drivers/usb/gadget/function/f_tcm.c

   1 /* Target based USB-Gadget
   2  *
   3  * UAS protocol handling, target callbacks, configfs handling,
   4  * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
   5  *
   6  * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
   7  * License: GPLv2 as published by FSF.
   8  */
   9 #include <linux/kernel.h>
  10 #include <linux/module.h>
  11 #include <linux/types.h>
  12 #include <linux/string.h>
  13 #include <linux/configfs.h>
  14 #include <linux/ctype.h>
  15 #include <linux/usb/ch9.h>
  16 #include <linux/usb/composite.h>
  17 #include <linux/usb/gadget.h>
  18 #include <linux/usb/storage.h>
  19 #include <scsi/scsi_tcq.h>
  20 #include <target/target_core_base.h>
  21 #include <target/target_core_fabric.h>
  22 #include <asm/unaligned.h>
  23
  24 #include "tcm.h"
  25 #include "u_tcm.h"
  26 #include "configfs.h"
  27
  28 #define TPG_INSTANCES           1
  29
  30 struct tpg_instance {
  31         struct usb_function_instance    *func_inst;
  32         struct usbg_tpg                 *tpg;
  33 };
  34
  35 static struct tpg_instance tpg_instances[TPG_INSTANCES];
  36
  37 static DEFINE_MUTEX(tpg_instances_lock);
  38
  39 static inline struct f_uas *to_f_uas(struct usb_function *f)
  40 {
  41         return container_of(f, struct f_uas, function);
  42 }
  43
  44 static void usbg_cmd_release(struct kref *);
  45
  46 static inline void usbg_cleanup_cmd(struct usbg_cmd *cmd)
  47 {
  48         kref_put(&cmd->ref, usbg_cmd_release);
  49 }
  50
  51 /* Start bot.c code */
  52
  53 static int bot_enqueue_cmd_cbw(struct f_uas *fu)
  54 {
  55         int ret;
  56
  57         if (fu->flags & USBG_BOT_CMD_PEND)
  58                 return 0;
  59
  60         ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
  61         if (!ret)
  62                 fu->flags |= USBG_BOT_CMD_PEND;
  63         return ret;
  64 }
  65
  66 static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
  67 {
  68         struct usbg_cmd *cmd = req->context;
  69         struct f_uas *fu = cmd->fu;
  70
  71         usbg_cleanup_cmd(cmd);
  72         if (req->status < 0) {
  73                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
  74                 return;
  75         }
  76
  77         /* CSW completed, wait for next CBW */
  78         bot_enqueue_cmd_cbw(fu);
  79 }
  80
  81 static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
  82 {
  83         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
  84         int ret;
  85         unsigned int csw_stat;
  86
  87         csw_stat = cmd->csw_code;
  88         csw->Tag = cmd->bot_tag;
  89         csw->Status = csw_stat;
  90         fu->bot_status.req->context = cmd;
  91         ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
  92         if (ret)
  93                 pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
  94 }
  95
  96 static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
  97 {
  98         struct usbg_cmd *cmd = req->context;
  99         struct f_uas *fu = cmd->fu;
 100
 101         if (req->status < 0)
 102                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 103
 104         if (cmd->data_len) {
 105                 if (cmd->data_len > ep->maxpacket) {
 106                         req->length = ep->maxpacket;
 107                         cmd->data_len -= ep->maxpacket;
 108                 } else {
 109                         req->length = cmd->data_len;
 110                         cmd->data_len = 0;
 111                 }
 112
 113                 usb_ep_queue(ep, req, GFP_ATOMIC);
 114                 return;
 115         }
 116         bot_enqueue_sense_code(fu, cmd);
 117 }
 118
 119 static void bot_send_bad_status(struct usbg_cmd *cmd)
 120 {
 121         struct f_uas *fu = cmd->fu;
 122         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 123         struct usb_request *req;
 124         struct usb_ep *ep;
 125
 126         csw->Residue = cpu_to_le32(cmd->data_len);
 127
 128         if (cmd->data_len) {
 129                 if (cmd->is_read) {
 130                         ep = fu->ep_in;
 131                         req = fu->bot_req_in;
 132                 } else {
 133                         ep = fu->ep_out;
 134                         req = fu->bot_req_out;
 135                 }
 136
 137                 if (cmd->data_len > fu->ep_in->maxpacket) {
 138                         req->length = ep->maxpacket;
 139                         cmd->data_len -= ep->maxpacket;
 140                 } else {
 141                         req->length = cmd->data_len;
 142                         cmd->data_len = 0;
 143                 }
 144                 req->complete = bot_err_compl;
 145                 req->context = cmd;
 146                 req->buf = fu->cmd.buf;
 147                 usb_ep_queue(ep, req, GFP_KERNEL);
 148         } else {
 149                 bot_enqueue_sense_code(fu, cmd);
 150         }
 151 }
 152
 153 static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
 154 {
 155         struct f_uas *fu = cmd->fu;
 156         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 157         int ret;
 158
 159         if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
 160                 if (!moved_data && cmd->data_len) {
 161                         /*
 162                          * the host wants to move data, we don't. Fill / empty
 163                          * the pipe and then send the csw with reside set.
 164                          */
 165                         cmd->csw_code = US_BULK_STAT_OK;
 166                         bot_send_bad_status(cmd);
 167                         return 0;
 168                 }
 169
 170                 csw->Tag = cmd->bot_tag;
 171                 csw->Residue = cpu_to_le32(0);
 172                 csw->Status = US_BULK_STAT_OK;
 173                 fu->bot_status.req->context = cmd;
 174
 175                 ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
 176                 if (ret)
 177                         pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
 178         } else {
 179                 cmd->csw_code = US_BULK_STAT_FAIL;
 180                 bot_send_bad_status(cmd);
 181         }
 182         return 0;
 183 }
 184
 185 /*
 186  * Called after command (no data transfer) or after the write (to device)
 187  * operation is completed
 188  */
 189 static int bot_send_status_response(struct usbg_cmd *cmd)
 190 {
 191         bool moved_data = false;
 192
 193         if (!cmd->is_read)
 194                 moved_data = true;
 195         return bot_send_status(cmd, moved_data);
 196 }
 197
 198 /* Read request completed, now we have to send the CSW */
 199 static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
 200 {
 201         struct usbg_cmd *cmd = req->context;
 202
 203         if (req->status < 0)
 204                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 205
 206         bot_send_status(cmd, true);
 207 }
 208
 209 static int bot_send_read_response(struct usbg_cmd *cmd)
 210 {
 211         struct f_uas *fu = cmd->fu;
 212         struct se_cmd *se_cmd = &cmd->se_cmd;
 213         struct usb_gadget *gadget = fuas_to_gadget(fu);
 214         int ret;
 215
 216         if (!cmd->data_len) {
 217                 cmd->csw_code = US_BULK_STAT_PHASE;
 218                 bot_send_bad_status(cmd);
 219                 return 0;
 220         }
 221
 222         if (!gadget->sg_supported) {
 223                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 224                 if (!cmd->data_buf)
 225                         return -ENOMEM;
 226
 227                 sg_copy_to_buffer(se_cmd->t_data_sg,
 228                                 se_cmd->t_data_nents,
 229                                 cmd->data_buf,
 230                                 se_cmd->data_length);
 231
 232                 fu->bot_req_in->buf = cmd->data_buf;
 233         } else {
 234                 fu->bot_req_in->buf = NULL;
 235                 fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
 236                 fu->bot_req_in->sg = se_cmd->t_data_sg;
 237         }
 238
 239         fu->bot_req_in->complete = bot_read_compl;
 240         fu->bot_req_in->length = se_cmd->data_length;
 241         fu->bot_req_in->context = cmd;
 242         ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
 243         if (ret)
 244                 pr_err("%s(%d)\n", __func__, __LINE__);
 245         return 0;
 246 }
 247
 248 static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
 249 static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
 250
 251 static int bot_send_write_request(struct usbg_cmd *cmd)
 252 {
 253         struct f_uas *fu = cmd->fu;
 254         struct se_cmd *se_cmd = &cmd->se_cmd;
 255         struct usb_gadget *gadget = fuas_to_gadget(fu);
 256         int ret;
 257
 258         init_completion(&cmd->write_complete);
 259         cmd->fu = fu;
 260
 261         if (!cmd->data_len) {
 262                 cmd->csw_code = US_BULK_STAT_PHASE;
 263                 return -EINVAL;
 264         }
 265
 266         if (!gadget->sg_supported) {
 267                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL);
 268                 if (!cmd->data_buf)
 269                         return -ENOMEM;
 270
 271                 fu->bot_req_out->buf = cmd->data_buf;
 272         } else {
 273                 fu->bot_req_out->buf = NULL;
 274                 fu->bot_req_out->num_sgs = se_cmd->t_data_nents;
 275                 fu->bot_req_out->sg = se_cmd->t_data_sg;
 276         }
 277
 278         fu->bot_req_out->complete = usbg_data_write_cmpl;
 279         fu->bot_req_out->length = se_cmd->data_length;
 280         fu->bot_req_out->context = cmd;
 281
 282         ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
 283         if (ret)
 284                 goto cleanup;
 285         ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
 286         if (ret)
 287                 pr_err("%s(%d)\n", __func__, __LINE__);
 288
 289         wait_for_completion(&cmd->write_complete);
 290         target_execute_cmd(se_cmd);
 291 cleanup:
 292         return ret;
 293 }
 294
 295 static int bot_submit_command(struct f_uas *, void *, unsigned int);
 296
 297 static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 298 {
 299         struct f_uas *fu = req->context;
 300         int ret;
 301
 302         fu->flags &= ~USBG_BOT_CMD_PEND;
 303
 304         if (req->status < 0)
 305                 return;
 306
 307         ret = bot_submit_command(fu, req->buf, req->actual);
 308         if (ret)
 309                 pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
 310 }
 311
 312 static int bot_prepare_reqs(struct f_uas *fu)
 313 {
 314         int ret;
 315
 316         fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 317         if (!fu->bot_req_in)
 318                 goto err;
 319
 320         fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 321         if (!fu->bot_req_out)
 322                 goto err_out;
 323
 324         fu->cmd.req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 325         if (!fu->cmd.req)
 326                 goto err_cmd;
 327
 328         fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 329         if (!fu->bot_status.req)
 330                 goto err_sts;
 331
 332         fu->bot_status.req->buf = &fu->bot_status.csw;
 333         fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
 334         fu->bot_status.req->complete = bot_status_complete;
 335         fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
 336
 337         fu->cmd.buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
 338         if (!fu->cmd.buf)
 339                 goto err_buf;
 340
 341         fu->cmd.req->complete = bot_cmd_complete;
 342         fu->cmd.req->buf = fu->cmd.buf;
 343         fu->cmd.req->length = fu->ep_out->maxpacket;
 344         fu->cmd.req->context = fu;
 345
 346         ret = bot_enqueue_cmd_cbw(fu);
 347         if (ret)
 348                 goto err_queue;
 349         return 0;
 350 err_queue:
 351         kfree(fu->cmd.buf);
 352         fu->cmd.buf = NULL;
 353 err_buf:
 354         usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 355 err_sts:
 356         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 357         fu->cmd.req = NULL;
 358 err_cmd:
 359         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 360         fu->bot_req_out = NULL;
 361 err_out:
 362         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 363         fu->bot_req_in = NULL;
 364 err:
 365         pr_err("BOT: endpoint setup failed\n");
 366         return -ENOMEM;
 367 }
 368
 369 static void bot_cleanup_old_alt(struct f_uas *fu)
 370 {
 371         if (!(fu->flags & USBG_ENABLED))
 372                 return;
 373
 374         usb_ep_disable(fu->ep_in);
 375         usb_ep_disable(fu->ep_out);
 376
 377         if (!fu->bot_req_in)
 378                 return;
 379
 380         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 381         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 382         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 383         usb_ep_free_request(fu->ep_out, fu->bot_status.req);
 384
 385         kfree(fu->cmd.buf);
 386
 387         fu->bot_req_in = NULL;
 388         fu->bot_req_out = NULL;
 389         fu->cmd.req = NULL;
 390         fu->bot_status.req = NULL;
 391         fu->cmd.buf = NULL;
 392 }
 393
 394 static void bot_set_alt(struct f_uas *fu)
 395 {
 396         struct usb_function *f = &fu->function;
 397         struct usb_gadget *gadget = f->config->cdev->gadget;
 398         int ret;
 399
 400         fu->flags = USBG_IS_BOT;
 401
 402         config_ep_by_speed(gadget, f, fu->ep_in);
 403         ret = usb_ep_enable(fu->ep_in);
 404         if (ret)
 405                 goto err_b_in;
 406
 407         config_ep_by_speed(gadget, f, fu->ep_out);
 408         ret = usb_ep_enable(fu->ep_out);
 409         if (ret)
 410                 goto err_b_out;
 411
 412         ret = bot_prepare_reqs(fu);
 413         if (ret)
 414                 goto err_wq;
 415         fu->flags |= USBG_ENABLED;
 416         pr_info("Using the BOT protocol\n");
 417         return;
 418 err_wq:
 419         usb_ep_disable(fu->ep_out);
 420 err_b_out:
 421         usb_ep_disable(fu->ep_in);
 422 err_b_in:
 423         fu->flags = USBG_IS_BOT;
 424 }
 425
 426 static int usbg_bot_setup(struct usb_function *f,
 427                 const struct usb_ctrlrequest *ctrl)
 428 {
 429         struct f_uas *fu = to_f_uas(f);
 430         struct usb_composite_dev *cdev = f->config->cdev;
 431         u16 w_value = le16_to_cpu(ctrl->wValue);
 432         u16 w_length = le16_to_cpu(ctrl->wLength);
 433         int luns;
 434         u8 *ret_lun;
 435
 436         switch (ctrl->bRequest) {
 437         case US_BULK_GET_MAX_LUN:
 438                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
 439                                         USB_RECIP_INTERFACE))
 440                         return -ENOTSUPP;
 441
 442                 if (w_length < 1)
 443                         return -EINVAL;
 444                 if (w_value != 0)
 445                         return -EINVAL;
 446                 luns = atomic_read(&fu->tpg->tpg_port_count);
 447                 if (!luns) {
 448                         pr_err("No LUNs configured?\n");
 449                         return -EINVAL;
 450                 }
 451                 /*
 452                  * If 4 LUNs are present we return 3 i.e. LUN 0..3 can be
 453                  * accessed. The upper limit is 0xf
 454                  */
 455                 luns--;
 456                 if (luns > 0xf) {
 457                         pr_info_once("Limiting the number of luns to 16\n");
 458                         luns = 0xf;
 459                 }
 460                 ret_lun = cdev->req->buf;
 461                 *ret_lun = luns;
 462                 cdev->req->length = 1;
 463                 return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
 464
 465         case US_BULK_RESET_REQUEST:
 466                 /* XXX maybe we should remove previous requests for IN + OUT */
 467                 bot_enqueue_cmd_cbw(fu);
 468                 return 0;
 469         }
 470         return -ENOTSUPP;
 471 }
 472
 473 /* Start uas.c code */
 474
 475 static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
 476 {
 477         /* We have either all three allocated or none */
 478         if (!stream->req_in)
 479                 return;
 480
 481         usb_ep_free_request(fu->ep_in, stream->req_in);
 482         usb_ep_free_request(fu->ep_out, stream->req_out);
 483         usb_ep_free_request(fu->ep_status, stream->req_status);
 484
 485         stream->req_in = NULL;
 486         stream->req_out = NULL;
 487         stream->req_status = NULL;
 488 }
 489
 490 static void uasp_free_cmdreq(struct f_uas *fu)
 491 {
 492         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 493         kfree(fu->cmd.buf);
 494         fu->cmd.req = NULL;
 495         fu->cmd.buf = NULL;
 496 }
 497
 498 static void uasp_cleanup_old_alt(struct f_uas *fu)
 499 {
 500         int i;
 501
 502         if (!(fu->flags & USBG_ENABLED))
 503                 return;
 504
 505         usb_ep_disable(fu->ep_in);
 506         usb_ep_disable(fu->ep_out);
 507         usb_ep_disable(fu->ep_status);
 508         usb_ep_disable(fu->ep_cmd);
 509
 510         for (i = 0; i < UASP_SS_EP_COMP_NUM_STREAMS; i++)
 511                 uasp_cleanup_one_stream(fu, &fu->stream[i]);
 512         uasp_free_cmdreq(fu);
 513 }
 514
 515 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
 516
 517 static int uasp_prepare_r_request(struct usbg_cmd *cmd)
 518 {
 519         struct se_cmd *se_cmd = &cmd->se_cmd;
 520         struct f_uas *fu = cmd->fu;
 521         struct usb_gadget *gadget = fuas_to_gadget(fu);
 522         struct uas_stream *stream = cmd->stream;
 523
 524         if (!gadget->sg_supported) {
 525                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 526                 if (!cmd->data_buf)
 527                         return -ENOMEM;
 528
 529                 sg_copy_to_buffer(se_cmd->t_data_sg,
 530                                 se_cmd->t_data_nents,
 531                                 cmd->data_buf,
 532                                 se_cmd->data_length);
 533
 534                 stream->req_in->buf = cmd->data_buf;
 535         } else {
 536                 stream->req_in->buf = NULL;
 537                 stream->req_in->num_sgs = se_cmd->t_data_nents;
 538                 stream->req_in->sg = se_cmd->t_data_sg;
 539         }
 540
 541         stream->req_in->complete = uasp_status_data_cmpl;
 542         stream->req_in->length = se_cmd->data_length;
 543         stream->req_in->context = cmd;
 544
 545         cmd->state = UASP_SEND_STATUS;
 546         return 0;
 547 }
 548
 549 static void uasp_prepare_status(struct usbg_cmd *cmd)
 550 {
 551         struct se_cmd *se_cmd = &cmd->se_cmd;
 552         struct sense_iu *iu = &cmd->sense_iu;
 553         struct uas_stream *stream = cmd->stream;
 554
 555         cmd->state = UASP_QUEUE_COMMAND;
 556         iu->iu_id = IU_ID_STATUS;
 557         iu->tag = cpu_to_be16(cmd->tag);
 558
 559         /*
 560          * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
 561          */
 562         iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
 563         iu->status = se_cmd->scsi_status;
 564         stream->req_status->context = cmd;
 565         stream->req_status->length = se_cmd->scsi_sense_length + 16;
 566         stream->req_status->buf = iu;
 567         stream->req_status->complete = uasp_status_data_cmpl;
 568 }
 569
 570 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
 571 {
 572         struct usbg_cmd *cmd = req->context;
 573         struct uas_stream *stream = cmd->stream;
 574         struct f_uas *fu = cmd->fu;
 575         int ret;
 576
 577         if (req->status < 0)
 578                 goto cleanup;
 579
 580         switch (cmd->state) {
 581         case UASP_SEND_DATA:
 582                 ret = uasp_prepare_r_request(cmd);
 583                 if (ret)
 584                         goto cleanup;
 585                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 586                 if (ret)
 587                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 588                 break;
 589
 590         case UASP_RECEIVE_DATA:
 591                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 592                 if (ret)
 593                         goto cleanup;
 594                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 595                 if (ret)
 596                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 597                 break;
 598
 599         case UASP_SEND_STATUS:
 600                 uasp_prepare_status(cmd);
 601                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 602                                 GFP_ATOMIC);
 603                 if (ret)
 604                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 605                 break;
 606
 607         case UASP_QUEUE_COMMAND:
 608                 usbg_cleanup_cmd(cmd);
 609                 usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 610                 break;
 611
 612         default:
 613                 BUG();
 614         }
 615         return;
 616
 617 cleanup:
 618         usbg_cleanup_cmd(cmd);
 619 }
 620
 621 static int uasp_send_status_response(struct usbg_cmd *cmd)
 622 {
 623         struct f_uas *fu = cmd->fu;
 624         struct uas_stream *stream = cmd->stream;
 625         struct sense_iu *iu = &cmd->sense_iu;
 626
 627         iu->tag = cpu_to_be16(cmd->tag);
 628         stream->req_status->complete = uasp_status_data_cmpl;
 629         stream->req_status->context = cmd;
 630         cmd->fu = fu;
 631         uasp_prepare_status(cmd);
 632         return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
 633 }
 634
 635 static int uasp_send_read_response(struct usbg_cmd *cmd)
 636 {
 637         struct f_uas *fu = cmd->fu;
 638         struct uas_stream *stream = cmd->stream;
 639         struct sense_iu *iu = &cmd->sense_iu;
 640         int ret;
 641
 642         cmd->fu = fu;
 643
 644         iu->tag = cpu_to_be16(cmd->tag);
 645         if (fu->flags & USBG_USE_STREAMS) {
 646
 647                 ret = uasp_prepare_r_request(cmd);
 648                 if (ret)
 649                         goto out;
 650                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 651                 if (ret) {
 652                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 653                         kfree(cmd->data_buf);
 654                         cmd->data_buf = NULL;
 655                 }
 656
 657         } else {
 658
 659                 iu->iu_id = IU_ID_READ_READY;
 660                 iu->tag = cpu_to_be16(cmd->tag);
 661
 662                 stream->req_status->complete = uasp_status_data_cmpl;
 663                 stream->req_status->context = cmd;
 664
 665                 cmd->state = UASP_SEND_DATA;
 666                 stream->req_status->buf = iu;
 667                 stream->req_status->length = sizeof(struct iu);
 668
 669                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 670                                 GFP_ATOMIC);
 671                 if (ret)
 672                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 673         }
 674 out:
 675         return ret;
 676 }
 677
 678 static int uasp_send_write_request(struct usbg_cmd *cmd)
 679 {
 680         struct f_uas *fu = cmd->fu;
 681         struct se_cmd *se_cmd = &cmd->se_cmd;
 682         struct uas_stream *stream = cmd->stream;
 683         struct sense_iu *iu = &cmd->sense_iu;
 684         int ret;
 685
 686         init_completion(&cmd->write_complete);
 687         cmd->fu = fu;
 688
 689         iu->tag = cpu_to_be16(cmd->tag);
 690
 691         if (fu->flags & USBG_USE_STREAMS) {
 692
 693                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 694                 if (ret)
 695                         goto cleanup;
 696                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 697                 if (ret)
 698                         pr_err("%s(%d)\n", __func__, __LINE__);
 699
 700         } else {
 701
 702                 iu->iu_id = IU_ID_WRITE_READY;
 703                 iu->tag = cpu_to_be16(cmd->tag);
 704
 705                 stream->req_status->complete = uasp_status_data_cmpl;
 706                 stream->req_status->context = cmd;
 707
 708                 cmd->state = UASP_RECEIVE_DATA;
 709                 stream->req_status->buf = iu;
 710                 stream->req_status->length = sizeof(struct iu);
 711
 712                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 713                                 GFP_ATOMIC);
 714                 if (ret)
 715                         pr_err("%s(%d)\n", __func__, __LINE__);
 716         }
 717
 718         wait_for_completion(&cmd->write_complete);
 719         target_execute_cmd(se_cmd);
 720 cleanup:
 721         return ret;
 722 }
 723
 724 static int usbg_submit_command(struct f_uas *, void *, unsigned int);
 725
 726 static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 727 {
 728         struct f_uas *fu = req->context;
 729         int ret;
 730
 731         if (req->status < 0)
 732                 return;
 733
 734         ret = usbg_submit_command(fu, req->buf, req->actual);
 735         /*
 736          * Once we tune for performance enqueue the command req here again so
 737          * we can receive a second command while we processing this one. Pay
 738          * attention to properly sync STAUS endpoint with DATA IN + OUT so you
 739          * don't break HS.
 740          */
 741         if (!ret)
 742                 return;
 743         usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 744 }
 745
 746 static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
 747 {
 748         stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 749         if (!stream->req_in)
 750                 goto out;
 751
 752         stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 753         if (!stream->req_out)
 754                 goto err_out;
 755
 756         stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
 757         if (!stream->req_status)
 758                 goto err_sts;
 759
 760         return 0;
 761 err_sts:
 762         usb_ep_free_request(fu->ep_status, stream->req_status);
 763         stream->req_status = NULL;
 764 err_out:
 765         usb_ep_free_request(fu->ep_out, stream->req_out);
 766         stream->req_out = NULL;
 767 out:
 768         return -ENOMEM;
 769 }
 770
 771 static int uasp_alloc_cmd(struct f_uas *fu)
 772 {
 773         fu->cmd.req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
 774         if (!fu->cmd.req)
 775                 goto err;
 776
 777         fu->cmd.buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
 778         if (!fu->cmd.buf)
 779                 goto err_buf;
 780
 781         fu->cmd.req->complete = uasp_cmd_complete;
 782         fu->cmd.req->buf = fu->cmd.buf;
 783         fu->cmd.req->length = fu->ep_cmd->maxpacket;
 784         fu->cmd.req->context = fu;
 785         return 0;
 786
 787 err_buf:
 788         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 789 err:
 790         return -ENOMEM;
 791 }
 792
 793 static void uasp_setup_stream_res(struct f_uas *fu, int max_streams)
 794 {
 795         int i;
 796
 797         for (i = 0; i < max_streams; i++) {
 798                 struct uas_stream *s = &fu->stream[i];
 799
 800                 s->req_in->stream_id = i + 1;
 801                 s->req_out->stream_id = i + 1;
 802                 s->req_status->stream_id = i + 1;
 803         }
 804 }
 805
 806 static int uasp_prepare_reqs(struct f_uas *fu)
 807 {
 808         int ret;
 809         int i;
 810         int max_streams;
 811
 812         if (fu->flags & USBG_USE_STREAMS)
 813                 max_streams = UASP_SS_EP_COMP_NUM_STREAMS;
 814         else
 815                 max_streams = 1;
 816
 817         for (i = 0; i < max_streams; i++) {
 818                 ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
 819                 if (ret)
 820                         goto err_cleanup;
 821         }
 822
 823         ret = uasp_alloc_cmd(fu);
 824         if (ret)
 825                 goto err_free_stream;
 826         uasp_setup_stream_res(fu, max_streams);
 827
 828         ret = usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 829         if (ret)
 830                 goto err_free_stream;
 831
 832         return 0;
 833
 834 err_free_stream:
 835         uasp_free_cmdreq(fu);
 836
 837 err_cleanup:
 838         if (i) {
 839                 do {
 840                         uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
 841                         i--;
 842                 } while (i);
 843         }
 844         pr_err("UASP: endpoint setup failed\n");
 845         return ret;
 846 }
 847
 848 static void uasp_set_alt(struct f_uas *fu)
 849 {
 850         struct usb_function *f = &fu->function;
 851         struct usb_gadget *gadget = f->config->cdev->gadget;
 852         int ret;
 853
 854         fu->flags = USBG_IS_UAS;
 855
 856         if (gadget->speed == USB_SPEED_SUPER)
 857                 fu->flags |= USBG_USE_STREAMS;
 858
 859         config_ep_by_speed(gadget, f, fu->ep_in);
 860         ret = usb_ep_enable(fu->ep_in);
 861         if (ret)
 862                 goto err_b_in;
 863
 864         config_ep_by_speed(gadget, f, fu->ep_out);
 865         ret = usb_ep_enable(fu->ep_out);
 866         if (ret)
 867                 goto err_b_out;
 868
 869         config_ep_by_speed(gadget, f, fu->ep_cmd);
 870         ret = usb_ep_enable(fu->ep_cmd);
 871         if (ret)
 872                 goto err_cmd;
 873         config_ep_by_speed(gadget, f, fu->ep_status);
 874         ret = usb_ep_enable(fu->ep_status);
 875         if (ret)
 876                 goto err_status;
 877
 878         ret = uasp_prepare_reqs(fu);
 879         if (ret)
 880                 goto err_wq;
 881         fu->flags |= USBG_ENABLED;
 882
 883         pr_info("Using the UAS protocol\n");
 884         return;
 885 err_wq:
 886         usb_ep_disable(fu->ep_status);
 887 err_status:
 888         usb_ep_disable(fu->ep_cmd);
 889 err_cmd:
 890         usb_ep_disable(fu->ep_out);
 891 err_b_out:
 892         usb_ep_disable(fu->ep_in);
 893 err_b_in:
 894         fu->flags = 0;
 895 }
 896
 897 static int get_cmd_dir(const unsigned char *cdb)
 898 {
 899         int ret;
 900
 901         switch (cdb[0]) {
 902         case READ_6:
 903         case READ_10:
 904         case READ_12:
 905         case READ_16:
 906         case INQUIRY:
 907         case MODE_SENSE:
 908         case MODE_SENSE_10:
 909         case SERVICE_ACTION_IN_16:
 910         case MAINTENANCE_IN:
 911         case PERSISTENT_RESERVE_IN:
 912         case SECURITY_PROTOCOL_IN:
 913         case ACCESS_CONTROL_IN:
 914         case REPORT_LUNS:
 915         case READ_BLOCK_LIMITS:
 916         case READ_POSITION:
 917         case READ_CAPACITY:
 918         case READ_TOC:
 919         case READ_FORMAT_CAPACITIES:
 920         case REQUEST_SENSE:
 921                 ret = DMA_FROM_DEVICE;
 922                 break;
 923
 924         case WRITE_6:
 925         case WRITE_10:
 926         case WRITE_12:
 927         case WRITE_16:
 928         case MODE_SELECT:
 929         case MODE_SELECT_10:
 930         case WRITE_VERIFY:
 931         case WRITE_VERIFY_12:
 932         case PERSISTENT_RESERVE_OUT:
 933         case MAINTENANCE_OUT:
 934         case SECURITY_PROTOCOL_OUT:
 935         case ACCESS_CONTROL_OUT:
 936                 ret = DMA_TO_DEVICE;
 937                 break;
 938         case ALLOW_MEDIUM_REMOVAL:
 939         case TEST_UNIT_READY:
 940         case SYNCHRONIZE_CACHE:
 941         case START_STOP:
 942         case ERASE:
 943         case REZERO_UNIT:
 944         case SEEK_10:
 945         case SPACE:
 946         case VERIFY:
 947         case WRITE_FILEMARKS:
 948                 ret = DMA_NONE;
 949                 break;
 950         default:
 951 #define CMD_DIR_MSG "target: Unknown data direction for SCSI Opcode 0x%02x\n"
 952                 pr_warn(CMD_DIR_MSG, cdb[0]);
 953 #undef CMD_DIR_MSG
 954                 ret = -EINVAL;
 955         }
 956         return ret;
 957 }
 958
 959 static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
 960 {
 961         struct usbg_cmd *cmd = req->context;
 962         struct se_cmd *se_cmd = &cmd->se_cmd;
 963
 964         if (req->status < 0) {
 965                 pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
 966                 goto cleanup;
 967         }
 968
 969         if (req->num_sgs == 0) {
 970                 sg_copy_from_buffer(se_cmd->t_data_sg,
 971                                 se_cmd->t_data_nents,
 972                                 cmd->data_buf,
 973                                 se_cmd->data_length);
 974         }
 975
 976         complete(&cmd->write_complete);
 977         return;
 978
 979 cleanup:
 980         usbg_cleanup_cmd(cmd);
 981 }
 982
 983 static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
 984 {
 985         struct se_cmd *se_cmd = &cmd->se_cmd;
 986         struct f_uas *fu = cmd->fu;
 987         struct usb_gadget *gadget = fuas_to_gadget(fu);
 988
 989         if (!gadget->sg_supported) {
 990                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 991                 if (!cmd->data_buf)
 992                         return -ENOMEM;
 993
 994                 req->buf = cmd->data_buf;
 995         } else {
 996                 req->buf = NULL;
 997                 req->num_sgs = se_cmd->t_data_nents;
 998                 req->sg = se_cmd->t_data_sg;
 999         }
1000
1001         req->complete = usbg_data_write_cmpl;
1002         req->length = se_cmd->data_length;
1003         req->context = cmd;
1004         return 0;
1005 }
1006
1007 static int usbg_send_status_response(struct se_cmd *se_cmd)
1008 {
1009         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1010                         se_cmd);
1011         struct f_uas *fu = cmd->fu;
1012
1013         if (fu->flags & USBG_IS_BOT)
1014                 return bot_send_status_response(cmd);
1015         else
1016                 return uasp_send_status_response(cmd);
1017 }
1018
1019 static int usbg_send_write_request(struct se_cmd *se_cmd)
1020 {
1021         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1022                         se_cmd);
1023         struct f_uas *fu = cmd->fu;
1024
1025         if (fu->flags & USBG_IS_BOT)
1026                 return bot_send_write_request(cmd);
1027         else
1028                 return uasp_send_write_request(cmd);
1029 }
1030
1031 static int usbg_send_read_response(struct se_cmd *se_cmd)
1032 {
1033         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1034                         se_cmd);
1035         struct f_uas *fu = cmd->fu;
1036
1037         if (fu->flags & USBG_IS_BOT)
1038                 return bot_send_read_response(cmd);
1039         else
1040                 return uasp_send_read_response(cmd);
1041 }
1042
1043 static void usbg_cmd_work(struct work_struct *work)
1044 {
1045         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1046         struct se_cmd *se_cmd;
1047         struct tcm_usbg_nexus *tv_nexus;
1048         struct usbg_tpg *tpg;
1049         int dir;
1050
1051         se_cmd = &cmd->se_cmd;
1052         tpg = cmd->fu->tpg;
1053         tv_nexus = tpg->tpg_nexus;
1054         dir = get_cmd_dir(cmd->cmd_buf);
1055         if (dir < 0) {
1056                 transport_init_se_cmd(se_cmd,
1057                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1058                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1059                                 cmd->prio_attr, cmd->sense_iu.sense);
1060                 goto out;
1061         }
1062
1063         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1064                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1065                         0, cmd->prio_attr, dir, TARGET_SCF_UNKNOWN_SIZE) < 0)
1066                 goto out;
1067
1068         return;
1069
1070 out:
1071         transport_send_check_condition_and_sense(se_cmd,
1072                         TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1073         usbg_cleanup_cmd(cmd);
1074 }
1075
1076 static int usbg_submit_command(struct f_uas *fu,
1077                 void *cmdbuf, unsigned int len)
1078 {
1079         struct command_iu *cmd_iu = cmdbuf;
1080         struct usbg_cmd *cmd;
1081         struct usbg_tpg *tpg;
1082         struct tcm_usbg_nexus *tv_nexus;
1083         u32 cmd_len;
1084
1085         if (cmd_iu->iu_id != IU_ID_COMMAND) {
1086                 pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1087                 return -EINVAL;
1088         }
1089
1090         cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
1091         if (!cmd)
1092                 return -ENOMEM;
1093
1094         cmd->fu = fu;
1095
1096         /* XXX until I figure out why I can't free in on complete */
1097         kref_init(&cmd->ref);
1098         kref_get(&cmd->ref);
1099
1100         tpg = fu->tpg;
1101         cmd_len = (cmd_iu->len & ~0x3) + 16;
1102         if (cmd_len > USBG_MAX_CMD)
1103                 goto err;
1104
1105         memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1106
1107         cmd->tag = be16_to_cpup(&cmd_iu->tag);
1108         cmd->se_cmd.tag = cmd->tag;
1109         if (fu->flags & USBG_USE_STREAMS) {
1110                 if (cmd->tag > UASP_SS_EP_COMP_NUM_STREAMS)
1111                         goto err;
1112                 if (!cmd->tag)
1113                         cmd->stream = &fu->stream[0];
1114                 else
1115                         cmd->stream = &fu->stream[cmd->tag - 1];
1116         } else {
1117                 cmd->stream = &fu->stream[0];
1118         }
1119
1120         tv_nexus = tpg->tpg_nexus;
1121         if (!tv_nexus) {
1122                 pr_err("Missing nexus, ignoring command\n");
1123                 goto err;
1124         }
1125
1126         switch (cmd_iu->prio_attr & 0x7) {
1127         case UAS_HEAD_TAG:
1128                 cmd->prio_attr = TCM_HEAD_TAG;
1129                 break;
1130         case UAS_ORDERED_TAG:
1131                 cmd->prio_attr = TCM_ORDERED_TAG;
1132                 break;
1133         case UAS_ACA:
1134                 cmd->prio_attr = TCM_ACA_TAG;
1135                 break;
1136         default:
1137                 pr_debug_once("Unsupported prio_attr: %02x.\n",
1138                                 cmd_iu->prio_attr);
1139         case UAS_SIMPLE_TAG:
1140                 cmd->prio_attr = TCM_SIMPLE_TAG;
1141                 break;
1142         }
1143
1144         cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1145
1146         INIT_WORK(&cmd->work, usbg_cmd_work);
1147         queue_work(tpg->workqueue, &cmd->work);
1148
1149         return 0;
1150 err:
1151         kfree(cmd);
1152         return -EINVAL;
1153 }
1154
1155 static void bot_cmd_work(struct work_struct *work)
1156 {
1157         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1158         struct se_cmd *se_cmd;
1159         struct tcm_usbg_nexus *tv_nexus;
1160         struct usbg_tpg *tpg;
1161         int dir;
1162
1163         se_cmd = &cmd->se_cmd;
1164         tpg = cmd->fu->tpg;
1165         tv_nexus = tpg->tpg_nexus;
1166         dir = get_cmd_dir(cmd->cmd_buf);
1167         if (dir < 0) {
1168                 transport_init_se_cmd(se_cmd,
1169                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1170                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1171                                 cmd->prio_attr, cmd->sense_iu.sense);
1172                 goto out;
1173         }
1174
1175         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1176                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1177                         cmd->data_len, cmd->prio_attr, dir, 0) < 0)
1178                 goto out;
1179
1180         return;
1181
1182 out:
1183         transport_send_check_condition_and_sense(se_cmd,
1184                                 TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1185         usbg_cleanup_cmd(cmd);
1186 }
1187
1188 static int bot_submit_command(struct f_uas *fu,
1189                 void *cmdbuf, unsigned int len)
1190 {
1191         struct bulk_cb_wrap *cbw = cmdbuf;
1192         struct usbg_cmd *cmd;
1193         struct usbg_tpg *tpg;
1194         struct tcm_usbg_nexus *tv_nexus;
1195         u32 cmd_len;
1196
1197         if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1198                 pr_err("Wrong signature on CBW\n");
1199                 return -EINVAL;
1200         }
1201         if (len != 31) {
1202                 pr_err("Wrong length for CBW\n");
1203                 return -EINVAL;
1204         }
1205
1206         cmd_len = cbw->Length;
1207         if (cmd_len < 1 || cmd_len > 16)
1208                 return -EINVAL;
1209
1210         cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
1211         if (!cmd)
1212                 return -ENOMEM;
1213
1214         cmd->fu = fu;
1215
1216         /* XXX until I figure out why I can't free in on complete */
1217         kref_init(&cmd->ref);
1218         kref_get(&cmd->ref);
1219
1220         tpg = fu->tpg;
1221
1222         memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1223
1224         cmd->bot_tag = cbw->Tag;
1225
1226         tv_nexus = tpg->tpg_nexus;
1227         if (!tv_nexus) {
1228                 pr_err("Missing nexus, ignoring command\n");
1229                 goto err;
1230         }
1231
1232         cmd->prio_attr = TCM_SIMPLE_TAG;
1233         cmd->unpacked_lun = cbw->Lun;
1234         cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1235         cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1236         cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1237
1238         INIT_WORK(&cmd->work, bot_cmd_work);
1239         queue_work(tpg->workqueue, &cmd->work);
1240
1241         return 0;
1242 err:
1243         kfree(cmd);
1244         return -EINVAL;
1245 }
1246
1247 /* Start fabric.c code */
1248
1249 static int usbg_check_true(struct se_portal_group *se_tpg)
1250 {
1251         return 1;
1252 }
1253
1254 static int usbg_check_false(struct se_portal_group *se_tpg)
1255 {
1256         return 0;
1257 }
1258
1259 static char *usbg_get_fabric_name(void)
1260 {
1261         return "usb_gadget";
1262 }
1263
1264 static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1265 {
1266         struct usbg_tpg *tpg = container_of(se_tpg,
1267                                 struct usbg_tpg, se_tpg);
1268         struct usbg_tport *tport = tpg->tport;
1269
1270         return &tport->tport_name[0];
1271 }
1272
1273 static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1274 {
1275         struct usbg_tpg *tpg = container_of(se_tpg,
1276                                 struct usbg_tpg, se_tpg);
1277         return tpg->tport_tpgt;
1278 }
1279
1280 static u32 usbg_tpg_get_inst_index(struct se_portal_group *se_tpg)
1281 {
1282         return 1;
1283 }
1284
1285 static void usbg_cmd_release(struct kref *ref)
1286 {
1287         struct usbg_cmd *cmd = container_of(ref, struct usbg_cmd,
1288                         ref);
1289
1290         transport_generic_free_cmd(&cmd->se_cmd, 0);
1291 }
1292
1293 static void usbg_release_cmd(struct se_cmd *se_cmd)
1294 {
1295         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1296                         se_cmd);
1297         kfree(cmd->data_buf);
1298         kfree(cmd);
1299 }
1300
1301 static int usbg_shutdown_session(struct se_session *se_sess)
1302 {
1303         return 0;
1304 }
1305
1306 static void usbg_close_session(struct se_session *se_sess)
1307 {
1308 }
1309
1310 static u32 usbg_sess_get_index(struct se_session *se_sess)
1311 {
1312         return 0;
1313 }
1314
1315 /*
1316  * XXX Error recovery: return != 0 if we expect writes. Dunno when that could be
1317  */
1318 static int usbg_write_pending_status(struct se_cmd *se_cmd)
1319 {
1320         return 0;
1321 }
1322
1323 static void usbg_set_default_node_attrs(struct se_node_acl *nacl)
1324 {
1325 }
1326
1327 static int usbg_get_cmd_state(struct se_cmd *se_cmd)
1328 {
1329         return 0;
1330 }
1331
1332 static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1333 {
1334 }
1335
1336 static void usbg_aborted_task(struct se_cmd *se_cmd)
1337 {
1338 }
1339
1340 static const char *usbg_check_wwn(const char *name)
1341 {
1342         const char *n;
1343         unsigned int len;
1344
1345         n = strstr(name, "naa.");
1346         if (!n)
1347                 return NULL;
1348         n += 4;
1349         len = strlen(n);
1350         if (len == 0 || len > USBG_NAMELEN - 1)
1351                 return NULL;
1352         return n;
1353 }
1354
1355 static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1356 {
1357         if (!usbg_check_wwn(name))
1358                 return -EINVAL;
1359         return 0;
1360 }
1361
1362 static struct se_portal_group *usbg_make_tpg(
1363         struct se_wwn *wwn,
1364         struct config_group *group,
1365         const char *name)
1366 {
1367         struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1368                         tport_wwn);
1369         struct usbg_tpg *tpg;
1370         unsigned long tpgt;
1371         int ret;
1372         struct f_tcm_opts *opts;
1373         unsigned i;
1374
1375         if (strstr(name, "tpgt_") != name)
1376                 return ERR_PTR(-EINVAL);
1377         if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1378                 return ERR_PTR(-EINVAL);
1379         ret = -ENODEV;
1380         mutex_lock(&tpg_instances_lock);
1381         for (i = 0; i < TPG_INSTANCES; ++i)
1382                 if (tpg_instances[i].func_inst && !tpg_instances[i].tpg)
1383                         break;
1384         if (i == TPG_INSTANCES)
1385                 goto unlock_inst;
1386
1387         opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
1388                 func_inst);
1389         mutex_lock(&opts->dep_lock);
1390         if (!opts->ready)
1391                 goto unlock_dep;
1392
1393         if (opts->has_dep) {
1394                 if (!try_module_get(opts->dependent))
1395                         goto unlock_dep;
1396         } else {
1397                 ret = configfs_depend_item_unlocked(
1398                         group->cg_subsys,
1399                         &opts->func_inst.group.cg_item);
1400                 if (ret)
1401                         goto unlock_dep;
1402         }
1403
1404         tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1405         ret = -ENOMEM;
1406         if (!tpg)
1407                 goto unref_dep;
1408         mutex_init(&tpg->tpg_mutex);
1409         atomic_set(&tpg->tpg_port_count, 0);
1410         tpg->workqueue = alloc_workqueue("tcm_usb_gadget", 0, 1);
1411         if (!tpg->workqueue)
1412                 goto free_tpg;
1413
1414         tpg->tport = tport;
1415         tpg->tport_tpgt = tpgt;
1416
1417         /*
1418          * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1419          * pretend to be SAS..
1420          */
1421         ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1422         if (ret < 0)
1423                 goto free_workqueue;
1424
1425         tpg_instances[i].tpg = tpg;
1426         tpg->fi = tpg_instances[i].func_inst;
1427         mutex_unlock(&opts->dep_lock);
1428         mutex_unlock(&tpg_instances_lock);
1429         return &tpg->se_tpg;
1430
1431 free_workqueue:
1432         destroy_workqueue(tpg->workqueue);
1433 free_tpg:
1434         kfree(tpg);
1435 unref_dep:
1436         if (opts->has_dep)
1437                 module_put(opts->dependent);
1438         else
1439                 configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1440 unlock_dep:
1441         mutex_unlock(&opts->dep_lock);
1442 unlock_inst:
1443         mutex_unlock(&tpg_instances_lock);
1444
1445         return ERR_PTR(ret);
1446 }
1447
1448 static int tcm_usbg_drop_nexus(struct usbg_tpg *);
1449
1450 static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1451 {
1452         struct usbg_tpg *tpg = container_of(se_tpg,
1453                                 struct usbg_tpg, se_tpg);
1454         unsigned i;
1455         struct f_tcm_opts *opts;
1456
1457         tcm_usbg_drop_nexus(tpg);
1458         core_tpg_deregister(se_tpg);
1459         destroy_workqueue(tpg->workqueue);
1460
1461         mutex_lock(&tpg_instances_lock);
1462         for (i = 0; i < TPG_INSTANCES; ++i)
1463                 if (tpg_instances[i].tpg == tpg)
1464                         break;
1465         if (i < TPG_INSTANCES)
1466                 tpg_instances[i].tpg = NULL;
1467         opts = container_of(tpg_instances[i].func_inst,
1468                 struct f_tcm_opts, func_inst);
1469         mutex_lock(&opts->dep_lock);
1470         if (opts->has_dep)
1471                 module_put(opts->dependent);
1472         else
1473                 configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1474         mutex_unlock(&opts->dep_lock);
1475         mutex_unlock(&tpg_instances_lock);
1476
1477         kfree(tpg);
1478 }
1479
1480 static struct se_wwn *usbg_make_tport(
1481         struct target_fabric_configfs *tf,
1482         struct config_group *group,
1483         const char *name)
1484 {
1485         struct usbg_tport *tport;
1486         const char *wnn_name;
1487         u64 wwpn = 0;
1488
1489         wnn_name = usbg_check_wwn(name);
1490         if (!wnn_name)
1491                 return ERR_PTR(-EINVAL);
1492
1493         tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1494         if (!(tport))
1495                 return ERR_PTR(-ENOMEM);
1496
1497         tport->tport_wwpn = wwpn;
1498         snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1499         return &tport->tport_wwn;
1500 }
1501
1502 static void usbg_drop_tport(struct se_wwn *wwn)
1503 {
1504         struct usbg_tport *tport = container_of(wwn,
1505                                 struct usbg_tport, tport_wwn);
1506         kfree(tport);
1507 }
1508
1509 /*
1510  * If somebody feels like dropping the version property, go ahead.
1511  */
1512 static ssize_t usbg_wwn_version_show(struct config_item *item,  char *page)
1513 {
1514         return sprintf(page, "usb-gadget fabric module\n");
1515 }
1516
1517 CONFIGFS_ATTR_RO(usbg_wwn_, version);
1518
1519 static struct configfs_attribute *usbg_wwn_attrs[] = {
1520         &usbg_wwn_attr_version,
1521         NULL,
1522 };
1523
1524 static ssize_t tcm_usbg_tpg_enable_show(struct config_item *item, char *page)
1525 {
1526         struct se_portal_group *se_tpg = to_tpg(item);
1527         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1528
1529         return snprintf(page, PAGE_SIZE, "%u\n", tpg->gadget_connect);
1530 }
1531
1532 static int usbg_attach(struct usbg_tpg *);
1533 static void usbg_detach(struct usbg_tpg *);
1534
1535 static ssize_t tcm_usbg_tpg_enable_store(struct config_item *item,
1536                 const char *page, size_t count)
1537 {
1538         struct se_portal_group *se_tpg = to_tpg(item);
1539         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1540         bool op;
1541         ssize_t ret;
1542
1543         ret = strtobool(page, &op);
1544         if (ret)
1545                 return ret;
1546
1547         if ((op && tpg->gadget_connect) || (!op && !tpg->gadget_connect))
1548                 return -EINVAL;
1549
1550         if (op)
1551                 ret = usbg_attach(tpg);
1552         else
1553                 usbg_detach(tpg);
1554         if (ret)
1555                 return ret;
1556
1557         tpg->gadget_connect = op;
1558
1559         return count;
1560 }
1561
1562 static ssize_t tcm_usbg_tpg_nexus_show(struct config_item *item, char *page)
1563 {
1564         struct se_portal_group *se_tpg = to_tpg(item);
1565         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1566         struct tcm_usbg_nexus *tv_nexus;
1567         ssize_t ret;
1568
1569         mutex_lock(&tpg->tpg_mutex);
1570         tv_nexus = tpg->tpg_nexus;
1571         if (!tv_nexus) {
1572                 ret = -ENODEV;
1573                 goto out;
1574         }
1575         ret = snprintf(page, PAGE_SIZE, "%s\n",
1576                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1577 out:
1578         mutex_unlock(&tpg->tpg_mutex);
1579         return ret;
1580 }
1581
1582 static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1583 {
1584         struct se_portal_group *se_tpg;
1585         struct tcm_usbg_nexus *tv_nexus;
1586         int ret;
1587
1588         mutex_lock(&tpg->tpg_mutex);
1589         if (tpg->tpg_nexus) {
1590                 ret = -EEXIST;
1591                 pr_debug("tpg->tpg_nexus already exists\n");
1592                 goto err_unlock;
1593         }
1594         se_tpg = &tpg->se_tpg;
1595
1596         ret = -ENOMEM;
1597         tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1598         if (!tv_nexus)
1599                 goto err_unlock;
1600         tv_nexus->tvn_se_sess = transport_init_session(TARGET_PROT_NORMAL);
1601         if (IS_ERR(tv_nexus->tvn_se_sess))
1602                 goto err_free;
1603
1604         /*
1605          * Since we are running in 'demo mode' this call with generate a
1606          * struct se_node_acl for the tcm_vhost struct se_portal_group with
1607          * the SCSI Initiator port name of the passed configfs group 'name'.
1608          */
1609         tv_nexus->tvn_se_sess->se_node_acl = core_tpg_check_initiator_node_acl(
1610                         se_tpg, name);
1611         if (!tv_nexus->tvn_se_sess->se_node_acl) {
1612 #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
1613                 pr_debug(MAKE_NEXUS_MSG, name);
1614 #undef MAKE_NEXUS_MSG
1615                 goto err_session;
1616         }
1617         /*
1618          * Now register the TCM vHost virtual I_T Nexus as active.
1619          */
1620         transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
1621                         tv_nexus->tvn_se_sess, tv_nexus);
1622         tpg->tpg_nexus = tv_nexus;
1623         mutex_unlock(&tpg->tpg_mutex);
1624         return 0;
1625
1626 err_session:
1627         transport_free_session(tv_nexus->tvn_se_sess);
1628 err_free:
1629         kfree(tv_nexus);
1630 err_unlock:
1631         mutex_unlock(&tpg->tpg_mutex);
1632         return ret;
1633 }
1634
1635 static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1636 {
1637         struct se_session *se_sess;
1638         struct tcm_usbg_nexus *tv_nexus;
1639         int ret = -ENODEV;
1640
1641         mutex_lock(&tpg->tpg_mutex);
1642         tv_nexus = tpg->tpg_nexus;
1643         if (!tv_nexus)
1644                 goto out;
1645
1646         se_sess = tv_nexus->tvn_se_sess;
1647         if (!se_sess)
1648                 goto out;
1649
1650         if (atomic_read(&tpg->tpg_port_count)) {
1651                 ret = -EPERM;
1652 #define MSG "Unable to remove Host I_T Nexus with active TPG port count: %d\n"
1653                 pr_err(MSG, atomic_read(&tpg->tpg_port_count));
1654 #undef MSG
1655                 goto out;
1656         }
1657
1658         pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1659                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1660         /*
1661          * Release the SCSI I_T Nexus to the emulated vHost Target Port
1662          */
1663         transport_deregister_session(tv_nexus->tvn_se_sess);
1664         tpg->tpg_nexus = NULL;
1665
1666         kfree(tv_nexus);
1667         ret = 0;
1668 out:
1669         mutex_unlock(&tpg->tpg_mutex);
1670         return ret;
1671 }
1672
1673 static ssize_t tcm_usbg_tpg_nexus_store(struct config_item *item,
1674                 const char *page, size_t count)
1675 {
1676         struct se_portal_group *se_tpg = to_tpg(item);
1677         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1678         unsigned char i_port[USBG_NAMELEN], *ptr;
1679         int ret;
1680
1681         if (!strncmp(page, "NULL", 4)) {
1682                 ret = tcm_usbg_drop_nexus(tpg);
1683                 return (!ret) ? count : ret;
1684         }
1685         if (strlen(page) >= USBG_NAMELEN) {
1686
1687 #define NEXUS_STORE_MSG "Emulated NAA Sas Address: %s, exceeds max: %d\n"
1688                 pr_err(NEXUS_STORE_MSG, page, USBG_NAMELEN);
1689 #undef NEXUS_STORE_MSG
1690                 return -EINVAL;
1691         }
1692         snprintf(i_port, USBG_NAMELEN, "%s", page);
1693
1694         ptr = strstr(i_port, "naa.");
1695         if (!ptr) {
1696                 pr_err("Missing 'naa.' prefix\n");
1697                 return -EINVAL;
1698         }
1699
1700         if (i_port[strlen(i_port) - 1] == '\n')
1701                 i_port[strlen(i_port) - 1] = '\0';
1702
1703         ret = tcm_usbg_make_nexus(tpg, &i_port[0]);
1704         if (ret < 0)
1705                 return ret;
1706         return count;
1707 }
1708
1709 CONFIGFS_ATTR(tcm_usbg_tpg_, enable);
1710 CONFIGFS_ATTR(tcm_usbg_tpg_, nexus);
1711
1712 static struct configfs_attribute *usbg_base_attrs[] = {
1713         &tcm_usbg_tpg_attr_enable,
1714         &tcm_usbg_tpg_attr_nexus,
1715         NULL,
1716 };
1717
1718 static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1719 {
1720         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1721
1722         atomic_inc(&tpg->tpg_port_count);
1723         smp_mb__after_atomic();
1724         return 0;
1725 }
1726
1727 static void usbg_port_unlink(struct se_portal_group *se_tpg,
1728                 struct se_lun *se_lun)
1729 {
1730         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1731
1732         atomic_dec(&tpg->tpg_port_count);
1733         smp_mb__after_atomic();
1734 }
1735
1736 static int usbg_check_stop_free(struct se_cmd *se_cmd)
1737 {
1738         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1739                         se_cmd);
1740
1741         kref_put(&cmd->ref, usbg_cmd_release);
1742         return 1;
1743 }
1744
1745 static const struct target_core_fabric_ops usbg_ops = {
1746         .module                         = THIS_MODULE,
1747         .name                           = "usb_gadget",
1748         .get_fabric_name                = usbg_get_fabric_name,
1749         .tpg_get_wwn                    = usbg_get_fabric_wwn,
1750         .tpg_get_tag                    = usbg_get_tag,
1751         .tpg_check_demo_mode            = usbg_check_true,
1752         .tpg_check_demo_mode_cache      = usbg_check_false,
1753         .tpg_check_demo_mode_write_protect = usbg_check_false,
1754         .tpg_check_prod_mode_write_protect = usbg_check_false,
1755         .tpg_get_inst_index             = usbg_tpg_get_inst_index,
1756         .release_cmd                    = usbg_release_cmd,
1757         .shutdown_session               = usbg_shutdown_session,
1758         .close_session                  = usbg_close_session,
1759         .sess_get_index                 = usbg_sess_get_index,
1760         .sess_get_initiator_sid         = NULL,
1761         .write_pending                  = usbg_send_write_request,
1762         .write_pending_status           = usbg_write_pending_status,
1763         .set_default_node_attributes    = usbg_set_default_node_attrs,
1764         .get_cmd_state                  = usbg_get_cmd_state,
1765         .queue_data_in                  = usbg_send_read_response,
1766         .queue_status                   = usbg_send_status_response,
1767         .queue_tm_rsp                   = usbg_queue_tm_rsp,
1768         .aborted_task                   = usbg_aborted_task,
1769         .check_stop_free                = usbg_check_stop_free,
1770
1771         .fabric_make_wwn                = usbg_make_tport,
1772         .fabric_drop_wwn                = usbg_drop_tport,
1773         .fabric_make_tpg                = usbg_make_tpg,
1774         .fabric_drop_tpg                = usbg_drop_tpg,
1775         .fabric_post_link               = usbg_port_link,
1776         .fabric_pre_unlink              = usbg_port_unlink,
1777         .fabric_init_nodeacl            = usbg_init_nodeacl,
1778
1779         .tfc_wwn_attrs                  = usbg_wwn_attrs,
1780         .tfc_tpg_base_attrs             = usbg_base_attrs,
1781 };
1782
1783 /* Start gadget.c code */
1784
1785 static struct usb_interface_descriptor bot_intf_desc = {
1786         .bLength =              sizeof(bot_intf_desc),
1787         .bDescriptorType =      USB_DT_INTERFACE,
1788         .bNumEndpoints =        2,
1789         .bAlternateSetting =    USB_G_ALT_INT_BBB,
1790         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1791         .bInterfaceSubClass =   USB_SC_SCSI,
1792         .bInterfaceProtocol =   USB_PR_BULK,
1793 };
1794
1795 static struct usb_interface_descriptor uasp_intf_desc = {
1796         .bLength =              sizeof(uasp_intf_desc),
1797         .bDescriptorType =      USB_DT_INTERFACE,
1798         .bNumEndpoints =        4,
1799         .bAlternateSetting =    USB_G_ALT_INT_UAS,
1800         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1801         .bInterfaceSubClass =   USB_SC_SCSI,
1802         .bInterfaceProtocol =   USB_PR_UAS,
1803 };
1804
1805 static struct usb_endpoint_descriptor uasp_bi_desc = {
1806         .bLength =              USB_DT_ENDPOINT_SIZE,
1807         .bDescriptorType =      USB_DT_ENDPOINT,
1808         .bEndpointAddress =     USB_DIR_IN,
1809         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1810         .wMaxPacketSize =       cpu_to_le16(512),
1811 };
1812
1813 static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1814         .bLength =              USB_DT_ENDPOINT_SIZE,
1815         .bDescriptorType =      USB_DT_ENDPOINT,
1816         .bEndpointAddress =     USB_DIR_IN,
1817         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1818 };
1819
1820 static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1821         .bLength =              sizeof(uasp_bi_pipe_desc),
1822         .bDescriptorType =      USB_DT_PIPE_USAGE,
1823         .bPipeID =              DATA_IN_PIPE_ID,
1824 };
1825
1826 static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1827         .bLength =              USB_DT_ENDPOINT_SIZE,
1828         .bDescriptorType =      USB_DT_ENDPOINT,
1829         .bEndpointAddress =     USB_DIR_IN,
1830         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1831         .wMaxPacketSize =       cpu_to_le16(1024),
1832 };
1833
1834 static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1835         .bLength =              sizeof(uasp_bi_ep_comp_desc),
1836         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1837         .bMaxBurst =            0,
1838         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1839         .wBytesPerInterval =    0,
1840 };
1841
1842 static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1843         .bLength =              sizeof(bot_bi_ep_comp_desc),
1844         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1845         .bMaxBurst =            0,
1846 };
1847
1848 static struct usb_endpoint_descriptor uasp_bo_desc = {
1849         .bLength =              USB_DT_ENDPOINT_SIZE,
1850         .bDescriptorType =      USB_DT_ENDPOINT,
1851         .bEndpointAddress =     USB_DIR_OUT,
1852         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1853         .wMaxPacketSize =       cpu_to_le16(512),
1854 };
1855
1856 static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1857         .bLength =              USB_DT_ENDPOINT_SIZE,
1858         .bDescriptorType =      USB_DT_ENDPOINT,
1859         .bEndpointAddress =     USB_DIR_OUT,
1860         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1861 };
1862
1863 static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1864         .bLength =              sizeof(uasp_bo_pipe_desc),
1865         .bDescriptorType =      USB_DT_PIPE_USAGE,
1866         .bPipeID =              DATA_OUT_PIPE_ID,
1867 };
1868
1869 static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1870         .bLength =              USB_DT_ENDPOINT_SIZE,
1871         .bDescriptorType =      USB_DT_ENDPOINT,
1872         .bEndpointAddress =     USB_DIR_OUT,
1873         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1874         .wMaxPacketSize =       cpu_to_le16(0x400),
1875 };
1876
1877 static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1878         .bLength =              sizeof(uasp_bo_ep_comp_desc),
1879         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1880         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1881 };
1882
1883 static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1884         .bLength =              sizeof(bot_bo_ep_comp_desc),
1885         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1886 };
1887
1888 static struct usb_endpoint_descriptor uasp_status_desc = {
1889         .bLength =              USB_DT_ENDPOINT_SIZE,
1890         .bDescriptorType =      USB_DT_ENDPOINT,
1891         .bEndpointAddress =     USB_DIR_IN,
1892         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1893         .wMaxPacketSize =       cpu_to_le16(512),
1894 };
1895
1896 static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1897         .bLength =              USB_DT_ENDPOINT_SIZE,
1898         .bDescriptorType =      USB_DT_ENDPOINT,
1899         .bEndpointAddress =     USB_DIR_IN,
1900         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1901 };
1902
1903 static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1904         .bLength =              sizeof(uasp_status_pipe_desc),
1905         .bDescriptorType =      USB_DT_PIPE_USAGE,
1906         .bPipeID =              STATUS_PIPE_ID,
1907 };
1908
1909 static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1910         .bLength =              USB_DT_ENDPOINT_SIZE,
1911         .bDescriptorType =      USB_DT_ENDPOINT,
1912         .bEndpointAddress =     USB_DIR_IN,
1913         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1914         .wMaxPacketSize =       cpu_to_le16(1024),
1915 };
1916
1917 static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1918         .bLength =              sizeof(uasp_status_in_ep_comp_desc),
1919         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1920         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1921 };
1922
1923 static struct usb_endpoint_descriptor uasp_cmd_desc = {
1924         .bLength =              USB_DT_ENDPOINT_SIZE,
1925         .bDescriptorType =      USB_DT_ENDPOINT,
1926         .bEndpointAddress =     USB_DIR_OUT,
1927         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1928         .wMaxPacketSize =       cpu_to_le16(512),
1929 };
1930
1931 static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1932         .bLength =              USB_DT_ENDPOINT_SIZE,
1933         .bDescriptorType =      USB_DT_ENDPOINT,
1934         .bEndpointAddress =     USB_DIR_OUT,
1935         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1936 };
1937
1938 static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1939         .bLength =              sizeof(uasp_cmd_pipe_desc),
1940         .bDescriptorType =      USB_DT_PIPE_USAGE,
1941         .bPipeID =              CMD_PIPE_ID,
1942 };
1943
1944 static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1945         .bLength =              USB_DT_ENDPOINT_SIZE,
1946         .bDescriptorType =      USB_DT_ENDPOINT,
1947         .bEndpointAddress =     USB_DIR_OUT,
1948         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1949         .wMaxPacketSize =       cpu_to_le16(1024),
1950 };
1951
1952 static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1953         .bLength =              sizeof(uasp_cmd_comp_desc),
1954         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1955 };
1956
1957 static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1958         (struct usb_descriptor_header *) &bot_intf_desc,
1959         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1960         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1961
1962         (struct usb_descriptor_header *) &uasp_intf_desc,
1963         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1964         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1965         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1966         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1967         (struct usb_descriptor_header *) &uasp_fs_status_desc,
1968         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1969         (struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1970         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1971         NULL,
1972 };
1973
1974 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1975         (struct usb_descriptor_header *) &bot_intf_desc,
1976         (struct usb_descriptor_header *) &uasp_bi_desc,
1977         (struct usb_descriptor_header *) &uasp_bo_desc,
1978
1979         (struct usb_descriptor_header *) &uasp_intf_desc,
1980         (struct usb_descriptor_header *) &uasp_bi_desc,
1981         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1982         (struct usb_descriptor_header *) &uasp_bo_desc,
1983         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1984         (struct usb_descriptor_header *) &uasp_status_desc,
1985         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1986         (struct usb_descriptor_header *) &uasp_cmd_desc,
1987         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1988         NULL,
1989 };
1990
1991 static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1992         (struct usb_descriptor_header *) &bot_intf_desc,
1993         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
1994         (struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1995         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
1996         (struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1997
1998         (struct usb_descriptor_header *) &uasp_intf_desc,
1999         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
2000         (struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
2001         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
2002         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
2003         (struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
2004         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
2005         (struct usb_descriptor_header *) &uasp_ss_status_desc,
2006         (struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
2007         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
2008         (struct usb_descriptor_header *) &uasp_ss_cmd_desc,
2009         (struct usb_descriptor_header *) &uasp_cmd_comp_desc,
2010         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
2011         NULL,
2012 };
2013
2014 static struct usb_string        tcm_us_strings[] = {
2015         [USB_G_STR_INT_UAS].s           = "USB Attached SCSI",
2016         [USB_G_STR_INT_BBB].s           = "Bulk Only Transport",
2017         { },
2018 };
2019
2020 static struct usb_gadget_strings tcm_stringtab = {
2021         .language = 0x0409,
2022         .strings = tcm_us_strings,
2023 };
2024
2025 static struct usb_gadget_strings *tcm_strings[] = {
2026         &tcm_stringtab,
2027         NULL,
2028 };
2029
2030 static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
2031 {
2032         struct f_uas            *fu = to_f_uas(f);
2033         struct usb_string       *us;
2034         struct usb_gadget       *gadget = c->cdev->gadget;
2035         struct usb_ep           *ep;
2036         struct f_tcm_opts       *opts;
2037         int                     iface;
2038         int                     ret;
2039
2040         opts = container_of(f->fi, struct f_tcm_opts, func_inst);
2041
2042         mutex_lock(&opts->dep_lock);
2043         if (!opts->can_attach) {
2044                 mutex_unlock(&opts->dep_lock);
2045                 return -ENODEV;
2046         }
2047         mutex_unlock(&opts->dep_lock);
2048         us = usb_gstrings_attach(c->cdev, tcm_strings,
2049                 ARRAY_SIZE(tcm_us_strings));
2050         if (IS_ERR(us))
2051                 return PTR_ERR(us);
2052         bot_intf_desc.iInterface = us[USB_G_STR_INT_BBB].id;
2053         uasp_intf_desc.iInterface = us[USB_G_STR_INT_UAS].id;
2054
2055         iface = usb_interface_id(c, f);
2056         if (iface < 0)
2057                 return iface;
2058
2059         bot_intf_desc.bInterfaceNumber = iface;
2060         uasp_intf_desc.bInterfaceNumber = iface;
2061         fu->iface = iface;
2062         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc,
2063                         &uasp_bi_ep_comp_desc);
2064         if (!ep)
2065                 goto ep_fail;
2066
2067         fu->ep_in = ep;
2068
2069         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc,
2070                         &uasp_bo_ep_comp_desc);
2071         if (!ep)
2072                 goto ep_fail;
2073         fu->ep_out = ep;
2074
2075         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc,
2076                         &uasp_status_in_ep_comp_desc);
2077         if (!ep)
2078                 goto ep_fail;
2079         fu->ep_status = ep;
2080
2081         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc,
2082                         &uasp_cmd_comp_desc);
2083         if (!ep)
2084                 goto ep_fail;
2085         fu->ep_cmd = ep;
2086
2087         /* Assume endpoint addresses are the same for both speeds */
2088         uasp_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2089         uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2090         uasp_status_desc.bEndpointAddress =
2091                 uasp_ss_status_desc.bEndpointAddress;
2092         uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2093
2094         uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2095         uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2096         uasp_fs_status_desc.bEndpointAddress =
2097                 uasp_ss_status_desc.bEndpointAddress;
2098         uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2099
2100         ret = usb_assign_descriptors(f, uasp_fs_function_desc,
2101                         uasp_hs_function_desc, uasp_ss_function_desc);
2102         if (ret)
2103                 goto ep_fail;
2104
2105         return 0;
2106 ep_fail:
2107         pr_err("Can't claim all required eps\n");
2108
2109         return -ENOTSUPP;
2110 }
2111
2112 struct guas_setup_wq {
2113         struct work_struct work;
2114         struct f_uas *fu;
2115         unsigned int alt;
2116 };
2117
2118 static void tcm_delayed_set_alt(struct work_struct *wq)
2119 {
2120         struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
2121                         work);
2122         struct f_uas *fu = work->fu;
2123         int alt = work->alt;
2124
2125         kfree(work);
2126
2127         if (fu->flags & USBG_IS_BOT)
2128                 bot_cleanup_old_alt(fu);
2129         if (fu->flags & USBG_IS_UAS)
2130                 uasp_cleanup_old_alt(fu);
2131
2132         if (alt == USB_G_ALT_INT_BBB)
2133                 bot_set_alt(fu);
2134         else if (alt == USB_G_ALT_INT_UAS)
2135                 uasp_set_alt(fu);
2136         usb_composite_setup_continue(fu->function.config->cdev);
2137 }
2138
2139 static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2140 {
2141         struct f_uas *fu = to_f_uas(f);
2142
2143         if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2144                 struct guas_setup_wq *work;
2145
2146                 work = kmalloc(sizeof(*work), GFP_ATOMIC);
2147                 if (!work)
2148                         return -ENOMEM;
2149                 INIT_WORK(&work->work, tcm_delayed_set_alt);
2150                 work->fu = fu;
2151                 work->alt = alt;
2152                 schedule_work(&work->work);
2153                 return USB_GADGET_DELAYED_STATUS;
2154         }
2155         return -EOPNOTSUPP;
2156 }
2157
2158 static void tcm_disable(struct usb_function *f)
2159 {
2160         struct f_uas *fu = to_f_uas(f);
2161
2162         if (fu->flags & USBG_IS_UAS)
2163                 uasp_cleanup_old_alt(fu);
2164         else if (fu->flags & USBG_IS_BOT)
2165                 bot_cleanup_old_alt(fu);
2166         fu->flags = 0;
2167 }
2168
2169 static int tcm_setup(struct usb_function *f,
2170                 const struct usb_ctrlrequest *ctrl)
2171 {
2172         struct f_uas *fu = to_f_uas(f);
2173
2174         if (!(fu->flags & USBG_IS_BOT))
2175                 return -EOPNOTSUPP;
2176
2177         return usbg_bot_setup(f, ctrl);
2178 }
2179
2180 static inline struct f_tcm_opts *to_f_tcm_opts(struct config_item *item)
2181 {
2182         return container_of(to_config_group(item), struct f_tcm_opts,
2183                 func_inst.group);
2184 }
2185
2186 static void tcm_attr_release(struct config_item *item)
2187 {
2188         struct f_tcm_opts *opts = to_f_tcm_opts(item);
2189
2190         usb_put_function_instance(&opts->func_inst);
2191 }
2192
2193 static struct configfs_item_operations tcm_item_ops = {
2194         .release                = tcm_attr_release,
2195 };
2196
2197 static struct config_item_type tcm_func_type = {
2198         .ct_item_ops    = &tcm_item_ops,
2199         .ct_owner       = THIS_MODULE,
2200 };
2201
2202 static void tcm_free_inst(struct usb_function_instance *f)
2203 {
2204         struct f_tcm_opts *opts;
2205         unsigned i;
2206
2207         opts = container_of(f, struct f_tcm_opts, func_inst);
2208
2209         mutex_lock(&tpg_instances_lock);
2210         for (i = 0; i < TPG_INSTANCES; ++i)
2211                 if (tpg_instances[i].func_inst == f)
2212                         break;
2213         if (i < TPG_INSTANCES)
2214                 tpg_instances[i].func_inst = NULL;
2215         mutex_unlock(&tpg_instances_lock);
2216
2217         kfree(opts);
2218 }
2219
2220 static int tcm_register_callback(struct usb_function_instance *f)
2221 {
2222         struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2223
2224         mutex_lock(&opts->dep_lock);
2225         opts->can_attach = true;
2226         mutex_unlock(&opts->dep_lock);
2227
2228         return 0;
2229 }
2230
2231 static void tcm_unregister_callback(struct usb_function_instance *f)
2232 {
2233         struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2234
2235         mutex_lock(&opts->dep_lock);
2236         unregister_gadget_item(opts->
2237                 func_inst.group.cg_item.ci_parent->ci_parent);
2238         opts->can_attach = false;
2239         mutex_unlock(&opts->dep_lock);
2240 }
2241
2242 static int usbg_attach(struct usbg_tpg *tpg)
2243 {
2244         struct usb_function_instance *f = tpg->fi;
2245         struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2246
2247         if (opts->tcm_register_callback)
2248                 return opts->tcm_register_callback(f);
2249
2250         return 0;
2251 }
2252
2253 static void usbg_detach(struct usbg_tpg *tpg)
2254 {
2255         struct usb_function_instance *f = tpg->fi;
2256         struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2257
2258         if (opts->tcm_unregister_callback)
2259                 opts->tcm_unregister_callback(f);
2260 }
2261
2262 static int tcm_set_name(struct usb_function_instance *f, const char *name)
2263 {
2264         struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2265
2266         pr_debug("tcm: Activating %s\n", name);
2267
2268         mutex_lock(&opts->dep_lock);
2269         opts->ready = true;
2270         mutex_unlock(&opts->dep_lock);
2271
2272         return 0;
2273 }
2274
2275 static struct usb_function_instance *tcm_alloc_inst(void)
2276 {
2277         struct f_tcm_opts *opts;
2278         int i;
2279
2280
2281         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2282         if (!opts)
2283                 return ERR_PTR(-ENOMEM);
2284
2285         mutex_lock(&tpg_instances_lock);
2286         for (i = 0; i < TPG_INSTANCES; ++i)
2287                 if (!tpg_instances[i].func_inst)
2288                         break;
2289
2290         if (i == TPG_INSTANCES) {
2291                 mutex_unlock(&tpg_instances_lock);
2292                 kfree(opts);
2293                 return ERR_PTR(-EBUSY);
2294         }
2295         tpg_instances[i].func_inst = &opts->func_inst;
2296         mutex_unlock(&tpg_instances_lock);
2297
2298         mutex_init(&opts->dep_lock);
2299         opts->func_inst.set_inst_name = tcm_set_name;
2300         opts->func_inst.free_func_inst = tcm_free_inst;
2301         opts->tcm_register_callback = tcm_register_callback;
2302         opts->tcm_unregister_callback = tcm_unregister_callback;
2303
2304         config_group_init_type_name(&opts->func_inst.group, "",
2305                         &tcm_func_type);
2306
2307         return &opts->func_inst;
2308 }
2309
2310 static void tcm_free(struct usb_function *f)
2311 {
2312         struct f_uas *tcm = to_f_uas(f);
2313
2314         kfree(tcm);
2315 }
2316
2317 static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
2318 {
2319         usb_free_all_descriptors(f);
2320 }
2321
2322 static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
2323 {
2324         struct f_uas *fu;
2325         unsigned i;
2326
2327         mutex_lock(&tpg_instances_lock);
2328         for (i = 0; i < TPG_INSTANCES; ++i)
2329                 if (tpg_instances[i].func_inst == fi)
2330                         break;
2331         if (i == TPG_INSTANCES) {
2332                 mutex_unlock(&tpg_instances_lock);
2333                 return ERR_PTR(-ENODEV);
2334         }
2335
2336         fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2337         if (!fu) {
2338                 mutex_unlock(&tpg_instances_lock);
2339                 return ERR_PTR(-ENOMEM);
2340         }
2341
2342         fu->function.name = "Target Function";
2343         fu->function.bind = tcm_bind;
2344         fu->function.unbind = tcm_unbind;
2345         fu->function.set_alt = tcm_set_alt;
2346         fu->function.setup = tcm_setup;
2347         fu->function.disable = tcm_disable;
2348         fu->function.free_func = tcm_free;
2349         fu->tpg = tpg_instances[i].tpg;
2350         mutex_unlock(&tpg_instances_lock);
2351
2352         return &fu->function;
2353 }
2354
2355 DECLARE_USB_FUNCTION(tcm, tcm_alloc_inst, tcm_alloc);
2356
2357 static int tcm_init(void)
2358 {
2359         int ret;
2360
2361         ret = usb_function_register(&tcmusb_func);
2362         if (ret)
2363                 return ret;
2364
2365         ret = target_register_template(&usbg_ops);
2366         if (ret)
2367                 usb_function_unregister(&tcmusb_func);
2368
2369         return ret;
2370 }
2371 module_init(tcm_init);
2372
2373 static void tcm_exit(void)
2374 {
2375         target_unregister_template(&usbg_ops);
2376         usb_function_unregister(&tcmusb_func);
2377 }
2378 module_exit(tcm_exit);
2379
2380 MODULE_LICENSE("GPL");
2381 MODULE_AUTHOR("Sebastian Andrzej Siewior");