drivers/usb/gadget/legacy/tcm_usb_gadget.c

   1 /* Target based USB-Gadget
   2  *
   3  * UAS protocol handling, target callbacks, configfs handling,
   4  * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
   5  *
   6  * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
   7  * License: GPLv2 as published by FSF.
   8  */
   9 #include <linux/kernel.h>
  10 #include <linux/module.h>
  11 #include <linux/types.h>
  12 #include <linux/string.h>
  13 #include <linux/configfs.h>
  14 #include <linux/ctype.h>
  15 #include <linux/usb/ch9.h>
  16 #include <linux/usb/composite.h>
  17 #include <linux/usb/gadget.h>
  18 #include <linux/usb/storage.h>
  19 #include <scsi/scsi_tcq.h>
  20 #include <target/target_core_base.h>
  21 #include <target/target_core_fabric.h>
  22 #include <target/target_core_fabric_configfs.h>
  23 #include <target/configfs_macros.h>
  24 #include <asm/unaligned.h>
  25
  26 #include "tcm_usb_gadget.h"
  27
  28 USB_GADGET_COMPOSITE_OPTIONS();
  29
  30 static inline struct f_uas *to_f_uas(struct usb_function *f)
  31 {
  32         return container_of(f, struct f_uas, function);
  33 }
  34
  35 static void usbg_cmd_release(struct kref *);
  36
  37 static inline void usbg_cleanup_cmd(struct usbg_cmd *cmd)
  38 {
  39         kref_put(&cmd->ref, usbg_cmd_release);
  40 }
  41
  42 /* Start bot.c code */
  43
  44 static int bot_enqueue_cmd_cbw(struct f_uas *fu)
  45 {
  46         int ret;
  47
  48         if (fu->flags & USBG_BOT_CMD_PEND)
  49                 return 0;
  50
  51         ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
  52         if (!ret)
  53                 fu->flags |= USBG_BOT_CMD_PEND;
  54         return ret;
  55 }
  56
  57 static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
  58 {
  59         struct usbg_cmd *cmd = req->context;
  60         struct f_uas *fu = cmd->fu;
  61
  62         usbg_cleanup_cmd(cmd);
  63         if (req->status < 0) {
  64                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
  65                 return;
  66         }
  67
  68         /* CSW completed, wait for next CBW */
  69         bot_enqueue_cmd_cbw(fu);
  70 }
  71
  72 static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
  73 {
  74         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
  75         int ret;
  76         u8 *sense;
  77         unsigned int csw_stat;
  78
  79         csw_stat = cmd->csw_code;
  80
  81         /*
  82          * We can't send SENSE as a response. So we take ASC & ASCQ from our
  83          * sense buffer and queue it and hope the host sends a REQUEST_SENSE
  84          * command where it learns why we failed.
  85          */
  86         sense = cmd->sense_iu.sense;
  87
  88         csw->Tag = cmd->bot_tag;
  89         csw->Status = csw_stat;
  90         fu->bot_status.req->context = cmd;
  91         ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
  92         if (ret)
  93                 pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
  94 }
  95
  96 static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
  97 {
  98         struct usbg_cmd *cmd = req->context;
  99         struct f_uas *fu = cmd->fu;
 100
 101         if (req->status < 0)
 102                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 103
 104         if (cmd->data_len) {
 105                 if (cmd->data_len > ep->maxpacket) {
 106                         req->length = ep->maxpacket;
 107                         cmd->data_len -= ep->maxpacket;
 108                 } else {
 109                         req->length = cmd->data_len;
 110                         cmd->data_len = 0;
 111                 }
 112
 113                 usb_ep_queue(ep, req, GFP_ATOMIC);
 114                 return ;
 115         }
 116         bot_enqueue_sense_code(fu, cmd);
 117 }
 118
 119 static void bot_send_bad_status(struct usbg_cmd *cmd)
 120 {
 121         struct f_uas *fu = cmd->fu;
 122         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 123         struct usb_request *req;
 124         struct usb_ep *ep;
 125
 126         csw->Residue = cpu_to_le32(cmd->data_len);
 127
 128         if (cmd->data_len) {
 129                 if (cmd->is_read) {
 130                         ep = fu->ep_in;
 131                         req = fu->bot_req_in;
 132                 } else {
 133                         ep = fu->ep_out;
 134                         req = fu->bot_req_out;
 135                 }
 136
 137                 if (cmd->data_len > fu->ep_in->maxpacket) {
 138                         req->length = ep->maxpacket;
 139                         cmd->data_len -= ep->maxpacket;
 140                 } else {
 141                         req->length = cmd->data_len;
 142                         cmd->data_len = 0;
 143                 }
 144                 req->complete = bot_err_compl;
 145                 req->context = cmd;
 146                 req->buf = fu->cmd.buf;
 147                 usb_ep_queue(ep, req, GFP_KERNEL);
 148         } else {
 149                 bot_enqueue_sense_code(fu, cmd);
 150         }
 151 }
 152
 153 static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
 154 {
 155         struct f_uas *fu = cmd->fu;
 156         struct bulk_cs_wrap *csw = &fu->bot_status.csw;
 157         int ret;
 158
 159         if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
 160                 if (!moved_data && cmd->data_len) {
 161                         /*
 162                          * the host wants to move data, we don't. Fill / empty
 163                          * the pipe and then send the csw with reside set.
 164                          */
 165                         cmd->csw_code = US_BULK_STAT_OK;
 166                         bot_send_bad_status(cmd);
 167                         return 0;
 168                 }
 169
 170                 csw->Tag = cmd->bot_tag;
 171                 csw->Residue = cpu_to_le32(0);
 172                 csw->Status = US_BULK_STAT_OK;
 173                 fu->bot_status.req->context = cmd;
 174
 175                 ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
 176                 if (ret)
 177                         pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
 178         } else {
 179                 cmd->csw_code = US_BULK_STAT_FAIL;
 180                 bot_send_bad_status(cmd);
 181         }
 182         return 0;
 183 }
 184
 185 /*
 186  * Called after command (no data transfer) or after the write (to device)
 187  * operation is completed
 188  */
 189 static int bot_send_status_response(struct usbg_cmd *cmd)
 190 {
 191         bool moved_data = false;
 192
 193         if (!cmd->is_read)
 194                 moved_data = true;
 195         return bot_send_status(cmd, moved_data);
 196 }
 197
 198 /* Read request completed, now we have to send the CSW */
 199 static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
 200 {
 201         struct usbg_cmd *cmd = req->context;
 202
 203         if (req->status < 0)
 204                 pr_err("ERR %s(%d)\n", __func__, __LINE__);
 205
 206         bot_send_status(cmd, true);
 207 }
 208
 209 static int bot_send_read_response(struct usbg_cmd *cmd)
 210 {
 211         struct f_uas *fu = cmd->fu;
 212         struct se_cmd *se_cmd = &cmd->se_cmd;
 213         struct usb_gadget *gadget = fuas_to_gadget(fu);
 214         int ret;
 215
 216         if (!cmd->data_len) {
 217                 cmd->csw_code = US_BULK_STAT_PHASE;
 218                 bot_send_bad_status(cmd);
 219                 return 0;
 220         }
 221
 222         if (!gadget->sg_supported) {
 223                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 224                 if (!cmd->data_buf)
 225                         return -ENOMEM;
 226
 227                 sg_copy_to_buffer(se_cmd->t_data_sg,
 228                                 se_cmd->t_data_nents,
 229                                 cmd->data_buf,
 230                                 se_cmd->data_length);
 231
 232                 fu->bot_req_in->buf = cmd->data_buf;
 233         } else {
 234                 fu->bot_req_in->buf = NULL;
 235                 fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
 236                 fu->bot_req_in->sg = se_cmd->t_data_sg;
 237         }
 238
 239         fu->bot_req_in->complete = bot_read_compl;
 240         fu->bot_req_in->length = se_cmd->data_length;
 241         fu->bot_req_in->context = cmd;
 242         ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
 243         if (ret)
 244                 pr_err("%s(%d)\n", __func__, __LINE__);
 245         return 0;
 246 }
 247
 248 static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
 249 static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
 250
 251 static int bot_send_write_request(struct usbg_cmd *cmd)
 252 {
 253         struct f_uas *fu = cmd->fu;
 254         struct se_cmd *se_cmd = &cmd->se_cmd;
 255         struct usb_gadget *gadget = fuas_to_gadget(fu);
 256         int ret;
 257
 258         init_completion(&cmd->write_complete);
 259         cmd->fu = fu;
 260
 261         if (!cmd->data_len) {
 262                 cmd->csw_code = US_BULK_STAT_PHASE;
 263                 return -EINVAL;
 264         }
 265
 266         if (!gadget->sg_supported) {
 267                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL);
 268                 if (!cmd->data_buf)
 269                         return -ENOMEM;
 270
 271                 fu->bot_req_out->buf = cmd->data_buf;
 272         } else {
 273                 fu->bot_req_out->buf = NULL;
 274                 fu->bot_req_out->num_sgs = se_cmd->t_data_nents;
 275                 fu->bot_req_out->sg = se_cmd->t_data_sg;
 276         }
 277
 278         fu->bot_req_out->complete = usbg_data_write_cmpl;
 279         fu->bot_req_out->length = se_cmd->data_length;
 280         fu->bot_req_out->context = cmd;
 281
 282         ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
 283         if (ret)
 284                 goto cleanup;
 285         ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
 286         if (ret)
 287                 pr_err("%s(%d)\n", __func__, __LINE__);
 288
 289         wait_for_completion(&cmd->write_complete);
 290         target_execute_cmd(se_cmd);
 291 cleanup:
 292         return ret;
 293 }
 294
 295 static int bot_submit_command(struct f_uas *, void *, unsigned int);
 296
 297 static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 298 {
 299         struct f_uas *fu = req->context;
 300         int ret;
 301
 302         fu->flags &= ~USBG_BOT_CMD_PEND;
 303
 304         if (req->status < 0)
 305                 return;
 306
 307         ret = bot_submit_command(fu, req->buf, req->actual);
 308         if (ret)
 309                 pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
 310 }
 311
 312 static int bot_prepare_reqs(struct f_uas *fu)
 313 {
 314         int ret;
 315
 316         fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 317         if (!fu->bot_req_in)
 318                 goto err;
 319
 320         fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 321         if (!fu->bot_req_out)
 322                 goto err_out;
 323
 324         fu->cmd.req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 325         if (!fu->cmd.req)
 326                 goto err_cmd;
 327
 328         fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 329         if (!fu->bot_status.req)
 330                 goto err_sts;
 331
 332         fu->bot_status.req->buf = &fu->bot_status.csw;
 333         fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
 334         fu->bot_status.req->complete = bot_status_complete;
 335         fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
 336
 337         fu->cmd.buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
 338         if (!fu->cmd.buf)
 339                 goto err_buf;
 340
 341         fu->cmd.req->complete = bot_cmd_complete;
 342         fu->cmd.req->buf = fu->cmd.buf;
 343         fu->cmd.req->length = fu->ep_out->maxpacket;
 344         fu->cmd.req->context = fu;
 345
 346         ret = bot_enqueue_cmd_cbw(fu);
 347         if (ret)
 348                 goto err_queue;
 349         return 0;
 350 err_queue:
 351         kfree(fu->cmd.buf);
 352         fu->cmd.buf = NULL;
 353 err_buf:
 354         usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 355 err_sts:
 356         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 357         fu->cmd.req = NULL;
 358 err_cmd:
 359         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 360         fu->bot_req_out = NULL;
 361 err_out:
 362         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 363         fu->bot_req_in = NULL;
 364 err:
 365         pr_err("BOT: endpoint setup failed\n");
 366         return -ENOMEM;
 367 }
 368
 369 static void bot_cleanup_old_alt(struct f_uas *fu)
 370 {
 371         if (!(fu->flags & USBG_ENABLED))
 372                 return;
 373
 374         usb_ep_disable(fu->ep_in);
 375         usb_ep_disable(fu->ep_out);
 376
 377         if (!fu->bot_req_in)
 378                 return;
 379
 380         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
 381         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
 382         usb_ep_free_request(fu->ep_out, fu->cmd.req);
 383         usb_ep_free_request(fu->ep_out, fu->bot_status.req);
 384
 385         kfree(fu->cmd.buf);
 386
 387         fu->bot_req_in = NULL;
 388         fu->bot_req_out = NULL;
 389         fu->cmd.req = NULL;
 390         fu->bot_status.req = NULL;
 391         fu->cmd.buf = NULL;
 392 }
 393
 394 static void bot_set_alt(struct f_uas *fu)
 395 {
 396         struct usb_function *f = &fu->function;
 397         struct usb_gadget *gadget = f->config->cdev->gadget;
 398         int ret;
 399
 400         fu->flags = USBG_IS_BOT;
 401
 402         config_ep_by_speed(gadget, f, fu->ep_in);
 403         ret = usb_ep_enable(fu->ep_in);
 404         if (ret)
 405                 goto err_b_in;
 406
 407         config_ep_by_speed(gadget, f, fu->ep_out);
 408         ret = usb_ep_enable(fu->ep_out);
 409         if (ret)
 410                 goto err_b_out;
 411
 412         ret = bot_prepare_reqs(fu);
 413         if (ret)
 414                 goto err_wq;
 415         fu->flags |= USBG_ENABLED;
 416         pr_info("Using the BOT protocol\n");
 417         return;
 418 err_wq:
 419         usb_ep_disable(fu->ep_out);
 420 err_b_out:
 421         usb_ep_disable(fu->ep_in);
 422 err_b_in:
 423         fu->flags = USBG_IS_BOT;
 424 }
 425
 426 static int usbg_bot_setup(struct usb_function *f,
 427                 const struct usb_ctrlrequest *ctrl)
 428 {
 429         struct f_uas *fu = to_f_uas(f);
 430         struct usb_composite_dev *cdev = f->config->cdev;
 431         u16 w_value = le16_to_cpu(ctrl->wValue);
 432         u16 w_length = le16_to_cpu(ctrl->wLength);
 433         int luns;
 434         u8 *ret_lun;
 435
 436         switch (ctrl->bRequest) {
 437         case US_BULK_GET_MAX_LUN:
 438                 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
 439                                         USB_RECIP_INTERFACE))
 440                         return -ENOTSUPP;
 441
 442                 if (w_length < 1)
 443                         return -EINVAL;
 444                 if (w_value != 0)
 445                         return -EINVAL;
 446                 luns = atomic_read(&fu->tpg->tpg_port_count);
 447                 if (!luns) {
 448                         pr_err("No LUNs configured?\n");
 449                         return -EINVAL;
 450                 }
 451                 /*
 452                  * If 4 LUNs are present we return 3 i.e. LUN 0..3 can be
 453                  * accessed. The upper limit is 0xf
 454                  */
 455                 luns--;
 456                 if (luns > 0xf) {
 457                         pr_info_once("Limiting the number of luns to 16\n");
 458                         luns = 0xf;
 459                 }
 460                 ret_lun = cdev->req->buf;
 461                 *ret_lun = luns;
 462                 cdev->req->length = 1;
 463                 return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
 464                 break;
 465
 466         case US_BULK_RESET_REQUEST:
 467                 /* XXX maybe we should remove previous requests for IN + OUT */
 468                 bot_enqueue_cmd_cbw(fu);
 469                 return 0;
 470                 break;
 471         }
 472         return -ENOTSUPP;
 473 }
 474
 475 /* Start uas.c code */
 476
 477 static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
 478 {
 479         /* We have either all three allocated or none */
 480         if (!stream->req_in)
 481                 return;
 482
 483         usb_ep_free_request(fu->ep_in, stream->req_in);
 484         usb_ep_free_request(fu->ep_out, stream->req_out);
 485         usb_ep_free_request(fu->ep_status, stream->req_status);
 486
 487         stream->req_in = NULL;
 488         stream->req_out = NULL;
 489         stream->req_status = NULL;
 490 }
 491
 492 static void uasp_free_cmdreq(struct f_uas *fu)
 493 {
 494         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 495         kfree(fu->cmd.buf);
 496         fu->cmd.req = NULL;
 497         fu->cmd.buf = NULL;
 498 }
 499
 500 static void uasp_cleanup_old_alt(struct f_uas *fu)
 501 {
 502         int i;
 503
 504         if (!(fu->flags & USBG_ENABLED))
 505                 return;
 506
 507         usb_ep_disable(fu->ep_in);
 508         usb_ep_disable(fu->ep_out);
 509         usb_ep_disable(fu->ep_status);
 510         usb_ep_disable(fu->ep_cmd);
 511
 512         for (i = 0; i < UASP_SS_EP_COMP_NUM_STREAMS; i++)
 513                 uasp_cleanup_one_stream(fu, &fu->stream[i]);
 514         uasp_free_cmdreq(fu);
 515 }
 516
 517 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
 518
 519 static int uasp_prepare_r_request(struct usbg_cmd *cmd)
 520 {
 521         struct se_cmd *se_cmd = &cmd->se_cmd;
 522         struct f_uas *fu = cmd->fu;
 523         struct usb_gadget *gadget = fuas_to_gadget(fu);
 524         struct uas_stream *stream = cmd->stream;
 525
 526         if (!gadget->sg_supported) {
 527                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 528                 if (!cmd->data_buf)
 529                         return -ENOMEM;
 530
 531                 sg_copy_to_buffer(se_cmd->t_data_sg,
 532                                 se_cmd->t_data_nents,
 533                                 cmd->data_buf,
 534                                 se_cmd->data_length);
 535
 536                 stream->req_in->buf = cmd->data_buf;
 537         } else {
 538                 stream->req_in->buf = NULL;
 539                 stream->req_in->num_sgs = se_cmd->t_data_nents;
 540                 stream->req_in->sg = se_cmd->t_data_sg;
 541         }
 542
 543         stream->req_in->complete = uasp_status_data_cmpl;
 544         stream->req_in->length = se_cmd->data_length;
 545         stream->req_in->context = cmd;
 546
 547         cmd->state = UASP_SEND_STATUS;
 548         return 0;
 549 }
 550
 551 static void uasp_prepare_status(struct usbg_cmd *cmd)
 552 {
 553         struct se_cmd *se_cmd = &cmd->se_cmd;
 554         struct sense_iu *iu = &cmd->sense_iu;
 555         struct uas_stream *stream = cmd->stream;
 556
 557         cmd->state = UASP_QUEUE_COMMAND;
 558         iu->iu_id = IU_ID_STATUS;
 559         iu->tag = cpu_to_be16(cmd->tag);
 560
 561         /*
 562          * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
 563          */
 564         iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
 565         iu->status = se_cmd->scsi_status;
 566         stream->req_status->context = cmd;
 567         stream->req_status->length = se_cmd->scsi_sense_length + 16;
 568         stream->req_status->buf = iu;
 569         stream->req_status->complete = uasp_status_data_cmpl;
 570 }
 571
 572 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
 573 {
 574         struct usbg_cmd *cmd = req->context;
 575         struct uas_stream *stream = cmd->stream;
 576         struct f_uas *fu = cmd->fu;
 577         int ret;
 578
 579         if (req->status < 0)
 580                 goto cleanup;
 581
 582         switch (cmd->state) {
 583         case UASP_SEND_DATA:
 584                 ret = uasp_prepare_r_request(cmd);
 585                 if (ret)
 586                         goto cleanup;
 587                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 588                 if (ret)
 589                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 590                 break;
 591
 592         case UASP_RECEIVE_DATA:
 593                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 594                 if (ret)
 595                         goto cleanup;
 596                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 597                 if (ret)
 598                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 599                 break;
 600
 601         case UASP_SEND_STATUS:
 602                 uasp_prepare_status(cmd);
 603                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 604                                 GFP_ATOMIC);
 605                 if (ret)
 606                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 607                 break;
 608
 609         case UASP_QUEUE_COMMAND:
 610                 usbg_cleanup_cmd(cmd);
 611                 usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 612                 break;
 613
 614         default:
 615                 BUG();
 616         }
 617         return;
 618
 619 cleanup:
 620         usbg_cleanup_cmd(cmd);
 621 }
 622
 623 static int uasp_send_status_response(struct usbg_cmd *cmd)
 624 {
 625         struct f_uas *fu = cmd->fu;
 626         struct uas_stream *stream = cmd->stream;
 627         struct sense_iu *iu = &cmd->sense_iu;
 628
 629         iu->tag = cpu_to_be16(cmd->tag);
 630         stream->req_status->complete = uasp_status_data_cmpl;
 631         stream->req_status->context = cmd;
 632         cmd->fu = fu;
 633         uasp_prepare_status(cmd);
 634         return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
 635 }
 636
 637 static int uasp_send_read_response(struct usbg_cmd *cmd)
 638 {
 639         struct f_uas *fu = cmd->fu;
 640         struct uas_stream *stream = cmd->stream;
 641         struct sense_iu *iu = &cmd->sense_iu;
 642         int ret;
 643
 644         cmd->fu = fu;
 645
 646         iu->tag = cpu_to_be16(cmd->tag);
 647         if (fu->flags & USBG_USE_STREAMS) {
 648
 649                 ret = uasp_prepare_r_request(cmd);
 650                 if (ret)
 651                         goto out;
 652                 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
 653                 if (ret) {
 654                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 655                         kfree(cmd->data_buf);
 656                         cmd->data_buf = NULL;
 657                 }
 658
 659         } else {
 660
 661                 iu->iu_id = IU_ID_READ_READY;
 662                 iu->tag = cpu_to_be16(cmd->tag);
 663
 664                 stream->req_status->complete = uasp_status_data_cmpl;
 665                 stream->req_status->context = cmd;
 666
 667                 cmd->state = UASP_SEND_DATA;
 668                 stream->req_status->buf = iu;
 669                 stream->req_status->length = sizeof(struct iu);
 670
 671                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 672                                 GFP_ATOMIC);
 673                 if (ret)
 674                         pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
 675         }
 676 out:
 677         return ret;
 678 }
 679
 680 static int uasp_send_write_request(struct usbg_cmd *cmd)
 681 {
 682         struct f_uas *fu = cmd->fu;
 683         struct se_cmd *se_cmd = &cmd->se_cmd;
 684         struct uas_stream *stream = cmd->stream;
 685         struct sense_iu *iu = &cmd->sense_iu;
 686         int ret;
 687
 688         init_completion(&cmd->write_complete);
 689         cmd->fu = fu;
 690
 691         iu->tag = cpu_to_be16(cmd->tag);
 692
 693         if (fu->flags & USBG_USE_STREAMS) {
 694
 695                 ret = usbg_prepare_w_request(cmd, stream->req_out);
 696                 if (ret)
 697                         goto cleanup;
 698                 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
 699                 if (ret)
 700                         pr_err("%s(%d)\n", __func__, __LINE__);
 701
 702         } else {
 703
 704                 iu->iu_id = IU_ID_WRITE_READY;
 705                 iu->tag = cpu_to_be16(cmd->tag);
 706
 707                 stream->req_status->complete = uasp_status_data_cmpl;
 708                 stream->req_status->context = cmd;
 709
 710                 cmd->state = UASP_RECEIVE_DATA;
 711                 stream->req_status->buf = iu;
 712                 stream->req_status->length = sizeof(struct iu);
 713
 714                 ret = usb_ep_queue(fu->ep_status, stream->req_status,
 715                                 GFP_ATOMIC);
 716                 if (ret)
 717                         pr_err("%s(%d)\n", __func__, __LINE__);
 718         }
 719
 720         wait_for_completion(&cmd->write_complete);
 721         target_execute_cmd(se_cmd);
 722 cleanup:
 723         return ret;
 724 }
 725
 726 static int usbg_submit_command(struct f_uas *, void *, unsigned int);
 727
 728 static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 729 {
 730         struct f_uas *fu = req->context;
 731         int ret;
 732
 733         if (req->status < 0)
 734                 return;
 735
 736         ret = usbg_submit_command(fu, req->buf, req->actual);
 737         /*
 738          * Once we tune for performance enqueue the command req here again so
 739          * we can receive a second command while we processing this one. Pay
 740          * attention to properly sync STAUS endpoint with DATA IN + OUT so you
 741          * don't break HS.
 742          */
 743         if (!ret)
 744                 return;
 745         usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 746 }
 747
 748 static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
 749 {
 750         stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
 751         if (!stream->req_in)
 752                 goto out;
 753
 754         stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
 755         if (!stream->req_out)
 756                 goto err_out;
 757
 758         stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
 759         if (!stream->req_status)
 760                 goto err_sts;
 761
 762         return 0;
 763 err_sts:
 764         usb_ep_free_request(fu->ep_status, stream->req_status);
 765         stream->req_status = NULL;
 766 err_out:
 767         usb_ep_free_request(fu->ep_out, stream->req_out);
 768         stream->req_out = NULL;
 769 out:
 770         return -ENOMEM;
 771 }
 772
 773 static int uasp_alloc_cmd(struct f_uas *fu)
 774 {
 775         fu->cmd.req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
 776         if (!fu->cmd.req)
 777                 goto err;
 778
 779         fu->cmd.buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
 780         if (!fu->cmd.buf)
 781                 goto err_buf;
 782
 783         fu->cmd.req->complete = uasp_cmd_complete;
 784         fu->cmd.req->buf = fu->cmd.buf;
 785         fu->cmd.req->length = fu->ep_cmd->maxpacket;
 786         fu->cmd.req->context = fu;
 787         return 0;
 788
 789 err_buf:
 790         usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
 791 err:
 792         return -ENOMEM;
 793 }
 794
 795 static void uasp_setup_stream_res(struct f_uas *fu, int max_streams)
 796 {
 797         int i;
 798
 799         for (i = 0; i < max_streams; i++) {
 800                 struct uas_stream *s = &fu->stream[i];
 801
 802                 s->req_in->stream_id = i + 1;
 803                 s->req_out->stream_id = i + 1;
 804                 s->req_status->stream_id = i + 1;
 805         }
 806 }
 807
 808 static int uasp_prepare_reqs(struct f_uas *fu)
 809 {
 810         int ret;
 811         int i;
 812         int max_streams;
 813
 814         if (fu->flags & USBG_USE_STREAMS)
 815                 max_streams = UASP_SS_EP_COMP_NUM_STREAMS;
 816         else
 817                 max_streams = 1;
 818
 819         for (i = 0; i < max_streams; i++) {
 820                 ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
 821                 if (ret)
 822                         goto err_cleanup;
 823         }
 824
 825         ret = uasp_alloc_cmd(fu);
 826         if (ret)
 827                 goto err_free_stream;
 828         uasp_setup_stream_res(fu, max_streams);
 829
 830         ret = usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
 831         if (ret)
 832                 goto err_free_stream;
 833
 834         return 0;
 835
 836 err_free_stream:
 837         uasp_free_cmdreq(fu);
 838
 839 err_cleanup:
 840         if (i) {
 841                 do {
 842                         uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
 843                         i--;
 844                 } while (i);
 845         }
 846         pr_err("UASP: endpoint setup failed\n");
 847         return ret;
 848 }
 849
 850 static void uasp_set_alt(struct f_uas *fu)
 851 {
 852         struct usb_function *f = &fu->function;
 853         struct usb_gadget *gadget = f->config->cdev->gadget;
 854         int ret;
 855
 856         fu->flags = USBG_IS_UAS;
 857
 858         if (gadget->speed == USB_SPEED_SUPER)
 859                 fu->flags |= USBG_USE_STREAMS;
 860
 861         config_ep_by_speed(gadget, f, fu->ep_in);
 862         ret = usb_ep_enable(fu->ep_in);
 863         if (ret)
 864                 goto err_b_in;
 865
 866         config_ep_by_speed(gadget, f, fu->ep_out);
 867         ret = usb_ep_enable(fu->ep_out);
 868         if (ret)
 869                 goto err_b_out;
 870
 871         config_ep_by_speed(gadget, f, fu->ep_cmd);
 872         ret = usb_ep_enable(fu->ep_cmd);
 873         if (ret)
 874                 goto err_cmd;
 875         config_ep_by_speed(gadget, f, fu->ep_status);
 876         ret = usb_ep_enable(fu->ep_status);
 877         if (ret)
 878                 goto err_status;
 879
 880         ret = uasp_prepare_reqs(fu);
 881         if (ret)
 882                 goto err_wq;
 883         fu->flags |= USBG_ENABLED;
 884
 885         pr_info("Using the UAS protocol\n");
 886         return;
 887 err_wq:
 888         usb_ep_disable(fu->ep_status);
 889 err_status:
 890         usb_ep_disable(fu->ep_cmd);
 891 err_cmd:
 892         usb_ep_disable(fu->ep_out);
 893 err_b_out:
 894         usb_ep_disable(fu->ep_in);
 895 err_b_in:
 896         fu->flags = 0;
 897 }
 898
 899 static int get_cmd_dir(const unsigned char *cdb)
 900 {
 901         int ret;
 902
 903         switch (cdb[0]) {
 904         case READ_6:
 905         case READ_10:
 906         case READ_12:
 907         case READ_16:
 908         case INQUIRY:
 909         case MODE_SENSE:
 910         case MODE_SENSE_10:
 911         case SERVICE_ACTION_IN_16:
 912         case MAINTENANCE_IN:
 913         case PERSISTENT_RESERVE_IN:
 914         case SECURITY_PROTOCOL_IN:
 915         case ACCESS_CONTROL_IN:
 916         case REPORT_LUNS:
 917         case READ_BLOCK_LIMITS:
 918         case READ_POSITION:
 919         case READ_CAPACITY:
 920         case READ_TOC:
 921         case READ_FORMAT_CAPACITIES:
 922         case REQUEST_SENSE:
 923                 ret = DMA_FROM_DEVICE;
 924                 break;
 925
 926         case WRITE_6:
 927         case WRITE_10:
 928         case WRITE_12:
 929         case WRITE_16:
 930         case MODE_SELECT:
 931         case MODE_SELECT_10:
 932         case WRITE_VERIFY:
 933         case WRITE_VERIFY_12:
 934         case PERSISTENT_RESERVE_OUT:
 935         case MAINTENANCE_OUT:
 936         case SECURITY_PROTOCOL_OUT:
 937         case ACCESS_CONTROL_OUT:
 938                 ret = DMA_TO_DEVICE;
 939                 break;
 940         case ALLOW_MEDIUM_REMOVAL:
 941         case TEST_UNIT_READY:
 942         case SYNCHRONIZE_CACHE:
 943         case START_STOP:
 944         case ERASE:
 945         case REZERO_UNIT:
 946         case SEEK_10:
 947         case SPACE:
 948         case VERIFY:
 949         case WRITE_FILEMARKS:
 950                 ret = DMA_NONE;
 951                 break;
 952         default:
 953                 pr_warn("target: Unknown data direction for SCSI Opcode "
 954                                 "0x%02x\n", cdb[0]);
 955                 ret = -EINVAL;
 956         }
 957         return ret;
 958 }
 959
 960 static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
 961 {
 962         struct usbg_cmd *cmd = req->context;
 963         struct se_cmd *se_cmd = &cmd->se_cmd;
 964
 965         if (req->status < 0) {
 966                 pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
 967                 goto cleanup;
 968         }
 969
 970         if (req->num_sgs == 0) {
 971                 sg_copy_from_buffer(se_cmd->t_data_sg,
 972                                 se_cmd->t_data_nents,
 973                                 cmd->data_buf,
 974                                 se_cmd->data_length);
 975         }
 976
 977         complete(&cmd->write_complete);
 978         return;
 979
 980 cleanup:
 981         usbg_cleanup_cmd(cmd);
 982 }
 983
 984 static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
 985 {
 986         struct se_cmd *se_cmd = &cmd->se_cmd;
 987         struct f_uas *fu = cmd->fu;
 988         struct usb_gadget *gadget = fuas_to_gadget(fu);
 989
 990         if (!gadget->sg_supported) {
 991                 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
 992                 if (!cmd->data_buf)
 993                         return -ENOMEM;
 994
 995                 req->buf = cmd->data_buf;
 996         } else {
 997                 req->buf = NULL;
 998                 req->num_sgs = se_cmd->t_data_nents;
 999                 req->sg = se_cmd->t_data_sg;
1000         }
1001
1002         req->complete = usbg_data_write_cmpl;
1003         req->length = se_cmd->data_length;
1004         req->context = cmd;
1005         return 0;
1006 }
1007
1008 static int usbg_send_status_response(struct se_cmd *se_cmd)
1009 {
1010         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1011                         se_cmd);
1012         struct f_uas *fu = cmd->fu;
1013
1014         if (fu->flags & USBG_IS_BOT)
1015                 return bot_send_status_response(cmd);
1016         else
1017                 return uasp_send_status_response(cmd);
1018 }
1019
1020 static int usbg_send_write_request(struct se_cmd *se_cmd)
1021 {
1022         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1023                         se_cmd);
1024         struct f_uas *fu = cmd->fu;
1025
1026         if (fu->flags & USBG_IS_BOT)
1027                 return bot_send_write_request(cmd);
1028         else
1029                 return uasp_send_write_request(cmd);
1030 }
1031
1032 static int usbg_send_read_response(struct se_cmd *se_cmd)
1033 {
1034         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1035                         se_cmd);
1036         struct f_uas *fu = cmd->fu;
1037
1038         if (fu->flags & USBG_IS_BOT)
1039                 return bot_send_read_response(cmd);
1040         else
1041                 return uasp_send_read_response(cmd);
1042 }
1043
1044 static void usbg_cmd_work(struct work_struct *work)
1045 {
1046         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1047         struct se_cmd *se_cmd;
1048         struct tcm_usbg_nexus *tv_nexus;
1049         struct usbg_tpg *tpg;
1050         int dir;
1051
1052         se_cmd = &cmd->se_cmd;
1053         tpg = cmd->fu->tpg;
1054         tv_nexus = tpg->tpg_nexus;
1055         dir = get_cmd_dir(cmd->cmd_buf);
1056         if (dir < 0) {
1057                 transport_init_se_cmd(se_cmd,
1058                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1059                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1060                                 cmd->prio_attr, cmd->sense_iu.sense);
1061                 goto out;
1062         }
1063
1064         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1065                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1066                         0, cmd->prio_attr, dir, TARGET_SCF_UNKNOWN_SIZE) < 0)
1067                 goto out;
1068
1069         return;
1070
1071 out:
1072         transport_send_check_condition_and_sense(se_cmd,
1073                         TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1074         usbg_cleanup_cmd(cmd);
1075 }
1076
1077 static int usbg_submit_command(struct f_uas *fu,
1078                 void *cmdbuf, unsigned int len)
1079 {
1080         struct command_iu *cmd_iu = cmdbuf;
1081         struct usbg_cmd *cmd;
1082         struct usbg_tpg *tpg;
1083         struct se_cmd *se_cmd;
1084         struct tcm_usbg_nexus *tv_nexus;
1085         u32 cmd_len;
1086         int ret;
1087
1088         if (cmd_iu->iu_id != IU_ID_COMMAND) {
1089                 pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1090                 return -EINVAL;
1091         }
1092
1093         cmd = kzalloc(sizeof *cmd, GFP_ATOMIC);
1094         if (!cmd)
1095                 return -ENOMEM;
1096
1097         cmd->fu = fu;
1098
1099         /* XXX until I figure out why I can't free in on complete */
1100         kref_init(&cmd->ref);
1101         kref_get(&cmd->ref);
1102
1103         tpg = fu->tpg;
1104         cmd_len = (cmd_iu->len & ~0x3) + 16;
1105         if (cmd_len > USBG_MAX_CMD)
1106                 goto err;
1107
1108         memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1109
1110         cmd->tag = be16_to_cpup(&cmd_iu->tag);
1111         cmd->se_cmd.tag = cmd->tag;
1112         if (fu->flags & USBG_USE_STREAMS) {
1113                 if (cmd->tag > UASP_SS_EP_COMP_NUM_STREAMS)
1114                         goto err;
1115                 if (!cmd->tag)
1116                         cmd->stream = &fu->stream[0];
1117                 else
1118                         cmd->stream = &fu->stream[cmd->tag - 1];
1119         } else {
1120                 cmd->stream = &fu->stream[0];
1121         }
1122
1123         tv_nexus = tpg->tpg_nexus;
1124         if (!tv_nexus) {
1125                 pr_err("Missing nexus, ignoring command\n");
1126                 goto err;
1127         }
1128
1129         switch (cmd_iu->prio_attr & 0x7) {
1130         case UAS_HEAD_TAG:
1131                 cmd->prio_attr = TCM_HEAD_TAG;
1132                 break;
1133         case UAS_ORDERED_TAG:
1134                 cmd->prio_attr = TCM_ORDERED_TAG;
1135                 break;
1136         case UAS_ACA:
1137                 cmd->prio_attr = TCM_ACA_TAG;
1138                 break;
1139         default:
1140                 pr_debug_once("Unsupported prio_attr: %02x.\n",
1141                                 cmd_iu->prio_attr);
1142         case UAS_SIMPLE_TAG:
1143                 cmd->prio_attr = TCM_SIMPLE_TAG;
1144                 break;
1145         }
1146
1147         se_cmd = &cmd->se_cmd;
1148         cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1149
1150         INIT_WORK(&cmd->work, usbg_cmd_work);
1151         ret = queue_work(tpg->workqueue, &cmd->work);
1152         if (ret < 0)
1153                 goto err;
1154
1155         return 0;
1156 err:
1157         kfree(cmd);
1158         return -EINVAL;
1159 }
1160
1161 static void bot_cmd_work(struct work_struct *work)
1162 {
1163         struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1164         struct se_cmd *se_cmd;
1165         struct tcm_usbg_nexus *tv_nexus;
1166         struct usbg_tpg *tpg;
1167         int dir;
1168
1169         se_cmd = &cmd->se_cmd;
1170         tpg = cmd->fu->tpg;
1171         tv_nexus = tpg->tpg_nexus;
1172         dir = get_cmd_dir(cmd->cmd_buf);
1173         if (dir < 0) {
1174                 transport_init_se_cmd(se_cmd,
1175                                 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1176                                 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1177                                 cmd->prio_attr, cmd->sense_iu.sense);
1178                 goto out;
1179         }
1180
1181         if (target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1182                         cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1183                         cmd->data_len, cmd->prio_attr, dir, 0) < 0)
1184                 goto out;
1185
1186         return;
1187
1188 out:
1189         transport_send_check_condition_and_sense(se_cmd,
1190                                 TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1191         usbg_cleanup_cmd(cmd);
1192 }
1193
1194 static int bot_submit_command(struct f_uas *fu,
1195                 void *cmdbuf, unsigned int len)
1196 {
1197         struct bulk_cb_wrap *cbw = cmdbuf;
1198         struct usbg_cmd *cmd;
1199         struct usbg_tpg *tpg;
1200         struct se_cmd *se_cmd;
1201         struct tcm_usbg_nexus *tv_nexus;
1202         u32 cmd_len;
1203         int ret;
1204
1205         if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1206                 pr_err("Wrong signature on CBW\n");
1207                 return -EINVAL;
1208         }
1209         if (len != 31) {
1210                 pr_err("Wrong length for CBW\n");
1211                 return -EINVAL;
1212         }
1213
1214         cmd_len = cbw->Length;
1215         if (cmd_len < 1 || cmd_len > 16)
1216                 return -EINVAL;
1217
1218         cmd = kzalloc(sizeof *cmd, GFP_ATOMIC);
1219         if (!cmd)
1220                 return -ENOMEM;
1221
1222         cmd->fu = fu;
1223
1224         /* XXX until I figure out why I can't free in on complete */
1225         kref_init(&cmd->ref);
1226         kref_get(&cmd->ref);
1227
1228         tpg = fu->tpg;
1229
1230         memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1231
1232         cmd->bot_tag = cbw->Tag;
1233
1234         tv_nexus = tpg->tpg_nexus;
1235         if (!tv_nexus) {
1236                 pr_err("Missing nexus, ignoring command\n");
1237                 goto err;
1238         }
1239
1240         cmd->prio_attr = TCM_SIMPLE_TAG;
1241         se_cmd = &cmd->se_cmd;
1242         cmd->unpacked_lun = cbw->Lun;
1243         cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1244         cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1245         cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1246
1247         INIT_WORK(&cmd->work, bot_cmd_work);
1248         ret = queue_work(tpg->workqueue, &cmd->work);
1249         if (ret < 0)
1250                 goto err;
1251
1252         return 0;
1253 err:
1254         kfree(cmd);
1255         return -EINVAL;
1256 }
1257
1258 /* Start fabric.c code */
1259
1260 static int usbg_check_true(struct se_portal_group *se_tpg)
1261 {
1262         return 1;
1263 }
1264
1265 static int usbg_check_false(struct se_portal_group *se_tpg)
1266 {
1267         return 0;
1268 }
1269
1270 static char *usbg_get_fabric_name(void)
1271 {
1272         return "usb_gadget";
1273 }
1274
1275 static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1276 {
1277         struct usbg_tpg *tpg = container_of(se_tpg,
1278                                 struct usbg_tpg, se_tpg);
1279         struct usbg_tport *tport = tpg->tport;
1280
1281         return &tport->tport_name[0];
1282 }
1283
1284 static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1285 {
1286         struct usbg_tpg *tpg = container_of(se_tpg,
1287                                 struct usbg_tpg, se_tpg);
1288         return tpg->tport_tpgt;
1289 }
1290
1291 static u32 usbg_tpg_get_inst_index(struct se_portal_group *se_tpg)
1292 {
1293         return 1;
1294 }
1295
1296 static void usbg_cmd_release(struct kref *ref)
1297 {
1298         struct usbg_cmd *cmd = container_of(ref, struct usbg_cmd,
1299                         ref);
1300
1301         transport_generic_free_cmd(&cmd->se_cmd, 0);
1302 }
1303
1304 static void usbg_release_cmd(struct se_cmd *se_cmd)
1305 {
1306         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1307                         se_cmd);
1308         kfree(cmd->data_buf);
1309         kfree(cmd);
1310         return;
1311 }
1312
1313 static int usbg_shutdown_session(struct se_session *se_sess)
1314 {
1315         return 0;
1316 }
1317
1318 static void usbg_close_session(struct se_session *se_sess)
1319 {
1320         return;
1321 }
1322
1323 static u32 usbg_sess_get_index(struct se_session *se_sess)
1324 {
1325         return 0;
1326 }
1327
1328 /*
1329  * XXX Error recovery: return != 0 if we expect writes. Dunno when that could be
1330  */
1331 static int usbg_write_pending_status(struct se_cmd *se_cmd)
1332 {
1333         return 0;
1334 }
1335
1336 static void usbg_set_default_node_attrs(struct se_node_acl *nacl)
1337 {
1338         return;
1339 }
1340
1341 static int usbg_get_cmd_state(struct se_cmd *se_cmd)
1342 {
1343         return 0;
1344 }
1345
1346 static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1347 {
1348 }
1349
1350 static void usbg_aborted_task(struct se_cmd *se_cmd)
1351 {
1352         return;
1353 }
1354
1355 static const char *usbg_check_wwn(const char *name)
1356 {
1357         const char *n;
1358         unsigned int len;
1359
1360         n = strstr(name, "naa.");
1361         if (!n)
1362                 return NULL;
1363         n += 4;
1364         len = strlen(n);
1365         if (len == 0 || len > USBG_NAMELEN - 1)
1366                 return NULL;
1367         return n;
1368 }
1369
1370 static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1371 {
1372         if (!usbg_check_wwn(name))
1373                 return -EINVAL;
1374         return 0;
1375 }
1376
1377 struct usbg_tpg *the_only_tpg_I_currently_have;
1378
1379 static struct se_portal_group *usbg_make_tpg(
1380         struct se_wwn *wwn,
1381         struct config_group *group,
1382         const char *name)
1383 {
1384         struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1385                         tport_wwn);
1386         struct usbg_tpg *tpg;
1387         unsigned long tpgt;
1388         int ret;
1389
1390         if (strstr(name, "tpgt_") != name)
1391                 return ERR_PTR(-EINVAL);
1392         if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1393                 return ERR_PTR(-EINVAL);
1394         if (the_only_tpg_I_currently_have) {
1395                 pr_err("Until the gadget framework can't handle multiple\n");
1396                 pr_err("gadgets, you can't do this here.\n");
1397                 return ERR_PTR(-EBUSY);
1398         }
1399
1400         tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1401         if (!tpg)
1402                 return ERR_PTR(-ENOMEM);
1403         mutex_init(&tpg->tpg_mutex);
1404         atomic_set(&tpg->tpg_port_count, 0);
1405         tpg->workqueue = alloc_workqueue("tcm_usb_gadget", 0, 1);
1406         if (!tpg->workqueue) {
1407                 kfree(tpg);
1408                 return NULL;
1409         }
1410
1411         tpg->tport = tport;
1412         tpg->tport_tpgt = tpgt;
1413
1414         /*
1415          * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1416          * pretend to be SAS..
1417          */
1418         ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1419         if (ret < 0) {
1420                 destroy_workqueue(tpg->workqueue);
1421                 kfree(tpg);
1422                 return NULL;
1423         }
1424         the_only_tpg_I_currently_have = tpg;
1425         return &tpg->se_tpg;
1426 }
1427
1428 static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1429 {
1430         struct usbg_tpg *tpg = container_of(se_tpg,
1431                                 struct usbg_tpg, se_tpg);
1432
1433         core_tpg_deregister(se_tpg);
1434         destroy_workqueue(tpg->workqueue);
1435         kfree(tpg);
1436         the_only_tpg_I_currently_have = NULL;
1437 }
1438
1439 static struct se_wwn *usbg_make_tport(
1440         struct target_fabric_configfs *tf,
1441         struct config_group *group,
1442         const char *name)
1443 {
1444         struct usbg_tport *tport;
1445         const char *wnn_name;
1446         u64 wwpn = 0;
1447
1448         wnn_name = usbg_check_wwn(name);
1449         if (!wnn_name)
1450                 return ERR_PTR(-EINVAL);
1451
1452         tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1453         if (!(tport))
1454                 return ERR_PTR(-ENOMEM);
1455         tport->tport_wwpn = wwpn;
1456         snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1457         return &tport->tport_wwn;
1458 }
1459
1460 static void usbg_drop_tport(struct se_wwn *wwn)
1461 {
1462         struct usbg_tport *tport = container_of(wwn,
1463                                 struct usbg_tport, tport_wwn);
1464         kfree(tport);
1465 }
1466
1467 /*
1468  * If somebody feels like dropping the version property, go ahead.
1469  */
1470 static ssize_t usbg_wwn_show_attr_version(
1471         struct target_fabric_configfs *tf,
1472         char *page)
1473 {
1474         return sprintf(page, "usb-gadget fabric module\n");
1475 }
1476 TF_WWN_ATTR_RO(usbg, version);
1477
1478 static struct configfs_attribute *usbg_wwn_attrs[] = {
1479         &usbg_wwn_version.attr,
1480         NULL,
1481 };
1482
1483 static ssize_t tcm_usbg_tpg_show_enable(
1484                 struct se_portal_group *se_tpg,
1485                 char *page)
1486 {
1487         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1488
1489         return snprintf(page, PAGE_SIZE, "%u\n", tpg->gadget_connect);
1490 }
1491
1492 static int usbg_attach(struct usbg_tpg *);
1493 static void usbg_detach(struct usbg_tpg *);
1494
1495 static ssize_t tcm_usbg_tpg_store_enable(
1496                 struct se_portal_group *se_tpg,
1497                 const char *page,
1498                 size_t count)
1499 {
1500         struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1501         unsigned long op;
1502         ssize_t ret;
1503
1504         ret = kstrtoul(page, 0, &op);
1505         if (ret < 0)
1506                 return -EINVAL;
1507         if (op > 1)
1508                 return -EINVAL;
1509
1510         if (op && tpg->gadget_connect)
1511                 goto out;
1512         if (!op && !tpg->gadget_connect)
1513                 goto out;
1514
1515         if (op) {
1516                 ret = usbg_attach(tpg);
1517                 if (ret)
1518                         goto out;
1519         } else {
1520                 usbg_detach(tpg);
1521         }
1522         tpg->gadget_connect = op;
1523 out:
1524         return count;
1525 }
1526 TF_TPG_BASE_ATTR(tcm_usbg, enable, S_IRUGO | S_IWUSR);
1527
1528 static ssize_t tcm_usbg_tpg_show_nexus(
1529                 struct se_portal_group *se_tpg,
1530                 char *page)
1531 {
1532         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1533         struct tcm_usbg_nexus *tv_nexus;
1534         ssize_t ret;
1535
1536         mutex_lock(&tpg->tpg_mutex);
1537         tv_nexus = tpg->tpg_nexus;
1538         if (!tv_nexus) {
1539                 ret = -ENODEV;
1540                 goto out;
1541         }
1542         ret = snprintf(page, PAGE_SIZE, "%s\n",
1543                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1544 out:
1545         mutex_unlock(&tpg->tpg_mutex);
1546         return ret;
1547 }
1548
1549 static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1550 {
1551         struct se_portal_group *se_tpg;
1552         struct tcm_usbg_nexus *tv_nexus;
1553         int ret;
1554
1555         mutex_lock(&tpg->tpg_mutex);
1556         if (tpg->tpg_nexus) {
1557                 ret = -EEXIST;
1558                 pr_debug("tpg->tpg_nexus already exists\n");
1559                 goto err_unlock;
1560         }
1561         se_tpg = &tpg->se_tpg;
1562
1563         ret = -ENOMEM;
1564         tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1565         if (!tv_nexus)
1566                 goto err_unlock;
1567         tv_nexus->tvn_se_sess = transport_init_session(TARGET_PROT_NORMAL);
1568         if (IS_ERR(tv_nexus->tvn_se_sess))
1569                 goto err_free;
1570
1571         /*
1572          * Since we are running in 'demo mode' this call with generate a
1573          * struct se_node_acl for the tcm_vhost struct se_portal_group with
1574          * the SCSI Initiator port name of the passed configfs group 'name'.
1575          */
1576         tv_nexus->tvn_se_sess->se_node_acl = core_tpg_check_initiator_node_acl(
1577                         se_tpg, name);
1578         if (!tv_nexus->tvn_se_sess->se_node_acl) {
1579                 pr_debug("core_tpg_check_initiator_node_acl() failed"
1580                                 " for %s\n", name);
1581                 goto err_session;
1582         }
1583         /*
1584          * Now register the TCM vHost virtual I_T Nexus as active.
1585          */
1586         transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
1587                         tv_nexus->tvn_se_sess, tv_nexus);
1588         tpg->tpg_nexus = tv_nexus;
1589         mutex_unlock(&tpg->tpg_mutex);
1590         return 0;
1591
1592 err_session:
1593         transport_free_session(tv_nexus->tvn_se_sess);
1594 err_free:
1595         kfree(tv_nexus);
1596 err_unlock:
1597         mutex_unlock(&tpg->tpg_mutex);
1598         return ret;
1599 }
1600
1601 static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1602 {
1603         struct se_session *se_sess;
1604         struct tcm_usbg_nexus *tv_nexus;
1605         int ret = -ENODEV;
1606
1607         mutex_lock(&tpg->tpg_mutex);
1608         tv_nexus = tpg->tpg_nexus;
1609         if (!tv_nexus)
1610                 goto out;
1611
1612         se_sess = tv_nexus->tvn_se_sess;
1613         if (!se_sess)
1614                 goto out;
1615
1616         if (atomic_read(&tpg->tpg_port_count)) {
1617                 ret = -EPERM;
1618                 pr_err("Unable to remove Host I_T Nexus with"
1619                                 " active TPG port count: %d\n",
1620                                 atomic_read(&tpg->tpg_port_count));
1621                 goto out;
1622         }
1623
1624         pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1625                         tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1626         /*
1627          * Release the SCSI I_T Nexus to the emulated vHost Target Port
1628          */
1629         transport_deregister_session(tv_nexus->tvn_se_sess);
1630         tpg->tpg_nexus = NULL;
1631
1632         kfree(tv_nexus);
1633         ret = 0;
1634 out:
1635         mutex_unlock(&tpg->tpg_mutex);
1636         return ret;
1637 }
1638
1639 static ssize_t tcm_usbg_tpg_store_nexus(
1640                 struct se_portal_group *se_tpg,
1641                 const char *page,
1642                 size_t count)
1643 {
1644         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1645         unsigned char i_port[USBG_NAMELEN], *ptr;
1646         int ret;
1647
1648         if (!strncmp(page, "NULL", 4)) {
1649                 ret = tcm_usbg_drop_nexus(tpg);
1650                 return (!ret) ? count : ret;
1651         }
1652         if (strlen(page) >= USBG_NAMELEN) {
1653                 pr_err("Emulated NAA Sas Address: %s, exceeds"
1654                                 " max: %d\n", page, USBG_NAMELEN);
1655                 return -EINVAL;
1656         }
1657         snprintf(i_port, USBG_NAMELEN, "%s", page);
1658
1659         ptr = strstr(i_port, "naa.");
1660         if (!ptr) {
1661                 pr_err("Missing 'naa.' prefix\n");
1662                 return -EINVAL;
1663         }
1664
1665         if (i_port[strlen(i_port) - 1] == '\n')
1666                 i_port[strlen(i_port) - 1] = '\0';
1667
1668         ret = tcm_usbg_make_nexus(tpg, &i_port[4]);
1669         if (ret < 0)
1670                 return ret;
1671         return count;
1672 }
1673 TF_TPG_BASE_ATTR(tcm_usbg, nexus, S_IRUGO | S_IWUSR);
1674
1675 static struct configfs_attribute *usbg_base_attrs[] = {
1676         &tcm_usbg_tpg_enable.attr,
1677         &tcm_usbg_tpg_nexus.attr,
1678         NULL,
1679 };
1680
1681 static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1682 {
1683         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1684
1685         atomic_inc(&tpg->tpg_port_count);
1686         smp_mb__after_atomic();
1687         return 0;
1688 }
1689
1690 static void usbg_port_unlink(struct se_portal_group *se_tpg,
1691                 struct se_lun *se_lun)
1692 {
1693         struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1694
1695         atomic_dec(&tpg->tpg_port_count);
1696         smp_mb__after_atomic();
1697 }
1698
1699 static int usbg_check_stop_free(struct se_cmd *se_cmd)
1700 {
1701         struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1702                         se_cmd);
1703
1704         kref_put(&cmd->ref, usbg_cmd_release);
1705         return 1;
1706 }
1707
1708 static const struct target_core_fabric_ops usbg_ops = {
1709         .module                         = THIS_MODULE,
1710         .name                           = "usb_gadget",
1711         .get_fabric_name                = usbg_get_fabric_name,
1712         .tpg_get_wwn                    = usbg_get_fabric_wwn,
1713         .tpg_get_tag                    = usbg_get_tag,
1714         .tpg_check_demo_mode            = usbg_check_true,
1715         .tpg_check_demo_mode_cache      = usbg_check_false,
1716         .tpg_check_demo_mode_write_protect = usbg_check_false,
1717         .tpg_check_prod_mode_write_protect = usbg_check_false,
1718         .tpg_get_inst_index             = usbg_tpg_get_inst_index,
1719         .release_cmd                    = usbg_release_cmd,
1720         .shutdown_session               = usbg_shutdown_session,
1721         .close_session                  = usbg_close_session,
1722         .sess_get_index                 = usbg_sess_get_index,
1723         .sess_get_initiator_sid         = NULL,
1724         .write_pending                  = usbg_send_write_request,
1725         .write_pending_status           = usbg_write_pending_status,
1726         .set_default_node_attributes    = usbg_set_default_node_attrs,
1727         .get_cmd_state                  = usbg_get_cmd_state,
1728         .queue_data_in                  = usbg_send_read_response,
1729         .queue_status                   = usbg_send_status_response,
1730         .queue_tm_rsp                   = usbg_queue_tm_rsp,
1731         .aborted_task                   = usbg_aborted_task,
1732         .check_stop_free                = usbg_check_stop_free,
1733
1734         .fabric_make_wwn                = usbg_make_tport,
1735         .fabric_drop_wwn                = usbg_drop_tport,
1736         .fabric_make_tpg                = usbg_make_tpg,
1737         .fabric_drop_tpg                = usbg_drop_tpg,
1738         .fabric_post_link               = usbg_port_link,
1739         .fabric_pre_unlink              = usbg_port_unlink,
1740         .fabric_init_nodeacl            = usbg_init_nodeacl,
1741
1742         .tfc_wwn_attrs                  = usbg_wwn_attrs,
1743         .tfc_tpg_base_attrs             = usbg_base_attrs,
1744 };
1745
1746 /* Start gadget.c code */
1747
1748 static struct usb_interface_descriptor bot_intf_desc = {
1749         .bLength =              sizeof(bot_intf_desc),
1750         .bDescriptorType =      USB_DT_INTERFACE,
1751         .bNumEndpoints =        2,
1752         .bAlternateSetting =    USB_G_ALT_INT_BBB,
1753         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1754         .bInterfaceSubClass =   USB_SC_SCSI,
1755         .bInterfaceProtocol =   USB_PR_BULK,
1756 };
1757
1758 static struct usb_interface_descriptor uasp_intf_desc = {
1759         .bLength =              sizeof(uasp_intf_desc),
1760         .bDescriptorType =      USB_DT_INTERFACE,
1761         .bNumEndpoints =        4,
1762         .bAlternateSetting =    USB_G_ALT_INT_UAS,
1763         .bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1764         .bInterfaceSubClass =   USB_SC_SCSI,
1765         .bInterfaceProtocol =   USB_PR_UAS,
1766 };
1767
1768 static struct usb_endpoint_descriptor uasp_bi_desc = {
1769         .bLength =              USB_DT_ENDPOINT_SIZE,
1770         .bDescriptorType =      USB_DT_ENDPOINT,
1771         .bEndpointAddress =     USB_DIR_IN,
1772         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1773         .wMaxPacketSize =       cpu_to_le16(512),
1774 };
1775
1776 static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1777         .bLength =              USB_DT_ENDPOINT_SIZE,
1778         .bDescriptorType =      USB_DT_ENDPOINT,
1779         .bEndpointAddress =     USB_DIR_IN,
1780         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1781 };
1782
1783 static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1784         .bLength =              sizeof(uasp_bi_pipe_desc),
1785         .bDescriptorType =      USB_DT_PIPE_USAGE,
1786         .bPipeID =              DATA_IN_PIPE_ID,
1787 };
1788
1789 static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1790         .bLength =              USB_DT_ENDPOINT_SIZE,
1791         .bDescriptorType =      USB_DT_ENDPOINT,
1792         .bEndpointAddress =     USB_DIR_IN,
1793         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1794         .wMaxPacketSize =       cpu_to_le16(1024),
1795 };
1796
1797 static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1798         .bLength =              sizeof(uasp_bi_ep_comp_desc),
1799         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1800         .bMaxBurst =            0,
1801         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1802         .wBytesPerInterval =    0,
1803 };
1804
1805 static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1806         .bLength =              sizeof(bot_bi_ep_comp_desc),
1807         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1808         .bMaxBurst =            0,
1809 };
1810
1811 static struct usb_endpoint_descriptor uasp_bo_desc = {
1812         .bLength =              USB_DT_ENDPOINT_SIZE,
1813         .bDescriptorType =      USB_DT_ENDPOINT,
1814         .bEndpointAddress =     USB_DIR_OUT,
1815         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1816         .wMaxPacketSize =       cpu_to_le16(512),
1817 };
1818
1819 static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1820         .bLength =              USB_DT_ENDPOINT_SIZE,
1821         .bDescriptorType =      USB_DT_ENDPOINT,
1822         .bEndpointAddress =     USB_DIR_OUT,
1823         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1824 };
1825
1826 static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1827         .bLength =              sizeof(uasp_bo_pipe_desc),
1828         .bDescriptorType =      USB_DT_PIPE_USAGE,
1829         .bPipeID =              DATA_OUT_PIPE_ID,
1830 };
1831
1832 static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1833         .bLength =              USB_DT_ENDPOINT_SIZE,
1834         .bDescriptorType =      USB_DT_ENDPOINT,
1835         .bEndpointAddress =     USB_DIR_OUT,
1836         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1837         .wMaxPacketSize =       cpu_to_le16(0x400),
1838 };
1839
1840 static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1841         .bLength =              sizeof(uasp_bo_ep_comp_desc),
1842         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1843         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1844 };
1845
1846 static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1847         .bLength =              sizeof(bot_bo_ep_comp_desc),
1848         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1849 };
1850
1851 static struct usb_endpoint_descriptor uasp_status_desc = {
1852         .bLength =              USB_DT_ENDPOINT_SIZE,
1853         .bDescriptorType =      USB_DT_ENDPOINT,
1854         .bEndpointAddress =     USB_DIR_IN,
1855         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1856         .wMaxPacketSize =       cpu_to_le16(512),
1857 };
1858
1859 static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1860         .bLength =              USB_DT_ENDPOINT_SIZE,
1861         .bDescriptorType =      USB_DT_ENDPOINT,
1862         .bEndpointAddress =     USB_DIR_IN,
1863         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1864 };
1865
1866 static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1867         .bLength =              sizeof(uasp_status_pipe_desc),
1868         .bDescriptorType =      USB_DT_PIPE_USAGE,
1869         .bPipeID =              STATUS_PIPE_ID,
1870 };
1871
1872 static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1873         .bLength =              USB_DT_ENDPOINT_SIZE,
1874         .bDescriptorType =      USB_DT_ENDPOINT,
1875         .bEndpointAddress =     USB_DIR_IN,
1876         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1877         .wMaxPacketSize =       cpu_to_le16(1024),
1878 };
1879
1880 static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1881         .bLength =              sizeof(uasp_status_in_ep_comp_desc),
1882         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1883         .bmAttributes =         UASP_SS_EP_COMP_LOG_STREAMS,
1884 };
1885
1886 static struct usb_endpoint_descriptor uasp_cmd_desc = {
1887         .bLength =              USB_DT_ENDPOINT_SIZE,
1888         .bDescriptorType =      USB_DT_ENDPOINT,
1889         .bEndpointAddress =     USB_DIR_OUT,
1890         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1891         .wMaxPacketSize =       cpu_to_le16(512),
1892 };
1893
1894 static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1895         .bLength =              USB_DT_ENDPOINT_SIZE,
1896         .bDescriptorType =      USB_DT_ENDPOINT,
1897         .bEndpointAddress =     USB_DIR_OUT,
1898         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1899 };
1900
1901 static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1902         .bLength =              sizeof(uasp_cmd_pipe_desc),
1903         .bDescriptorType =      USB_DT_PIPE_USAGE,
1904         .bPipeID =              CMD_PIPE_ID,
1905 };
1906
1907 static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1908         .bLength =              USB_DT_ENDPOINT_SIZE,
1909         .bDescriptorType =      USB_DT_ENDPOINT,
1910         .bEndpointAddress =     USB_DIR_OUT,
1911         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
1912         .wMaxPacketSize =       cpu_to_le16(1024),
1913 };
1914
1915 static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1916         .bLength =              sizeof(uasp_cmd_comp_desc),
1917         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
1918 };
1919
1920 static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1921         (struct usb_descriptor_header *) &bot_intf_desc,
1922         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1923         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1924
1925         (struct usb_descriptor_header *) &uasp_intf_desc,
1926         (struct usb_descriptor_header *) &uasp_fs_bi_desc,
1927         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1928         (struct usb_descriptor_header *) &uasp_fs_bo_desc,
1929         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1930         (struct usb_descriptor_header *) &uasp_fs_status_desc,
1931         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1932         (struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1933         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1934         NULL,
1935 };
1936
1937 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1938         (struct usb_descriptor_header *) &bot_intf_desc,
1939         (struct usb_descriptor_header *) &uasp_bi_desc,
1940         (struct usb_descriptor_header *) &uasp_bo_desc,
1941
1942         (struct usb_descriptor_header *) &uasp_intf_desc,
1943         (struct usb_descriptor_header *) &uasp_bi_desc,
1944         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1945         (struct usb_descriptor_header *) &uasp_bo_desc,
1946         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1947         (struct usb_descriptor_header *) &uasp_status_desc,
1948         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1949         (struct usb_descriptor_header *) &uasp_cmd_desc,
1950         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1951         NULL,
1952 };
1953
1954 static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1955         (struct usb_descriptor_header *) &bot_intf_desc,
1956         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
1957         (struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1958         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
1959         (struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1960
1961         (struct usb_descriptor_header *) &uasp_intf_desc,
1962         (struct usb_descriptor_header *) &uasp_ss_bi_desc,
1963         (struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
1964         (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1965         (struct usb_descriptor_header *) &uasp_ss_bo_desc,
1966         (struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
1967         (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1968         (struct usb_descriptor_header *) &uasp_ss_status_desc,
1969         (struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
1970         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
1971         (struct usb_descriptor_header *) &uasp_ss_cmd_desc,
1972         (struct usb_descriptor_header *) &uasp_cmd_comp_desc,
1973         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1974         NULL,
1975 };
1976
1977 #define UAS_VENDOR_ID   0x0525  /* NetChip */
1978 #define UAS_PRODUCT_ID  0xa4a5  /* Linux-USB File-backed Storage Gadget */
1979
1980 static struct usb_device_descriptor usbg_device_desc = {
1981         .bLength =              sizeof(usbg_device_desc),
1982         .bDescriptorType =      USB_DT_DEVICE,
1983         .bcdUSB =               cpu_to_le16(0x0200),
1984         .bDeviceClass =         USB_CLASS_PER_INTERFACE,
1985         .idVendor =             cpu_to_le16(UAS_VENDOR_ID),
1986         .idProduct =            cpu_to_le16(UAS_PRODUCT_ID),
1987         .bNumConfigurations =   1,
1988 };
1989
1990 static struct usb_string        usbg_us_strings[] = {
1991         [USB_GADGET_MANUFACTURER_IDX].s = "Target Manufactor",
1992         [USB_GADGET_PRODUCT_IDX].s      = "Target Product",
1993         [USB_GADGET_SERIAL_IDX].s       = "000000000001",
1994         [USB_G_STR_CONFIG].s            = "default config",
1995         [USB_G_STR_INT_UAS].s           = "USB Attached SCSI",
1996         [USB_G_STR_INT_BBB].s           = "Bulk Only Transport",
1997         { },
1998 };
1999
2000 static struct usb_gadget_strings usbg_stringtab = {
2001         .language = 0x0409,
2002         .strings = usbg_us_strings,
2003 };
2004
2005 static struct usb_gadget_strings *usbg_strings[] = {
2006         &usbg_stringtab,
2007         NULL,
2008 };
2009
2010 static int guas_unbind(struct usb_composite_dev *cdev)
2011 {
2012         return 0;
2013 }
2014
2015 static struct usb_configuration usbg_config_driver = {
2016         .label                  = "Linux Target",
2017         .bConfigurationValue    = 1,
2018         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
2019 };
2020
2021 static void give_back_ep(struct usb_ep **pep)
2022 {
2023         struct usb_ep *ep = *pep;
2024         if (!ep)
2025                 return;
2026         ep->driver_data = NULL;
2027 }
2028
2029 static int usbg_bind(struct usb_configuration *c, struct usb_function *f)
2030 {
2031         struct f_uas            *fu = to_f_uas(f);
2032         struct usb_gadget       *gadget = c->cdev->gadget;
2033         struct usb_ep           *ep;
2034         int                     iface;
2035         int                     ret;
2036
2037         iface = usb_interface_id(c, f);
2038         if (iface < 0)
2039                 return iface;
2040
2041         bot_intf_desc.bInterfaceNumber = iface;
2042         uasp_intf_desc.bInterfaceNumber = iface;
2043         fu->iface = iface;
2044         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc,
2045                         &uasp_bi_ep_comp_desc);
2046         if (!ep)
2047                 goto ep_fail;
2048
2049         ep->driver_data = fu;
2050         fu->ep_in = ep;
2051
2052         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc,
2053                         &uasp_bo_ep_comp_desc);
2054         if (!ep)
2055                 goto ep_fail;
2056         ep->driver_data = fu;
2057         fu->ep_out = ep;
2058
2059         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc,
2060                         &uasp_status_in_ep_comp_desc);
2061         if (!ep)
2062                 goto ep_fail;
2063         ep->driver_data = fu;
2064         fu->ep_status = ep;
2065
2066         ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc,
2067                         &uasp_cmd_comp_desc);
2068         if (!ep)
2069                 goto ep_fail;
2070         ep->driver_data = fu;
2071         fu->ep_cmd = ep;
2072
2073         /* Assume endpoint addresses are the same for both speeds */
2074         uasp_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2075         uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2076         uasp_status_desc.bEndpointAddress =
2077                 uasp_ss_status_desc.bEndpointAddress;
2078         uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2079
2080         uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2081         uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2082         uasp_fs_status_desc.bEndpointAddress =
2083                 uasp_ss_status_desc.bEndpointAddress;
2084         uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2085
2086         ret = usb_assign_descriptors(f, uasp_fs_function_desc,
2087                         uasp_hs_function_desc, uasp_ss_function_desc);
2088         if (ret)
2089                 goto ep_fail;
2090
2091         return 0;
2092 ep_fail:
2093         pr_err("Can't claim all required eps\n");
2094
2095         give_back_ep(&fu->ep_in);
2096         give_back_ep(&fu->ep_out);
2097         give_back_ep(&fu->ep_status);
2098         give_back_ep(&fu->ep_cmd);
2099         return -ENOTSUPP;
2100 }
2101
2102 static void usbg_unbind(struct usb_configuration *c, struct usb_function *f)
2103 {
2104         struct f_uas *fu = to_f_uas(f);
2105
2106         usb_free_all_descriptors(f);
2107         kfree(fu);
2108 }
2109
2110 struct guas_setup_wq {
2111         struct work_struct work;
2112         struct f_uas *fu;
2113         unsigned int alt;
2114 };
2115
2116 static void usbg_delayed_set_alt(struct work_struct *wq)
2117 {
2118         struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
2119                         work);
2120         struct f_uas *fu = work->fu;
2121         int alt = work->alt;
2122
2123         kfree(work);
2124
2125         if (fu->flags & USBG_IS_BOT)
2126                 bot_cleanup_old_alt(fu);
2127         if (fu->flags & USBG_IS_UAS)
2128                 uasp_cleanup_old_alt(fu);
2129
2130         if (alt == USB_G_ALT_INT_BBB)
2131                 bot_set_alt(fu);
2132         else if (alt == USB_G_ALT_INT_UAS)
2133                 uasp_set_alt(fu);
2134         usb_composite_setup_continue(fu->function.config->cdev);
2135 }
2136
2137 static int usbg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2138 {
2139         struct f_uas *fu = to_f_uas(f);
2140
2141         if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2142                 struct guas_setup_wq *work;
2143
2144                 work = kmalloc(sizeof(*work), GFP_ATOMIC);
2145                 if (!work)
2146                         return -ENOMEM;
2147                 INIT_WORK(&work->work, usbg_delayed_set_alt);
2148                 work->fu = fu;
2149                 work->alt = alt;
2150                 schedule_work(&work->work);
2151                 return USB_GADGET_DELAYED_STATUS;
2152         }
2153         return -EOPNOTSUPP;
2154 }
2155
2156 static void usbg_disable(struct usb_function *f)
2157 {
2158         struct f_uas *fu = to_f_uas(f);
2159
2160         if (fu->flags & USBG_IS_UAS)
2161                 uasp_cleanup_old_alt(fu);
2162         else if (fu->flags & USBG_IS_BOT)
2163                 bot_cleanup_old_alt(fu);
2164         fu->flags = 0;
2165 }
2166
2167 static int usbg_setup(struct usb_function *f,
2168                 const struct usb_ctrlrequest *ctrl)
2169 {
2170         struct f_uas *fu = to_f_uas(f);
2171
2172         if (!(fu->flags & USBG_IS_BOT))
2173                 return -EOPNOTSUPP;
2174
2175         return usbg_bot_setup(f, ctrl);
2176 }
2177
2178 static int usbg_cfg_bind(struct usb_configuration *c)
2179 {
2180         struct f_uas *fu;
2181         int ret;
2182
2183         fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2184         if (!fu)
2185                 return -ENOMEM;
2186         fu->function.name = "Target Function";
2187         fu->function.bind = usbg_bind;
2188         fu->function.unbind = usbg_unbind;
2189         fu->function.set_alt = usbg_set_alt;
2190         fu->function.setup = usbg_setup;
2191         fu->function.disable = usbg_disable;
2192         fu->tpg = the_only_tpg_I_currently_have;
2193
2194         bot_intf_desc.iInterface = usbg_us_strings[USB_G_STR_INT_BBB].id;
2195         uasp_intf_desc.iInterface = usbg_us_strings[USB_G_STR_INT_UAS].id;
2196
2197         ret = usb_add_function(c, &fu->function);
2198         if (ret)
2199                 goto err;
2200
2201         return 0;
2202 err:
2203         kfree(fu);
2204         return ret;
2205 }
2206
2207 static int usb_target_bind(struct usb_composite_dev *cdev)
2208 {
2209         int ret;
2210
2211         ret = usb_string_ids_tab(cdev, usbg_us_strings);
2212         if (ret)
2213                 return ret;
2214
2215         usbg_device_desc.iManufacturer =
2216                 usbg_us_strings[USB_GADGET_MANUFACTURER_IDX].id;
2217         usbg_device_desc.iProduct = usbg_us_strings[USB_GADGET_PRODUCT_IDX].id;
2218         usbg_device_desc.iSerialNumber =
2219                 usbg_us_strings[USB_GADGET_SERIAL_IDX].id;
2220         usbg_config_driver.iConfiguration =
2221                 usbg_us_strings[USB_G_STR_CONFIG].id;
2222
2223         ret = usb_add_config(cdev, &usbg_config_driver,
2224                         usbg_cfg_bind);
2225         if (ret)
2226                 return ret;
2227         usb_composite_overwrite_options(cdev, &coverwrite);
2228         return 0;
2229 }
2230
2231 static struct usb_composite_driver usbg_driver = {
2232         .name           = "g_target",
2233         .dev            = &usbg_device_desc,
2234         .strings        = usbg_strings,
2235         .max_speed      = USB_SPEED_SUPER,
2236         .bind           = usb_target_bind,
2237         .unbind         = guas_unbind,
2238 };
2239
2240 static int usbg_attach(struct usbg_tpg *tpg)
2241 {
2242         return usb_composite_probe(&usbg_driver);
2243 }
2244
2245 static void usbg_detach(struct usbg_tpg *tpg)
2246 {
2247         usb_composite_unregister(&usbg_driver);
2248 }
2249
2250 static int __init usb_target_gadget_init(void)
2251 {
2252         return target_register_template(&usbg_ops);
2253 }
2254 module_init(usb_target_gadget_init);
2255
2256 static void __exit usb_target_gadget_exit(void)
2257 {
2258         target_unregister_template(&usbg_ops);
2259 }
2260 module_exit(usb_target_gadget_exit);
2261
2262 MODULE_AUTHOR("Sebastian Andrzej Siewior <bigeasy@linutronix.de>");
2263 MODULE_DESCRIPTION("usb-gadget fabric");
2264 MODULE_LICENSE("GPL v2");