target/linux/goldfish/patches-2.6.30/0101-android_usb-Composite-USB-gadget-driver-for-android.patch

   1 From 03e39e8f663c896dac11e87d96e8cb0292520e36 Mon Sep 17 00:00:00 2001
   2 From: Mike Lockwood <lockwood@android.com>
   3 Date: Tue, 2 Dec 2008 22:01:33 -0500
   4 Subject: [PATCH 101/134] android_usb: Composite USB gadget driver for android.
   5
   6 Signed-off-by: Mike Lockwood <lockwood@android.com>
   7
   8 USB: android gadget: add remote wakeup attribute to android function
   9
  10 Add remote wakeup attribute to configuration descriptor of android
  11 function to advertise remote wakeup capability to host
  12
  13 Acked-by: Allam, Suresh Reddy <sallam@qualcomm.com>
  14
  15 Signed-off-by: Mike Lockwood <lockwood@android.com>
  16
  17 usb gadget: link fixes for android composite gadget
  18
  19 Signed-off-by: Mike Lockwood <lockwood@android.com>
  20
  21 usb gadget: Fix null pointer errors in android composite driver
  22
  23 Signed-off-by: Mike Lockwood <lockwood@android.com>
  24 ---
  25  drivers/usb/gadget/Kconfig          |    8 +
  26  drivers/usb/gadget/Makefile         |    2 +
  27  drivers/usb/gadget/android.c        |  345 +++++
  28  drivers/usb/gadget/f_adb.c          |  668 ++++++++
  29  drivers/usb/gadget/f_adb.h          |   25 +
  30  drivers/usb/gadget/f_mass_storage.c | 2906 +++++++++++++++++++++++++++++++++++
  31  drivers/usb/gadget/f_mass_storage.h |   52 +
  32  include/linux/usb/android.h         |   40 +
  33  8 files changed, 4046 insertions(+), 0 deletions(-)
  34  create mode 100644 drivers/usb/gadget/android.c
  35  create mode 100644 drivers/usb/gadget/f_adb.c
  36  create mode 100644 drivers/usb/gadget/f_adb.h
  37  create mode 100644 drivers/usb/gadget/f_mass_storage.c
  38  create mode 100644 drivers/usb/gadget/f_mass_storage.h
  39  create mode 100644 include/linux/usb/android.h
  40
  41 --- a/drivers/usb/gadget/Kconfig
  42 +++ b/drivers/usb/gadget/Kconfig
  43 @@ -700,6 +700,14 @@ config USB_G_PRINTER
  44           For more information, see Documentation/usb/gadget_printer.txt
  45           which includes sample code for accessing the device file.
  46
  47 +config USB_ANDROID
  48 +       tristate "Android Gadget"
  49 +       help
  50 +         The Android gadget provides mass storage and adb transport.
  51 +
  52 +         Say "y" to link the driver statically, or "m" to build a
  53 +         dynamically linked module called "g_android".
  54 +
  55  config USB_CDC_COMPOSITE
  56         tristate "CDC Composite Device (Ethernet and ACM)"
  57         depends on NET
  58 --- a/drivers/usb/gadget/Makefile
  59 +++ b/drivers/usb/gadget/Makefile
  60 @@ -33,6 +33,7 @@ gadgetfs-objs                 := inode.o
  61  g_file_storage-objs            := file_storage.o
  62  g_printer-objs                 := printer.o
  63  g_cdc-objs                     := cdc2.o
  64 +g_android-objs                 := android.o f_adb.o f_mass_storage.o
  65
  66  obj-$(CONFIG_USB_ZERO)         += g_zero.o
  67  obj-$(CONFIG_USB_ETH)          += g_ether.o
  68 @@ -42,4 +43,5 @@ obj-$(CONFIG_USB_G_SERIAL)    += g_serial.o
  69  obj-$(CONFIG_USB_G_PRINTER)    += g_printer.o
  70  obj-$(CONFIG_USB_MIDI_GADGET)  += g_midi.o
  71  obj-$(CONFIG_USB_CDC_COMPOSITE) += g_cdc.o
  72 +obj-$(CONFIG_USB_ANDROID)      += g_android.o
  73
  74 --- /dev/null
  75 +++ b/drivers/usb/gadget/android.c
  76 @@ -0,0 +1,345 @@
  77 +/*
  78 + * Gadget Driver for Android
  79 + *
  80 + * Copyright (C) 2008 Google, Inc.
  81 + * Author: Mike Lockwood <lockwood@android.com>
  82 + *
  83 + * This software is licensed under the terms of the GNU General Public
  84 + * License version 2, as published by the Free Software Foundation, and
  85 + * may be copied, distributed, and modified under those terms.
  86 + *
  87 + * This program is distributed in the hope that it will be useful,
  88 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
  89 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  90 + * GNU General Public License for more details.
  91 + *
  92 + */
  93 +
  94 +/* #define DEBUG */
  95 +/* #define VERBOSE_DEBUG */
  96 +
  97 +#include <linux/init.h>
  98 +#include <linux/module.h>
  99 +#include <linux/fs.h>
 100 +
 101 +#include <linux/delay.h>
 102 +#include <linux/kernel.h>
 103 +#include <linux/utsname.h>
 104 +#include <linux/miscdevice.h>
 105 +#include <linux/platform_device.h>
 106 +
 107 +#include <linux/usb/android.h>
 108 +#include <linux/usb/ch9.h>
 109 +#include <linux/usb/composite.h>
 110 +#include <linux/usb/gadget.h>
 111 +
 112 +#include "f_mass_storage.h"
 113 +#include "f_adb.h"
 114 +
 115 +#include "gadget_chips.h"
 116 +
 117 +/*
 118 + * Kbuild is not very cooperative with respect to linking separately
 119 + * compiled library objects into one module.  So for now we won't use
 120 + * separate compilation ... ensuring init/exit sections work to shrink
 121 + * the runtime footprint, and giving us at least some parts of what
 122 + * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
 123 + */
 124 +#include "usbstring.c"
 125 +#include "config.c"
 126 +#include "epautoconf.c"
 127 +#include "composite.c"
 128 +
 129 +MODULE_AUTHOR("Mike Lockwood");
 130 +MODULE_DESCRIPTION("Android Composite USB Driver");
 131 +MODULE_LICENSE("GPL");
 132 +MODULE_VERSION("1.0");
 133 +
 134 +static const char longname[] = "Gadget Android";
 135 +
 136 +/* Default vendor and product IDs, overridden by platform data */
 137 +#define VENDOR_ID              0x18D1
 138 +#define PRODUCT_ID             0x0001
 139 +#define ADB_PRODUCT_ID 0x0002
 140 +
 141 +struct android_dev {
 142 +       struct usb_gadget *gadget;
 143 +       struct usb_composite_dev *cdev;
 144 +
 145 +       int product_id;
 146 +       int adb_product_id;
 147 +       int version;
 148 +
 149 +       int adb_enabled;
 150 +       int nluns;
 151 +};
 152 +
 153 +static atomic_t adb_enable_excl;
 154 +static struct android_dev *_android_dev;
 155 +
 156 +/* string IDs are assigned dynamically */
 157 +
 158 +#define STRING_MANUFACTURER_IDX                0
 159 +#define STRING_PRODUCT_IDX             1
 160 +#define STRING_SERIAL_IDX              2
 161 +
 162 +/* String Table */
 163 +static struct usb_string strings_dev[] = {
 164 +       /* These dummy values should be overridden by platform data */
 165 +       [STRING_MANUFACTURER_IDX].s = "Android",
 166 +       [STRING_PRODUCT_IDX].s = "Android",
 167 +       [STRING_SERIAL_IDX].s = "0123456789ABCDEF",
 168 +       {  }                    /* end of list */
 169 +};
 170 +
 171 +static struct usb_gadget_strings stringtab_dev = {
 172 +       .language       = 0x0409,       /* en-us */
 173 +       .strings        = strings_dev,
 174 +};
 175 +
 176 +static struct usb_gadget_strings *dev_strings[] = {
 177 +       &stringtab_dev,
 178 +       NULL,
 179 +};
 180 +
 181 +static struct usb_device_descriptor device_desc = {
 182 +       .bLength              = sizeof(device_desc),
 183 +       .bDescriptorType      = USB_DT_DEVICE,
 184 +       .bcdUSB               = __constant_cpu_to_le16(0x0200),
 185 +       .bDeviceClass         = USB_CLASS_PER_INTERFACE,
 186 +       .idVendor             = __constant_cpu_to_le16(VENDOR_ID),
 187 +       .idProduct            = __constant_cpu_to_le16(PRODUCT_ID),
 188 +       .bcdDevice            = __constant_cpu_to_le16(0xffff),
 189 +       .bNumConfigurations   = 1,
 190 +};
 191 +
 192 +static int __init android_bind_config(struct usb_configuration *c)
 193 +{
 194 +       struct android_dev *dev = _android_dev;
 195 +       int ret;
 196 +       printk(KERN_DEBUG "android_bind_config\n");
 197 +
 198 +       ret = mass_storage_function_add(dev->cdev, c, dev->nluns);
 199 +       if (ret)
 200 +               return ret;
 201 +       return adb_function_add(dev->cdev, c);
 202 +}
 203 +
 204 +static struct usb_configuration android_config_driver = {
 205 +       .label          = "android",
 206 +       .bind           = android_bind_config,
 207 +       .bConfigurationValue = 1,
 208 +       .bmAttributes   = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
 209 +       .bMaxPower      = 0x80, /* 250ma */
 210 +};
 211 +
 212 +static int __init android_bind(struct usb_composite_dev *cdev)
 213 +{
 214 +       struct android_dev *dev = _android_dev;
 215 +       struct usb_gadget       *gadget = cdev->gadget;
 216 +       int                     gcnum;
 217 +       int                     id;
 218 +       int                     ret;
 219 +
 220 +       printk(KERN_INFO "android_bind\n");
 221 +
 222 +       /* Allocate string descriptor numbers ... note that string
 223 +        * contents can be overridden by the composite_dev glue.
 224 +        */
 225 +       id = usb_string_id(cdev);
 226 +       if (id < 0)
 227 +               return id;
 228 +       strings_dev[STRING_MANUFACTURER_IDX].id = id;
 229 +       device_desc.iManufacturer = id;
 230 +
 231 +       id = usb_string_id(cdev);
 232 +       if (id < 0)
 233 +               return id;
 234 +       strings_dev[STRING_PRODUCT_IDX].id = id;
 235 +       device_desc.iProduct = id;
 236 +
 237 +       id = usb_string_id(cdev);
 238 +       if (id < 0)
 239 +               return id;
 240 +       strings_dev[STRING_SERIAL_IDX].id = id;
 241 +       device_desc.iSerialNumber = id;
 242 +
 243 +       if (gadget->ops->wakeup)
 244 +               android_config_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
 245 +
 246 +       /* register our configuration */
 247 +       ret = usb_add_config(cdev, &android_config_driver);
 248 +       if (ret) {
 249 +               printk(KERN_ERR "usb_add_config failed\n");
 250 +               return ret;
 251 +       }
 252 +
 253 +       gcnum = usb_gadget_controller_number(gadget);
 254 +       if (gcnum >= 0)
 255 +               device_desc.bcdDevice = cpu_to_le16(0x0200 + gcnum);
 256 +       else {
 257 +               /* gadget zero is so simple (for now, no altsettings) that
 258 +                * it SHOULD NOT have problems with bulk-capable hardware.
 259 +                * so just warn about unrcognized controllers -- don't panic.
 260 +                *
 261 +                * things like configuration and altsetting numbering
 262 +                * can need hardware-specific attention though.
 263 +                */
 264 +               pr_warning("%s: controller '%s' not recognized\n",
 265 +                       longname, gadget->name);
 266 +               device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
 267 +       }
 268 +
 269 +       usb_gadget_set_selfpowered(gadget);
 270 +       dev->cdev = cdev;
 271 +
 272 +       return 0;
 273 +}
 274 +
 275 +static struct usb_composite_driver android_usb_driver = {
 276 +       .name           = "android_usb",
 277 +       .dev            = &device_desc,
 278 +       .strings        = dev_strings,
 279 +       .bind           = android_bind,
 280 +};
 281 +
 282 +static void enable_adb(struct android_dev *dev, int enable)
 283 +{
 284 +       if (enable != dev->adb_enabled) {
 285 +               dev->adb_enabled = enable;
 286 +               adb_function_enable(enable);
 287 +
 288 +               /* set product ID to the appropriate value */
 289 +               if (enable)
 290 +                       device_desc.idProduct =
 291 +                               __constant_cpu_to_le16(dev->adb_product_id);
 292 +               else
 293 +                       device_desc.idProduct =
 294 +                               __constant_cpu_to_le16(dev->product_id);
 295 +               if (dev->cdev)
 296 +                       dev->cdev->desc.idProduct = device_desc.idProduct;
 297 +
 298 +               /* force reenumeration */
 299 +               if (dev->cdev && dev->cdev->gadget &&
 300 +                               dev->cdev->gadget->speed != USB_SPEED_UNKNOWN) {
 301 +                       usb_gadget_disconnect(dev->cdev->gadget);
 302 +                       msleep(10);
 303 +                       usb_gadget_connect(dev->cdev->gadget);
 304 +               }
 305 +       }
 306 +}
 307 +
 308 +static int adb_enable_open(struct inode *ip, struct file *fp)
 309 +{
 310 +       if (atomic_inc_return(&adb_enable_excl) != 1) {
 311 +               atomic_dec(&adb_enable_excl);
 312 +               return -EBUSY;
 313 +       }
 314 +
 315 +       printk(KERN_INFO "enabling adb\n");
 316 +       enable_adb(_android_dev, 1);
 317 +
 318 +       return 0;
 319 +}
 320 +
 321 +static int adb_enable_release(struct inode *ip, struct file *fp)
 322 +{
 323 +       printk(KERN_INFO "disabling adb\n");
 324 +       enable_adb(_android_dev, 0);
 325 +       atomic_dec(&adb_enable_excl);
 326 +       return 0;
 327 +}
 328 +
 329 +static struct file_operations adb_enable_fops = {
 330 +       .owner =   THIS_MODULE,
 331 +       .open =    adb_enable_open,
 332 +       .release = adb_enable_release,
 333 +};
 334 +
 335 +static struct miscdevice adb_enable_device = {
 336 +       .minor = MISC_DYNAMIC_MINOR,
 337 +       .name = "android_adb_enable",
 338 +       .fops = &adb_enable_fops,
 339 +};
 340 +
 341 +static int __init android_probe(struct platform_device *pdev)
 342 +{
 343 +       struct android_usb_platform_data *pdata = pdev->dev.platform_data;
 344 +       struct android_dev *dev = _android_dev;
 345 +
 346 +       printk(KERN_INFO "android_probe pdata: %p\n", pdata);
 347 +
 348 +       if (pdata) {
 349 +               if (pdata->vendor_id)
 350 +                       device_desc.idVendor =
 351 +                               __constant_cpu_to_le16(pdata->vendor_id);
 352 +               if (pdata->product_id) {
 353 +                       dev->product_id = pdata->product_id;
 354 +                       device_desc.idProduct =
 355 +                               __constant_cpu_to_le16(pdata->product_id);
 356 +               }
 357 +               if (pdata->adb_product_id)
 358 +                       dev->adb_product_id = pdata->adb_product_id;
 359 +               if (pdata->version)
 360 +                       dev->version = pdata->version;
 361 +
 362 +               if (pdata->product_name)
 363 +                       strings_dev[STRING_PRODUCT_IDX].s = pdata->product_name;
 364 +               if (pdata->manufacturer_name)
 365 +                       strings_dev[STRING_MANUFACTURER_IDX].s =
 366 +                                       pdata->manufacturer_name;
 367 +               if (pdata->serial_number)
 368 +                       strings_dev[STRING_SERIAL_IDX].s = pdata->serial_number;
 369 +               dev->nluns = pdata->nluns;
 370 +       }
 371 +
 372 +       return 0;
 373 +}
 374 +
 375 +static struct platform_driver android_platform_driver = {
 376 +       .driver = { .name = "android_usb", },
 377 +       .probe = android_probe,
 378 +};
 379 +
 380 +static int __init init(void)
 381 +{
 382 +       struct android_dev *dev;
 383 +       int ret;
 384 +
 385 +       printk(KERN_INFO "android init\n");
 386 +
 387 +       dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 388 +       if (!dev)
 389 +               return -ENOMEM;
 390 +
 391 +       /* set default values, which should be overridden by platform data */
 392 +       dev->product_id = PRODUCT_ID;
 393 +       dev->adb_product_id = ADB_PRODUCT_ID;
 394 +       _android_dev = dev;
 395 +
 396 +       ret = platform_driver_register(&android_platform_driver);
 397 +       if (ret)
 398 +               return ret;
 399 +       ret = misc_register(&adb_enable_device);
 400 +       if (ret) {
 401 +               platform_driver_unregister(&android_platform_driver);
 402 +               return ret;
 403 +       }
 404 +       ret = usb_composite_register(&android_usb_driver);
 405 +       if (ret) {
 406 +               misc_deregister(&adb_enable_device);
 407 +               platform_driver_unregister(&android_platform_driver);
 408 +       }
 409 +       return ret;
 410 +}
 411 +module_init(init);
 412 +
 413 +static void __exit cleanup(void)
 414 +{
 415 +       usb_composite_unregister(&android_usb_driver);
 416 +       misc_deregister(&adb_enable_device);
 417 +       platform_driver_unregister(&android_platform_driver);
 418 +       kfree(_android_dev);
 419 +       _android_dev = NULL;
 420 +}
 421 +module_exit(cleanup);
 422 --- /dev/null
 423 +++ b/drivers/usb/gadget/f_adb.c
 424 @@ -0,0 +1,668 @@
 425 +/*
 426 + * Gadget Driver for Android ADB
 427 + *
 428 + * Copyright (C) 2008 Google, Inc.
 429 + * Author: Mike Lockwood <lockwood@android.com>
 430 + *
 431 + * This software is licensed under the terms of the GNU General Public
 432 + * License version 2, as published by the Free Software Foundation, and
 433 + * may be copied, distributed, and modified under those terms.
 434 + *
 435 + * This program is distributed in the hope that it will be useful,
 436 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 437 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 438 + * GNU General Public License for more details.
 439 + *
 440 + */
 441 +
 442 +/* #define DEBUG */
 443 +/* #define VERBOSE_DEBUG */
 444 +
 445 +#include <linux/module.h>
 446 +#include <linux/init.h>
 447 +#include <linux/poll.h>
 448 +#include <linux/delay.h>
 449 +#include <linux/wait.h>
 450 +#include <linux/err.h>
 451 +#include <linux/interrupt.h>
 452 +
 453 +#include <linux/types.h>
 454 +#include <linux/device.h>
 455 +#include <linux/miscdevice.h>
 456 +
 457 +#include <linux/usb/ch9.h>
 458 +#include <linux/usb/composite.h>
 459 +#include <linux/usb/gadget.h>
 460 +
 461 +#include "f_adb.h"
 462 +
 463 +#define BULK_BUFFER_SIZE           4096
 464 +
 465 +/* number of rx and tx requests to allocate */
 466 +#define RX_REQ_MAX 4
 467 +#define TX_REQ_MAX 4
 468 +
 469 +static const char shortname[] = "android_adb";
 470 +
 471 +struct adb_dev {
 472 +       struct usb_function function;
 473 +       struct usb_composite_dev *cdev;
 474 +       spinlock_t lock;
 475 +
 476 +       struct usb_ep *ep_in;
 477 +       struct usb_ep *ep_out;
 478 +
 479 +       int online;
 480 +       int error;
 481 +
 482 +       atomic_t read_excl;
 483 +       atomic_t write_excl;
 484 +       atomic_t open_excl;
 485 +
 486 +       struct list_head tx_idle;
 487 +       struct list_head rx_idle;
 488 +       struct list_head rx_done;
 489 +
 490 +       wait_queue_head_t read_wq;
 491 +       wait_queue_head_t write_wq;
 492 +
 493 +       /* the request we're currently reading from */
 494 +       struct usb_request *read_req;
 495 +       unsigned char *read_buf;
 496 +       unsigned read_count;
 497 +};
 498 +
 499 +static struct usb_interface_descriptor adb_interface_desc = {
 500 +       .bLength                = USB_DT_INTERFACE_SIZE,
 501 +       .bDescriptorType        = USB_DT_INTERFACE,
 502 +       .bInterfaceNumber       = 0,
 503 +       .bNumEndpoints          = 2,
 504 +       .bInterfaceClass        = 0xFF,
 505 +       .bInterfaceSubClass     = 0x42,
 506 +       .bInterfaceProtocol     = 1,
 507 +};
 508 +
 509 +static struct usb_endpoint_descriptor adb_highspeed_in_desc = {
 510 +       .bLength                = USB_DT_ENDPOINT_SIZE,
 511 +       .bDescriptorType        = USB_DT_ENDPOINT,
 512 +       .bEndpointAddress       = USB_DIR_IN,
 513 +       .bmAttributes           = USB_ENDPOINT_XFER_BULK,
 514 +       .wMaxPacketSize         = __constant_cpu_to_le16(512),
 515 +};
 516 +
 517 +static struct usb_endpoint_descriptor adb_highspeed_out_desc = {
 518 +       .bLength                = USB_DT_ENDPOINT_SIZE,
 519 +       .bDescriptorType        = USB_DT_ENDPOINT,
 520 +       .bEndpointAddress       = USB_DIR_OUT,
 521 +       .bmAttributes           = USB_ENDPOINT_XFER_BULK,
 522 +       .wMaxPacketSize         = __constant_cpu_to_le16(512),
 523 +};
 524 +
 525 +static struct usb_endpoint_descriptor adb_fullspeed_in_desc = {
 526 +       .bLength                = USB_DT_ENDPOINT_SIZE,
 527 +       .bDescriptorType        = USB_DT_ENDPOINT,
 528 +       .bEndpointAddress       = USB_DIR_IN,
 529 +       .bmAttributes           = USB_ENDPOINT_XFER_BULK,
 530 +};
 531 +
 532 +static struct usb_endpoint_descriptor adb_fullspeed_out_desc = {
 533 +       .bLength                = USB_DT_ENDPOINT_SIZE,
 534 +       .bDescriptorType        = USB_DT_ENDPOINT,
 535 +       .bEndpointAddress       = USB_DIR_OUT,
 536 +       .bmAttributes           = USB_ENDPOINT_XFER_BULK,
 537 +};
 538 +
 539 +static struct usb_descriptor_header *fs_adb_descs[] = {
 540 +       (struct usb_descriptor_header *) &adb_interface_desc,
 541 +       (struct usb_descriptor_header *) &adb_fullspeed_in_desc,
 542 +       (struct usb_descriptor_header *) &adb_fullspeed_out_desc,
 543 +       NULL,
 544 +};
 545 +
 546 +static struct usb_descriptor_header *hs_adb_descs[] = {
 547 +       (struct usb_descriptor_header *) &adb_interface_desc,
 548 +       (struct usb_descriptor_header *) &adb_highspeed_in_desc,
 549 +       (struct usb_descriptor_header *) &adb_highspeed_out_desc,
 550 +       NULL,
 551 +};
 552 +
 553 +/* used when adb function is disabled */
 554 +static struct usb_descriptor_header *null_adb_descs[] = {
 555 +       NULL,
 556 +};
 557 +
 558 +
 559 +/* temporary variable used between adb_open() and adb_gadget_bind() */
 560 +static struct adb_dev *_adb_dev;
 561 +
 562 +static inline struct adb_dev *func_to_dev(struct usb_function *f)
 563 +{
 564 +       return container_of(f, struct adb_dev, function);
 565 +}
 566 +
 567 +
 568 +static struct usb_request *adb_request_new(struct usb_ep *ep, int buffer_size)
 569 +{
 570 +       struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
 571 +       if (!req)
 572 +               return NULL;
 573 +
 574 +       /* now allocate buffers for the requests */
 575 +       req->buf = kmalloc(buffer_size, GFP_KERNEL);
 576 +       if (!req->buf) {
 577 +               usb_ep_free_request(ep, req);
 578 +               return NULL;
 579 +       }
 580 +
 581 +       return req;
 582 +}
 583 +
 584 +static void adb_request_free(struct usb_request *req, struct usb_ep *ep)
 585 +{
 586 +       if (req) {
 587 +               kfree(req->buf);
 588 +               usb_ep_free_request(ep, req);
 589 +       }
 590 +}
 591 +
 592 +static inline int _lock(atomic_t *excl)
 593 +{
 594 +       if (atomic_inc_return(excl) == 1) {
 595 +               return 0;
 596 +       } else {
 597 +               atomic_dec(excl);
 598 +               return -1;
 599 +       }
 600 +}
 601 +
 602 +static inline void _unlock(atomic_t *excl)
 603 +{
 604 +       atomic_dec(excl);
 605 +}
 606 +
 607 +/* add a request to the tail of a list */
 608 +void req_put(struct adb_dev *dev, struct list_head *head,
 609 +               struct usb_request *req)
 610 +{
 611 +       unsigned long flags;
 612 +
 613 +       spin_lock_irqsave(&dev->lock, flags);
 614 +       list_add_tail(&req->list, head);
 615 +       spin_unlock_irqrestore(&dev->lock, flags);
 616 +}
 617 +
 618 +/* remove a request from the head of a list */
 619 +struct usb_request *req_get(struct adb_dev *dev, struct list_head *head)
 620 +{
 621 +       unsigned long flags;
 622 +       struct usb_request *req;
 623 +
 624 +       spin_lock_irqsave(&dev->lock, flags);
 625 +       if (list_empty(head)) {
 626 +               req = 0;
 627 +       } else {
 628 +               req = list_first_entry(head, struct usb_request, list);
 629 +               list_del(&req->list);
 630 +       }
 631 +       spin_unlock_irqrestore(&dev->lock, flags);
 632 +       return req;
 633 +}
 634 +
 635 +static void adb_complete_in(struct usb_ep *ep, struct usb_request *req)
 636 +{
 637 +       struct adb_dev *dev = _adb_dev;
 638 +
 639 +       if (req->status != 0)
 640 +               dev->error = 1;
 641 +
 642 +       req_put(dev, &dev->tx_idle, req);
 643 +
 644 +       wake_up(&dev->write_wq);
 645 +}
 646 +
 647 +static void adb_complete_out(struct usb_ep *ep, struct usb_request *req)
 648 +{
 649 +       struct adb_dev *dev = _adb_dev;
 650 +
 651 +       if (req->status != 0) {
 652 +               dev->error = 1;
 653 +               req_put(dev, &dev->rx_idle, req);
 654 +       } else {
 655 +               req_put(dev, &dev->rx_done, req);
 656 +       }
 657 +
 658 +       wake_up(&dev->read_wq);
 659 +}
 660 +
 661 +static int __init create_bulk_endpoints(struct adb_dev *dev,
 662 +                               struct usb_endpoint_descriptor *in_desc,
 663 +                               struct usb_endpoint_descriptor *out_desc)
 664 +{
 665 +       struct usb_composite_dev *cdev = dev->cdev;
 666 +       struct usb_request *req;
 667 +       struct usb_ep *ep;
 668 +       int i;
 669 +
 670 +       DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
 671 +
 672 +       ep = usb_ep_autoconfig(cdev->gadget, in_desc);
 673 +       if (!ep) {
 674 +               DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
 675 +               return -ENODEV;
 676 +       }
 677 +       DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
 678 +       dev->ep_in = ep;
 679 +
 680 +       ep = usb_ep_autoconfig(cdev->gadget, out_desc);
 681 +       if (!ep) {
 682 +               DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
 683 +               return -ENODEV;
 684 +       }
 685 +       DBG(cdev, "usb_ep_autoconfig for adb ep_out got %s\n", ep->name);
 686 +       dev->ep_out = ep;
 687 +
 688 +       /* now allocate requests for our endpoints */
 689 +       for (i = 0; i < RX_REQ_MAX; i++) {
 690 +               req = adb_request_new(dev->ep_out, BULK_BUFFER_SIZE);
 691 +               if (!req)
 692 +                       goto fail;
 693 +               req->complete = adb_complete_out;
 694 +               req_put(dev, &dev->rx_idle, req);
 695 +       }
 696 +
 697 +       for (i = 0; i < TX_REQ_MAX; i++) {
 698 +               req = adb_request_new(dev->ep_in, BULK_BUFFER_SIZE);
 699 +               if (!req)
 700 +                       goto fail;
 701 +               req->complete = adb_complete_in;
 702 +               req_put(dev, &dev->tx_idle, req);
 703 +       }
 704 +
 705 +       return 0;
 706 +
 707 +fail:
 708 +       printk(KERN_ERR "adb_bind() could not allocate requests\n");
 709 +       return -1;
 710 +}
 711 +
 712 +static ssize_t adb_read(struct file *fp, char __user *buf,
 713 +                               size_t count, loff_t *pos)
 714 +{
 715 +       struct adb_dev *dev = fp->private_data;
 716 +       struct usb_composite_dev *cdev = dev->cdev;
 717 +       struct usb_request *req;
 718 +       int r = count, xfer;
 719 +       int ret;
 720 +
 721 +       DBG(cdev, "adb_read(%d)\n", count);
 722 +
 723 +       if (_lock(&dev->read_excl))
 724 +               return -EBUSY;
 725 +
 726 +       /* we will block until we're online */
 727 +       while (!(dev->online || dev->error)) {
 728 +               DBG(cdev, "adb_read: waiting for online state\n");
 729 +               ret = wait_event_interruptible(dev->read_wq,
 730 +                               (dev->online || dev->error));
 731 +               if (ret < 0) {
 732 +                       _unlock(&dev->read_excl);
 733 +                       return ret;
 734 +               }
 735 +       }
 736 +
 737 +       while (count > 0) {
 738 +               if (dev->error) {
 739 +                       DBG(cdev, "adb_read dev->error\n");
 740 +                       r = -EIO;
 741 +                       break;
 742 +               }
 743 +
 744 +               /* if we have idle read requests, get them queued */
 745 +               while ((req = req_get(dev, &dev->rx_idle))) {
 746 +requeue_req:
 747 +                       req->length = BULK_BUFFER_SIZE;
 748 +                       ret = usb_ep_queue(dev->ep_out, req, GFP_ATOMIC);
 749 +
 750 +                       if (ret < 0) {
 751 +                               r = -EIO;
 752 +                               dev->error = 1;
 753 +                               req_put(dev, &dev->rx_idle, req);
 754 +                               goto fail;
 755 +                       } else {
 756 +                               DBG(cdev, "rx %p queue\n", req);
 757 +                       }
 758 +               }
 759 +
 760 +               /* if we have data pending, give it to userspace */
 761 +               if (dev->read_count > 0) {
 762 +                       if (dev->read_count < count)
 763 +                               xfer = dev->read_count;
 764 +                       else
 765 +                               xfer = count;
 766 +
 767 +                       if (copy_to_user(buf, dev->read_buf, xfer)) {
 768 +                               r = -EFAULT;
 769 +                               break;
 770 +                       }
 771 +                       dev->read_buf += xfer;
 772 +                       dev->read_count -= xfer;
 773 +                       buf += xfer;
 774 +                       count -= xfer;
 775 +
 776 +                       /* if we've emptied the buffer, release the request */
 777 +                       if (dev->read_count == 0) {
 778 +                               req_put(dev, &dev->rx_idle, dev->read_req);
 779 +                               dev->read_req = 0;
 780 +                       }
 781 +                       continue;
 782 +               }
 783 +
 784 +               /* wait for a request to complete */
 785 +               req = 0;
 786 +               ret = wait_event_interruptible(dev->read_wq,
 787 +                       ((req = req_get(dev, &dev->rx_done)) || dev->error));
 788 +               if (req != 0) {
 789 +                       /* if we got a 0-len one we need to put it back into
 790 +                       ** service.  if we made it the current read req we'd
 791 +                       ** be stuck forever
 792 +                       */
 793 +                       if (req->actual == 0)
 794 +                               goto requeue_req;
 795 +
 796 +                       dev->read_req = req;
 797 +                       dev->read_count = req->actual;
 798 +                       dev->read_buf = req->buf;
 799 +                       DBG(cdev, "rx %p %d\n", req, req->actual);
 800 +               }
 801 +
 802 +               if (ret < 0) {
 803 +                       r = ret;
 804 +                       break;
 805 +               }
 806 +       }
 807 +
 808 +fail:
 809 +       _unlock(&dev->read_excl);
 810 +       DBG(cdev, "adb_read returning %d\n", r);
 811 +       return r;
 812 +}
 813 +
 814 +static ssize_t adb_write(struct file *fp, const char __user *buf,
 815 +                                size_t count, loff_t *pos)
 816 +{
 817 +       struct adb_dev *dev = fp->private_data;
 818 +       struct usb_composite_dev *cdev = dev->cdev;
 819 +       struct usb_request *req = 0;
 820 +       int r = count, xfer;
 821 +       int ret;
 822 +
 823 +       DBG(cdev, "adb_write(%d)\n", count);
 824 +
 825 +       if (_lock(&dev->write_excl))
 826 +               return -EBUSY;
 827 +
 828 +       while (count > 0) {
 829 +               if (dev->error) {
 830 +                       DBG(cdev, "adb_write dev->error\n");
 831 +                       r = -EIO;
 832 +                       break;
 833 +               }
 834 +
 835 +               /* get an idle tx request to use */
 836 +               req = 0;
 837 +               ret = wait_event_interruptible(dev->write_wq,
 838 +                       ((req = req_get(dev, &dev->tx_idle)) || dev->error));
 839 +
 840 +               if (ret < 0) {
 841 +                       r = ret;
 842 +                       break;
 843 +               }
 844 +
 845 +               if (req != 0) {
 846 +                       if (count > BULK_BUFFER_SIZE)
 847 +                               xfer = BULK_BUFFER_SIZE;
 848 +                       else
 849 +                               xfer = count;
 850 +                       if (copy_from_user(req->buf, buf, xfer)) {
 851 +                               r = -EFAULT;
 852 +                               break;
 853 +                       }
 854 +
 855 +                       req->length = xfer;
 856 +                       ret = usb_ep_queue(dev->ep_in, req, GFP_ATOMIC);
 857 +                       if (ret < 0) {
 858 +                               DBG(cdev, "adb_write: xfer error %d\n", ret);
 859 +                               dev->error = 1;
 860 +                               r = -EIO;
 861 +                               break;
 862 +                       }
 863 +
 864 +                       buf += xfer;
 865 +                       count -= xfer;
 866 +
 867 +                       /* zero this so we don't try to free it on error exit */
 868 +                       req = 0;
 869 +               }
 870 +       }
 871 +
 872 +       if (req)
 873 +               req_put(dev, &dev->tx_idle, req);
 874 +
 875 +       _unlock(&dev->write_excl);
 876 +       DBG(cdev, "adb_write returning %d\n", r);
 877 +       return r;
 878 +}
 879 +
 880 +static int adb_open(struct inode *ip, struct file *fp)
 881 +{
 882 +       printk(KERN_INFO "adb_open\n");
 883 +       if (_lock(&_adb_dev->open_excl))
 884 +               return -EBUSY;
 885 +
 886 +       fp->private_data = _adb_dev;
 887 +
 888 +       /* clear the error latch */
 889 +       _adb_dev->error = 0;
 890 +
 891 +       return 0;
 892 +}
 893 +
 894 +static int adb_release(struct inode *ip, struct file *fp)
 895 +{
 896 +       printk(KERN_INFO "adb_release\n");
 897 +       _unlock(&_adb_dev->open_excl);
 898 +       return 0;
 899 +}
 900 +
 901 +/* file operations for ADB device /dev/android_adb */
 902 +static struct file_operations adb_fops = {
 903 +       .owner = THIS_MODULE,
 904 +       .read = adb_read,
 905 +       .write = adb_write,
 906 +       .open = adb_open,
 907 +       .release = adb_release,
 908 +};
 909 +
 910 +static struct miscdevice adb_device = {
 911 +       .minor = MISC_DYNAMIC_MINOR,
 912 +       .name = shortname,
 913 +       .fops = &adb_fops,
 914 +};
 915 +
 916 +static int __init
 917 +adb_function_bind(struct usb_configuration *c, struct usb_function *f)
 918 +{
 919 +       struct usb_composite_dev *cdev = c->cdev;
 920 +       struct adb_dev  *dev = func_to_dev(f);
 921 +       int                     id;
 922 +       int                     ret;
 923 +
 924 +       dev->cdev = cdev;
 925 +       DBG(cdev, "adb_function_bind dev: %p\n", dev);
 926 +
 927 +       /* allocate interface ID(s) */
 928 +       id = usb_interface_id(c, f);
 929 +       if (id < 0)
 930 +               return id;
 931 +       adb_interface_desc.bInterfaceNumber = id;
 932 +
 933 +       /* allocate endpoints */
 934 +       ret = create_bulk_endpoints(dev, &adb_fullspeed_in_desc,
 935 +                       &adb_fullspeed_out_desc);
 936 +       if (ret)
 937 +               return ret;
 938 +
 939 +       /* support high speed hardware */
 940 +       if (gadget_is_dualspeed(c->cdev->gadget)) {
 941 +               adb_highspeed_in_desc.bEndpointAddress =
 942 +                       adb_fullspeed_in_desc.bEndpointAddress;
 943 +               adb_highspeed_out_desc.bEndpointAddress =
 944 +                       adb_fullspeed_out_desc.bEndpointAddress;
 945 +       }
 946 +
 947 +       DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
 948 +                       gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
 949 +                       f->name, dev->ep_in->name, dev->ep_out->name);
 950 +       return 0;
 951 +}
 952 +
 953 +static void
 954 +adb_function_unbind(struct usb_configuration *c, struct usb_function *f)
 955 +{
 956 +       struct adb_dev  *dev = func_to_dev(f);
 957 +       struct usb_request *req;
 958 +
 959 +       spin_lock_irq(&dev->lock);
 960 +
 961 +       while ((req = req_get(dev, &dev->rx_idle)))
 962 +               adb_request_free(req, dev->ep_out);
 963 +       while ((req = req_get(dev, &dev->tx_idle)))
 964 +               adb_request_free(req, dev->ep_in);
 965 +
 966 +       dev->online = 0;
 967 +       dev->error = 1;
 968 +       spin_unlock_irq(&dev->lock);
 969 +
 970 +       misc_deregister(&adb_device);
 971 +       kfree(_adb_dev);
 972 +       _adb_dev = NULL;
 973 +}
 974 +
 975 +static int adb_function_set_alt(struct usb_function *f,
 976 +               unsigned intf, unsigned alt)
 977 +{
 978 +       struct adb_dev  *dev = func_to_dev(f);
 979 +       struct usb_composite_dev *cdev = f->config->cdev;
 980 +       int ret;
 981 +
 982 +       DBG(cdev, "adb_function_set_alt intf: %d alt: %d\n", intf, alt);
 983 +       ret = usb_ep_enable(dev->ep_in,
 984 +                       ep_choose(cdev->gadget,
 985 +                               &adb_highspeed_in_desc,
 986 +                               &adb_fullspeed_in_desc));
 987 +       if (ret)
 988 +               return ret;
 989 +       ret = usb_ep_enable(dev->ep_out,
 990 +                       ep_choose(cdev->gadget,
 991 +                               &adb_highspeed_out_desc,
 992 +                               &adb_fullspeed_out_desc));
 993 +       if (ret) {
 994 +               usb_ep_disable(dev->ep_in);
 995 +               return ret;
 996 +       }
 997 +       dev->online = 1;
 998 +
 999 +       /* readers may be blocked waiting for us to go online */
1000 +       wake_up(&dev->read_wq);
1001 +       return 0;
1002 +}
1003 +
1004 +static void adb_function_disable(struct usb_function *f)
1005 +{
1006 +       struct adb_dev  *dev = func_to_dev(f);
1007 +       struct usb_composite_dev        *cdev = dev->cdev;
1008 +
1009 +       DBG(cdev, "adb_function_disable\n");
1010 +       dev->online = 0;
1011 +       dev->error = 1;
1012 +       usb_ep_disable(dev->ep_in);
1013 +       usb_ep_disable(dev->ep_out);
1014 +
1015 +       /* readers may be blocked waiting for us to go online */
1016 +       wake_up(&dev->read_wq);
1017 +
1018 +       VDBG(cdev, "%s disabled\n", dev->function.name);
1019 +}
1020 +
1021 +int __init adb_function_add(struct usb_composite_dev *cdev,
1022 +       struct usb_configuration *c)
1023 +{
1024 +       struct adb_dev *dev;
1025 +       int ret;
1026 +
1027 +       printk(KERN_INFO "adb_function_add\n");
1028 +
1029 +       dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1030 +       if (!dev)
1031 +               return -ENOMEM;
1032 +
1033 +       spin_lock_init(&dev->lock);
1034 +
1035 +       init_waitqueue_head(&dev->read_wq);
1036 +       init_waitqueue_head(&dev->write_wq);
1037 +
1038 +       atomic_set(&dev->open_excl, 0);
1039 +       atomic_set(&dev->read_excl, 0);
1040 +       atomic_set(&dev->write_excl, 0);
1041 +
1042 +       INIT_LIST_HEAD(&dev->rx_idle);
1043 +       INIT_LIST_HEAD(&dev->rx_done);
1044 +       INIT_LIST_HEAD(&dev->tx_idle);
1045 +
1046 +       dev->cdev = cdev;
1047 +       dev->function.name = "adb";
1048 +       dev->function.descriptors = null_adb_descs;
1049 +       dev->function.hs_descriptors = null_adb_descs;
1050 +       dev->function.bind = adb_function_bind;
1051 +       dev->function.unbind = adb_function_unbind;
1052 +       dev->function.set_alt = adb_function_set_alt;
1053 +       dev->function.disable = adb_function_disable;
1054 +
1055 +       /* _adb_dev must be set before calling usb_gadget_register_driver */
1056 +       _adb_dev = dev;
1057 +
1058 +       ret = misc_register(&adb_device);
1059 +       if (ret)
1060 +               goto err1;
1061 +       ret = usb_add_function(c, &dev->function);
1062 +       if (ret)
1063 +               goto err2;
1064 +
1065 +       return 0;
1066 +
1067 +err2:
1068 +       misc_deregister(&adb_device);
1069 +err1:
1070 +       kfree(dev);
1071 +       printk(KERN_ERR "adb gadget driver failed to initialize\n");
1072 +       return ret;
1073 +}
1074 +
1075 +void adb_function_enable(int enable)
1076 +{
1077 +       struct adb_dev *dev = _adb_dev;
1078 +
1079 +       if (dev) {
1080 +               DBG(dev->cdev, "adb_function_enable(%s)\n",
1081 +                       enable ? "true" : "false");
1082 +
1083 +               if (enable) {
1084 +                       dev->function.descriptors = fs_adb_descs;
1085 +                       dev->function.hs_descriptors = hs_adb_descs;
1086 +               } else {
1087 +                       dev->function.descriptors = null_adb_descs;
1088 +                       dev->function.hs_descriptors = null_adb_descs;
1089 +               }
1090 +       }
1091 +}
1092 +
1093 --- /dev/null
1094 +++ b/drivers/usb/gadget/f_adb.h
1095 @@ -0,0 +1,25 @@
1096 +/*
1097 + * Gadget Driver for Android ADB
1098 + *
1099 + * Copyright (C) 2008 Google, Inc.
1100 + * Author: Mike Lockwood <lockwood@android.com>
1101 + *
1102 + * This software is licensed under the terms of the GNU General Public
1103 + * License version 2, as published by the Free Software Foundation, and
1104 + * may be copied, distributed, and modified under those terms.
1105 + *
1106 + * This program is distributed in the hope that it will be useful,
1107 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
1108 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
1109 + * GNU General Public License for more details.
1110 + *
1111 + */
1112 +
1113 +#ifndef __F_ADB_H
1114 +#define __F_ADB_H
1115 +
1116 +int adb_function_add(struct usb_composite_dev *cdev,
1117 +       struct usb_configuration *c);
1118 +void adb_function_enable(int enable);
1119 +
1120 +#endif /* __F_ADB_H */
1121 --- /dev/null
1122 +++ b/drivers/usb/gadget/f_mass_storage.c
1123 @@ -0,0 +1,2906 @@
1124 +/*
1125 + * drivers/usb/gadget/f_mass_storage.c
1126 + *
1127 + * Function Driver for USB Mass Storage
1128 + *
1129 + * Copyright (C) 2008 Google, Inc.
1130 + * Author: Mike Lockwood <lockwood@android.com>
1131 + *
1132 + * Based heavily on the file_storage gadget driver in
1133 + * drivers/usb/gadget/file_storage.c and licensed under the same terms:
1134 + *
1135 + * Copyright (C) 2003-2007 Alan Stern
1136 + * All rights reserved.
1137 + *
1138 + * Redistribution and use in source and binary forms, with or without
1139 + * modification, are permitted provided that the following conditions
1140 + * are met:
1141 + * 1. Redistributions of source code must retain the above copyright
1142 + *    notice, this list of conditions, and the following disclaimer,
1143 + *    without modification.
1144 + * 2. Redistributions in binary form must reproduce the above copyright
1145 + *    notice, this list of conditions and the following disclaimer in the
1146 + *    documentation and/or other materials provided with the distribution.
1147 + * 3. The names of the above-listed copyright holders may not be used
1148 + *    to endorse or promote products derived from this software without
1149 + *    specific prior written permission.
1150 + *
1151 + * ALTERNATIVELY, this software may be distributed under the terms of the
1152 + * GNU General Public License ("GPL") as published by the Free Software
1153 + * Foundation, either version 2 of that License or (at your option) any
1154 + * later version.
1155 + *
1156 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
1157 + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
1158 + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
1159 + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
1160 + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
1161 + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
1162 + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
1163 + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
1164 + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
1165 + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
1166 + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1167 + */
1168 +
1169 +/* #define DEBUG */
1170 +/* #define VERBOSE_DEBUG */
1171 +/* #define DUMP_MSGS */
1172 +
1173 +
1174 +#include <linux/blkdev.h>
1175 +#include <linux/completion.h>
1176 +#include <linux/dcache.h>
1177 +#include <linux/delay.h>
1178 +#include <linux/device.h>
1179 +#include <linux/fcntl.h>
1180 +#include <linux/file.h>
1181 +#include <linux/fs.h>
1182 +#include <linux/kref.h>
1183 +#include <linux/kthread.h>
1184 +#include <linux/limits.h>
1185 +#include <linux/rwsem.h>
1186 +#include <linux/slab.h>
1187 +#include <linux/spinlock.h>
1188 +#include <linux/string.h>
1189 +#include <linux/switch.h>
1190 +#include <linux/freezer.h>
1191 +#include <linux/utsname.h>
1192 +#include <linux/wakelock.h>
1193 +
1194 +#include <linux/usb_usual.h>
1195 +#include <linux/usb/ch9.h>
1196 +#include <linux/usb/composite.h>
1197 +#include <linux/usb/gadget.h>
1198 +
1199 +#include "f_mass_storage.h"
1200 +#include "gadget_chips.h"
1201 +
1202 +
1203 +#define BULK_BUFFER_SIZE           4096
1204 +
1205 +/*-------------------------------------------------------------------------*/
1206 +
1207 +#define DRIVER_NAME            "usb_mass_storage"
1208 +#define MAX_LUNS               8
1209 +
1210 +static const char shortname[] = DRIVER_NAME;
1211 +
1212 +#ifdef DEBUG
1213 +#define LDBG(lun, fmt, args...) \
1214 +       dev_dbg(&(lun)->dev , fmt , ## args)
1215 +#define MDBG(fmt,args...) \
1216 +       printk(KERN_DEBUG DRIVER_NAME ": " fmt , ## args)
1217 +#else
1218 +#define LDBG(lun, fmt, args...) \
1219 +       do { } while (0)
1220 +#define MDBG(fmt,args...) \
1221 +       do { } while (0)
1222 +#undef VERBOSE_DEBUG
1223 +#undef DUMP_MSGS
1224 +#endif /* DEBUG */
1225 +
1226 +#ifdef VERBOSE_DEBUG
1227 +#define VLDBG  LDBG
1228 +#else
1229 +#define VLDBG(lun, fmt, args...) \
1230 +       do { } while (0)
1231 +#endif /* VERBOSE_DEBUG */
1232 +
1233 +#define LERROR(lun, fmt, args...) \
1234 +       dev_err(&(lun)->dev , fmt , ## args)
1235 +#define LWARN(lun, fmt, args...) \
1236 +       dev_warn(&(lun)->dev , fmt , ## args)
1237 +#define LINFO(lun, fmt, args...) \
1238 +       dev_info(&(lun)->dev , fmt , ## args)
1239 +
1240 +#define MINFO(fmt,args...) \
1241 +       printk(KERN_INFO DRIVER_NAME ": " fmt , ## args)
1242 +
1243 +#undef DBG
1244 +#undef VDBG
1245 +#undef ERROR
1246 +#undef WARNING
1247 +#undef INFO
1248 +#define DBG(d, fmt, args...) \
1249 +       dev_dbg(&(d)->cdev->gadget->dev , fmt , ## args)
1250 +#define VDBG(d, fmt, args...) \
1251 +       dev_vdbg(&(d)->cdev->gadget->dev , fmt , ## args)
1252 +#define ERROR(d, fmt, args...) \
1253 +       dev_err(&(d)->cdev->gadget->dev , fmt , ## args)
1254 +#define WARNING(d, fmt, args...) \
1255 +       dev_warn(&(d)->cdev->gadget->dev , fmt , ## args)
1256 +#define INFO(d, fmt, args...) \
1257 +       dev_info(&(d)->cdev->gadget->dev , fmt , ## args)
1258 +
1259 +
1260 +/*-------------------------------------------------------------------------*/
1261 +
1262 +/* Bulk-only data structures */
1263 +
1264 +/* Command Block Wrapper */
1265 +struct bulk_cb_wrap {
1266 +       __le32  Signature;              /* Contains 'USBC' */
1267 +       u32     Tag;                    /* Unique per command id */
1268 +       __le32  DataTransferLength;     /* Size of the data */
1269 +       u8      Flags;                  /* Direction in bit 7 */
1270 +       u8      Lun;                    /* LUN (normally 0) */
1271 +       u8      Length;                 /* Of the CDB, <= MAX_COMMAND_SIZE */
1272 +       u8      CDB[16];                /* Command Data Block */
1273 +};
1274 +
1275 +#define USB_BULK_CB_WRAP_LEN   31
1276 +#define USB_BULK_CB_SIG                0x43425355      /* Spells out USBC */
1277 +#define USB_BULK_IN_FLAG       0x80
1278 +
1279 +/* Command Status Wrapper */
1280 +struct bulk_cs_wrap {
1281 +       __le32  Signature;              /* Should = 'USBS' */
1282 +       u32     Tag;                    /* Same as original command */
1283 +       __le32  Residue;                /* Amount not transferred */
1284 +       u8      Status;                 /* See below */
1285 +};
1286 +
1287 +#define USB_BULK_CS_WRAP_LEN   13
1288 +#define USB_BULK_CS_SIG                0x53425355      /* Spells out 'USBS' */
1289 +#define USB_STATUS_PASS                0
1290 +#define USB_STATUS_FAIL                1
1291 +#define USB_STATUS_PHASE_ERROR 2
1292 +
1293 +/* Bulk-only class specific requests */
1294 +#define USB_BULK_RESET_REQUEST         0xff
1295 +#define USB_BULK_GET_MAX_LUN_REQUEST   0xfe
1296 +
1297 +/* Length of a SCSI Command Data Block */
1298 +#define MAX_COMMAND_SIZE       16
1299 +
1300 +/* SCSI commands that we recognize */
1301 +#define SC_FORMAT_UNIT                 0x04
1302 +#define SC_INQUIRY                     0x12
1303 +#define SC_MODE_SELECT_6               0x15
1304 +#define SC_MODE_SELECT_10              0x55
1305 +#define SC_MODE_SENSE_6                        0x1a
1306 +#define SC_MODE_SENSE_10               0x5a
1307 +#define SC_PREVENT_ALLOW_MEDIUM_REMOVAL        0x1e
1308 +#define SC_READ_6                      0x08
1309 +#define SC_READ_10                     0x28
1310 +#define SC_READ_12                     0xa8
1311 +#define SC_READ_CAPACITY               0x25
1312 +#define SC_READ_FORMAT_CAPACITIES      0x23
1313 +#define SC_RELEASE                     0x17
1314 +#define SC_REQUEST_SENSE               0x03
1315 +#define SC_RESERVE                     0x16
1316 +#define SC_SEND_DIAGNOSTIC             0x1d
1317 +#define SC_START_STOP_UNIT             0x1b
1318 +#define SC_SYNCHRONIZE_CACHE           0x35
1319 +#define SC_TEST_UNIT_READY             0x00
1320 +#define SC_VERIFY                      0x2f
1321 +#define SC_WRITE_6                     0x0a
1322 +#define SC_WRITE_10                    0x2a
1323 +#define SC_WRITE_12                    0xaa
1324 +
1325 +/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
1326 +#define SS_NO_SENSE                            0
1327 +#define SS_COMMUNICATION_FAILURE               0x040800
1328 +#define SS_INVALID_COMMAND                     0x052000
1329 +#define SS_INVALID_FIELD_IN_CDB                        0x052400
1330 +#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE  0x052100
1331 +#define SS_LOGICAL_UNIT_NOT_SUPPORTED          0x052500
1332 +#define SS_MEDIUM_NOT_PRESENT                  0x023a00
1333 +#define SS_MEDIUM_REMOVAL_PREVENTED            0x055302
1334 +#define SS_NOT_READY_TO_READY_TRANSITION       0x062800
1335 +#define SS_RESET_OCCURRED                      0x062900
1336 +#define SS_SAVING_PARAMETERS_NOT_SUPPORTED     0x053900
1337 +#define SS_UNRECOVERED_READ_ERROR              0x031100
1338 +#define SS_WRITE_ERROR                         0x030c02
1339 +#define SS_WRITE_PROTECTED                     0x072700
1340 +
1341 +#define SK(x)          ((u8) ((x) >> 16))      /* Sense Key byte, etc. */
1342 +#define ASC(x)         ((u8) ((x) >> 8))
1343 +#define ASCQ(x)                ((u8) (x))
1344 +
1345 +
1346 +/*-------------------------------------------------------------------------*/
1347 +
1348 +struct lun {
1349 +       struct file     *filp;
1350 +       loff_t          file_length;
1351 +       loff_t          num_sectors;
1352 +
1353 +       unsigned int    ro : 1;
1354 +       unsigned int    prevent_medium_removal : 1;
1355 +       unsigned int    registered : 1;
1356 +       unsigned int    info_valid : 1;
1357 +
1358 +       u32             sense_data;
1359 +       u32             sense_data_info;
1360 +       u32             unit_attention_data;
1361 +
1362 +       struct device   dev;
1363 +};
1364 +
1365 +#define backing_file_is_open(curlun)   ((curlun)->filp != NULL)
1366 +
1367 +
1368 +static struct lun *dev_to_lun(struct device *dev)
1369 +{
1370 +       return container_of(dev, struct lun, dev);
1371 +}
1372 +
1373 +/* Big enough to hold our biggest descriptor */
1374 +#define EP0_BUFSIZE    256
1375 +#define DELAYED_STATUS (EP0_BUFSIZE + 999)     /* An impossibly large value */
1376 +
1377 +/* Number of buffers we will use.  2 is enough for double-buffering */
1378 +#define NUM_BUFFERS    2
1379 +
1380 +enum fsg_buffer_state {
1381 +       BUF_STATE_EMPTY = 0,
1382 +       BUF_STATE_FULL,
1383 +       BUF_STATE_BUSY
1384 +};
1385 +
1386 +struct fsg_buffhd {
1387 +       void                            *buf;
1388 +       enum fsg_buffer_state           state;
1389 +       struct fsg_buffhd               *next;
1390 +
1391 +       /* The NetChip 2280 is faster, and handles some protocol faults
1392 +        * better, if we don't submit any short bulk-out read requests.
1393 +        * So we will record the intended request length here. */
1394 +       unsigned int                    bulk_out_intended_length;
1395 +
1396 +       struct usb_request              *inreq;
1397 +       int                             inreq_busy;
1398 +       struct usb_request              *outreq;
1399 +       int                             outreq_busy;
1400 +};
1401 +
1402 +enum fsg_state {
1403 +       /* This one isn't used anywhere */
1404 +       FSG_STATE_COMMAND_PHASE = -10,
1405 +
1406 +       FSG_STATE_DATA_PHASE,
1407 +       FSG_STATE_STATUS_PHASE,
1408 +
1409 +       FSG_STATE_IDLE = 0,
1410 +       FSG_STATE_ABORT_BULK_OUT,
1411 +       FSG_STATE_RESET,
1412 +       FSG_STATE_CONFIG_CHANGE,
1413 +       FSG_STATE_EXIT,
1414 +       FSG_STATE_TERMINATED
1415 +};
1416 +
1417 +enum data_direction {
1418 +       DATA_DIR_UNKNOWN = 0,
1419 +       DATA_DIR_FROM_HOST,
1420 +       DATA_DIR_TO_HOST,
1421 +       DATA_DIR_NONE
1422 +};
1423 +
1424 +struct fsg_dev {
1425 +       struct usb_function function;
1426 +       struct usb_composite_dev *cdev;
1427 +
1428 +       /* lock protects: state and all the req_busy's */
1429 +       spinlock_t              lock;
1430 +
1431 +       /* filesem protects: backing files in use */
1432 +       struct rw_semaphore     filesem;
1433 +
1434 +       /* reference counting: wait until all LUNs are released */
1435 +       struct kref             ref;
1436 +
1437 +       unsigned int            bulk_out_maxpacket;
1438 +       enum fsg_state          state;          /* For exception handling */
1439 +
1440 +       u8                      config, new_config;
1441 +
1442 +       unsigned int            running : 1;
1443 +       unsigned int            bulk_in_enabled : 1;
1444 +       unsigned int            bulk_out_enabled : 1;
1445 +       unsigned int            phase_error : 1;
1446 +       unsigned int            short_packet_received : 1;
1447 +       unsigned int            bad_lun_okay : 1;
1448 +
1449 +       unsigned long           atomic_bitflags;
1450 +#define REGISTERED             0
1451 +#define CLEAR_BULK_HALTS       1
1452 +#define SUSPENDED              2
1453 +
1454 +       struct usb_ep           *bulk_in;
1455 +       struct usb_ep           *bulk_out;
1456 +
1457 +       struct fsg_buffhd       *next_buffhd_to_fill;
1458 +       struct fsg_buffhd       *next_buffhd_to_drain;
1459 +       struct fsg_buffhd       buffhds[NUM_BUFFERS];
1460 +
1461 +       int                     thread_wakeup_needed;
1462 +       struct completion       thread_notifier;
1463 +       struct task_struct      *thread_task;
1464 +
1465 +       int                     cmnd_size;
1466 +       u8                      cmnd[MAX_COMMAND_SIZE];
1467 +       enum data_direction     data_dir;
1468 +       u32                     data_size;
1469 +       u32                     data_size_from_cmnd;
1470 +       u32                     tag;
1471 +       unsigned int            lun;
1472 +       u32                     residue;
1473 +       u32                     usb_amount_left;
1474 +
1475 +       unsigned int            nluns;
1476 +       struct lun              *luns;
1477 +       struct lun              *curlun;
1478 +
1479 +       u32                             buf_size;
1480 +       const char              *vendor;
1481 +       const char              *product;
1482 +       int                             release;
1483 +
1484 +       struct switch_dev sdev;
1485 +
1486 +       struct wake_lock wake_lock;
1487 +};
1488 +
1489 +static inline struct fsg_dev *func_to_dev(struct usb_function *f)
1490 +{
1491 +       return container_of(f, struct fsg_dev, function);
1492 +}
1493 +
1494 +static int exception_in_progress(struct fsg_dev *fsg)
1495 +{
1496 +       return (fsg->state > FSG_STATE_IDLE);
1497 +}
1498 +
1499 +/* Make bulk-out requests be divisible by the maxpacket size */
1500 +static void set_bulk_out_req_length(struct fsg_dev *fsg,
1501 +               struct fsg_buffhd *bh, unsigned int length)
1502 +{
1503 +       unsigned int    rem;
1504 +
1505 +       bh->bulk_out_intended_length = length;
1506 +       rem = length % fsg->bulk_out_maxpacket;
1507 +       if (rem > 0)
1508 +               length += fsg->bulk_out_maxpacket - rem;
1509 +       bh->outreq->length = length;
1510 +}
1511 +
1512 +static struct fsg_dev                  *the_fsg;
1513 +
1514 +static void    close_backing_file(struct fsg_dev *fsg, struct lun *curlun);
1515 +static void    close_all_backing_files(struct fsg_dev *fsg);
1516 +
1517 +
1518 +/*-------------------------------------------------------------------------*/
1519 +
1520 +#ifdef DUMP_MSGS
1521 +
1522 +static void dump_msg(struct fsg_dev *fsg, const char *label,
1523 +               const u8 *buf, unsigned int length)
1524 +{
1525 +       if (length < 512) {
1526 +               DBG(fsg, "%s, length %u:\n", label, length);
1527 +               print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,
1528 +                               16, 1, buf, length, 0);
1529 +       }
1530 +}
1531 +
1532 +static void dump_cdb(struct fsg_dev *fsg)
1533 +{}
1534 +
1535 +#else
1536 +
1537 +static void dump_msg(struct fsg_dev *fsg, const char *label,
1538 +               const u8 *buf, unsigned int length)
1539 +{}
1540 +
1541 +#ifdef VERBOSE_DEBUG
1542 +
1543 +static void dump_cdb(struct fsg_dev *fsg)
1544 +{
1545 +       print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,
1546 +                       16, 1, fsg->cmnd, fsg->cmnd_size, 0);
1547 +}
1548 +
1549 +#else
1550 +
1551 +static void dump_cdb(struct fsg_dev *fsg)
1552 +{}
1553 +
1554 +#endif /* VERBOSE_DEBUG */
1555 +#endif /* DUMP_MSGS */
1556 +
1557 +
1558 +/*-------------------------------------------------------------------------*/
1559 +
1560 +/* Routines for unaligned data access */
1561 +
1562 +static u16 get_be16(u8 *buf)
1563 +{
1564 +       return ((u16) buf[0] << 8) | ((u16) buf[1]);
1565 +}
1566 +
1567 +static u32 get_be32(u8 *buf)
1568 +{
1569 +       return ((u32) buf[0] << 24) | ((u32) buf[1] << 16) |
1570 +                       ((u32) buf[2] << 8) | ((u32) buf[3]);
1571 +}
1572 +
1573 +static void put_be16(u8 *buf, u16 val)
1574 +{
1575 +       buf[0] = val >> 8;
1576 +       buf[1] = val;
1577 +}
1578 +
1579 +static void put_be32(u8 *buf, u32 val)
1580 +{
1581 +       buf[0] = val >> 24;
1582 +       buf[1] = val >> 16;
1583 +       buf[2] = val >> 8;
1584 +       buf[3] = val & 0xff;
1585 +}
1586 +
1587 +/*-------------------------------------------------------------------------*/
1588 +
1589 +/*
1590 + * DESCRIPTORS ... most are static, but strings and (full) configuration
1591 + * descriptors are built on demand.  Also the (static) config and interface
1592 + * descriptors are adjusted during fsg_bind().
1593 + */
1594 +
1595 +/* There is only one interface. */
1596 +
1597 +static struct usb_interface_descriptor
1598 +intf_desc = {
1599 +       .bLength =              sizeof intf_desc,
1600 +       .bDescriptorType =      USB_DT_INTERFACE,
1601 +
1602 +       .bNumEndpoints =        2,              /* Adjusted during fsg_bind() */
1603 +       .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1604 +       .bInterfaceSubClass =   US_SC_SCSI,
1605 +       .bInterfaceProtocol =   US_PR_BULK,
1606 +};
1607 +
1608 +/* Three full-speed endpoint descriptors: bulk-in, bulk-out,
1609 + * and interrupt-in. */
1610 +
1611 +static struct usb_endpoint_descriptor
1612 +fs_bulk_in_desc = {
1613 +       .bLength =              USB_DT_ENDPOINT_SIZE,
1614 +       .bDescriptorType =      USB_DT_ENDPOINT,
1615 +
1616 +       .bEndpointAddress =     USB_DIR_IN,
1617 +       .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1618 +       /* wMaxPacketSize set by autoconfiguration */
1619 +};
1620 +
1621 +static struct usb_endpoint_descriptor
1622 +fs_bulk_out_desc = {
1623 +       .bLength =              USB_DT_ENDPOINT_SIZE,
1624 +       .bDescriptorType =      USB_DT_ENDPOINT,
1625 +
1626 +       .bEndpointAddress =     USB_DIR_OUT,
1627 +       .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1628 +       /* wMaxPacketSize set by autoconfiguration */
1629 +};
1630 +
1631 +static struct usb_descriptor_header *fs_function[] = {
1632 +       (struct usb_descriptor_header *) &intf_desc,
1633 +       (struct usb_descriptor_header *) &fs_bulk_in_desc,
1634 +       (struct usb_descriptor_header *) &fs_bulk_out_desc,
1635 +       NULL,
1636 +};
1637 +#define FS_FUNCTION_PRE_EP_ENTRIES     2
1638 +
1639 +
1640 +static struct usb_endpoint_descriptor
1641 +hs_bulk_in_desc = {
1642 +       .bLength =              USB_DT_ENDPOINT_SIZE,
1643 +       .bDescriptorType =      USB_DT_ENDPOINT,
1644 +
1645 +       /* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
1646 +       .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1647 +       .wMaxPacketSize =       __constant_cpu_to_le16(512),
1648 +};
1649 +
1650 +static struct usb_endpoint_descriptor
1651 +hs_bulk_out_desc = {
1652 +       .bLength =              USB_DT_ENDPOINT_SIZE,
1653 +       .bDescriptorType =      USB_DT_ENDPOINT,
1654 +
1655 +       /* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
1656 +       .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1657 +       .wMaxPacketSize =       __constant_cpu_to_le16(512),
1658 +       .bInterval =            1,      /* NAK every 1 uframe */
1659 +};
1660 +
1661 +
1662 +static struct usb_descriptor_header *hs_function[] = {
1663 +       (struct usb_descriptor_header *) &intf_desc,
1664 +       (struct usb_descriptor_header *) &hs_bulk_in_desc,
1665 +       (struct usb_descriptor_header *) &hs_bulk_out_desc,
1666 +       NULL,
1667 +};
1668 +
1669 +/* Maxpacket and other transfer characteristics vary by speed. */
1670 +static struct usb_endpoint_descriptor *
1671 +ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
1672 +               struct usb_endpoint_descriptor *hs)
1673 +{
1674 +       if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
1675 +               return hs;
1676 +       return fs;
1677 +}
1678 +
1679 +/*-------------------------------------------------------------------------*/
1680 +
1681 +/* These routines may be called in process context or in_irq */
1682 +
1683 +/* Caller must hold fsg->lock */
1684 +static void wakeup_thread(struct fsg_dev *fsg)
1685 +{
1686 +       /* Tell the main thread that something has happened */
1687 +       fsg->thread_wakeup_needed = 1;
1688 +       if (fsg->thread_task)
1689 +               wake_up_process(fsg->thread_task);
1690 +}
1691 +
1692 +
1693 +static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
1694 +{
1695 +       unsigned long           flags;
1696 +
1697 +       DBG(fsg, "raise_exception %d\n", (int)new_state);
1698 +       /* Do nothing if a higher-priority exception is already in progress.
1699 +        * If a lower-or-equal priority exception is in progress, preempt it
1700 +        * and notify the main thread by sending it a signal. */
1701 +       spin_lock_irqsave(&fsg->lock, flags);
1702 +       if (fsg->state <= new_state) {
1703 +               fsg->state = new_state;
1704 +               if (fsg->thread_task)
1705 +                       send_sig_info(SIGUSR1, SEND_SIG_FORCED,
1706 +                                       fsg->thread_task);
1707 +       }
1708 +       spin_unlock_irqrestore(&fsg->lock, flags);
1709 +}
1710 +
1711 +
1712 +/*-------------------------------------------------------------------------*/
1713 +
1714 +/* Bulk and interrupt endpoint completion handlers.
1715 + * These always run in_irq. */
1716 +
1717 +static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
1718 +{
1719 +       struct fsg_dev          *fsg = ep->driver_data;
1720 +       struct fsg_buffhd       *bh = req->context;
1721 +
1722 +       if (req->status || req->actual != req->length)
1723 +               DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1724 +                               req->status, req->actual, req->length);
1725 +
1726 +       /* Hold the lock while we update the request and buffer states */
1727 +       smp_wmb();
1728 +       spin_lock(&fsg->lock);
1729 +       bh->inreq_busy = 0;
1730 +       bh->state = BUF_STATE_EMPTY;
1731 +       wakeup_thread(fsg);
1732 +       spin_unlock(&fsg->lock);
1733 +}
1734 +
1735 +static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
1736 +{
1737 +       struct fsg_dev          *fsg = ep->driver_data;
1738 +       struct fsg_buffhd       *bh = req->context;
1739 +
1740 +       dump_msg(fsg, "bulk-out", req->buf, req->actual);
1741 +       if (req->status || req->actual != bh->bulk_out_intended_length)
1742 +               DBG(fsg, "%s --> %d, %u/%u\n", __func__,
1743 +                               req->status, req->actual,
1744 +                               bh->bulk_out_intended_length);
1745 +
1746 +       /* Hold the lock while we update the request and buffer states */
1747 +       smp_wmb();
1748 +       spin_lock(&fsg->lock);
1749 +       bh->outreq_busy = 0;
1750 +       bh->state = BUF_STATE_FULL;
1751 +       wakeup_thread(fsg);
1752 +       spin_unlock(&fsg->lock);
1753 +}
1754 +
1755 +static int fsg_function_setup(struct usb_function *f,
1756 +                                       const struct usb_ctrlrequest *ctrl)
1757 +{
1758 +       struct fsg_dev  *fsg = func_to_dev(f);
1759 +       struct usb_composite_dev *cdev = fsg->cdev;
1760 +       int                     value = -EOPNOTSUPP;
1761 +       u16                     w_index = le16_to_cpu(ctrl->wIndex);
1762 +       u16                     w_value = le16_to_cpu(ctrl->wValue);
1763 +       u16                     w_length = le16_to_cpu(ctrl->wLength);
1764 +
1765 +       DBG(fsg, "fsg_function_setup\n");
1766 +       /* Handle Bulk-only class-specific requests */
1767 +       if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) {
1768 +       DBG(fsg, "USB_TYPE_CLASS\n");
1769 +               switch (ctrl->bRequest) {
1770 +               case USB_BULK_RESET_REQUEST:
1771 +                       if (ctrl->bRequestType != (USB_DIR_OUT |
1772 +                                       USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1773 +                               break;
1774 +                       if (w_index != 0 || w_value != 0) {
1775 +                               value = -EDOM;
1776 +                               break;
1777 +                       }
1778 +
1779 +                       /* Raise an exception to stop the current operation
1780 +                        * and reinitialize our state. */
1781 +                       DBG(fsg, "bulk reset request\n");
1782 +                       raise_exception(fsg, FSG_STATE_RESET);
1783 +                       value = DELAYED_STATUS;
1784 +                       break;
1785 +
1786 +               case USB_BULK_GET_MAX_LUN_REQUEST:
1787 +                       if (ctrl->bRequestType != (USB_DIR_IN |
1788 +                                       USB_TYPE_CLASS | USB_RECIP_INTERFACE))
1789 +                               break;
1790 +                       if (w_index != 0 || w_value != 0) {
1791 +                               value = -EDOM;
1792 +                               break;
1793 +                       }
1794 +                       VDBG(fsg, "get max LUN\n");
1795 +                       *(u8 *)cdev->req->buf = fsg->nluns - 1;
1796 +                       value = 1;
1797 +                       break;
1798 +               }
1799 +       }
1800 +
1801 +       if (value == -EOPNOTSUPP)
1802 +               VDBG(fsg,
1803 +                       "unknown class-specific control req "
1804 +                       "%02x.%02x v%04x i%04x l%u\n",
1805 +                       ctrl->bRequestType, ctrl->bRequest,
1806 +                       le16_to_cpu(ctrl->wValue), w_index, w_length);
1807 +       return value;
1808 +}
1809 +
1810 +/*-------------------------------------------------------------------------*/
1811 +
1812 +/* All the following routines run in process context */
1813 +
1814 +
1815 +/* Use this for bulk or interrupt transfers, not ep0 */
1816 +static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
1817 +               struct usb_request *req, int *pbusy,
1818 +               enum fsg_buffer_state *state)
1819 +{
1820 +       int     rc;
1821 +
1822 +       DBG(fsg, "start_transfer req: %p, req->buf: %p\n", req, req->buf);
1823 +       if (ep == fsg->bulk_in)
1824 +               dump_msg(fsg, "bulk-in", req->buf, req->length);
1825 +
1826 +       spin_lock_irq(&fsg->lock);
1827 +       *pbusy = 1;
1828 +       *state = BUF_STATE_BUSY;
1829 +       spin_unlock_irq(&fsg->lock);
1830 +       rc = usb_ep_queue(ep, req, GFP_KERNEL);
1831 +       if (rc != 0) {
1832 +               *pbusy = 0;
1833 +               *state = BUF_STATE_EMPTY;
1834 +
1835 +               /* We can't do much more than wait for a reset */
1836 +
1837 +               /* Note: currently the net2280 driver fails zero-length
1838 +                * submissions if DMA is enabled. */
1839 +               if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
1840 +                                               req->length == 0))
1841 +                       WARN(fsg, "error in submission: %s --> %d\n",
1842 +                               (ep == fsg->bulk_in ? "bulk-in" : "bulk-out"),
1843 +                               rc);
1844 +       }
1845 +}
1846 +
1847 +
1848 +static int sleep_thread(struct fsg_dev *fsg)
1849 +{
1850 +       int     rc = 0;
1851 +
1852 +       /* Wait until a signal arrives or we are woken up */
1853 +       for (;;) {
1854 +               try_to_freeze();
1855 +               set_current_state(TASK_INTERRUPTIBLE);
1856 +               if (signal_pending(current)) {
1857 +                       rc = -EINTR;
1858 +                       break;
1859 +               }
1860 +               if (fsg->thread_wakeup_needed)
1861 +                       break;
1862 +               schedule();
1863 +       }
1864 +       __set_current_state(TASK_RUNNING);
1865 +       fsg->thread_wakeup_needed = 0;
1866 +       return rc;
1867 +}
1868 +
1869 +
1870 +/*-------------------------------------------------------------------------*/
1871 +
1872 +static int do_read(struct fsg_dev *fsg)
1873 +{
1874 +       struct lun              *curlun = fsg->curlun;
1875 +       u32                     lba;
1876 +       struct fsg_buffhd       *bh;
1877 +       int                     rc;
1878 +       u32                     amount_left;
1879 +       loff_t                  file_offset, file_offset_tmp;
1880 +       unsigned int            amount;
1881 +       unsigned int            partial_page;
1882 +       ssize_t                 nread;
1883 +
1884 +       /* Get the starting Logical Block Address and check that it's
1885 +        * not too big */
1886 +       if (fsg->cmnd[0] == SC_READ_6)
1887 +               lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
1888 +       else {
1889 +               lba = get_be32(&fsg->cmnd[2]);
1890 +
1891 +               /* We allow DPO (Disable Page Out = don't save data in the
1892 +                * cache) and FUA (Force Unit Access = don't read from the
1893 +                * cache), but we don't implement them. */
1894 +               if ((fsg->cmnd[1] & ~0x18) != 0) {
1895 +                       curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1896 +                       return -EINVAL;
1897 +               }
1898 +       }
1899 +       if (lba >= curlun->num_sectors) {
1900 +               curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1901 +               return -EINVAL;
1902 +       }
1903 +       file_offset = ((loff_t) lba) << 9;
1904 +
1905 +       /* Carry out the file reads */
1906 +       amount_left = fsg->data_size_from_cmnd;
1907 +       if (unlikely(amount_left == 0))
1908 +               return -EIO;            /* No default reply */
1909 +
1910 +       for (;;) {
1911 +
1912 +               /* Figure out how much we need to read:
1913 +                * Try to read the remaining amount.
1914 +                * But don't read more than the buffer size.
1915 +                * And don't try to read past the end of the file.
1916 +                * Finally, if we're not at a page boundary, don't read past
1917 +                *      the next page.
1918 +                * If this means reading 0 then we were asked to read past
1919 +                *      the end of file. */
1920 +               amount = min((unsigned int) amount_left,
1921 +                               (unsigned int)fsg->buf_size);
1922 +               amount = min((loff_t) amount,
1923 +                               curlun->file_length - file_offset);
1924 +               partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
1925 +               if (partial_page > 0)
1926 +                       amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
1927 +                                       partial_page);
1928 +
1929 +               /* Wait for the next buffer to become available */
1930 +               bh = fsg->next_buffhd_to_fill;
1931 +               while (bh->state != BUF_STATE_EMPTY) {
1932 +                       rc = sleep_thread(fsg);
1933 +                       if (rc)
1934 +                               return rc;
1935 +               }
1936 +
1937 +               /* If we were asked to read past the end of file,
1938 +                * end with an empty buffer. */
1939 +               if (amount == 0) {
1940 +                       curlun->sense_data =
1941 +                                       SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1942 +                       curlun->sense_data_info = file_offset >> 9;
1943 +                       curlun->info_valid = 1;
1944 +                       bh->inreq->length = 0;
1945 +                       bh->state = BUF_STATE_FULL;
1946 +                       break;
1947 +               }
1948 +
1949 +               /* Perform the read */
1950 +               file_offset_tmp = file_offset;
1951 +               nread = vfs_read(curlun->filp,
1952 +                               (char __user *) bh->buf,
1953 +                               amount, &file_offset_tmp);
1954 +               VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
1955 +                               (unsigned long long) file_offset,
1956 +                               (int) nread);
1957 +               if (signal_pending(current))
1958 +                       return -EINTR;
1959 +
1960 +               if (nread < 0) {
1961 +                       LDBG(curlun, "error in file read: %d\n",
1962 +                                       (int) nread);
1963 +                       nread = 0;
1964 +               } else if (nread < amount) {
1965 +                       LDBG(curlun, "partial file read: %d/%u\n",
1966 +                                       (int) nread, amount);
1967 +                       nread -= (nread & 511); /* Round down to a block */
1968 +               }
1969 +               file_offset  += nread;
1970 +               amount_left  -= nread;
1971 +               fsg->residue -= nread;
1972 +               bh->inreq->length = nread;
1973 +               bh->state = BUF_STATE_FULL;
1974 +
1975 +               /* If an error occurred, report it and its position */
1976 +               if (nread < amount) {
1977 +                       curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
1978 +                       curlun->sense_data_info = file_offset >> 9;
1979 +                       curlun->info_valid = 1;
1980 +                       break;
1981 +               }
1982 +
1983 +               if (amount_left == 0)
1984 +                       break;          /* No more left to read */
1985 +
1986 +               /* Send this buffer and go read some more */
1987 +               start_transfer(fsg, fsg->bulk_in, bh->inreq,
1988 +                               &bh->inreq_busy, &bh->state);
1989 +               fsg->next_buffhd_to_fill = bh->next;
1990 +       }
1991 +
1992 +       return -EIO;            /* No default reply */
1993 +}
1994 +
1995 +
1996 +/*-------------------------------------------------------------------------*/
1997 +
1998 +static int do_write(struct fsg_dev *fsg)
1999 +{
2000 +       struct lun              *curlun = fsg->curlun;
2001 +       u32                     lba;
2002 +       struct fsg_buffhd       *bh;
2003 +       int                     get_some_more;
2004 +       u32                     amount_left_to_req, amount_left_to_write;
2005 +       loff_t                  usb_offset, file_offset, file_offset_tmp;
2006 +       unsigned int            amount;
2007 +       unsigned int            partial_page;
2008 +       ssize_t                 nwritten;
2009 +       int                     rc;
2010 +
2011 +       if (curlun->ro) {
2012 +               curlun->sense_data = SS_WRITE_PROTECTED;
2013 +               return -EINVAL;
2014 +       }
2015 +       curlun->filp->f_flags &= ~O_SYNC;       /* Default is not to wait */
2016 +
2017 +       /* Get the starting Logical Block Address and check that it's
2018 +        * not too big */
2019 +       if (fsg->cmnd[0] == SC_WRITE_6)
2020 +               lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
2021 +       else {
2022 +               lba = get_be32(&fsg->cmnd[2]);
2023 +
2024 +               /* We allow DPO (Disable Page Out = don't save data in the
2025 +                * cache) and FUA (Force Unit Access = write directly to the
2026 +                * medium).  We don't implement DPO; we implement FUA by
2027 +                * performing synchronous output. */
2028 +               if ((fsg->cmnd[1] & ~0x18) != 0) {
2029 +                       curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2030 +                       return -EINVAL;
2031 +               }
2032 +               if (fsg->cmnd[1] & 0x08)        /* FUA */
2033 +                       curlun->filp->f_flags |= O_SYNC;
2034 +       }
2035 +       if (lba >= curlun->num_sectors) {
2036 +               curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2037 +               return -EINVAL;
2038 +       }
2039 +
2040 +       /* Carry out the file writes */
2041 +       get_some_more = 1;
2042 +       file_offset = usb_offset = ((loff_t) lba) << 9;
2043 +       amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
2044 +
2045 +       while (amount_left_to_write > 0) {
2046 +
2047 +               /* Queue a request for more data from the host */
2048 +               bh = fsg->next_buffhd_to_fill;
2049 +               if (bh->state == BUF_STATE_EMPTY && get_some_more) {
2050 +
2051 +                       /* Figure out how much we want to get:
2052 +                        * Try to get the remaining amount.
2053 +                        * But don't get more than the buffer size.
2054 +                        * And don't try to go past the end of the file.
2055 +                        * If we're not at a page boundary,
2056 +                        *      don't go past the next page.
2057 +                        * If this means getting 0, then we were asked
2058 +                        *      to write past the end of file.
2059 +                        * Finally, round down to a block boundary. */
2060 +                       amount = min(amount_left_to_req, (u32)fsg->buf_size);
2061 +                       amount = min((loff_t) amount, curlun->file_length -
2062 +                                       usb_offset);
2063 +                       partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
2064 +                       if (partial_page > 0)
2065 +                               amount = min(amount,
2066 +       (unsigned int) PAGE_CACHE_SIZE - partial_page);
2067 +
2068 +                       if (amount == 0) {
2069 +                               get_some_more = 0;
2070 +                               curlun->sense_data =
2071 +                                       SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2072 +                               curlun->sense_data_info = usb_offset >> 9;
2073 +                               curlun->info_valid = 1;
2074 +                               continue;
2075 +                       }
2076 +                       amount -= (amount & 511);
2077 +                       if (amount == 0) {
2078 +
2079 +                               /* Why were we were asked to transfer a
2080 +                                * partial block? */
2081 +                               get_some_more = 0;
2082 +                               continue;
2083 +                       }
2084 +
2085 +                       /* Get the next buffer */
2086 +                       usb_offset += amount;
2087 +                       fsg->usb_amount_left -= amount;
2088 +                       amount_left_to_req -= amount;
2089 +                       if (amount_left_to_req == 0)
2090 +                               get_some_more = 0;
2091 +
2092 +                       /* amount is always divisible by 512, hence by
2093 +                        * the bulk-out maxpacket size */
2094 +                       bh->outreq->length = bh->bulk_out_intended_length =
2095 +                                       amount;
2096 +                       start_transfer(fsg, fsg->bulk_out, bh->outreq,
2097 +                                       &bh->outreq_busy, &bh->state);
2098 +                       fsg->next_buffhd_to_fill = bh->next;
2099 +                       continue;
2100 +               }
2101 +
2102 +               /* Write the received data to the backing file */
2103 +               bh = fsg->next_buffhd_to_drain;
2104 +               if (bh->state == BUF_STATE_EMPTY && !get_some_more)
2105 +                       break;                  /* We stopped early */
2106 +               if (bh->state == BUF_STATE_FULL) {
2107 +                       smp_rmb();
2108 +                       fsg->next_buffhd_to_drain = bh->next;
2109 +                       bh->state = BUF_STATE_EMPTY;
2110 +
2111 +                       /* Did something go wrong with the transfer? */
2112 +                       if (bh->outreq->status != 0) {
2113 +                               curlun->sense_data = SS_COMMUNICATION_FAILURE;
2114 +                               curlun->sense_data_info = file_offset >> 9;
2115 +                               curlun->info_valid = 1;
2116 +                               break;
2117 +                       }
2118 +
2119 +                       amount = bh->outreq->actual;
2120 +                       if (curlun->file_length - file_offset < amount) {
2121 +                               LERROR(curlun,
2122 +       "write %u @ %llu beyond end %llu\n",
2123 +       amount, (unsigned long long) file_offset,
2124 +       (unsigned long long) curlun->file_length);
2125 +                               amount = curlun->file_length - file_offset;
2126 +                       }
2127 +
2128 +                       /* Perform the write */
2129 +                       file_offset_tmp = file_offset;
2130 +                       nwritten = vfs_write(curlun->filp,
2131 +                                       (char __user *) bh->buf,
2132 +                                       amount, &file_offset_tmp);
2133 +                       VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
2134 +                                       (unsigned long long) file_offset,
2135 +                                       (int) nwritten);
2136 +                       if (signal_pending(current))
2137 +                               return -EINTR;          /* Interrupted! */
2138 +
2139 +                       if (nwritten < 0) {
2140 +                               LDBG(curlun, "error in file write: %d\n",
2141 +                                               (int) nwritten);
2142 +                               nwritten = 0;
2143 +                       } else if (nwritten < amount) {
2144 +                               LDBG(curlun, "partial file write: %d/%u\n",
2145 +                                               (int) nwritten, amount);
2146 +                               nwritten -= (nwritten & 511);
2147 +                                               /* Round down to a block */
2148 +                       }
2149 +                       file_offset += nwritten;
2150 +                       amount_left_to_write -= nwritten;
2151 +                       fsg->residue -= nwritten;
2152 +
2153 +                       /* If an error occurred, report it and its position */
2154 +                       if (nwritten < amount) {
2155 +                               curlun->sense_data = SS_WRITE_ERROR;
2156 +                               curlun->sense_data_info = file_offset >> 9;
2157 +                               curlun->info_valid = 1;
2158 +                               break;
2159 +                       }
2160 +
2161 +                       /* Did the host decide to stop early? */
2162 +                       if (bh->outreq->actual != bh->outreq->length) {
2163 +                               fsg->short_packet_received = 1;
2164 +                               break;
2165 +                       }
2166 +                       continue;
2167 +               }
2168 +
2169 +               /* Wait for something to happen */
2170 +               rc = sleep_thread(fsg);
2171 +               if (rc)
2172 +                       return rc;
2173 +       }
2174 +
2175 +       return -EIO;            /* No default reply */
2176 +}
2177 +
2178 +
2179 +/*-------------------------------------------------------------------------*/
2180 +
2181 +/* Sync the file data, don't bother with the metadata.
2182 + * The caller must own fsg->filesem.
2183 + * This code was copied from fs/buffer.c:sys_fdatasync(). */
2184 +static int fsync_sub(struct lun *curlun)
2185 +{
2186 +       struct file     *filp = curlun->filp;
2187 +       struct inode    *inode;
2188 +       int             rc, err;
2189 +
2190 +       if (curlun->ro || !filp)
2191 +               return 0;
2192 +       if (!filp->f_op->fsync)
2193 +               return -EINVAL;
2194 +
2195 +       inode = filp->f_path.dentry->d_inode;
2196 +       mutex_lock(&inode->i_mutex);
2197 +       rc = filemap_fdatawrite(inode->i_mapping);
2198 +       err = filp->f_op->fsync(filp, filp->f_path.dentry, 1);
2199 +       if (!rc)
2200 +               rc = err;
2201 +       err = filemap_fdatawait(inode->i_mapping);
2202 +       if (!rc)
2203 +               rc = err;
2204 +       mutex_unlock(&inode->i_mutex);
2205 +       VLDBG(curlun, "fdatasync -> %d\n", rc);
2206 +       return rc;
2207 +}
2208 +
2209 +static void fsync_all(struct fsg_dev *fsg)
2210 +{
2211 +       int     i;
2212 +
2213 +       for (i = 0; i < fsg->nluns; ++i)
2214 +               fsync_sub(&fsg->luns[i]);
2215 +}
2216 +
2217 +static int do_synchronize_cache(struct fsg_dev *fsg)
2218 +{
2219 +       struct lun      *curlun = fsg->curlun;
2220 +       int             rc;
2221 +
2222 +       /* We ignore the requested LBA and write out all file's
2223 +        * dirty data buffers. */
2224 +       rc = fsync_sub(curlun);
2225 +       if (rc)
2226 +               curlun->sense_data = SS_WRITE_ERROR;
2227 +       return 0;
2228 +}
2229 +
2230 +
2231 +/*-------------------------------------------------------------------------*/
2232 +
2233 +static void invalidate_sub(struct lun *curlun)
2234 +{
2235 +       struct file     *filp = curlun->filp;
2236 +       struct inode    *inode = filp->f_path.dentry->d_inode;
2237 +       unsigned long   rc;
2238 +
2239 +       rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
2240 +       VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
2241 +}
2242 +
2243 +static int do_verify(struct fsg_dev *fsg)
2244 +{
2245 +       struct lun              *curlun = fsg->curlun;
2246 +       u32                     lba;
2247 +       u32                     verification_length;
2248 +       struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2249 +       loff_t                  file_offset, file_offset_tmp;
2250 +       u32                     amount_left;
2251 +       unsigned int            amount;
2252 +       ssize_t                 nread;
2253 +
2254 +       /* Get the starting Logical Block Address and check that it's
2255 +        * not too big */
2256 +       lba = get_be32(&fsg->cmnd[2]);
2257 +       if (lba >= curlun->num_sectors) {
2258 +               curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2259 +               return -EINVAL;
2260 +       }
2261 +
2262 +       /* We allow DPO (Disable Page Out = don't save data in the
2263 +        * cache) but we don't implement it. */
2264 +       if ((fsg->cmnd[1] & ~0x10) != 0) {
2265 +               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2266 +               return -EINVAL;
2267 +       }
2268 +
2269 +       verification_length = get_be16(&fsg->cmnd[7]);
2270 +       if (unlikely(verification_length == 0))
2271 +               return -EIO;            /* No default reply */
2272 +
2273 +       /* Prepare to carry out the file verify */
2274 +       amount_left = verification_length << 9;
2275 +       file_offset = ((loff_t) lba) << 9;
2276 +
2277 +       /* Write out all the dirty buffers before invalidating them */
2278 +       fsync_sub(curlun);
2279 +       if (signal_pending(current))
2280 +               return -EINTR;
2281 +
2282 +       invalidate_sub(curlun);
2283 +       if (signal_pending(current))
2284 +               return -EINTR;
2285 +
2286 +       /* Just try to read the requested blocks */
2287 +       while (amount_left > 0) {
2288 +
2289 +               /* Figure out how much we need to read:
2290 +                * Try to read the remaining amount, but not more than
2291 +                * the buffer size.
2292 +                * And don't try to read past the end of the file.
2293 +                * If this means reading 0 then we were asked to read
2294 +                * past the end of file. */
2295 +               amount = min((unsigned int) amount_left,
2296 +                               (unsigned int)fsg->buf_size);
2297 +               amount = min((loff_t) amount,
2298 +                               curlun->file_length - file_offset);
2299 +               if (amount == 0) {
2300 +                       curlun->sense_data =
2301 +                                       SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
2302 +                       curlun->sense_data_info = file_offset >> 9;
2303 +                       curlun->info_valid = 1;
2304 +                       break;
2305 +               }
2306 +
2307 +               /* Perform the read */
2308 +               file_offset_tmp = file_offset;
2309 +               nread = vfs_read(curlun->filp,
2310 +                               (char __user *) bh->buf,
2311 +                               amount, &file_offset_tmp);
2312 +               VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
2313 +                               (unsigned long long) file_offset,
2314 +                               (int) nread);
2315 +               if (signal_pending(current))
2316 +                       return -EINTR;
2317 +
2318 +               if (nread < 0) {
2319 +                       LDBG(curlun, "error in file verify: %d\n",
2320 +                                       (int) nread);
2321 +                       nread = 0;
2322 +               } else if (nread < amount) {
2323 +                       LDBG(curlun, "partial file verify: %d/%u\n",
2324 +                                       (int) nread, amount);
2325 +                       nread -= (nread & 511); /* Round down to a sector */
2326 +               }
2327 +               if (nread == 0) {
2328 +                       curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
2329 +                       curlun->sense_data_info = file_offset >> 9;
2330 +                       curlun->info_valid = 1;
2331 +                       break;
2332 +               }
2333 +               file_offset += nread;
2334 +               amount_left -= nread;
2335 +       }
2336 +       return 0;
2337 +}
2338 +
2339 +
2340 +/*-------------------------------------------------------------------------*/
2341 +
2342 +static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2343 +{
2344 +       u8      *buf = (u8 *) bh->buf;
2345 +
2346 +       if (!fsg->curlun) {             /* Unsupported LUNs are okay */
2347 +               fsg->bad_lun_okay = 1;
2348 +               memset(buf, 0, 36);
2349 +               buf[0] = 0x7f;          /* Unsupported, no device-type */
2350 +               return 36;
2351 +       }
2352 +
2353 +       memset(buf, 0, 8);      /* Non-removable, direct-access device */
2354 +
2355 +       buf[1] = 0x80;  /* set removable bit */
2356 +       buf[2] = 2;             /* ANSI SCSI level 2 */
2357 +       buf[3] = 2;             /* SCSI-2 INQUIRY data format */
2358 +       buf[4] = 31;            /* Additional length */
2359 +                               /* No special options */
2360 +       sprintf(buf + 8, "%-8s%-16s%04x", fsg->vendor,
2361 +                       fsg->product, fsg->release);
2362 +       return 36;
2363 +}
2364 +
2365 +
2366 +static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2367 +{
2368 +       struct lun      *curlun = fsg->curlun;
2369 +       u8              *buf = (u8 *) bh->buf;
2370 +       u32             sd, sdinfo;
2371 +       int             valid;
2372 +
2373 +       /*
2374 +        * From the SCSI-2 spec., section 7.9 (Unit attention condition):
2375 +        *
2376 +        * If a REQUEST SENSE command is received from an initiator
2377 +        * with a pending unit attention condition (before the target
2378 +        * generates the contingent allegiance condition), then the
2379 +        * target shall either:
2380 +        *   a) report any pending sense data and preserve the unit
2381 +        *      attention condition on the logical unit, or,
2382 +        *   b) report the unit attention condition, may discard any
2383 +        *      pending sense data, and clear the unit attention
2384 +        *      condition on the logical unit for that initiator.
2385 +        *
2386 +        * FSG normally uses option a); enable this code to use option b).
2387 +        */
2388 +#if 0
2389 +       if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
2390 +               curlun->sense_data = curlun->unit_attention_data;
2391 +               curlun->unit_attention_data = SS_NO_SENSE;
2392 +       }
2393 +#endif
2394 +
2395 +       if (!curlun) {          /* Unsupported LUNs are okay */
2396 +               fsg->bad_lun_okay = 1;
2397 +               sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2398 +               sdinfo = 0;
2399 +               valid = 0;
2400 +       } else {
2401 +               sd = curlun->sense_data;
2402 +               sdinfo = curlun->sense_data_info;
2403 +               valid = curlun->info_valid << 7;
2404 +               curlun->sense_data = SS_NO_SENSE;
2405 +               curlun->sense_data_info = 0;
2406 +               curlun->info_valid = 0;
2407 +       }
2408 +
2409 +       memset(buf, 0, 18);
2410 +       buf[0] = valid | 0x70;                  /* Valid, current error */
2411 +       buf[2] = SK(sd);
2412 +       put_be32(&buf[3], sdinfo);              /* Sense information */
2413 +       buf[7] = 18 - 8;                        /* Additional sense length */
2414 +       buf[12] = ASC(sd);
2415 +       buf[13] = ASCQ(sd);
2416 +       return 18;
2417 +}
2418 +
2419 +
2420 +static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2421 +{
2422 +       struct lun      *curlun = fsg->curlun;
2423 +       u32             lba = get_be32(&fsg->cmnd[2]);
2424 +       int             pmi = fsg->cmnd[8];
2425 +       u8              *buf = (u8 *) bh->buf;
2426 +
2427 +       /* Check the PMI and LBA fields */
2428 +       if (pmi > 1 || (pmi == 0 && lba != 0)) {
2429 +               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2430 +               return -EINVAL;
2431 +       }
2432 +
2433 +       put_be32(&buf[0], curlun->num_sectors - 1);     /* Max logical block */
2434 +       put_be32(&buf[4], 512);                         /* Block length */
2435 +       return 8;
2436 +}
2437 +
2438 +
2439 +static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2440 +{
2441 +       struct lun      *curlun = fsg->curlun;
2442 +       int             mscmnd = fsg->cmnd[0];
2443 +       u8              *buf = (u8 *) bh->buf;
2444 +       u8              *buf0 = buf;
2445 +       int             pc, page_code;
2446 +       int             changeable_values, all_pages;
2447 +       int             valid_page = 0;
2448 +       int             len, limit;
2449 +
2450 +       if ((fsg->cmnd[1] & ~0x08) != 0) {              /* Mask away DBD */
2451 +               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2452 +               return -EINVAL;
2453 +       }
2454 +       pc = fsg->cmnd[2] >> 6;
2455 +       page_code = fsg->cmnd[2] & 0x3f;
2456 +       if (pc == 3) {
2457 +               curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
2458 +               return -EINVAL;
2459 +       }
2460 +       changeable_values = (pc == 1);
2461 +       all_pages = (page_code == 0x3f);
2462 +
2463 +       /* Write the mode parameter header.  Fixed values are: default
2464 +        * medium type, no cache control (DPOFUA), and no block descriptors.
2465 +        * The only variable value is the WriteProtect bit.  We will fill in
2466 +        * the mode data length later. */
2467 +       memset(buf, 0, 8);
2468 +       if (mscmnd == SC_MODE_SENSE_6) {
2469 +               buf[2] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
2470 +               buf += 4;
2471 +               limit = 255;
2472 +       } else {                        /* SC_MODE_SENSE_10 */
2473 +               buf[3] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
2474 +               buf += 8;
2475 +               limit = 65535;
2476 +       }
2477 +
2478 +       /* No block descriptors */
2479 +
2480 +       /* Disabled to workaround USB reset problems with a Vista host.
2481 +        */
2482 +#if 0
2483 +       /* The mode pages, in numerical order.  The only page we support
2484 +        * is the Caching page. */
2485 +       if (page_code == 0x08 || all_pages) {
2486 +               valid_page = 1;
2487 +               buf[0] = 0x08;          /* Page code */
2488 +               buf[1] = 10;            /* Page length */
2489 +               memset(buf+2, 0, 10);   /* None of the fields are changeable */
2490 +
2491 +               if (!changeable_values) {
2492 +                       buf[2] = 0x04;  /* Write cache enable, */
2493 +                                       /* Read cache not disabled */
2494 +                                       /* No cache retention priorities */
2495 +                       put_be16(&buf[4], 0xffff);  /* Don't disable prefetch */
2496 +                                       /* Minimum prefetch = 0 */
2497 +                       put_be16(&buf[8], 0xffff);  /* Maximum prefetch */
2498 +                       /* Maximum prefetch ceiling */
2499 +                       put_be16(&buf[10], 0xffff);
2500 +               }
2501 +               buf += 12;
2502 +       }
2503 +#else
2504 +       valid_page = 1;
2505 +#endif
2506 +
2507 +       /* Check that a valid page was requested and the mode data length
2508 +        * isn't too long. */
2509 +       len = buf - buf0;
2510 +       if (!valid_page || len > limit) {
2511 +               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2512 +               return -EINVAL;
2513 +       }
2514 +
2515 +       /*  Store the mode data length */
2516 +       if (mscmnd == SC_MODE_SENSE_6)
2517 +               buf0[0] = len - 1;
2518 +       else
2519 +               put_be16(buf0, len - 2);
2520 +       return len;
2521 +}
2522 +
2523 +static int do_start_stop(struct fsg_dev *fsg)
2524 +{
2525 +       struct lun      *curlun = fsg->curlun;
2526 +       int             loej, start;
2527 +
2528 +       /* int immed = fsg->cmnd[1] & 0x01; */
2529 +       loej = fsg->cmnd[4] & 0x02;
2530 +       start = fsg->cmnd[4] & 0x01;
2531 +
2532 +       if (loej) {
2533 +               /* eject request from the host */
2534 +               if (backing_file_is_open(curlun)) {
2535 +                       close_backing_file(fsg, curlun);
2536 +                       curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
2537 +               }
2538 +       }
2539 +
2540 +       return 0;
2541 +}
2542 +
2543 +static int do_prevent_allow(struct fsg_dev *fsg)
2544 +{
2545 +       struct lun      *curlun = fsg->curlun;
2546 +       int             prevent;
2547 +
2548 +       prevent = fsg->cmnd[4] & 0x01;
2549 +       if ((fsg->cmnd[4] & ~0x01) != 0) {              /* Mask away Prevent */
2550 +               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2551 +               return -EINVAL;
2552 +       }
2553 +
2554 +       if (curlun->prevent_medium_removal && !prevent)
2555 +               fsync_sub(curlun);
2556 +       curlun->prevent_medium_removal = prevent;
2557 +       return 0;
2558 +}
2559 +
2560 +
2561 +static int do_read_format_capacities(struct fsg_dev *fsg,
2562 +                       struct fsg_buffhd *bh)
2563 +{
2564 +       struct lun      *curlun = fsg->curlun;
2565 +       u8              *buf = (u8 *) bh->buf;
2566 +
2567 +       buf[0] = buf[1] = buf[2] = 0;
2568 +       buf[3] = 8;     /* Only the Current/Maximum Capacity Descriptor */
2569 +       buf += 4;
2570 +
2571 +       put_be32(&buf[0], curlun->num_sectors); /* Number of blocks */
2572 +       put_be32(&buf[4], 512);                         /* Block length */
2573 +       buf[4] = 0x02;                                  /* Current capacity */
2574 +       return 12;
2575 +}
2576 +
2577 +
2578 +static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
2579 +{
2580 +       struct lun      *curlun = fsg->curlun;
2581 +
2582 +       /* We don't support MODE SELECT */
2583 +       curlun->sense_data = SS_INVALID_COMMAND;
2584 +       return -EINVAL;
2585 +}
2586 +
2587 +
2588 +/*-------------------------------------------------------------------------*/
2589 +#if 0
2590 +static int write_zero(struct fsg_dev *fsg)
2591 +{
2592 +       struct fsg_buffhd       *bh;
2593 +       int                     rc;
2594 +
2595 +       DBG(fsg, "write_zero\n");
2596 +       /* Wait for the next buffer to become available */
2597 +       bh = fsg->next_buffhd_to_fill;
2598 +       while (bh->state != BUF_STATE_EMPTY) {
2599 +               rc = sleep_thread(fsg);
2600 +               if (rc)
2601 +                       return rc;
2602 +       }
2603 +
2604 +       bh->inreq->length = 0;
2605 +       start_transfer(fsg, fsg->bulk_in, bh->inreq,
2606 +                       &bh->inreq_busy, &bh->state);
2607 +
2608 +       fsg->next_buffhd_to_fill = bh->next;
2609 +       return 0;
2610 +}
2611 +#endif
2612 +
2613 +static int throw_away_data(struct fsg_dev *fsg)
2614 +{
2615 +       struct fsg_buffhd       *bh;
2616 +       u32                     amount;
2617 +       int                     rc;
2618 +
2619 +       DBG(fsg, "throw_away_data\n");
2620 +       while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
2621 +                       fsg->usb_amount_left > 0) {
2622 +
2623 +               /* Throw away the data in a filled buffer */
2624 +               if (bh->state == BUF_STATE_FULL) {
2625 +                       smp_rmb();
2626 +                       bh->state = BUF_STATE_EMPTY;
2627 +                       fsg->next_buffhd_to_drain = bh->next;
2628 +
2629 +                       /* A short packet or an error ends everything */
2630 +                       if (bh->outreq->actual != bh->outreq->length ||
2631 +                                       bh->outreq->status != 0) {
2632 +                               raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2633 +                               return -EINTR;
2634 +                       }
2635 +                       continue;
2636 +               }
2637 +
2638 +               /* Try to submit another request if we need one */
2639 +               bh = fsg->next_buffhd_to_fill;
2640 +               if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
2641 +                       amount = min(fsg->usb_amount_left, (u32) fsg->buf_size);
2642 +
2643 +                       /* amount is always divisible by 512, hence by
2644 +                        * the bulk-out maxpacket size */
2645 +                       bh->outreq->length = bh->bulk_out_intended_length =
2646 +                                       amount;
2647 +                       start_transfer(fsg, fsg->bulk_out, bh->outreq,
2648 +                                       &bh->outreq_busy, &bh->state);
2649 +                       fsg->next_buffhd_to_fill = bh->next;
2650 +                       fsg->usb_amount_left -= amount;
2651 +                       continue;
2652 +               }
2653 +
2654 +               /* Otherwise wait for something to happen */
2655 +               rc = sleep_thread(fsg);
2656 +               if (rc)
2657 +                       return rc;
2658 +       }
2659 +       return 0;
2660 +}
2661 +
2662 +
2663 +static int finish_reply(struct fsg_dev *fsg)
2664 +{
2665 +       struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
2666 +       int                     rc = 0;
2667 +
2668 +       switch (fsg->data_dir) {
2669 +       case DATA_DIR_NONE:
2670 +               break;                  /* Nothing to send */
2671 +
2672 +       case DATA_DIR_UNKNOWN:
2673 +               rc = -EINVAL;
2674 +               break;
2675 +
2676 +       /* All but the last buffer of data must have already been sent */
2677 +       case DATA_DIR_TO_HOST:
2678 +               if (fsg->data_size == 0)
2679 +                       ;               /* Nothing to send */
2680 +
2681 +               /* If there's no residue, simply send the last buffer */
2682 +               else if (fsg->residue == 0) {
2683 +                       start_transfer(fsg, fsg->bulk_in, bh->inreq,
2684 +                                       &bh->inreq_busy, &bh->state);
2685 +                       fsg->next_buffhd_to_fill = bh->next;
2686 +               } else {
2687 +                       start_transfer(fsg, fsg->bulk_in, bh->inreq,
2688 +                                       &bh->inreq_busy, &bh->state);
2689 +                       fsg->next_buffhd_to_fill = bh->next;
2690 +#if 0
2691 +                       /* this is unnecessary, and was causing problems with MacOS */
2692 +                       if (bh->inreq->length > 0)
2693 +                               write_zero(fsg);
2694 +#endif
2695 +               }
2696 +               break;
2697 +
2698 +       /* We have processed all we want from the data the host has sent.
2699 +        * There may still be outstanding bulk-out requests. */
2700 +       case DATA_DIR_FROM_HOST:
2701 +               if (fsg->residue == 0)
2702 +                       ;               /* Nothing to receive */
2703 +
2704 +               /* Did the host stop sending unexpectedly early? */
2705 +               else if (fsg->short_packet_received) {
2706 +                       raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2707 +                       rc = -EINTR;
2708 +               }
2709 +
2710 +               /* We haven't processed all the incoming data.  Even though
2711 +                * we may be allowed to stall, doing so would cause a race.
2712 +                * The controller may already have ACK'ed all the remaining
2713 +                * bulk-out packets, in which case the host wouldn't see a
2714 +                * STALL.  Not realizing the endpoint was halted, it wouldn't
2715 +                * clear the halt -- leading to problems later on. */
2716 +#if 0
2717 +               fsg_set_halt(fsg, fsg->bulk_out);
2718 +               raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
2719 +               rc = -EINTR;
2720 +#endif
2721 +
2722 +               /* We can't stall.  Read in the excess data and throw it
2723 +                * all away. */
2724 +               else
2725 +                       rc = throw_away_data(fsg);
2726 +               break;
2727 +       }
2728 +       return rc;
2729 +}
2730 +
2731 +
2732 +static int send_status(struct fsg_dev *fsg)
2733 +{
2734 +       struct lun              *curlun = fsg->curlun;
2735 +       struct fsg_buffhd       *bh;
2736 +       int                     rc;
2737 +       u8                      status = USB_STATUS_PASS;
2738 +       u32                     sd, sdinfo = 0;
2739 +       struct bulk_cs_wrap     *csw;
2740 +
2741 +       DBG(fsg, "send_status\n");
2742 +       /* Wait for the next buffer to become available */
2743 +       bh = fsg->next_buffhd_to_fill;
2744 +       while (bh->state != BUF_STATE_EMPTY) {
2745 +               rc = sleep_thread(fsg);
2746 +               if (rc)
2747 +                       return rc;
2748 +       }
2749 +
2750 +       if (curlun) {
2751 +               sd = curlun->sense_data;
2752 +               sdinfo = curlun->sense_data_info;
2753 +       } else if (fsg->bad_lun_okay)
2754 +               sd = SS_NO_SENSE;
2755 +       else
2756 +               sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
2757 +
2758 +       if (fsg->phase_error) {
2759 +               DBG(fsg, "sending phase-error status\n");
2760 +               status = USB_STATUS_PHASE_ERROR;
2761 +               sd = SS_INVALID_COMMAND;
2762 +       } else if (sd != SS_NO_SENSE) {
2763 +               DBG(fsg, "sending command-failure status\n");
2764 +               status = USB_STATUS_FAIL;
2765 +               VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
2766 +                               "  info x%x\n",
2767 +                               SK(sd), ASC(sd), ASCQ(sd), sdinfo);
2768 +       }
2769 +
2770 +       csw = bh->buf;
2771 +
2772 +       /* Store and send the Bulk-only CSW */
2773 +       csw->Signature = __constant_cpu_to_le32(USB_BULK_CS_SIG);
2774 +       csw->Tag = fsg->tag;
2775 +       csw->Residue = cpu_to_le32(fsg->residue);
2776 +       csw->Status = status;
2777 +
2778 +       bh->inreq->length = USB_BULK_CS_WRAP_LEN;
2779 +       start_transfer(fsg, fsg->bulk_in, bh->inreq,
2780 +                       &bh->inreq_busy, &bh->state);
2781 +
2782 +       fsg->next_buffhd_to_fill = bh->next;
2783 +       return 0;
2784 +}
2785 +
2786 +
2787 +/*-------------------------------------------------------------------------*/
2788 +
2789 +/* Check whether the command is properly formed and whether its data size
2790 + * and direction agree with the values we already have. */
2791 +static int check_command(struct fsg_dev *fsg, int cmnd_size,
2792 +               enum data_direction data_dir, unsigned int mask,
2793 +               int needs_medium, const char *name)
2794 +{
2795 +       int                     i;
2796 +       int                     lun = fsg->cmnd[1] >> 5;
2797 +       static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
2798 +       char                    hdlen[20];
2799 +       struct lun              *curlun;
2800 +
2801 +       hdlen[0] = 0;
2802 +       if (fsg->data_dir != DATA_DIR_UNKNOWN)
2803 +               sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
2804 +                               fsg->data_size);
2805 +       VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
2806 +                       name, cmnd_size, dirletter[(int) data_dir],
2807 +                       fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
2808 +
2809 +       /* We can't reply at all until we know the correct data direction
2810 +        * and size. */
2811 +       if (fsg->data_size_from_cmnd == 0)
2812 +               data_dir = DATA_DIR_NONE;
2813 +       if (fsg->data_dir == DATA_DIR_UNKNOWN) {        /* CB or CBI */
2814 +               fsg->data_dir = data_dir;
2815 +               fsg->data_size = fsg->data_size_from_cmnd;
2816 +
2817 +       } else {                                        /* Bulk-only */
2818 +               if (fsg->data_size < fsg->data_size_from_cmnd) {
2819 +
2820 +                       /* Host data size < Device data size is a phase error.
2821 +                        * Carry out the command, but only transfer as much
2822 +                        * as we are allowed. */
2823 +                       DBG(fsg, "phase error 1\n");
2824 +                       fsg->data_size_from_cmnd = fsg->data_size;
2825 +                       fsg->phase_error = 1;
2826 +               }
2827 +       }
2828 +       fsg->residue = fsg->usb_amount_left = fsg->data_size;
2829 +
2830 +       /* Conflicting data directions is a phase error */
2831 +       if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
2832 +               fsg->phase_error = 1;
2833 +               DBG(fsg, "phase error 2\n");
2834 +               return -EINVAL;
2835 +       }
2836 +
2837 +       /* Verify the length of the command itself */
2838 +       if (cmnd_size != fsg->cmnd_size) {
2839 +
2840 +               /* Special case workaround: MS-Windows issues REQUEST SENSE
2841 +                * with cbw->Length == 12 (it should be 6). */
2842 +               if (fsg->cmnd[0] == SC_REQUEST_SENSE && fsg->cmnd_size == 12)
2843 +                       cmnd_size = fsg->cmnd_size;
2844 +               else {
2845 +                       fsg->phase_error = 1;
2846 +                       return -EINVAL;
2847 +               }
2848 +       }
2849 +
2850 +       /* Check that the LUN values are consistent */
2851 +       if (fsg->lun != lun)
2852 +               DBG(fsg, "using LUN %d from CBW, "
2853 +                               "not LUN %d from CDB\n",
2854 +                               fsg->lun, lun);
2855 +
2856 +       /* Check the LUN */
2857 +       if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
2858 +               fsg->curlun = curlun = &fsg->luns[fsg->lun];
2859 +               if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
2860 +                       curlun->sense_data = SS_NO_SENSE;
2861 +                       curlun->sense_data_info = 0;
2862 +                       curlun->info_valid = 0;
2863 +               }
2864 +       } else {
2865 +               fsg->curlun = curlun = NULL;
2866 +               fsg->bad_lun_okay = 0;
2867 +
2868 +               /* INQUIRY and REQUEST SENSE commands are explicitly allowed
2869 +                * to use unsupported LUNs; all others may not. */
2870 +               if (fsg->cmnd[0] != SC_INQUIRY &&
2871 +                               fsg->cmnd[0] != SC_REQUEST_SENSE) {
2872 +                       DBG(fsg, "unsupported LUN %d\n", fsg->lun);
2873 +                       return -EINVAL;
2874 +               }
2875 +       }
2876 +
2877 +       /* If a unit attention condition exists, only INQUIRY and
2878 +        * REQUEST SENSE commands are allowed; anything else must fail. */
2879 +       if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
2880 +                       fsg->cmnd[0] != SC_INQUIRY &&
2881 +                       fsg->cmnd[0] != SC_REQUEST_SENSE) {
2882 +               curlun->sense_data = curlun->unit_attention_data;
2883 +               curlun->unit_attention_data = SS_NO_SENSE;
2884 +               return -EINVAL;
2885 +       }
2886 +
2887 +       /* Check that only command bytes listed in the mask are non-zero */
2888 +       fsg->cmnd[1] &= 0x1f;                   /* Mask away the LUN */
2889 +       for (i = 1; i < cmnd_size; ++i) {
2890 +               if (fsg->cmnd[i] && !(mask & (1 << i))) {
2891 +                       if (curlun)
2892 +                               curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
2893 +                       DBG(fsg, "SS_INVALID_FIELD_IN_CDB\n");
2894 +                       return -EINVAL;
2895 +               }
2896 +       }
2897 +
2898 +       /* If the medium isn't mounted and the command needs to access
2899 +        * it, return an error. */
2900 +       if (curlun && !backing_file_is_open(curlun) && needs_medium) {
2901 +               curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
2902 +               DBG(fsg, "SS_MEDIUM_NOT_PRESENT\n");
2903 +               return -EINVAL;
2904 +       }
2905 +
2906 +       return 0;
2907 +}
2908 +
2909 +
2910 +static int do_scsi_command(struct fsg_dev *fsg)
2911 +{
2912 +       struct fsg_buffhd       *bh;
2913 +       int                     rc;
2914 +       int                     reply = -EINVAL;
2915 +       int                     i;
2916 +       static char             unknown[16];
2917 +
2918 +       dump_cdb(fsg);
2919 +
2920 +       /* Wait for the next buffer to become available for data or status */
2921 +       bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
2922 +       while (bh->state != BUF_STATE_EMPTY) {
2923 +               rc = sleep_thread(fsg);
2924 +               if (rc)
2925 +                       return rc;
2926 +       }
2927 +       fsg->phase_error = 0;
2928 +       fsg->short_packet_received = 0;
2929 +
2930 +       down_read(&fsg->filesem);       /* We're using the backing file */
2931 +       switch (fsg->cmnd[0]) {
2932 +
2933 +       case SC_INQUIRY:
2934 +               fsg->data_size_from_cmnd = fsg->cmnd[4];
2935 +               if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2936 +                               (1<<4), 0,
2937 +                               "INQUIRY")) == 0)
2938 +                       reply = do_inquiry(fsg, bh);
2939 +               break;
2940 +
2941 +       case SC_MODE_SELECT_6:
2942 +               fsg->data_size_from_cmnd = fsg->cmnd[4];
2943 +               if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
2944 +                               (1<<1) | (1<<4), 0,
2945 +                               "MODE SELECT(6)")) == 0)
2946 +                       reply = do_mode_select(fsg, bh);
2947 +               break;
2948 +
2949 +       case SC_MODE_SELECT_10:
2950 +               fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
2951 +               if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
2952 +                               (1<<1) | (3<<7), 0,
2953 +                               "MODE SELECT(10)")) == 0)
2954 +                       reply = do_mode_select(fsg, bh);
2955 +               break;
2956 +
2957 +       case SC_MODE_SENSE_6:
2958 +               fsg->data_size_from_cmnd = fsg->cmnd[4];
2959 +               if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2960 +                               (1<<1) | (1<<2) | (1<<4), 0,
2961 +                               "MODE SENSE(6)")) == 0)
2962 +                       reply = do_mode_sense(fsg, bh);
2963 +               break;
2964 +
2965 +       case SC_MODE_SENSE_10:
2966 +               fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
2967 +               if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2968 +                               (1<<1) | (1<<2) | (3<<7), 0,
2969 +                               "MODE SENSE(10)")) == 0)
2970 +                       reply = do_mode_sense(fsg, bh);
2971 +               break;
2972 +
2973 +       case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
2974 +               fsg->data_size_from_cmnd = 0;
2975 +               if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
2976 +                               (1<<4), 0,
2977 +                               "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
2978 +                       reply = do_prevent_allow(fsg);
2979 +               break;
2980 +
2981 +       case SC_READ_6:
2982 +               i = fsg->cmnd[4];
2983 +               fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
2984 +               if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
2985 +                               (7<<1) | (1<<4), 1,
2986 +                               "READ(6)")) == 0)
2987 +                       reply = do_read(fsg);
2988 +               break;
2989 +
2990 +       case SC_READ_10:
2991 +               fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
2992 +               if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
2993 +                               (1<<1) | (0xf<<2) | (3<<7), 1,
2994 +                               "READ(10)")) == 0)
2995 +                       reply = do_read(fsg);
2996 +               break;
2997 +
2998 +       case SC_READ_12:
2999 +               fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
3000 +               if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
3001 +                               (1<<1) | (0xf<<2) | (0xf<<6), 1,
3002 +                               "READ(12)")) == 0)
3003 +                       reply = do_read(fsg);
3004 +               break;
3005 +
3006 +       case SC_READ_CAPACITY:
3007 +               fsg->data_size_from_cmnd = 8;
3008 +               if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3009 +                               (0xf<<2) | (1<<8), 1,
3010 +                               "READ CAPACITY")) == 0)
3011 +                       reply = do_read_capacity(fsg, bh);
3012 +               break;
3013 +
3014 +       case SC_READ_FORMAT_CAPACITIES:
3015 +               fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
3016 +               if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
3017 +                               (3<<7), 1,
3018 +                               "READ FORMAT CAPACITIES")) == 0)
3019 +                       reply = do_read_format_capacities(fsg, bh);
3020 +               break;
3021 +
3022 +       case SC_REQUEST_SENSE:
3023 +               fsg->data_size_from_cmnd = fsg->cmnd[4];
3024 +               if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
3025 +                               (1<<4), 0,
3026 +                               "REQUEST SENSE")) == 0)
3027 +                       reply = do_request_sense(fsg, bh);
3028 +               break;
3029 +
3030 +       case SC_START_STOP_UNIT:
3031 +               fsg->data_size_from_cmnd = 0;
3032 +               if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
3033 +                               (1<<1) | (1<<4), 0,
3034 +                               "START-STOP UNIT")) == 0)
3035 +                       reply = do_start_stop(fsg);
3036 +               break;
3037 +
3038 +       case SC_SYNCHRONIZE_CACHE:
3039 +               fsg->data_size_from_cmnd = 0;
3040 +               if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
3041 +                               (0xf<<2) | (3<<7), 1,
3042 +                               "SYNCHRONIZE CACHE")) == 0)
3043 +                       reply = do_synchronize_cache(fsg);
3044 +               break;
3045 +
3046 +       case SC_TEST_UNIT_READY:
3047 +               fsg->data_size_from_cmnd = 0;
3048 +               reply = check_command(fsg, 6, DATA_DIR_NONE,
3049 +                               0, 1,
3050 +                               "TEST UNIT READY");
3051 +               break;
3052 +
3053 +       /* Although optional, this command is used by MS-Windows.  We
3054 +        * support a minimal version: BytChk must be 0. */
3055 +       case SC_VERIFY:
3056 +               fsg->data_size_from_cmnd = 0;
3057 +               if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
3058 +                               (1<<1) | (0xf<<2) | (3<<7), 1,
3059 +                               "VERIFY")) == 0)
3060 +                       reply = do_verify(fsg);
3061 +               break;
3062 +
3063 +       case SC_WRITE_6:
3064 +               i = fsg->cmnd[4];
3065 +               fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
3066 +               if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
3067 +                               (7<<1) | (1<<4), 1,
3068 +                               "WRITE(6)")) == 0)
3069 +                       reply = do_write(fsg);
3070 +               break;
3071 +
3072 +       case SC_WRITE_10:
3073 +               fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
3074 +               if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
3075 +                               (1<<1) | (0xf<<2) | (3<<7), 1,
3076 +                               "WRITE(10)")) == 0)
3077 +                       reply = do_write(fsg);
3078 +               break;
3079 +
3080 +       case SC_WRITE_12:
3081 +               fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
3082 +               if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
3083 +                               (1<<1) | (0xf<<2) | (0xf<<6), 1,
3084 +                               "WRITE(12)")) == 0)
3085 +                       reply = do_write(fsg);
3086 +               break;
3087 +
3088 +       /* Some mandatory commands that we recognize but don't implement.
3089 +        * They don't mean much in this setting.  It's left as an exercise
3090 +        * for anyone interested to implement RESERVE and RELEASE in terms
3091 +        * of Posix locks. */
3092 +       case SC_FORMAT_UNIT:
3093 +       case SC_RELEASE:
3094 +       case SC_RESERVE:
3095 +       case SC_SEND_DIAGNOSTIC:
3096 +               /* Fall through */
3097 +
3098 +       default:
3099 +               fsg->data_size_from_cmnd = 0;
3100 +               sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
3101 +               if ((reply = check_command(fsg, fsg->cmnd_size,
3102 +                               DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
3103 +                       fsg->curlun->sense_data = SS_INVALID_COMMAND;
3104 +                       reply = -EINVAL;
3105 +               }
3106 +               break;
3107 +       }
3108 +       up_read(&fsg->filesem);
3109 +
3110 +       VDBG(fsg, "reply: %d, fsg->data_size_from_cmnd: %d\n",
3111 +                       reply, fsg->data_size_from_cmnd);
3112 +       if (reply == -EINTR || signal_pending(current))
3113 +               return -EINTR;
3114 +
3115 +       /* Set up the single reply buffer for finish_reply() */
3116 +       if (reply == -EINVAL)
3117 +               reply = 0;              /* Error reply length */
3118 +       if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
3119 +               reply = min((u32) reply, fsg->data_size_from_cmnd);
3120 +               bh->inreq->length = reply;
3121 +               bh->state = BUF_STATE_FULL;
3122 +               fsg->residue -= reply;
3123 +       }                               /* Otherwise it's already set */
3124 +
3125 +       return 0;
3126 +}
3127 +
3128 +
3129 +/*-------------------------------------------------------------------------*/
3130 +
3131 +static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
3132 +{
3133 +       struct usb_request      *req = bh->outreq;
3134 +       struct bulk_cb_wrap     *cbw = req->buf;
3135 +
3136 +       /* Was this a real packet? */
3137 +       if (req->status)
3138 +               return -EINVAL;
3139 +
3140 +       /* Is the CBW valid? */
3141 +       if (req->actual != USB_BULK_CB_WRAP_LEN ||
3142 +                       cbw->Signature != __constant_cpu_to_le32(
3143 +                               USB_BULK_CB_SIG)) {
3144 +               DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
3145 +                               req->actual,
3146 +                               le32_to_cpu(cbw->Signature));
3147 +               return -EINVAL;
3148 +       }
3149 +
3150 +       /* Is the CBW meaningful? */
3151 +       if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
3152 +                       cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
3153 +               DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
3154 +                               "cmdlen %u\n",
3155 +                               cbw->Lun, cbw->Flags, cbw->Length);
3156 +               return -EINVAL;
3157 +       }
3158 +
3159 +       /* Save the command for later */
3160 +       fsg->cmnd_size = cbw->Length;
3161 +       memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
3162 +       if (cbw->Flags & USB_BULK_IN_FLAG)
3163 +               fsg->data_dir = DATA_DIR_TO_HOST;
3164 +       else
3165 +               fsg->data_dir = DATA_DIR_FROM_HOST;
3166 +       fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
3167 +       if (fsg->data_size == 0)
3168 +               fsg->data_dir = DATA_DIR_NONE;
3169 +       fsg->lun = cbw->Lun;
3170 +       fsg->tag = cbw->Tag;
3171 +       return 0;
3172 +}
3173 +
3174 +
3175 +static int get_next_command(struct fsg_dev *fsg)
3176 +{
3177 +       struct fsg_buffhd       *bh;
3178 +       int                     rc = 0;
3179 +
3180 +       /* Wait for the next buffer to become available */
3181 +       bh = fsg->next_buffhd_to_fill;
3182 +       while (bh->state != BUF_STATE_EMPTY) {
3183 +               rc = sleep_thread(fsg);
3184 +               if (rc)
3185 +                       return rc;
3186 +       }
3187 +
3188 +       /* Queue a request to read a Bulk-only CBW */
3189 +       set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
3190 +       start_transfer(fsg, fsg->bulk_out, bh->outreq,
3191 +                       &bh->outreq_busy, &bh->state);
3192 +
3193 +       /* We will drain the buffer in software, which means we
3194 +        * can reuse it for the next filling.  No need to advance
3195 +        * next_buffhd_to_fill. */
3196 +
3197 +       /* Wait for the CBW to arrive */
3198 +       while (bh->state != BUF_STATE_FULL) {
3199 +               rc = sleep_thread(fsg);
3200 +               if (rc)
3201 +                       return rc;
3202 +       }
3203 +       smp_rmb();
3204 +       rc = received_cbw(fsg, bh);
3205 +       bh->state = BUF_STATE_EMPTY;
3206 +
3207 +       return rc;
3208 +}
3209 +
3210 +
3211 +/*-------------------------------------------------------------------------*/
3212 +
3213 +static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
3214 +               const struct usb_endpoint_descriptor *d)
3215 +{
3216 +       int     rc;
3217 +
3218 +       DBG(fsg, "usb_ep_enable %s\n", ep->name);
3219 +       ep->driver_data = fsg;
3220 +       rc = usb_ep_enable(ep, d);
3221 +       if (rc)
3222 +               ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
3223 +       return rc;
3224 +}
3225 +
3226 +static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
3227 +               struct usb_request **preq)
3228 +{
3229 +       *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
3230 +       if (*preq)
3231 +               return 0;
3232 +       ERROR(fsg, "can't allocate request for %s\n", ep->name);
3233 +       return -ENOMEM;
3234 +}
3235 +
3236 +/*
3237 + * Reset interface setting and re-init endpoint state (toggle etc).
3238 + * Call with altsetting < 0 to disable the interface.  The only other
3239 + * available altsetting is 0, which enables the interface.
3240 + */
3241 +static int do_set_interface(struct fsg_dev *fsg, int altsetting)
3242 +{
3243 +       struct usb_composite_dev *cdev = fsg->cdev;
3244 +       int     rc = 0;
3245 +       int     i;
3246 +       const struct usb_endpoint_descriptor    *d;
3247 +
3248 +       if (fsg->running)
3249 +               DBG(fsg, "reset interface\n");
3250 +
3251 +reset:
3252 +       /* Deallocate the requests */
3253 +       for (i = 0; i < NUM_BUFFERS; ++i) {
3254 +               struct fsg_buffhd *bh = &fsg->buffhds[i];
3255 +
3256 +               if (bh->inreq) {
3257 +                       usb_ep_free_request(fsg->bulk_in, bh->inreq);
3258 +                       bh->inreq = NULL;
3259 +               }
3260 +               if (bh->outreq) {
3261 +                       usb_ep_free_request(fsg->bulk_out, bh->outreq);
3262 +                       bh->outreq = NULL;
3263 +               }
3264 +       }
3265 +
3266 +       /* Disable the endpoints */
3267 +       if (fsg->bulk_in_enabled) {
3268 +               DBG(fsg, "usb_ep_disable %s\n", fsg->bulk_in->name);
3269 +               usb_ep_disable(fsg->bulk_in);
3270 +               fsg->bulk_in_enabled = 0;
3271 +       }
3272 +       if (fsg->bulk_out_enabled) {
3273 +               DBG(fsg, "usb_ep_disable %s\n", fsg->bulk_out->name);
3274 +               usb_ep_disable(fsg->bulk_out);
3275 +               fsg->bulk_out_enabled = 0;
3276 +       }
3277 +
3278 +       fsg->running = 0;
3279 +       if (altsetting < 0 || rc != 0)
3280 +               return rc;
3281 +
3282 +       DBG(fsg, "set interface %d\n", altsetting);
3283 +
3284 +       /* Enable the endpoints */
3285 +       d = ep_desc(cdev->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
3286 +       if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
3287 +               goto reset;
3288 +       fsg->bulk_in_enabled = 1;
3289 +
3290 +       d = ep_desc(cdev->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
3291 +       if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
3292 +               goto reset;
3293 +       fsg->bulk_out_enabled = 1;
3294 +       fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
3295 +
3296 +       /* Allocate the requests */
3297 +       for (i = 0; i < NUM_BUFFERS; ++i) {
3298 +               struct fsg_buffhd       *bh = &fsg->buffhds[i];
3299 +
3300 +               rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq);
3301 +               if (rc != 0)
3302 +                       goto reset;
3303 +               rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq);
3304 +               if (rc != 0)
3305 +                       goto reset;
3306 +               bh->inreq->buf = bh->outreq->buf = bh->buf;
3307 +               bh->inreq->context = bh->outreq->context = bh;
3308 +               bh->inreq->complete = bulk_in_complete;
3309 +               bh->outreq->complete = bulk_out_complete;
3310 +       }
3311 +
3312 +       fsg->running = 1;
3313 +       for (i = 0; i < fsg->nluns; ++i)
3314 +               fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
3315 +
3316 +       return rc;
3317 +}
3318 +
3319 +static void adjust_wake_lock(struct fsg_dev *fsg)
3320 +{
3321 +       int ums_active = 0;
3322 +       int i;
3323 +
3324 +       spin_lock_irq(&fsg->lock);
3325 +
3326 +       if (fsg->config) {
3327 +               for (i = 0; i < fsg->nluns; ++i) {
3328 +                       if (backing_file_is_open(&fsg->luns[i]))
3329 +                               ums_active = 1;
3330 +               }
3331 +       }
3332 +
3333 +       if (ums_active)
3334 +               wake_lock(&fsg->wake_lock);
3335 +       else
3336 +               wake_unlock(&fsg->wake_lock);
3337 +
3338 +       spin_unlock_irq(&fsg->lock);
3339 +}
3340 +
3341 +/*
3342 + * Change our operational configuration.  This code must agree with the code
3343 + * that returns config descriptors, and with interface altsetting code.
3344 + *
3345 + * It's also responsible for power management interactions.  Some
3346 + * configurations might not work with our current power sources.
3347 + * For now we just assume the gadget is always self-powered.
3348 + */
3349 +static int do_set_config(struct fsg_dev *fsg, u8 new_config)
3350 +{
3351 +       int     rc = 0;
3352 +
3353 +       if (new_config == fsg->config)
3354 +               return rc;
3355 +
3356 +       /* Disable the single interface */
3357 +       if (fsg->config != 0) {
3358 +               DBG(fsg, "reset config\n");
3359 +               fsg->config = 0;
3360 +               rc = do_set_interface(fsg, -1);
3361 +       }
3362 +
3363 +       /* Enable the interface */
3364 +       if (new_config != 0) {
3365 +               fsg->config = new_config;
3366 +               rc = do_set_interface(fsg, 0);
3367 +               if (rc != 0)
3368 +                       fsg->config = 0;        /* Reset on errors */
3369 +               else
3370 +                       INFO(fsg, "config #%d\n", fsg->config);
3371 +       }
3372 +
3373 +       switch_set_state(&fsg->sdev, new_config);
3374 +       adjust_wake_lock(fsg);
3375 +       return rc;
3376 +}
3377 +
3378 +
3379 +/*-------------------------------------------------------------------------*/
3380 +
3381 +static void handle_exception(struct fsg_dev *fsg)
3382 +{
3383 +       siginfo_t               info;
3384 +       int                     sig;
3385 +       int                     i;
3386 +       struct fsg_buffhd       *bh;
3387 +       enum fsg_state          old_state;
3388 +       u8                      new_config;
3389 +       struct lun              *curlun;
3390 +       int                     rc;
3391 +
3392 +       DBG(fsg, "handle_exception state: %d\n", (int)fsg->state);
3393 +       /* Clear the existing signals.  Anything but SIGUSR1 is converted
3394 +        * into a high-priority EXIT exception. */
3395 +       for (;;) {
3396 +               sig = dequeue_signal_lock(current, &current->blocked, &info);
3397 +               if (!sig)
3398 +                       break;
3399 +               if (sig != SIGUSR1) {
3400 +                       if (fsg->state < FSG_STATE_EXIT)
3401 +                               DBG(fsg, "Main thread exiting on signal\n");
3402 +                       raise_exception(fsg, FSG_STATE_EXIT);
3403 +               }
3404 +       }
3405 +
3406 +       /* Clear out the controller's fifos */
3407 +       if (fsg->bulk_in_enabled)
3408 +               usb_ep_fifo_flush(fsg->bulk_in);
3409 +       if (fsg->bulk_out_enabled)
3410 +               usb_ep_fifo_flush(fsg->bulk_out);
3411 +
3412 +       /* Reset the I/O buffer states and pointers, the SCSI
3413 +        * state, and the exception.  Then invoke the handler. */
3414 +       spin_lock_irq(&fsg->lock);
3415 +
3416 +       for (i = 0; i < NUM_BUFFERS; ++i) {
3417 +               bh = &fsg->buffhds[i];
3418 +               bh->state = BUF_STATE_EMPTY;
3419 +       }
3420 +       fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
3421 +                       &fsg->buffhds[0];
3422 +
3423 +       new_config = fsg->new_config;
3424 +       old_state = fsg->state;
3425 +
3426 +       if (old_state == FSG_STATE_ABORT_BULK_OUT)
3427 +               fsg->state = FSG_STATE_STATUS_PHASE;
3428 +       else {
3429 +               for (i = 0; i < fsg->nluns; ++i) {
3430 +                       curlun = &fsg->luns[i];
3431 +                       curlun->prevent_medium_removal = 0;
3432 +                       curlun->sense_data = curlun->unit_attention_data =
3433 +                                       SS_NO_SENSE;
3434 +                       curlun->sense_data_info = 0;
3435 +                       curlun->info_valid = 0;
3436 +               }
3437 +               fsg->state = FSG_STATE_IDLE;
3438 +       }
3439 +       spin_unlock_irq(&fsg->lock);
3440 +
3441 +       /* Carry out any extra actions required for the exception */
3442 +       switch (old_state) {
3443 +       default:
3444 +               break;
3445 +
3446 +       case FSG_STATE_ABORT_BULK_OUT:
3447 +               DBG(fsg, "FSG_STATE_ABORT_BULK_OUT\n");
3448 +               spin_lock_irq(&fsg->lock);
3449 +               if (fsg->state == FSG_STATE_STATUS_PHASE)
3450 +                       fsg->state = FSG_STATE_IDLE;
3451 +               spin_unlock_irq(&fsg->lock);
3452 +               break;
3453 +
3454 +       case FSG_STATE_RESET:
3455 +               /* really not much to do here */
3456 +               break;
3457 +
3458 +       case FSG_STATE_CONFIG_CHANGE:
3459 +               rc = do_set_config(fsg, new_config);
3460 +               if (new_config == 0) {
3461 +                       /* We're using the backing file */
3462 +                       down_read(&fsg->filesem);
3463 +                       fsync_all(fsg);
3464 +                       up_read(&fsg->filesem);
3465 +               }
3466 +               break;
3467 +
3468 +       case FSG_STATE_EXIT:
3469 +       case FSG_STATE_TERMINATED:
3470 +               do_set_config(fsg, 0);                  /* Free resources */
3471 +               spin_lock_irq(&fsg->lock);
3472 +               fsg->state = FSG_STATE_TERMINATED;      /* Stop the thread */
3473 +               spin_unlock_irq(&fsg->lock);
3474 +               break;
3475 +       }
3476 +}
3477 +
3478 +
3479 +/*-------------------------------------------------------------------------*/
3480 +
3481 +static int fsg_main_thread(void *fsg_)
3482 +{
3483 +       struct fsg_dev          *fsg = fsg_;
3484 +
3485 +       /* Allow the thread to be killed by a signal, but set the signal mask
3486 +        * to block everything but INT, TERM, KILL, and USR1. */
3487 +       allow_signal(SIGINT);
3488 +       allow_signal(SIGTERM);
3489 +       allow_signal(SIGKILL);
3490 +       allow_signal(SIGUSR1);
3491 +
3492 +       /* Allow the thread to be frozen */
3493 +       set_freezable();
3494 +
3495 +       /* Arrange for userspace references to be interpreted as kernel
3496 +        * pointers.  That way we can pass a kernel pointer to a routine
3497 +        * that expects a __user pointer and it will work okay. */
3498 +       set_fs(get_ds());
3499 +
3500 +       /* The main loop */
3501 +       while (fsg->state != FSG_STATE_TERMINATED) {
3502 +               if (exception_in_progress(fsg) || signal_pending(current)) {
3503 +                       handle_exception(fsg);
3504 +                       continue;
3505 +               }
3506 +
3507 +               if (!fsg->running) {
3508 +                       sleep_thread(fsg);
3509 +                       continue;
3510 +               }
3511 +
3512 +               if (get_next_command(fsg))
3513 +                       continue;
3514 +
3515 +               spin_lock_irq(&fsg->lock);
3516 +               if (!exception_in_progress(fsg))
3517 +                       fsg->state = FSG_STATE_DATA_PHASE;
3518 +               spin_unlock_irq(&fsg->lock);
3519 +
3520 +               if (do_scsi_command(fsg) || finish_reply(fsg))
3521 +                       continue;
3522 +
3523 +               spin_lock_irq(&fsg->lock);
3524 +               if (!exception_in_progress(fsg))
3525 +                       fsg->state = FSG_STATE_STATUS_PHASE;
3526 +               spin_unlock_irq(&fsg->lock);
3527 +
3528 +               if (send_status(fsg))
3529 +                       continue;
3530 +
3531 +               spin_lock_irq(&fsg->lock);
3532 +               if (!exception_in_progress(fsg))
3533 +                       fsg->state = FSG_STATE_IDLE;
3534 +               spin_unlock_irq(&fsg->lock);
3535 +               }
3536 +
3537 +       spin_lock_irq(&fsg->lock);
3538 +       fsg->thread_task = NULL;
3539 +       spin_unlock_irq(&fsg->lock);
3540 +
3541 +       /* In case we are exiting because of a signal, unregister the
3542 +        * gadget driver and close the backing file. */
3543 +       if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
3544 +               close_all_backing_files(fsg);
3545 +
3546 +       /* Let the unbind and cleanup routines know the thread has exited */
3547 +       complete_and_exit(&fsg->thread_notifier, 0);
3548 +}
3549 +
3550 +
3551 +/*-------------------------------------------------------------------------*/
3552 +
3553 +/* If the next two routines are called while the gadget is registered,
3554 + * the caller must own fsg->filesem for writing. */
3555 +
3556 +static int open_backing_file(struct fsg_dev *fsg, struct lun *curlun,
3557 +       const char *filename)
3558 +{
3559 +       int                             ro;
3560 +       struct file                     *filp = NULL;
3561 +       int                             rc = -EINVAL;
3562 +       struct inode                    *inode = NULL;
3563 +       loff_t                          size;
3564 +       loff_t                          num_sectors;
3565 +
3566 +       /* R/W if we can, R/O if we must */
3567 +       ro = curlun->ro;
3568 +       if (!ro) {
3569 +               filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
3570 +               if (-EROFS == PTR_ERR(filp))
3571 +                       ro = 1;
3572 +       }
3573 +       if (ro)
3574 +               filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
3575 +       if (IS_ERR(filp)) {
3576 +               LINFO(curlun, "unable to open backing file: %s\n", filename);
3577 +               return PTR_ERR(filp);
3578 +       }
3579 +
3580 +       if (!(filp->f_mode & FMODE_WRITE))
3581 +               ro = 1;
3582 +
3583 +       if (filp->f_path.dentry)
3584 +               inode = filp->f_path.dentry->d_inode;
3585 +       if (inode && S_ISBLK(inode->i_mode)) {
3586 +               if (bdev_read_only(inode->i_bdev))
3587 +                       ro = 1;
3588 +       } else if (!inode || !S_ISREG(inode->i_mode)) {
3589 +               LINFO(curlun, "invalid file type: %s\n", filename);
3590 +               goto out;
3591 +       }
3592 +
3593 +       /* If we can't read the file, it's no good.
3594 +        * If we can't write the file, use it read-only. */
3595 +       if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
3596 +               LINFO(curlun, "file not readable: %s\n", filename);
3597 +               goto out;
3598 +       }
3599 +       if (!(filp->f_op->write || filp->f_op->aio_write))
3600 +               ro = 1;
3601 +
3602 +       size = i_size_read(inode->i_mapping->host);
3603 +       if (size < 0) {
3604 +               LINFO(curlun, "unable to find file size: %s\n", filename);
3605 +               rc = (int) size;
3606 +               goto out;
3607 +       }
3608 +       num_sectors = size >> 9;        /* File size in 512-byte sectors */
3609 +       if (num_sectors == 0) {
3610 +               LINFO(curlun, "file too small: %s\n", filename);
3611 +               rc = -ETOOSMALL;
3612 +               goto out;
3613 +       }
3614 +
3615 +       get_file(filp);
3616 +       curlun->ro = ro;
3617 +       curlun->filp = filp;
3618 +       curlun->file_length = size;
3619 +       curlun->num_sectors = num_sectors;
3620 +       LDBG(curlun, "open backing file: %s size: %lld num_sectors: %lld\n",
3621 +                       filename, size, num_sectors);
3622 +       rc = 0;
3623 +       adjust_wake_lock(fsg);
3624 +
3625 +out:
3626 +       filp_close(filp, current->files);
3627 +       return rc;
3628 +}
3629 +
3630 +
3631 +static void close_backing_file(struct fsg_dev *fsg, struct lun *curlun)
3632 +{
3633 +       if (curlun->filp) {
3634 +               int rc;
3635 +
3636 +               /*
3637 +                * XXX: San: Ugly hack here added to ensure that
3638 +                * our pages get synced to disk.
3639 +                * Also drop caches here just to be extra-safe
3640 +                */
3641 +               rc = vfs_fsync(curlun->filp, curlun->filp->f_path.dentry, 1);
3642 +               if (rc < 0)
3643 +                       printk(KERN_ERR "ums: Error syncing data (%d)\n", rc);
3644 +               /* drop_pagecache and drop_slab are no longer available */
3645 +               /* drop_pagecache(); */
3646 +               /* drop_slab(); */
3647 +
3648 +               LDBG(curlun, "close backing file\n");
3649 +               fput(curlun->filp);
3650 +               curlun->filp = NULL;
3651 +               adjust_wake_lock(fsg);
3652 +       }
3653 +}
3654 +
3655 +static void close_all_backing_files(struct fsg_dev *fsg)
3656 +{
3657 +       int     i;
3658 +
3659 +       for (i = 0; i < fsg->nluns; ++i)
3660 +               close_backing_file(fsg, &fsg->luns[i]);
3661 +}
3662 +
3663 +static ssize_t show_file(struct device *dev, struct device_attribute *attr,
3664 +               char *buf)
3665 +{
3666 +       struct lun      *curlun = dev_to_lun(dev);
3667 +       struct fsg_dev  *fsg = dev_get_drvdata(dev);
3668 +       char            *p;
3669 +       ssize_t         rc;
3670 +
3671 +       down_read(&fsg->filesem);
3672 +       if (backing_file_is_open(curlun)) {     /* Get the complete pathname */
3673 +               p = d_path(&curlun->filp->f_path, buf, PAGE_SIZE - 1);
3674 +               if (IS_ERR(p))
3675 +                       rc = PTR_ERR(p);
3676 +               else {
3677 +                       rc = strlen(p);
3678 +                       memmove(buf, p, rc);
3679 +                       buf[rc] = '\n';         /* Add a newline */
3680 +                       buf[++rc] = 0;
3681 +               }
3682 +       } else {                                /* No file, return 0 bytes */
3683 +               *buf = 0;
3684 +               rc = 0;
3685 +       }
3686 +       up_read(&fsg->filesem);
3687 +       return rc;
3688 +}
3689 +
3690 +static ssize_t store_file(struct device *dev, struct device_attribute *attr,
3691 +               const char *buf, size_t count)
3692 +{
3693 +       struct lun      *curlun = dev_to_lun(dev);
3694 +       struct fsg_dev  *fsg = dev_get_drvdata(dev);
3695 +       int             rc = 0;
3696 +
3697 +       DBG(fsg, "store_file: \"%s\"\n", buf);
3698 +#if 0
3699 +       /* disabled because we need to allow closing the backing file if the media was removed */
3700 +       if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
3701 +               LDBG(curlun, "eject attempt prevented\n");
3702 +               return -EBUSY;                          /* "Door is locked" */
3703 +       }
3704 +#endif
3705 +
3706 +       /* Remove a trailing newline */
3707 +       if (count > 0 && buf[count-1] == '\n')
3708 +               ((char *) buf)[count-1] = 0;
3709 +
3710 +       /* Eject current medium */
3711 +       down_write(&fsg->filesem);
3712 +       if (backing_file_is_open(curlun)) {
3713 +               close_backing_file(fsg, curlun);
3714 +               curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
3715 +       }
3716 +
3717 +       /* Load new medium */
3718 +       if (count > 0 && buf[0]) {
3719 +               rc = open_backing_file(fsg, curlun, buf);
3720 +               if (rc == 0)
3721 +                       curlun->unit_attention_data =
3722 +                                       SS_NOT_READY_TO_READY_TRANSITION;
3723 +       }
3724 +       up_write(&fsg->filesem);
3725 +       return (rc < 0 ? rc : count);
3726 +}
3727 +
3728 +
3729 +static DEVICE_ATTR(file, 0444, show_file, store_file);
3730 +
3731 +/*-------------------------------------------------------------------------*/
3732 +
3733 +static void fsg_release(struct kref *ref)
3734 +{
3735 +       struct fsg_dev  *fsg = container_of(ref, struct fsg_dev, ref);
3736 +
3737 +       kfree(fsg->luns);
3738 +       kfree(fsg);
3739 +}
3740 +
3741 +static void lun_release(struct device *dev)
3742 +{
3743 +       struct fsg_dev  *fsg = dev_get_drvdata(dev);
3744 +
3745 +       kref_put(&fsg->ref, fsg_release);
3746 +}
3747 +
3748 +
3749 +/*-------------------------------------------------------------------------*/
3750 +
3751 +static int __init fsg_alloc(void)
3752 +{
3753 +       struct fsg_dev          *fsg;
3754 +
3755 +       fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
3756 +       if (!fsg)
3757 +               return -ENOMEM;
3758 +       spin_lock_init(&fsg->lock);
3759 +       init_rwsem(&fsg->filesem);
3760 +       kref_init(&fsg->ref);
3761 +       init_completion(&fsg->thread_notifier);
3762 +
3763 +       the_fsg = fsg;
3764 +       return 0;
3765 +}
3766 +
3767 +static ssize_t print_switch_name(struct switch_dev *sdev, char *buf)
3768 +{
3769 +       return sprintf(buf, "%s\n", DRIVER_NAME);
3770 +}
3771 +
3772 +static ssize_t print_switch_state(struct switch_dev *sdev, char *buf)
3773 +{
3774 +       struct fsg_dev  *fsg = container_of(sdev, struct fsg_dev, sdev);
3775 +       return sprintf(buf, "%s\n", (fsg->config ? "online" : "offline"));
3776 +}
3777 +
3778 +static void
3779 +fsg_function_unbind(struct usb_configuration *c, struct usb_function *f)
3780 +{
3781 +       struct fsg_dev  *fsg = func_to_dev(f);
3782 +       int                     i;
3783 +       struct lun              *curlun;
3784 +
3785 +       DBG(fsg, "fsg_function_unbind\n");
3786 +       clear_bit(REGISTERED, &fsg->atomic_bitflags);
3787 +
3788 +       /* Unregister the sysfs attribute files and the LUNs */
3789 +       for (i = 0; i < fsg->nluns; ++i) {
3790 +               curlun = &fsg->luns[i];
3791 +               if (curlun->registered) {
3792 +                       device_remove_file(&curlun->dev, &dev_attr_file);
3793 +                       device_unregister(&curlun->dev);
3794 +                       curlun->registered = 0;
3795 +               }
3796 +       }
3797 +
3798 +       /* If the thread isn't already dead, tell it to exit now */
3799 +       if (fsg->state != FSG_STATE_TERMINATED) {
3800 +               raise_exception(fsg, FSG_STATE_EXIT);
3801 +               wait_for_completion(&fsg->thread_notifier);
3802 +
3803 +               /* The cleanup routine waits for this completion also */
3804 +               complete(&fsg->thread_notifier);
3805 +       }
3806 +
3807 +       /* Free the data buffers */
3808 +       for (i = 0; i < NUM_BUFFERS; ++i)
3809 +               kfree(fsg->buffhds[i].buf);
3810 +}
3811 +
3812 +static int __init
3813 +fsg_function_bind(struct usb_configuration *c, struct usb_function *f)
3814 +{
3815 +       struct usb_composite_dev *cdev = c->cdev;
3816 +       struct fsg_dev  *fsg = func_to_dev(f);
3817 +       int                     rc;
3818 +       int                     i;
3819 +       int                     id;
3820 +       struct lun              *curlun;
3821 +       struct usb_ep           *ep;
3822 +       char                    *pathbuf, *p;
3823 +
3824 +       fsg->cdev = cdev;
3825 +       DBG(fsg, "fsg_function_bind\n");
3826 +
3827 +       dev_attr_file.attr.mode = 0644;
3828 +
3829 +       /* Find out how many LUNs there should be */
3830 +       i = fsg->nluns;
3831 +       if (i == 0)
3832 +               i = 1;
3833 +       if (i > MAX_LUNS) {
3834 +               ERROR(fsg, "invalid number of LUNs: %d\n", i);
3835 +               rc = -EINVAL;
3836 +               goto out;
3837 +       }
3838 +
3839 +       /* Create the LUNs, open their backing files, and register the
3840 +        * LUN devices in sysfs. */
3841 +       fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
3842 +       if (!fsg->luns) {
3843 +               rc = -ENOMEM;
3844 +               goto out;
3845 +       }
3846 +       fsg->nluns = i;
3847 +
3848 +       for (i = 0; i < fsg->nluns; ++i) {
3849 +               curlun = &fsg->luns[i];
3850 +               curlun->ro = 0;
3851 +               curlun->dev.release = lun_release;
3852 +               curlun->dev.parent = &cdev->gadget->dev;
3853 +               dev_set_drvdata(&curlun->dev, fsg);
3854 +               snprintf(curlun->dev.bus_id, BUS_ID_SIZE,
3855 +                               "lun%d", i);
3856 +
3857 +               rc = device_register(&curlun->dev);
3858 +               if (rc != 0) {
3859 +                       INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
3860 +                       goto out;
3861 +               }
3862 +               rc = device_create_file(&curlun->dev, &dev_attr_file);
3863 +               if (rc != 0) {
3864 +                       ERROR(fsg, "device_create_file failed: %d\n", rc);
3865 +                       device_unregister(&curlun->dev);
3866 +                       goto out;
3867 +               }
3868 +               curlun->registered = 1;
3869 +               kref_get(&fsg->ref);
3870 +       }
3871 +
3872 +       /* allocate interface ID(s) */
3873 +       id = usb_interface_id(c, f);
3874 +       if (id < 0)
3875 +               return id;
3876 +       intf_desc.bInterfaceNumber = id;
3877 +
3878 +       ep = usb_ep_autoconfig(cdev->gadget, &fs_bulk_in_desc);
3879 +       if (!ep)
3880 +               goto autoconf_fail;
3881 +       ep->driver_data = fsg;          /* claim the endpoint */
3882 +       fsg->bulk_in = ep;
3883 +
3884 +       ep = usb_ep_autoconfig(cdev->gadget, &fs_bulk_out_desc);
3885 +       if (!ep)
3886 +               goto autoconf_fail;
3887 +       ep->driver_data = fsg;          /* claim the endpoint */
3888 +       fsg->bulk_out = ep;
3889 +
3890 +       rc = -ENOMEM;
3891 +
3892 +       if (gadget_is_dualspeed(cdev->gadget)) {
3893 +               /* Assume endpoint addresses are the same for both speeds */
3894 +               hs_bulk_in_desc.bEndpointAddress =
3895 +                               fs_bulk_in_desc.bEndpointAddress;
3896 +               hs_bulk_out_desc.bEndpointAddress =
3897 +                               fs_bulk_out_desc.bEndpointAddress;
3898 +
3899 +               f->hs_descriptors = hs_function;
3900 +       }
3901 +
3902 +       /* Allocate the data buffers */
3903 +       for (i = 0; i < NUM_BUFFERS; ++i) {
3904 +               struct fsg_buffhd       *bh = &fsg->buffhds[i];
3905 +
3906 +               /* Allocate for the bulk-in endpoint.  We assume that
3907 +                * the buffer will also work with the bulk-out (and
3908 +                * interrupt-in) endpoint. */
3909 +               bh->buf = kmalloc(fsg->buf_size, GFP_KERNEL);
3910 +               if (!bh->buf)
3911 +                       goto out;
3912 +               bh->next = bh + 1;
3913 +       }
3914 +       fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
3915 +
3916 +       fsg->thread_task = kthread_create(fsg_main_thread, fsg,
3917 +                       shortname);
3918 +       if (IS_ERR(fsg->thread_task)) {
3919 +               rc = PTR_ERR(fsg->thread_task);
3920 +               ERROR(fsg, "kthread_create failed: %d\n", rc);
3921 +               goto out;
3922 +       }
3923 +
3924 +       INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
3925 +
3926 +       pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
3927 +       for (i = 0; i < fsg->nluns; ++i) {
3928 +               curlun = &fsg->luns[i];
3929 +               if (backing_file_is_open(curlun)) {
3930 +                       p = NULL;
3931 +                       if (pathbuf) {
3932 +                               p = d_path(&curlun->filp->f_path,
3933 +                                          pathbuf, PATH_MAX);
3934 +                               if (IS_ERR(p))
3935 +                                       p = NULL;
3936 +                       }
3937 +                       LINFO(curlun, "ro=%d, file: %s\n",
3938 +                                       curlun->ro, (p ? p : "(error)"));
3939 +               }
3940 +       }
3941 +       kfree(pathbuf);
3942 +
3943 +       set_bit(REGISTERED, &fsg->atomic_bitflags);
3944 +
3945 +       /* Tell the thread to start working */
3946 +       wake_up_process(fsg->thread_task);
3947 +       return 0;
3948 +
3949 +autoconf_fail:
3950 +       ERROR(fsg, "unable to autoconfigure all endpoints\n");
3951 +       rc = -ENOTSUPP;
3952 +
3953 +out:
3954 +       DBG(fsg, "fsg_function_bind failed: %d\n", rc);
3955 +       fsg->state = FSG_STATE_TERMINATED;      /* The thread is dead */
3956 +       fsg_function_unbind(c, f);
3957 +       close_all_backing_files(fsg);
3958 +       return rc;
3959 +}
3960 +
3961 +static int fsg_function_set_alt(struct usb_function *f,
3962 +               unsigned intf, unsigned alt)
3963 +{
3964 +       struct fsg_dev  *fsg = func_to_dev(f);
3965 +       DBG(fsg, "fsg_function_set_alt intf: %d alt: %d\n", intf, alt);
3966 +       fsg->new_config = 1;
3967 +       raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
3968 +       return 0;
3969 +}
3970 +
3971 +static void fsg_function_disable(struct usb_function *f)
3972 +{
3973 +       struct fsg_dev  *fsg = func_to_dev(f);
3974 +       DBG(fsg, "fsg_function_disable\n");
3975 +       fsg->new_config = 0;
3976 +       raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
3977 +}
3978 +
3979 +int __init mass_storage_function_add(struct usb_composite_dev *cdev,
3980 +       struct usb_configuration *c, int nluns)
3981 +{
3982 +       int             rc;
3983 +       struct fsg_dev  *fsg;
3984 +
3985 +       printk(KERN_INFO "mass_storage_function_add\n");
3986 +       rc = fsg_alloc();
3987 +       if (rc)
3988 +               return rc;
3989 +       fsg = the_fsg;
3990 +       fsg->nluns = nluns;
3991 +
3992 +       spin_lock_init(&fsg->lock);
3993 +       init_rwsem(&fsg->filesem);
3994 +       kref_init(&fsg->ref);
3995 +       init_completion(&fsg->thread_notifier);
3996 +
3997 +       the_fsg->buf_size = BULK_BUFFER_SIZE;
3998 +       the_fsg->sdev.name = DRIVER_NAME;
3999 +       the_fsg->sdev.print_name = print_switch_name;
4000 +       the_fsg->sdev.print_state = print_switch_state;
4001 +       rc = switch_dev_register(&the_fsg->sdev);
4002 +       if (rc < 0)
4003 +               goto err_switch_dev_register;
4004 +
4005 +       wake_lock_init(&the_fsg->wake_lock, WAKE_LOCK_SUSPEND,
4006 +                      "usb_mass_storage");
4007 +
4008 +       fsg->cdev = cdev;
4009 +       fsg->function.name = shortname;
4010 +       fsg->function.descriptors = fs_function;
4011 +       fsg->function.bind = fsg_function_bind;
4012 +       fsg->function.unbind = fsg_function_unbind;
4013 +       fsg->function.setup = fsg_function_setup;
4014 +       fsg->function.set_alt = fsg_function_set_alt;
4015 +       fsg->function.disable = fsg_function_disable;
4016 +
4017 +       rc = usb_add_function(c, &fsg->function);
4018 +       if (rc != 0)
4019 +               goto err_usb_add_function;
4020 +
4021 +       return 0;
4022 +
4023 +err_usb_add_function:
4024 +       switch_dev_unregister(&the_fsg->sdev);
4025 +err_switch_dev_register:
4026 +       kref_put(&the_fsg->ref, fsg_release);
4027 +
4028 +       return rc;
4029 +}
4030 --- /dev/null
4031 +++ b/drivers/usb/gadget/f_mass_storage.h
4032 @@ -0,0 +1,52 @@
4033 +/*
4034 + * drivers/usb/gadget/f_mass_storage.h
4035 + *
4036 + * Function Driver for USB Mass Storage
4037 + *
4038 + * Copyright (C) 2008 Google, Inc.
4039 + * Author: Mike Lockwood <lockwood@android.com>
4040 + *
4041 + * Based heavily on the file_storage gadget driver in
4042 + * drivers/usb/gadget/file_storage.c and licensed under the same terms:
4043 + *
4044 + * Copyright (C) 2003-2007 Alan Stern
4045 + * All rights reserved.
4046 + *
4047 + * Redistribution and use in source and binary forms, with or without
4048 + * modification, are permitted provided that the following conditions
4049 + * are met:
4050 + * 1. Redistributions of source code must retain the above copyright
4051 + *    notice, this list of conditions, and the following disclaimer,
4052 + *    without modification.
4053 + * 2. Redistributions in binary form must reproduce the above copyright
4054 + *    notice, this list of conditions and the following disclaimer in the
4055 + *    documentation and/or other materials provided with the distribution.
4056 + * 3. The names of the above-listed copyright holders may not be used
4057 + *    to endorse or promote products derived from this software without
4058 + *    specific prior written permission.
4059 + *
4060 + * ALTERNATIVELY, this software may be distributed under the terms of the
4061 + * GNU General Public License ("GPL") as published by the Free Software
4062 + * Foundation, either version 2 of that License or (at your option) any
4063 + * later version.
4064 + *
4065 + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
4066 + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
4067 + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
4068 + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
4069 + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
4070 + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
4071 + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
4072 + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
4073 + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
4074 + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
4075 + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
4076 + */
4077 +
4078 +#ifndef __F_MASS_STORAGE_H
4079 +#define __F_MASS_STORAGE_H
4080 +
4081 +int mass_storage_function_add(struct usb_composite_dev *cdev,
4082 +       struct usb_configuration *c, int nluns);
4083 +
4084 +#endif /* __F_MASS_STORAGE_H */
4085 --- /dev/null
4086 +++ b/include/linux/usb/android.h
4087 @@ -0,0 +1,40 @@
4088 +/*
4089 + * Platform data for Android USB
4090 + *
4091 + * Copyright (C) 2008 Google, Inc.
4092 + * Author: Mike Lockwood <lockwood@android.com>
4093 + *
4094 + * This software is licensed under the terms of the GNU General Public
4095 + * License version 2, as published by the Free Software Foundation, and
4096 + * may be copied, distributed, and modified under those terms.
4097 + *
4098 + * This program is distributed in the hope that it will be useful,
4099 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
4100 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4101 + * GNU General Public License for more details.
4102 + *
4103 + */
4104 +#ifndef        __LINUX_USB_ANDROID_H
4105 +#define        __LINUX_USB_ANDROID_H
4106 +
4107 +struct android_usb_platform_data {
4108 +       /* USB device descriptor fields */
4109 +       __u16 vendor_id;
4110 +
4111 +       /* Default product ID. */
4112 +       __u16 product_id;
4113 +
4114 +       /* Product ID when adb is enabled. */
4115 +       __u16 adb_product_id;
4116 +
4117 +       __u16 version;
4118 +
4119 +       char *product_name;
4120 +       char *manufacturer_name;
4121 +       char *serial_number;
4122 +
4123 +       /* number of LUNS for mass storage function */
4124 +       int nluns;
4125 +};
4126 +
4127 +#endif /* __LINUX_USB_ANDROID_H */