);
768 }
769
770 #else
771 static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
772 {}
773 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
774
775
776 /*-------------------------------------------------------------------------*/
777
778 /* Ep0 class-specific handlers.  These always run in_irq. */
779
780 #ifdef CONFIG_USB_FILE_STORAGE_TEST
781 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
782 {
783         struct usb_request      *req = fsg->ep0req;
784         static u8               cbi_reset_cmnd[6] = {
785                         SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
786
787         /* Error in command transfer? */
788         if (req->status || req->length != req->actual ||
789                         req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
790
791                 /* Not all controllers allow a protocol stall after
792                  * receiving control-out data, but we'll try anyway. */
793                 fsg_set_halt(fsg, fsg->ep0);
794                 return;                 // Wait for reset
795         }
796
797         /* Is it the special reset command? */
798         if (req->actual >= sizeof cbi_reset_cmnd &&
799                         memcmp(req->buf, cbi_reset_cmnd,
800                                 sizeof cbi_reset_cmnd) == 0) {
801
802                 /* Raise an exception to stop the current operation
803                  * and reinitialize our state. */
804                 DBG(fsg, "cbi reset request\n");
805                 raise_exception(fsg, FSG_STATE_RESET);
806                 return;
807         }
808
809         VDBG(fsg, "CB[I] accept device-specific command\n");
810         spin_lock(&fsg->lock);
811
812         /* Save the command for later */
813         if (fsg->cbbuf_cmnd_size)
814                 WARNING(fsg, "CB[I] overwriting previous command\n");
815         fsg->cbbuf_cmnd_size = req->actual;
816         memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
817
818         wakeup_thread(fsg);
819         spin_unlock(&fsg->lock);
820 }
821
822 #else
823 static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
824 {}
825 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
826
827
828 static int class_setup_req(struct fsg_dev *fsg,
829                 const struct usb_ctrlrequest *ctrl)
830 {
831         struct usb_request      *req = fsg->ep0req;
832         int                     value = -EOPNOTSUPP;
833         u16                     w_index = le16_to_cpu(ctrl->wIndex);
834         u16                     w_value = le16_to_cpu(ctrl->wValue);
835         u16                     w_length = le16_to_cpu(ctrl->wLength);
836
837         if (!fsg->config)
838                 return value;
839
840         /* Handle Bulk-only class-specific requests */
841         if (transport_is_bbb()) {
842                 switch (ctrl->bRequest) {
843
844                 case USB_BULK_RESET_REQUEST:
845                         if (ctrl->bRequestType != (USB_DIR_OUT |
846                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
847                                 break;
848                         if (w_index != 0 || w_value != 0) {
849                                 value = -EDOM;
850                                 break;
851                         }
852
853                         /* Raise an exception to stop the current operation
854                          * and reinitialize our state. */
855                         DBG(fsg, "bulk reset request\n");
856                         raise_exception(fsg, FSG_STATE_RESET);
857                         value = DELAYED_STATUS;
858                         break;
859
860                 case USB_BULK_GET_MAX_LUN_REQUEST:
861                         if (ctrl->bRequestType != (USB_DIR_IN |
862                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
863                                 break;
864                         if (w_index != 0 || w_value != 0) {
865                                 value = -EDOM;
866                                 break;
867                         }
868                         VDBG(fsg, "get max LUN\n");
869                         *(u8 *) req->buf = fsg->nluns - 1;
870                         value = 1;
871                         break;
872                 }
873         }
874
875         /* Handle CBI class-specific requests */
876         else {
877                 switch (ctrl->bRequest) {
878
879                 case USB_CBI_ADSC_REQUEST:
880                         if (ctrl->bRequestType != (USB_DIR_OUT |
881                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
882                                 break;
883                         if (w_index != 0 || w_value != 0) {
884                                 value = -EDOM;
885                                 break;
886                         }
887                         if (w_length > MAX_COMMAND_SIZE) {
888                                 value = -EOVERFLOW;
889                                 break;
890                         }
891                         value = w_length;
892                         fsg->ep0req->context = received_cbi_adsc;
893                         break;
894                 }
895         }
896
897         if (value == -EOPNOTSUPP)
898                 VDBG(fsg,
899                         "unknown class-specific control req "
900                         "%02x.%02x v%04x i%04x l%u\n",
901                         ctrl->bRequestType, ctrl->bRequest,
902                         le16_to_cpu(ctrl->wValue), w_index, w_length);
903         return value;
904 }
905
906
907 /*-------------------------------------------------------------------------*/
908
909 /* Ep0 standard request handlers.  These always run in_irq. */
910
911 static int standard_setup_req(struct fsg_dev *fsg,
912                 const struct usb_ctrlrequest *ctrl)
913 {
914         struct usb_request      *req = fsg->ep0req;
915         int                     value = -EOPNOTSUPP;
916         u16                     w_index = le16_to_cpu(ctrl->wIndex);
917         u16                     w_value = le16_to_cpu(ctrl->wValue);
918
919         /* Usually this just stores reply data in the pre-allocated ep0 buffer,
920          * but config change events will also reconfigure hardware. */
921         switch (ctrl->bRequest) {
922
923         case USB_REQ_GET_DESCRIPTOR:
924                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
925                                 USB_RECIP_DEVICE))
926                         break;
927                 switch (w_value >> 8) {
928
929                 case USB_DT_DEVICE:
930                         VDBG(fsg, "get device descriptor\n");
931                         value = sizeof device_desc;
932                         memcpy(req->buf, &device_desc, value);
933                         break;
934                 case USB_DT_DEVICE_QUALIFIER:
935                         VDBG(fsg, "get device qualifier\n");
936                         if (!gadget_is_dualspeed(fsg->gadget))
937                                 break;
938                         value = sizeof dev_qualifier;
939                         memcpy(req->buf, &dev_qualifier, value);
940                         break;
941
942                 case USB_DT_OTHER_SPEED_CONFIG:
943                         VDBG(fsg, "get other-speed config descriptor\n");
944                         if (!gadget_is_dualspeed(fsg->gadget))
945                                 break;
946                         goto get_config;
947                 case USB_DT_CONFIG:
948                         VDBG(fsg, "get configuration descriptor\n");
949 get_config:
950                         value = populate_config_buf(fsg->gadget,
951                                         req->buf,
952                                         w_value >> 8,
953                                         w_value & 0xff);
954                         break;
955
956                 case USB_DT_STRING:
957                         VDBG(fsg, "get string descriptor\n");
958
959                         /* wIndex == language code */
960                         value = usb_gadget_get_string(&stringtab,
961                                         w_value & 0xff, req->buf);
962                         break;
963                 }
964                 break;
965
966         /* One config, two speeds */
967         case USB_REQ_SET_CONFIGURATION:
968                 if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
969                                 USB_RECIP_DEVICE))
970                         break;
971                 VDBG(fsg, "set configuration\n");
972                 if (w_value == CONFIG_VALUE || w_value == 0) {
973                         fsg->new_config = w_value;
974
975                         /* Raise an exception to wipe out previous transaction
976                          * state (queued bufs, etc) and set the new config. */
977                         raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
978                         value = DELAYED_STATUS;
979                 }
980                 break;
981         case USB_REQ_GET_CONFIGURATION:
982                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
983                                 USB_RECIP_DEVICE))
984                         break;
985                 VDBG(fsg, "get configuration\n");
986                 *(u8 *) req->buf = fsg->config;
987                 value = 1;
988                 break;
989
990         case USB_REQ_SET_INTERFACE:
991                 if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
992                                 USB_RECIP_INTERFACE))
993                         break;
994                 if (fsg->config && w_index == 0) {
995
996                         /* Raise an exception to wipe out previous transaction
997                          * state (queued bufs, etc) and install the new
998                          * interface altsetting. */
999                         raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
1000                         value = DELAYED_STATUS;
1001                 }
1002                 break;
1003         case USB_REQ_GET_INTERFACE:
1004                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
1005                                 USB_RECIP_INTERFACE))
1006                         break;
1007                 if (!fsg->config)
1008                         break;
1009                 if (w_index != 0) {
1010                         value = -EDOM;
1011                         break;
1012                 }
1013                 VDBG(fsg, "get interface\n");
1014                 *(u8 *) req->buf = 0;
1015                 value = 1;
1016                 break;
1017
1018         default:
1019                 VDBG(fsg,
1020                         "unknown control req %02x.%02x v%04x i%04x l%u\n",
1021                         ctrl->bRequestType, ctrl->bRequest,
1022                         w_value, w_index, le16_to_cpu(ctrl->wLength));
1023         }
1024
1025         return value;
1026 }
1027
1028
1029 static int fsg_setup(struct usb_gadget *gadget,
1030                 const struct usb_ctrlrequest *ctrl)
1031 {
1032         struct fsg_dev          *fsg = get_gadget_data(gadget);
1033         int                     rc;
1034         int                     w_length = le16_to_cpu(ctrl->wLength);
1035
1036         ++fsg->ep0_req_tag;             // Record arrival of a new request
1037         fsg->ep0req->context = NULL;
1038         fsg->ep0req->length = 0;
1039         dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
1040
1041         if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
1042                 rc = class_setup_req(fsg, ctrl);
1043         else
1044                 rc = standard_setup_req(fsg, ctrl);
1045
1046         /* Respond with data/status or defer until later? */
1047         if (rc >= 0 && rc != DELAYED_STATUS) {
1048                 rc = min(rc, w_length);
1049                 fsg->ep0req->length = rc;
1050                 fsg->ep0req->zero = rc < w_length;
1051                 fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
1052                                 "ep0-in" : "ep0-out");
1053                 rc = ep0_queue(fsg);
1054         }
1055
1056         /* Device either stalls (rc < 0) or reports success */
1057         return rc;
1058 }
1059
1060
1061 /*-------------------------------------------------------------------------*/
1062
1063 /* All the following routines run in process context */
1064
1065
1066 /* Use this for bulk or interrupt transfers, not ep0 */
1067 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
1068                 struct usb_request *req, int *pbusy,
1069                 enum fsg_buffer_state *state)
1070 {
1071         int     rc;
1072
1073         if (ep == fsg->bulk_in)
1074                 dump_msg(fsg, "bulk-in", req->buf, req->length);
1075         else if (ep == fsg->intr_in)
1076                 dump_msg(fsg, "intr-in", req->buf, req->length);
1077
1078         spin_lock_irq(&fsg->lock);
1079         *pbusy = 1;
1080         *state = BUF_STATE_BUSY;
1081         spin_unlock_irq(&fsg->lock);
1082         rc = usb_ep_queue(ep, req, GFP_KERNEL);
1083         if (rc != 0) {
1084                 *pbusy = 0;
1085                 *state = BUF_STATE_EMPTY;
1086
1087                 /* We can't do much more than wait for a reset */
1088
1089                 /* Note: currently the net2280 driver fails zero-length
1090                  * submissions if DMA is enabled. */
1091                 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
1092                                                 req->length == 0))
1093                         WARNING(fsg, "error in submission: %s --> %d\n",
1094                                         ep->name, rc);
1095         }
1096 }
1097
1098
1099 static int sleep_thread(struct fsg_dev *fsg)
1100 {
1101         int     rc = 0;
1102
1103         /* Wait until a signal arrives or we are woken up */
1104         for (;;) {
1105                 try_to_freeze();
1106                 set_current_state(TASK_INTERRUPTIBLE);
1107                 if (signal_pending(current)) {
1108                         rc = -EINTR;
1109                         break;
1110                 }
1111                 if (fsg->thread_wakeup_needed)
1112                         break;
1113                 schedule();
1114         }
1115         __set_current_state(TASK_RUNNING);
1116         fsg->thread_wakeup_needed = 0;
1117         return rc;
1118 }
1119
1120
1121 /*-------------------------------------------------------------------------*/
1122
1123 static int do_read(struct fsg_dev *fsg)
1124 {
1125         struct lun              *curlun = fsg->curlun;
1126         u32                     lba;
1127         struct fsg_buffhd       *bh;
1128         int                     rc;
1129         u32                     amount_left;
1130         loff_t                  file_offset, file_offset_tmp;
1131         unsigned int            amount;
1132         unsigned int            partial_page;
1133         ssize_t                 nread;
1134
1135         /* Get the starting Logical Block Address and check that it's
1136          * not too big */
1137         if (fsg->cmnd[0] == SC_READ_6)
1138                 lba = get_unaligned_be24(&fsg->cmnd[1]);
1139         else {
1140                 lba = get_unaligned_be32(&fsg->cmnd[2]);
1141
1142                 /* We allow DPO (Disable Page Out = don't save data in the
1143                  * cache) and FUA (Force Unit Access = don't read from the
1144                  * cache), but we don't implement them. */
1145                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1146                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1147                         return -EINVAL;
1148                 }
1149         }
1150         if (lba >= curlun->num_sectors) {
1151                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1152                 return -EINVAL;
1153         }
1154         file_offset = ((loff_t) lba) << 9;
1155
1156         /* Carry out the file reads */
1157         amount_left = fsg->data_size_from_cmnd;
1158         if (unlikely(amount_left == 0))
1159                 return -EIO;            // No default reply
1160
1161         for (;;) {
1162
1163                 /* Figure out how much we need to read:
1164                  * Try to read the remaining amount.
1165                  * But don't read more than the buffer size.
1166                  * And don't try to read past the end of the file.
1167                  * Finally, if we're not at a page boundary, don't read past
1168                  *      the next page.
1169                  * If this means reading 0 then we were asked to read past
1170                  *      the end of file. */
1171                 amount = min((unsigned int) amount_left, mod_data.buflen);
1172                 amount = min((loff_t) amount,
1173                                 curlun->file_length - file_offset);
1174                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
1175                 if (partial_page > 0)
1176                         amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
1177                                         partial_page);
1178
1179                 /* Wait for the next buffer to become available */
1180                 bh = fsg->next_buffhd_to_fill;
1181                 while (bh->state != BUF_STATE_EMPTY) {
1182                         rc = sleep_thread(fsg);
1183                         if (rc)
1184                                 return rc;
1185                 }
1186
1187                 /* If we were asked to read past the end of file,
1188                  * end with an empty buffer. */
1189                 if (amount == 0) {
1190                         curlun->sense_data =
1191                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1192                         curlun->sense_data_info = file_offset >> 9;
1193                         curlun->info_valid = 1;
1194                         bh->inreq->length = 0;
1195                         bh->state = BUF_STATE_FULL;
1196                         break;
1197                 }
1198
1199                 /* Perform the read */
1200                 file_offset_tmp = file_offset;
1201                 nread = vfs_read(curlun->filp,
1202                                 (char __user *) bh->buf,
1203                                 amount, &file_offset_tmp);
1204                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1205                                 (unsigned long long) file_offset,
1206                                 (int) nread);
1207                 if (signal_pending(current))
1208                         return -EINTR;
1209
1210                 if (nread < 0) {
1211                         LDBG(curlun, "error in file read: %d\n",
1212                                         (int) nread);
1213                         nread = 0;
1214                 } else if (nread < amount) {
1215                         LDBG(curlun, "partial file read: %d/%u\n",
1216                                         (int) nread, amount);
1217                         nread -= (nread & 511); // Round down to a block
1218                 }
1219                 file_offset  += nread;
1220                 amount_left  -= nread;
1221                 fsg->residue -= nread;
1222                 bh->inreq->length = nread;
1223                 bh->state = BUF_STATE_FULL;
1224
1225                 /* If an error occurred, report it and its position */
1226                 if (nread < amount) {
1227                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1228                         curlun->sense_data_info = file_offset >> 9;
1229                         curlun->info_valid = 1;
1230                         break;
1231                 }
1232
1233                 if (amount_left == 0)
1234                         break;          // No more left to read
1235
1236                 /* Send this buffer and go read some more */
1237                 bh->inreq->zero = 0;
1238                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1239                                 &bh->inreq_busy, &bh->state);
1240                 fsg->next_buffhd_to_fill = bh->next;
1241         }
1242
1243         return -EIO;            // No default reply
1244 }
1245
1246
1247 /*-------------------------------------------------------------------------*/
1248
1249 static int do_write(struct fsg_dev *fsg)
1250 {
1251         struct lun              *curlun = fsg->curlun;
1252         u32                     lba;
1253         struct fsg_buffhd       *bh;
1254         int                     get_some_more;
1255         u32                     amount_left_to_req, amount_left_to_write;
1256         loff_t                  usb_offset, file_offset, file_offset_tmp;
1257         unsigned int            amount;
1258         unsigned int            partial_page;
1259         ssize_t                 nwritten;
1260         int                     rc;
1261
1262         if (curlun->ro) {
1263                 curlun->sense_data = SS_WRITE_PROTECTED;
1264                 return -EINVAL;
1265         }
1266         spin_lock(&curlun->filp->f_lock);
1267         curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
1268         spin_unlock(&curlun->filp->f_lock);
1269
1270         /* Get the starting Logical Block Address and check that it's
1271          * not too big */
1272         if (fsg->cmnd[0] == SC_WRITE_6)
1273                 lba = get_unaligned_be24(&fsg->cmnd[1]);
1274         else {
1275                 lba = get_unaligned_be32(&fsg->cmnd[2]);
1276
1277                 /* We allow DPO (Disable Page Out = don't save data in the
1278                  * cache) and FUA (Force Unit Access = write directly to the
1279                  * medium).  We don't implement DPO; we implement FUA by
1280                  * performing synchronous output. */
1281                 if ((fsg->cmnd[1] & ~0x18) != 0) {
1282                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1283                         return -EINVAL;
1284                 }
1285                 if (fsg->cmnd[1] & 0x08) {      // FUA
1286                         spin_lock(&curlun->filp->f_lock);
1287                         curlun->filp->f_flags |= O_SYNC;
1288                         spin_unlock(&curlun->filp->f_lock);
1289                 }
1290         }
1291         if (lba >= curlun->num_sectors) {
1292                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1293                 return -EINVAL;
1294         }
1295
1296         /* Carry out the file writes */
1297         get_some_more = 1;
1298         file_offset = usb_offset = ((loff_t) lba) << 9;
1299         amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
1300
1301         while (amount_left_to_write > 0) {
1302
1303                 /* Queue a request for more data from the host */
1304                 bh = fsg->next_buffhd_to_fill;
1305                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
1306
1307                         /* Figure out how much we want to get:
1308                          * Try to get the remaining amount.
1309                          * But don't get more than the buffer size.
1310                          * And don't try to go past the end of the file.
1311                          * If we're not at a page boundary,
1312                          *      don't go past the next page.
1313                          * If this means getting 0, then we were asked
1314                          *      to write past the end of file.
1315                          * Finally, round down to a block boundary. */
1316                         amount = min(amount_left_to_req, mod_data.buflen);
1317                         amount = min((loff_t) amount, curlun->file_length -
1318                                         usb_offset);
1319                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
1320                         if (partial_page > 0)
1321                                 amount = min(amount,
1322         (unsigned int) PAGE_CACHE_SIZE - partial_page);
1323
1324                         if (amount == 0) {
1325                                 get_some_more = 0;
1326                                 curlun->sense_data =
1327                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1328                                 curlun->sense_data_info = usb_offset >> 9;
1329                                 curlun->info_valid = 1;
1330                                 continue;
1331                         }
1332                         amount -= (amount & 511);
1333                         if (amount == 0) {
1334
1335                                 /* Why were we were asked to transfer a
1336                                  * partial block? */
1337                                 get_some_more = 0;
1338                                 continue;
1339                         }
1340
1341                         /* Get the next buffer */
1342                         usb_offset += amount;
1343                         fsg->usb_amount_left -= amount;
1344                         amount_left_to_req -= amount;
1345                         if (amount_left_to_req == 0)
1346                                 get_some_more = 0;
1347
1348                         /* amount is always divisible by 512, hence by
1349                          * the bulk-out maxpacket size */
1350                         bh->outreq->length = bh->bulk_out_intended_length =
1351                                         amount;
1352                         bh->outreq->short_not_ok = 1;
1353                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
1354                                         &bh->outreq_busy, &bh->state);
1355                         fsg->next_buffhd_to_fill = bh->next;
1356                         continue;
1357                 }
1358
1359                 /* Write the received data to the backing file */
1360                 bh = fsg->next_buffhd_to_drain;
1361                 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
1362                         break;                  // We stopped early
1363                 if (bh->state == BUF_STATE_FULL) {
1364                         smp_rmb();
1365                         fsg->next_buffhd_to_drain = bh->next;
1366                         bh->state = BUF_STATE_EMPTY;
1367
1368                         /* Did something go wrong with the transfer? */
1369                         if (bh->outreq->status != 0) {
1370                                 curlun->sense_data = SS_COMMUNICATION_FAILURE;
1371                                 curlun->sense_data_info = file_offset >> 9;
1372                                 curlun->info_valid = 1;
1373                                 break;
1374                         }
1375
1376                         amount = bh->outreq->actual;
1377                         if (curlun->file_length - file_offset < amount) {
1378                                 LERROR(curlun,
1379         "write %u @ %llu beyond end %llu\n",
1380         amount, (unsigned long long) file_offset,
1381         (unsigned long long) curlun->file_length);
1382                                 amount = curlun->file_length - file_offset;
1383                         }
1384
1385                         /* Perform the write */
1386                         file_offset_tmp = file_offset;
1387                         nwritten = vfs_write(curlun->filp,
1388                                         (char __user *) bh->buf,
1389                                         amount, &file_offset_tmp);
1390                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
1391                                         (unsigned long long) file_offset,
1392                                         (int) nwritten);
1393                         if (signal_pending(current))
1394                                 return -EINTR;          // Interrupted!
1395
1396                         if (nwritten < 0) {
1397                                 LDBG(curlun, "error in file write: %d\n",
1398                                                 (int) nwritten);
1399                                 nwritten = 0;
1400                         } else if (nwritten < amount) {
1401                                 LDBG(curlun, "partial file write: %d/%u\n",
1402                                                 (int) nwritten, amount);
1403                                 nwritten -= (nwritten & 511);
1404                                                 // Round down to a block
1405                         }
1406                         file_offset += nwritten;
1407                         amount_left_to_write -= nwritten;
1408                         fsg->residue -= nwritten;
1409
1410                         /* If an error occurred, report it and its position */
1411                         if (nwritten < amount) {
1412                                 curlun->sense_data = SS_WRITE_ERROR;
1413                                 curlun->sense_data_info = file_offset >> 9;
1414                                 curlun->info_valid = 1;
1415                                 break;
1416                         }
1417
1418                         /* Did the host decide to stop early? */
1419                         if (bh->outreq->actual != bh->outreq->length) {
1420                                 fsg->short_packet_received = 1;
1421                                 break;
1422                         }
1423                         continue;
1424                 }
1425
1426                 /* Wait for something to happen */
1427                 rc = sleep_thread(fsg);
1428                 if (rc)
1429                         return rc;
1430         }
1431
1432         return -EIO;            // No default reply
1433 }
1434
1435
1436 /*-------------------------------------------------------------------------*/
1437
1438 static int do_synchronize_cache(struct fsg_dev *fsg)
1439 {
1440         struct lun      *curlun = fsg->curlun;
1441         int             rc;
1442
1443         /* We ignore the requested LBA and write out all file's
1444          * dirty data buffers. */
1445         rc = fsync_sub(curlun);
1446         if (rc)
1447                 curlun->sense_data = SS_WRITE_ERROR;
1448         return 0;
1449 }
1450
1451
1452 /*-------------------------------------------------------------------------*/
1453
1454 static void invalidate_sub(struct lun *curlun)
1455 {
1456         struct file     *filp = curlun->filp;
1457         struct inode    *inode = filp->f_path.dentry->d_inode;
1458         unsigned long   rc;
1459
1460         rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
1461         VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
1462 }
1463
1464 static int do_verify(struct fsg_dev *fsg)
1465 {
1466         struct lun              *curlun = fsg->curlun;
1467         u32                     lba;
1468         u32                     verification_length;
1469         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
1470         loff_t                  file_offset, file_offset_tmp;
1471         u32                     amount_left;
1472         unsigned int            amount;
1473         ssize_t                 nread;
1474
1475         /* Get the starting Logical Block Address and check that it's
1476          * not too big */
1477         lba = get_unaligned_be32(&fsg->cmnd[2]);
1478         if (lba >= curlun->num_sectors) {
1479                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1480                 return -EINVAL;
1481         }
1482
1483         /* We allow DPO (Disable Page Out = don't save data in the
1484          * cache) but we don't implement it. */
1485         if ((fsg->cmnd[1] & ~0x10) != 0) {
1486                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1487                 return -EINVAL;
1488         }
1489
1490         verification_length = get_unaligned_be16(&fsg->cmnd[7]);
1491         if (unlikely(verification_length == 0))
1492                 return -EIO;            // No default reply
1493
1494         /* Prepare to carry out the file verify */
1495         amount_left = verification_length << 9;
1496         file_offset = ((loff_t) lba) << 9;
1497
1498         /* Write out all the dirty buffers before invalidating them */
1499         fsync_sub(curlun);
1500         if (signal_pending(current))
1501                 return -EINTR;
1502
1503         invalidate_sub(curlun);
1504         if (signal_pending(current))
1505                 return -EINTR;
1506
1507         /* Just try to read the requested blocks */
1508         while (amount_left > 0) {
1509
1510                 /* Figure out how much we need to read:
1511                  * Try to read the remaining amount, but not more than
1512                  * the buffer size.
1513                  * And don't try to read past the end of the file.
1514                  * If this means reading 0 then we were asked to read
1515                  * past the end of file. */
1516                 amount = min((unsigned int) amount_left, mod_data.buflen);
1517                 amount = min((loff_t) amount,
1518                                 curlun->file_length - file_offset);
1519                 if (amount == 0) {
1520                         curlun->sense_data =
1521                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1522                         curlun->sense_data_info = file_offset >> 9;
1523                         curlun->info_valid = 1;
1524                         break;
1525                 }
1526
1527                 /* Perform the read */
1528                 file_offset_tmp = file_offset;
1529                 nread = vfs_read(curlun->filp,
1530                                 (char __user *) bh->buf,
1531                                 amount, &file_offset_tmp);
1532                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1533                                 (unsigned long long) file_offset,
1534                                 (int) nread);
1535                 if (signal_pending(current))
1536                         return -EINTR;
1537
1538                 if (nread < 0) {
1539                         LDBG(curlun, "error in file verify: %d\n",
1540                                         (int) nread);
1541                         nread = 0;
1542                 } else if (nread < amount) {
1543                         LDBG(curlun, "partial file verify: %d/%u\n",
1544                                         (int) nread, amount);
1545                         nread -= (nread & 511); // Round down to a sector
1546                 }
1547                 if (nread == 0) {
1548                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1549                         curlun->sense_data_info = file_offset >> 9;
1550                         curlun->info_valid = 1;
1551                         break;
1552                 }
1553                 file_offset += nread;
1554                 amount_left -= nread;
1555         }
1556         return 0;
1557 }
1558
1559
1560 /*-------------------------------------------------------------------------*/
1561
1562 static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1563 {
1564         u8      *buf = (u8 *) bh->buf;
1565
1566         static char vendor_id[] = "Linux   ";
1567         static char product_disk_id[] = "File-Stor Gadget";
1568         static char product_cdrom_id[] = "File-CD Gadget  ";
1569
1570         if (!fsg->curlun) {             // Unsupported LUNs are okay
1571                 fsg->bad_lun_okay = 1;
1572                 memset(buf, 0, 36);
1573                 buf[0] = 0x7f;          // Unsupported, no device-type
1574                 buf[4] = 31;            // Additional length
1575                 return 36;
1576         }
1577
1578         memset(buf, 0, 8);
1579         buf[0] = (mod_data.cdrom ? TYPE_CDROM : TYPE_DISK);
1580         if (mod_data.removable)
1581                 buf[1] = 0x80;
1582         buf[2] = 2;             // ANSI SCSI level 2
1583         buf[3] = 2;             // SCSI-2 INQUIRY data format
1584         buf[4] = 31;            // Additional length
1585                                 // No special options
1586         sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
1587                         (mod_data.cdrom ? product_cdrom_id :
1588                                 product_disk_id),
1589                         mod_data.release);
1590         return 36;
1591 }
1592
1593
1594 static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1595 {
1596         struct lun      *curlun = fsg->curlun;
1597         u8              *buf = (u8 *) bh->buf;
1598         u32             sd, sdinfo;
1599         int             valid;
1600
1601         /*
1602          * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1603          *
1604          * If a REQUEST SENSE command is received from an initiator
1605          * with a pending unit attention condition (before the target
1606          * generates the contingent allegiance condition), then the
1607          * target shall either:
1608          *   a) report any pending sense data and preserve the unit
1609          *      attention condition on the logical unit, or,
1610          *   b) report the unit attention condition, may discard any
1611          *      pending sense data, and clear the unit attention
1612          *      condition on the logical unit for that initiator.
1613          *
1614          * FSG normally uses option a); enable this code to use option b).
1615          */
1616 #if 0
1617         if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1618                 curlun->sense_data = curlun->unit_attention_data;
1619                 curlun->unit_attention_data = SS_NO_SENSE;
1620         }
1621 #endif
1622
1623         if (!curlun) {          // Unsupported LUNs are okay
1624                 fsg->bad_lun_okay = 1;
1625                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1626                 sdinfo = 0;
1627                 valid = 0;
1628         } else {
1629                 sd = curlun->sense_data;
1630                 sdinfo = curlun->sense_data_info;
1631                 valid = curlun->info_valid << 7;
1632                 curlun->sense_data = SS_NO_SENSE;
1633                 curlun->sense_data_info = 0;
1634                 curlun->info_valid = 0;
1635         }
1636
1637         memset(buf, 0, 18);
1638         buf[0] = valid | 0x70;                  // Valid, current error
1639         buf[2] = SK(sd);
1640         put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
1641         buf[7] = 18 - 8;                        // Additional sense length
1642         buf[12] = ASC(sd);
1643         buf[13] = ASCQ(sd);
1644         return 18;
1645 }
1646
1647
1648 static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1649 {
1650         struct lun      *curlun = fsg->curlun;
1651         u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
1652         int             pmi = fsg->cmnd[8];
1653         u8              *buf = (u8 *) bh->buf;
1654
1655         /* Check the PMI and LBA fields */
1656         if (pmi > 1 || (pmi == 0 && lba != 0)) {
1657                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1658                 return -EINVAL;
1659         }
1660
1661         put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1662                                                 /* Max logical block */
1663         put_unaligned_be32(512, &buf[4]);       /* Block length */
1664         return 8;
1665 }
1666
1667
1668 static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1669 {
1670         struct lun      *curlun = fsg->curlun;
1671         int             msf = fsg->cmnd[1] & 0x02;
1672         u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
1673         u8              *buf = (u8 *) bh->buf;
1674
1675         if ((fsg->cmnd[1] & ~0x02) != 0) {              /* Mask away MSF */
1676                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1677                 return -EINVAL;
1678         }
1679         if (lba >= curlun->num_sectors) {
1680                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1681                 return -EINVAL;
1682         }
1683
1684         memset(buf, 0, 8);
1685         buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
1686         store_cdrom_address(&buf[4], msf, lba);
1687         return 8;
1688 }
1689
1690
1691 static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1692 {
1693         struct lun      *curlun = fsg->curlun;
1694         int             msf = fsg->cmnd[1] & 0x02;
1695         int             start_track = fsg->cmnd[6];
1696         u8              *buf = (u8 *) bh->buf;
1697
1698         if ((fsg->cmnd[1] & ~0x02) != 0 ||              /* Mask away MSF */
1699                         start_track > 1) {
1700                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1701                 return -EINVAL;
1702         }
1703
1704         memset(buf, 0, 20);
1705         buf[1] = (20-2);                /* TOC data length */
1706         buf[2] = 1;                     /* First track number */
1707         buf[3] = 1;                     /* Last track number */
1708         buf[5] = 0x16;                  /* Data track, copying allowed */
1709         buf[6] = 0x01;                  /* Only track is number 1 */
1710         store_cdrom_address(&buf[8], msf, 0);
1711
1712         buf[13] = 0x16;                 /* Lead-out track is data */
1713         buf[14] = 0xAA;                 /* Lead-out track number */
1714         store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1715         return 20;
1716 }
1717
1718
1719 static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1720 {
1721         struct lun      *curlun = fsg->curlun;
1722         int             mscmnd = fsg->cmnd[0];
1723         u8              *buf = (u8 *) bh->buf;
1724         u8              *buf0 = buf;
1725         int             pc, page_code;
1726         int             changeable_values, all_pages;
1727         int             valid_page = 0;
1728         int             len, limit;
1729
1730         if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
1731                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1732                 return -EINVAL;
1733         }
1734         pc = fsg->cmnd[2] >> 6;
1735         page_code = fsg->cmnd[2] & 0x3f;
1736         if (pc == 3) {
1737                 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1738                 return -EINVAL;
1739         }
1740         changeable_values = (pc == 1);
1741         all_pages = (page_code == 0x3f);
1742
1743         /* Write the mode parameter header.  Fixed values are: default
1744          * medium type, no cache control (DPOFUA), and no block descriptors.
1745          * The only variable value is the WriteProtect bit.  We will fill in
1746          * the mode data length later. */
1747         memset(buf, 0, 8);
1748         if (mscmnd == SC_MODE_SENSE_6) {
1749                 buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
1750                 buf += 4;
1751                 limit = 255;
1752         } else {                        // SC_MODE_SENSE_10
1753                 buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
1754                 buf += 8;
1755                 limit = 65535;          // Should really be mod_data.buflen
1756         }
1757
1758         /* No block descriptors */
1759
1760         /* The mode pages, in numerical order.  The only page we support
1761          * is the Caching page. */
1762         if (page_code == 0x08 || all_pages) {
1763                 valid_page = 1;
1764                 buf[0] = 0x08;          // Page code
1765                 buf[1] = 10;            // Page length
1766                 memset(buf+2, 0, 10);   // None of the fields are changeable
1767
1768                 if (!changeable_values) {
1769                         buf[2] = 0x04;  // Write cache enable,
1770                                         // Read cache not disabled
1771                                         // No cache retention priorities
1772                         put_unaligned_be16(0xffff, &buf[4]);
1773                                         /* Don't disable prefetch */
1774                                         /* Minimum prefetch = 0 */
1775                         put_unaligned_be16(0xffff, &buf[8]);
1776                                         /* Maximum prefetch */
1777                         put_unaligned_be16(0xffff, &buf[10]);
1778                                         /* Maximum prefetch ceiling */
1779                 }
1780                 buf += 12;
1781         }
1782
1783         /* Check that a valid page was requested and the mode data length
1784          * isn't too long. */
1785         len = buf - buf0;
1786         if (!valid_page || len > limit) {
1787                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1788                 return -EINVAL;
1789         }
1790
1791         /*  Store the mode data length */
1792         if (mscmnd == SC_MODE_SENSE_6)
1793                 buf0[0] = len - 1;
1794         else
1795                 put_unaligned_be16(len - 2, buf0);
1796         return len;
1797 }
1798
1799
1800 static int do_start_stop(struct fsg_dev *fsg)
1801 {
1802         struct lun      *curlun = fsg->curlun;
1803         int             loej, start;
1804
1805         if (!mod_data.removable) {
1806                 curlun->sense_data = SS_INVALID_COMMAND;
1807                 return -EINVAL;
1808         }
1809
1810         // int immed = fsg->cmnd[1] & 0x01;
1811         loej = fsg->cmnd[4] & 0x02;
1812         start = fsg->cmnd[4] & 0x01;
1813
1814 #ifdef CONFIG_USB_FILE_STORAGE_TEST
1815         if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
1816                         (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
1817                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1818                 return -EINVAL;
1819         }
1820
1821         if (!start) {
1822
1823                 /* Are we allowed to unload the media? */
1824                 if (curlun->prevent_medium_removal) {
1825                         LDBG(curlun, "unload attempt prevented\n");
1826                         curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1827                         return -EINVAL;
1828                 }
1829                 if (loej) {             // Simulate an unload/eject
1830                         up_read(&fsg->filesem);
1831                         down_write(&fsg->filesem);
1832                         close_backing_file(curlun);
1833                         up_write(&fsg->filesem);
1834                         down_read(&fsg->filesem);
1835                 }
1836         } else {
1837
1838                 /* Our emulation doesn't support mounting; the medium is
1839                  * available for use as soon as it is loaded. */
1840                 if (!backing_file_is_open(curlun)) {
1841                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1842                         return -EINVAL;
1843                 }
1844         }
1845 #endif
1846         return 0;
1847 }
1848
1849
1850 static int do_prevent_allow(struct fsg_dev *fsg)
1851 {
1852         struct lun      *curlun = fsg->curlun;
1853         int             prevent;
1854
1855         if (!mod_data.removable) {
1856                 curlun->sense_data = SS_INVALID_COMMAND;
1857                 return -EINVAL;
1858         }
1859
1860         prevent = fsg->cmnd[4] & 0x01;
1861         if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
1862                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1863                 return -EINVAL;
1864         }
1865
1866         if (curlun->prevent_medium_removal && !prevent)
1867                 fsync_sub(curlun);
1868         curlun->prevent_medium_removal = prevent;
1869         return 0;
1870 }
1871
1872
1873 static int do_read_format_capacities(struct fsg_dev *fsg,
1874                         struct fsg_buffhd *bh)
1875 {
1876         struct lun      *curlun = fsg->curlun;
1877         u8              *buf = (u8 *) bh->buf;
1878
1879         buf[0] = buf[1] = buf[2] = 0;
1880         buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
1881         buf += 4;
1882
1883         put_unaligned_be32(curlun->num_sectors, &buf[0]);
1884                                                 /* Number of blocks */
1885         put_unaligned_be32(512, &buf[4]);       /* Block length */
1886         buf[4] = 0x02;                          /* Current capacity */
1887         return 12;
1888 }
1889
1890
1891 static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
1892 {
1893         struct lun      *curlun = fsg->curlun;
1894
1895         /* We don't support MODE SELECT */
1896         curlun->sense_data = SS_INVALID_COMMAND;
1897         return -EINVAL;
1898 }
1899
1900
1901 /*-------------------------------------------------------------------------*/
1902
1903 static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1904 {
1905         int     rc;
1906
1907         rc = fsg_set_halt(fsg, fsg->bulk_in);
1908         if (rc == -EAGAIN)
1909                 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1910         while (rc != 0) {
1911                 if (rc != -EAGAIN) {
1912                         WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1913                         rc = 0;
1914                         break;
1915                 }
1916
1917                 /* Wait for a short time and then try again */
1918                 if (msleep_interruptible(100) != 0)
1919                         return -EINTR;
1920                 rc = usb_ep_set_halt(fsg->bulk_in);
1921         }
1922         return rc;
1923 }
1924
1925 static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1926 {
1927         int     rc;
1928
1929         DBG(fsg, "bulk-in set wedge\n");
1930         rc = usb_ep_set_wedge(fsg->bulk_in);
1931         if (rc == -EAGAIN)
1932                 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1933         while (rc != 0) {
1934                 if (rc != -EAGAIN) {
1935                         WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1936                         rc = 0;
1937                         break;
1938                 }
1939
1940                 /* Wait for a short time and then try again */
1941                 if (msleep_interruptible(100) != 0)
1942                         return -EINTR;
1943                 rc = usb_ep_set_wedge(fsg->bulk_in);
1944         }
1945         return rc;
1946 }
1947
1948 static int pad_with_zeros(struct fsg_dev *fsg)
1949 {
1950         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
1951         u32                     nkeep = bh->inreq->length;
1952         u32                     nsend;
1953         int                     rc;
1954
1955         bh->state = BUF_STATE_EMPTY;            // For the first iteration
1956         fsg->usb_amount_left = nkeep + fsg->residue;
1957         while (fsg->usb_amount_left > 0) {
1958
1959                 /* Wait for the next buffer to be free */
1960                 while (bh->state != BUF_STATE_EMPTY) {
1961                         rc = sleep_thread(fsg);
1962                         if (rc)
1963                                 return rc;
1964                 }
1965
1966                 nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
1967                 memset(bh->buf + nkeep, 0, nsend - nkeep);
1968                 bh->inreq->length = nsend;
1969                 bh->inreq->zero = 0;
1970                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1971                                 &bh->inreq_busy, &bh->state);
1972                 bh = fsg->next_buffhd_to_fill = bh->next;
1973                 fsg->usb_amount_left -= nsend;
1974                 nkeep = 0;
1975         }
1976         return 0;
1977 }
1978
1979 static int throw_away_data(struct fsg_dev *fsg)
1980 {
1981         struct fsg_buffhd       *bh;
1982         u32                     amount;
1983         int                     rc;
1984
1985         while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
1986                         fsg->usb_amount_left > 0) {
1987
1988                 /* Throw away the data in a filled buffer */
1989                 if (bh->state == BUF_STATE_FULL) {
1990                         smp_rmb();
1991                         bh->state = BUF_STATE_EMPTY;
1992                         fsg->next_buffhd_to_drain = bh->next;
1993
1994                         /* A short packet or an error ends everything */
1995                         if (bh->outreq->actual != bh->outreq->length ||
1996                                         bh->outreq->status != 0) {
1997                                 raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
1998                                 return -EINTR;
1999                         }
2000                         continue;
2001                 }
2002
2003                 /* Try to submit another request if we need one */
2004                 bh = fsg->next_buffhd_to_fill;
2005                 if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
2006                         amount = min(fsg->usb_amount_left,
2007                                         (u32) mod_data.buflen);
2008
2009                         /* amount is always divisible by 512, hence by
2010                          * the bulk-out maxpacket size */
2011                         bh->outreq->length = bh->bulk_out_intended_length =
2012                                         amount;
2013                         bh->outreq->short_not_ok = 1;
2014                         start_transfer(fsg, fsg->bulk_out, bh->outreq,
2015                                         &bh->outreq_busy, &bh->state);
2016                         fsg->next_buffhd_to_fill = bh->next;
2017                         fsg->usb_amount_left -= amount;
2018                         continue;
2019                 }
2020
2021                 /* Otherwise wait for something to happen */
2022                 rc = sleep_thread(fsg);
2023                 if (rc)
2024                         return rc;
2025         }
2026         return 0;
2027 }
2028
2029
2030 static int finish_reply(struct fsg_dev *fsg)
2031 {
2032         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2033         int                     rc = 0;
2034
2035         switch (fsg->data_dir) {
2036         case DATA_DIR_NONE:
2037                 break;                  // Nothing to send
2038
2039         /* If we don't know whether the host wants to read or write,
2040          * this must be CB or CBI with an unknown command.  We mustn't
2041          * try to send or receive any data.  So stall both bulk pipes
2042          * if we can and wait for a reset. */
2043         case DATA_DIR_UNKNOWN:
2044                 if (mod_data.can_stall) {
2045                         fsg_set_halt(fsg, fsg->bulk_out);
2046                         rc = halt_bulk_in_endpoint(fsg);
2047                 }
2048                 break;
2049
2050         /* All but the last buffer of data must have already been sent */
2051         case DATA_DIR_TO_HOST:
2052                 if (fsg->data_size == 0)
2053                         ;               // Nothing to send
2054
2055                 /* If there's no residue, simply send the last buffer */
2056                 else if (fsg->residue == 0) {
2057                         bh->inreq->zero = 0;
2058                         start_transfer(fsg, fsg->bulk_in, bh->inreq,
2059                                         &bh->inreq_busy, &bh->state);
2060                         fsg->next_buffhd_to_fill = bh->next;
2061                 }
2062
2063                 /* There is a residue.  For CB and CBI, simply mark the end
2064                  * of the data with a short packet.  However, if we are
2065                  * allowed to stall, there was no data at all (residue ==
2066                  * data_size), and the command failed (invalid LUN or
2067                  * sense data is set), then halt the bulk-in endpoint
2068                  * instead. */
2069                 else if (!transport_is_bbb()) {
2070                         if (mod_data.can_stall &&
2071                                         fsg->residue == fsg->data_size &&
2072         (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
2073                                 bh->state = BUF_STATE_EMPTY;
2074                                 rc = halt_bulk_in_endpoint(fsg);
2075                         } else {
2076                                 bh->inreq->zero = 1;
2077                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2078                                                 &bh->inreq_busy, &bh->state);
2079                                 fsg->next_buffhd_to_fill = bh->next;
2080                         }
2081                 }
2082
2083                 /* For Bulk-only, if we're allowed to stall then send the
2084                  * short packet and halt the bulk-in endpoint.  If we can't
2085                  * stall, pad out the remaining data with 0's. */
2086                 else {
2087                         if (mod_data.can_stall) {
2088                                 bh->inreq->zero = 1;
2089                                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2090                                                 &bh->inreq_busy, &bh->state);
2091                                 fsg->next_buffhd_to_fill = bh->next;
2092                                 rc = halt_bulk_in_endpoint(fsg);
2093                         } else
2094                                 rc = pad_with_zeros(fsg);
2095                 }
2096                 break;
2097
2098         /* We have processed all we want from the data the host has sent.
2099          * There may still be outstanding bulk-out requests. */
2100         case DATA_DIR_FROM_HOST:
2101                 if (fsg->residue == 0)
2102                         ;               // Nothing to receive
2103
2104                 /* Did the host stop sending unexpectedly early? */
2105                 else if (fsg->short_packet_received) {
2106                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2107                         rc = -EINTR;
2108                 }
2109
2110                 /* We haven't processed all the incoming data.  Even though
2111                  * we may be allowed to stall, doing so would cause a race.
2112                  * The controller may already have ACK'ed all the remaining
2113                  * bulk-out packets, in which case the host wouldn't see a
2114                  * STALL.  Not realizing the endpoint was halted, it wouldn't
2115                  * clear the halt -- leading to problems later on. */
2116 #if 0
2117                 else if (mod_data.can_stall) {
2118                         fsg_set_halt(fsg, fsg->bulk_out);
2119                         raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2120                         rc = -EINTR;
2121                 }
2122 #endif
2123
2124                 /* We can't stall.  Read in the excess data and throw it
2125                  * all away. */
2126                 else
2127                         rc = throw_away_data(fsg);
2128                 break;
2129         }
2130         return rc;
2131 }
2132
2133
2134 static int send_status(struct fsg_dev *fsg)
2135 {
2136         struct lun              *curlun = fsg->curlun;
2137         struct fsg_buffhd       *bh;
2138         int                     rc;
2139         u8                      status = USB_STATUS_PASS;
2140         u32                     sd, sdinfo = 0;
2141
2142         /* Wait for the next buffer to become available */
2143         bh = fsg->next_buffhd_to_fill;
2144         while (bh->state != BUF_STATE_EMPTY) {
2145                 rc = sleep_thread(fsg);
2146                 if (rc)
2147                         return rc;
2148         }
2149
2150         if (curlun) {
2151                 sd = curlun->sense_data;
2152                 sdinfo = curlun->sense_data_info;
2153         } else if (fsg->bad_lun_okay)
2154                 sd = SS_NO_SENSE;
2155         else
2156                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2157
2158         if (fsg->phase_error) {
2159                 DBG(fsg, "sending phase-error status\n");
2160                 status = USB_STATUS_PHASE_ERROR;
2161                 sd = SS_INVALID_COMMAND;
2162         } else if (sd != SS_NO_SENSE) {
2163                 DBG(fsg, "sending command-failure status\n");
2164                 status = USB_STATUS_FAIL;
2165                 VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2166                                 "  info x%x\n",
2167                                 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
2168         }
2169
2170         if (transport_is_bbb()) {
2171                 struct bulk_cs_wrap     *csw = bh->buf;
2172
2173                 /* Store and send the Bulk-only CSW */
2174                 csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
2175                 csw->Tag = fsg->tag;
2176                 csw->Residue = cpu_to_le32(fsg->residue);
2177                 csw->Status = status;
2178
2179                 bh->inreq->length = USB_BULK_CS_WRAP_LEN;
2180                 bh->inreq->zero = 0;
2181                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
2182                                 &bh->inreq_busy, &bh->state);
2183
2184         } else if (mod_data.transport_type == USB_PR_CB) {
2185
2186                 /* Control-Bulk transport has no status phase! */
2187                 return 0;
2188
2189         } else {                        // USB_PR_CBI
2190                 struct interrupt_data   *buf = bh->buf;
2191
2192                 /* Store and send the Interrupt data.  UFI sends the ASC
2193                  * and ASCQ bytes.  Everything else sends a Type (which
2194                  * is always 0) and the status Value. */
2195                 if (mod_data.protocol_type == USB_SC_UFI) {
2196                         buf->bType = ASC(sd);
2197                         buf->bValue = ASCQ(sd);
2198                 } else {
2199                         buf->bType = 0;
2200                         buf->bValue = status;
2201                 }
2202                 fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
2203
2204                 fsg->intr_buffhd = bh;          // Point to the right buffhd
2205                 fsg->intreq->buf = bh->inreq->buf;
2206                 fsg->intreq->context = bh;
2207                 start_transfer(fsg, fsg->intr_in, fsg->intreq,
2208                                 &fsg->intreq_busy, &bh->state);
2209         }
2210
2211         fsg->next_buffhd_to_fill = bh->next;
2212         return 0;
2213 }
2214
2215
2216 /*-------------------------------------------------------------------------*/
2217
2218 /* Check whether the command is properly formed and whether its data size
2219  * and direction agree with the values we already have. */
2220 static int check_command(struct fsg_dev *fsg, int cmnd_size,
2221                 enum data_direction data_dir, unsigned int mask,
2222                 int needs_medium, const char *name)
2223 {
2224         int                     i;
2225         int                     lun = fsg->cmnd[1] >> 5;
2226         static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
2227         char                    hdlen[20];
2228         struct lun              *curlun;
2229
2230         /* Adjust the expected cmnd_size for protocol encapsulation padding.
2231          * Transparent SCSI doesn't pad. */
2232         if (protocol_is_scsi())
2233                 ;
2234
2235         /* There's some disagreement as to whether RBC pads commands or not.
2236          * We'll play it safe and accept either form. */
2237         else if (mod_data.protocol_type == USB_SC_RBC) {
2238                 if (fsg->cmnd_size == 12)
2239                         cmnd_size = 12;
2240
2241         /* All the other protocols pad to 12 bytes */
2242         } else
2243                 cmnd_size = 12;
2244
2245         hdlen[0] = 0;
2246         if (fsg->data_dir != DATA_DIR_UNKNOWN)
2247                 sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
2248                                 fsg->data_size);
2249         VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
2250                         name, cmnd_size, dirletter[(int) data_dir],
2251                         fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
2252
2253         /* We can't reply at all until we know the correct data direction
2254          * and size. */
2255         if (fsg->data_size_from_cmnd == 0)
2256                 data_dir = DATA_DIR_NONE;
2257         if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
2258                 fsg->data_dir = data_dir;
2259                 fsg->data_size = fsg->data_size_from_cmnd;
2260
2261         } else {                                        // Bulk-only
2262                 if (fsg->data_size < fsg->data_size_from_cmnd) {
2263
2264                         /* Host data size < Device data size is a phase error.
2265                          * Carry out the command, but only transfer as much
2266                          * as we are allowed. */
2267                         fsg->data_size_from_cmnd = fsg->data_size;
2268                         fsg->phase_error = 1;
2269                 }
2270         }
2271         fsg->residue = fsg->usb_amount_left = fsg->data_size;
2272
2273         /* Conflicting data directions is a phase error */
2274         if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
2275                 fsg->phase_error = 1;
2276                 return -EINVAL;
2277         }
2278
2279         /* Verify the length of the command itself */
2280         if (cmnd_size != fsg->cmnd_size) {
2281
2282                 /* Special case workaround: There are plenty of buggy SCSI
2283                  * implementations. Many have issues with cbw->Length
2284                  * field passing a wrong command size. For those cases we
2285                  * always try to work around the problem by using the length
2286                  * sent by the host side provided it is at least as large
2287                  * as the correct command length.
2288                  * Examples of such cases would be MS-Windows, which issues
2289                  * REQUEST SENSE with cbw->Length == 12 where it should
2290                  * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
2291                  * REQUEST SENSE with cbw->Length == 10 where it should
2292                  * be 6 as well.
2293                  */
2294                 if (cmnd_size <= fsg->cmnd_size) {
2295                         DBG(fsg, "%s is buggy! Expected length %d "
2296                                         "but we got %d\n", name,
2297                                         cmnd_size, fsg->cmnd_size);
2298                         cmnd_size = fsg->cmnd_size;
2299                 } else {
2300                         fsg->phase_error = 1;
2301                         return -EINVAL;
2302                 }
2303         }
2304
2305         /* Check that the LUN values are consistent */
2306         if (transport_is_bbb()) {
2307                 if (fsg->lun != lun)
2308                         DBG(fsg, "using LUN %d from CBW, "
2309                                         "not LUN %d from CDB\n",
2310                                         fsg->lun, lun);
2311         } else
2312                 fsg->lun = lun;         // Use LUN from the command
2313
2314         /* Check the LUN */
2315         if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
2316                 fsg->curlun = curlun = &fsg->luns[fsg->lun];
2317                 if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
2318                         curlun->sense_data = SS_NO_SENSE;
2319                         curlun->sense_data_info = 0;
2320                         curlun->info_valid = 0;
2321                 }
2322         } else {
2323                 fsg->curlun = curlun = NULL;
2324                 fsg->bad_lun_okay = 0;
2325
2326                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2327                  * to use unsupported LUNs; all others may not. */
2328                 if (fsg->cmnd[0] != SC_INQUIRY &&
2329                                 fsg->cmnd[0] != SC_REQUEST_SENSE) {
2330                         DBG(fsg, "unsupported LUN %d\n", fsg->lun);
2331                         return -EINVAL;
2332                 }
2333         }
2334
2335         /* If a unit attention condition exists, only INQUIRY and
2336          * REQUEST SENSE commands are allowed; anything else must fail. */
2337         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
2338                         fsg->cmnd[0] != SC_INQUIRY &&
2339                         fsg->cmnd[0] != SC_REQUEST_SENSE) {
2340                 curlun->sense_data = curlun->unit_attention_data;
2341                 curlun->unit_attention_data = SS_NO_SENSE;
2342                 return -EINVAL;
2343         }
2344
2345         /* Check that only command bytes listed in the mask are non-zero */
2346         fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
2347         for (i = 1; i < cmnd_size; ++i) {
2348                 if (fsg->cmnd[i] && !(mask & (1 << i))) {
2349                         if (curlun)
2350                                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2351                         return -EINVAL;
2352                 }
2353         }
2354
2355         /* If the medium isn't mounted and the command needs to access
2356          * it, return an error. */
2357         if (curlun && !backing_file_is_open(curlun) && needs_medium) {
2358                 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2359                 return -EINVAL;
2360         }
2361
2362         return 0;
2363 }
2364
2365
2366 static int do_scsi_command(struct fsg_dev *fsg)
2367 {
2368         struct fsg_buffhd       *bh;
2369         int                     rc;
2370         int                     reply = -EINVAL;
2371         int                     i;
2372         static char             unknown[16];
2373
2374         dump_cdb(fsg);
2375
2376         /* Wait for the next buffer to become available for data or status */
2377         bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
2378         while (bh->state != BUF_STATE_EMPTY) {
2379                 rc = sleep_thread(fsg);
2380                 if (rc)
2381                         return rc;
2382         }
2383         fsg->phase_error = 0;
2384         fsg->short_packet_received = 0;
2385
2386         down_read(&fsg->filesem);       // We're using the backing file
2387         switch (fsg->cmnd[0]) {
2388
2389         case SC_INQUIRY:
2390                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2391                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2392                                 (1<<4), 0,
2393                                 "INQUIRY")) == 0)
2394                         reply = do_inquiry(fsg, bh);
2395                 break;
2396
2397         case SC_MODE_SELECT_6:
2398                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2399                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2400                                 (1<<1) | (1<<4), 0,
2401                                 "MODE SELECT(6)")) == 0)
2402                         reply = do_mode_select(fsg, bh);
2403                 break;
2404
2405         case SC_MODE_SELECT_10:
2406                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2407                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2408                                 (1<<1) | (3<<7), 0,
2409                                 "MODE SELECT(10)")) == 0)
2410                         reply = do_mode_select(fsg, bh);
2411                 break;
2412
2413         case SC_MODE_SENSE_6:
2414                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2415                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2416                                 (1<<1) | (1<<2) | (1<<4), 0,
2417                                 "MODE SENSE(6)")) == 0)
2418                         reply = do_mode_sense(fsg, bh);
2419                 break;
2420
2421         case SC_MODE_SENSE_10:
2422                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2423                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2424                                 (1<<1) | (1<<2) | (3<<7), 0,
2425                                 "MODE SENSE(10)")) == 0)
2426                         reply = do_mode_sense(fsg, bh);
2427                 break;
2428
2429         case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
2430                 fsg->data_size_from_cmnd = 0;
2431                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2432                                 (1<<4), 0,
2433                                 "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2434                         reply = do_prevent_allow(fsg);
2435                 break;
2436
2437         case SC_READ_6:
2438                 i = fsg->cmnd[4];
2439                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2440                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2441                                 (7<<1) | (1<<4), 1,
2442                                 "READ(6)")) == 0)
2443                         reply = do_read(fsg);
2444                 break;
2445
2446         case SC_READ_10:
2447                 fsg->data_size_from_cmnd =
2448                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2449                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2450                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2451                                 "READ(10)")) == 0)
2452                         reply = do_read(fsg);
2453                 break;
2454
2455         case SC_READ_12:
2456                 fsg->data_size_from_cmnd =
2457                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2458                 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
2459                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2460                                 "READ(12)")) == 0)
2461                         reply = do_read(fsg);
2462                 break;
2463
2464         case SC_READ_CAPACITY:
2465                 fsg->data_size_from_cmnd = 8;
2466                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2467                                 (0xf<<2) | (1<<8), 1,
2468                                 "READ CAPACITY")) == 0)
2469                         reply = do_read_capacity(fsg, bh);
2470                 break;
2471
2472         case SC_READ_HEADER:
2473                 if (!mod_data.cdrom)
2474                         goto unknown_cmnd;
2475                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2476                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2477                                 (3<<7) | (0x1f<<1), 1,
2478                                 "READ HEADER")) == 0)
2479                         reply = do_read_header(fsg, bh);
2480                 break;
2481
2482         case SC_READ_TOC:
2483                 if (!mod_data.cdrom)
2484                         goto unknown_cmnd;
2485                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2486                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2487                                 (7<<6) | (1<<1), 1,
2488                                 "READ TOC")) == 0)
2489                         reply = do_read_toc(fsg, bh);
2490                 break;
2491
2492         case SC_READ_FORMAT_CAPACITIES:
2493                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
2494                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2495                                 (3<<7), 1,
2496                                 "READ FORMAT CAPACITIES")) == 0)
2497                         reply = do_read_format_capacities(fsg, bh);
2498                 break;
2499
2500         case SC_REQUEST_SENSE:
2501                 fsg->data_size_from_cmnd = fsg->cmnd[4];
2502                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2503                                 (1<<4), 0,
2504                                 "REQUEST SENSE")) == 0)
2505                         reply = do_request_sense(fsg, bh);
2506                 break;
2507
2508         case SC_START_STOP_UNIT:
2509                 fsg->data_size_from_cmnd = 0;
2510                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2511                                 (1<<1) | (1<<4), 0,
2512                                 "START-STOP UNIT")) == 0)
2513                         reply = do_start_stop(fsg);
2514                 break;
2515
2516         case SC_SYNCHRONIZE_CACHE:
2517                 fsg->data_size_from_cmnd = 0;
2518                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2519                                 (0xf<<2) | (3<<7), 1,
2520                                 "SYNCHRONIZE CACHE")) == 0)
2521                         reply = do_synchronize_cache(fsg);
2522                 break;
2523
2524         case SC_TEST_UNIT_READY:
2525                 fsg->data_size_from_cmnd = 0;
2526                 reply = check_command(fsg, 6, DATA_DIR_NONE,
2527                                 0, 1,
2528                                 "TEST UNIT READY");
2529                 break;
2530
2531         /* Although optional, this command is used by MS-Windows.  We
2532          * support a minimal version: BytChk must be 0. */
2533         case SC_VERIFY:
2534                 fsg->data_size_from_cmnd = 0;
2535                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
2536                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2537                                 "VERIFY")) == 0)
2538                         reply = do_verify(fsg);
2539                 break;
2540
2541         case SC_WRITE_6:
2542                 i = fsg->cmnd[4];
2543                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2544                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2545                                 (7<<1) | (1<<4), 1,
2546                                 "WRITE(6)")) == 0)
2547                         reply = do_write(fsg);
2548                 break;
2549
2550         case SC_WRITE_10:
2551                 fsg->data_size_from_cmnd =
2552                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
2553                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2554                                 (1<<1) | (0xf<<2) | (3<<7), 1,
2555                                 "WRITE(10)")) == 0)
2556                         reply = do_write(fsg);
2557                 break;
2558
2559         case SC_WRITE_12:
2560                 fsg->data_size_from_cmnd =
2561                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
2562                 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
2563                                 (1<<1) | (0xf<<2) | (0xf<<6), 1,
2564                                 "WRITE(12)")) == 0)
2565                         reply = do_write(fsg);
2566                 break;
2567
2568         /* Some mandatory commands that we recognize but don't implement.
2569          * They don't mean much in this setting.  It's left as an exercise
2570          * for anyone interested to implement RESERVE and RELEASE in terms
2571          * of Posix locks. */
2572         case SC_FORMAT_UNIT:
2573         case SC_RELEASE:
2574         case SC_RESERVE:
2575         case SC_SEND_DIAGNOSTIC:
2576                 // Fall through
2577
2578         default:
2579  unknown_cmnd:
2580                 fsg->data_size_from_cmnd = 0;
2581                 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
2582                 if ((reply = check_command(fsg, fsg->cmnd_size,
2583                                 DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
2584                         fsg->curlun->sense_data = SS_INVALID_COMMAND;
2585                         reply = -EINVAL;
2586                 }
2587                 break;
2588         }
2589         up_read(&fsg->filesem);
2590
2591         if (reply == -EINTR || signal_pending(current))
2592                 return -EINTR;
2593
2594         /* Set up the single reply buffer for finish_reply() */
2595         if (reply == -EINVAL)
2596                 reply = 0;              // Error reply length
2597         if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
2598                 reply = min((u32) reply, fsg->data_size_from_cmnd);
2599                 bh->inreq->length = reply;
2600                 bh->state = BUF_STATE_FULL;
2601                 fsg->residue -= reply;
2602         }                               // Otherwise it's already set
2603
2604         return 0;
2605 }
2606
2607
2608 /*-------------------------------------------------------------------------*/
2609
2610 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2611 {
2612         struct usb_request      *req = bh->outreq;
2613         struct bulk_cb_wrap     *cbw = req->buf;
2614
2615         /* Was this a real packet?  Should it be ignored? */
2616         if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2617                 return -EINVAL;
2618
2619         /* Is the CBW valid? */
2620         if (req->actual != USB_BULK_CB_WRAP_LEN ||
2621                         cbw->Signature != cpu_to_le32(
2622                                 USB_BULK_CB_SIG)) {
2623                 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2624                                 req->actual,
2625                                 le32_to_cpu(cbw->Signature));
2626
2627                 /* The Bulk-only spec says we MUST stall the IN endpoint
2628                  * (6.6.1), so it's unavoidable.  It also says we must
2629                  * retain this state until the next reset, but there's
2630                  * no way to tell the controller driver it should ignore
2631                  * Clear-Feature(HALT) requests.
2632                  *
2633                  * We aren't required to halt the OUT endpoint; instead
2634                  * we can simply accept and discard any data received
2635                  * until the next reset. */
2636                 wedge_bulk_in_endpoint(fsg);
2637                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2638                 return -EINVAL;
2639         }
2640
2641         /* Is the CBW meaningful? */
2642         if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2643                         cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
2644                 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2645                                 "cmdlen %u\n",
2646                                 cbw->Lun, cbw->Flags, cbw->Length);
2647
2648                 /* We can do anything we want here, so let's stall the
2649                  * bulk pipes if we are allowed to. */
2650                 if (mod_data.can_stall) {
2651                         fsg_set_halt(fsg, fsg->bulk_out);
2652                         halt_bulk_in_endpoint(fsg);
2653                 }
2654                 return -EINVAL;
2655         }
2656
2657         /* Save the command for later */
2658         fsg->cmnd_size = cbw->Length;
2659         memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
2660         if (cbw->Flags & USB_BULK_IN_FLAG)
2661                 fsg->data_dir = DATA_DIR_TO_HOST;
2662         else
2663                 fsg->data_dir = DATA_DIR_FROM_HOST;
2664         fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
2665         if (fsg->data_size == 0)
2666                 fsg->data_dir = DATA_DIR_NONE;
2667         fsg->lun = cbw->Lun;
2668         fsg->tag = cbw->Tag;
2669         return 0;
2670 }
2671
2672
2673 static int get_next_command(struct fsg_dev *fsg)
2674 {
2675         struct fsg_buffhd       *bh;
2676         int                     rc = 0;
2677
2678         if (transport_is_bbb()) {
2679
2680                 /* Wait for the next buffer to become available */
2681                 bh = fsg->next_buffhd_to_fill;
2682                 while (bh->state != BUF_STATE_EMPTY) {
2683                         rc = sleep_thread(fsg);
2684                         if (rc)
2685                                 return rc;
2686                 }
2687
2688                 /* Queue a request to read a Bulk-only CBW */
2689                 set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
2690                 bh->outreq->short_not_ok = 1;
2691                 start_transfer(fsg, fsg->bulk_out, bh->outreq,
2692                                 &bh->outreq_busy, &bh->state);
2693
2694                 /* We will drain the buffer in software, which means we
2695                  * can reuse it for the next filling.  No need to advance
2696                  * next_buffhd_to_fill. */
2697
2698                 /* Wait for the CBW to arrive */
2699                 while (bh->state != BUF_STATE_FULL) {
2700                         rc = sleep_thread(fsg);
2701                         if (rc)
2702                                 return rc;
2703                 }
2704                 smp_rmb();
2705                 rc = received_cbw(fsg, bh);
2706                 bh->state = BUF_STATE_EMPTY;
2707
2708         } else {                // USB_PR_CB or USB_PR_CBI
2709
2710                 /* Wait for the next command to arrive */
2711                 while (fsg->cbbuf_cmnd_size == 0) {
2712                         rc = sleep_thread(fsg);
2713                         if (rc)
2714                                 return rc;
2715                 }
2716
2717                 /* Is the previous status interrupt request still busy?
2718                  * The host is allowed to skip reading the status,
2719                  * so we must cancel it. */
2720                 if (fsg->intreq_busy)
2721                         usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2722
2723                 /* Copy the command and mark the buffer empty */
2724                 fsg->data_dir = DATA_DIR_UNKNOWN;
2725                 spin_lock_irq(&fsg->lock);
2726                 fsg->cmnd_size = fsg->cbbuf_cmnd_size;
2727                 memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
2728                 fsg->cbbuf_cmnd_size = 0;
2729                 spin_unlock_irq(&fsg->lock);
2730         }
2731         return rc;
2732 }
2733
2734
2735 /*-------------------------------------------------------------------------*/
2736
2737 static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
2738                 const struct usb_endpoint_descriptor *d)
2739 {
2740         int     rc;
2741
2742         ep->driver_data = fsg;
2743         rc = usb_ep_enable(ep, d);
2744         if (rc)
2745                 ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
2746         return rc;
2747 }
2748
2749 static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
2750                 struct usb_request **preq)
2751 {
2752         *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2753         if (*preq)
2754                 return 0;
2755         ERROR(fsg, "can't allocate request for %s\n", ep->name);
2756         return -ENOMEM;
2757 }
2758
2759 /*
2760  * Reset interface setting and re-init endpoint state (toggle etc).
2761  * Call with altsetting < 0 to disable the interface.  The only other
2762  * available altsetting is 0, which enables the interface.
2763  */
2764 static int do_set_interface(struct fsg_dev *fsg, int altsetting)
2765 {
2766         int     rc = 0;
2767         int     i;
2768         const struct usb_endpoint_descriptor    *d;
2769
2770         if (fsg->running)
2771                 DBG(fsg, "reset interface\n");
2772
2773 reset:
2774         /* Deallocate the requests */
2775         for (i = 0; i < NUM_BUFFERS; ++i) {
2776                 struct fsg_buffhd *bh = &fsg->buffhds[i];
2777
2778                 if (bh->inreq) {
2779                         usb_ep_free_request(fsg->bulk_in, bh->inreq);
2780                         bh->inreq = NULL;
2781                 }
2782                 if (bh->outreq) {
2783                         usb_ep_free_request(fsg->bulk_out, bh->outreq);
2784                         bh->outreq = NULL;
2785                 }
2786         }
2787         if (fsg->intreq) {
2788                 usb_ep_free_request(fsg->intr_in, fsg->intreq);
2789                 fsg->intreq = NULL;
2790         }
2791
2792         /* Disable the endpoints */
2793         if (fsg->bulk_in_enabled) {
2794                 usb_ep_disable(fsg->bulk_in);
2795                 fsg->bulk_in_enabled = 0;
2796         }
2797         if (fsg->bulk_out_enabled) {
2798                 usb_ep_disable(fsg->bulk_out);
2799                 fsg->bulk_out_enabled = 0;
2800         }
2801         if (fsg->intr_in_enabled) {
2802                 usb_ep_disable(fsg->intr_in);
2803                 fsg->intr_in_enabled = 0;
2804         }
2805
2806         fsg->running = 0;
2807         if (altsetting < 0 || rc != 0)
2808                 return rc;
2809
2810         DBG(fsg, "set interface %d\n", altsetting);
2811
2812         /* Enable the endpoints */
2813         d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
2814         if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
2815                 goto reset;
2816         fsg->bulk_in_enabled = 1;
2817
2818         d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
2819         if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
2820                 goto reset;
2821         fsg->bulk_out_enabled = 1;
2822         fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
2823         clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2824
2825         if (transport_is_cbi()) {
2826                 d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
2827                 if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
2828                         goto reset;
2829                 fsg->intr_in_enabled = 1;
2830         }
2831
2832         /* Allocate the requests */
2833         for (i = 0; i < NUM_BUFFERS; ++i) {
2834                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
2835
2836                 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
2837                         goto reset;
2838                 if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
2839                         goto reset;
2840                 bh->inreq->buf = bh->outreq->buf = bh->buf;
2841                 bh->inreq->context = bh->outreq->context = bh;
2842                 bh->inreq->complete = bulk_in_complete;
2843                 bh->outreq->complete = bulk_out_complete;
2844         }
2845         if (transport_is_cbi()) {
2846                 if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
2847                         goto reset;
2848                 fsg->intreq->complete = intr_in_complete;
2849         }
2850
2851         fsg->running = 1;
2852         for (i = 0; i < fsg->nluns; ++i)
2853                 fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
2854         return rc;
2855 }
2856
2857
2858 /*
2859  * Change our operational configuration.  This code must agree with the code
2860  * that returns config descriptors, and with interface altsetting code.
2861  *
2862  * It's also responsible for power management interactions.  Some
2863  * configurations might not work with our current power sources.
2864  * For now we just assume the gadget is always self-powered.
2865  */
2866 static int do_set_config(struct fsg_dev *fsg, u8 new_config)
2867 {
2868         int     rc = 0;
2869
2870         /* Disable the single interface */
2871         if (fsg->config != 0) {
2872                 DBG(fsg, "reset config\n");
2873                 fsg->config = 0;
2874                 rc = do_set_interface(fsg, -1);
2875         }
2876
2877         /* Enable the interface */
2878         if (new_config != 0) {
2879                 fsg->config = new_config;
2880                 if ((rc = do_set_interface(fsg, 0)) != 0)
2881                         fsg->config = 0;        // Reset on errors
2882                 else {
2883                         char *speed;
2884
2885                         switch (fsg->gadget->speed) {
2886                         case USB_SPEED_LOW:     speed = "low";  break;
2887                         case USB_SPEED_FULL:    speed = "full"; break;
2888                         case USB_SPEED_HIGH:    speed = "high"; break;
2889                         default:                speed = "?";    break;
2890                         }
2891                         INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
2892                 }
2893         }
2894         return rc;
2895 }
2896
2897
2898 /*-------------------------------------------------------------------------*/
2899
2900 static void handle_exception(struct fsg_dev *fsg)
2901 {
2902         siginfo_t               info;
2903         int                     sig;
2904         int                     i;
2905         int                     num_active;
2906         struct fsg_buffhd       *bh;
2907         enum fsg_state          old_state;
2908         u8                      new_config;
2909         struct lun              *curlun;
2910         unsigned int            exception_req_tag;
2911         int                     rc;
2912
2913         /* Clear the existing signals.  Anything but SIGUSR1 is converted
2914          * into a high-priority EXIT exception. */
2915         for (;;) {
2916                 sig = dequeue_signal_lock(current, &current->blocked, &info);
2917                 if (!sig)
2918                         break;
2919                 if (sig != SIGUSR1) {
2920                         if (fsg->state < FSG_STATE_EXIT)
2921                                 DBG(fsg, "Main thread exiting on signal\n");
2922                         raise_exception(fsg, FSG_STATE_EXIT);
2923                 }
2924         }
2925
2926         /* Cancel all the pending transfers */
2927         if (fsg->intreq_busy)
2928                 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
2929         for (i = 0; i < NUM_BUFFERS; ++i) {
2930                 bh = &fsg->buffhds[i];
2931                 if (bh->inreq_busy)
2932                         usb_ep_dequeue(fsg->bulk_in, bh->inreq);
2933                 if (bh->outreq_busy)
2934                         usb_ep_dequeue(fsg->bulk_out, bh->outreq);
2935         }
2936
2937         /* Wait until everything is idle */
2938         for (;;) {
2939                 num_active = fsg->intreq_busy;
2940                 for (i = 0; i < NUM_BUFFERS; ++i) {
2941                         bh = &fsg->buffhds[i];
2942                         num_active += bh->inreq_busy + bh->outreq_busy;
2943                 }
2944                 if (num_active == 0)
2945                         break;
2946                 if (sleep_thread(fsg))
2947                         return;
2948         }
2949
2950         /* Clear out the controller's fifos */
2951         if (fsg->bulk_in_enabled)
2952                 usb_ep_fifo_flush(fsg->bulk_in);
2953         if (fsg->bulk_out_enabled)
2954                 usb_ep_fifo_flush(fsg->bulk_out);
2955         if (fsg->intr_in_enabled)
2956                 usb_ep_fifo_flush(fsg->intr_in);
2957
2958         /* Reset the I/O buffer states and pointers, the SCSI
2959          * state, and the exception.  Then invoke the handler. */
2960         spin_lock_irq(&fsg->lock);
2961
2962         for (i = 0; i < NUM_BUFFERS; ++i) {
2963                 bh = &fsg->buffhds[i];
2964                 bh->state = BUF_STATE_EMPTY;
2965         }
2966         fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
2967                         &fsg->buffhds[0];
2968
2969         exception_req_tag = fsg->exception_req_tag;
2970         new_config = fsg->new_config;
2971         old_state = fsg->state;
2972
2973         if (old_state == FSG_STATE_ABORT_BULK_OUT)
2974                 fsg->state = FSG_STATE_STATUS_PHASE;
2975         else {
2976                 for (i = 0; i < fsg->nluns; ++i) {
2977                         curlun = &fsg->luns[i];
2978                         curlun->prevent_medium_removal = 0;
2979                         curlun->sense_data = curlun->unit_attention_data =
2980                                         SS_NO_SENSE;
2981                         curlun->sense_data_info = 0;
2982                         curlun->info_valid = 0;
2983                 }
2984                 fsg->state = FSG_STATE_IDLE;
2985         }
2986         spin_unlock_irq(&fsg->lock);
2987
2988         /* Carry out any extra actions required for the exception */
2989         switch (old_state) {
2990         default:
2991                 break;
2992
2993         case FSG_STATE_ABORT_BULK_OUT:
2994                 send_status(fsg);
2995                 spin_lock_irq(&fsg->lock);
2996                 if (fsg->state == FSG_STATE_STATUS_PHASE)
2997                         fsg->state = FSG_STATE_IDLE;
2998                 spin_unlock_irq(&fsg->lock);
2999                 break;
3000
3001         case FSG_STATE_RESET:
3002                 /* In case we were forced against our will to halt a
3003                  * bulk endpoint, clear the halt now.  (The SuperH UDC
3004                  * requires this.) */
3005                 if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
3006                         usb_ep_clear_halt(fsg->bulk_in);
3007
3008                 if (transport_is_bbb()) {
3009                         if (fsg->ep0_req_tag == exception_req_tag)
3010                                 ep0_queue(fsg); // Complete the status stage
3011