1// SPDX-License-Identifier: GPL-2.0
2/* Target based USB-Gadget
3 *
4 * UAS protocol handling, target callbacks, configfs handling,
5 * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
6 *
7 * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
8 */
9#include <linux/kernel.h>
10#include <linux/module.h>
11#include <linux/types.h>
12#include <linux/string.h>
13#include <linux/configfs.h>
14#include <linux/ctype.h>
15#include <linux/usb/ch9.h>
16#include <linux/usb/composite.h>
17#include <linux/usb/gadget.h>
18#include <linux/usb/storage.h>
19#include <scsi/scsi_tcq.h>
20#include <target/target_core_base.h>
21#include <target/target_core_fabric.h>
22#include <asm/unaligned.h>
23
24#include "tcm.h"
25#include "u_tcm.h"
26#include "configfs.h"
27
28#define TPG_INSTANCES		1
29
30struct tpg_instance {
31	struct usb_function_instance	*func_inst;
32	struct usbg_tpg			*tpg;
33};
34
35static struct tpg_instance tpg_instances[TPG_INSTANCES];
36
37static DEFINE_MUTEX(tpg_instances_lock);
38
39static inline struct f_uas *to_f_uas(struct usb_function *f)
40{
41	return container_of(f, struct f_uas, function);
42}
43
44/* Start bot.c code */
45
46static int bot_enqueue_cmd_cbw(struct f_uas *fu)
47{
48	int ret;
49
50	if (fu->flags & USBG_BOT_CMD_PEND)
51		return 0;
52
53	ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
54	if (!ret)
55		fu->flags |= USBG_BOT_CMD_PEND;
56	return ret;
57}
58
59static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
60{
61	struct usbg_cmd *cmd = req->context;
62	struct f_uas *fu = cmd->fu;
63
64	transport_generic_free_cmd(&cmd->se_cmd, 0);
65	if (req->status < 0) {
66		pr_err("ERR %s(%d)\n", __func__, __LINE__);
67		return;
68	}
69
70	/* CSW completed, wait for next CBW */
71	bot_enqueue_cmd_cbw(fu);
72}
73
74static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
75{
76	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
77	int ret;
78	unsigned int csw_stat;
79
80	csw_stat = cmd->csw_code;
81	csw->Tag = cmd->bot_tag;
82	csw->Status = csw_stat;
83	fu->bot_status.req->context = cmd;
84	ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
85	if (ret)
86		pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
87}
88
89static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
90{
91	struct usbg_cmd *cmd = req->context;
92	struct f_uas *fu = cmd->fu;
93
94	if (req->status < 0)
95		pr_err("ERR %s(%d)\n", __func__, __LINE__);
96
97	if (cmd->data_len) {
98		if (cmd->data_len > ep->maxpacket) {
99			req->length = ep->maxpacket;
100			cmd->data_len -= ep->maxpacket;
101		} else {
102			req->length = cmd->data_len;
103			cmd->data_len = 0;
104		}
105
106		usb_ep_queue(ep, req, GFP_ATOMIC);
107		return;
108	}
109	bot_enqueue_sense_code(fu, cmd);
110}
111
112static void bot_send_bad_status(struct usbg_cmd *cmd)
113{
114	struct f_uas *fu = cmd->fu;
115	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
116	struct usb_request *req;
117	struct usb_ep *ep;
118
119	csw->Residue = cpu_to_le32(cmd->data_len);
120
121	if (cmd->data_len) {
122		if (cmd->is_read) {
123			ep = fu->ep_in;
124			req = fu->bot_req_in;
125		} else {
126			ep = fu->ep_out;
127			req = fu->bot_req_out;
128		}
129
130		if (cmd->data_len > fu->ep_in->maxpacket) {
131			req->length = ep->maxpacket;
132			cmd->data_len -= ep->maxpacket;
133		} else {
134			req->length = cmd->data_len;
135			cmd->data_len = 0;
136		}
137		req->complete = bot_err_compl;
138		req->context = cmd;
139		req->buf = fu->cmd.buf;
140		usb_ep_queue(ep, req, GFP_KERNEL);
141	} else {
142		bot_enqueue_sense_code(fu, cmd);
143	}
144}
145
146static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
147{
148	struct f_uas *fu = cmd->fu;
149	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
150	int ret;
151
152	if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
153		if (!moved_data && cmd->data_len) {
154			/*
155			 * the host wants to move data, we don't. Fill / empty
156			 * the pipe and then send the csw with reside set.
157			 */
158			cmd->csw_code = US_BULK_STAT_OK;
159			bot_send_bad_status(cmd);
160			return 0;
161		}
162
163		csw->Tag = cmd->bot_tag;
164		csw->Residue = cpu_to_le32(0);
165		csw->Status = US_BULK_STAT_OK;
166		fu->bot_status.req->context = cmd;
167
168		ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
169		if (ret)
170			pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
171	} else {
172		cmd->csw_code = US_BULK_STAT_FAIL;
173		bot_send_bad_status(cmd);
174	}
175	return 0;
176}
177
178/*
179 * Called after command (no data transfer) or after the write (to device)
180 * operation is completed
181 */
182static int bot_send_status_response(struct usbg_cmd *cmd)
183{
184	bool moved_data = false;
185
186	if (!cmd->is_read)
187		moved_data = true;
188	return bot_send_status(cmd, moved_data);
189}
190
191/* Read request completed, now we have to send the CSW */
192static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
193{
194	struct usbg_cmd *cmd = req->context;
195
196	if (req->status < 0)
197		pr_err("ERR %s(%d)\n", __func__, __LINE__);
198
199	bot_send_status(cmd, true);
200}
201
202static int bot_send_read_response(struct usbg_cmd *cmd)
203{
204	struct f_uas *fu = cmd->fu;
205	struct se_cmd *se_cmd = &cmd->se_cmd;
206	struct usb_gadget *gadget = fuas_to_gadget(fu);
207	int ret;
208
209	if (!cmd->data_len) {
210		cmd->csw_code = US_BULK_STAT_PHASE;
211		bot_send_bad_status(cmd);
212		return 0;
213	}
214
215	if (!gadget->sg_supported) {
216		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
217		if (!cmd->data_buf)
218			return -ENOMEM;
219
220		sg_copy_to_buffer(se_cmd->t_data_sg,
221				se_cmd->t_data_nents,
222				cmd->data_buf,
223				se_cmd->data_length);
224
225		fu->bot_req_in->buf = cmd->data_buf;
226	} else {
227		fu->bot_req_in->buf = NULL;
228		fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
229		fu->bot_req_in->sg = se_cmd->t_data_sg;
230	}
231
232	fu->bot_req_in->complete = bot_read_compl;
233	fu->bot_req_in->length = se_cmd->data_length;
234	fu->bot_req_in->context = cmd;
235	ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
236	if (ret)
237		pr_err("%s(%d)\n", __func__, __LINE__);
238	return 0;
239}
240
241static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
242static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
243
244static int bot_send_write_request(struct usbg_cmd *cmd)
245{
246	struct f_uas *fu = cmd->fu;
247	struct se_cmd *se_cmd = &cmd->se_cmd;
248	struct usb_gadget *gadget = fuas_to_gadget(fu);
249	int ret;
250
251	init_completion(&cmd->write_complete);
252	cmd->fu = fu;
253
254	if (!cmd->data_len) {
255		cmd->csw_code = US_BULK_STAT_PHASE;
256		return -EINVAL;
257	}
258
259	if (!gadget->sg_supported) {
260		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL);
261		if (!cmd->data_buf)
262			return -ENOMEM;
263
264		fu->bot_req_out->buf = cmd->data_buf;
265	} else {
266		fu->bot_req_out->buf = NULL;
267		fu->bot_req_out->num_sgs = se_cmd->t_data_nents;
268		fu->bot_req_out->sg = se_cmd->t_data_sg;
269	}
270
271	fu->bot_req_out->complete = usbg_data_write_cmpl;
272	fu->bot_req_out->length = se_cmd->data_length;
273	fu->bot_req_out->context = cmd;
274
275	ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
276	if (ret)
277		goto cleanup;
278	ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
279	if (ret)
280		pr_err("%s(%d)\n", __func__, __LINE__);
281
282	wait_for_completion(&cmd->write_complete);
283	target_execute_cmd(se_cmd);
284cleanup:
285	return ret;
286}
287
288static int bot_submit_command(struct f_uas *, void *, unsigned int);
289
290static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
291{
292	struct f_uas *fu = req->context;
293	int ret;
294
295	fu->flags &= ~USBG_BOT_CMD_PEND;
296
297	if (req->status < 0)
298		return;
299
300	ret = bot_submit_command(fu, req->buf, req->actual);
301	if (ret)
302		pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
303}
304
305static int bot_prepare_reqs(struct f_uas *fu)
306{
307	int ret;
308
309	fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
310	if (!fu->bot_req_in)
311		goto err;
312
313	fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
314	if (!fu->bot_req_out)
315		goto err_out;
316
317	fu->cmd.req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
318	if (!fu->cmd.req)
319		goto err_cmd;
320
321	fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
322	if (!fu->bot_status.req)
323		goto err_sts;
324
325	fu->bot_status.req->buf = &fu->bot_status.csw;
326	fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
327	fu->bot_status.req->complete = bot_status_complete;
328	fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
329
330	fu->cmd.buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
331	if (!fu->cmd.buf)
332		goto err_buf;
333
334	fu->cmd.req->complete = bot_cmd_complete;
335	fu->cmd.req->buf = fu->cmd.buf;
336	fu->cmd.req->length = fu->ep_out->maxpacket;
337	fu->cmd.req->context = fu;
338
339	ret = bot_enqueue_cmd_cbw(fu);
340	if (ret)
341		goto err_queue;
342	return 0;
343err_queue:
344	kfree(fu->cmd.buf);
345	fu->cmd.buf = NULL;
346err_buf:
347	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
348err_sts:
349	usb_ep_free_request(fu->ep_out, fu->cmd.req);
350	fu->cmd.req = NULL;
351err_cmd:
352	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
353	fu->bot_req_out = NULL;
354err_out:
355	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
356	fu->bot_req_in = NULL;
357err:
358	pr_err("BOT: endpoint setup failed\n");
359	return -ENOMEM;
360}
361
362static void bot_cleanup_old_alt(struct f_uas *fu)
363{
364	if (!(fu->flags & USBG_ENABLED))
365		return;
366
367	usb_ep_disable(fu->ep_in);
368	usb_ep_disable(fu->ep_out);
369
370	if (!fu->bot_req_in)
371		return;
372
373	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
374	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
375	usb_ep_free_request(fu->ep_out, fu->cmd.req);
376	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
377
378	kfree(fu->cmd.buf);
379
380	fu->bot_req_in = NULL;
381	fu->bot_req_out = NULL;
382	fu->cmd.req = NULL;
383	fu->bot_status.req = NULL;
384	fu->cmd.buf = NULL;
385}
386
387static void bot_set_alt(struct f_uas *fu)
388{
389	struct usb_function *f = &fu->function;
390	struct usb_gadget *gadget = f->config->cdev->gadget;
391	int ret;
392
393	fu->flags = USBG_IS_BOT;
394
395	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_BBB);
396	ret = usb_ep_enable(fu->ep_in);
397	if (ret)
398		goto err_b_in;
399
400	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_BBB);
401	ret = usb_ep_enable(fu->ep_out);
402	if (ret)
403		goto err_b_out;
404
405	ret = bot_prepare_reqs(fu);
406	if (ret)
407		goto err_wq;
408	fu->flags |= USBG_ENABLED;
409	pr_info("Using the BOT protocol\n");
410	return;
411err_wq:
412	usb_ep_disable(fu->ep_out);
413err_b_out:
414	usb_ep_disable(fu->ep_in);
415err_b_in:
416	fu->flags = USBG_IS_BOT;
417}
418
419static int usbg_bot_setup(struct usb_function *f,
420		const struct usb_ctrlrequest *ctrl)
421{
422	struct f_uas *fu = to_f_uas(f);
423	struct usb_composite_dev *cdev = f->config->cdev;
424	u16 w_value = le16_to_cpu(ctrl->wValue);
425	u16 w_length = le16_to_cpu(ctrl->wLength);
426	int luns;
427	u8 *ret_lun;
428
429	switch (ctrl->bRequest) {
430	case US_BULK_GET_MAX_LUN:
431		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
432					USB_RECIP_INTERFACE))
433			return -ENOTSUPP;
434
435		if (w_length < 1)
436			return -EINVAL;
437		if (w_value != 0)
438			return -EINVAL;
439		luns = atomic_read(&fu->tpg->tpg_port_count);
440		if (!luns) {
441			pr_err("No LUNs configured?\n");
442			return -EINVAL;
443		}
444		/*
445		 * If 4 LUNs are present we return 3 i.e. LUN 0..3 can be
446		 * accessed. The upper limit is 0xf
447		 */
448		luns--;
449		if (luns > 0xf) {
450			pr_info_once("Limiting the number of luns to 16\n");
451			luns = 0xf;
452		}
453		ret_lun = cdev->req->buf;
454		*ret_lun = luns;
455		cdev->req->length = 1;
456		return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
457
458	case US_BULK_RESET_REQUEST:
459		/* XXX maybe we should remove previous requests for IN + OUT */
460		bot_enqueue_cmd_cbw(fu);
461		return 0;
462	}
463	return -ENOTSUPP;
464}
465
466/* Start uas.c code */
467
468static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
469{
470	/* We have either all three allocated or none */
471	if (!stream->req_in)
472		return;
473
474	usb_ep_free_request(fu->ep_in, stream->req_in);
475	usb_ep_free_request(fu->ep_out, stream->req_out);
476	usb_ep_free_request(fu->ep_status, stream->req_status);
477
478	stream->req_in = NULL;
479	stream->req_out = NULL;
480	stream->req_status = NULL;
481}
482
483static void uasp_free_cmdreq(struct f_uas *fu)
484{
485	usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
486	kfree(fu->cmd.buf);
487	fu->cmd.req = NULL;
488	fu->cmd.buf = NULL;
489}
490
491static void uasp_cleanup_old_alt(struct f_uas *fu)
492{
493	int i;
494
495	if (!(fu->flags & USBG_ENABLED))
496		return;
497
498	usb_ep_disable(fu->ep_in);
499	usb_ep_disable(fu->ep_out);
500	usb_ep_disable(fu->ep_status);
501	usb_ep_disable(fu->ep_cmd);
502
503	for (i = 0; i < UASP_SS_EP_COMP_NUM_STREAMS; i++)
504		uasp_cleanup_one_stream(fu, &fu->stream[i]);
505	uasp_free_cmdreq(fu);
506}
507
508static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
509
510static int uasp_prepare_r_request(struct usbg_cmd *cmd)
511{
512	struct se_cmd *se_cmd = &cmd->se_cmd;
513	struct f_uas *fu = cmd->fu;
514	struct usb_gadget *gadget = fuas_to_gadget(fu);
515	struct uas_stream *stream = cmd->stream;
516
517	if (!gadget->sg_supported) {
518		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
519		if (!cmd->data_buf)
520			return -ENOMEM;
521
522		sg_copy_to_buffer(se_cmd->t_data_sg,
523				se_cmd->t_data_nents,
524				cmd->data_buf,
525				se_cmd->data_length);
526
527		stream->req_in->buf = cmd->data_buf;
528	} else {
529		stream->req_in->buf = NULL;
530		stream->req_in->num_sgs = se_cmd->t_data_nents;
531		stream->req_in->sg = se_cmd->t_data_sg;
532	}
533
534	stream->req_in->is_last = 1;
535	stream->req_in->complete = uasp_status_data_cmpl;
536	stream->req_in->length = se_cmd->data_length;
537	stream->req_in->context = cmd;
538
539	cmd->state = UASP_SEND_STATUS;
540	return 0;
541}
542
543static void uasp_prepare_status(struct usbg_cmd *cmd)
544{
545	struct se_cmd *se_cmd = &cmd->se_cmd;
546	struct sense_iu *iu = &cmd->sense_iu;
547	struct uas_stream *stream = cmd->stream;
548
549	cmd->state = UASP_QUEUE_COMMAND;
550	iu->iu_id = IU_ID_STATUS;
551	iu->tag = cpu_to_be16(cmd->tag);
552
553	/*
554	 * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
555	 */
556	iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
557	iu->status = se_cmd->scsi_status;
558	stream->req_status->is_last = 1;
559	stream->req_status->context = cmd;
560	stream->req_status->length = se_cmd->scsi_sense_length + 16;
561	stream->req_status->buf = iu;
562	stream->req_status->complete = uasp_status_data_cmpl;
563}
564
565static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
566{
567	struct usbg_cmd *cmd = req->context;
568	struct uas_stream *stream = cmd->stream;
569	struct f_uas *fu = cmd->fu;
570	int ret;
571
572	if (req->status < 0)
573		goto cleanup;
574
575	switch (cmd->state) {
576	case UASP_SEND_DATA:
577		ret = uasp_prepare_r_request(cmd);
578		if (ret)
579			goto cleanup;
580		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
581		if (ret)
582			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
583		break;
584
585	case UASP_RECEIVE_DATA:
586		ret = usbg_prepare_w_request(cmd, stream->req_out);
587		if (ret)
588			goto cleanup;
589		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
590		if (ret)
591			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
592		break;
593
594	case UASP_SEND_STATUS:
595		uasp_prepare_status(cmd);
596		ret = usb_ep_queue(fu->ep_status, stream->req_status,
597				GFP_ATOMIC);
598		if (ret)
599			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
600		break;
601
602	case UASP_QUEUE_COMMAND:
603		transport_generic_free_cmd(&cmd->se_cmd, 0);
604		usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
605		break;
606
607	default:
608		BUG();
609	}
610	return;
611
612cleanup:
613	transport_generic_free_cmd(&cmd->se_cmd, 0);
614}
615
616static int uasp_send_status_response(struct usbg_cmd *cmd)
617{
618	struct f_uas *fu = cmd->fu;
619	struct uas_stream *stream = cmd->stream;
620	struct sense_iu *iu = &cmd->sense_iu;
621
622	iu->tag = cpu_to_be16(cmd->tag);
623	stream->req_status->complete = uasp_status_data_cmpl;
624	stream->req_status->context = cmd;
625	cmd->fu = fu;
626	uasp_prepare_status(cmd);
627	return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
628}
629
630static int uasp_send_read_response(struct usbg_cmd *cmd)
631{
632	struct f_uas *fu = cmd->fu;
633	struct uas_stream *stream = cmd->stream;
634	struct sense_iu *iu = &cmd->sense_iu;
635	int ret;
636
637	cmd->fu = fu;
638
639	iu->tag = cpu_to_be16(cmd->tag);
640	if (fu->flags & USBG_USE_STREAMS) {
641
642		ret = uasp_prepare_r_request(cmd);
643		if (ret)
644			goto out;
645		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
646		if (ret) {
647			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
648			kfree(cmd->data_buf);
649			cmd->data_buf = NULL;
650		}
651
652	} else {
653
654		iu->iu_id = IU_ID_READ_READY;
655		iu->tag = cpu_to_be16(cmd->tag);
656
657		stream->req_status->complete = uasp_status_data_cmpl;
658		stream->req_status->context = cmd;
659
660		cmd->state = UASP_SEND_DATA;
661		stream->req_status->buf = iu;
662		stream->req_status->length = sizeof(struct iu);
663
664		ret = usb_ep_queue(fu->ep_status, stream->req_status,
665				GFP_ATOMIC);
666		if (ret)
667			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
668	}
669out:
670	return ret;
671}
672
673static int uasp_send_write_request(struct usbg_cmd *cmd)
674{
675	struct f_uas *fu = cmd->fu;
676	struct se_cmd *se_cmd = &cmd->se_cmd;
677	struct uas_stream *stream = cmd->stream;
678	struct sense_iu *iu = &cmd->sense_iu;
679	int ret;
680
681	init_completion(&cmd->write_complete);
682	cmd->fu = fu;
683
684	iu->tag = cpu_to_be16(cmd->tag);
685
686	if (fu->flags & USBG_USE_STREAMS) {
687
688		ret = usbg_prepare_w_request(cmd, stream->req_out);
689		if (ret)
690			goto cleanup;
691		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
692		if (ret)
693			pr_err("%s(%d)\n", __func__, __LINE__);
694
695	} else {
696
697		iu->iu_id = IU_ID_WRITE_READY;
698		iu->tag = cpu_to_be16(cmd->tag);
699
700		stream->req_status->complete = uasp_status_data_cmpl;
701		stream->req_status->context = cmd;
702
703		cmd->state = UASP_RECEIVE_DATA;
704		stream->req_status->buf = iu;
705		stream->req_status->length = sizeof(struct iu);
706
707		ret = usb_ep_queue(fu->ep_status, stream->req_status,
708				GFP_ATOMIC);
709		if (ret)
710			pr_err("%s(%d)\n", __func__, __LINE__);
711	}
712
713	wait_for_completion(&cmd->write_complete);
714	target_execute_cmd(se_cmd);
715cleanup:
716	return ret;
717}
718
719static int usbg_submit_command(struct f_uas *, void *, unsigned int);
720
721static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
722{
723	struct f_uas *fu = req->context;
724	int ret;
725
726	if (req->status < 0)
727		return;
728
729	ret = usbg_submit_command(fu, req->buf, req->actual);
730	/*
731	 * Once we tune for performance enqueue the command req here again so
732	 * we can receive a second command while we processing this one. Pay
733	 * attention to properly sync STAUS endpoint with DATA IN + OUT so you
734	 * don't break HS.
735	 */
736	if (!ret)
737		return;
738	usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
739}
740
741static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
742{
743	stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
744	if (!stream->req_in)
745		goto out;
746
747	stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
748	if (!stream->req_out)
749		goto err_out;
750
751	stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
752	if (!stream->req_status)
753		goto err_sts;
754
755	return 0;
756
757err_sts:
758	usb_ep_free_request(fu->ep_out, stream->req_out);
759	stream->req_out = NULL;
760err_out:
761	usb_ep_free_request(fu->ep_in, stream->req_in);
762	stream->req_in = NULL;
763out:
764	return -ENOMEM;
765}
766
767static int uasp_alloc_cmd(struct f_uas *fu)
768{
769	fu->cmd.req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
770	if (!fu->cmd.req)
771		goto err;
772
773	fu->cmd.buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
774	if (!fu->cmd.buf)
775		goto err_buf;
776
777	fu->cmd.req->complete = uasp_cmd_complete;
778	fu->cmd.req->buf = fu->cmd.buf;
779	fu->cmd.req->length = fu->ep_cmd->maxpacket;
780	fu->cmd.req->context = fu;
781	return 0;
782
783err_buf:
784	usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
785err:
786	return -ENOMEM;
787}
788
789static void uasp_setup_stream_res(struct f_uas *fu, int max_streams)
790{
791	int i;
792
793	for (i = 0; i < max_streams; i++) {
794		struct uas_stream *s = &fu->stream[i];
795
796		s->req_in->stream_id = i + 1;
797		s->req_out->stream_id = i + 1;
798		s->req_status->stream_id = i + 1;
799	}
800}
801
802static int uasp_prepare_reqs(struct f_uas *fu)
803{
804	int ret;
805	int i;
806	int max_streams;
807
808	if (fu->flags & USBG_USE_STREAMS)
809		max_streams = UASP_SS_EP_COMP_NUM_STREAMS;
810	else
811		max_streams = 1;
812
813	for (i = 0; i < max_streams; i++) {
814		ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
815		if (ret)
816			goto err_cleanup;
817	}
818
819	ret = uasp_alloc_cmd(fu);
820	if (ret)
821		goto err_free_stream;
822	uasp_setup_stream_res(fu, max_streams);
823
824	ret = usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
825	if (ret)
826		goto err_free_stream;
827
828	return 0;
829
830err_free_stream:
831	uasp_free_cmdreq(fu);
832
833err_cleanup:
834	if (i) {
835		do {
836			uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
837			i--;
838		} while (i);
839	}
840	pr_err("UASP: endpoint setup failed\n");
841	return ret;
842}
843
844static void uasp_set_alt(struct f_uas *fu)
845{
846	struct usb_function *f = &fu->function;
847	struct usb_gadget *gadget = f->config->cdev->gadget;
848	int ret;
849
850	fu->flags = USBG_IS_UAS;
851
852	if (gadget->speed >= USB_SPEED_SUPER)
853		fu->flags |= USBG_USE_STREAMS;
854
855	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_UAS);
856	ret = usb_ep_enable(fu->ep_in);
857	if (ret)
858		goto err_b_in;
859
860	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_UAS);
861	ret = usb_ep_enable(fu->ep_out);
862	if (ret)
863		goto err_b_out;
864
865	config_ep_by_speed_and_alt(gadget, f, fu->ep_cmd, USB_G_ALT_INT_UAS);
866	ret = usb_ep_enable(fu->ep_cmd);
867	if (ret)
868		goto err_cmd;
869	config_ep_by_speed_and_alt(gadget, f, fu->ep_status, USB_G_ALT_INT_UAS);
870	ret = usb_ep_enable(fu->ep_status);
871	if (ret)
872		goto err_status;
873
874	ret = uasp_prepare_reqs(fu);
875	if (ret)
876		goto err_wq;
877	fu->flags |= USBG_ENABLED;
878
879	pr_info("Using the UAS protocol\n");
880	return;
881err_wq:
882	usb_ep_disable(fu->ep_status);
883err_status:
884	usb_ep_disable(fu->ep_cmd);
885err_cmd:
886	usb_ep_disable(fu->ep_out);
887err_b_out:
888	usb_ep_disable(fu->ep_in);
889err_b_in:
890	fu->flags = 0;
891}
892
893static int get_cmd_dir(const unsigned char *cdb)
894{
895	int ret;
896
897	switch (cdb[0]) {
898	case READ_6:
899	case READ_10:
900	case READ_12:
901	case READ_16:
902	case INQUIRY:
903	case MODE_SENSE:
904	case MODE_SENSE_10:
905	case SERVICE_ACTION_IN_16:
906	case MAINTENANCE_IN:
907	case PERSISTENT_RESERVE_IN:
908	case SECURITY_PROTOCOL_IN:
909	case ACCESS_CONTROL_IN:
910	case REPORT_LUNS:
911	case READ_BLOCK_LIMITS:
912	case READ_POSITION:
913	case READ_CAPACITY:
914	case READ_TOC:
915	case READ_FORMAT_CAPACITIES:
916	case REQUEST_SENSE:
917		ret = DMA_FROM_DEVICE;
918		break;
919
920	case WRITE_6:
921	case WRITE_10:
922	case WRITE_12:
923	case WRITE_16:
924	case MODE_SELECT:
925	case MODE_SELECT_10:
926	case WRITE_VERIFY:
927	case WRITE_VERIFY_12:
928	case PERSISTENT_RESERVE_OUT:
929	case MAINTENANCE_OUT:
930	case SECURITY_PROTOCOL_OUT:
931	case ACCESS_CONTROL_OUT:
932		ret = DMA_TO_DEVICE;
933		break;
934	case ALLOW_MEDIUM_REMOVAL:
935	case TEST_UNIT_READY:
936	case SYNCHRONIZE_CACHE:
937	case START_STOP:
938	case ERASE:
939	case REZERO_UNIT:
940	case SEEK_10:
941	case SPACE:
942	case VERIFY:
943	case WRITE_FILEMARKS:
944		ret = DMA_NONE;
945		break;
946	default:
947#define CMD_DIR_MSG "target: Unknown data direction for SCSI Opcode 0x%02x\n"
948		pr_warn(CMD_DIR_MSG, cdb[0]);
949#undef CMD_DIR_MSG
950		ret = -EINVAL;
951	}
952	return ret;
953}
954
955static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
956{
957	struct usbg_cmd *cmd = req->context;
958	struct se_cmd *se_cmd = &cmd->se_cmd;
959
960	if (req->status < 0) {
961		pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
962		goto cleanup;
963	}
964
965	if (req->num_sgs == 0) {
966		sg_copy_from_buffer(se_cmd->t_data_sg,
967				se_cmd->t_data_nents,
968				cmd->data_buf,
969				se_cmd->data_length);
970	}
971
972	complete(&cmd->write_complete);
973	return;
974
975cleanup:
976	transport_generic_free_cmd(&cmd->se_cmd, 0);
977}
978
979static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
980{
981	struct se_cmd *se_cmd = &cmd->se_cmd;
982	struct f_uas *fu = cmd->fu;
983	struct usb_gadget *gadget = fuas_to_gadget(fu);
984
985	if (!gadget->sg_supported) {
986		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
987		if (!cmd->data_buf)
988			return -ENOMEM;
989
990		req->buf = cmd->data_buf;
991	} else {
992		req->buf = NULL;
993		req->num_sgs = se_cmd->t_data_nents;
994		req->sg = se_cmd->t_data_sg;
995	}
996
997	req->is_last = 1;
998	req->complete = usbg_data_write_cmpl;
999	req->length = se_cmd->data_length;
1000	req->context = cmd;
1001	return 0;
1002}
1003
1004static int usbg_send_status_response(struct se_cmd *se_cmd)
1005{
1006	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1007			se_cmd);
1008	struct f_uas *fu = cmd->fu;
1009
1010	if (fu->flags & USBG_IS_BOT)
1011		return bot_send_status_response(cmd);
1012	else
1013		return uasp_send_status_response(cmd);
1014}
1015
1016static int usbg_send_write_request(struct se_cmd *se_cmd)
1017{
1018	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1019			se_cmd);
1020	struct f_uas *fu = cmd->fu;
1021
1022	if (fu->flags & USBG_IS_BOT)
1023		return bot_send_write_request(cmd);
1024	else
1025		return uasp_send_write_request(cmd);
1026}
1027
1028static int usbg_send_read_response(struct se_cmd *se_cmd)
1029{
1030	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1031			se_cmd);
1032	struct f_uas *fu = cmd->fu;
1033
1034	if (fu->flags & USBG_IS_BOT)
1035		return bot_send_read_response(cmd);
1036	else
1037		return uasp_send_read_response(cmd);
1038}
1039
1040static void usbg_cmd_work(struct work_struct *work)
1041{
1042	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1043	struct se_cmd *se_cmd;
1044	struct tcm_usbg_nexus *tv_nexus;
1045	struct usbg_tpg *tpg;
1046	int dir, flags = (TARGET_SCF_UNKNOWN_SIZE | TARGET_SCF_ACK_KREF);
1047
1048	se_cmd = &cmd->se_cmd;
1049	tpg = cmd->fu->tpg;
1050	tv_nexus = tpg->tpg_nexus;
1051	dir = get_cmd_dir(cmd->cmd_buf);
1052	if (dir < 0) {
1053		__target_init_cmd(se_cmd,
1054				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1055				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1056				  cmd->prio_attr, cmd->sense_iu.sense,
1057				  cmd->unpacked_lun, NULL);
1058		goto out;
1059	}
1060
1061	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess, cmd->cmd_buf,
1062			  cmd->sense_iu.sense, cmd->unpacked_lun, 0,
1063			  cmd->prio_attr, dir, flags);
1064	return;
1065
1066out:
1067	transport_send_check_condition_and_sense(se_cmd,
1068			TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1069	transport_generic_free_cmd(&cmd->se_cmd, 0);
1070}
1071
1072static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
1073		struct tcm_usbg_nexus *tv_nexus, u32 scsi_tag)
1074{
1075	struct se_session *se_sess = tv_nexus->tvn_se_sess;
1076	struct usbg_cmd *cmd;
1077	int tag, cpu;
1078
1079	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
1080	if (tag < 0)
1081		return ERR_PTR(-ENOMEM);
1082
1083	cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[tag];
1084	memset(cmd, 0, sizeof(*cmd));
1085	cmd->se_cmd.map_tag = tag;
1086	cmd->se_cmd.map_cpu = cpu;
1087	cmd->se_cmd.tag = cmd->tag = scsi_tag;
1088	cmd->fu = fu;
1089
1090	return cmd;
1091}
1092
1093static void usbg_release_cmd(struct se_cmd *);
1094
1095static int usbg_submit_command(struct f_uas *fu,
1096		void *cmdbuf, unsigned int len)
1097{
1098	struct command_iu *cmd_iu = cmdbuf;
1099	struct usbg_cmd *cmd;
1100	struct usbg_tpg *tpg = fu->tpg;
1101	struct tcm_usbg_nexus *tv_nexus;
1102	u32 cmd_len;
1103	u16 scsi_tag;
1104
1105	if (cmd_iu->iu_id != IU_ID_COMMAND) {
1106		pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1107		return -EINVAL;
1108	}
1109
1110	tv_nexus = tpg->tpg_nexus;
1111	if (!tv_nexus) {
1112		pr_err("Missing nexus, ignoring command\n");
1113		return -EINVAL;
1114	}
1115
1116	cmd_len = (cmd_iu->len & ~0x3) + 16;
1117	if (cmd_len > USBG_MAX_CMD)
1118		return -EINVAL;
1119
1120	scsi_tag = be16_to_cpup(&cmd_iu->tag);
1121	cmd = usbg_get_cmd(fu, tv_nexus, scsi_tag);
1122	if (IS_ERR(cmd)) {
1123		pr_err("usbg_get_cmd failed\n");
1124		return -ENOMEM;
1125	}
1126	memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1127
1128	if (fu->flags & USBG_USE_STREAMS) {
1129		if (cmd->tag > UASP_SS_EP_COMP_NUM_STREAMS)
1130			goto err;
1131		if (!cmd->tag)
1132			cmd->stream = &fu->stream[0];
1133		else
1134			cmd->stream = &fu->stream[cmd->tag - 1];
1135	} else {
1136		cmd->stream = &fu->stream[0];
1137	}
1138
1139	switch (cmd_iu->prio_attr & 0x7) {
1140	case UAS_HEAD_TAG:
1141		cmd->prio_attr = TCM_HEAD_TAG;
1142		break;
1143	case UAS_ORDERED_TAG:
1144		cmd->prio_attr = TCM_ORDERED_TAG;
1145		break;
1146	case UAS_ACA:
1147		cmd->prio_attr = TCM_ACA_TAG;
1148		break;
1149	default:
1150		pr_debug_once("Unsupported prio_attr: %02x.\n",
1151				cmd_iu->prio_attr);
1152		fallthrough;
1153	case UAS_SIMPLE_TAG:
1154		cmd->prio_attr = TCM_SIMPLE_TAG;
1155		break;
1156	}
1157
1158	cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1159
1160	INIT_WORK(&cmd->work, usbg_cmd_work);
1161	queue_work(tpg->workqueue, &cmd->work);
1162
1163	return 0;
1164err:
1165	usbg_release_cmd(&cmd->se_cmd);
1166	return -EINVAL;
1167}
1168
1169static void bot_cmd_work(struct work_struct *work)
1170{
1171	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1172	struct se_cmd *se_cmd;
1173	struct tcm_usbg_nexus *tv_nexus;
1174	struct usbg_tpg *tpg;
1175	int dir;
1176
1177	se_cmd = &cmd->se_cmd;
1178	tpg = cmd->fu->tpg;
1179	tv_nexus = tpg->tpg_nexus;
1180	dir = get_cmd_dir(cmd->cmd_buf);
1181	if (dir < 0) {
1182		__target_init_cmd(se_cmd,
1183				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1184				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1185				  cmd->prio_attr, cmd->sense_iu.sense,
1186				  cmd->unpacked_lun, NULL);
1187		goto out;
1188	}
1189
1190	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1191			  cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1192			  cmd->data_len, cmd->prio_attr, dir, 0);
1193	return;
1194
1195out:
1196	transport_send_check_condition_and_sense(se_cmd,
1197				TCM_UNSUPPORTED_SCSI_OPCODE, 1);
1198	transport_generic_free_cmd(&cmd->se_cmd, 0);
1199}
1200
1201static int bot_submit_command(struct f_uas *fu,
1202		void *cmdbuf, unsigned int len)
1203{
1204	struct bulk_cb_wrap *cbw = cmdbuf;
1205	struct usbg_cmd *cmd;
1206	struct usbg_tpg *tpg = fu->tpg;
1207	struct tcm_usbg_nexus *tv_nexus;
1208	u32 cmd_len;
1209
1210	if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1211		pr_err("Wrong signature on CBW\n");
1212		return -EINVAL;
1213	}
1214	if (len != 31) {
1215		pr_err("Wrong length for CBW\n");
1216		return -EINVAL;
1217	}
1218
1219	cmd_len = cbw->Length;
1220	if (cmd_len < 1 || cmd_len > 16)
1221		return -EINVAL;
1222
1223	tv_nexus = tpg->tpg_nexus;
1224	if (!tv_nexus) {
1225		pr_err("Missing nexus, ignoring command\n");
1226		return -ENODEV;
1227	}
1228
1229	cmd = usbg_get_cmd(fu, tv_nexus, cbw->Tag);
1230	if (IS_ERR(cmd)) {
1231		pr_err("usbg_get_cmd failed\n");
1232		return -ENOMEM;
1233	}
1234	memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1235
1236	cmd->bot_tag = cbw->Tag;
1237	cmd->prio_attr = TCM_SIMPLE_TAG;
1238	cmd->unpacked_lun = cbw->Lun;
1239	cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1240	cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1241	cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1242
1243	INIT_WORK(&cmd->work, bot_cmd_work);
1244	queue_work(tpg->workqueue, &cmd->work);
1245
1246	return 0;
1247}
1248
1249/* Start fabric.c code */
1250
1251static int usbg_check_true(struct se_portal_group *se_tpg)
1252{
1253	return 1;
1254}
1255
1256static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1257{
1258	struct usbg_tpg *tpg = container_of(se_tpg,
1259				struct usbg_tpg, se_tpg);
1260	struct usbg_tport *tport = tpg->tport;
1261
1262	return &tport->tport_name[0];
1263}
1264
1265static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1266{
1267	struct usbg_tpg *tpg = container_of(se_tpg,
1268				struct usbg_tpg, se_tpg);
1269	return tpg->tport_tpgt;
1270}
1271
1272static void usbg_release_cmd(struct se_cmd *se_cmd)
1273{
1274	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1275			se_cmd);
1276	struct se_session *se_sess = se_cmd->se_sess;
1277
1278	kfree(cmd->data_buf);
1279	target_free_tag(se_sess, se_cmd);
1280}
1281
1282static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1283{
1284}
1285
1286static void usbg_aborted_task(struct se_cmd *se_cmd)
1287{
1288}
1289
1290static const char *usbg_check_wwn(const char *name)
1291{
1292	const char *n;
1293	unsigned int len;
1294
1295	n = strstr(name, "naa.");
1296	if (!n)
1297		return NULL;
1298	n += 4;
1299	len = strlen(n);
1300	if (len == 0 || len > USBG_NAMELEN - 1)
1301		return NULL;
1302	return n;
1303}
1304
1305static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1306{
1307	if (!usbg_check_wwn(name))
1308		return -EINVAL;
1309	return 0;
1310}
1311
1312static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
1313					     const char *name)
1314{
1315	struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1316			tport_wwn);
1317	struct usbg_tpg *tpg;
1318	unsigned long tpgt;
1319	int ret;
1320	struct f_tcm_opts *opts;
1321	unsigned i;
1322
1323	if (strstr(name, "tpgt_") != name)
1324		return ERR_PTR(-EINVAL);
1325	if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1326		return ERR_PTR(-EINVAL);
1327	ret = -ENODEV;
1328	mutex_lock(&tpg_instances_lock);
1329	for (i = 0; i < TPG_INSTANCES; ++i)
1330		if (tpg_instances[i].func_inst && !tpg_instances[i].tpg)
1331			break;
1332	if (i == TPG_INSTANCES)
1333		goto unlock_inst;
1334
1335	opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
1336		func_inst);
1337	mutex_lock(&opts->dep_lock);
1338	if (!opts->ready)
1339		goto unlock_dep;
1340
1341	if (opts->has_dep) {
1342		if (!try_module_get(opts->dependent))
1343			goto unlock_dep;
1344	} else {
1345		ret = configfs_depend_item_unlocked(
1346			wwn->wwn_group.cg_subsys,
1347			&opts->func_inst.group.cg_item);
1348		if (ret)
1349			goto unlock_dep;
1350	}
1351
1352	tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1353	ret = -ENOMEM;
1354	if (!tpg)
1355		goto unref_dep;
1356	mutex_init(&tpg->tpg_mutex);
1357	atomic_set(&tpg->tpg_port_count, 0);
1358	tpg->workqueue = alloc_workqueue("tcm_usb_gadget", 0, 1);
1359	if (!tpg->workqueue)
1360		goto free_tpg;
1361
1362	tpg->tport = tport;
1363	tpg->tport_tpgt = tpgt;
1364
1365	/*
1366	 * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1367	 * pretend to be SAS..
1368	 */
1369	ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1370	if (ret < 0)
1371		goto free_workqueue;
1372
1373	tpg_instances[i].tpg = tpg;
1374	tpg->fi = tpg_instances[i].func_inst;
1375	mutex_unlock(&opts->dep_lock);
1376	mutex_unlock(&tpg_instances_lock);
1377	return &tpg->se_tpg;
1378
1379free_workqueue:
1380	destroy_workqueue(tpg->workqueue);
1381free_tpg:
1382	kfree(tpg);
1383unref_dep:
1384	if (opts->has_dep)
1385		module_put(opts->dependent);
1386	else
1387		configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1388unlock_dep:
1389	mutex_unlock(&opts->dep_lock);
1390unlock_inst:
1391	mutex_unlock(&tpg_instances_lock);
1392
1393	return ERR_PTR(ret);
1394}
1395
1396static int tcm_usbg_drop_nexus(struct usbg_tpg *);
1397
1398static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1399{
1400	struct usbg_tpg *tpg = container_of(se_tpg,
1401				struct usbg_tpg, se_tpg);
1402	unsigned i;
1403	struct f_tcm_opts *opts;
1404
1405	tcm_usbg_drop_nexus(tpg);
1406	core_tpg_deregister(se_tpg);
1407	destroy_workqueue(tpg->workqueue);
1408
1409	mutex_lock(&tpg_instances_lock);
1410	for (i = 0; i < TPG_INSTANCES; ++i)
1411		if (tpg_instances[i].tpg == tpg)
1412			break;
1413	if (i < TPG_INSTANCES) {
1414		tpg_instances[i].tpg = NULL;
1415		opts = container_of(tpg_instances[i].func_inst,
1416			struct f_tcm_opts, func_inst);
1417		mutex_lock(&opts->dep_lock);
1418		if (opts->has_dep)
1419			module_put(opts->dependent);
1420		else
1421			configfs_undepend_item_unlocked(
1422				&opts->func_inst.group.cg_item);
1423		mutex_unlock(&opts->dep_lock);
1424	}
1425	mutex_unlock(&tpg_instances_lock);
1426
1427	kfree(tpg);
1428}
1429
1430static struct se_wwn *usbg_make_tport(
1431	struct target_fabric_configfs *tf,
1432	struct config_group *group,
1433	const char *name)
1434{
1435	struct usbg_tport *tport;
1436	const char *wnn_name;
1437	u64 wwpn = 0;
1438
1439	wnn_name = usbg_check_wwn(name);
1440	if (!wnn_name)
1441		return ERR_PTR(-EINVAL);
1442
1443	tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1444	if (!(tport))
1445		return ERR_PTR(-ENOMEM);
1446
1447	tport->tport_wwpn = wwpn;
1448	snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1449	return &tport->tport_wwn;
1450}
1451
1452static void usbg_drop_tport(struct se_wwn *wwn)
1453{
1454	struct usbg_tport *tport = container_of(wwn,
1455				struct usbg_tport, tport_wwn);
1456	kfree(tport);
1457}
1458
1459/*
1460 * If somebody feels like dropping the version property, go ahead.
1461 */
1462static ssize_t usbg_wwn_version_show(struct config_item *item,  char *page)
1463{
1464	return sprintf(page, "usb-gadget fabric module\n");
1465}
1466
1467CONFIGFS_ATTR_RO(usbg_wwn_, version);
1468
1469static struct configfs_attribute *usbg_wwn_attrs[] = {
1470	&usbg_wwn_attr_version,
1471	NULL,
1472};
1473
1474static int usbg_attach(struct usbg_tpg *);
1475static void usbg_detach(struct usbg_tpg *);
1476
1477static int usbg_enable_tpg(struct se_portal_group *se_tpg, bool enable)
1478{
1479	struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1480	int ret = 0;
1481
1482	if (enable)
1483		ret = usbg_attach(tpg);
1484	else
1485		usbg_detach(tpg);
1486	if (ret)
1487		return ret;
1488
1489	tpg->gadget_connect = enable;
1490
1491	return 0;
1492}
1493
1494static ssize_t tcm_usbg_tpg_nexus_show(struct config_item *item, char *page)
1495{
1496	struct se_portal_group *se_tpg = to_tpg(item);
1497	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1498	struct tcm_usbg_nexus *tv_nexus;
1499	ssize_t ret;
1500
1501	mutex_lock(&tpg->tpg_mutex);
1502	tv_nexus = tpg->tpg_nexus;
1503	if (!tv_nexus) {
1504		ret = -ENODEV;
1505		goto out;
1506	}
1507	ret = sysfs_emit(page, "%s\n",
1508			 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1509out:
1510	mutex_unlock(&tpg->tpg_mutex);
1511	return ret;
1512}
1513
1514static int usbg_alloc_sess_cb(struct se_portal_group *se_tpg,
1515			      struct se_session *se_sess, void *p)
1516{
1517	struct usbg_tpg *tpg = container_of(se_tpg,
1518				struct usbg_tpg, se_tpg);
1519
1520	tpg->tpg_nexus = p;
1521	return 0;
1522}
1523
1524static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1525{
1526	struct tcm_usbg_nexus *tv_nexus;
1527	int ret = 0;
1528
1529	mutex_lock(&tpg->tpg_mutex);
1530	if (tpg->tpg_nexus) {
1531		ret = -EEXIST;
1532		pr_debug("tpg->tpg_nexus already exists\n");
1533		goto out_unlock;
1534	}
1535
1536	tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1537	if (!tv_nexus) {
1538		ret = -ENOMEM;
1539		goto out_unlock;
1540	}
1541
1542	tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg,
1543						     USB_G_DEFAULT_SESSION_TAGS,
1544						     sizeof(struct usbg_cmd),
1545						     TARGET_PROT_NORMAL, name,
1546						     tv_nexus, usbg_alloc_sess_cb);
1547	if (IS_ERR(tv_nexus->tvn_se_sess)) {
1548#define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
1549		pr_debug(MAKE_NEXUS_MSG, name);
1550#undef MAKE_NEXUS_MSG
1551		ret = PTR_ERR(tv_nexus->tvn_se_sess);
1552		kfree(tv_nexus);
1553	}
1554
1555out_unlock:
1556	mutex_unlock(&tpg->tpg_mutex);
1557	return ret;
1558}
1559
1560static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1561{
1562	struct se_session *se_sess;
1563	struct tcm_usbg_nexus *tv_nexus;
1564	int ret = -ENODEV;
1565
1566	mutex_lock(&tpg->tpg_mutex);
1567	tv_nexus = tpg->tpg_nexus;
1568	if (!tv_nexus)
1569		goto out;
1570
1571	se_sess = tv_nexus->tvn_se_sess;
1572	if (!se_sess)
1573		goto out;
1574
1575	if (atomic_read(&tpg->tpg_port_count)) {
1576		ret = -EPERM;
1577#define MSG "Unable to remove Host I_T Nexus with active TPG port count: %d\n"
1578		pr_err(MSG, atomic_read(&tpg->tpg_port_count));
1579#undef MSG
1580		goto out;
1581	}
1582
1583	pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1584			tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1585	/*
1586	 * Release the SCSI I_T Nexus to the emulated vHost Target Port
1587	 */
1588	target_remove_session(se_sess);
1589	tpg->tpg_nexus = NULL;
1590
1591	kfree(tv_nexus);
1592	ret = 0;
1593out:
1594	mutex_unlock(&tpg->tpg_mutex);
1595	return ret;
1596}
1597
1598static ssize_t tcm_usbg_tpg_nexus_store(struct config_item *item,
1599		const char *page, size_t count)
1600{
1601	struct se_portal_group *se_tpg = to_tpg(item);
1602	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1603	unsigned char i_port[USBG_NAMELEN], *ptr;
1604	int ret;
1605
1606	if (!strncmp(page, "NULL", 4)) {
1607		ret = tcm_usbg_drop_nexus(tpg);
1608		return (!ret) ? count : ret;
1609	}
1610	if (strlen(page) >= USBG_NAMELEN) {
1611
1612#define NEXUS_STORE_MSG "Emulated NAA Sas Address: %s, exceeds max: %d\n"
1613		pr_err(NEXUS_STORE_MSG, page, USBG_NAMELEN);
1614#undef NEXUS_STORE_MSG
1615		return -EINVAL;
1616	}
1617	snprintf(i_port, USBG_NAMELEN, "%s", page);
1618
1619	ptr = strstr(i_port, "naa.");
1620	if (!ptr) {
1621		pr_err("Missing 'naa.' prefix\n");
1622		return -EINVAL;
1623	}
1624
1625	if (i_port[strlen(i_port) - 1] == '\n')
1626		i_port[strlen(i_port) - 1] = '\0';
1627
1628	ret = tcm_usbg_make_nexus(tpg, &i_port[0]);
1629	if (ret < 0)
1630		return ret;
1631	return count;
1632}
1633
1634CONFIGFS_ATTR(tcm_usbg_tpg_, nexus);
1635
1636static struct configfs_attribute *usbg_base_attrs[] = {
1637	&tcm_usbg_tpg_attr_nexus,
1638	NULL,
1639};
1640
1641static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1642{
1643	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1644
1645	atomic_inc(&tpg->tpg_port_count);
1646	smp_mb__after_atomic();
1647	return 0;
1648}
1649
1650static void usbg_port_unlink(struct se_portal_group *se_tpg,
1651		struct se_lun *se_lun)
1652{
1653	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1654
1655	atomic_dec(&tpg->tpg_port_count);
1656	smp_mb__after_atomic();
1657}
1658
1659static int usbg_check_stop_free(struct se_cmd *se_cmd)
1660{
1661	return target_put_sess_cmd(se_cmd);
1662}
1663
1664static const struct target_core_fabric_ops usbg_ops = {
1665	.module				= THIS_MODULE,
1666	.fabric_name			= "usb_gadget",
1667	.tpg_get_wwn			= usbg_get_fabric_wwn,
1668	.tpg_get_tag			= usbg_get_tag,
1669	.tpg_check_demo_mode		= usbg_check_true,
1670	.release_cmd			= usbg_release_cmd,
1671	.sess_get_initiator_sid		= NULL,
1672	.write_pending			= usbg_send_write_request,
1673	.queue_data_in			= usbg_send_read_response,
1674	.queue_status			= usbg_send_status_response,
1675	.queue_tm_rsp			= usbg_queue_tm_rsp,
1676	.aborted_task			= usbg_aborted_task,
1677	.check_stop_free		= usbg_check_stop_free,
1678
1679	.fabric_make_wwn		= usbg_make_tport,
1680	.fabric_drop_wwn		= usbg_drop_tport,
1681	.fabric_make_tpg		= usbg_make_tpg,
1682	.fabric_enable_tpg		= usbg_enable_tpg,
1683	.fabric_drop_tpg		= usbg_drop_tpg,
1684	.fabric_post_link		= usbg_port_link,
1685	.fabric_pre_unlink		= usbg_port_unlink,
1686	.fabric_init_nodeacl		= usbg_init_nodeacl,
1687
1688	.tfc_wwn_attrs			= usbg_wwn_attrs,
1689	.tfc_tpg_base_attrs		= usbg_base_attrs,
1690
1691	.default_submit_type		= TARGET_DIRECT_SUBMIT,
1692	.direct_submit_supp		= 1,
1693};
1694
1695/* Start gadget.c code */
1696
1697static struct usb_interface_descriptor bot_intf_desc = {
1698	.bLength =              sizeof(bot_intf_desc),
1699	.bDescriptorType =      USB_DT_INTERFACE,
1700	.bNumEndpoints =        2,
1701	.bAlternateSetting =	USB_G_ALT_INT_BBB,
1702	.bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1703	.bInterfaceSubClass =   USB_SC_SCSI,
1704	.bInterfaceProtocol =   USB_PR_BULK,
1705};
1706
1707static struct usb_interface_descriptor uasp_intf_desc = {
1708	.bLength =		sizeof(uasp_intf_desc),
1709	.bDescriptorType =	USB_DT_INTERFACE,
1710	.bNumEndpoints =	4,
1711	.bAlternateSetting =	USB_G_ALT_INT_UAS,
1712	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
1713	.bInterfaceSubClass =	USB_SC_SCSI,
1714	.bInterfaceProtocol =	USB_PR_UAS,
1715};
1716
1717static struct usb_endpoint_descriptor uasp_bi_desc = {
1718	.bLength =		USB_DT_ENDPOINT_SIZE,
1719	.bDescriptorType =	USB_DT_ENDPOINT,
1720	.bEndpointAddress =	USB_DIR_IN,
1721	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1722	.wMaxPacketSize =	cpu_to_le16(512),
1723};
1724
1725static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1726	.bLength =		USB_DT_ENDPOINT_SIZE,
1727	.bDescriptorType =	USB_DT_ENDPOINT,
1728	.bEndpointAddress =	USB_DIR_IN,
1729	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1730};
1731
1732static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1733	.bLength =		sizeof(uasp_bi_pipe_desc),
1734	.bDescriptorType =	USB_DT_PIPE_USAGE,
1735	.bPipeID =		DATA_IN_PIPE_ID,
1736};
1737
1738static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1739	.bLength =		USB_DT_ENDPOINT_SIZE,
1740	.bDescriptorType =	USB_DT_ENDPOINT,
1741	.bEndpointAddress =	USB_DIR_IN,
1742	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1743	.wMaxPacketSize =	cpu_to_le16(1024),
1744};
1745
1746static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1747	.bLength =		sizeof(uasp_bi_ep_comp_desc),
1748	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1749	.bMaxBurst =		0,
1750	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1751	.wBytesPerInterval =	0,
1752};
1753
1754static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1755	.bLength =		sizeof(bot_bi_ep_comp_desc),
1756	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1757	.bMaxBurst =		0,
1758};
1759
1760static struct usb_endpoint_descriptor uasp_bo_desc = {
1761	.bLength =		USB_DT_ENDPOINT_SIZE,
1762	.bDescriptorType =	USB_DT_ENDPOINT,
1763	.bEndpointAddress =	USB_DIR_OUT,
1764	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1765	.wMaxPacketSize =	cpu_to_le16(512),
1766};
1767
1768static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1769	.bLength =		USB_DT_ENDPOINT_SIZE,
1770	.bDescriptorType =	USB_DT_ENDPOINT,
1771	.bEndpointAddress =	USB_DIR_OUT,
1772	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1773};
1774
1775static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1776	.bLength =		sizeof(uasp_bo_pipe_desc),
1777	.bDescriptorType =	USB_DT_PIPE_USAGE,
1778	.bPipeID =		DATA_OUT_PIPE_ID,
1779};
1780
1781static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1782	.bLength =		USB_DT_ENDPOINT_SIZE,
1783	.bDescriptorType =	USB_DT_ENDPOINT,
1784	.bEndpointAddress =	USB_DIR_OUT,
1785	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1786	.wMaxPacketSize =	cpu_to_le16(0x400),
1787};
1788
1789static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1790	.bLength =		sizeof(uasp_bo_ep_comp_desc),
1791	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1792	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1793};
1794
1795static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1796	.bLength =		sizeof(bot_bo_ep_comp_desc),
1797	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1798};
1799
1800static struct usb_endpoint_descriptor uasp_status_desc = {
1801	.bLength =		USB_DT_ENDPOINT_SIZE,
1802	.bDescriptorType =	USB_DT_ENDPOINT,
1803	.bEndpointAddress =	USB_DIR_IN,
1804	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1805	.wMaxPacketSize =	cpu_to_le16(512),
1806};
1807
1808static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1809	.bLength =		USB_DT_ENDPOINT_SIZE,
1810	.bDescriptorType =	USB_DT_ENDPOINT,
1811	.bEndpointAddress =	USB_DIR_IN,
1812	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1813};
1814
1815static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1816	.bLength =		sizeof(uasp_status_pipe_desc),
1817	.bDescriptorType =	USB_DT_PIPE_USAGE,
1818	.bPipeID =		STATUS_PIPE_ID,
1819};
1820
1821static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1822	.bLength =		USB_DT_ENDPOINT_SIZE,
1823	.bDescriptorType =	USB_DT_ENDPOINT,
1824	.bEndpointAddress =	USB_DIR_IN,
1825	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1826	.wMaxPacketSize =	cpu_to_le16(1024),
1827};
1828
1829static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1830	.bLength =		sizeof(uasp_status_in_ep_comp_desc),
1831	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1832	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1833};
1834
1835static struct usb_endpoint_descriptor uasp_cmd_desc = {
1836	.bLength =		USB_DT_ENDPOINT_SIZE,
1837	.bDescriptorType =	USB_DT_ENDPOINT,
1838	.bEndpointAddress =	USB_DIR_OUT,
1839	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1840	.wMaxPacketSize =	cpu_to_le16(512),
1841};
1842
1843static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1844	.bLength =		USB_DT_ENDPOINT_SIZE,
1845	.bDescriptorType =	USB_DT_ENDPOINT,
1846	.bEndpointAddress =	USB_DIR_OUT,
1847	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1848};
1849
1850static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1851	.bLength =		sizeof(uasp_cmd_pipe_desc),
1852	.bDescriptorType =	USB_DT_PIPE_USAGE,
1853	.bPipeID =		CMD_PIPE_ID,
1854};
1855
1856static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1857	.bLength =		USB_DT_ENDPOINT_SIZE,
1858	.bDescriptorType =	USB_DT_ENDPOINT,
1859	.bEndpointAddress =	USB_DIR_OUT,
1860	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1861	.wMaxPacketSize =	cpu_to_le16(1024),
1862};
1863
1864static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1865	.bLength =		sizeof(uasp_cmd_comp_desc),
1866	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1867};
1868
1869static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1870	(struct usb_descriptor_header *) &bot_intf_desc,
1871	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1872	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1873
1874	(struct usb_descriptor_header *) &uasp_intf_desc,
1875	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1876	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1877	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1878	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1879	(struct usb_descriptor_header *) &uasp_fs_status_desc,
1880	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1881	(struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1882	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1883	NULL,
1884};
1885
1886static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1887	(struct usb_descriptor_header *) &bot_intf_desc,
1888	(struct usb_descriptor_header *) &uasp_bi_desc,
1889	(struct usb_descriptor_header *) &uasp_bo_desc,
1890
1891	(struct usb_descriptor_header *) &uasp_intf_desc,
1892	(struct usb_descriptor_header *) &uasp_bi_desc,
1893	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1894	(struct usb_descriptor_header *) &uasp_bo_desc,
1895	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1896	(struct usb_descriptor_header *) &uasp_status_desc,
1897	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1898	(struct usb_descriptor_header *) &uasp_cmd_desc,
1899	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1900	NULL,
1901};
1902
1903static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1904	(struct usb_descriptor_header *) &bot_intf_desc,
1905	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1906	(struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1907	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1908	(struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1909
1910	(struct usb_descriptor_header *) &uasp_intf_desc,
1911	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1912	(struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
1913	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1914	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1915	(struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
1916	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1917	(struct usb_descriptor_header *) &uasp_ss_status_desc,
1918	(struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
1919	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1920	(struct usb_descriptor_header *) &uasp_ss_cmd_desc,
1921	(struct usb_descriptor_header *) &uasp_cmd_comp_desc,
1922	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1923	NULL,
1924};
1925
1926static struct usb_string	tcm_us_strings[] = {
1927	[USB_G_STR_INT_UAS].s		= "USB Attached SCSI",
1928	[USB_G_STR_INT_BBB].s		= "Bulk Only Transport",
1929	{ },
1930};
1931
1932static struct usb_gadget_strings tcm_stringtab = {
1933	.language = 0x0409,
1934	.strings = tcm_us_strings,
1935};
1936
1937static struct usb_gadget_strings *tcm_strings[] = {
1938	&tcm_stringtab,
1939	NULL,
1940};
1941
1942static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
1943{
1944	struct f_uas		*fu = to_f_uas(f);
1945	struct usb_string	*us;
1946	struct usb_gadget	*gadget = c->cdev->gadget;
1947	struct usb_ep		*ep;
1948	struct f_tcm_opts	*opts;
1949	int			iface;
1950	int			ret;
1951
1952	opts = container_of(f->fi, struct f_tcm_opts, func_inst);
1953
1954	mutex_lock(&opts->dep_lock);
1955	if (!opts->can_attach) {
1956		mutex_unlock(&opts->dep_lock);
1957		return -ENODEV;
1958	}
1959	mutex_unlock(&opts->dep_lock);
1960	us = usb_gstrings_attach(c->cdev, tcm_strings,
1961		ARRAY_SIZE(tcm_us_strings));
1962	if (IS_ERR(us))
1963		return PTR_ERR(us);
1964	bot_intf_desc.iInterface = us[USB_G_STR_INT_BBB].id;
1965	uasp_intf_desc.iInterface = us[USB_G_STR_INT_UAS].id;
1966
1967	iface = usb_interface_id(c, f);
1968	if (iface < 0)
1969		return iface;
1970
1971	bot_intf_desc.bInterfaceNumber = iface;
1972	uasp_intf_desc.bInterfaceNumber = iface;
1973	fu->iface = iface;
1974	ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc,
1975			&uasp_bi_ep_comp_desc);
1976	if (!ep)
1977		goto ep_fail;
1978
1979	fu->ep_in = ep;
1980
1981	ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc,
1982			&uasp_bo_ep_comp_desc);
1983	if (!ep)
1984		goto ep_fail;
1985	fu->ep_out = ep;
1986
1987	ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc,
1988			&uasp_status_in_ep_comp_desc);
1989	if (!ep)
1990		goto ep_fail;
1991	fu->ep_status = ep;
1992
1993	ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc,
1994			&uasp_cmd_comp_desc);
1995	if (!ep)
1996		goto ep_fail;
1997	fu->ep_cmd = ep;
1998
1999	/* Assume endpoint addresses are the same for both speeds */
2000	uasp_bi_desc.bEndpointAddress =	uasp_ss_bi_desc.bEndpointAddress;
2001	uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2002	uasp_status_desc.bEndpointAddress =
2003		uasp_ss_status_desc.bEndpointAddress;
2004	uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2005
2006	uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
2007	uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
2008	uasp_fs_status_desc.bEndpointAddress =
2009		uasp_ss_status_desc.bEndpointAddress;
2010	uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
2011
2012	ret = usb_assign_descriptors(f, uasp_fs_function_desc,
2013			uasp_hs_function_desc, uasp_ss_function_desc,
2014			uasp_ss_function_desc);
2015	if (ret)
2016		goto ep_fail;
2017
2018	return 0;
2019ep_fail:
2020	pr_err("Can't claim all required eps\n");
2021
2022	return -ENOTSUPP;
2023}
2024
2025struct guas_setup_wq {
2026	struct work_struct work;
2027	struct f_uas *fu;
2028	unsigned int alt;
2029};
2030
2031static void tcm_delayed_set_alt(struct work_struct *wq)
2032{
2033	struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
2034			work);
2035	struct f_uas *fu = work->fu;
2036	int alt = work->alt;
2037
2038	kfree(work);
2039
2040	if (fu->flags & USBG_IS_BOT)
2041		bot_cleanup_old_alt(fu);
2042	if (fu->flags & USBG_IS_UAS)
2043		uasp_cleanup_old_alt(fu);
2044
2045	if (alt == USB_G_ALT_INT_BBB)
2046		bot_set_alt(fu);
2047	else if (alt == USB_G_ALT_INT_UAS)
2048		uasp_set_alt(fu);
2049	usb_composite_setup_continue(fu->function.config->cdev);
2050}
2051
2052static int tcm_get_alt(struct usb_function *f, unsigned intf)
2053{
2054	if (intf == bot_intf_desc.bInterfaceNumber)
2055		return USB_G_ALT_INT_BBB;
2056	if (intf == uasp_intf_desc.bInterfaceNumber)
2057		return USB_G_ALT_INT_UAS;
2058
2059	return -EOPNOTSUPP;
2060}
2061
2062static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2063{
2064	struct f_uas *fu = to_f_uas(f);
2065
2066	if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2067		struct guas_setup_wq *work;
2068
2069		work = kmalloc(sizeof(*work), GFP_ATOMIC);
2070		if (!work)
2071			return -ENOMEM;
2072		INIT_WORK(&work->work, tcm_delayed_set_alt);
2073		work->fu = fu;
2074		work->alt = alt;
2075		schedule_work(&work->work);
2076		return USB_GADGET_DELAYED_STATUS;
2077	}
2078	return -EOPNOTSUPP;
2079}
2080
2081static void tcm_disable(struct usb_function *f)
2082{
2083	struct f_uas *fu = to_f_uas(f);
2084
2085	if (fu->flags & USBG_IS_UAS)
2086		uasp_cleanup_old_alt(fu);
2087	else if (fu->flags & USBG_IS_BOT)
2088		bot_cleanup_old_alt(fu);
2089	fu->flags = 0;
2090}
2091
2092static int tcm_setup(struct usb_function *f,
2093		const struct usb_ctrlrequest *ctrl)
2094{
2095	struct f_uas *fu = to_f_uas(f);
2096
2097	if (!(fu->flags & USBG_IS_BOT))
2098		return -EOPNOTSUPP;
2099
2100	return usbg_bot_setup(f, ctrl);
2101}
2102
2103static inline struct f_tcm_opts *to_f_tcm_opts(struct config_item *item)
2104{
2105	return container_of(to_config_group(item), struct f_tcm_opts,
2106		func_inst.group);
2107}
2108
2109static void tcm_attr_release(struct config_item *item)
2110{
2111	struct f_tcm_opts *opts = to_f_tcm_opts(item);
2112
2113	usb_put_function_instance(&opts->func_inst);
2114}
2115
2116static struct configfs_item_operations tcm_item_ops = {
2117	.release		= tcm_attr_release,
2118};
2119
2120static const struct config_item_type tcm_func_type = {
2121	.ct_item_ops	= &tcm_item_ops,
2122	.ct_owner	= THIS_MODULE,
2123};
2124
2125static void tcm_free_inst(struct usb_function_instance *f)
2126{
2127	struct f_tcm_opts *opts;
2128	unsigned i;
2129
2130	opts = container_of(f, struct f_tcm_opts, func_inst);
2131
2132	mutex_lock(&tpg_instances_lock);
2133	for (i = 0; i < TPG_INSTANCES; ++i)
2134		if (tpg_instances[i].func_inst == f)
2135			break;
2136	if (i < TPG_INSTANCES)
2137		tpg_instances[i].func_inst = NULL;
2138	mutex_unlock(&tpg_instances_lock);
2139
2140	kfree(opts);
2141}
2142
2143static int tcm_register_callback(struct usb_function_instance *f)
2144{
2145	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2146
2147	mutex_lock(&opts->dep_lock);
2148	opts->can_attach = true;
2149	mutex_unlock(&opts->dep_lock);
2150
2151	return 0;
2152}
2153
2154static void tcm_unregister_callback(struct usb_function_instance *f)
2155{
2156	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2157
2158	mutex_lock(&opts->dep_lock);
2159	unregister_gadget_item(opts->
2160		func_inst.group.cg_item.ci_parent->ci_parent);
2161	opts->can_attach = false;
2162	mutex_unlock(&opts->dep_lock);
2163}
2164
2165static int usbg_attach(struct usbg_tpg *tpg)
2166{
2167	struct usb_function_instance *f = tpg->fi;
2168	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2169
2170	if (opts->tcm_register_callback)
2171		return opts->tcm_register_callback(f);
2172
2173	return 0;
2174}
2175
2176static void usbg_detach(struct usbg_tpg *tpg)
2177{
2178	struct usb_function_instance *f = tpg->fi;
2179	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2180
2181	if (opts->tcm_unregister_callback)
2182		opts->tcm_unregister_callback(f);
2183}
2184
2185static int tcm_set_name(struct usb_function_instance *f, const char *name)
2186{
2187	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2188
2189	pr_debug("tcm: Activating %s\n", name);
2190
2191	mutex_lock(&opts->dep_lock);
2192	opts->ready = true;
2193	mutex_unlock(&opts->dep_lock);
2194
2195	return 0;
2196}
2197
2198static struct usb_function_instance *tcm_alloc_inst(void)
2199{
2200	struct f_tcm_opts *opts;
2201	int i;
2202
2203
2204	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2205	if (!opts)
2206		return ERR_PTR(-ENOMEM);
2207
2208	mutex_lock(&tpg_instances_lock);
2209	for (i = 0; i < TPG_INSTANCES; ++i)
2210		if (!tpg_instances[i].func_inst)
2211			break;
2212
2213	if (i == TPG_INSTANCES) {
2214		mutex_unlock(&tpg_instances_lock);
2215		kfree(opts);
2216		return ERR_PTR(-EBUSY);
2217	}
2218	tpg_instances[i].func_inst = &opts->func_inst;
2219	mutex_unlock(&tpg_instances_lock);
2220
2221	mutex_init(&opts->dep_lock);
2222	opts->func_inst.set_inst_name = tcm_set_name;
2223	opts->func_inst.free_func_inst = tcm_free_inst;
2224	opts->tcm_register_callback = tcm_register_callback;
2225	opts->tcm_unregister_callback = tcm_unregister_callback;
2226
2227	config_group_init_type_name(&opts->func_inst.group, "",
2228			&tcm_func_type);
2229
2230	return &opts->func_inst;
2231}
2232
2233static void tcm_free(struct usb_function *f)
2234{
2235	struct f_uas *tcm = to_f_uas(f);
2236
2237	kfree(tcm);
2238}
2239
2240static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
2241{
2242	usb_free_all_descriptors(f);
2243}
2244
2245static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
2246{
2247	struct f_uas *fu;
2248	unsigned i;
2249
2250	mutex_lock(&tpg_instances_lock);
2251	for (i = 0; i < TPG_INSTANCES; ++i)
2252		if (tpg_instances[i].func_inst == fi)
2253			break;
2254	if (i == TPG_INSTANCES) {
2255		mutex_unlock(&tpg_instances_lock);
2256		return ERR_PTR(-ENODEV);
2257	}
2258
2259	fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2260	if (!fu) {
2261		mutex_unlock(&tpg_instances_lock);
2262		return ERR_PTR(-ENOMEM);
2263	}
2264
2265	fu->function.name = "Target Function";
2266	fu->function.bind = tcm_bind;
2267	fu->function.unbind = tcm_unbind;
2268	fu->function.set_alt = tcm_set_alt;
2269	fu->function.get_alt = tcm_get_alt;
2270	fu->function.setup = tcm_setup;
2271	fu->function.disable = tcm_disable;
2272	fu->function.free_func = tcm_free;
2273	fu->tpg = tpg_instances[i].tpg;
2274	mutex_unlock(&tpg_instances_lock);
2275
2276	return &fu->function;
2277}
2278
2279DECLARE_USB_FUNCTION(tcm, tcm_alloc_inst, tcm_alloc);
2280
2281static int __init tcm_init(void)
2282{
2283	int ret;
2284
2285	ret = usb_function_register(&tcmusb_func);
2286	if (ret)
2287		return ret;
2288
2289	ret = target_register_template(&usbg_ops);
2290	if (ret)
2291		usb_function_unregister(&tcmusb_func);
2292
2293	return ret;
2294}
2295module_init(tcm_init);
2296
2297static void __exit tcm_exit(void)
2298{
2299	target_unregister_template(&usbg_ops);
2300	usb_function_unregister(&tcmusb_func);
2301}
2302module_exit(tcm_exit);
2303
2304MODULE_LICENSE("GPL");
2305MODULE_AUTHOR("Sebastian Andrzej Siewior");
2306