USB: gadget: f_mass_storage: remove needless complete()
[firefly-linux-kernel-4.4.55.git] / drivers / usb / gadget / f_mass_storage.c
1 /*
2  * f_mass_storage.c -- Mass Storage USB Composite Function
3  *
4  * Copyright (C) 2003-2008 Alan Stern
5  * Copyright (C) 2009 Samsung Electronics
6  *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions, and the following disclaimer,
14  *    without modification.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. The names of the above-listed copyright holders may not be used
19  *    to endorse or promote products derived from this software without
20  *    specific prior written permission.
21  *
22  * ALTERNATIVELY, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") as published by the Free Software
24  * Foundation, either version 2 of that License or (at your option) any
25  * later version.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
28  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
29  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
31  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
32  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
33  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
34  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
35  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
36  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
37  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38  */
39
40
41 /*
42  * The Mass Storage Function acts as a USB Mass Storage device,
43  * appearing to the host as a disk drive or as a CD-ROM drive.  In
44  * addition to providing an example of a genuinely useful composite
45  * function for a USB device, it also illustrates a technique of
46  * double-buffering for increased throughput.
47  *
48  * Function supports multiple logical units (LUNs).  Backing storage
49  * for each LUN is provided by a regular file or a block device.
50  * Access for each LUN can be limited to read-only.  Moreover, the
51  * function can indicate that LUN is removable and/or CD-ROM.  (The
52  * later implies read-only access.)
53  *
54  * MSF is configured by specifying a fsg_config structure.  It has the
55  * following fields:
56  *
57  *      nluns           Number of LUNs function have (anywhere from 1
58  *                              to FSG_MAX_LUNS which is 8).
59  *      luns            An array of LUN configuration values.  This
60  *                              should be filled for each LUN that
61  *                              function will include (ie. for "nluns"
62  *                              LUNs).  Each element of the array has
63  *                              the following fields:
64  *      ->filename      The path to the backing file for the LUN.
65  *                              Required if LUN is not marked as
66  *                              removable.
67  *      ->ro            Flag specifying access to the LUN shall be
68  *                              read-only.  This is implied if CD-ROM
69  *                              emulation is enabled as well as when
70  *                              it was impossible to open "filename"
71  *                              in R/W mode.
72  *      ->removable     Flag specifying that LUN shall be indicated as
73  *                              being removable.
74  *      ->cdrom         Flag specifying that LUN shall be reported as
75  *                              being a CD-ROM.
76  *      ->nofua         Flag specifying that FUA flag in SCSI WRITE(10,12)
77  *                              commands for this LUN shall be ignored.
78  *
79  *      lun_name_format A printf-like format for names of the LUN
80  *                              devices.  This determines how the
81  *                              directory in sysfs will be named.
82  *                              Unless you are using several MSFs in
83  *                              a single gadget (as opposed to single
84  *                              MSF in many configurations) you may
85  *                              leave it as NULL (in which case
86  *                              "lun%d" will be used).  In the format
87  *                              you can use "%d" to index LUNs for
88  *                              MSF's with more than one LUN.  (Beware
89  *                              that there is only one integer given
90  *                              as an argument for the format and
91  *                              specifying invalid format may cause
92  *                              unspecified behaviour.)
93  *      thread_name     Name of the kernel thread process used by the
94  *                              MSF.  You can safely set it to NULL
95  *                              (in which case default "file-storage"
96  *                              will be used).
97  *
98  *      vendor_name
99  *      product_name
100  *      release         Information used as a reply to INQUIRY
101  *                              request.  To use default set to NULL,
102  *                              NULL, 0xffff respectively.  The first
103  *                              field should be 8 and the second 16
104  *                              characters or less.
105  *
106  *      can_stall       Set to permit function to halt bulk endpoints.
107  *                              Disabled on some USB devices known not
108  *                              to work correctly.  You should set it
109  *                              to true.
110  *
111  * If "removable" is not set for a LUN then a backing file must be
112  * specified.  If it is set, then NULL filename means the LUN's medium
113  * is not loaded (an empty string as "filename" in the fsg_config
114  * structure causes error).  The CD-ROM emulation includes a single
115  * data track and no audio tracks; hence there need be only one
116  * backing file per LUN.  Note also that the CD-ROM block length is
117  * set to 512 rather than the more common value 2048.
118  *
119  *
120  * MSF includes support for module parameters.  If gadget using it
121  * decides to use it, the following module parameters will be
122  * available:
123  *
124  *      file=filename[,filename...]
125  *                      Names of the files or block devices used for
126  *                              backing storage.
127  *      ro=b[,b...]     Default false, boolean for read-only access.
128  *      removable=b[,b...]
129  *                      Default true, boolean for removable media.
130  *      cdrom=b[,b...]  Default false, boolean for whether to emulate
131  *                              a CD-ROM drive.
132  *      nofua=b[,b...]  Default false, booleans for ignore FUA flag
133  *                              in SCSI WRITE(10,12) commands
134  *      luns=N          Default N = number of filenames, number of
135  *                              LUNs to support.
136  *      stall           Default determined according to the type of
137  *                              USB device controller (usually true),
138  *                              boolean to permit the driver to halt
139  *                              bulk endpoints.
140  *
141  * The module parameters may be prefixed with some string.  You need
142  * to consult gadget's documentation or source to verify whether it is
143  * using those module parameters and if it does what are the prefixes
144  * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
145  * the prefix).
146  *
147  *
148  * Requirements are modest; only a bulk-in and a bulk-out endpoint are
149  * needed.  The memory requirement amounts to two 16K buffers, size
150  * configurable by a parameter.  Support is included for both
151  * full-speed and high-speed operation.
152  *
153  * Note that the driver is slightly non-portable in that it assumes a
154  * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
155  * interrupt-in endpoints.  With most device controllers this isn't an
156  * issue, but there may be some with hardware restrictions that prevent
157  * a buffer from being used by more than one endpoint.
158  *
159  *
160  * The pathnames of the backing files and the ro settings are
161  * available in the attribute files "file" and "ro" in the lun<n> (or
162  * to be more precise in a directory which name comes from
163  * "lun_name_format" option!) subdirectory of the gadget's sysfs
164  * directory.  If the "removable" option is set, writing to these
165  * files will simulate ejecting/loading the medium (writing an empty
166  * line means eject) and adjusting a write-enable tab.  Changes to the
167  * ro setting are not allowed when the medium is loaded or if CD-ROM
168  * emulation is being used.
169  *
170  * When a LUN receive an "eject" SCSI request (Start/Stop Unit),
171  * if the LUN is removable, the backing file is released to simulate
172  * ejection.
173  *
174  *
175  * This function is heavily based on "File-backed Storage Gadget" by
176  * Alan Stern which in turn is heavily based on "Gadget Zero" by David
177  * Brownell.  The driver's SCSI command interface was based on the
178  * "Information technology - Small Computer System Interface - 2"
179  * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
180  * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
181  * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
182  * was based on the "Universal Serial Bus Mass Storage Class UFI
183  * Command Specification" document, Revision 1.0, December 14, 1998,
184  * available at
185  * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
186  */
187
188
189 /*
190  *                              Driver Design
191  *
192  * The MSF is fairly straightforward.  There is a main kernel
193  * thread that handles most of the work.  Interrupt routines field
194  * callbacks from the controller driver: bulk- and interrupt-request
195  * completion notifications, endpoint-0 events, and disconnect events.
196  * Completion events are passed to the main thread by wakeup calls.  Many
197  * ep0 requests are handled at interrupt time, but SetInterface,
198  * SetConfiguration, and device reset requests are forwarded to the
199  * thread in the form of "exceptions" using SIGUSR1 signals (since they
200  * should interrupt any ongoing file I/O operations).
201  *
202  * The thread's main routine implements the standard command/data/status
203  * parts of a SCSI interaction.  It and its subroutines are full of tests
204  * for pending signals/exceptions -- all this polling is necessary since
205  * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
206  * indication that the driver really wants to be running in userspace.)
207  * An important point is that so long as the thread is alive it keeps an
208  * open reference to the backing file.  This will prevent unmounting
209  * the backing file's underlying filesystem and could cause problems
210  * during system shutdown, for example.  To prevent such problems, the
211  * thread catches INT, TERM, and KILL signals and converts them into
212  * an EXIT exception.
213  *
214  * In normal operation the main thread is started during the gadget's
215  * fsg_bind() callback and stopped during fsg_unbind().  But it can
216  * also exit when it receives a signal, and there's no point leaving
217  * the gadget running when the thread is dead.  At of this moment, MSF
218  * provides no way to deregister the gadget when thread dies -- maybe
219  * a callback functions is needed.
220  *
221  * To provide maximum throughput, the driver uses a circular pipeline of
222  * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
223  * arbitrarily long; in practice the benefits don't justify having more
224  * than 2 stages (i.e., double buffering).  But it helps to think of the
225  * pipeline as being a long one.  Each buffer head contains a bulk-in and
226  * a bulk-out request pointer (since the buffer can be used for both
227  * output and input -- directions always are given from the host's
228  * point of view) as well as a pointer to the buffer and various state
229  * variables.
230  *
231  * Use of the pipeline follows a simple protocol.  There is a variable
232  * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
233  * At any time that buffer head may still be in use from an earlier
234  * request, so each buffer head has a state variable indicating whether
235  * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
236  * buffer head to be EMPTY, filling the buffer either by file I/O or by
237  * USB I/O (during which the buffer head is BUSY), and marking the buffer
238  * head FULL when the I/O is complete.  Then the buffer will be emptied
239  * (again possibly by USB I/O, during which it is marked BUSY) and
240  * finally marked EMPTY again (possibly by a completion routine).
241  *
242  * A module parameter tells the driver to avoid stalling the bulk
243  * endpoints wherever the transport specification allows.  This is
244  * necessary for some UDCs like the SuperH, which cannot reliably clear a
245  * halt on a bulk endpoint.  However, under certain circumstances the
246  * Bulk-only specification requires a stall.  In such cases the driver
247  * will halt the endpoint and set a flag indicating that it should clear
248  * the halt in software during the next device reset.  Hopefully this
249  * will permit everything to work correctly.  Furthermore, although the
250  * specification allows the bulk-out endpoint to halt when the host sends
251  * too much data, implementing this would cause an unavoidable race.
252  * The driver will always use the "no-stall" approach for OUT transfers.
253  *
254  * One subtle point concerns sending status-stage responses for ep0
255  * requests.  Some of these requests, such as device reset, can involve
256  * interrupting an ongoing file I/O operation, which might take an
257  * arbitrarily long time.  During that delay the host might give up on
258  * the original ep0 request and issue a new one.  When that happens the
259  * driver should not notify the host about completion of the original
260  * request, as the host will no longer be waiting for it.  So the driver
261  * assigns to each ep0 request a unique tag, and it keeps track of the
262  * tag value of the request associated with a long-running exception
263  * (device-reset, interface-change, or configuration-change).  When the
264  * exception handler is finished, the status-stage response is submitted
265  * only if the current ep0 request tag is equal to the exception request
266  * tag.  Thus only the most recently received ep0 request will get a
267  * status-stage response.
268  *
269  * Warning: This driver source file is too long.  It ought to be split up
270  * into a header file plus about 3 separate .c files, to handle the details
271  * of the Gadget, USB Mass Storage, and SCSI protocols.
272  */
273
274
275 /* #define VERBOSE_DEBUG */
276 /* #define DUMP_MSGS */
277
278
279 #include <linux/blkdev.h>
280 #include <linux/completion.h>
281 #include <linux/dcache.h>
282 #include <linux/delay.h>
283 #include <linux/device.h>
284 #include <linux/fcntl.h>
285 #include <linux/file.h>
286 #include <linux/fs.h>
287 #include <linux/kref.h>
288 #include <linux/kthread.h>
289 #include <linux/limits.h>
290 #include <linux/rwsem.h>
291 #include <linux/slab.h>
292 #include <linux/spinlock.h>
293 #include <linux/string.h>
294 #include <linux/freezer.h>
295 #include <linux/utsname.h>
296
297 #include <linux/usb/ch9.h>
298 #include <linux/usb/gadget.h>
299
300 #include "gadget_chips.h"
301
302
303
304 /*------------------------------------------------------------------------*/
305
306 #define FSG_DRIVER_DESC         "Mass Storage Function"
307 #define FSG_DRIVER_VERSION      "2009/09/11"
308
309 static const char fsg_string_interface[] = "Mass Storage";
310
311
312 #define FSG_NO_INTR_EP 1
313 #define FSG_NO_DEVICE_STRINGS    1
314 #define FSG_NO_OTG               1
315 #define FSG_NO_INTR_EP           1
316
317 #include "storage_common.c"
318
319
320 /*-------------------------------------------------------------------------*/
321
322 struct fsg_dev;
323 struct fsg_common;
324
325 /* FSF callback functions */
326 struct fsg_operations {
327         /* Callback function to call when thread exits.  If no
328          * callback is set or it returns value lower then zero MSF
329          * will force eject all LUNs it operates on (including those
330          * marked as non-removable or with prevent_medium_removal flag
331          * set). */
332         int (*thread_exits)(struct fsg_common *common);
333
334         /* Called prior to ejection.  Negative return means error,
335          * zero means to continue with ejection, positive means not to
336          * eject. */
337         int (*pre_eject)(struct fsg_common *common,
338                          struct fsg_lun *lun, int num);
339         /* Called after ejection.  Negative return means error, zero
340          * or positive is just a success. */
341         int (*post_eject)(struct fsg_common *common,
342                           struct fsg_lun *lun, int num);
343 };
344
345
346 /* Data shared by all the FSG instances. */
347 struct fsg_common {
348         struct usb_gadget       *gadget;
349         struct fsg_dev          *fsg, *new_fsg;
350         wait_queue_head_t       fsg_wait;
351
352         /* filesem protects: backing files in use */
353         struct rw_semaphore     filesem;
354
355         /* lock protects: state, all the req_busy's */
356         spinlock_t              lock;
357
358         struct usb_ep           *ep0;           /* Copy of gadget->ep0 */
359         struct usb_request      *ep0req;        /* Copy of cdev->req */
360         unsigned int            ep0_req_tag;
361
362         struct fsg_buffhd       *next_buffhd_to_fill;
363         struct fsg_buffhd       *next_buffhd_to_drain;
364         struct fsg_buffhd       buffhds[FSG_NUM_BUFFERS];
365
366         int                     cmnd_size;
367         u8                      cmnd[MAX_COMMAND_SIZE];
368
369         unsigned int            nluns;
370         unsigned int            lun;
371         struct fsg_lun          *luns;
372         struct fsg_lun          *curlun;
373
374         unsigned int            bulk_out_maxpacket;
375         enum fsg_state          state;          /* For exception handling */
376         unsigned int            exception_req_tag;
377
378         enum data_direction     data_dir;
379         u32                     data_size;
380         u32                     data_size_from_cmnd;
381         u32                     tag;
382         u32                     residue;
383         u32                     usb_amount_left;
384
385         unsigned int            can_stall:1;
386         unsigned int            free_storage_on_release:1;
387         unsigned int            phase_error:1;
388         unsigned int            short_packet_received:1;
389         unsigned int            bad_lun_okay:1;
390         unsigned int            running:1;
391
392         int                     thread_wakeup_needed;
393         struct completion       thread_notifier;
394         struct task_struct      *thread_task;
395
396         /* Callback functions. */
397         const struct fsg_operations     *ops;
398         /* Gadget's private data. */
399         void                    *private_data;
400
401         /* Vendor (8 chars), product (16 chars), release (4
402          * hexadecimal digits) and NUL byte */
403         char inquiry_string[8 + 16 + 4 + 1];
404
405         struct kref             ref;
406 };
407
408
409 struct fsg_config {
410         unsigned nluns;
411         struct fsg_lun_config {
412                 const char *filename;
413                 char ro;
414                 char removable;
415                 char cdrom;
416                 char nofua;
417         } luns[FSG_MAX_LUNS];
418
419         const char              *lun_name_format;
420         const char              *thread_name;
421
422         /* Callback functions. */
423         const struct fsg_operations     *ops;
424         /* Gadget's private data. */
425         void                    *private_data;
426
427         const char *vendor_name;                /*  8 characters or less */
428         const char *product_name;               /* 16 characters or less */
429         u16 release;
430
431         char                    can_stall;
432 };
433
434
435 struct fsg_dev {
436         struct usb_function     function;
437         struct usb_gadget       *gadget;        /* Copy of cdev->gadget */
438         struct fsg_common       *common;
439
440         u16                     interface_number;
441
442         unsigned int            bulk_in_enabled:1;
443         unsigned int            bulk_out_enabled:1;
444
445         unsigned long           atomic_bitflags;
446 #define IGNORE_BULK_OUT         0
447
448         struct usb_ep           *bulk_in;
449         struct usb_ep           *bulk_out;
450 };
451
452
453 static inline int __fsg_is_set(struct fsg_common *common,
454                                const char *func, unsigned line)
455 {
456         if (common->fsg)
457                 return 1;
458         ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
459         WARN_ON(1);
460         return 0;
461 }
462
463 #define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
464
465
466 static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
467 {
468         return container_of(f, struct fsg_dev, function);
469 }
470
471
472 typedef void (*fsg_routine_t)(struct fsg_dev *);
473
474 static int exception_in_progress(struct fsg_common *common)
475 {
476         return common->state > FSG_STATE_IDLE;
477 }
478
479 /* Make bulk-out requests be divisible by the maxpacket size */
480 static void set_bulk_out_req_length(struct fsg_common *common,
481                 struct fsg_buffhd *bh, unsigned int length)
482 {
483         unsigned int    rem;
484
485         bh->bulk_out_intended_length = length;
486         rem = length % common->bulk_out_maxpacket;
487         if (rem > 0)
488                 length += common->bulk_out_maxpacket - rem;
489         bh->outreq->length = length;
490 }
491
492 /*-------------------------------------------------------------------------*/
493
494 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
495 {
496         const char      *name;
497
498         if (ep == fsg->bulk_in)
499                 name = "bulk-in";
500         else if (ep == fsg->bulk_out)
501                 name = "bulk-out";
502         else
503                 name = ep->name;
504         DBG(fsg, "%s set halt\n", name);
505         return usb_ep_set_halt(ep);
506 }
507
508
509 /*-------------------------------------------------------------------------*/
510
511 /* These routines may be called in process context or in_irq */
512
513 /* Caller must hold fsg->lock */
514 static void wakeup_thread(struct fsg_common *common)
515 {
516         /* Tell the main thread that something has happened */
517         common->thread_wakeup_needed = 1;
518         if (common->thread_task)
519                 wake_up_process(common->thread_task);
520 }
521
522
523 static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
524 {
525         unsigned long           flags;
526
527         /* Do nothing if a higher-priority exception is already in progress.
528          * If a lower-or-equal priority exception is in progress, preempt it
529          * and notify the main thread by sending it a signal. */
530         spin_lock_irqsave(&common->lock, flags);
531         if (common->state <= new_state) {
532                 common->exception_req_tag = common->ep0_req_tag;
533                 common->state = new_state;
534                 if (common->thread_task)
535                         send_sig_info(SIGUSR1, SEND_SIG_FORCED,
536                                       common->thread_task);
537         }
538         spin_unlock_irqrestore(&common->lock, flags);
539 }
540
541
542 /*-------------------------------------------------------------------------*/
543
544 static int ep0_queue(struct fsg_common *common)
545 {
546         int     rc;
547
548         rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC);
549         common->ep0->driver_data = common;
550         if (rc != 0 && rc != -ESHUTDOWN) {
551                 /* We can't do much more than wait for a reset */
552                 WARNING(common, "error in submission: %s --> %d\n",
553                         common->ep0->name, rc);
554         }
555         return rc;
556 }
557
558 /*-------------------------------------------------------------------------*/
559
560 /* Bulk and interrupt endpoint completion handlers.
561  * These always run in_irq. */
562
563 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
564 {
565         struct fsg_common       *common = ep->driver_data;
566         struct fsg_buffhd       *bh = req->context;
567
568         if (req->status || req->actual != req->length)
569                 DBG(common, "%s --> %d, %u/%u\n", __func__,
570                                 req->status, req->actual, req->length);
571         if (req->status == -ECONNRESET)         /* Request was cancelled */
572                 usb_ep_fifo_flush(ep);
573
574         /* Hold the lock while we update the request and buffer states */
575         smp_wmb();
576         spin_lock(&common->lock);
577         bh->inreq_busy = 0;
578         bh->state = BUF_STATE_EMPTY;
579         wakeup_thread(common);
580         spin_unlock(&common->lock);
581 }
582
583 static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
584 {
585         struct fsg_common       *common = ep->driver_data;
586         struct fsg_buffhd       *bh = req->context;
587
588         dump_msg(common, "bulk-out", req->buf, req->actual);
589         if (req->status || req->actual != bh->bulk_out_intended_length)
590                 DBG(common, "%s --> %d, %u/%u\n", __func__,
591                                 req->status, req->actual,
592                                 bh->bulk_out_intended_length);
593         if (req->status == -ECONNRESET)         /* Request was cancelled */
594                 usb_ep_fifo_flush(ep);
595
596         /* Hold the lock while we update the request and buffer states */
597         smp_wmb();
598         spin_lock(&common->lock);
599         bh->outreq_busy = 0;
600         bh->state = BUF_STATE_FULL;
601         wakeup_thread(common);
602         spin_unlock(&common->lock);
603 }
604
605
606 /*-------------------------------------------------------------------------*/
607
608 /* Ep0 class-specific handlers.  These always run in_irq. */
609
610 static int fsg_setup(struct usb_function *f,
611                 const struct usb_ctrlrequest *ctrl)
612 {
613         struct fsg_dev          *fsg = fsg_from_func(f);
614         struct usb_request      *req = fsg->common->ep0req;
615         u16                     w_index = le16_to_cpu(ctrl->wIndex);
616         u16                     w_value = le16_to_cpu(ctrl->wValue);
617         u16                     w_length = le16_to_cpu(ctrl->wLength);
618
619         if (!fsg_is_set(fsg->common))
620                 return -EOPNOTSUPP;
621
622         switch (ctrl->bRequest) {
623
624         case USB_BULK_RESET_REQUEST:
625                 if (ctrl->bRequestType !=
626                     (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
627                         break;
628                 if (w_index != fsg->interface_number || w_value != 0)
629                         return -EDOM;
630
631                 /* Raise an exception to stop the current operation
632                  * and reinitialize our state. */
633                 DBG(fsg, "bulk reset request\n");
634                 raise_exception(fsg->common, FSG_STATE_RESET);
635                 return DELAYED_STATUS;
636
637         case USB_BULK_GET_MAX_LUN_REQUEST:
638                 if (ctrl->bRequestType !=
639                     (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
640                         break;
641                 if (w_index != fsg->interface_number || w_value != 0)
642                         return -EDOM;
643                 VDBG(fsg, "get max LUN\n");
644                 *(u8 *) req->buf = fsg->common->nluns - 1;
645
646                 /* Respond with data/status */
647                 req->length = min((u16)1, w_length);
648                 return ep0_queue(fsg->common);
649         }
650
651         VDBG(fsg,
652              "unknown class-specific control req "
653              "%02x.%02x v%04x i%04x l%u\n",
654              ctrl->bRequestType, ctrl->bRequest,
655              le16_to_cpu(ctrl->wValue), w_index, w_length);
656         return -EOPNOTSUPP;
657 }
658
659
660 /*-------------------------------------------------------------------------*/
661
662 /* All the following routines run in process context */
663
664
665 /* Use this for bulk or interrupt transfers, not ep0 */
666 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
667                 struct usb_request *req, int *pbusy,
668                 enum fsg_buffer_state *state)
669 {
670         int     rc;
671
672         if (ep == fsg->bulk_in)
673                 dump_msg(fsg, "bulk-in", req->buf, req->length);
674
675         spin_lock_irq(&fsg->common->lock);
676         *pbusy = 1;
677         *state = BUF_STATE_BUSY;
678         spin_unlock_irq(&fsg->common->lock);
679         rc = usb_ep_queue(ep, req, GFP_KERNEL);
680         if (rc != 0) {
681                 *pbusy = 0;
682                 *state = BUF_STATE_EMPTY;
683
684                 /* We can't do much more than wait for a reset */
685
686                 /* Note: currently the net2280 driver fails zero-length
687                  * submissions if DMA is enabled. */
688                 if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
689                                                 req->length == 0))
690                         WARNING(fsg, "error in submission: %s --> %d\n",
691                                         ep->name, rc);
692         }
693 }
694
695 static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
696 {
697         if (!fsg_is_set(common))
698                 return false;
699         start_transfer(common->fsg, common->fsg->bulk_in,
700                        bh->inreq, &bh->inreq_busy, &bh->state);
701         return true;
702 }
703
704 static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
705 {
706         if (!fsg_is_set(common))
707                 return false;
708         start_transfer(common->fsg, common->fsg->bulk_out,
709                        bh->outreq, &bh->outreq_busy, &bh->state);
710         return true;
711 }
712
713 static int sleep_thread(struct fsg_common *common)
714 {
715         int     rc = 0;
716
717         /* Wait until a signal arrives or we are woken up */
718         for (;;) {
719                 try_to_freeze();
720                 set_current_state(TASK_INTERRUPTIBLE);
721                 if (signal_pending(current)) {
722                         rc = -EINTR;
723                         break;
724                 }
725                 if (common->thread_wakeup_needed)
726                         break;
727                 schedule();
728         }
729         __set_current_state(TASK_RUNNING);
730         common->thread_wakeup_needed = 0;
731         return rc;
732 }
733
734
735 /*-------------------------------------------------------------------------*/
736
737 static int do_read(struct fsg_common *common)
738 {
739         struct fsg_lun          *curlun = common->curlun;
740         u32                     lba;
741         struct fsg_buffhd       *bh;
742         int                     rc;
743         u32                     amount_left;
744         loff_t                  file_offset, file_offset_tmp;
745         unsigned int            amount;
746         unsigned int            partial_page;
747         ssize_t                 nread;
748
749         /* Get the starting Logical Block Address and check that it's
750          * not too big */
751         if (common->cmnd[0] == READ_6)
752                 lba = get_unaligned_be24(&common->cmnd[1]);
753         else {
754                 lba = get_unaligned_be32(&common->cmnd[2]);
755
756                 /* We allow DPO (Disable Page Out = don't save data in the
757                  * cache) and FUA (Force Unit Access = don't read from the
758                  * cache), but we don't implement them. */
759                 if ((common->cmnd[1] & ~0x18) != 0) {
760                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
761                         return -EINVAL;
762                 }
763         }
764         if (lba >= curlun->num_sectors) {
765                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
766                 return -EINVAL;
767         }
768         file_offset = ((loff_t) lba) << 9;
769
770         /* Carry out the file reads */
771         amount_left = common->data_size_from_cmnd;
772         if (unlikely(amount_left == 0))
773                 return -EIO;            /* No default reply */
774
775         for (;;) {
776
777                 /* Figure out how much we need to read:
778                  * Try to read the remaining amount.
779                  * But don't read more than the buffer size.
780                  * And don't try to read past the end of the file.
781                  * Finally, if we're not at a page boundary, don't read past
782                  *      the next page.
783                  * If this means reading 0 then we were asked to read past
784                  *      the end of file. */
785                 amount = min(amount_left, FSG_BUFLEN);
786                 amount = min((loff_t) amount,
787                                 curlun->file_length - file_offset);
788                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
789                 if (partial_page > 0)
790                         amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
791                                         partial_page);
792
793                 /* Wait for the next buffer to become available */
794                 bh = common->next_buffhd_to_fill;
795                 while (bh->state != BUF_STATE_EMPTY) {
796                         rc = sleep_thread(common);
797                         if (rc)
798                                 return rc;
799                 }
800
801                 /* If we were asked to read past the end of file,
802                  * end with an empty buffer. */
803                 if (amount == 0) {
804                         curlun->sense_data =
805                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
806                         curlun->sense_data_info = file_offset >> 9;
807                         curlun->info_valid = 1;
808                         bh->inreq->length = 0;
809                         bh->state = BUF_STATE_FULL;
810                         break;
811                 }
812
813                 /* Perform the read */
814                 file_offset_tmp = file_offset;
815                 nread = vfs_read(curlun->filp,
816                                 (char __user *) bh->buf,
817                                 amount, &file_offset_tmp);
818                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
819                                 (unsigned long long) file_offset,
820                                 (int) nread);
821                 if (signal_pending(current))
822                         return -EINTR;
823
824                 if (nread < 0) {
825                         LDBG(curlun, "error in file read: %d\n",
826                                         (int) nread);
827                         nread = 0;
828                 } else if (nread < amount) {
829                         LDBG(curlun, "partial file read: %d/%u\n",
830                                         (int) nread, amount);
831                         nread -= (nread & 511); /* Round down to a block */
832                 }
833                 file_offset  += nread;
834                 amount_left  -= nread;
835                 common->residue -= nread;
836                 bh->inreq->length = nread;
837                 bh->state = BUF_STATE_FULL;
838
839                 /* If an error occurred, report it and its position */
840                 if (nread < amount) {
841                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
842                         curlun->sense_data_info = file_offset >> 9;
843                         curlun->info_valid = 1;
844                         break;
845                 }
846
847                 if (amount_left == 0)
848                         break;          /* No more left to read */
849
850                 /* Send this buffer and go read some more */
851                 bh->inreq->zero = 0;
852                 if (!start_in_transfer(common, bh))
853                         /* Don't know what to do if common->fsg is NULL */
854                         return -EIO;
855                 common->next_buffhd_to_fill = bh->next;
856         }
857
858         return -EIO;            /* No default reply */
859 }
860
861
862 /*-------------------------------------------------------------------------*/
863
864 static int do_write(struct fsg_common *common)
865 {
866         struct fsg_lun          *curlun = common->curlun;
867         u32                     lba;
868         struct fsg_buffhd       *bh;
869         int                     get_some_more;
870         u32                     amount_left_to_req, amount_left_to_write;
871         loff_t                  usb_offset, file_offset, file_offset_tmp;
872         unsigned int            amount;
873         unsigned int            partial_page;
874         ssize_t                 nwritten;
875         int                     rc;
876
877         if (curlun->ro) {
878                 curlun->sense_data = SS_WRITE_PROTECTED;
879                 return -EINVAL;
880         }
881         spin_lock(&curlun->filp->f_lock);
882         curlun->filp->f_flags &= ~O_SYNC;       /* Default is not to wait */
883         spin_unlock(&curlun->filp->f_lock);
884
885         /* Get the starting Logical Block Address and check that it's
886          * not too big */
887         if (common->cmnd[0] == WRITE_6)
888                 lba = get_unaligned_be24(&common->cmnd[1]);
889         else {
890                 lba = get_unaligned_be32(&common->cmnd[2]);
891
892                 /* We allow DPO (Disable Page Out = don't save data in the
893                  * cache) and FUA (Force Unit Access = write directly to the
894                  * medium).  We don't implement DPO; we implement FUA by
895                  * performing synchronous output. */
896                 if (common->cmnd[1] & ~0x18) {
897                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
898                         return -EINVAL;
899                 }
900                 if (!curlun->nofua && (common->cmnd[1] & 0x08)) { /* FUA */
901                         spin_lock(&curlun->filp->f_lock);
902                         curlun->filp->f_flags |= O_SYNC;
903                         spin_unlock(&curlun->filp->f_lock);
904                 }
905         }
906         if (lba >= curlun->num_sectors) {
907                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
908                 return -EINVAL;
909         }
910
911         /* Carry out the file writes */
912         get_some_more = 1;
913         file_offset = usb_offset = ((loff_t) lba) << 9;
914         amount_left_to_req = common->data_size_from_cmnd;
915         amount_left_to_write = common->data_size_from_cmnd;
916
917         while (amount_left_to_write > 0) {
918
919                 /* Queue a request for more data from the host */
920                 bh = common->next_buffhd_to_fill;
921                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
922
923                         /* Figure out how much we want to get:
924                          * Try to get the remaining amount.
925                          * But don't get more than the buffer size.
926                          * And don't try to go past the end of the file.
927                          * If we're not at a page boundary,
928                          *      don't go past the next page.
929                          * If this means getting 0, then we were asked
930                          *      to write past the end of file.
931                          * Finally, round down to a block boundary. */
932                         amount = min(amount_left_to_req, FSG_BUFLEN);
933                         amount = min((loff_t) amount, curlun->file_length -
934                                         usb_offset);
935                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
936                         if (partial_page > 0)
937                                 amount = min(amount,
938         (unsigned int) PAGE_CACHE_SIZE - partial_page);
939
940                         if (amount == 0) {
941                                 get_some_more = 0;
942                                 curlun->sense_data =
943                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
944                                 curlun->sense_data_info = usb_offset >> 9;
945                                 curlun->info_valid = 1;
946                                 continue;
947                         }
948                         amount -= (amount & 511);
949                         if (amount == 0) {
950
951                                 /* Why were we were asked to transfer a
952                                  * partial block? */
953                                 get_some_more = 0;
954                                 continue;
955                         }
956
957                         /* Get the next buffer */
958                         usb_offset += amount;
959                         common->usb_amount_left -= amount;
960                         amount_left_to_req -= amount;
961                         if (amount_left_to_req == 0)
962                                 get_some_more = 0;
963
964                         /* amount is always divisible by 512, hence by
965                          * the bulk-out maxpacket size */
966                         bh->outreq->length = amount;
967                         bh->bulk_out_intended_length = amount;
968                         bh->outreq->short_not_ok = 1;
969                         if (!start_out_transfer(common, bh))
970                                 /* Don't know what to do if
971                                  * common->fsg is NULL */
972                                 return -EIO;
973                         common->next_buffhd_to_fill = bh->next;
974                         continue;
975                 }
976
977                 /* Write the received data to the backing file */
978                 bh = common->next_buffhd_to_drain;
979                 if (bh->state == BUF_STATE_EMPTY && !get_some_more)
980                         break;                  /* We stopped early */
981                 if (bh->state == BUF_STATE_FULL) {
982                         smp_rmb();
983                         common->next_buffhd_to_drain = bh->next;
984                         bh->state = BUF_STATE_EMPTY;
985
986                         /* Did something go wrong with the transfer? */
987                         if (bh->outreq->status != 0) {
988                                 curlun->sense_data = SS_COMMUNICATION_FAILURE;
989                                 curlun->sense_data_info = file_offset >> 9;
990                                 curlun->info_valid = 1;
991                                 break;
992                         }
993
994                         amount = bh->outreq->actual;
995                         if (curlun->file_length - file_offset < amount) {
996                                 LERROR(curlun,
997         "write %u @ %llu beyond end %llu\n",
998         amount, (unsigned long long) file_offset,
999         (unsigned long long) curlun->file_length);
1000                                 amount = curlun->file_length - file_offset;
1001                         }
1002
1003                         /* Perform the write */
1004                         file_offset_tmp = file_offset;
1005                         nwritten = vfs_write(curlun->filp,
1006                                         (char __user *) bh->buf,
1007                                         amount, &file_offset_tmp);
1008                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
1009                                         (unsigned long long) file_offset,
1010                                         (int) nwritten);
1011                         if (signal_pending(current))
1012                                 return -EINTR;          /* Interrupted! */
1013
1014                         if (nwritten < 0) {
1015                                 LDBG(curlun, "error in file write: %d\n",
1016                                                 (int) nwritten);
1017                                 nwritten = 0;
1018                         } else if (nwritten < amount) {
1019                                 LDBG(curlun, "partial file write: %d/%u\n",
1020                                                 (int) nwritten, amount);
1021                                 nwritten -= (nwritten & 511);
1022                                 /* Round down to a block */
1023                         }
1024                         file_offset += nwritten;
1025                         amount_left_to_write -= nwritten;
1026                         common->residue -= nwritten;
1027
1028                         /* If an error occurred, report it and its position */
1029                         if (nwritten < amount) {
1030                                 curlun->sense_data = SS_WRITE_ERROR;
1031                                 curlun->sense_data_info = file_offset >> 9;
1032                                 curlun->info_valid = 1;
1033                                 break;
1034                         }
1035
1036                         /* Did the host decide to stop early? */
1037                         if (bh->outreq->actual != bh->outreq->length) {
1038                                 common->short_packet_received = 1;
1039                                 break;
1040                         }
1041                         continue;
1042                 }
1043
1044                 /* Wait for something to happen */
1045                 rc = sleep_thread(common);
1046                 if (rc)
1047                         return rc;
1048         }
1049
1050         return -EIO;            /* No default reply */
1051 }
1052
1053
1054 /*-------------------------------------------------------------------------*/
1055
1056 static int do_synchronize_cache(struct fsg_common *common)
1057 {
1058         struct fsg_lun  *curlun = common->curlun;
1059         int             rc;
1060
1061         /* We ignore the requested LBA and write out all file's
1062          * dirty data buffers. */
1063         rc = fsg_lun_fsync_sub(curlun);
1064         if (rc)
1065                 curlun->sense_data = SS_WRITE_ERROR;
1066         return 0;
1067 }
1068
1069
1070 /*-------------------------------------------------------------------------*/
1071
1072 static void invalidate_sub(struct fsg_lun *curlun)
1073 {
1074         struct file     *filp = curlun->filp;
1075         struct inode    *inode = filp->f_path.dentry->d_inode;
1076         unsigned long   rc;
1077
1078         rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
1079         VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
1080 }
1081
1082 static int do_verify(struct fsg_common *common)
1083 {
1084         struct fsg_lun          *curlun = common->curlun;
1085         u32                     lba;
1086         u32                     verification_length;
1087         struct fsg_buffhd       *bh = common->next_buffhd_to_fill;
1088         loff_t                  file_offset, file_offset_tmp;
1089         u32                     amount_left;
1090         unsigned int            amount;
1091         ssize_t                 nread;
1092
1093         /* Get the starting Logical Block Address and check that it's
1094          * not too big */
1095         lba = get_unaligned_be32(&common->cmnd[2]);
1096         if (lba >= curlun->num_sectors) {
1097                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1098                 return -EINVAL;
1099         }
1100
1101         /* We allow DPO (Disable Page Out = don't save data in the
1102          * cache) but we don't implement it. */
1103         if (common->cmnd[1] & ~0x10) {
1104                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1105                 return -EINVAL;
1106         }
1107
1108         verification_length = get_unaligned_be16(&common->cmnd[7]);
1109         if (unlikely(verification_length == 0))
1110                 return -EIO;            /* No default reply */
1111
1112         /* Prepare to carry out the file verify */
1113         amount_left = verification_length << 9;
1114         file_offset = ((loff_t) lba) << 9;
1115
1116         /* Write out all the dirty buffers before invalidating them */
1117         fsg_lun_fsync_sub(curlun);
1118         if (signal_pending(current))
1119                 return -EINTR;
1120
1121         invalidate_sub(curlun);
1122         if (signal_pending(current))
1123                 return -EINTR;
1124
1125         /* Just try to read the requested blocks */
1126         while (amount_left > 0) {
1127
1128                 /* Figure out how much we need to read:
1129                  * Try to read the remaining amount, but not more than
1130                  * the buffer size.
1131                  * And don't try to read past the end of the file.
1132                  * If this means reading 0 then we were asked to read
1133                  * past the end of file. */
1134                 amount = min(amount_left, FSG_BUFLEN);
1135                 amount = min((loff_t) amount,
1136                                 curlun->file_length - file_offset);
1137                 if (amount == 0) {
1138                         curlun->sense_data =
1139                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1140                         curlun->sense_data_info = file_offset >> 9;
1141                         curlun->info_valid = 1;
1142                         break;
1143                 }
1144
1145                 /* Perform the read */
1146                 file_offset_tmp = file_offset;
1147                 nread = vfs_read(curlun->filp,
1148                                 (char __user *) bh->buf,
1149                                 amount, &file_offset_tmp);
1150                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1151                                 (unsigned long long) file_offset,
1152                                 (int) nread);
1153                 if (signal_pending(current))
1154                         return -EINTR;
1155
1156                 if (nread < 0) {
1157                         LDBG(curlun, "error in file verify: %d\n",
1158                                         (int) nread);
1159                         nread = 0;
1160                 } else if (nread < amount) {
1161                         LDBG(curlun, "partial file verify: %d/%u\n",
1162                                         (int) nread, amount);
1163                         nread -= (nread & 511); /* Round down to a sector */
1164                 }
1165                 if (nread == 0) {
1166                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1167                         curlun->sense_data_info = file_offset >> 9;
1168                         curlun->info_valid = 1;
1169                         break;
1170                 }
1171                 file_offset += nread;
1172                 amount_left -= nread;
1173         }
1174         return 0;
1175 }
1176
1177
1178 /*-------------------------------------------------------------------------*/
1179
1180 static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
1181 {
1182         struct fsg_lun *curlun = common->curlun;
1183         u8      *buf = (u8 *) bh->buf;
1184
1185         if (!curlun) {          /* Unsupported LUNs are okay */
1186                 common->bad_lun_okay = 1;
1187                 memset(buf, 0, 36);
1188                 buf[0] = 0x7f;          /* Unsupported, no device-type */
1189                 buf[4] = 31;            /* Additional length */
1190                 return 36;
1191         }
1192
1193         buf[0] = curlun->cdrom ? TYPE_ROM : TYPE_DISK;
1194         buf[1] = curlun->removable ? 0x80 : 0;
1195         buf[2] = 2;             /* ANSI SCSI level 2 */
1196         buf[3] = 2;             /* SCSI-2 INQUIRY data format */
1197         buf[4] = 31;            /* Additional length */
1198         buf[5] = 0;             /* No special options */
1199         buf[6] = 0;
1200         buf[7] = 0;
1201         memcpy(buf + 8, common->inquiry_string, sizeof common->inquiry_string);
1202         return 36;
1203 }
1204
1205
1206 static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1207 {
1208         struct fsg_lun  *curlun = common->curlun;
1209         u8              *buf = (u8 *) bh->buf;
1210         u32             sd, sdinfo;
1211         int             valid;
1212
1213         /*
1214          * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1215          *
1216          * If a REQUEST SENSE command is received from an initiator
1217          * with a pending unit attention condition (before the target
1218          * generates the contingent allegiance condition), then the
1219          * target shall either:
1220          *   a) report any pending sense data and preserve the unit
1221          *      attention condition on the logical unit, or,
1222          *   b) report the unit attention condition, may discard any
1223          *      pending sense data, and clear the unit attention
1224          *      condition on the logical unit for that initiator.
1225          *
1226          * FSG normally uses option a); enable this code to use option b).
1227          */
1228 #if 0
1229         if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
1230                 curlun->sense_data = curlun->unit_attention_data;
1231                 curlun->unit_attention_data = SS_NO_SENSE;
1232         }
1233 #endif
1234
1235         if (!curlun) {          /* Unsupported LUNs are okay */
1236                 common->bad_lun_okay = 1;
1237                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1238                 sdinfo = 0;
1239                 valid = 0;
1240         } else {
1241                 sd = curlun->sense_data;
1242                 sdinfo = curlun->sense_data_info;
1243                 valid = curlun->info_valid << 7;
1244                 curlun->sense_data = SS_NO_SENSE;
1245                 curlun->sense_data_info = 0;
1246                 curlun->info_valid = 0;
1247         }
1248
1249         memset(buf, 0, 18);
1250         buf[0] = valid | 0x70;                  /* Valid, current error */
1251         buf[2] = SK(sd);
1252         put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
1253         buf[7] = 18 - 8;                        /* Additional sense length */
1254         buf[12] = ASC(sd);
1255         buf[13] = ASCQ(sd);
1256         return 18;
1257 }
1258
1259
1260 static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
1261 {
1262         struct fsg_lun  *curlun = common->curlun;
1263         u32             lba = get_unaligned_be32(&common->cmnd[2]);
1264         int             pmi = common->cmnd[8];
1265         u8              *buf = (u8 *) bh->buf;
1266
1267         /* Check the PMI and LBA fields */
1268         if (pmi > 1 || (pmi == 0 && lba != 0)) {
1269                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1270                 return -EINVAL;
1271         }
1272
1273         put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
1274                                                 /* Max logical block */
1275         put_unaligned_be32(512, &buf[4]);       /* Block length */
1276         return 8;
1277 }
1278
1279
1280 static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
1281 {
1282         struct fsg_lun  *curlun = common->curlun;
1283         int             msf = common->cmnd[1] & 0x02;
1284         u32             lba = get_unaligned_be32(&common->cmnd[2]);
1285         u8              *buf = (u8 *) bh->buf;
1286
1287         if (common->cmnd[1] & ~0x02) {          /* Mask away MSF */
1288                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1289                 return -EINVAL;
1290         }
1291         if (lba >= curlun->num_sectors) {
1292                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1293                 return -EINVAL;
1294         }
1295
1296         memset(buf, 0, 8);
1297         buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
1298         store_cdrom_address(&buf[4], msf, lba);
1299         return 8;
1300 }
1301
1302
1303 static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
1304 {
1305         struct fsg_lun  *curlun = common->curlun;
1306         int             msf = common->cmnd[1] & 0x02;
1307         int             start_track = common->cmnd[6];
1308         u8              *buf = (u8 *) bh->buf;
1309
1310         if ((common->cmnd[1] & ~0x02) != 0 ||   /* Mask away MSF */
1311                         start_track > 1) {
1312                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1313                 return -EINVAL;
1314         }
1315
1316         memset(buf, 0, 20);
1317         buf[1] = (20-2);                /* TOC data length */
1318         buf[2] = 1;                     /* First track number */
1319         buf[3] = 1;                     /* Last track number */
1320         buf[5] = 0x16;                  /* Data track, copying allowed */
1321         buf[6] = 0x01;                  /* Only track is number 1 */
1322         store_cdrom_address(&buf[8], msf, 0);
1323
1324         buf[13] = 0x16;                 /* Lead-out track is data */
1325         buf[14] = 0xAA;                 /* Lead-out track number */
1326         store_cdrom_address(&buf[16], msf, curlun->num_sectors);
1327         return 20;
1328 }
1329
1330
1331 static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
1332 {
1333         struct fsg_lun  *curlun = common->curlun;
1334         int             mscmnd = common->cmnd[0];
1335         u8              *buf = (u8 *) bh->buf;
1336         u8              *buf0 = buf;
1337         int             pc, page_code;
1338         int             changeable_values, all_pages;
1339         int             valid_page = 0;
1340         int             len, limit;
1341
1342         if ((common->cmnd[1] & ~0x08) != 0) {   /* Mask away DBD */
1343                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1344                 return -EINVAL;
1345         }
1346         pc = common->cmnd[2] >> 6;
1347         page_code = common->cmnd[2] & 0x3f;
1348         if (pc == 3) {
1349                 curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1350                 return -EINVAL;
1351         }
1352         changeable_values = (pc == 1);
1353         all_pages = (page_code == 0x3f);
1354
1355         /* Write the mode parameter header.  Fixed values are: default
1356          * medium type, no cache control (DPOFUA), and no block descriptors.
1357          * The only variable value is the WriteProtect bit.  We will fill in
1358          * the mode data length later. */
1359         memset(buf, 0, 8);
1360         if (mscmnd == MODE_SENSE) {
1361                 buf[2] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
1362                 buf += 4;
1363                 limit = 255;
1364         } else {                        /* MODE_SENSE_10 */
1365                 buf[3] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
1366                 buf += 8;
1367                 limit = 65535;          /* Should really be FSG_BUFLEN */
1368         }
1369
1370         /* No block descriptors */
1371
1372         /* The mode pages, in numerical order.  The only page we support
1373          * is the Caching page. */
1374         if (page_code == 0x08 || all_pages) {
1375                 valid_page = 1;
1376                 buf[0] = 0x08;          /* Page code */
1377                 buf[1] = 10;            /* Page length */
1378                 memset(buf+2, 0, 10);   /* None of the fields are changeable */
1379
1380                 if (!changeable_values) {
1381                         buf[2] = 0x04;  /* Write cache enable, */
1382                                         /* Read cache not disabled */
1383                                         /* No cache retention priorities */
1384                         put_unaligned_be16(0xffff, &buf[4]);
1385                                         /* Don't disable prefetch */
1386                                         /* Minimum prefetch = 0 */
1387                         put_unaligned_be16(0xffff, &buf[8]);
1388                                         /* Maximum prefetch */
1389                         put_unaligned_be16(0xffff, &buf[10]);
1390                                         /* Maximum prefetch ceiling */
1391                 }
1392                 buf += 12;
1393         }
1394
1395         /* Check that a valid page was requested and the mode data length
1396          * isn't too long. */
1397         len = buf - buf0;
1398         if (!valid_page || len > limit) {
1399                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1400                 return -EINVAL;
1401         }
1402
1403         /*  Store the mode data length */
1404         if (mscmnd == MODE_SENSE)
1405                 buf0[0] = len - 1;
1406         else
1407                 put_unaligned_be16(len - 2, buf0);
1408         return len;
1409 }
1410
1411
1412 static int do_start_stop(struct fsg_common *common)
1413 {
1414         struct fsg_lun  *curlun = common->curlun;
1415         int             loej, start;
1416
1417         if (!curlun) {
1418                 return -EINVAL;
1419         } else if (!curlun->removable) {
1420                 curlun->sense_data = SS_INVALID_COMMAND;
1421                 return -EINVAL;
1422         } else if ((common->cmnd[1] & ~0x01) != 0 || /* Mask away Immed */
1423                    (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */
1424                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1425                 return -EINVAL;
1426         }
1427
1428         loej  = common->cmnd[4] & 0x02;
1429         start = common->cmnd[4] & 0x01;
1430
1431         /* Our emulation doesn't support mounting; the medium is
1432          * available for use as soon as it is loaded. */
1433         if (start) {
1434                 if (!fsg_lun_is_open(curlun)) {
1435                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1436                         return -EINVAL;
1437                 }
1438                 return 0;
1439         }
1440
1441         /* Are we allowed to unload the media? */
1442         if (curlun->prevent_medium_removal) {
1443                 LDBG(curlun, "unload attempt prevented\n");
1444                 curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
1445                 return -EINVAL;
1446         }
1447
1448         if (!loej)
1449                 return 0;
1450
1451         /* Simulate an unload/eject */
1452         if (common->ops && common->ops->pre_eject) {
1453                 int r = common->ops->pre_eject(common, curlun,
1454                                                curlun - common->luns);
1455                 if (unlikely(r < 0))
1456                         return r;
1457                 else if (r)
1458                         return 0;
1459         }
1460
1461         up_read(&common->filesem);
1462         down_write(&common->filesem);
1463         fsg_lun_close(curlun);
1464         up_write(&common->filesem);
1465         down_read(&common->filesem);
1466
1467         return common->ops && common->ops->post_eject
1468                 ? min(0, common->ops->post_eject(common, curlun,
1469                                                  curlun - common->luns))
1470                 : 0;
1471 }
1472
1473
1474 static int do_prevent_allow(struct fsg_common *common)
1475 {
1476         struct fsg_lun  *curlun = common->curlun;
1477         int             prevent;
1478
1479         if (!common->curlun) {
1480                 return -EINVAL;
1481         } else if (!common->curlun->removable) {
1482                 common->curlun->sense_data = SS_INVALID_COMMAND;
1483                 return -EINVAL;
1484         }
1485
1486         prevent = common->cmnd[4] & 0x01;
1487         if ((common->cmnd[4] & ~0x01) != 0) {   /* Mask away Prevent */
1488                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1489                 return -EINVAL;
1490         }
1491
1492         if (curlun->prevent_medium_removal && !prevent)
1493                 fsg_lun_fsync_sub(curlun);
1494         curlun->prevent_medium_removal = prevent;
1495         return 0;
1496 }
1497
1498
1499 static int do_read_format_capacities(struct fsg_common *common,
1500                         struct fsg_buffhd *bh)
1501 {
1502         struct fsg_lun  *curlun = common->curlun;
1503         u8              *buf = (u8 *) bh->buf;
1504
1505         buf[0] = buf[1] = buf[2] = 0;
1506         buf[3] = 8;     /* Only the Current/Maximum Capacity Descriptor */
1507         buf += 4;
1508
1509         put_unaligned_be32(curlun->num_sectors, &buf[0]);
1510                                                 /* Number of blocks */
1511         put_unaligned_be32(512, &buf[4]);       /* Block length */
1512         buf[4] = 0x02;                          /* Current capacity */
1513         return 12;
1514 }
1515
1516
1517 static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
1518 {
1519         struct fsg_lun  *curlun = common->curlun;
1520
1521         /* We don't support MODE SELECT */
1522         if (curlun)
1523                 curlun->sense_data = SS_INVALID_COMMAND;
1524         return -EINVAL;
1525 }
1526
1527
1528 /*-------------------------------------------------------------------------*/
1529
1530 static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
1531 {
1532         int     rc;
1533
1534         rc = fsg_set_halt(fsg, fsg->bulk_in);
1535         if (rc == -EAGAIN)
1536                 VDBG(fsg, "delayed bulk-in endpoint halt\n");
1537         while (rc != 0) {
1538                 if (rc != -EAGAIN) {
1539                         WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
1540                         rc = 0;
1541                         break;
1542                 }
1543
1544                 /* Wait for a short time and then try again */
1545                 if (msleep_interruptible(100) != 0)
1546                         return -EINTR;
1547                 rc = usb_ep_set_halt(fsg->bulk_in);
1548         }
1549         return rc;
1550 }
1551
1552 static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
1553 {
1554         int     rc;
1555
1556         DBG(fsg, "bulk-in set wedge\n");
1557         rc = usb_ep_set_wedge(fsg->bulk_in);
1558         if (rc == -EAGAIN)
1559                 VDBG(fsg, "delayed bulk-in endpoint wedge\n");
1560         while (rc != 0) {
1561                 if (rc != -EAGAIN) {
1562                         WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
1563                         rc = 0;
1564                         break;
1565                 }
1566
1567                 /* Wait for a short time and then try again */
1568                 if (msleep_interruptible(100) != 0)
1569                         return -EINTR;
1570                 rc = usb_ep_set_wedge(fsg->bulk_in);
1571         }
1572         return rc;
1573 }
1574
1575 static int pad_with_zeros(struct fsg_dev *fsg)
1576 {
1577         struct fsg_buffhd       *bh = fsg->common->next_buffhd_to_fill;
1578         u32                     nkeep = bh->inreq->length;
1579         u32                     nsend;
1580         int                     rc;
1581
1582         bh->state = BUF_STATE_EMPTY;            /* For the first iteration */
1583         fsg->common->usb_amount_left = nkeep + fsg->common->residue;
1584         while (fsg->common->usb_amount_left > 0) {
1585
1586                 /* Wait for the next buffer to be free */
1587                 while (bh->state != BUF_STATE_EMPTY) {
1588                         rc = sleep_thread(fsg->common);
1589                         if (rc)
1590                                 return rc;
1591                 }
1592
1593                 nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
1594                 memset(bh->buf + nkeep, 0, nsend - nkeep);
1595                 bh->inreq->length = nsend;
1596                 bh->inreq->zero = 0;
1597                 start_transfer(fsg, fsg->bulk_in, bh->inreq,
1598                                 &bh->inreq_busy, &bh->state);
1599                 bh = fsg->common->next_buffhd_to_fill = bh->next;
1600                 fsg->common->usb_amount_left -= nsend;
1601                 nkeep = 0;
1602         }
1603         return 0;
1604 }
1605
1606 static int throw_away_data(struct fsg_common *common)
1607 {
1608         struct fsg_buffhd       *bh;
1609         u32                     amount;
1610         int                     rc;
1611
1612         for (bh = common->next_buffhd_to_drain;
1613              bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
1614              bh = common->next_buffhd_to_drain) {
1615
1616                 /* Throw away the data in a filled buffer */
1617                 if (bh->state == BUF_STATE_FULL) {
1618                         smp_rmb();
1619                         bh->state = BUF_STATE_EMPTY;
1620                         common->next_buffhd_to_drain = bh->next;
1621
1622                         /* A short packet or an error ends everything */
1623                         if (bh->outreq->actual != bh->outreq->length ||
1624                                         bh->outreq->status != 0) {
1625                                 raise_exception(common,
1626                                                 FSG_STATE_ABORT_BULK_OUT);
1627                                 return -EINTR;
1628                         }
1629                         continue;
1630                 }
1631
1632                 /* Try to submit another request if we need one */
1633                 bh = common->next_buffhd_to_fill;
1634                 if (bh->state == BUF_STATE_EMPTY
1635                  && common->usb_amount_left > 0) {
1636                         amount = min(common->usb_amount_left, FSG_BUFLEN);
1637
1638                         /* amount is always divisible by 512, hence by
1639                          * the bulk-out maxpacket size */
1640                         bh->outreq->length = amount;
1641                         bh->bulk_out_intended_length = amount;
1642                         bh->outreq->short_not_ok = 1;
1643                         if (!start_out_transfer(common, bh))
1644                                 /* Don't know what to do if
1645                                  * common->fsg is NULL */
1646                                 return -EIO;
1647                         common->next_buffhd_to_fill = bh->next;
1648                         common->usb_amount_left -= amount;
1649                         continue;
1650                 }
1651
1652                 /* Otherwise wait for something to happen */
1653                 rc = sleep_thread(common);
1654                 if (rc)
1655                         return rc;
1656         }
1657         return 0;
1658 }
1659
1660
1661 static int finish_reply(struct fsg_common *common)
1662 {
1663         struct fsg_buffhd       *bh = common->next_buffhd_to_fill;
1664         int                     rc = 0;
1665
1666         switch (common->data_dir) {
1667         case DATA_DIR_NONE:
1668                 break;                  /* Nothing to send */
1669
1670         /* If we don't know whether the host wants to read or write,
1671          * this must be CB or CBI with an unknown command.  We mustn't
1672          * try to send or receive any data.  So stall both bulk pipes
1673          * if we can and wait for a reset. */
1674         case DATA_DIR_UNKNOWN:
1675                 if (!common->can_stall) {
1676                         /* Nothing */
1677                 } else if (fsg_is_set(common)) {
1678                         fsg_set_halt(common->fsg, common->fsg->bulk_out);
1679                         rc = halt_bulk_in_endpoint(common->fsg);
1680                 } else {
1681                         /* Don't know what to do if common->fsg is NULL */
1682                         rc = -EIO;
1683                 }
1684                 break;
1685
1686         /* All but the last buffer of data must have already been sent */
1687         case DATA_DIR_TO_HOST:
1688                 if (common->data_size == 0) {
1689                         /* Nothing to send */
1690
1691                 /* If there's no residue, simply send the last buffer */
1692                 } else if (common->residue == 0) {
1693                         bh->inreq->zero = 0;
1694                         if (!start_in_transfer(common, bh))
1695                                 return -EIO;
1696                         common->next_buffhd_to_fill = bh->next;
1697
1698                 /* For Bulk-only, if we're allowed to stall then send the
1699                  * short packet and halt the bulk-in endpoint.  If we can't
1700                  * stall, pad out the remaining data with 0's. */
1701                 } else if (common->can_stall) {
1702                         bh->inreq->zero = 1;
1703                         if (!start_in_transfer(common, bh))
1704                                 /* Don't know what to do if
1705                                  * common->fsg is NULL */
1706                                 rc = -EIO;
1707                         common->next_buffhd_to_fill = bh->next;
1708                         if (common->fsg)
1709                                 rc = halt_bulk_in_endpoint(common->fsg);
1710                 } else if (fsg_is_set(common)) {
1711                         rc = pad_with_zeros(common->fsg);
1712                 } else {
1713                         /* Don't know what to do if common->fsg is NULL */
1714                         rc = -EIO;
1715                 }
1716                 break;
1717
1718         /* We have processed all we want from the data the host has sent.
1719          * There may still be outstanding bulk-out requests. */
1720         case DATA_DIR_FROM_HOST:
1721                 if (common->residue == 0) {
1722                         /* Nothing to receive */
1723
1724                 /* Did the host stop sending unexpectedly early? */
1725                 } else if (common->short_packet_received) {
1726                         raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1727                         rc = -EINTR;
1728
1729                 /* We haven't processed all the incoming data.  Even though
1730                  * we may be allowed to stall, doing so would cause a race.
1731                  * The controller may already have ACK'ed all the remaining
1732                  * bulk-out packets, in which case the host wouldn't see a
1733                  * STALL.  Not realizing the endpoint was halted, it wouldn't
1734                  * clear the halt -- leading to problems later on. */
1735 #if 0
1736                 } else if (common->can_stall) {
1737                         if (fsg_is_set(common))
1738                                 fsg_set_halt(common->fsg,
1739                                              common->fsg->bulk_out);
1740                         raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
1741                         rc = -EINTR;
1742 #endif
1743
1744                 /* We can't stall.  Read in the excess data and throw it
1745                  * all away. */
1746                 } else {
1747                         rc = throw_away_data(common);
1748                 }
1749                 break;
1750         }
1751         return rc;
1752 }
1753
1754
1755 static int send_status(struct fsg_common *common)
1756 {
1757         struct fsg_lun          *curlun = common->curlun;
1758         struct fsg_buffhd       *bh;
1759         struct bulk_cs_wrap     *csw;
1760         int                     rc;
1761         u8                      status = USB_STATUS_PASS;
1762         u32                     sd, sdinfo = 0;
1763
1764         /* Wait for the next buffer to become available */
1765         bh = common->next_buffhd_to_fill;
1766         while (bh->state != BUF_STATE_EMPTY) {
1767                 rc = sleep_thread(common);
1768                 if (rc)
1769                         return rc;
1770         }
1771
1772         if (curlun) {
1773                 sd = curlun->sense_data;
1774                 sdinfo = curlun->sense_data_info;
1775         } else if (common->bad_lun_okay)
1776                 sd = SS_NO_SENSE;
1777         else
1778                 sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1779
1780         if (common->phase_error) {
1781                 DBG(common, "sending phase-error status\n");
1782                 status = USB_STATUS_PHASE_ERROR;
1783                 sd = SS_INVALID_COMMAND;
1784         } else if (sd != SS_NO_SENSE) {
1785                 DBG(common, "sending command-failure status\n");
1786                 status = USB_STATUS_FAIL;
1787                 VDBG(common, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
1788                                 "  info x%x\n",
1789                                 SK(sd), ASC(sd), ASCQ(sd), sdinfo);
1790         }
1791
1792         /* Store and send the Bulk-only CSW */
1793         csw = (void *)bh->buf;
1794
1795         csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
1796         csw->Tag = common->tag;
1797         csw->Residue = cpu_to_le32(common->residue);
1798         csw->Status = status;
1799
1800         bh->inreq->length = USB_BULK_CS_WRAP_LEN;
1801         bh->inreq->zero = 0;
1802         if (!start_in_transfer(common, bh))
1803                 /* Don't know what to do if common->fsg is NULL */
1804                 return -EIO;
1805
1806         common->next_buffhd_to_fill = bh->next;
1807         return 0;
1808 }
1809
1810
1811 /*-------------------------------------------------------------------------*/
1812
1813 /* Check whether the command is properly formed and whether its data size
1814  * and direction agree with the values we already have. */
1815 static int check_command(struct fsg_common *common, int cmnd_size,
1816                 enum data_direction data_dir, unsigned int mask,
1817                 int needs_medium, const char *name)
1818 {
1819         int                     i;
1820         int                     lun = common->cmnd[1] >> 5;
1821         static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
1822         char                    hdlen[20];
1823         struct fsg_lun          *curlun;
1824
1825         hdlen[0] = 0;
1826         if (common->data_dir != DATA_DIR_UNKNOWN)
1827                 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
1828                                 common->data_size);
1829         VDBG(common, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
1830              name, cmnd_size, dirletter[(int) data_dir],
1831              common->data_size_from_cmnd, common->cmnd_size, hdlen);
1832
1833         /* We can't reply at all until we know the correct data direction
1834          * and size. */
1835         if (common->data_size_from_cmnd == 0)
1836                 data_dir = DATA_DIR_NONE;
1837         if (common->data_size < common->data_size_from_cmnd) {
1838                 /* Host data size < Device data size is a phase error.
1839                  * Carry out the command, but only transfer as much as
1840                  * we are allowed. */
1841                 common->data_size_from_cmnd = common->data_size;
1842                 common->phase_error = 1;
1843         }
1844         common->residue = common->data_size;
1845         common->usb_amount_left = common->data_size;
1846
1847         /* Conflicting data directions is a phase error */
1848         if (common->data_dir != data_dir
1849          && common->data_size_from_cmnd > 0) {
1850                 common->phase_error = 1;
1851                 return -EINVAL;
1852         }
1853
1854         /* Verify the length of the command itself */
1855         if (cmnd_size != common->cmnd_size) {
1856
1857                 /* Special case workaround: There are plenty of buggy SCSI
1858                  * implementations. Many have issues with cbw->Length
1859                  * field passing a wrong command size. For those cases we
1860                  * always try to work around the problem by using the length
1861                  * sent by the host side provided it is at least as large
1862                  * as the correct command length.
1863                  * Examples of such cases would be MS-Windows, which issues
1864                  * REQUEST SENSE with cbw->Length == 12 where it should
1865                  * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
1866                  * REQUEST SENSE with cbw->Length == 10 where it should
1867                  * be 6 as well.
1868                  */
1869                 if (cmnd_size <= common->cmnd_size) {
1870                         DBG(common, "%s is buggy! Expected length %d "
1871                             "but we got %d\n", name,
1872                             cmnd_size, common->cmnd_size);
1873                         cmnd_size = common->cmnd_size;
1874                 } else {
1875                         common->phase_error = 1;
1876                         return -EINVAL;
1877                 }
1878         }
1879
1880         /* Check that the LUN values are consistent */
1881         if (common->lun != lun)
1882                 DBG(common, "using LUN %d from CBW, not LUN %d from CDB\n",
1883                     common->lun, lun);
1884
1885         /* Check the LUN */
1886         if (common->lun >= 0 && common->lun < common->nluns) {
1887                 curlun = &common->luns[common->lun];
1888                 common->curlun = curlun;
1889                 if (common->cmnd[0] != REQUEST_SENSE) {
1890                         curlun->sense_data = SS_NO_SENSE;
1891                         curlun->sense_data_info = 0;
1892                         curlun->info_valid = 0;
1893                 }
1894         } else {
1895                 common->curlun = NULL;
1896                 curlun = NULL;
1897                 common->bad_lun_okay = 0;
1898
1899                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
1900                  * to use unsupported LUNs; all others may not. */
1901                 if (common->cmnd[0] != INQUIRY &&
1902                     common->cmnd[0] != REQUEST_SENSE) {
1903                         DBG(common, "unsupported LUN %d\n", common->lun);
1904                         return -EINVAL;
1905                 }
1906         }
1907
1908         /* If a unit attention condition exists, only INQUIRY and
1909          * REQUEST SENSE commands are allowed; anything else must fail. */
1910         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
1911                         common->cmnd[0] != INQUIRY &&
1912                         common->cmnd[0] != REQUEST_SENSE) {
1913                 curlun->sense_data = curlun->unit_attention_data;
1914                 curlun->unit_attention_data = SS_NO_SENSE;
1915                 return -EINVAL;
1916         }
1917
1918         /* Check that only command bytes listed in the mask are non-zero */
1919         common->cmnd[1] &= 0x1f;                        /* Mask away the LUN */
1920         for (i = 1; i < cmnd_size; ++i) {
1921                 if (common->cmnd[i] && !(mask & (1 << i))) {
1922                         if (curlun)
1923                                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1924                         return -EINVAL;
1925                 }
1926         }
1927
1928         /* If the medium isn't mounted and the command needs to access
1929          * it, return an error. */
1930         if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
1931                 curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1932                 return -EINVAL;
1933         }
1934
1935         return 0;
1936 }
1937
1938
1939 static int do_scsi_command(struct fsg_common *common)
1940 {
1941         struct fsg_buffhd       *bh;
1942         int                     rc;
1943         int                     reply = -EINVAL;
1944         int                     i;
1945         static char             unknown[16];
1946
1947         dump_cdb(common);
1948
1949         /* Wait for the next buffer to become available for data or status */
1950         bh = common->next_buffhd_to_fill;
1951         common->next_buffhd_to_drain = bh;
1952         while (bh->state != BUF_STATE_EMPTY) {
1953                 rc = sleep_thread(common);
1954                 if (rc)
1955                         return rc;
1956         }
1957         common->phase_error = 0;
1958         common->short_packet_received = 0;
1959
1960         down_read(&common->filesem);    /* We're using the backing file */
1961         switch (common->cmnd[0]) {
1962
1963         case INQUIRY:
1964                 common->data_size_from_cmnd = common->cmnd[4];
1965                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1966                                       (1<<4), 0,
1967                                       "INQUIRY");
1968                 if (reply == 0)
1969                         reply = do_inquiry(common, bh);
1970                 break;
1971
1972         case MODE_SELECT:
1973                 common->data_size_from_cmnd = common->cmnd[4];
1974                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
1975                                       (1<<1) | (1<<4), 0,
1976                                       "MODE SELECT(6)");
1977                 if (reply == 0)
1978                         reply = do_mode_select(common, bh);
1979                 break;
1980
1981         case MODE_SELECT_10:
1982                 common->data_size_from_cmnd =
1983                         get_unaligned_be16(&common->cmnd[7]);
1984                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
1985                                       (1<<1) | (3<<7), 0,
1986                                       "MODE SELECT(10)");
1987                 if (reply == 0)
1988                         reply = do_mode_select(common, bh);
1989                 break;
1990
1991         case MODE_SENSE:
1992                 common->data_size_from_cmnd = common->cmnd[4];
1993                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
1994                                       (1<<1) | (1<<2) | (1<<4), 0,
1995                                       "MODE SENSE(6)");
1996                 if (reply == 0)
1997                         reply = do_mode_sense(common, bh);
1998                 break;
1999
2000         case MODE_SENSE_10:
2001                 common->data_size_from_cmnd =
2002                         get_unaligned_be16(&common->cmnd[7]);
2003                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2004                                       (1<<1) | (1<<2) | (3<<7), 0,
2005                                       "MODE SENSE(10)");
2006                 if (reply == 0)
2007                         reply = do_mode_sense(common, bh);
2008                 break;
2009
2010         case ALLOW_MEDIUM_REMOVAL:
2011                 common->data_size_from_cmnd = 0;
2012                 reply = check_command(common, 6, DATA_DIR_NONE,
2013                                       (1<<4), 0,
2014                                       "PREVENT-ALLOW MEDIUM REMOVAL");
2015                 if (reply == 0)
2016                         reply = do_prevent_allow(common);
2017                 break;
2018
2019         case READ_6:
2020                 i = common->cmnd[4];
2021                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2022                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
2023                                       (7<<1) | (1<<4), 1,
2024                                       "READ(6)");
2025                 if (reply == 0)
2026                         reply = do_read(common);
2027                 break;
2028
2029         case READ_10:
2030                 common->data_size_from_cmnd =
2031                                 get_unaligned_be16(&common->cmnd[7]) << 9;
2032                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2033                                       (1<<1) | (0xf<<2) | (3<<7), 1,
2034                                       "READ(10)");
2035                 if (reply == 0)
2036                         reply = do_read(common);
2037                 break;
2038
2039         case READ_12:
2040                 common->data_size_from_cmnd =
2041                                 get_unaligned_be32(&common->cmnd[6]) << 9;
2042                 reply = check_command(common, 12, DATA_DIR_TO_HOST,
2043                                       (1<<1) | (0xf<<2) | (0xf<<6), 1,
2044                                       "READ(12)");
2045                 if (reply == 0)
2046                         reply = do_read(common);
2047                 break;
2048
2049         case READ_CAPACITY:
2050                 common->data_size_from_cmnd = 8;
2051                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2052                                       (0xf<<2) | (1<<8), 1,
2053                                       "READ CAPACITY");
2054                 if (reply == 0)
2055                         reply = do_read_capacity(common, bh);
2056                 break;
2057
2058         case READ_HEADER:
2059                 if (!common->curlun || !common->curlun->cdrom)
2060                         goto unknown_cmnd;
2061                 common->data_size_from_cmnd =
2062                         get_unaligned_be16(&common->cmnd[7]);
2063                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2064                                       (3<<7) | (0x1f<<1), 1,
2065                                       "READ HEADER");
2066                 if (reply == 0)
2067                         reply = do_read_header(common, bh);
2068                 break;
2069
2070         case READ_TOC:
2071                 if (!common->curlun || !common->curlun->cdrom)
2072                         goto unknown_cmnd;
2073                 common->data_size_from_cmnd =
2074                         get_unaligned_be16(&common->cmnd[7]);
2075                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2076                                       (7<<6) | (1<<1), 1,
2077                                       "READ TOC");
2078                 if (reply == 0)
2079                         reply = do_read_toc(common, bh);
2080                 break;
2081
2082         case READ_FORMAT_CAPACITIES:
2083                 common->data_size_from_cmnd =
2084                         get_unaligned_be16(&common->cmnd[7]);
2085                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
2086                                       (3<<7), 1,
2087                                       "READ FORMAT CAPACITIES");
2088                 if (reply == 0)
2089                         reply = do_read_format_capacities(common, bh);
2090                 break;
2091
2092         case REQUEST_SENSE:
2093                 common->data_size_from_cmnd = common->cmnd[4];
2094                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
2095                                       (1<<4), 0,
2096                                       "REQUEST SENSE");
2097                 if (reply == 0)
2098                         reply = do_request_sense(common, bh);
2099                 break;
2100
2101         case START_STOP:
2102                 common->data_size_from_cmnd = 0;
2103                 reply = check_command(common, 6, DATA_DIR_NONE,
2104                                       (1<<1) | (1<<4), 0,
2105                                       "START-STOP UNIT");
2106                 if (reply == 0)
2107                         reply = do_start_stop(common);
2108                 break;
2109
2110         case SYNCHRONIZE_CACHE:
2111                 common->data_size_from_cmnd = 0;
2112                 reply = check_command(common, 10, DATA_DIR_NONE,
2113                                       (0xf<<2) | (3<<7), 1,
2114                                       "SYNCHRONIZE CACHE");
2115                 if (reply == 0)
2116                         reply = do_synchronize_cache(common);
2117                 break;
2118
2119         case TEST_UNIT_READY:
2120                 common->data_size_from_cmnd = 0;
2121                 reply = check_command(common, 6, DATA_DIR_NONE,
2122                                 0, 1,
2123                                 "TEST UNIT READY");
2124                 break;
2125
2126         /* Although optional, this command is used by MS-Windows.  We
2127          * support a minimal version: BytChk must be 0. */
2128         case VERIFY:
2129                 common->data_size_from_cmnd = 0;
2130                 reply = check_command(common, 10, DATA_DIR_NONE,
2131                                       (1<<1) | (0xf<<2) | (3<<7), 1,
2132                                       "VERIFY");
2133                 if (reply == 0)
2134                         reply = do_verify(common);
2135                 break;
2136
2137         case WRITE_6:
2138                 i = common->cmnd[4];
2139                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2140                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
2141                                       (7<<1) | (1<<4), 1,
2142                                       "WRITE(6)");
2143                 if (reply == 0)
2144                         reply = do_write(common);
2145                 break;
2146
2147         case WRITE_10:
2148                 common->data_size_from_cmnd =
2149                                 get_unaligned_be16(&common->cmnd[7]) << 9;
2150                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
2151                                       (1<<1) | (0xf<<2) | (3<<7), 1,
2152                                       "WRITE(10)");
2153                 if (reply == 0)
2154                         reply = do_write(common);
2155                 break;
2156
2157         case WRITE_12:
2158                 common->data_size_from_cmnd =
2159                                 get_unaligned_be32(&common->cmnd[6]) << 9;
2160                 reply = check_command(common, 12, DATA_DIR_FROM_HOST,
2161                                       (1<<1) | (0xf<<2) | (0xf<<6), 1,
2162                                       "WRITE(12)");
2163                 if (reply == 0)
2164                         reply = do_write(common);
2165                 break;
2166
2167         /* Some mandatory commands that we recognize but don't implement.
2168          * They don't mean much in this setting.  It's left as an exercise
2169          * for anyone interested to implement RESERVE and RELEASE in terms
2170          * of Posix locks. */
2171         case FORMAT_UNIT:
2172         case RELEASE:
2173         case RESERVE:
2174         case SEND_DIAGNOSTIC:
2175                 /* Fall through */
2176
2177         default:
2178 unknown_cmnd:
2179                 common->data_size_from_cmnd = 0;
2180                 sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
2181                 reply = check_command(common, common->cmnd_size,
2182                                       DATA_DIR_UNKNOWN, 0xff, 0, unknown);
2183                 if (reply == 0) {
2184                         common->curlun->sense_data = SS_INVALID_COMMAND;
2185                         reply = -EINVAL;
2186                 }
2187                 break;
2188         }
2189         up_read(&common->filesem);
2190
2191         if (reply == -EINTR || signal_pending(current))
2192                 return -EINTR;
2193
2194         /* Set up the single reply buffer for finish_reply() */
2195         if (reply == -EINVAL)
2196                 reply = 0;              /* Error reply length */
2197         if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
2198                 reply = min((u32) reply, common->data_size_from_cmnd);
2199                 bh->inreq->length = reply;
2200                 bh->state = BUF_STATE_FULL;
2201                 common->residue -= reply;
2202         }                               /* Otherwise it's already set */
2203
2204         return 0;
2205 }
2206
2207
2208 /*-------------------------------------------------------------------------*/
2209
2210 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2211 {
2212         struct usb_request      *req = bh->outreq;
2213         struct fsg_bulk_cb_wrap *cbw = req->buf;
2214         struct fsg_common       *common = fsg->common;
2215
2216         /* Was this a real packet?  Should it be ignored? */
2217         if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
2218                 return -EINVAL;
2219
2220         /* Is the CBW valid? */
2221         if (req->actual != USB_BULK_CB_WRAP_LEN ||
2222                         cbw->Signature != cpu_to_le32(
2223                                 USB_BULK_CB_SIG)) {
2224                 DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
2225                                 req->actual,
2226                                 le32_to_cpu(cbw->Signature));
2227
2228                 /* The Bulk-only spec says we MUST stall the IN endpoint
2229                  * (6.6.1), so it's unavoidable.  It also says we must
2230                  * retain this state until the next reset, but there's
2231                  * no way to tell the controller driver it should ignore
2232                  * Clear-Feature(HALT) requests.
2233                  *
2234                  * We aren't required to halt the OUT endpoint; instead
2235                  * we can simply accept and discard any data received
2236                  * until the next reset. */
2237                 wedge_bulk_in_endpoint(fsg);
2238                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2239                 return -EINVAL;
2240         }
2241
2242         /* Is the CBW meaningful? */
2243         if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
2244                         cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
2245                 DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
2246                                 "cmdlen %u\n",
2247                                 cbw->Lun, cbw->Flags, cbw->Length);
2248
2249                 /* We can do anything we want here, so let's stall the
2250                  * bulk pipes if we are allowed to. */
2251                 if (common->can_stall) {
2252                         fsg_set_halt(fsg, fsg->bulk_out);
2253                         halt_bulk_in_endpoint(fsg);
2254                 }
2255                 return -EINVAL;
2256         }
2257
2258         /* Save the command for later */
2259         common->cmnd_size = cbw->Length;
2260         memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
2261         if (cbw->Flags & USB_BULK_IN_FLAG)
2262                 common->data_dir = DATA_DIR_TO_HOST;
2263         else
2264                 common->data_dir = DATA_DIR_FROM_HOST;
2265         common->data_size = le32_to_cpu(cbw->DataTransferLength);
2266         if (common->data_size == 0)
2267                 common->data_dir = DATA_DIR_NONE;
2268         common->lun = cbw->Lun;
2269         common->tag = cbw->Tag;
2270         return 0;
2271 }
2272
2273
2274 static int get_next_command(struct fsg_common *common)
2275 {
2276         struct fsg_buffhd       *bh;
2277         int                     rc = 0;
2278
2279         /* Wait for the next buffer to become available */
2280         bh = common->next_buffhd_to_fill;
2281         while (bh->state != BUF_STATE_EMPTY) {
2282                 rc = sleep_thread(common);
2283                 if (rc)
2284                         return rc;
2285         }
2286
2287         /* Queue a request to read a Bulk-only CBW */
2288         set_bulk_out_req_length(common, bh, USB_BULK_CB_WRAP_LEN);
2289         bh->outreq->short_not_ok = 1;
2290         if (!start_out_transfer(common, bh))
2291                 /* Don't know what to do if common->fsg is NULL */
2292                 return -EIO;
2293
2294         /* We will drain the buffer in software, which means we
2295          * can reuse it for the next filling.  No need to advance
2296          * next_buffhd_to_fill. */
2297
2298         /* Wait for the CBW to arrive */
2299         while (bh->state != BUF_STATE_FULL) {
2300                 rc = sleep_thread(common);
2301                 if (rc)
2302                         return rc;
2303         }
2304         smp_rmb();
2305         rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
2306         bh->state = BUF_STATE_EMPTY;
2307
2308         return rc;
2309 }
2310
2311
2312 /*-------------------------------------------------------------------------*/
2313
2314 static int enable_endpoint(struct fsg_common *common, struct usb_ep *ep,
2315                 const struct usb_endpoint_descriptor *d)
2316 {
2317         int     rc;
2318
2319         ep->driver_data = common;
2320         rc = usb_ep_enable(ep, d);
2321         if (rc)
2322                 ERROR(common, "can't enable %s, result %d\n", ep->name, rc);
2323         return rc;
2324 }
2325
2326 static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
2327                 struct usb_request **preq)
2328 {
2329         *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
2330         if (*preq)
2331                 return 0;
2332         ERROR(common, "can't allocate request for %s\n", ep->name);
2333         return -ENOMEM;
2334 }
2335
2336 /* Reset interface setting and re-init endpoint state (toggle etc). */
2337 static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
2338 {
2339         const struct usb_endpoint_descriptor *d;
2340         struct fsg_dev *fsg;
2341         int i, rc = 0;
2342
2343         if (common->running)
2344                 DBG(common, "reset interface\n");
2345
2346 reset:
2347         /* Deallocate the requests */
2348         if (common->fsg) {
2349                 fsg = common->fsg;
2350
2351                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2352                         struct fsg_buffhd *bh = &common->buffhds[i];
2353
2354                         if (bh->inreq) {
2355                                 usb_ep_free_request(fsg->bulk_in, bh->inreq);
2356                                 bh->inreq = NULL;
2357                         }
2358                         if (bh->outreq) {
2359                                 usb_ep_free_request(fsg->bulk_out, bh->outreq);
2360                                 bh->outreq = NULL;
2361                         }
2362                 }
2363
2364                 /* Disable the endpoints */
2365                 if (fsg->bulk_in_enabled) {
2366                         usb_ep_disable(fsg->bulk_in);
2367                         fsg->bulk_in_enabled = 0;
2368                 }
2369                 if (fsg->bulk_out_enabled) {
2370                         usb_ep_disable(fsg->bulk_out);
2371                         fsg->bulk_out_enabled = 0;
2372                 }
2373
2374                 common->fsg = NULL;
2375                 wake_up(&common->fsg_wait);
2376         }
2377
2378         common->running = 0;
2379         if (!new_fsg || rc)
2380                 return rc;
2381
2382         common->fsg = new_fsg;
2383         fsg = common->fsg;
2384
2385         /* Enable the endpoints */
2386         d = fsg_ep_desc(common->gadget,
2387                         &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
2388         rc = enable_endpoint(common, fsg->bulk_in, d);
2389         if (rc)
2390                 goto reset;
2391         fsg->bulk_in_enabled = 1;
2392
2393         d = fsg_ep_desc(common->gadget,
2394                         &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
2395         rc = enable_endpoint(common, fsg->bulk_out, d);
2396         if (rc)
2397                 goto reset;
2398         fsg->bulk_out_enabled = 1;
2399         common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
2400         clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
2401
2402         /* Allocate the requests */
2403         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2404                 struct fsg_buffhd       *bh = &common->buffhds[i];
2405
2406                 rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
2407                 if (rc)
2408                         goto reset;
2409                 rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
2410                 if (rc)
2411                         goto reset;
2412                 bh->inreq->buf = bh->outreq->buf = bh->buf;
2413                 bh->inreq->context = bh->outreq->context = bh;
2414                 bh->inreq->complete = bulk_in_complete;
2415                 bh->outreq->complete = bulk_out_complete;
2416         }
2417
2418         common->running = 1;
2419         for (i = 0; i < common->nluns; ++i)
2420                 common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
2421         return rc;
2422 }
2423
2424
2425 /****************************** ALT CONFIGS ******************************/
2426
2427
2428 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2429 {
2430         struct fsg_dev *fsg = fsg_from_func(f);
2431         fsg->common->new_fsg = fsg;
2432         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2433         return 0;
2434 }
2435
2436 static void fsg_disable(struct usb_function *f)
2437 {
2438         struct fsg_dev *fsg = fsg_from_func(f);
2439         fsg->common->new_fsg = NULL;
2440         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2441 }
2442
2443
2444 /*-------------------------------------------------------------------------*/
2445
2446 static void handle_exception(struct fsg_common *common)
2447 {
2448         siginfo_t               info;
2449         int                     i;
2450         struct fsg_buffhd       *bh;
2451         enum fsg_state          old_state;
2452         struct fsg_lun          *curlun;
2453         unsigned int            exception_req_tag;
2454
2455         /* Clear the existing signals.  Anything but SIGUSR1 is converted
2456          * into a high-priority EXIT exception. */
2457         for (;;) {
2458                 int sig =
2459                         dequeue_signal_lock(current, &current->blocked, &info);
2460                 if (!sig)
2461                         break;
2462                 if (sig != SIGUSR1) {
2463                         if (common->state < FSG_STATE_EXIT)
2464                                 DBG(common, "Main thread exiting on signal\n");
2465                         raise_exception(common, FSG_STATE_EXIT);
2466                 }
2467         }
2468
2469         /* Cancel all the pending transfers */
2470         if (likely(common->fsg)) {
2471                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2472                         bh = &common->buffhds[i];
2473                         if (bh->inreq_busy)
2474                                 usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
2475                         if (bh->outreq_busy)
2476                                 usb_ep_dequeue(common->fsg->bulk_out,
2477                                                bh->outreq);
2478                 }
2479
2480                 /* Wait until everything is idle */
2481                 for (;;) {
2482                         int num_active = 0;
2483                         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2484                                 bh = &common->buffhds[i];
2485                                 num_active += bh->inreq_busy + bh->outreq_busy;
2486                         }
2487                         if (num_active == 0)
2488                                 break;
2489                         if (sleep_thread(common))
2490                                 return;
2491                 }
2492
2493                 /* Clear out the controller's fifos */
2494                 if (common->fsg->bulk_in_enabled)
2495                         usb_ep_fifo_flush(common->fsg->bulk_in);
2496                 if (common->fsg->bulk_out_enabled)
2497                         usb_ep_fifo_flush(common->fsg->bulk_out);
2498         }
2499
2500         /* Reset the I/O buffer states and pointers, the SCSI
2501          * state, and the exception.  Then invoke the handler. */
2502         spin_lock_irq(&common->lock);
2503
2504         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
2505                 bh = &common->buffhds[i];
2506                 bh->state = BUF_STATE_EMPTY;
2507         }
2508         common->next_buffhd_to_fill = &common->buffhds[0];
2509         common->next_buffhd_to_drain = &common->buffhds[0];
2510         exception_req_tag = common->exception_req_tag;
2511         old_state = common->state;
2512
2513         if (old_state == FSG_STATE_ABORT_BULK_OUT)
2514                 common->state = FSG_STATE_STATUS_PHASE;
2515         else {
2516                 for (i = 0; i < common->nluns; ++i) {
2517                         curlun = &common->luns[i];
2518                         curlun->prevent_medium_removal = 0;
2519                         curlun->sense_data = SS_NO_SENSE;
2520                         curlun->unit_attention_data = SS_NO_SENSE;
2521                         curlun->sense_data_info = 0;
2522                         curlun->info_valid = 0;
2523                 }
2524                 common->state = FSG_STATE_IDLE;
2525         }
2526         spin_unlock_irq(&common->lock);
2527
2528         /* Carry out any extra actions required for the exception */
2529         switch (old_state) {
2530         case FSG_STATE_ABORT_BULK_OUT:
2531                 send_status(common);
2532                 spin_lock_irq(&common->lock);
2533                 if (common->state == FSG_STATE_STATUS_PHASE)
2534                         common->state = FSG_STATE_IDLE;
2535                 spin_unlock_irq(&common->lock);
2536                 break;
2537
2538         case FSG_STATE_RESET:
2539                 /* In case we were forced against our will to halt a
2540                  * bulk endpoint, clear the halt now.  (The SuperH UDC
2541                  * requires this.) */
2542                 if (!fsg_is_set(common))
2543                         break;
2544                 if (test_and_clear_bit(IGNORE_BULK_OUT,
2545                                        &common->fsg->atomic_bitflags))
2546                         usb_ep_clear_halt(common->fsg->bulk_in);
2547
2548                 if (common->ep0_req_tag == exception_req_tag)
2549                         ep0_queue(common);      /* Complete the status stage */
2550
2551                 /* Technically this should go here, but it would only be
2552                  * a waste of time.  Ditto for the INTERFACE_CHANGE and
2553                  * CONFIG_CHANGE cases. */
2554                 /* for (i = 0; i < common->nluns; ++i) */
2555                 /*      common->luns[i].unit_attention_data = */
2556                 /*              SS_RESET_OCCURRED;  */
2557                 break;
2558
2559         case FSG_STATE_CONFIG_CHANGE:
2560                 do_set_interface(common, common->new_fsg);
2561                 break;
2562
2563         case FSG_STATE_EXIT:
2564         case FSG_STATE_TERMINATED:
2565                 do_set_interface(common, NULL);         /* Free resources */
2566                 spin_lock_irq(&common->lock);
2567                 common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
2568                 spin_unlock_irq(&common->lock);
2569                 break;
2570
2571         case FSG_STATE_INTERFACE_CHANGE:
2572         case FSG_STATE_DISCONNECT:
2573         case FSG_STATE_COMMAND_PHASE:
2574         case FSG_STATE_DATA_PHASE:
2575         case FSG_STATE_STATUS_PHASE:
2576         case FSG_STATE_IDLE:
2577                 break;
2578         }
2579 }
2580
2581
2582 /*-------------------------------------------------------------------------*/
2583
2584 static int fsg_main_thread(void *common_)
2585 {
2586         struct fsg_common       *common = common_;
2587
2588         /* Allow the thread to be killed by a signal, but set the signal mask
2589          * to block everything but INT, TERM, KILL, and USR1. */
2590         allow_signal(SIGINT);
2591         allow_signal(SIGTERM);
2592         allow_signal(SIGKILL);
2593         allow_signal(SIGUSR1);
2594
2595         /* Allow the thread to be frozen */
2596         set_freezable();
2597
2598         /* Arrange for userspace references to be interpreted as kernel
2599          * pointers.  That way we can pass a kernel pointer to a routine
2600          * that expects a __user pointer and it will work okay. */
2601         set_fs(get_ds());
2602
2603         /* The main loop */
2604         while (common->state != FSG_STATE_TERMINATED) {
2605                 if (exception_in_progress(common) || signal_pending(current)) {
2606                         handle_exception(common);
2607                         continue;
2608                 }
2609
2610                 if (!common->running) {
2611                         sleep_thread(common);
2612                         continue;
2613                 }
2614
2615                 if (get_next_command(common))
2616                         continue;
2617
2618                 spin_lock_irq(&common->lock);
2619                 if (!exception_in_progress(common))
2620                         common->state = FSG_STATE_DATA_PHASE;
2621                 spin_unlock_irq(&common->lock);
2622
2623                 if (do_scsi_command(common) || finish_reply(common))
2624                         continue;
2625
2626                 spin_lock_irq(&common->lock);
2627                 if (!exception_in_progress(common))
2628                         common->state = FSG_STATE_STATUS_PHASE;
2629                 spin_unlock_irq(&common->lock);
2630
2631                 if (send_status(common))
2632                         continue;
2633
2634                 spin_lock_irq(&common->lock);
2635                 if (!exception_in_progress(common))
2636                         common->state = FSG_STATE_IDLE;
2637                 spin_unlock_irq(&common->lock);
2638         }
2639
2640         spin_lock_irq(&common->lock);
2641         common->thread_task = NULL;
2642         spin_unlock_irq(&common->lock);
2643
2644         if (!common->ops || !common->ops->thread_exits
2645          || common->ops->thread_exits(common) < 0) {
2646                 struct fsg_lun *curlun = common->luns;
2647                 unsigned i = common->nluns;
2648
2649                 down_write(&common->filesem);
2650                 for (; i--; ++curlun) {
2651                         if (!fsg_lun_is_open(curlun))
2652                                 continue;
2653
2654                         fsg_lun_close(curlun);
2655                         curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
2656                 }
2657                 up_write(&common->filesem);
2658         }
2659
2660         /* Let fsg_unbind() know the thread has exited */
2661         complete_and_exit(&common->thread_notifier, 0);
2662 }
2663
2664
2665 /*************************** DEVICE ATTRIBUTES ***************************/
2666
2667 /* Write permission is checked per LUN in store_*() functions. */
2668 static DEVICE_ATTR(ro, 0644, fsg_show_ro, fsg_store_ro);
2669 static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, fsg_store_nofua);
2670 static DEVICE_ATTR(file, 0644, fsg_show_file, fsg_store_file);
2671
2672
2673 /****************************** FSG COMMON ******************************/
2674
2675 static void fsg_common_release(struct kref *ref);
2676
2677 static void fsg_lun_release(struct device *dev)
2678 {
2679         /* Nothing needs to be done */
2680 }
2681
2682 static inline void fsg_common_get(struct fsg_common *common)
2683 {
2684         kref_get(&common->ref);
2685 }
2686
2687 static inline void fsg_common_put(struct fsg_common *common)
2688 {
2689         kref_put(&common->ref, fsg_common_release);
2690 }
2691
2692
2693 static struct fsg_common *fsg_common_init(struct fsg_common *common,
2694                                           struct usb_composite_dev *cdev,
2695                                           struct fsg_config *cfg)
2696 {
2697         struct usb_gadget *gadget = cdev->gadget;
2698         struct fsg_buffhd *bh;
2699         struct fsg_lun *curlun;
2700         struct fsg_lun_config *lcfg;
2701         int nluns, i, rc;
2702         char *pathbuf;
2703
2704         /* Find out how many LUNs there should be */
2705         nluns = cfg->nluns;
2706         if (nluns < 1 || nluns > FSG_MAX_LUNS) {
2707                 dev_err(&gadget->dev, "invalid number of LUNs: %u\n", nluns);
2708                 return ERR_PTR(-EINVAL);
2709         }
2710
2711         /* Allocate? */
2712         if (!common) {
2713                 common = kzalloc(sizeof *common, GFP_KERNEL);
2714                 if (!common)
2715                         return ERR_PTR(-ENOMEM);
2716                 common->free_storage_on_release = 1;
2717         } else {
2718                 memset(common, 0, sizeof common);
2719                 common->free_storage_on_release = 0;
2720         }
2721
2722         common->ops = cfg->ops;
2723         common->private_data = cfg->private_data;
2724
2725         common->gadget = gadget;
2726         common->ep0 = gadget->ep0;
2727         common->ep0req = cdev->req;
2728
2729         /* Maybe allocate device-global string IDs, and patch descriptors */
2730         if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
2731                 rc = usb_string_id(cdev);
2732                 if (unlikely(rc < 0))
2733                         goto error_release;
2734                 fsg_strings[FSG_STRING_INTERFACE].id = rc;
2735                 fsg_intf_desc.iInterface = rc;
2736         }
2737
2738         /* Create the LUNs, open their backing files, and register the
2739          * LUN devices in sysfs. */
2740         curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
2741         if (unlikely(!curlun)) {
2742                 rc = -ENOMEM;
2743                 goto error_release;
2744         }
2745         common->luns = curlun;
2746
2747         init_rwsem(&common->filesem);
2748
2749         for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
2750                 curlun->cdrom = !!lcfg->cdrom;
2751                 curlun->ro = lcfg->cdrom || lcfg->ro;
2752                 curlun->removable = lcfg->removable;
2753                 curlun->dev.release = fsg_lun_release;
2754                 curlun->dev.parent = &gadget->dev;
2755                 /* curlun->dev.driver = &fsg_driver.driver; XXX */
2756                 dev_set_drvdata(&curlun->dev, &common->filesem);
2757                 dev_set_name(&curlun->dev,
2758                              cfg->lun_name_format
2759                            ? cfg->lun_name_format
2760                            : "lun%d",
2761                              i);
2762
2763                 rc = device_register(&curlun->dev);
2764                 if (rc) {
2765                         INFO(common, "failed to register LUN%d: %d\n", i, rc);
2766                         common->nluns = i;
2767                         put_device(&curlun->dev);
2768                         goto error_release;
2769                 }
2770
2771                 rc = device_create_file(&curlun->dev, &dev_attr_ro);
2772                 if (rc)
2773                         goto error_luns;
2774                 rc = device_create_file(&curlun->dev, &dev_attr_file);
2775                 if (rc)
2776                         goto error_luns;
2777                 rc = device_create_file(&curlun->dev, &dev_attr_nofua);
2778                 if (rc)
2779                         goto error_luns;
2780
2781                 if (lcfg->filename) {
2782                         rc = fsg_lun_open(curlun, lcfg->filename);
2783                         if (rc)
2784                                 goto error_luns;
2785                 } else if (!curlun->removable) {
2786                         ERROR(common, "no file given for LUN%d\n", i);
2787                         rc = -EINVAL;
2788                         goto error_luns;
2789                 }
2790         }
2791         common->nluns = nluns;
2792
2793
2794         /* Data buffers cyclic list */
2795         bh = common->buffhds;
2796         i = FSG_NUM_BUFFERS;
2797         goto buffhds_first_it;
2798         do {
2799                 bh->next = bh + 1;
2800                 ++bh;
2801 buffhds_first_it:
2802                 bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL);
2803                 if (unlikely(!bh->buf)) {
2804                         rc = -ENOMEM;
2805                         goto error_release;
2806                 }
2807         } while (--i);
2808         bh->next = common->buffhds;
2809
2810
2811         /* Prepare inquiryString */
2812         if (cfg->release != 0xffff) {
2813                 i = cfg->release;
2814         } else {
2815                 i = usb_gadget_controller_number(gadget);
2816                 if (i >= 0) {
2817                         i = 0x0300 + i;
2818                 } else {
2819                         WARNING(common, "controller '%s' not recognized\n",
2820                                 gadget->name);
2821                         i = 0x0399;
2822                 }
2823         }
2824         snprintf(common->inquiry_string, sizeof common->inquiry_string,
2825                  "%-8s%-16s%04x", cfg->vendor_name ?: "Linux",
2826                  /* Assume product name dependent on the first LUN */
2827                  cfg->product_name ?: (common->luns->cdrom
2828                                      ? "File-Stor Gadget"
2829                                      : "File-CD Gadget"),
2830                  i);
2831
2832
2833         /* Some peripheral controllers are known not to be able to
2834          * halt bulk endpoints correctly.  If one of them is present,
2835          * disable stalls.
2836          */
2837         common->can_stall = cfg->can_stall &&
2838                 !(gadget_is_at91(common->gadget));
2839
2840
2841         spin_lock_init(&common->lock);
2842         kref_init(&common->ref);
2843
2844
2845         /* Tell the thread to start working */
2846         common->thread_task =
2847                 kthread_create(fsg_main_thread, common,
2848                                cfg->thread_name ?: "file-storage");
2849         if (IS_ERR(common->thread_task)) {
2850                 rc = PTR_ERR(common->thread_task);
2851                 goto error_release;
2852         }
2853         init_completion(&common->thread_notifier);
2854         init_waitqueue_head(&common->fsg_wait);
2855
2856
2857         /* Information */
2858         INFO(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
2859         INFO(common, "Number of LUNs=%d\n", common->nluns);
2860
2861         pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
2862         for (i = 0, nluns = common->nluns, curlun = common->luns;
2863              i < nluns;
2864              ++curlun, ++i) {
2865                 char *p = "(no medium)";
2866                 if (fsg_lun_is_open(curlun)) {
2867                         p = "(error)";
2868                         if (pathbuf) {
2869                                 p = d_path(&curlun->filp->f_path,
2870                                            pathbuf, PATH_MAX);
2871                                 if (IS_ERR(p))
2872                                         p = "(error)";
2873                         }
2874                 }
2875                 LINFO(curlun, "LUN: %s%s%sfile: %s\n",
2876                       curlun->removable ? "removable " : "",
2877                       curlun->ro ? "read only " : "",
2878                       curlun->cdrom ? "CD-ROM " : "",
2879                       p);
2880         }
2881         kfree(pathbuf);
2882
2883         DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
2884
2885         wake_up_process(common->thread_task);
2886
2887         return common;
2888
2889
2890 error_luns:
2891         common->nluns = i + 1;
2892 error_release:
2893         common->state = FSG_STATE_TERMINATED;   /* The thread is dead */
2894         /* Call fsg_common_release() directly, ref might be not
2895          * initialised */
2896         fsg_common_release(&common->ref);
2897         return ERR_PTR(rc);
2898 }
2899
2900
2901 static void fsg_common_release(struct kref *ref)
2902 {
2903         struct fsg_common *common = container_of(ref, struct fsg_common, ref);
2904
2905         /* If the thread isn't already dead, tell it to exit now */
2906         if (common->state != FSG_STATE_TERMINATED) {
2907                 raise_exception(common, FSG_STATE_EXIT);
2908                 wait_for_completion(&common->thread_notifier);
2909         }
2910
2911         if (likely(common->luns)) {
2912                 struct fsg_lun *lun = common->luns;
2913                 unsigned i = common->nluns;
2914
2915                 /* In error recovery common->nluns may be zero. */
2916                 for (; i; --i, ++lun) {
2917                         device_remove_file(&lun->dev, &dev_attr_nofua);
2918                         device_remove_file(&lun->dev, &dev_attr_ro);
2919                         device_remove_file(&lun->dev, &dev_attr_file);
2920                         fsg_lun_close(lun);
2921                         device_unregister(&lun->dev);
2922                 }
2923
2924                 kfree(common->luns);
2925         }
2926
2927         {
2928                 struct fsg_buffhd *bh = common->buffhds;
2929                 unsigned i = FSG_NUM_BUFFERS;
2930                 do {
2931                         kfree(bh->buf);
2932                 } while (++bh, --i);
2933         }
2934
2935         if (common->free_storage_on_release)
2936                 kfree(common);
2937 }
2938
2939
2940 /*-------------------------------------------------------------------------*/
2941
2942
2943 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
2944 {
2945         struct fsg_dev          *fsg = fsg_from_func(f);
2946         struct fsg_common       *common = fsg->common;
2947
2948         DBG(fsg, "unbind\n");
2949         if (fsg->common->fsg == fsg) {
2950                 fsg->common->new_fsg = NULL;
2951                 raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
2952                 /* FIXME: make interruptible or killable somehow? */
2953                 wait_event(common->fsg_wait, common->fsg != fsg);
2954         }
2955
2956         fsg_common_put(common);
2957         usb_free_descriptors(fsg->function.descriptors);
2958         usb_free_descriptors(fsg->function.hs_descriptors);
2959         kfree(fsg);
2960 }
2961
2962
2963 static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
2964 {
2965         struct fsg_dev          *fsg = fsg_from_func(f);
2966         struct usb_gadget       *gadget = c->cdev->gadget;
2967         int                     i;
2968         struct usb_ep           *ep;
2969
2970         fsg->gadget = gadget;
2971
2972         /* New interface */
2973         i = usb_interface_id(c, f);
2974         if (i < 0)
2975                 return i;
2976         fsg_intf_desc.bInterfaceNumber = i;
2977         fsg->interface_number = i;
2978
2979         /* Find all the endpoints we will use */
2980         ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
2981         if (!ep)
2982                 goto autoconf_fail;
2983         ep->driver_data = fsg->common;  /* claim the endpoint */
2984         fsg->bulk_in = ep;
2985
2986         ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
2987         if (!ep)
2988                 goto autoconf_fail;
2989         ep->driver_data = fsg->common;  /* claim the endpoint */
2990         fsg->bulk_out = ep;
2991
2992         /* Copy descriptors */
2993         f->descriptors = usb_copy_descriptors(fsg_fs_function);
2994         if (unlikely(!f->descriptors))
2995                 return -ENOMEM;
2996
2997         if (gadget_is_dualspeed(gadget)) {
2998                 /* Assume endpoint addresses are the same for both speeds */
2999                 fsg_hs_bulk_in_desc.bEndpointAddress =
3000                         fsg_fs_bulk_in_desc.bEndpointAddress;
3001                 fsg_hs_bulk_out_desc.bEndpointAddress =
3002                         fsg_fs_bulk_out_desc.bEndpointAddress;
3003                 f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
3004                 if (unlikely(!f->hs_descriptors)) {
3005                         usb_free_descriptors(f->descriptors);
3006                         return -ENOMEM;
3007                 }
3008         }
3009
3010         return 0;
3011
3012 autoconf_fail:
3013         ERROR(fsg, "unable to autoconfigure all endpoints\n");
3014         return -ENOTSUPP;
3015 }
3016
3017
3018 /****************************** ADD FUNCTION ******************************/
3019
3020 static struct usb_gadget_strings *fsg_strings_array[] = {
3021         &fsg_stringtab,
3022         NULL,
3023 };
3024
3025 static int fsg_bind_config(struct usb_composite_dev *cdev,
3026                            struct usb_configuration *c,
3027                            struct fsg_common *common)
3028 {
3029         struct fsg_dev *fsg;
3030         int rc;
3031
3032         fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
3033         if (unlikely(!fsg))
3034                 return -ENOMEM;
3035
3036         fsg->function.name        = FSG_DRIVER_DESC;
3037         fsg->function.strings     = fsg_strings_array;
3038         fsg->function.bind        = fsg_bind;
3039         fsg->function.unbind      = fsg_unbind;
3040         fsg->function.setup       = fsg_setup;
3041         fsg->function.set_alt     = fsg_set_alt;
3042         fsg->function.disable     = fsg_disable;
3043
3044         fsg->common               = common;
3045         /* Our caller holds a reference to common structure so we
3046          * don't have to be worry about it being freed until we return
3047          * from this function.  So instead of incrementing counter now
3048          * and decrement in error recovery we increment it only when
3049          * call to usb_add_function() was successful. */
3050
3051         rc = usb_add_function(c, &fsg->function);
3052         if (unlikely(rc))
3053                 kfree(fsg);
3054         else
3055                 fsg_common_get(fsg->common);
3056         return rc;
3057 }
3058
3059 static inline int __deprecated __maybe_unused
3060 fsg_add(struct usb_composite_dev *cdev,
3061         struct usb_configuration *c,
3062         struct fsg_common *common)
3063 {
3064         return fsg_bind_config(cdev, c, common);
3065 }
3066
3067
3068 /************************* Module parameters *************************/
3069
3070
3071 struct fsg_module_parameters {
3072         char            *file[FSG_MAX_LUNS];
3073         int             ro[FSG_MAX_LUNS];
3074         int             removable[FSG_MAX_LUNS];
3075         int             cdrom[FSG_MAX_LUNS];
3076         int             nofua[FSG_MAX_LUNS];
3077
3078         unsigned int    file_count, ro_count, removable_count, cdrom_count;
3079         unsigned int    nofua_count;
3080         unsigned int    luns;   /* nluns */
3081         int             stall;  /* can_stall */
3082 };
3083
3084
3085 #define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)       \
3086         module_param_array_named(prefix ## name, params.name, type,     \
3087                                  &prefix ## params.name ## _count,      \
3088                                  S_IRUGO);                              \
3089         MODULE_PARM_DESC(prefix ## name, desc)
3090
3091 #define _FSG_MODULE_PARAM(prefix, params, name, type, desc)             \
3092         module_param_named(prefix ## name, params.name, type,           \
3093                            S_IRUGO);                                    \
3094         MODULE_PARM_DESC(prefix ## name, desc)
3095
3096 #define FSG_MODULE_PARAMETERS(prefix, params)                           \
3097         _FSG_MODULE_PARAM_ARRAY(prefix, params, file, charp,            \
3098                                 "names of backing files or devices");   \
3099         _FSG_MODULE_PARAM_ARRAY(prefix, params, ro, bool,               \
3100                                 "true to force read-only");             \
3101         _FSG_MODULE_PARAM_ARRAY(prefix, params, removable, bool,        \
3102                                 "true to simulate removable media");    \
3103         _FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,            \
3104                                 "true to simulate CD-ROM instead of disk"); \
3105         _FSG_MODULE_PARAM_ARRAY(prefix, params, nofua, bool,            \
3106                                 "true to ignore SCSI WRITE(10,12) FUA bit"); \
3107         _FSG_MODULE_PARAM(prefix, params, luns, uint,                   \
3108                           "number of LUNs");                            \
3109         _FSG_MODULE_PARAM(prefix, params, stall, bool,                  \
3110                           "false to prevent bulk stalls")
3111
3112
3113 static void
3114 fsg_config_from_params(struct fsg_config *cfg,
3115                        const struct fsg_module_parameters *params)
3116 {
3117         struct fsg_lun_config *lun;
3118         unsigned i;
3119
3120         /* Configure LUNs */
3121         cfg->nluns =
3122                 min(params->luns ?: (params->file_count ?: 1u),
3123                     (unsigned)FSG_MAX_LUNS);
3124         for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) {
3125                 lun->ro = !!params->ro[i];
3126                 lun->cdrom = !!params->cdrom[i];
3127                 lun->removable = /* Removable by default */
3128                         params->removable_count <= i || params->removable[i];
3129                 lun->filename =
3130                         params->file_count > i && params->file[i][0]
3131                         ? params->file[i]
3132                         : 0;
3133         }
3134
3135         /* Let MSF use defaults */
3136         cfg->lun_name_format = 0;
3137         cfg->thread_name = 0;
3138         cfg->vendor_name = 0;
3139         cfg->product_name = 0;
3140         cfg->release = 0xffff;
3141
3142         cfg->ops = NULL;
3143         cfg->private_data = NULL;
3144
3145         /* Finalise */
3146         cfg->can_stall = params->stall;
3147 }
3148
3149 static inline struct fsg_common *
3150 fsg_common_from_params(struct fsg_common *common,
3151                        struct usb_composite_dev *cdev,
3152                        const struct fsg_module_parameters *params)
3153         __attribute__((unused));
3154 static inline struct fsg_common *
3155 fsg_common_from_params(struct fsg_common *common,
3156                        struct usb_composite_dev *cdev,
3157                        const struct fsg_module_parameters *params)
3158 {
3159         struct fsg_config cfg;
3160         fsg_config_from_params(&cfg, params);
3161         return fsg_common_init(common, cdev, &cfg);
3162 }
3163