drivers/usb/gadget/legacy/tcm_usb_gadget.c

   1 /* Target based USB-Gadget
   2  *
   3  * UAS protocol handling, target callbacks, configfs handling,
   4  * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
   5  *
   6  * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
   7  * License: GPLv2 as published by FSF.
   8  */
   9 #include <linux/kernel.h>
  10 #include <linux/module.h>
  11 #include <linux/types.h>
  12 #include <linux/string.h>
  13 #include <linux/configfs.h>
  14 #include <linux/ctype.h>
  15 #include <linux/usb/ch9.h>
  16 #include <linux/usb/composite.h>
  17 #include <linux/usb/gadget.h>
  18 #include <linux/usb/storage.h>
  19 #include <scsi/scsi.h>
  20 #include <scsi/scsi_tcq.h>
  21 #include <target/target_core_base.h>
  22 #include <target/target_core_fabric.h>
  23 #include <target/target_core_fabric_configfs.h>
  24 #include <target/configfs_macros.h>
  25 #include <asm/unaligned.h>
  26
  27 #include "tcm_usb_gadget.h"
  28
  29 USB_GADGET_COMPOSITE_OPTIONS();
  30
  31 static const struct target_core_fabric_ops usbg_ops;
  32
  33 static inline struct f_uas *to_f_uas(struct usb_function *f)
  34 {
  35         return container_of(f, struct f_uas, function);
  36 }
  37
  38 static void usbg_cmd_release(struct kref *);
  39
  40 static inline void usbg_cleanup_cmd(struct usbg_cmd *cmd)
  41 {
  42         kref_put(&cmd->ref, usbg_cmd_release);
  43 }
  44
  45 /* Start bot.c code */
  46
  47 static int bot_enqueue_cmd_cbw(struct f_uas *fu)
  48 {
  49         int ret;
  50
  51         if (fu->flags & USBG_BOT_CMD_PEND)
  52                 return 0;
  53
  54         ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
  55         if (!ret)
  56                 fu->flags |= USBG_BOT_CMD_PEND;
  57         return ret;
  58 }
  59
  60 static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
  61 {
  62         struct usbg_cmd *cmd = req->context;
  63         struct f_uas *fu = cmd->fu;
  64
  65         usbg_cleanup_cmd(cmd);
  66         if (req->status < 0) {
  67                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
  68                 return;
  69         }
  70
  71         /* CSW completed, wait for next CBW */
  72         bot_enqueue_cmd_cbw(fu);
  73 }
  74
  75 static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
  76 {
  77         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
  78         int ret;
  79         u8 *sense;
  80         unsigned int csw_stat;
  81
  82         csw_stat = cmd->csw_code;
  83
  84         /*
  85          * We can't send SENSE as a response. So we take ASC & ASCQ from our
  86          * sense buffer and queue it and hope the host sends a REQUEST_SENSE
  87          * command where it learns why we failed.
  88          */
  89         sense = cmd->sense_iu.sense;
  90
  91         csw->Tag = cmd->bot_tag;
  92         csw->Status = csw_stat;
  93         fu->bot_status.req->context = cmd;
  94         ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
  95         if (ret)
  96                 pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
  97 }
  98
  99 static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
 100 {
 101         struct usbg_cmd *cmd = req->context;
 102         struct f_uas *fu = cmd->fu;
 103
 104         if (req->status < 0)
 105                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 106
 107         if (cmd->data_len) {
 108                 if (cmd->data_len > ep->maxpacket) {
 109                         req->length = ep->maxpacket;
 110                         cmd->data_len -= ep->maxpacket;
 111                 } else {
 112                         req->length = cmd->data_len;
 113                         cmd->data_len = 0;
 114                 }
 115
 116                 usb_ep_queue(ep, req, GFP_ATOMIC);
 117                 return ;
 118         }
 119         bot_enqueue_sense_code(fu, cmd);
 120 }
 121
 122 static void bot_send_bad_status(struct usbg_cmd *cmd)
 123 {
 124         struct f_uas *fu = cmd->fu;
 125         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 126         struct usb_request *req;
 127         struct usb_ep *ep;
 128
 129         csw->Residue = cpu_to_le32(cmd->data_len);
 130
 131         if (cmd->data_len) {
 132                 if (cmd->is_read) {
 133                         ep = fu->ep_in;
 134                         req = fu->bot_req_in;
 135                 } else {
 136                         ep = fu->ep_out;
 137                         req = fu->bot_req_out;
 138                 }
 139
 140                 if (cmd->data_len > fu->ep_in->maxpacket) {
 141                         req->length = ep->maxpacket;
 142                         cmd->data_len -= ep->maxpacket;
 143                 } else {
 144                         req->length = cmd->data_len;
 145                         cmd->data_len = 0;
 146                 }
 147                 req->complete = bot_err_compl;
 148                 req->context = cmd;
 149                 req->buf = fu->cmd.buf;
 150                 usb_ep_queue(ep, req, GFP_KERNEL);
 151         } else {
 152                 bot_enqueue_sense_code(fu, cmd);
 153         }
 154 }
 155
 156 static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
 157 {
 158         struct f_uas *fu = cmd->fu;
 159         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 160         int ret;
 161
 162         if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
 163                 if (!moved_data && cmd->data_len) {
 164                         /*
 165                          * the host wants to move data, we don't. Fill / empty
 166                          * the pipe and then send the csw with reside set.
 167                          */
 168                         cmd->csw_code = US_BULK_STAT_OK;
 169                         bot_send_bad_status(cmd);
 170                         return 0;
 171                 }
 172
 173                 csw->Tag = cmd->bot_tag;
 174                 csw->Residue = cpu_to_le32(0);
 175                 csw->Status = US_BULK_STAT_OK;
 176                 fu->bot_status.req->context = cmd;
 177
 178                 ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
 179                 if (ret)
 180                         pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
 181         } else {
 182                 cmd->csw_code = US_BULK_STAT_FAIL;
 183                 bot_send_bad_status(cmd);
 184         }
 185         return 0;
 186 }
 187
 188 /*
 189  * Called after command (no data transfer) or after the write (to device)
 190  * operation is completed
 191  */
 192 static int bot_send_status_response(struct usbg_cmd *cmd)
 193 {
 194         bool moved_data = false;
 195
 196         if (!cmd->is_read)
 197                 moved_data = true;
 198         return bot_send_status(cmd, moved_data);
 199 }
 200
 201 /* Read request completed, now we have to send the CSW */
 202 static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
 203 {
 204         struct usbg_cmd *cmd = req->context;
 205
 206         if (req->status < 0)
 207                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 208
 209         bot_send_status(cmd, true);
 210 }
 211
 212 static int bot_send_read_response(struct usbg_cmd *cmd)
 213 {
 214         struct f_uas *fu = cmd->fu;
 215         struct se_cmd *se_cmd = &cmd->se_cmd;
 216         struct usb_gadget *gadget = fuas_to_gadget(fu);
 217         int ret;
 218
 219         if (!cmd->data_len) {
 220                 cmd->csw_code = US_BULK_STAT_PHASE;
 221                 bot_send_bad_status(cmd);
 222                 return 0;
 223         }
 224
 225         if (!gadget->sg_supported) {
 226                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 227                 if (!cmd->data_buf)
 228                         return -ENOMEM;
 229
 230                 sg_copy_to_buffer(se_cmd->t_data_sg,
 231                                 se_cmd->t_data_nents,
 232                                 cmd->data_buf,
 233                                 se_cmd->data_length);
 234
 235                 fu->bot_req_in->buf = cmd->data_buf;
 236         } else {
 237                 fu->bot_req_in->buf = NULL;
 238                 fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
 239                 fu->bot_req_in->sg = se_cmd->t_data_sg;
 240         }
 241
 242         fu->bot_req_in->complete = bot_read_compl;
 243         fu->bot_req_in->length = se_cmd->data_length;
 244         fu->bot_req_in->context = cmd;
 245         ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
 246         if (ret)
 247                 pr_err("%s(%d)\n", __func__, __LINE__);
 248         return 0;
 249 }
 250
 251 static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
 252 static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
 253
 254 static int bot_send_write_request(struct usbg_cmd *cmd)
 255 {
 256         struct f_uas *fu = cmd->fu;
 257         struct se_cmd *se_cmd = &cmd->se_cmd;
 258         struct usb_gadget *gadget = fuas_to_gadget(fu);
 259         int ret;
 260
 261         init_completion(&cmd->write_complete);
 262         cmd->fu = fu;
 263
 264         if (!cmd->data_len) {
 265                 cmd->csw_code = US_BULK_STAT_PHASE;
 266                 return -EINVAL;
 267         }
 268
 269         if (!gadget->sg_supported) {
 270                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL);
 271                 if (!cmd->data_buf)
 272                         return -ENOMEM;
 273
 274                 fu->bot_req_out->buf = cmd->data_buf;
 275         } else {
 276                 fu->bot_req_out->buf = NULL;
 277                 fu->bot_req_out->num_sgs = se_cmd->t_data_nents;
 278                 fu->bot_req_out->sg = se_cmd->t_data_sg;
 279         }
 280
 281         fu->bot_req_out->complete = usbg_data_write_cmpl;
 282         fu->bot_req_out->length = se_cmd->data_length;
 283         fu->bot_req_out->context = cmd;
 284
 285         ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
 286         if (ret)
 287                 goto cleanup;
 288         ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
 289         if (ret)
 290                 pr_err("%s(%d)\n", __func__, __LINE__);
 291
 292         wait_for_completion(&cmd->write_complete);
 293         target_execute_cmd(se_cmd);
 294 cleanup:
 295         return ret;
 296 }
 297
 298 static int bot_submit_command(struct f_uas *, void *, unsigned int);
 299
 300 static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 301 {
 302         struct f_uas *fu = req->context;
 303         int ret;
 304
 305         fu->flags &= ~USBG_BOT_CMD_PEND;
 306
 307         if (req->status < 0)
 308                 return;
 309
 310         ret = bot_submit_command(fu, req->buf, req->actual);
 311         if (ret)
 312                 pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
 313 }
 314
 315 static int bot_prepare_reqs(struct f_uas *fu)
 316 {
 317         int ret;
 318
 319         fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 320         if (!fu->bot_req_in)
 321                 goto err;
 322
 323         fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 324         if (!fu->bot_req_out)
 325                 goto err_out;
 326
 327         fu->cmd.req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 328         if (!fu->cmd.req)
 329                 goto err_cmd;
 330
 331         fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 332         if (!fu->bot_status.req)
 333                 goto err_sts;
 334
 335         fu->bot_status.req->buf = &fu->bot_status.csw;
 336         fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
 337         fu->bot_status.req->complete = bot_status_complete;
 338         fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
 339
 340         fu->cmd.buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
 341         if (!fu->cmd.buf)
 342                 goto err_buf;
 343
 344         fu->cmd.req->complete = bot_cmd_complete;
 345         fu->cmd.req->buf = fu->cmd.buf;
 346         fu->cmd.req->length = fu->ep_out->maxpacket;
 347         fu->cmd.req->context = fu;
 348
 349         ret = bot_enqueue_cmd_cbw(fu);
 350         if (ret)
 351                 goto err_queue;
 352         return 0;
 353 err_queue:
 354         kfree(fu->cmd.buf);
 355         fu->cmd.buf = NULL;
 356 err_buf:
 357         usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 358 err_sts:
 359         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 360         fu->cmd.req = NULL;
 361 err_cmd:
 362         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 363         fu->bot_req_out = NULL;
 364 err_out:
 365         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 366         fu->bot_req_in = NULL;
 367 err:
 368         pr_err("BOT: endpoint setup failed\n");
 369         return -ENOMEM;
 370 }
 371
 372 static void bot_cleanup_old_alt(struct f_uas *fu)
 373 {
 374         if (!(fu->flags & USBG_ENABLED))
 375                 return;
 376
 377         usb_ep_disable(fu->ep_in);
 378         usb_ep_disable(fu->ep_out);
 379
 380         if (!fu->bot_req_in)
 381                 return;
 382
 383         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 384         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 385         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 386         usb_ep_free_request(fu->ep_out, fu->bot_status.req);
 387
 388         kfree(fu->cmd.buf);
 389
 390         fu->bot_req_in = NULL;
 391         fu->bot_req_out = NULL;
 392         fu->cmd.req = NULL;
 393         fu->bot_status.req = NULL;
 394         fu->cmd.buf = NULL;
 395 }
 396
 397 static void bot_set_alt(struct f_uas *fu)
 398 {
 399         struct usb_function *f = &fu->function;
 400         struct usb_gadget *gadget = f->config->cdev->gadget;
 401         int ret;
 402
 403         fu->flags = USBG_IS_BOT;
 404
 405         config_ep_by_speed(gadget, f, fu->ep_in);
 406         ret = usb_ep_enable(fu->ep_in);
 407         if (ret)
 408                 goto err_b_in;
 409
 410         config_ep_by_speed(gadget, f, fu->ep_out);
 411         ret = usb_ep_enable(fu->ep_out);
 412         if (ret)
 413                 goto err_b_out;
 414
 415         ret = bot_prepare_reqs(fu);
 416         if (ret)
 417                 goto err_wq;
 418         fu->flags |= USBG_ENABLED;
 419         pr_info("Using the BOT protocol\n");
 420         return;
 421 err_wq:
 422         usb_ep_disable(fu->ep_out);
 423 err_b_out:
 424         usb_ep_disable(fu->ep_in);
 425 err_b_in:
 426         fu->flags = USBG_IS_BOT;
 427 }
 428
 429 static int usbg_bot_setup(struct usb_function *f,
 430                 const struct usb_ctrlrequest *ctrl)
 431 {
 432         struct f_uas *fu = to_f_uas(f);
 433         struct usb_composite_dev *cdev = f->config->cdev;
 434         u16 w_value = le16_to_cpu(ctrl->wValue);
 435         u16 w_length = le16_to_cpu(ctrl->wLength);
 436         int luns;
 437         u8 *ret_lun;
 438
 439         switch (ctrl->bRequest) {
 440         case US_BULK_GET_MAX_LUN:
 441                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
 442                                         USB_RECIP_INTERFACE))
 443                         return -ENOTSUPP;
 444
 445                 if (w_length < 1)
 446                         return -EINVAL;
 447                 if (w_value != 0)
 448                         return -EINVAL;
 449                 luns = atomic_read(&fu->tpg->tpg_port_count);
 450                 if (!luns) {
 451                         pr_err("No LUNs configured?\n");
 452                         return -EINVAL;
 453                 }
 454                 /*
 455                  * If 4 LUNs are present we return 3 i.e. LUN 0..3 can be
 456                  * accessed. The upper limit is 0xf
 457                  */
 458                 luns--;
 459                 if (luns > 0xf) {
 460                         pr_info_once("Limiting the number of luns to 16\n");
 461                         luns = 0xf;
 462                 }
 463                 ret_lun = cdev->req->buf;
 464                 *ret_lun = luns;
 465                 cdev->req->length = 1;
 466                 return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
 467                 break;
 468
 469         case US_BULK_RESET_REQUEST:
 470                 /* XXX maybe we should remove previous requests for IN + OUT */
 471                 bot_enqueue_cmd_cbw(fu);
 472                 return 0;
 473                 break;
 474         }
 475         return -ENOTSUPP;
 476 }
 477
 478 /* Start uas.c code */
 479
 480 static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
 481 {
 482         /* We have either all three allocated or none */
 483         if (!stream->req_in)
 484                 return;
 485
 486         usb_ep_free_request(fu->ep_in, stream->req_in);
 487         usb_ep_free_request(fu->ep_out, stream->req_out);
 488         usb_ep_free_request(fu->ep_status, stream->req_status);
 489
 490         stream->req_in = NULL;
 491         stream->req_out = NULL;
 492         stream->req_status = NULL;
 493 }
 494
 495 static void uasp_free_cmdreq(struct f_uas *fu)
 496 {
 497         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 498         kfree(fu->cmd.buf);
 499         fu->cmd.req = NULL;
 500         fu->cmd.buf = NULL;
 501 }
 502
 503 static void uasp_cleanup_old_alt(struct f_uas *fu)
 504 {
 505         int i;
 506
 507         if (!(fu->flags & USBG_ENABLED))
 508                 return;
 509
 510         usb_ep_disable(fu->ep_in);
 511         usb_ep_disable(fu->ep_out);
 512         usb_ep_disable(fu->ep_status);
 513         usb_ep_disable(fu->ep_cmd);
 514
 515         for (i = 0; i < UASP_SS_EP_COMP_NUM_STREAMS; i++)
 516                 uasp_cleanup_one_stream(fu, &fu->stream[i]);
 517         uasp_free_cmdreq(fu);
 518 }
 519
 520 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
 521
 522 static int uasp_prepare_r_request(struct usbg_cmd *cmd)
 523 {
 524         struct se_cmd *se_cmd = &cmd->se_cmd;
 525         struct f_uas *fu = cmd->fu;
 526         struct usb_gadget *gadget = fuas_to_gadget(fu);
 527         struct uas_stream *stream = cmd->stream;
 528
 529         if (!gadget->sg_supported) {
 530                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 531                 if (!cmd->data_buf)
 532                         return -ENOMEM;
 533
 534                 sg_copy_to_buffer(se_cmd->t_data_sg,
 535                                 se_cmd->t_data_nents,
 536                                 cmd->data_buf,
 537                                 se_cmd->data_length);
 538
 539                 stream->req_in->buf = cmd->data_buf;
 540         } else {
 541                 stream->req_in->buf = NULL;
 542                 stream->req_in->num_sgs = se_cmd->t_data_nents;
 543                 stream->req_in->sg = se_cmd->t_data_sg;
 544         }
 545
 546         stream->req_in->complete = uasp_status_data_cmpl;
 547         stream->req_in->length = se_cmd->data_length;
 548         stream->req_in->context = cmd;
 549
 550         cmd->state = UASP_SEND_STATUS;
 551         return 0;
 552 }
 553
 554 static void uasp_prepare_status(struct usbg_cmd *cmd)
 555 {
 556         struct se_cmd *se_cmd = &cmd->se_cmd;
 557         struct sense_iu *iu = &cmd->sense_iu;
 558         struct uas_stream *stream = cmd->stream;
 559
 560         cmd->state = UASP_QUEUE_COMMAND;
 561         iu->iu_id = IU_ID_STATUS;
 562         iu->tag = cpu_to_be16(cmd->tag);
 563
 564         /*
 565          * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
 566          */
 567         iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
 568         iu->status = se_cmd->scsi_status;
 569         stream->req_status->context = cmd;
 570         stream->req_status->length = se_cmd->scsi_sense_length + 16;
 571         stream->req_status->buf = iu;
 572         stream->req_status->complete = uasp_status_data_cmpl;
 573 }
 574
 575 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
 576 {
 577         struct usbg_cmd *cmd = req->context;
 578         struct uas_stream *stream = cmd->stream;
 579         struct f_uas *fu = cmd->fu;
 580         int ret;
 581
 582         if (req->status < 0)
 583                 goto cleanup;
 584
 585         switch (cmd->state) {
 586         case UASP_SEND_DATA:
 587                 ret = uasp_prepare_r_request(cmd);
 588                 if (ret)
 589                         goto cleanup;
 590                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 591                 if (ret)
 592                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 593                 break;
 594
 595         case UASP_RECEIVE_DATA:
 596                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 597                 if (ret)
 598                         goto cleanup;
 599                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 600                 if (ret)
 601                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 602                 break;
 603
 604         case UASP_SEND_STATUS:
 605                 uasp_prepare_status(cmd);
 606                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 607                                 GFP_ATOMIC);
 608                 if (ret)
 609                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 610                 break;
 611
 612         case UASP_QUEUE_COMMAND:
 613                 usbg_cleanup_cmd(cmd);
 614                 usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 615                 break;
 616
 617         default:
 618                 BUG();
 619         }
 620         return;
 621
 622 cleanup:
 623         usbg_cleanup_cmd(cmd);
 624 }
 625
 626 static int uasp_send_status_response(struct usbg_cmd *cmd)
 627 {
 628         struct f_uas *fu = cmd->fu;
 629         struct uas_stream *stream = cmd->stream;
 630         struct sense_iu *iu = &cmd->sense_iu;
 631
 632         iu->tag = cpu_to_be16(cmd->tag);
 633         stream->req_status->complete = uasp_status_data_cmpl;
 634         stream->req_status->context = cmd;
 635         cmd->fu = fu;
 636         uasp_prepare_status(cmd);
 637         return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
 638 }
 639
 640 static int uasp_send_read_response(struct usbg_cmd *cmd)
 641 {
 642         struct f_uas *fu = cmd->fu;
 643         struct uas_stream *stream = cmd->stream;
 644         struct sense_iu *iu = &cmd->sense_iu;
 645         int ret;
 646
 647         cmd->fu = fu;
 648
 649         iu->tag = cpu_to_be16(cmd->tag);
 650         if (fu->flags & USBG_USE_STREAMS) {
 651
 652                 ret = uasp_prepare_r_request(cmd);
 653                 if (ret)
 654                         goto out;
 655                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 656                 if (ret) {
 657                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 658                         kfree(cmd->data_buf);
 659                         cmd->data_buf = NULL;
 660                 }
 661
 662         } else {
 663
 664                 iu->iu_id = IU_ID_READ_READY;
 665                 iu->tag = cpu_to_be16(cmd->tag);
 666
 667                 stream->req_status->complete = uasp_status_data_cmpl;
 668                 stream->req_status->context = cmd;
 669
 670                 cmd->state = UASP_SEND_DATA;
 671                 stream->req_status->buf = iu;
 672                 stream->req_status->length = sizeof(struct iu);
 673
 674                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 675                                 GFP_ATOMIC);
 676                 if (ret)
 677                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 678         }
 679 out:
 680         return ret;
 681 }
 682
 683 static int uasp_send_write_request(struct usbg_cmd *cmd)
 684 {
 685         struct f_uas *fu = cmd->fu;
 686         struct se_cmd *se_cmd = &cmd->se_cmd;
 687         struct uas_stream *stream = cmd->stream;
 688         struct sense_iu *iu = &cmd->sense_iu;
 689         int ret;
 690
 691         init_completion(&cmd->write_complete);
 692         cmd->fu = fu;
 693
 694         iu->tag = cpu_to_be16(cmd->tag);
 695
 696         if (fu->flags & USBG_USE_STREAMS) {
 697
 698                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 699                 if (ret)
 700                         goto cleanup;
 701                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 702                 if (ret)
 703                         pr_err("%s(%d)\n", __func__, __LINE__);
 704
 705         } else {
 706
 707                 iu->iu_id = IU_ID_WRITE_READY;
 708                 iu->tag = cpu_to_be16(cmd->tag);
 709
 710                 stream->req_status->complete = uasp_status_data_cmpl;
 711                 stream->req_status->context = cmd;
 712
 713                 cmd->state = UASP_RECEIVE_DATA;
 714                 stream->req_status->buf = iu;
 715                 stream->req_status->length = sizeof(struct iu);
 716
 717                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 718                                 GFP_ATOMIC);
 719                 if (ret)
 720                         pr_err("%s(%d)\n", __func__, __LINE__);
 721         }
 722
 723         wait_for_completion(&cmd->write_complete);
 724         target_execute_cmd(se_cmd);
 725 cleanup:
 726         return ret;
 727 }
 728
 729 static int usbg_submit_command(struct f_uas *, void *, unsigned int);
 730
 731 static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 732 {
 733         struct f_uas *fu = req->context;
 734         int ret;
 735
 736         if (req->status < 0)
 737                 return;
 738
 739         ret = usbg_submit_command(fu, req->buf, req->actual);
 740         /*
 741          * Once we tune for performance enqueue the command req here again so
 742          * we can receive a second command while we processing this one. Pay
 743          * attention to properly sync STAUS endpoint with DATA IN + OUT so you
 744          * don't break HS.
 745          */
 746         if (!ret)
 747                 return;
 748         usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 749 }
 750
 751 static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
 752 {
 753         stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 754         if (!stream->req_in)
 755                 goto out;
 756
 757         stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 758         if (!stream->req_out)
 759                 goto err_out;
 760
 761         stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
 762         if (!stream->req_status)
 763                 goto err_sts;
 764
 765         return 0;
 766 err_sts:
 767         usb_ep_free_request(fu->ep_status, stream->req_status);
 768         stream->req_status = NULL;
 769 err_out:
 770         usb_ep_free_request(fu->ep_out, stream->req_out);
 771         stream->req_out = NULL;
 772 out:
 773         return -ENOMEM;
 774 }
 775
 776 static int uasp_alloc_cmd(struct f_uas *fu)
 777 {
 778         fu->cmd.req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
 779         if (!fu->cmd.req)
 780                 goto err;
 781
 782         fu->cmd.buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
 783         if (!fu->cmd.buf)
 784                 goto err_buf;
 785
 786         fu->cmd.req->complete = uasp_cmd_complete;
 787         fu->cmd.req->buf = fu->cmd.buf;
 788         fu->cmd.req->length = fu->ep_cmd->maxpacket;
 789         fu->cmd.req->context = fu;
 790         return 0;
 791
 792 err_buf:
 793         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 794 err:
 795         return -ENOMEM;
 796 }
 797
 798 static void uasp_setup_stream_res(struct f_uas *fu, int max_streams)
 799 {
 800         int i;
 801
 802         for (i = 0; i < max_streams; i++) {
 803                 struct uas_stream *s = &fu->stream[i];
 804
 805                 s->req_in->stream_id = i + 1;
 806                 s->req_out->stream_id = i + 1;
 807                 s->req_status->stream_id = i + 1;
 808         }
 809 }
 810
 811 static int uasp_prepare_reqs(struct f_uas *fu)
 812 {
 813         int ret;
 814         int i;
 815         int max_streams;
 816
 817         if (fu->flags & USBG_USE_STREAMS)
 818                 max_streams = UASP_SS_EP_COMP_NUM_STREAMS;
 819         else
 820                 max_streams = 1;
 821
 822         for (i = 0; i < max_streams; i++) {
 823                 ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
 824                 if (ret)
 825                         goto err_cleanup;
 826         }
 827
 828         ret = uasp_alloc_cmd(fu);
 829         if (ret)
 830                 goto err_free_stream;
 831         uasp_setup_stream_res(fu, max_streams);
 832
 833         ret = usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 834         if (ret)
 835                 goto err_free_stream;
 836
 837         return 0;
 838
 839 err_free_stream:
 840         uasp_free_cmdreq(fu);
 841
 842 err_cleanup:
 843         if (i) {
 844                 do {
 845                         uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
 846                         i--;
 847                 } while (i);
 848         }
 849         pr_err("UASP: endpoint setup failed\n");
 850         return ret;
 851 }
 852
 853 static void uasp_set_alt(struct f_uas *fu)
 854 {
 855         struct usb_function *f = &fu->function;
 856         struct usb_gadget *gadget = f->config->cdev->gadget;
 857         int ret;
 858
 859         fu->flags = USBG_IS_UAS;
 860
 861         if (gadget->speed == USB_SPEED_SUPER)
 862                 fu->flags |= USBG_USE_STREAMS;
 863
 864         config_ep_by_speed(gadget, f, fu->ep_in);
 865         ret = usb_ep_enable(fu->ep_in);
 866         if (ret)
 867                 goto err_b_in;
 868
 869         config_ep_by_speed(gadget, f, fu->ep_out);
 870         ret = usb_ep_enable(fu->ep_out);
 871         if (ret)
 872                 goto err_b_out;
 873
 874         config_ep_by_speed(gadget, f, fu->ep_cmd);
 875         ret = usb_ep_enable(fu->ep_cmd);
 876         if (ret)
 877                 goto err_cmd;
 878         config_ep_by_speed(gadget, f, fu->ep_status);
 879         ret = usb_ep_enable(fu->ep_status);
 880         if (ret)
 881                 goto err_status;
 882
 883         ret = uasp_prepare_reqs(fu);
 884         if (ret)
 885                 goto err_wq;
 886         fu->flags |= USBG_ENABLED;
 887
 888         pr_info("Using the UAS protocol\n");
 889         return;
 890 err_wq:
 891         usb_ep_disable(fu->ep_status);
 892 err_status:
 893         usb_ep_disable(fu->ep_cmd);
 894 err_cmd:
 895         usb_ep_disable(fu->ep_out);
 896 err_b_out:
 897         usb_ep_disable(fu->ep_in);
 898 err_b_in:
 899         fu->flags = 0;
 900 }
 901
 902 static int get_cmd_dir(const unsigned char *cdb)
 903 {
 904         int ret;
 905
 906         switch (cdb[0]) {
 907         case READ_6:
 908         case READ_10:
 909         case READ_12:
 910         case READ_16:
 911         case INQUIRY:
 912         case MODE_SENSE:
 913         case MODE_SENSE_10:
 914         case SERVICE_ACTION_IN_16:
 915         case MAINTENANCE_IN:
 916         case PERSISTENT_RESERVE_IN:
 917         case SECURITY_PROTOCOL_IN:
 918         case ACCESS_CONTROL_IN:
 919         case REPORT_LUNS:
 920         case READ_BLOCK_LIMITS:
 921         case READ_POSITION:
 922         case READ_CAPACITY:
 923         case READ_TOC:
 924         case READ_FORMAT_CAPACITIES:
 925         case REQUEST_SENSE:
 926                 ret = DMA_FROM_DEVICE;
 927                 break;
 928
 929         case WRITE_6:
 930         case WRITE_10:
 931         case WRITE_12:
 932         case WRITE_16:
 933         case MODE_SELECT:
 934         case MODE_SELECT_10:
 935         case WRITE_VERIFY:
 936         case WRITE_VERIFY_12:
 937         case PERSISTENT_RESERVE_OUT:
 938         case MAINTENANCE_OUT:
 939         case SECURITY_PROTOCOL_OUT:
 940         case ACCESS_CONTROL_OUT:
 941                 ret = DMA_TO_DEVICE;
 942                 break;
 943         case ALLOW_MEDIUM_REMOVAL:
 944         case TEST_UNIT_READY:
 945         case SYNCHRONIZE_CACHE:
 946         case START_STOP:
 947         case ERASE:
 948         case REZERO_UNIT:
 949         case SEEK_10:
 950         case SPACE:
 951         case VERIFY:
 952         case WRITE_FILEMARKS:
 953                 ret = DMA_NONE;
 954                 break;
 955         default:
 956                 pr_warn("target: Unknown data direction for SCSI Opcode "
 957                                 "0x%02x\n", cdb[0]);
 958                 ret = -EINVAL;
 959         }
 960         return ret;
 961 }
 962
 963 static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
 964 {
 965         struct usbg_cmd *cmd = req->context;
 966         struct se_cmd *se_cmd = &cmd->se_cmd;
 967
 968         if (req->status < 0) {
 969                 pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
 970                 goto cleanup;
 971         }
 972
 973         if (req->num_sgs == 0) {
 974                 sg_copy_from_buffer(se_cmd->t_data_sg,
 975                                 se_cmd->t_data_nents,
 976                                 cmd->data_buf,
 977                                 se_cmd->data_length);
 978         }
 979
 980         complete(&cmd->write_complete);
 981         return;
 982
 983 cleanup:
 984         usbg_cleanup_cmd(cmd);
 985 }
 986
 987 static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
 988 {
 989         struct se_cmd *se_cmd = &cmd->se_cmd;
 990         struct f_uas *fu = cmd->fu;
 991         struct usb_gadget *gadget = fuas_to_gadget(fu);
 992
 993         if (!gadget->sg_supported) {
 994                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 995                 if (!cmd->data_buf)
 996                         return -ENOMEM;
 997
 998                 req->buf = cmd->data_buf;
 999         } else {
1000                 req->buf = NULL;
1001                 req->num_sgs = se_cmd->t_data_nents;
1002                 req->sg = se_cmd->t_data_sg;
1003         }
1004
1005         req->complete = usbg_data_write_cmpl;
1006         req->length = se_cmd->data_length;
1007         req->context = cmd;
1008         return 0;
1009 }
1010
1011 static int usbg_send_status_response(struct se_cmd *se_cmd)
1012 {
1013         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1014                         se_cmd);
1015         struct f_uas *fu = cmd->fu;
1016
1017         if (fu->flags & USBG_IS_BOT)
1018                 return bot_send_status_response(cmd);
1019         else
1020                 return uasp_send_status_response(cmd);
1021 }
1022
1023 static int usbg_send_write_request(struct se_cmd *se_cmd)
1024 {
1025         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1026                         se_cmd);
1027         struct f_uas *fu = cmd->fu;
1028
1029         if (fu->flags & USBG_IS_BOT)
1030                 return bot_send_write_request(cmd);
1031         else
1032                 return uasp_send_write_request(cmd);
1033 }
1034
1035 static int usbg_send_read_response(struct se_cmd *se_cmd)
1036 {
1037         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1038                         se_cmd);
1039         struct f_uas *fu = cmd->fu;
1040
1041         if (fu->flags & USBG_IS_BOT)
1042                 return bot_send_read_response(cmd);
1043         else
1044                 return uasp_send_read_response(cmd);
1045 }
1046
1047 static void usbg_cmd_work(struct work_struct *work)
1048 {
1049         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1050         struct se_cmd *se_cmd;
1051         struct tcm_usbg_nexus *tv_nexus;
1052         struct usbg_tpg *tpg;
1053         int dir;
1054
1055         se_cmd = &cmd->se_cmd;
1056         tpg = cmd->fu->tpg;
1057         tv_nexus = tpg->tpg_nexus;
1058         dir = get_cmd_dir(cmd->cmd_buf);
1059         if (dir < 0) {
1060                 transport_init_se_cmd(se_cmd,
1061                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1062                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1063                                 cmd->prio_attr, cmd->sense_iu.sense);
1064                 goto out;
1065         }
1066
1067         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1068                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1069                         0, cmd->prio_attr, dir, TARGET_SCF_UNKNOWN_SIZE) < 0)
1070                 goto out;
1071
1072         return;
1073
1074 out:
1075         transport_send_check_condition_and_sense(se_cmd,
1076                         TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1077         usbg_cleanup_cmd(cmd);
1078 }
1079
1080 static int usbg_submit_command(struct f_uas *fu,
1081                 void *cmdbuf, unsigned int len)
1082 {
1083         struct command_iu *cmd_iu = cmdbuf;
1084         struct usbg_cmd *cmd;
1085         struct usbg_tpg *tpg;
1086         struct se_cmd *se_cmd;
1087         struct tcm_usbg_nexus *tv_nexus;
1088         u32 cmd_len;
1089         int ret;
1090
1091         if (cmd_iu->iu_id != IU_ID_COMMAND) {
1092                 pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1093                 return -EINVAL;
1094         }
1095
1096         cmd = kzalloc(sizeof *cmd, GFP_ATOMIC);
1097         if (!cmd)
1098                 return -ENOMEM;
1099
1100         cmd->fu = fu;
1101
1102         /* XXX until I figure out why I can't free in on complete */
1103         kref_init(&cmd->ref);
1104         kref_get(&cmd->ref);
1105
1106         tpg = fu->tpg;
1107         cmd_len = (cmd_iu->len & ~0x3) + 16;
1108         if (cmd_len > USBG_MAX_CMD)
1109                 goto err;
1110
1111         memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1112
1113         cmd->tag = be16_to_cpup(&cmd_iu->tag);
1114         cmd->se_cmd.tag = cmd->tag;
1115         if (fu->flags & USBG_USE_STREAMS) {
1116                 if (cmd->tag > UASP_SS_EP_COMP_NUM_STREAMS)
1117                         goto err;
1118                 if (!cmd->tag)
1119                         cmd->stream = &fu->stream[0];
1120                 else
1121                         cmd->stream = &fu->stream[cmd->tag - 1];
1122         } else {
1123                 cmd->stream = &fu->stream[0];
1124         }
1125
1126         tv_nexus = tpg->tpg_nexus;
1127         if (!tv_nexus) {
1128                 pr_err("Missing nexus, ignoring command\n");
1129                 goto err;
1130         }
1131
1132         switch (cmd_iu->prio_attr & 0x7) {
1133         case UAS_HEAD_TAG:
1134                 cmd->prio_attr = TCM_HEAD_TAG;
1135                 break;
1136         case UAS_ORDERED_TAG:
1137                 cmd->prio_attr = TCM_ORDERED_TAG;
1138                 break;
1139         case UAS_ACA:
1140                 cmd->prio_attr = TCM_ACA_TAG;
1141                 break;
1142         default:
1143                 pr_debug_once("Unsupported prio_attr: %02x.\n",
1144                                 cmd_iu->prio_attr);
1145         case UAS_SIMPLE_TAG:
1146                 cmd->prio_attr = TCM_SIMPLE_TAG;
1147                 break;
1148         }
1149
1150         se_cmd = &cmd->se_cmd;
1151         cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1152
1153         INIT_WORK(&cmd->work, usbg_cmd_work);
1154         ret = queue_work(tpg->workqueue, &cmd->work);
1155         if (ret < 0)
1156                 goto err;
1157
1158         return 0;
1159 err:
1160         kfree(cmd);
1161         return -EINVAL;
1162 }
1163
1164 static void bot_cmd_work(struct work_struct *work)
1165 {
1166         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1167         struct se_cmd *se_cmd;
1168         struct tcm_usbg_nexus *tv_nexus;
1169         struct usbg_tpg *tpg;
1170         int dir;
1171
1172         se_cmd = &cmd->se_cmd;
1173         tpg = cmd->fu->tpg;
1174         tv_nexus = tpg->tpg_nexus;
1175         dir = get_cmd_dir(cmd->cmd_buf);
1176         if (dir < 0) {
1177                 transport_init_se_cmd(se_cmd,
1178                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1179                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1180                                 cmd->prio_attr, cmd->sense_iu.sense);
1181                 goto out;
1182         }
1183
1184         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1185                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1186                         cmd->data_len, cmd->prio_attr, dir, 0) < 0)
1187                 goto out;
1188
1189         return;
1190
1191 out:
1192         transport_send_check_condition_and_sense(se_cmd,
1193                                 TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1194         usbg_cleanup_cmd(cmd);
1195 }
1196
1197 static int bot_submit_command(struct f_uas *fu,
1198                 void *cmdbuf, unsigned int len)
1199 {
1200         struct bulk_cb_wrap *cbw = cmdbuf;
1201         struct usbg_cmd *cmd;
1202         struct usbg_tpg *tpg;
1203         struct se_cmd *se_cmd;
1204         struct tcm_usbg_nexus *tv_nexus;
1205         u32 cmd_len;
1206         int ret;
1207
1208         if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1209                 pr_err("Wrong signature on CBW\n");
1210                 return -EINVAL;
1211         }
1212         if (len != 31) {
1213                 pr_err("Wrong length for CBW\n");
1214                 return -EINVAL;
1215         }
1216
1217         cmd_len = cbw->Length;
1218         if (cmd_len < 1 || cmd_len > 16)
1219                 return -EINVAL;
1220
1221         cmd = kzalloc(sizeof *cmd, GFP_ATOMIC);
1222         if (!cmd)
1223                 return -ENOMEM;
1224
1225         cmd->fu = fu;
1226
1227         /* XXX until I figure out why I can't free in on complete */
1228         kref_init(&cmd->ref);
1229         kref_get(&cmd->ref);
1230
1231         tpg = fu->tpg;
1232
1233         memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1234
1235         cmd->bot_tag = cbw->Tag;
1236
1237         tv_nexus = tpg->tpg_nexus;
1238         if (!tv_nexus) {
1239                 pr_err("Missing nexus, ignoring command\n");
1240                 goto err;
1241         }
1242
1243         cmd->prio_attr = TCM_SIMPLE_TAG;
1244         se_cmd = &cmd->se_cmd;
1245         cmd->unpacked_lun = cbw->Lun;
1246         cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1247         cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1248         cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1249
1250         INIT_WORK(&cmd->work, bot_cmd_work);
1251         ret = queue_work(tpg->workqueue, &cmd->work);
1252         if (ret < 0)
1253                 goto err;
1254
1255         return 0;
1256 err:
1257         kfree(cmd);
1258         return -EINVAL;
1259 }
1260
1261 /* Start fabric.c code */
1262
1263 static int usbg_check_true(struct se_portal_group *se_tpg)
1264 {
1265         return 1;
1266 }
1267
1268 static int usbg_check_false(struct se_portal_group *se_tpg)
1269 {
1270         return 0;
1271 }
1272
1273 static char *usbg_get_fabric_name(void)
1274 {
1275         return "usb_gadget";
1276 }
1277
1278 static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1279 {
1280         struct usbg_tpg *tpg = container_of(se_tpg,
1281                                 struct usbg_tpg, se_tpg);
1282         struct usbg_tport *tport = tpg->tport;
1283
1284         return &tport->tport_name[0];
1285 }
1286
1287 static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1288 {
1289         struct usbg_tpg *tpg = container_of(se_tpg,
1290                                 struct usbg_tpg, se_tpg);
1291         return tpg->tport_tpgt;
1292 }
1293
1294 static u32 usbg_tpg_get_inst_index(struct se_portal_group *se_tpg)
1295 {
1296         return 1;
1297 }
1298
1299 static void usbg_cmd_release(struct kref *ref)
1300 {
1301         struct usbg_cmd *cmd = container_of(ref, struct usbg_cmd,
1302                         ref);
1303
1304         transport_generic_free_cmd(&cmd->se_cmd, 0);
1305 }
1306
1307 static void usbg_release_cmd(struct se_cmd *se_cmd)
1308 {
1309         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1310                         se_cmd);
1311         kfree(cmd->data_buf);
1312         kfree(cmd);
1313         return;
1314 }
1315
1316 static int usbg_shutdown_session(struct se_session *se_sess)
1317 {
1318         return 0;
1319 }
1320
1321 static void usbg_close_session(struct se_session *se_sess)
1322 {
1323         return;
1324 }
1325
1326 static u32 usbg_sess_get_index(struct se_session *se_sess)
1327 {
1328         return 0;
1329 }
1330
1331 /*
1332  * XXX Error recovery: return != 0 if we expect writes. Dunno when that could be
1333  */
1334 static int usbg_write_pending_status(struct se_cmd *se_cmd)
1335 {
1336         return 0;
1337 }
1338
1339 static void usbg_set_default_node_attrs(struct se_node_acl *nacl)
1340 {
1341         return;
1342 }
1343
1344 static int usbg_get_cmd_state(struct se_cmd *se_cmd)
1345 {
1346         return 0;
1347 }
1348
1349 static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1350 {
1351 }
1352
1353 static void usbg_aborted_task(struct se_cmd *se_cmd)
1354 {
1355         return;
1356 }
1357
1358 static const char *usbg_check_wwn(const char *name)
1359 {
1360         const char *n;
1361         unsigned int len;
1362
1363         n = strstr(name, "naa.");
1364         if (!n)
1365                 return NULL;
1366         n += 4;
1367         len = strlen(n);
1368         if (len == 0 || len > USBG_NAMELEN - 1)
1369                 return NULL;
1370         return n;
1371 }
1372
1373 static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1374 {
1375         if (!usbg_check_wwn(name))
1376                 return -EINVAL;
1377         return 0;
1378 }
1379
1380 struct usbg_tpg *the_only_tpg_I_currently_have;
1381
1382 static struct se_portal_group *usbg_make_tpg(
1383         struct se_wwn *wwn,
1384         struct config_group *group,
1385         const char *name)
1386 {
1387         struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1388                         tport_wwn);
1389         struct usbg_tpg *tpg;
1390         unsigned long tpgt;
1391         int ret;
1392
1393         if (strstr(name, "tpgt_") != name)
1394                 return ERR_PTR(-EINVAL);
1395         if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1396                 return ERR_PTR(-EINVAL);
1397         if (the_only_tpg_I_currently_have) {
1398                 pr_err("Until the gadget framework can't handle multiple\n");
1399                 pr_err("gadgets, you can't do this here.\n");
1400                 return ERR_PTR(-EBUSY);
1401         }
1402
1403         tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1404         if (!tpg)
1405                 return ERR_PTR(-ENOMEM);
1406         mutex_init(&tpg->tpg_mutex);
1407         atomic_set(&tpg->tpg_port_count, 0);
1408         tpg->workqueue = alloc_workqueue("tcm_usb_gadget", 0, 1);
1409         if (!tpg->workqueue) {
1410                 kfree(tpg);
1411                 return NULL;
1412         }
1413
1414         tpg->tport = tport;
1415         tpg->tport_tpgt = tpgt;
1416
1417         /*
1418          * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1419          * pretend to be SAS..
1420          */
1421         ret = core_tpg_register(&usbg_ops, wwn, &tpg->se_tpg,
1422                                 SCSI_PROTOCOL_SAS);
1423         if (ret < 0) {
1424                 destroy_workqueue(tpg->workqueue);
1425                 kfree(tpg);
1426                 return NULL;
1427         }
1428         the_only_tpg_I_currently_have = tpg;
1429         return &tpg->se_tpg;
1430 }
1431
1432 static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1433 {
1434         struct usbg_tpg *tpg = container_of(se_tpg,
1435                                 struct usbg_tpg, se_tpg);
1436
1437         core_tpg_deregister(se_tpg);
1438         destroy_workqueue(tpg->workqueue);
1439         kfree(tpg);
1440         the_only_tpg_I_currently_have = NULL;
1441 }
1442
1443 static struct se_wwn *usbg_make_tport(
1444         struct target_fabric_configfs *tf,
1445         struct config_group *group,
1446         const char *name)
1447 {
1448         struct usbg_tport *tport;
1449         const char *wnn_name;
1450         u64 wwpn = 0;
1451
1452         wnn_name = usbg_check_wwn(name);
1453         if (!wnn_name)
1454                 return ERR_PTR(-EINVAL);
1455
1456         tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1457         if (!(tport))
1458                 return ERR_PTR(-ENOMEM);
1459         tport->tport_wwpn = wwpn;
1460         snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1461         return &tport->tport_wwn;
1462 }
1463
1464 static void usbg_drop_tport(struct se_wwn *wwn)
1465 {
1466         struct usbg_tport *tport = container_of(wwn,
1467                                 struct usbg_tport, tport_wwn);
1468         kfree(tport);
1469 }
1470
1471 /*
1472  * If somebody feels like dropping the version property, go ahead.
1473  */
1474 static ssize_t usbg_wwn_show_attr_version(
1475         struct target_fabric_configfs *tf,
1476         char *page)
1477 {
1478         return sprintf(page, "usb-gadget fabric module\n");
1479 }
1480 TF_WWN_ATTR_RO(usbg, version);
1481
1482 static struct configfs_attribute *usbg_wwn_attrs[] = {
1483         &usbg_wwn_version.attr,
1484         NULL,
1485 };
1486
1487 static ssize_t tcm_usbg_tpg_show_enable(
1488                 struct se_portal_group *se_tpg,
1489                 char *page)
1490 {
1491         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1492
1493         return snprintf(page, PAGE_SIZE, "%u\n", tpg->gadget_connect);
1494 }
1495
1496 static int usbg_attach(struct usbg_tpg *);
1497 static void usbg_detach(struct usbg_tpg *);
1498
1499 static ssize_t tcm_usbg_tpg_store_enable(
1500                 struct se_portal_group *se_tpg,
1501                 const char *page,
1502                 size_t count)
1503 {
1504         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1505         unsigned long op;
1506         ssize_t ret;
1507
1508         ret = kstrtoul(page, 0, &op);
1509         if (ret < 0)
1510                 return -EINVAL;
1511         if (op > 1)
1512                 return -EINVAL;
1513
1514         if (op && tpg->gadget_connect)
1515                 goto out;
1516         if (!op && !tpg->gadget_connect)
1517                 goto out;
1518
1519         if (op) {
1520                 ret = usbg_attach(tpg);
1521                 if (ret)
1522                         goto out;
1523         } else {
1524                 usbg_detach(tpg);
1525         }
1526         tpg->gadget_connect = op;
1527 out:
1528         return count;
1529 }
1530 TF_TPG_BASE_ATTR(tcm_usbg, enable, S_IRUGO | S_IWUSR);
1531
1532 static ssize_t tcm_usbg_tpg_show_nexus(
1533                 struct se_portal_group *se_tpg,
1534                 char *page)
1535 {
1536         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1537         struct tcm_usbg_nexus *tv_nexus;
1538         ssize_t ret;
1539
1540         mutex_lock(&tpg->tpg_mutex);
1541         tv_nexus = tpg->tpg_nexus;
1542         if (!tv_nexus) {
1543                 ret = -ENODEV;
1544                 goto out;
1545         }
1546         ret = snprintf(page, PAGE_SIZE, "%s\n",
1547                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1548 out:
1549         mutex_unlock(&tpg->tpg_mutex);
1550         return ret;
1551 }
1552
1553 static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1554 {
1555         struct se_portal_group *se_tpg;
1556         struct tcm_usbg_nexus *tv_nexus;
1557         int ret;
1558
1559         mutex_lock(&tpg->tpg_mutex);
1560         if (tpg->tpg_nexus) {
1561                 ret = -EEXIST;
1562                 pr_debug("tpg->tpg_nexus already exists\n");
1563                 goto err_unlock;
1564         }
1565         se_tpg = &tpg->se_tpg;
1566
1567         ret = -ENOMEM;
1568         tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1569         if (!tv_nexus)
1570                 goto err_unlock;
1571         tv_nexus->tvn_se_sess = transport_init_session(TARGET_PROT_NORMAL);
1572         if (IS_ERR(tv_nexus->tvn_se_sess))
1573                 goto err_free;
1574
1575         /*
1576          * Since we are running in 'demo mode' this call with generate a
1577          * struct se_node_acl for the tcm_vhost struct se_portal_group with
1578          * the SCSI Initiator port name of the passed configfs group 'name'.
1579          */
1580         tv_nexus->tvn_se_sess->se_node_acl = core_tpg_check_initiator_node_acl(
1581                         se_tpg, name);
1582         if (!tv_nexus->tvn_se_sess->se_node_acl) {
1583                 pr_debug("core_tpg_check_initiator_node_acl() failed"
1584                                 " for %s\n", name);
1585                 goto err_session;
1586         }
1587         /*
1588          * Now register the TCM vHost virtual I_T Nexus as active.
1589          */
1590         transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
1591                         tv_nexus->tvn_se_sess, tv_nexus);
1592         tpg->tpg_nexus = tv_nexus;
1593         mutex_unlock(&tpg->tpg_mutex);
1594         return 0;
1595
1596 err_session:
1597         transport_free_session(tv_nexus->tvn_se_sess);
1598 err_free:
1599         kfree(tv_nexus);
1600 err_unlock:
1601         mutex_unlock(&tpg->tpg_mutex);
1602         return ret;
1603 }
1604
1605 static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1606 {
1607         struct se_session *se_sess;
1608         struct tcm_usbg_nexus *tv_nexus;
1609         int ret = -ENODEV;
1610
1611         mutex_lock(&tpg->tpg_mutex);
1612         tv_nexus = tpg->tpg_nexus;
1613         if (!tv_nexus)
1614                 goto out;
1615
1616         se_sess = tv_nexus->tvn_se_sess;
1617         if (!se_sess)
1618                 goto out;
1619
1620         if (atomic_read(&tpg->tpg_port_count)) {
1621                 ret = -EPERM;
1622                 pr_err("Unable to remove Host I_T Nexus with"
1623                                 " active TPG port count: %d\n",
1624                                 atomic_read(&tpg->tpg_port_count));
1625                 goto out;
1626         }
1627
1628         pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1629                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1630         /*
1631          * Release the SCSI I_T Nexus to the emulated vHost Target Port
1632          */
1633         transport_deregister_session(tv_nexus->tvn_se_sess);
1634         tpg->tpg_nexus = NULL;
1635
1636         kfree(tv_nexus);
1637         ret = 0;
1638 out:
1639         mutex_unlock(&tpg->tpg_mutex);
1640         return ret;
1641 }
1642
1643 static ssize_t tcm_usbg_tpg_store_nexus(
1644                 struct se_portal_group *se_tpg,
1645                 const char *page,
1646                 size_t count)
1647 {
1648         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1649         unsigned char i_port[USBG_NAMELEN], *ptr;
1650         int ret;
1651
1652         if (!strncmp(page, "NULL", 4)) {
1653                 ret = tcm_usbg_drop_nexus(tpg);
1654                 return (!ret) ? count : ret;
1655         }
1656         if (strlen(page) >= USBG_NAMELEN) {
1657                 pr_err("Emulated NAA Sas Address: %s, exceeds"
1658                                 " max: %d\n", page, USBG_NAMELEN);
1659                 return -EINVAL;
1660         }
1661         snprintf(i_port, USBG_NAMELEN, "%s", page);
1662
1663         ptr = strstr(i_port, "naa.");
1664         if (!ptr) {
1665                 pr_err("Missing 'naa.' prefix\n");
1666                 return -EINVAL;
1667         }
1668
1669         if (i_port[strlen(i_port) - 1] == '\n')
1670                 i_port[strlen(i_port) - 1] = '\0';
1671
1672         ret = tcm_usbg_make_nexus(tpg, &i_port[4]);
1673         if (ret < 0)
1674                 return ret;
1675         return count;
1676 }
1677 TF_TPG_BASE_ATTR(tcm_usbg, nexus, S_IRUGO | S_IWUSR);
1678
1679 static struct configfs_attribute *usbg_base_attrs[] = {
1680         &tcm_usbg_tpg_enable.attr,
1681         &tcm_usbg_tpg_nexus.attr,
1682         NULL,
1683 };
1684
1685 static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1686 {
1687         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1688
1689         atomic_inc(&tpg->tpg_port_count);
1690         smp_mb__after_atomic();
1691         return 0;
1692 }
1693
1694 static void usbg_port_unlink(struct se_portal_group *se_tpg,
1695                 struct se_lun *se_lun)
1696 {
1697         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1698
1699         atomic_dec(&tpg->tpg_port_count);
1700         smp_mb__after_atomic();
1701 }
1702
1703 static int usbg_check_stop_free(struct se_cmd *se_cmd)
1704 {
1705         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1706                         se_cmd);
1707
1708         kref_put(&cmd->ref, usbg_cmd_release);
1709         return 1;
1710 }
1711
1712 static const struct target_core_fabric_ops usbg_ops = {
1713         .module                         = THIS_MODULE,
1714         .name                           = "usb_gadget",
1715         .get_fabric_name                = usbg_get_fabric_name,
1716         .tpg_get_wwn                    = usbg_get_fabric_wwn,
1717         .tpg_get_tag                    = usbg_get_tag,
1718         .tpg_check_demo_mode            = usbg_check_true,
1719         .tpg_check_demo_mode_cache      = usbg_check_false,
1720         .tpg_check_demo_mode_write_protect = usbg_check_false,
1721         .tpg_check_prod_mode_write_protect = usbg_check_false,
1722         .tpg_get_inst_index             = usbg_tpg_get_inst_index,
1723         .release_cmd                    = usbg_release_cmd,
1724         .shutdown_session               = usbg_shutdown_session,
1725         .close_session                  = usbg_close_session,
1726         .sess_get_index                 = usbg_sess_get_index,
1727         .sess_get_initiator_sid         = NULL,
1728         .write_pending                  = usbg_send_write_request,
1729         .write_pending_status           = usbg_write_pending_status,
1730         .set_default_node_attributes    = usbg_set_default_node_attrs,
1731         .get_cmd_state                  = usbg_get_cmd_state,
1732         .queue_data_in                  = usbg_send_read_response,
1733         .queue_status                   = usbg_send_status_response,
1734         .queue_tm_rsp                   = usbg_queue_tm_rsp,
1735         .aborted_task                   = usbg_aborted_task,
1736         .check_stop_free                = usbg_check_stop_free,
1737
1738         .fabric_make_wwn                = usbg_make_tport,
1739         .fabric_drop_wwn                = usbg_drop_tport,
1740         .fabric_make_tpg                = usbg_make_tpg,
1741         .fabric_drop_tpg                = usbg_drop_tpg,
1742         .fabric_post_link               = usbg_port_link,
1743         .fabric_pre_unlink              = usbg_port_unlink,
1744         .fabric_init_nodeacl            = usbg_init_nodeacl,
1745
1746         .tfc_wwn_attrs                  = usbg_wwn_attrs,
1747         .tfc_tpg_base_attrs             = usbg_base_attrs,
1748 };
1749
1750 /* Start gadget.c code */
1751
1752 static struct usb_interface_descriptor bot_intf_desc = {
1753         .bLength =              sizeof(bot_intf_desc),
1754         .bDescriptorType =      USB_DT_INTERFACE,
1755         .bNumEndpoints =        2,
1756         .bAlternateSetting =    USB_G_ALT_INT_BBB,
1757         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1758         .bInterfaceSubClass =   USB_SC_SCSI,
1759         .bInterfaceProtocol =   USB_PR_BULK,
1760 };
1761
1762 static struct usb_interface_descriptor uasp_intf_desc = {
1763         .bLength =              sizeof(uasp_intf_desc),
1764         .bDescriptorType =      USB_DT_INTERFACE,
1765         .bNumEndpoints =        4,
1766         .bAlternateSetting =    USB_G_ALT_INT_UAS,
1767         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1768         .bInterfaceSubClass =   USB_SC_SCSI,
1769         .bInterfaceProtocol =   USB_PR_UAS,
1770 };
1771
1772 static struct usb_endpoint_descriptor uasp_bi_desc = {
1773         .bLength =              USB_DT_ENDPOINT_SIZE,
1774         .bDescriptorType =      USB_DT_ENDPOINT,
1775         .bEndpointAddress =     USB_DIR_IN,
1776         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1777         .wMaxPacketSize =       cpu_to_le16(512),
1778 };
1779
1780 static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1781         .bLength =              USB_DT_ENDPOINT_SIZE,
1782         .bDescriptorType =      USB_DT_ENDPOINT,
1783         .bEndpointAddress =     USB_DIR_IN,
1784         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1785 };
1786
1787 static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1788         .bLength =              sizeof(uasp_bi_pipe_desc),
1789         .bDescriptorType =      USB_DT_PIPE_USAGE,
1790         .bPipeID =              DATA_IN_PIPE_ID,
1791 };
1792
1793 static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1794         .bLength =              USB_DT_ENDPOINT_SIZE,
1795         .bDescriptorType =      USB_DT_ENDPOINT,
1796         .bEndpointAddress =     USB_DIR_IN,
1797         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1798         .wMaxPacketSize =       cpu_to_le16(1024),
1799 };
1800
1801 static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1802         .bLength =              sizeof(uasp_bi_ep_comp_desc),
1803         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1804         .bMaxBurst =            0,
1805         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1806         .wBytesPerInterval =    0,
1807 };
1808
1809 static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1810         .bLength =              sizeof(bot_bi_ep_comp_desc),
1811         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1812         .bMaxBurst =            0,
1813 };
1814
1815 static struct usb_endpoint_descriptor uasp_bo_desc = {
1816         .bLength =              USB_DT_ENDPOINT_SIZE,
1817         .bDescriptorType =      USB_DT_ENDPOINT,
1818         .bEndpointAddress =     USB_DIR_OUT,
1819         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1820         .wMaxPacketSize =       cpu_to_le16(512),
1821 };
1822
1823 static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1824         .bLength =              USB_DT_ENDPOINT_SIZE,
1825         .bDescriptorType =      USB_DT_ENDPOINT,
1826         .bEndpointAddress =     USB_DIR_OUT,
1827         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1828 };
1829
1830 static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1831         .bLength =              sizeof(uasp_bo_pipe_desc),
1832         .bDescriptorType =      USB_DT_PIPE_USAGE,
1833         .bPipeID =              DATA_OUT_PIPE_ID,
1834 };
1835
1836 static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1837         .bLength =              USB_DT_ENDPOINT_SIZE,
1838         .bDescriptorType =      USB_DT_ENDPOINT,
1839         .bEndpointAddress =     USB_DIR_OUT,
1840         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1841         .wMaxPacketSize =       cpu_to_le16(0x400),
1842 };
1843
1844 static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1845         .bLength =              sizeof(uasp_bo_ep_comp_desc),
1846         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1847         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1848 };
1849
1850 static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1851         .bLength =              sizeof(bot_bo_ep_comp_desc),
1852         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1853 };
1854
1855 static struct usb_endpoint_descriptor uasp_status_desc = {
1856         .bLength =              USB_DT_ENDPOINT_SIZE,
1857         .bDescriptorType =      USB_DT_ENDPOINT,
1858         .bEndpointAddress =     USB_DIR_IN,
1859         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1860         .wMaxPacketSize =       cpu_to_le16(512),
1861 };
1862
1863 static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1864         .bLength =              USB_DT_ENDPOINT_SIZE,
1865         .bDescriptorType =      USB_DT_ENDPOINT,
1866         .bEndpointAddress =     USB_DIR_IN,
1867         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1868 };
1869
1870 static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1871         .bLength =              sizeof(uasp_status_pipe_desc),
1872         .bDescriptorType =      USB_DT_PIPE_USAGE,
1873         .bPipeID =              STATUS_PIPE_ID,
1874 };
1875
1876 static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1877         .bLength =              USB_DT_ENDPOINT_SIZE,
1878         .bDescriptorType =      USB_DT_ENDPOINT,
1879         .bEndpointAddress =     USB_DIR_IN,
1880         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1881         .wMaxPacketSize =       cpu_to_le16(1024),
1882 };
1883
1884 static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1885         .bLength =              sizeof(uasp_status_in_ep_comp_desc),
1886         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1887         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1888 };
1889
1890 static struct usb_endpoint_descriptor uasp_cmd_desc = {
1891         .bLength =              USB_DT_ENDPOINT_SIZE,
1892         .bDescriptorType =      USB_DT_ENDPOINT,
1893         .bEndpointAddress =     USB_DIR_OUT,
1894         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1895         .wMaxPacketSize =       cpu_to_le16(512),
1896 };
1897
1898 static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1899         .bLength =              USB_DT_ENDPOINT_SIZE,
1900         .bDescriptorType =      USB_DT_ENDPOINT,
1901         .bEndpointAddress =     USB_DIR_OUT,
1902         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1903 };
1904
1905 static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1906         .bLength =              sizeof(uasp_cmd_pipe_desc),
1907         .bDescriptorType =      USB_DT_PIPE_USAGE,
1908         .bPipeID =              CMD_PIPE_ID,
1909 };
1910
1911 static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1912         .bLength =              USB_DT_ENDPOINT_SIZE,
1913         .bDescriptorType =      USB_DT_ENDPOINT,
1914         .bEndpointAddress =     USB_DIR_OUT,
1915         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1916         .wMaxPacketSize =       cpu_to_le16(1024),
1917 };
1918
1919 static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1920         .bLength =              sizeof(uasp_cmd_comp_desc),
1921         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1922 };
1923
1924 static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1925         (struct usb_descriptor_header *) &bot_intf_desc,
1926         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1927         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1928
1929         (struct usb_descriptor_header *) &uasp_intf_desc,
1930         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1931         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1932         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1933         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1934         (struct usb_descriptor_header *) &uasp_fs_status_desc,
1935         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1936         (struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1937         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1938         NULL,
1939 };
1940
1941 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1942         (struct usb_descriptor_header *) &bot_intf_desc,
1943         (struct usb_descriptor_header *) &uasp_bi_desc,
1944         (struct usb_descriptor_header *) &uasp_bo_desc,
1945
1946         (struct usb_descriptor_header *) &uasp_intf_desc,
1947         (struct usb_descriptor_header *) &uasp_bi_desc,
1948         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1949         (struct usb_descriptor_header *) &uasp_bo_desc,
1950         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1951         (struct usb_descriptor_header *) &uasp_status_desc,
1952         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1953         (struct usb_descriptor_header *) &uasp_cmd_desc,
1954         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1955         NULL,
1956 };
1957
1958 static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1959         (struct usb_descriptor_header *) &bot_intf_desc,
1960         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
1961         (struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1962         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
1963         (struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1964
1965         (struct usb_descriptor_header *) &uasp_intf_desc,
1966         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
1967         (struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
1968         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1969         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
1970         (struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
1971         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1972         (struct usb_descriptor_header *) &uasp_ss_status_desc,
1973         (struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
1974         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1975         (struct usb_descriptor_header *) &uasp_ss_cmd_desc,
1976         (struct usb_descriptor_header *) &uasp_cmd_comp_desc,
1977         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1978         NULL,
1979 };
1980
1981 #define UAS_VENDOR_ID   0x0525  /* NetChip */
1982 #define UAS_PRODUCT_ID  0xa4a5  /* Linux-USB File-backed Storage Gadget */
1983
1984 static struct usb_device_descriptor usbg_device_desc = {
1985         .bLength =              sizeof(usbg_device_desc),
1986         .bDescriptorType =      USB_DT_DEVICE,
1987         .bcdUSB =               cpu_to_le16(0x0200),
1988         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
1989         .idVendor =             cpu_to_le16(UAS_VENDOR_ID),
1990         .idProduct =            cpu_to_le16(UAS_PRODUCT_ID),
1991         .bNumConfigurations =   1,
1992 };
1993
1994 static struct usb_string        usbg_us_strings[] = {
1995         [USB_GADGET_MANUFACTURER_IDX].s = "Target Manufactor",
1996         [USB_GADGET_PRODUCT_IDX].s      = "Target Product",
1997         [USB_GADGET_SERIAL_IDX].s       = "000000000001",
1998         [USB_G_STR_CONFIG].s            = "default config",
1999         [USB_G_STR_INT_UAS].s           = "USB Attached SCSI",
2000         [USB_G_STR_INT_BBB].s           = "Bulk Only Transport",
2001         { },
2002 };
2003
2004 static struct usb_gadget_strings usbg_stringtab = {
2005         .language = 0x0409,
2006         .strings = usbg_us_strings,
2007 };
2008
2009 static struct usb_gadget_strings *usbg_strings[] = {
2010         &usbg_stringtab,
2011         NULL,
2012 };
2013
2014 static int guas_unbind(struct usb_composite_dev *cdev)
2015 {
2016         return 0;
2017 }
2018
2019 static struct usb_configuration usbg_config_driver = {
2020         .label                  = "Linux Target",
2021         .bConfigurationValue    = 1,
2022         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
2023 };
2024
2025 static void give_back_ep(struct usb_ep **pep)
2026 {
2027         struct usb_ep *ep = *pep;
2028         if (!ep)
2029                 return;
2030         ep->driver_data = NULL;
2031 }
2032
2033 static int usbg_bind(struct usb_configuration *c, struct usb_function *f)
2034 {
2035         struct f_uas            *fu = to_f_uas(f);
2036         struct usb_gadget       *gadget = c->cdev->gadget;
2037         struct usb_ep           *ep;
2038         int                     iface;
2039         int                     ret;
2040
2041         iface = usb_interface_id(c, f);
2042         if (iface < 0)
2043                 return iface;
2044
2045         bot_intf_desc.bInterfaceNumber = iface;
2046         uasp_intf_desc.bInterfaceNumber = iface;
2047         fu->iface = iface;
2048         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc,
2049                         &uasp_bi_ep_comp_desc);
2050         if (!ep)
2051                 goto ep_fail;
2052
2053         ep->driver_data = fu;
2054         fu->ep_in = ep;
2055
2056         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc,
2057                         &uasp_bo_ep_comp_desc);
2058         if (!ep)
2059                 goto ep_fail;
2060         ep->driver_data = fu;
2061         fu->ep_out = ep;
2062
2063         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc,
2064                         &uasp_status_in_ep_comp_desc);
2065         if (!ep)
2066                 goto ep_fail;
2067         ep->driver_data = fu;
2068         fu->ep_status = ep;
2069
2070         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc,
2071                         &uasp_cmd_comp_desc);
2072         if (!ep)
2073                 goto ep_fail;
2074         ep->driver_data = fu;
2075         fu->ep_cmd = ep;
2076
2077         /* Assume endpoint addresses are the same for both speeds */
2078         uasp_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2079         uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2080         uasp_status_desc.bEndpointAddress =
2081                 uasp_ss_status_desc.bEndpointAddress;
2082         uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2083
2084         uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2085         uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2086         uasp_fs_status_desc.bEndpointAddress =
2087                 uasp_ss_status_desc.bEndpointAddress;
2088         uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2089
2090         ret = usb_assign_descriptors(f, uasp_fs_function_desc,
2091                         uasp_hs_function_desc, uasp_ss_function_desc);
2092         if (ret)
2093                 goto ep_fail;
2094
2095         return 0;
2096 ep_fail:
2097         pr_err("Can't claim all required eps\n");
2098
2099         give_back_ep(&fu->ep_in);
2100         give_back_ep(&fu->ep_out);
2101         give_back_ep(&fu->ep_status);
2102         give_back_ep(&fu->ep_cmd);
2103         return -ENOTSUPP;
2104 }
2105
2106 static void usbg_unbind(struct usb_configuration *c, struct usb_function *f)
2107 {
2108         struct f_uas *fu = to_f_uas(f);
2109
2110         usb_free_all_descriptors(f);
2111         kfree(fu);
2112 }
2113
2114 struct guas_setup_wq {
2115         struct work_struct work;
2116         struct f_uas *fu;
2117         unsigned int alt;
2118 };
2119
2120 static void usbg_delayed_set_alt(struct work_struct *wq)
2121 {
2122         struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
2123                         work);
2124         struct f_uas *fu = work->fu;
2125         int alt = work->alt;
2126
2127         kfree(work);
2128
2129         if (fu->flags & USBG_IS_BOT)
2130                 bot_cleanup_old_alt(fu);
2131         if (fu->flags & USBG_IS_UAS)
2132                 uasp_cleanup_old_alt(fu);
2133
2134         if (alt == USB_G_ALT_INT_BBB)
2135                 bot_set_alt(fu);
2136         else if (alt == USB_G_ALT_INT_UAS)
2137                 uasp_set_alt(fu);
2138         usb_composite_setup_continue(fu->function.config->cdev);
2139 }
2140
2141 static int usbg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2142 {
2143         struct f_uas *fu = to_f_uas(f);
2144
2145         if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2146                 struct guas_setup_wq *work;
2147
2148                 work = kmalloc(sizeof(*work), GFP_ATOMIC);
2149                 if (!work)
2150                         return -ENOMEM;
2151                 INIT_WORK(&work->work, usbg_delayed_set_alt);
2152                 work->fu = fu;
2153                 work->alt = alt;
2154                 schedule_work(&work->work);
2155                 return USB_GADGET_DELAYED_STATUS;
2156         }
2157         return -EOPNOTSUPP;
2158 }
2159
2160 static void usbg_disable(struct usb_function *f)
2161 {
2162         struct f_uas *fu = to_f_uas(f);
2163
2164         if (fu->flags & USBG_IS_UAS)
2165                 uasp_cleanup_old_alt(fu);
2166         else if (fu->flags & USBG_IS_BOT)
2167                 bot_cleanup_old_alt(fu);
2168         fu->flags = 0;
2169 }
2170
2171 static int usbg_setup(struct usb_function *f,
2172                 const struct usb_ctrlrequest *ctrl)
2173 {
2174         struct f_uas *fu = to_f_uas(f);
2175
2176         if (!(fu->flags & USBG_IS_BOT))
2177                 return -EOPNOTSUPP;
2178
2179         return usbg_bot_setup(f, ctrl);
2180 }
2181
2182 static int usbg_cfg_bind(struct usb_configuration *c)
2183 {
2184         struct f_uas *fu;
2185         int ret;
2186
2187         fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2188         if (!fu)
2189                 return -ENOMEM;
2190         fu->function.name = "Target Function";
2191         fu->function.bind = usbg_bind;
2192         fu->function.unbind = usbg_unbind;
2193         fu->function.set_alt = usbg_set_alt;
2194         fu->function.setup = usbg_setup;
2195         fu->function.disable = usbg_disable;
2196         fu->tpg = the_only_tpg_I_currently_have;
2197
2198         bot_intf_desc.iInterface = usbg_us_strings[USB_G_STR_INT_BBB].id;
2199         uasp_intf_desc.iInterface = usbg_us_strings[USB_G_STR_INT_UAS].id;
2200
2201         ret = usb_add_function(c, &fu->function);
2202         if (ret)
2203                 goto err;
2204
2205         return 0;
2206 err:
2207         kfree(fu);
2208         return ret;
2209 }
2210
2211 static int usb_target_bind(struct usb_composite_dev *cdev)
2212 {
2213         int ret;
2214
2215         ret = usb_string_ids_tab(cdev, usbg_us_strings);
2216         if (ret)
2217                 return ret;
2218
2219         usbg_device_desc.iManufacturer =
2220                 usbg_us_strings[USB_GADGET_MANUFACTURER_IDX].id;
2221         usbg_device_desc.iProduct = usbg_us_strings[USB_GADGET_PRODUCT_IDX].id;
2222         usbg_device_desc.iSerialNumber =
2223                 usbg_us_strings[USB_GADGET_SERIAL_IDX].id;
2224         usbg_config_driver.iConfiguration =
2225                 usbg_us_strings[USB_G_STR_CONFIG].id;
2226
2227         ret = usb_add_config(cdev, &usbg_config_driver,
2228                         usbg_cfg_bind);
2229         if (ret)
2230                 return ret;
2231         usb_composite_overwrite_options(cdev, &coverwrite);
2232         return 0;
2233 }
2234
2235 static __refdata struct usb_composite_driver usbg_driver = {
2236         .name           = "g_target",
2237         .dev            = &usbg_device_desc,
2238         .strings        = usbg_strings,
2239         .max_speed      = USB_SPEED_SUPER,
2240         .bind           = usb_target_bind,
2241         .unbind         = guas_unbind,
2242 };
2243
2244 static int usbg_attach(struct usbg_tpg *tpg)
2245 {
2246         return usb_composite_probe(&usbg_driver);
2247 }
2248
2249 static void usbg_detach(struct usbg_tpg *tpg)
2250 {
2251         usb_composite_unregister(&usbg_driver);
2252 }
2253
2254 static int __init usb_target_gadget_init(void)
2255 {
2256         return target_register_template(&usbg_ops);
2257 }
2258 module_init(usb_target_gadget_init);
2259
2260 static void __exit usb_target_gadget_exit(void)
2261 {
2262         target_unregister_template(&usbg_ops);
2263 }
2264 module_exit(usb_target_gadget_exit);
2265
2266 MODULE_AUTHOR("Sebastian Andrzej Siewior <bigeasy@linutronix.de>");
2267 MODULE_DESCRIPTION("usb-gadget fabric");
2268 MODULE_LICENSE("GPL v2");