xref: /linux-6.15/drivers/usb/gadget/function/f_tcm.c (revision 1f0d96f5)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Target based USB-Gadget
3  *
4  * UAS protocol handling, target callbacks, configfs handling,
5  * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
6  *
7  * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
8  */
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/types.h>
12 #include <linux/string.h>
13 #include <linux/configfs.h>
14 #include <linux/ctype.h>
15 #include <linux/usb/ch9.h>
16 #include <linux/usb/composite.h>
17 #include <linux/usb/gadget.h>
18 #include <linux/usb/storage.h>
19 #include <scsi/scsi_tcq.h>
20 #include <target/target_core_base.h>
21 #include <target/target_core_fabric.h>
22 #include <linux/unaligned.h>
23 
24 #include "tcm.h"
25 #include "u_tcm.h"
26 #include "configfs.h"
27 
28 #define TPG_INSTANCES		1
29 
30 struct tpg_instance {
31 	struct usb_function_instance	*func_inst;
32 	struct usbg_tpg			*tpg;
33 };
34 
35 static struct tpg_instance tpg_instances[TPG_INSTANCES];
36 
37 static DEFINE_MUTEX(tpg_instances_lock);
38 
39 static inline struct f_uas *to_f_uas(struct usb_function *f)
40 {
41 	return container_of(f, struct f_uas, function);
42 }
43 
44 /* Start bot.c code */
45 
46 static int bot_enqueue_cmd_cbw(struct f_uas *fu)
47 {
48 	int ret;
49 
50 	if (fu->flags & USBG_BOT_CMD_PEND)
51 		return 0;
52 
53 	ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
54 	if (!ret)
55 		fu->flags |= USBG_BOT_CMD_PEND;
56 	return ret;
57 }
58 
59 static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
60 {
61 	struct usbg_cmd *cmd = req->context;
62 	struct f_uas *fu = cmd->fu;
63 
64 	transport_generic_free_cmd(&cmd->se_cmd, 0);
65 	if (req->status < 0) {
66 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
67 		return;
68 	}
69 
70 	/* CSW completed, wait for next CBW */
71 	bot_enqueue_cmd_cbw(fu);
72 }
73 
74 static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
75 {
76 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
77 	int ret;
78 	unsigned int csw_stat;
79 
80 	csw_stat = cmd->csw_code;
81 	csw->Tag = cmd->bot_tag;
82 	csw->Status = csw_stat;
83 	fu->bot_status.req->context = cmd;
84 	ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
85 	if (ret)
86 		pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
87 }
88 
89 static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
90 {
91 	struct usbg_cmd *cmd = req->context;
92 	struct f_uas *fu = cmd->fu;
93 
94 	if (req->status < 0)
95 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
96 
97 	if (cmd->data_len) {
98 		if (cmd->data_len > ep->maxpacket) {
99 			req->length = ep->maxpacket;
100 			cmd->data_len -= ep->maxpacket;
101 		} else {
102 			req->length = cmd->data_len;
103 			cmd->data_len = 0;
104 		}
105 
106 		usb_ep_queue(ep, req, GFP_ATOMIC);
107 		return;
108 	}
109 	bot_enqueue_sense_code(fu, cmd);
110 }
111 
112 static void bot_send_bad_status(struct usbg_cmd *cmd)
113 {
114 	struct f_uas *fu = cmd->fu;
115 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
116 	struct usb_request *req;
117 	struct usb_ep *ep;
118 
119 	csw->Residue = cpu_to_le32(cmd->data_len);
120 
121 	if (cmd->data_len) {
122 		if (cmd->is_read) {
123 			ep = fu->ep_in;
124 			req = fu->bot_req_in;
125 		} else {
126 			ep = fu->ep_out;
127 			req = fu->bot_req_out;
128 		}
129 
130 		if (cmd->data_len > fu->ep_in->maxpacket) {
131 			req->length = ep->maxpacket;
132 			cmd->data_len -= ep->maxpacket;
133 		} else {
134 			req->length = cmd->data_len;
135 			cmd->data_len = 0;
136 		}
137 		req->complete = bot_err_compl;
138 		req->context = cmd;
139 		req->buf = fu->cmd.buf;
140 		usb_ep_queue(ep, req, GFP_KERNEL);
141 	} else {
142 		bot_enqueue_sense_code(fu, cmd);
143 	}
144 }
145 
146 static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
147 {
148 	struct f_uas *fu = cmd->fu;
149 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
150 	int ret;
151 
152 	if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
153 		if (!moved_data && cmd->data_len) {
154 			/*
155 			 * the host wants to move data, we don't. Fill / empty
156 			 * the pipe and then send the csw with reside set.
157 			 */
158 			cmd->csw_code = US_BULK_STAT_OK;
159 			bot_send_bad_status(cmd);
160 			return 0;
161 		}
162 
163 		csw->Tag = cmd->bot_tag;
164 		csw->Residue = cpu_to_le32(0);
165 		csw->Status = US_BULK_STAT_OK;
166 		fu->bot_status.req->context = cmd;
167 
168 		ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
169 		if (ret)
170 			pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
171 	} else {
172 		cmd->csw_code = US_BULK_STAT_FAIL;
173 		bot_send_bad_status(cmd);
174 	}
175 	return 0;
176 }
177 
178 /*
179  * Called after command (no data transfer) or after the write (to device)
180  * operation is completed
181  */
182 static int bot_send_status_response(struct usbg_cmd *cmd)
183 {
184 	bool moved_data = false;
185 
186 	if (!cmd->is_read)
187 		moved_data = true;
188 	return bot_send_status(cmd, moved_data);
189 }
190 
191 /* Read request completed, now we have to send the CSW */
192 static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
193 {
194 	struct usbg_cmd *cmd = req->context;
195 
196 	if (req->status < 0)
197 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
198 
199 	bot_send_status(cmd, true);
200 }
201 
202 static int bot_send_read_response(struct usbg_cmd *cmd)
203 {
204 	struct f_uas *fu = cmd->fu;
205 	struct se_cmd *se_cmd = &cmd->se_cmd;
206 	struct usb_gadget *gadget = fuas_to_gadget(fu);
207 	int ret;
208 
209 	if (!cmd->data_len) {
210 		cmd->csw_code = US_BULK_STAT_PHASE;
211 		bot_send_bad_status(cmd);
212 		return 0;
213 	}
214 
215 	if (!gadget->sg_supported) {
216 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
217 		if (!cmd->data_buf)
218 			return -ENOMEM;
219 
220 		sg_copy_to_buffer(se_cmd->t_data_sg,
221 				se_cmd->t_data_nents,
222 				cmd->data_buf,
223 				se_cmd->data_length);
224 
225 		fu->bot_req_in->buf = cmd->data_buf;
226 	} else {
227 		fu->bot_req_in->buf = NULL;
228 		fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
229 		fu->bot_req_in->sg = se_cmd->t_data_sg;
230 	}
231 
232 	fu->bot_req_in->complete = bot_read_compl;
233 	fu->bot_req_in->length = se_cmd->data_length;
234 	fu->bot_req_in->context = cmd;
235 	ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
236 	if (ret)
237 		pr_err("%s(%d)\n", __func__, __LINE__);
238 	return 0;
239 }
240 
241 static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
242 static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
243 
244 static int bot_send_write_request(struct usbg_cmd *cmd)
245 {
246 	struct f_uas *fu = cmd->fu;
247 	struct se_cmd *se_cmd = &cmd->se_cmd;
248 	int ret;
249 
250 	init_completion(&cmd->write_complete);
251 	cmd->fu = fu;
252 
253 	if (!cmd->data_len) {
254 		cmd->csw_code = US_BULK_STAT_PHASE;
255 		return -EINVAL;
256 	}
257 
258 	ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
259 	if (ret)
260 		goto cleanup;
261 	ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
262 	if (ret)
263 		pr_err("%s(%d)\n", __func__, __LINE__);
264 
265 	wait_for_completion(&cmd->write_complete);
266 	target_execute_cmd(se_cmd);
267 cleanup:
268 	return ret;
269 }
270 
271 static int bot_submit_command(struct f_uas *, void *, unsigned int);
272 
273 static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
274 {
275 	struct f_uas *fu = req->context;
276 	int ret;
277 
278 	fu->flags &= ~USBG_BOT_CMD_PEND;
279 
280 	if (req->status < 0)
281 		return;
282 
283 	ret = bot_submit_command(fu, req->buf, req->actual);
284 	if (ret)
285 		pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
286 }
287 
288 static int bot_prepare_reqs(struct f_uas *fu)
289 {
290 	int ret;
291 
292 	fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
293 	if (!fu->bot_req_in)
294 		goto err;
295 
296 	fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
297 	if (!fu->bot_req_out)
298 		goto err_out;
299 
300 	fu->cmd.req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
301 	if (!fu->cmd.req)
302 		goto err_cmd;
303 
304 	fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
305 	if (!fu->bot_status.req)
306 		goto err_sts;
307 
308 	fu->bot_status.req->buf = &fu->bot_status.csw;
309 	fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
310 	fu->bot_status.req->complete = bot_status_complete;
311 	fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
312 
313 	fu->cmd.buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
314 	if (!fu->cmd.buf)
315 		goto err_buf;
316 
317 	fu->cmd.req->complete = bot_cmd_complete;
318 	fu->cmd.req->buf = fu->cmd.buf;
319 	fu->cmd.req->length = fu->ep_out->maxpacket;
320 	fu->cmd.req->context = fu;
321 
322 	ret = bot_enqueue_cmd_cbw(fu);
323 	if (ret)
324 		goto err_queue;
325 	return 0;
326 err_queue:
327 	kfree(fu->cmd.buf);
328 	fu->cmd.buf = NULL;
329 err_buf:
330 	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
331 err_sts:
332 	usb_ep_free_request(fu->ep_out, fu->cmd.req);
333 	fu->cmd.req = NULL;
334 err_cmd:
335 	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
336 	fu->bot_req_out = NULL;
337 err_out:
338 	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
339 	fu->bot_req_in = NULL;
340 err:
341 	pr_err("BOT: endpoint setup failed\n");
342 	return -ENOMEM;
343 }
344 
345 static void bot_cleanup_old_alt(struct f_uas *fu)
346 {
347 	if (!(fu->flags & USBG_ENABLED))
348 		return;
349 
350 	usb_ep_disable(fu->ep_in);
351 	usb_ep_disable(fu->ep_out);
352 
353 	if (!fu->bot_req_in)
354 		return;
355 
356 	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
357 	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
358 	usb_ep_free_request(fu->ep_out, fu->cmd.req);
359 	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
360 
361 	kfree(fu->cmd.buf);
362 
363 	fu->bot_req_in = NULL;
364 	fu->bot_req_out = NULL;
365 	fu->cmd.req = NULL;
366 	fu->bot_status.req = NULL;
367 	fu->cmd.buf = NULL;
368 }
369 
370 static void bot_set_alt(struct f_uas *fu)
371 {
372 	struct usb_function *f = &fu->function;
373 	struct usb_gadget *gadget = f->config->cdev->gadget;
374 	int ret;
375 
376 	fu->flags = USBG_IS_BOT;
377 
378 	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_BBB);
379 	ret = usb_ep_enable(fu->ep_in);
380 	if (ret)
381 		goto err_b_in;
382 
383 	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_BBB);
384 	ret = usb_ep_enable(fu->ep_out);
385 	if (ret)
386 		goto err_b_out;
387 
388 	ret = bot_prepare_reqs(fu);
389 	if (ret)
390 		goto err_wq;
391 	fu->flags |= USBG_ENABLED;
392 	pr_info("Using the BOT protocol\n");
393 	return;
394 err_wq:
395 	usb_ep_disable(fu->ep_out);
396 err_b_out:
397 	usb_ep_disable(fu->ep_in);
398 err_b_in:
399 	fu->flags = USBG_IS_BOT;
400 }
401 
402 static int usbg_bot_setup(struct usb_function *f,
403 		const struct usb_ctrlrequest *ctrl)
404 {
405 	struct f_uas *fu = to_f_uas(f);
406 	struct usb_composite_dev *cdev = f->config->cdev;
407 	u16 w_value = le16_to_cpu(ctrl->wValue);
408 	u16 w_length = le16_to_cpu(ctrl->wLength);
409 	int luns;
410 	u8 *ret_lun;
411 
412 	switch (ctrl->bRequest) {
413 	case US_BULK_GET_MAX_LUN:
414 		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
415 					USB_RECIP_INTERFACE))
416 			return -ENOTSUPP;
417 
418 		if (w_length < 1)
419 			return -EINVAL;
420 		if (w_value != 0)
421 			return -EINVAL;
422 		luns = atomic_read(&fu->tpg->tpg_port_count);
423 		if (!luns) {
424 			pr_err("No LUNs configured?\n");
425 			return -EINVAL;
426 		}
427 		luns--;
428 		if (luns > US_BULK_MAX_LUN_LIMIT) {
429 			pr_info_once("Limiting the number of luns to 16\n");
430 			luns = US_BULK_MAX_LUN_LIMIT;
431 		}
432 		ret_lun = cdev->req->buf;
433 		*ret_lun = luns;
434 		cdev->req->length = 1;
435 		return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
436 
437 	case US_BULK_RESET_REQUEST:
438 		/* XXX maybe we should remove previous requests for IN + OUT */
439 		bot_enqueue_cmd_cbw(fu);
440 		return 0;
441 	}
442 	return -ENOTSUPP;
443 }
444 
445 /* Start uas.c code */
446 
447 static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
448 {
449 	/* We have either all three allocated or none */
450 	if (!stream->req_in)
451 		return;
452 
453 	usb_ep_free_request(fu->ep_in, stream->req_in);
454 	usb_ep_free_request(fu->ep_out, stream->req_out);
455 	usb_ep_free_request(fu->ep_status, stream->req_status);
456 
457 	stream->req_in = NULL;
458 	stream->req_out = NULL;
459 	stream->req_status = NULL;
460 }
461 
462 static void uasp_free_cmdreq(struct f_uas *fu)
463 {
464 	usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
465 	kfree(fu->cmd.buf);
466 	fu->cmd.req = NULL;
467 	fu->cmd.buf = NULL;
468 }
469 
470 static void uasp_cleanup_old_alt(struct f_uas *fu)
471 {
472 	int i;
473 
474 	if (!(fu->flags & USBG_ENABLED))
475 		return;
476 
477 	usb_ep_disable(fu->ep_in);
478 	usb_ep_disable(fu->ep_out);
479 	usb_ep_disable(fu->ep_status);
480 	usb_ep_disable(fu->ep_cmd);
481 
482 	for (i = 0; i < UASP_SS_EP_COMP_NUM_STREAMS; i++)
483 		uasp_cleanup_one_stream(fu, &fu->stream[i]);
484 	uasp_free_cmdreq(fu);
485 }
486 
487 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
488 
489 static int uasp_prepare_r_request(struct usbg_cmd *cmd)
490 {
491 	struct se_cmd *se_cmd = &cmd->se_cmd;
492 	struct f_uas *fu = cmd->fu;
493 	struct usb_gadget *gadget = fuas_to_gadget(fu);
494 	struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
495 
496 	if (!gadget->sg_supported) {
497 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
498 		if (!cmd->data_buf)
499 			return -ENOMEM;
500 
501 		sg_copy_to_buffer(se_cmd->t_data_sg,
502 				se_cmd->t_data_nents,
503 				cmd->data_buf,
504 				se_cmd->data_length);
505 
506 		stream->req_in->buf = cmd->data_buf;
507 	} else {
508 		stream->req_in->buf = NULL;
509 		stream->req_in->num_sgs = se_cmd->t_data_nents;
510 		stream->req_in->sg = se_cmd->t_data_sg;
511 	}
512 
513 	stream->req_in->is_last = 1;
514 	stream->req_in->complete = uasp_status_data_cmpl;
515 	stream->req_in->length = se_cmd->data_length;
516 	stream->req_in->context = cmd;
517 
518 	cmd->state = UASP_SEND_STATUS;
519 	return 0;
520 }
521 
522 static void uasp_prepare_status(struct usbg_cmd *cmd)
523 {
524 	struct se_cmd *se_cmd = &cmd->se_cmd;
525 	struct sense_iu *iu = &cmd->sense_iu;
526 	struct uas_stream *stream = &cmd->fu->stream[se_cmd->map_tag];
527 
528 	cmd->state = UASP_QUEUE_COMMAND;
529 	iu->iu_id = IU_ID_STATUS;
530 	iu->tag = cpu_to_be16(cmd->tag);
531 
532 	/*
533 	 * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
534 	 */
535 	iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
536 	iu->status = se_cmd->scsi_status;
537 	stream->req_status->is_last = 1;
538 	stream->req_status->context = cmd;
539 	stream->req_status->length = se_cmd->scsi_sense_length + 16;
540 	stream->req_status->buf = iu;
541 	stream->req_status->complete = uasp_status_data_cmpl;
542 }
543 
544 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
545 {
546 	struct usbg_cmd *cmd = req->context;
547 	struct f_uas *fu = cmd->fu;
548 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
549 	int ret;
550 
551 	if (req->status < 0)
552 		goto cleanup;
553 
554 	switch (cmd->state) {
555 	case UASP_SEND_DATA:
556 		ret = uasp_prepare_r_request(cmd);
557 		if (ret)
558 			goto cleanup;
559 		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
560 		if (ret)
561 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
562 		break;
563 
564 	case UASP_RECEIVE_DATA:
565 		ret = usbg_prepare_w_request(cmd, stream->req_out);
566 		if (ret)
567 			goto cleanup;
568 		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
569 		if (ret)
570 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
571 		break;
572 
573 	case UASP_SEND_STATUS:
574 		uasp_prepare_status(cmd);
575 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
576 				GFP_ATOMIC);
577 		if (ret)
578 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
579 		break;
580 
581 	case UASP_QUEUE_COMMAND:
582 		transport_generic_free_cmd(&cmd->se_cmd, 0);
583 		usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
584 		break;
585 
586 	default:
587 		BUG();
588 	}
589 	return;
590 
591 cleanup:
592 	transport_generic_free_cmd(&cmd->se_cmd, 0);
593 }
594 
595 static int uasp_send_status_response(struct usbg_cmd *cmd)
596 {
597 	struct f_uas *fu = cmd->fu;
598 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
599 	struct sense_iu *iu = &cmd->sense_iu;
600 
601 	iu->tag = cpu_to_be16(cmd->tag);
602 	stream->req_status->complete = uasp_status_data_cmpl;
603 	stream->req_status->context = cmd;
604 	cmd->fu = fu;
605 	uasp_prepare_status(cmd);
606 	return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
607 }
608 
609 static int uasp_send_read_response(struct usbg_cmd *cmd)
610 {
611 	struct f_uas *fu = cmd->fu;
612 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
613 	struct sense_iu *iu = &cmd->sense_iu;
614 	int ret;
615 
616 	cmd->fu = fu;
617 
618 	iu->tag = cpu_to_be16(cmd->tag);
619 	if (fu->flags & USBG_USE_STREAMS) {
620 
621 		ret = uasp_prepare_r_request(cmd);
622 		if (ret)
623 			goto out;
624 		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
625 		if (ret) {
626 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
627 			kfree(cmd->data_buf);
628 			cmd->data_buf = NULL;
629 		}
630 
631 	} else {
632 
633 		iu->iu_id = IU_ID_READ_READY;
634 		iu->tag = cpu_to_be16(cmd->tag);
635 
636 		stream->req_status->complete = uasp_status_data_cmpl;
637 		stream->req_status->context = cmd;
638 
639 		cmd->state = UASP_SEND_DATA;
640 		stream->req_status->buf = iu;
641 		stream->req_status->length = sizeof(struct iu);
642 
643 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
644 				GFP_ATOMIC);
645 		if (ret)
646 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
647 	}
648 out:
649 	return ret;
650 }
651 
652 static int uasp_send_write_request(struct usbg_cmd *cmd)
653 {
654 	struct f_uas *fu = cmd->fu;
655 	struct se_cmd *se_cmd = &cmd->se_cmd;
656 	struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
657 	struct sense_iu *iu = &cmd->sense_iu;
658 	int ret;
659 
660 	init_completion(&cmd->write_complete);
661 	cmd->fu = fu;
662 
663 	iu->tag = cpu_to_be16(cmd->tag);
664 
665 	if (fu->flags & USBG_USE_STREAMS) {
666 
667 		ret = usbg_prepare_w_request(cmd, stream->req_out);
668 		if (ret)
669 			goto cleanup;
670 		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
671 		if (ret)
672 			pr_err("%s(%d)\n", __func__, __LINE__);
673 
674 	} else {
675 
676 		iu->iu_id = IU_ID_WRITE_READY;
677 		iu->tag = cpu_to_be16(cmd->tag);
678 
679 		stream->req_status->complete = uasp_status_data_cmpl;
680 		stream->req_status->context = cmd;
681 
682 		cmd->state = UASP_RECEIVE_DATA;
683 		stream->req_status->buf = iu;
684 		stream->req_status->length = sizeof(struct iu);
685 
686 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
687 				GFP_ATOMIC);
688 		if (ret)
689 			pr_err("%s(%d)\n", __func__, __LINE__);
690 	}
691 
692 	wait_for_completion(&cmd->write_complete);
693 	target_execute_cmd(se_cmd);
694 cleanup:
695 	return ret;
696 }
697 
698 static int usbg_submit_command(struct f_uas *, void *, unsigned int);
699 
700 static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
701 {
702 	struct f_uas *fu = req->context;
703 	int ret;
704 
705 	if (req->status < 0)
706 		return;
707 
708 	ret = usbg_submit_command(fu, req->buf, req->actual);
709 	/*
710 	 * Once we tune for performance enqueue the command req here again so
711 	 * we can receive a second command while we processing this one. Pay
712 	 * attention to properly sync STAUS endpoint with DATA IN + OUT so you
713 	 * don't break HS.
714 	 */
715 	if (!ret)
716 		return;
717 	usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
718 }
719 
720 static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
721 {
722 	stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
723 	if (!stream->req_in)
724 		goto out;
725 
726 	stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
727 	if (!stream->req_out)
728 		goto err_out;
729 
730 	stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
731 	if (!stream->req_status)
732 		goto err_sts;
733 
734 	return 0;
735 
736 err_sts:
737 	usb_ep_free_request(fu->ep_out, stream->req_out);
738 	stream->req_out = NULL;
739 err_out:
740 	usb_ep_free_request(fu->ep_in, stream->req_in);
741 	stream->req_in = NULL;
742 out:
743 	return -ENOMEM;
744 }
745 
746 static int uasp_alloc_cmd(struct f_uas *fu)
747 {
748 	fu->cmd.req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
749 	if (!fu->cmd.req)
750 		goto err;
751 
752 	fu->cmd.buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
753 	if (!fu->cmd.buf)
754 		goto err_buf;
755 
756 	fu->cmd.req->complete = uasp_cmd_complete;
757 	fu->cmd.req->buf = fu->cmd.buf;
758 	fu->cmd.req->length = fu->ep_cmd->maxpacket;
759 	fu->cmd.req->context = fu;
760 	return 0;
761 
762 err_buf:
763 	usb_ep_free_request(fu->ep_cmd, fu->cmd.req);
764 err:
765 	return -ENOMEM;
766 }
767 
768 static void uasp_setup_stream_res(struct f_uas *fu, int max_streams)
769 {
770 	int i;
771 
772 	for (i = 0; i < max_streams; i++) {
773 		struct uas_stream *s = &fu->stream[i];
774 
775 		s->req_in->stream_id = i + 1;
776 		s->req_out->stream_id = i + 1;
777 		s->req_status->stream_id = i + 1;
778 	}
779 }
780 
781 static int uasp_prepare_reqs(struct f_uas *fu)
782 {
783 	int ret;
784 	int i;
785 	int max_streams;
786 
787 	if (fu->flags & USBG_USE_STREAMS)
788 		max_streams = UASP_SS_EP_COMP_NUM_STREAMS;
789 	else
790 		max_streams = 1;
791 
792 	for (i = 0; i < max_streams; i++) {
793 		ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
794 		if (ret)
795 			goto err_cleanup;
796 	}
797 
798 	ret = uasp_alloc_cmd(fu);
799 	if (ret)
800 		goto err_free_stream;
801 	uasp_setup_stream_res(fu, max_streams);
802 
803 	ret = usb_ep_queue(fu->ep_cmd, fu->cmd.req, GFP_ATOMIC);
804 	if (ret)
805 		goto err_free_stream;
806 
807 	return 0;
808 
809 err_free_stream:
810 	uasp_free_cmdreq(fu);
811 
812 err_cleanup:
813 	if (i) {
814 		do {
815 			uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
816 			i--;
817 		} while (i);
818 	}
819 	pr_err("UASP: endpoint setup failed\n");
820 	return ret;
821 }
822 
823 static void uasp_set_alt(struct f_uas *fu)
824 {
825 	struct usb_function *f = &fu->function;
826 	struct usb_gadget *gadget = f->config->cdev->gadget;
827 	int ret;
828 
829 	fu->flags = USBG_IS_UAS;
830 
831 	if (gadget->speed >= USB_SPEED_SUPER)
832 		fu->flags |= USBG_USE_STREAMS;
833 
834 	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_UAS);
835 	ret = usb_ep_enable(fu->ep_in);
836 	if (ret)
837 		goto err_b_in;
838 
839 	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_UAS);
840 	ret = usb_ep_enable(fu->ep_out);
841 	if (ret)
842 		goto err_b_out;
843 
844 	config_ep_by_speed_and_alt(gadget, f, fu->ep_cmd, USB_G_ALT_INT_UAS);
845 	ret = usb_ep_enable(fu->ep_cmd);
846 	if (ret)
847 		goto err_cmd;
848 	config_ep_by_speed_and_alt(gadget, f, fu->ep_status, USB_G_ALT_INT_UAS);
849 	ret = usb_ep_enable(fu->ep_status);
850 	if (ret)
851 		goto err_status;
852 
853 	ret = uasp_prepare_reqs(fu);
854 	if (ret)
855 		goto err_wq;
856 	fu->flags |= USBG_ENABLED;
857 
858 	pr_info("Using the UAS protocol\n");
859 	return;
860 err_wq:
861 	usb_ep_disable(fu->ep_status);
862 err_status:
863 	usb_ep_disable(fu->ep_cmd);
864 err_cmd:
865 	usb_ep_disable(fu->ep_out);
866 err_b_out:
867 	usb_ep_disable(fu->ep_in);
868 err_b_in:
869 	fu->flags = 0;
870 }
871 
872 static int get_cmd_dir(const unsigned char *cdb)
873 {
874 	int ret;
875 
876 	switch (cdb[0]) {
877 	case READ_6:
878 	case READ_10:
879 	case READ_12:
880 	case READ_16:
881 	case INQUIRY:
882 	case MODE_SENSE:
883 	case MODE_SENSE_10:
884 	case SERVICE_ACTION_IN_16:
885 	case MAINTENANCE_IN:
886 	case PERSISTENT_RESERVE_IN:
887 	case SECURITY_PROTOCOL_IN:
888 	case ACCESS_CONTROL_IN:
889 	case REPORT_LUNS:
890 	case READ_BLOCK_LIMITS:
891 	case READ_POSITION:
892 	case READ_CAPACITY:
893 	case READ_TOC:
894 	case READ_FORMAT_CAPACITIES:
895 	case REQUEST_SENSE:
896 		ret = DMA_FROM_DEVICE;
897 		break;
898 
899 	case WRITE_6:
900 	case WRITE_10:
901 	case WRITE_12:
902 	case WRITE_16:
903 	case MODE_SELECT:
904 	case MODE_SELECT_10:
905 	case WRITE_VERIFY:
906 	case WRITE_VERIFY_12:
907 	case PERSISTENT_RESERVE_OUT:
908 	case MAINTENANCE_OUT:
909 	case SECURITY_PROTOCOL_OUT:
910 	case ACCESS_CONTROL_OUT:
911 		ret = DMA_TO_DEVICE;
912 		break;
913 	case ALLOW_MEDIUM_REMOVAL:
914 	case TEST_UNIT_READY:
915 	case SYNCHRONIZE_CACHE:
916 	case START_STOP:
917 	case ERASE:
918 	case REZERO_UNIT:
919 	case SEEK_10:
920 	case SPACE:
921 	case VERIFY:
922 	case WRITE_FILEMARKS:
923 		ret = DMA_NONE;
924 		break;
925 	default:
926 #define CMD_DIR_MSG "target: Unknown data direction for SCSI Opcode 0x%02x\n"
927 		pr_warn(CMD_DIR_MSG, cdb[0]);
928 #undef CMD_DIR_MSG
929 		ret = -EINVAL;
930 	}
931 	return ret;
932 }
933 
934 static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
935 {
936 	struct usbg_cmd *cmd = req->context;
937 	struct se_cmd *se_cmd = &cmd->se_cmd;
938 
939 	if (req->status < 0) {
940 		pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
941 		goto cleanup;
942 	}
943 
944 	if (req->num_sgs == 0) {
945 		sg_copy_from_buffer(se_cmd->t_data_sg,
946 				se_cmd->t_data_nents,
947 				cmd->data_buf,
948 				se_cmd->data_length);
949 	}
950 
951 	complete(&cmd->write_complete);
952 	return;
953 
954 cleanup:
955 	target_put_sess_cmd(se_cmd);
956 	transport_generic_free_cmd(&cmd->se_cmd, 0);
957 }
958 
959 static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
960 {
961 	struct se_cmd *se_cmd = &cmd->se_cmd;
962 	struct f_uas *fu = cmd->fu;
963 	struct usb_gadget *gadget = fuas_to_gadget(fu);
964 
965 	if (!gadget->sg_supported) {
966 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
967 		if (!cmd->data_buf)
968 			return -ENOMEM;
969 
970 		req->buf = cmd->data_buf;
971 	} else {
972 		req->buf = NULL;
973 		req->num_sgs = se_cmd->t_data_nents;
974 		req->sg = se_cmd->t_data_sg;
975 	}
976 
977 	req->is_last = 1;
978 	req->complete = usbg_data_write_cmpl;
979 	req->length = se_cmd->data_length;
980 	req->context = cmd;
981 	return 0;
982 }
983 
984 static int usbg_send_status_response(struct se_cmd *se_cmd)
985 {
986 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
987 			se_cmd);
988 	struct f_uas *fu = cmd->fu;
989 
990 	if (fu->flags & USBG_IS_BOT)
991 		return bot_send_status_response(cmd);
992 	else
993 		return uasp_send_status_response(cmd);
994 }
995 
996 static int usbg_send_write_request(struct se_cmd *se_cmd)
997 {
998 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
999 			se_cmd);
1000 	struct f_uas *fu = cmd->fu;
1001 
1002 	if (fu->flags & USBG_IS_BOT)
1003 		return bot_send_write_request(cmd);
1004 	else
1005 		return uasp_send_write_request(cmd);
1006 }
1007 
1008 static int usbg_send_read_response(struct se_cmd *se_cmd)
1009 {
1010 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1011 			se_cmd);
1012 	struct f_uas *fu = cmd->fu;
1013 
1014 	if (fu->flags & USBG_IS_BOT)
1015 		return bot_send_read_response(cmd);
1016 	else
1017 		return uasp_send_read_response(cmd);
1018 }
1019 
1020 static void usbg_cmd_work(struct work_struct *work)
1021 {
1022 	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1023 	struct se_cmd *se_cmd;
1024 	struct tcm_usbg_nexus *tv_nexus;
1025 	struct usbg_tpg *tpg;
1026 	int dir, flags = (TARGET_SCF_UNKNOWN_SIZE | TARGET_SCF_ACK_KREF);
1027 
1028 	se_cmd = &cmd->se_cmd;
1029 	tpg = cmd->fu->tpg;
1030 	tv_nexus = tpg->tpg_nexus;
1031 	dir = get_cmd_dir(cmd->cmd_buf);
1032 	if (dir < 0) {
1033 		__target_init_cmd(se_cmd,
1034 				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1035 				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1036 				  cmd->prio_attr, cmd->sense_iu.sense,
1037 				  cmd->unpacked_lun, NULL);
1038 		goto out;
1039 	}
1040 
1041 	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess, cmd->cmd_buf,
1042 			  cmd->sense_iu.sense, cmd->unpacked_lun, 0,
1043 			  cmd->prio_attr, dir, flags);
1044 	return;
1045 
1046 out:
1047 	transport_send_check_condition_and_sense(se_cmd,
1048 			TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1049 }
1050 
1051 static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
1052 		struct tcm_usbg_nexus *tv_nexus, u32 scsi_tag)
1053 {
1054 	struct se_session *se_sess = tv_nexus->tvn_se_sess;
1055 	struct usbg_cmd *cmd;
1056 	int tag, cpu;
1057 
1058 	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
1059 	if (tag < 0)
1060 		return ERR_PTR(-ENOMEM);
1061 
1062 	cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[tag];
1063 	memset(cmd, 0, sizeof(*cmd));
1064 	cmd->se_cmd.map_tag = tag;
1065 	cmd->se_cmd.map_cpu = cpu;
1066 	cmd->se_cmd.tag = cmd->tag = scsi_tag;
1067 	cmd->fu = fu;
1068 
1069 	return cmd;
1070 }
1071 
1072 static void usbg_release_cmd(struct se_cmd *);
1073 
1074 static int usbg_submit_command(struct f_uas *fu,
1075 		void *cmdbuf, unsigned int len)
1076 {
1077 	struct command_iu *cmd_iu = cmdbuf;
1078 	struct usbg_cmd *cmd;
1079 	struct usbg_tpg *tpg = fu->tpg;
1080 	struct tcm_usbg_nexus *tv_nexus;
1081 	u32 cmd_len;
1082 	u16 scsi_tag;
1083 
1084 	if (cmd_iu->iu_id != IU_ID_COMMAND) {
1085 		pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1086 		return -EINVAL;
1087 	}
1088 
1089 	tv_nexus = tpg->tpg_nexus;
1090 	if (!tv_nexus) {
1091 		pr_err("Missing nexus, ignoring command\n");
1092 		return -EINVAL;
1093 	}
1094 
1095 	cmd_len = (cmd_iu->len & ~0x3) + 16;
1096 	if (cmd_len > USBG_MAX_CMD)
1097 		return -EINVAL;
1098 
1099 	scsi_tag = be16_to_cpup(&cmd_iu->tag);
1100 	cmd = usbg_get_cmd(fu, tv_nexus, scsi_tag);
1101 	if (IS_ERR(cmd)) {
1102 		pr_err("usbg_get_cmd failed\n");
1103 		return -ENOMEM;
1104 	}
1105 	memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1106 
1107 	switch (cmd_iu->prio_attr & 0x7) {
1108 	case UAS_HEAD_TAG:
1109 		cmd->prio_attr = TCM_HEAD_TAG;
1110 		break;
1111 	case UAS_ORDERED_TAG:
1112 		cmd->prio_attr = TCM_ORDERED_TAG;
1113 		break;
1114 	case UAS_ACA:
1115 		cmd->prio_attr = TCM_ACA_TAG;
1116 		break;
1117 	default:
1118 		pr_debug_once("Unsupported prio_attr: %02x.\n",
1119 				cmd_iu->prio_attr);
1120 		fallthrough;
1121 	case UAS_SIMPLE_TAG:
1122 		cmd->prio_attr = TCM_SIMPLE_TAG;
1123 		break;
1124 	}
1125 
1126 	cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1127 
1128 	INIT_WORK(&cmd->work, usbg_cmd_work);
1129 	queue_work(tpg->workqueue, &cmd->work);
1130 
1131 	return 0;
1132 }
1133 
1134 static void bot_cmd_work(struct work_struct *work)
1135 {
1136 	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1137 	struct se_cmd *se_cmd;
1138 	struct tcm_usbg_nexus *tv_nexus;
1139 	struct usbg_tpg *tpg;
1140 	int dir;
1141 
1142 	se_cmd = &cmd->se_cmd;
1143 	tpg = cmd->fu->tpg;
1144 	tv_nexus = tpg->tpg_nexus;
1145 	dir = get_cmd_dir(cmd->cmd_buf);
1146 	if (dir < 0) {
1147 		__target_init_cmd(se_cmd,
1148 				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1149 				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1150 				  cmd->prio_attr, cmd->sense_iu.sense,
1151 				  cmd->unpacked_lun, NULL);
1152 		goto out;
1153 	}
1154 
1155 	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1156 			  cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1157 			  cmd->data_len, cmd->prio_attr, dir, 0);
1158 	return;
1159 
1160 out:
1161 	transport_send_check_condition_and_sense(se_cmd,
1162 				TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1163 }
1164 
1165 static int bot_submit_command(struct f_uas *fu,
1166 		void *cmdbuf, unsigned int len)
1167 {
1168 	struct bulk_cb_wrap *cbw = cmdbuf;
1169 	struct usbg_cmd *cmd;
1170 	struct usbg_tpg *tpg = fu->tpg;
1171 	struct tcm_usbg_nexus *tv_nexus;
1172 	u32 cmd_len;
1173 
1174 	if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1175 		pr_err("Wrong signature on CBW\n");
1176 		return -EINVAL;
1177 	}
1178 	if (len != 31) {
1179 		pr_err("Wrong length for CBW\n");
1180 		return -EINVAL;
1181 	}
1182 
1183 	cmd_len = cbw->Length;
1184 	if (cmd_len < 1 || cmd_len > 16)
1185 		return -EINVAL;
1186 
1187 	tv_nexus = tpg->tpg_nexus;
1188 	if (!tv_nexus) {
1189 		pr_err("Missing nexus, ignoring command\n");
1190 		return -ENODEV;
1191 	}
1192 
1193 	cmd = usbg_get_cmd(fu, tv_nexus, cbw->Tag);
1194 	if (IS_ERR(cmd)) {
1195 		pr_err("usbg_get_cmd failed\n");
1196 		return -ENOMEM;
1197 	}
1198 	memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1199 
1200 	cmd->bot_tag = cbw->Tag;
1201 	cmd->prio_attr = TCM_SIMPLE_TAG;
1202 	cmd->unpacked_lun = cbw->Lun;
1203 	cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1204 	cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1205 	cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1206 
1207 	INIT_WORK(&cmd->work, bot_cmd_work);
1208 	queue_work(tpg->workqueue, &cmd->work);
1209 
1210 	return 0;
1211 }
1212 
1213 /* Start fabric.c code */
1214 
1215 static int usbg_check_true(struct se_portal_group *se_tpg)
1216 {
1217 	return 1;
1218 }
1219 
1220 static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1221 {
1222 	struct usbg_tpg *tpg = container_of(se_tpg,
1223 				struct usbg_tpg, se_tpg);
1224 	struct usbg_tport *tport = tpg->tport;
1225 
1226 	return &tport->tport_name[0];
1227 }
1228 
1229 static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1230 {
1231 	struct usbg_tpg *tpg = container_of(se_tpg,
1232 				struct usbg_tpg, se_tpg);
1233 	return tpg->tport_tpgt;
1234 }
1235 
1236 static void usbg_release_cmd(struct se_cmd *se_cmd)
1237 {
1238 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1239 			se_cmd);
1240 	struct se_session *se_sess = se_cmd->se_sess;
1241 
1242 	kfree(cmd->data_buf);
1243 	target_free_tag(se_sess, se_cmd);
1244 }
1245 
1246 static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1247 {
1248 }
1249 
1250 static void usbg_aborted_task(struct se_cmd *se_cmd)
1251 {
1252 }
1253 
1254 static const char *usbg_check_wwn(const char *name)
1255 {
1256 	const char *n;
1257 	unsigned int len;
1258 
1259 	n = strstr(name, "naa.");
1260 	if (!n)
1261 		return NULL;
1262 	n += 4;
1263 	len = strlen(n);
1264 	if (len == 0 || len > USBG_NAMELEN - 1)
1265 		return NULL;
1266 	return n;
1267 }
1268 
1269 static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1270 {
1271 	if (!usbg_check_wwn(name))
1272 		return -EINVAL;
1273 	return 0;
1274 }
1275 
1276 static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
1277 					     const char *name)
1278 {
1279 	struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1280 			tport_wwn);
1281 	struct usbg_tpg *tpg;
1282 	unsigned long tpgt;
1283 	int ret;
1284 	struct f_tcm_opts *opts;
1285 	unsigned i;
1286 
1287 	if (strstr(name, "tpgt_") != name)
1288 		return ERR_PTR(-EINVAL);
1289 	if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1290 		return ERR_PTR(-EINVAL);
1291 	ret = -ENODEV;
1292 	mutex_lock(&tpg_instances_lock);
1293 	for (i = 0; i < TPG_INSTANCES; ++i)
1294 		if (tpg_instances[i].func_inst && !tpg_instances[i].tpg)
1295 			break;
1296 	if (i == TPG_INSTANCES)
1297 		goto unlock_inst;
1298 
1299 	opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
1300 		func_inst);
1301 	mutex_lock(&opts->dep_lock);
1302 	if (!opts->ready)
1303 		goto unlock_dep;
1304 
1305 	if (opts->has_dep) {
1306 		if (!try_module_get(opts->dependent))
1307 			goto unlock_dep;
1308 	} else {
1309 		ret = configfs_depend_item_unlocked(
1310 			wwn->wwn_group.cg_subsys,
1311 			&opts->func_inst.group.cg_item);
1312 		if (ret)
1313 			goto unlock_dep;
1314 	}
1315 
1316 	tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1317 	ret = -ENOMEM;
1318 	if (!tpg)
1319 		goto unref_dep;
1320 	mutex_init(&tpg->tpg_mutex);
1321 	atomic_set(&tpg->tpg_port_count, 0);
1322 	tpg->workqueue = alloc_workqueue("tcm_usb_gadget", 0, 1);
1323 	if (!tpg->workqueue)
1324 		goto free_tpg;
1325 
1326 	tpg->tport = tport;
1327 	tpg->tport_tpgt = tpgt;
1328 
1329 	/*
1330 	 * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1331 	 * pretend to be SAS..
1332 	 */
1333 	ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1334 	if (ret < 0)
1335 		goto free_workqueue;
1336 
1337 	tpg_instances[i].tpg = tpg;
1338 	tpg->fi = tpg_instances[i].func_inst;
1339 	mutex_unlock(&opts->dep_lock);
1340 	mutex_unlock(&tpg_instances_lock);
1341 	return &tpg->se_tpg;
1342 
1343 free_workqueue:
1344 	destroy_workqueue(tpg->workqueue);
1345 free_tpg:
1346 	kfree(tpg);
1347 unref_dep:
1348 	if (opts->has_dep)
1349 		module_put(opts->dependent);
1350 	else
1351 		configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1352 unlock_dep:
1353 	mutex_unlock(&opts->dep_lock);
1354 unlock_inst:
1355 	mutex_unlock(&tpg_instances_lock);
1356 
1357 	return ERR_PTR(ret);
1358 }
1359 
1360 static int tcm_usbg_drop_nexus(struct usbg_tpg *);
1361 
1362 static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1363 {
1364 	struct usbg_tpg *tpg = container_of(se_tpg,
1365 				struct usbg_tpg, se_tpg);
1366 	unsigned i;
1367 	struct f_tcm_opts *opts;
1368 
1369 	tcm_usbg_drop_nexus(tpg);
1370 	core_tpg_deregister(se_tpg);
1371 	destroy_workqueue(tpg->workqueue);
1372 
1373 	mutex_lock(&tpg_instances_lock);
1374 	for (i = 0; i < TPG_INSTANCES; ++i)
1375 		if (tpg_instances[i].tpg == tpg)
1376 			break;
1377 	if (i < TPG_INSTANCES) {
1378 		tpg_instances[i].tpg = NULL;
1379 		opts = container_of(tpg_instances[i].func_inst,
1380 			struct f_tcm_opts, func_inst);
1381 		mutex_lock(&opts->dep_lock);
1382 		if (opts->has_dep)
1383 			module_put(opts->dependent);
1384 		else
1385 			configfs_undepend_item_unlocked(
1386 				&opts->func_inst.group.cg_item);
1387 		mutex_unlock(&opts->dep_lock);
1388 	}
1389 	mutex_unlock(&tpg_instances_lock);
1390 
1391 	kfree(tpg);
1392 }
1393 
1394 static struct se_wwn *usbg_make_tport(
1395 	struct target_fabric_configfs *tf,
1396 	struct config_group *group,
1397 	const char *name)
1398 {
1399 	struct usbg_tport *tport;
1400 	const char *wnn_name;
1401 	u64 wwpn = 0;
1402 
1403 	wnn_name = usbg_check_wwn(name);
1404 	if (!wnn_name)
1405 		return ERR_PTR(-EINVAL);
1406 
1407 	tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1408 	if (!(tport))
1409 		return ERR_PTR(-ENOMEM);
1410 
1411 	tport->tport_wwpn = wwpn;
1412 	snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1413 	return &tport->tport_wwn;
1414 }
1415 
1416 static void usbg_drop_tport(struct se_wwn *wwn)
1417 {
1418 	struct usbg_tport *tport = container_of(wwn,
1419 				struct usbg_tport, tport_wwn);
1420 	kfree(tport);
1421 }
1422 
1423 /*
1424  * If somebody feels like dropping the version property, go ahead.
1425  */
1426 static ssize_t usbg_wwn_version_show(struct config_item *item,  char *page)
1427 {
1428 	return sprintf(page, "usb-gadget fabric module\n");
1429 }
1430 
1431 CONFIGFS_ATTR_RO(usbg_wwn_, version);
1432 
1433 static struct configfs_attribute *usbg_wwn_attrs[] = {
1434 	&usbg_wwn_attr_version,
1435 	NULL,
1436 };
1437 
1438 static int usbg_attach(struct usbg_tpg *);
1439 static void usbg_detach(struct usbg_tpg *);
1440 
1441 static int usbg_enable_tpg(struct se_portal_group *se_tpg, bool enable)
1442 {
1443 	struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1444 	int ret = 0;
1445 
1446 	if (enable)
1447 		ret = usbg_attach(tpg);
1448 	else
1449 		usbg_detach(tpg);
1450 	if (ret)
1451 		return ret;
1452 
1453 	tpg->gadget_connect = enable;
1454 
1455 	return 0;
1456 }
1457 
1458 static ssize_t tcm_usbg_tpg_nexus_show(struct config_item *item, char *page)
1459 {
1460 	struct se_portal_group *se_tpg = to_tpg(item);
1461 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1462 	struct tcm_usbg_nexus *tv_nexus;
1463 	ssize_t ret;
1464 
1465 	mutex_lock(&tpg->tpg_mutex);
1466 	tv_nexus = tpg->tpg_nexus;
1467 	if (!tv_nexus) {
1468 		ret = -ENODEV;
1469 		goto out;
1470 	}
1471 	ret = sysfs_emit(page, "%s\n",
1472 			 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1473 out:
1474 	mutex_unlock(&tpg->tpg_mutex);
1475 	return ret;
1476 }
1477 
1478 static int usbg_alloc_sess_cb(struct se_portal_group *se_tpg,
1479 			      struct se_session *se_sess, void *p)
1480 {
1481 	struct usbg_tpg *tpg = container_of(se_tpg,
1482 				struct usbg_tpg, se_tpg);
1483 
1484 	tpg->tpg_nexus = p;
1485 	return 0;
1486 }
1487 
1488 static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1489 {
1490 	struct tcm_usbg_nexus *tv_nexus;
1491 	int ret = 0;
1492 
1493 	mutex_lock(&tpg->tpg_mutex);
1494 	if (tpg->tpg_nexus) {
1495 		ret = -EEXIST;
1496 		pr_debug("tpg->tpg_nexus already exists\n");
1497 		goto out_unlock;
1498 	}
1499 
1500 	tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1501 	if (!tv_nexus) {
1502 		ret = -ENOMEM;
1503 		goto out_unlock;
1504 	}
1505 
1506 	tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg,
1507 						     USB_G_DEFAULT_SESSION_TAGS,
1508 						     sizeof(struct usbg_cmd),
1509 						     TARGET_PROT_NORMAL, name,
1510 						     tv_nexus, usbg_alloc_sess_cb);
1511 	if (IS_ERR(tv_nexus->tvn_se_sess)) {
1512 #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
1513 		pr_debug(MAKE_NEXUS_MSG, name);
1514 #undef MAKE_NEXUS_MSG
1515 		ret = PTR_ERR(tv_nexus->tvn_se_sess);
1516 		kfree(tv_nexus);
1517 	}
1518 
1519 out_unlock:
1520 	mutex_unlock(&tpg->tpg_mutex);
1521 	return ret;
1522 }
1523 
1524 static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1525 {
1526 	struct se_session *se_sess;
1527 	struct tcm_usbg_nexus *tv_nexus;
1528 	int ret = -ENODEV;
1529 
1530 	mutex_lock(&tpg->tpg_mutex);
1531 	tv_nexus = tpg->tpg_nexus;
1532 	if (!tv_nexus)
1533 		goto out;
1534 
1535 	se_sess = tv_nexus->tvn_se_sess;
1536 	if (!se_sess)
1537 		goto out;
1538 
1539 	if (atomic_read(&tpg->tpg_port_count)) {
1540 		ret = -EPERM;
1541 #define MSG "Unable to remove Host I_T Nexus with active TPG port count: %d\n"
1542 		pr_err(MSG, atomic_read(&tpg->tpg_port_count));
1543 #undef MSG
1544 		goto out;
1545 	}
1546 
1547 	pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1548 			tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1549 	/*
1550 	 * Release the SCSI I_T Nexus to the emulated vHost Target Port
1551 	 */
1552 	target_remove_session(se_sess);
1553 	tpg->tpg_nexus = NULL;
1554 
1555 	kfree(tv_nexus);
1556 	ret = 0;
1557 out:
1558 	mutex_unlock(&tpg->tpg_mutex);
1559 	return ret;
1560 }
1561 
1562 static ssize_t tcm_usbg_tpg_nexus_store(struct config_item *item,
1563 		const char *page, size_t count)
1564 {
1565 	struct se_portal_group *se_tpg = to_tpg(item);
1566 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1567 	unsigned char i_port[USBG_NAMELEN], *ptr;
1568 	int ret;
1569 
1570 	if (!strncmp(page, "NULL", 4)) {
1571 		ret = tcm_usbg_drop_nexus(tpg);
1572 		return (!ret) ? count : ret;
1573 	}
1574 	if (strlen(page) >= USBG_NAMELEN) {
1575 
1576 #define NEXUS_STORE_MSG "Emulated NAA Sas Address: %s, exceeds max: %d\n"
1577 		pr_err(NEXUS_STORE_MSG, page, USBG_NAMELEN);
1578 #undef NEXUS_STORE_MSG
1579 		return -EINVAL;
1580 	}
1581 	snprintf(i_port, USBG_NAMELEN, "%s", page);
1582 
1583 	ptr = strstr(i_port, "naa.");
1584 	if (!ptr) {
1585 		pr_err("Missing 'naa.' prefix\n");
1586 		return -EINVAL;
1587 	}
1588 
1589 	if (i_port[strlen(i_port) - 1] == '\n')
1590 		i_port[strlen(i_port) - 1] = '\0';
1591 
1592 	ret = tcm_usbg_make_nexus(tpg, &i_port[0]);
1593 	if (ret < 0)
1594 		return ret;
1595 	return count;
1596 }
1597 
1598 CONFIGFS_ATTR(tcm_usbg_tpg_, nexus);
1599 
1600 static struct configfs_attribute *usbg_base_attrs[] = {
1601 	&tcm_usbg_tpg_attr_nexus,
1602 	NULL,
1603 };
1604 
1605 static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1606 {
1607 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1608 
1609 	atomic_inc(&tpg->tpg_port_count);
1610 	smp_mb__after_atomic();
1611 	return 0;
1612 }
1613 
1614 static void usbg_port_unlink(struct se_portal_group *se_tpg,
1615 		struct se_lun *se_lun)
1616 {
1617 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1618 
1619 	atomic_dec(&tpg->tpg_port_count);
1620 	smp_mb__after_atomic();
1621 }
1622 
1623 static int usbg_check_stop_free(struct se_cmd *se_cmd)
1624 {
1625 	return target_put_sess_cmd(se_cmd);
1626 }
1627 
1628 static const struct target_core_fabric_ops usbg_ops = {
1629 	.module				= THIS_MODULE,
1630 	.fabric_name			= "usb_gadget",
1631 	.tpg_get_wwn			= usbg_get_fabric_wwn,
1632 	.tpg_get_tag			= usbg_get_tag,
1633 	.tpg_check_demo_mode		= usbg_check_true,
1634 	.release_cmd			= usbg_release_cmd,
1635 	.sess_get_initiator_sid		= NULL,
1636 	.write_pending			= usbg_send_write_request,
1637 	.queue_data_in			= usbg_send_read_response,
1638 	.queue_status			= usbg_send_status_response,
1639 	.queue_tm_rsp			= usbg_queue_tm_rsp,
1640 	.aborted_task			= usbg_aborted_task,
1641 	.check_stop_free		= usbg_check_stop_free,
1642 
1643 	.fabric_make_wwn		= usbg_make_tport,
1644 	.fabric_drop_wwn		= usbg_drop_tport,
1645 	.fabric_make_tpg		= usbg_make_tpg,
1646 	.fabric_enable_tpg		= usbg_enable_tpg,
1647 	.fabric_drop_tpg		= usbg_drop_tpg,
1648 	.fabric_post_link		= usbg_port_link,
1649 	.fabric_pre_unlink		= usbg_port_unlink,
1650 	.fabric_init_nodeacl		= usbg_init_nodeacl,
1651 
1652 	.tfc_wwn_attrs			= usbg_wwn_attrs,
1653 	.tfc_tpg_base_attrs		= usbg_base_attrs,
1654 
1655 	.default_submit_type		= TARGET_DIRECT_SUBMIT,
1656 	.direct_submit_supp		= 1,
1657 };
1658 
1659 /* Start gadget.c code */
1660 
1661 static struct usb_interface_descriptor bot_intf_desc = {
1662 	.bLength =              sizeof(bot_intf_desc),
1663 	.bDescriptorType =      USB_DT_INTERFACE,
1664 	.bNumEndpoints =        2,
1665 	.bAlternateSetting =	USB_G_ALT_INT_BBB,
1666 	.bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1667 	.bInterfaceSubClass =   USB_SC_SCSI,
1668 	.bInterfaceProtocol =   USB_PR_BULK,
1669 };
1670 
1671 static struct usb_interface_descriptor uasp_intf_desc = {
1672 	.bLength =		sizeof(uasp_intf_desc),
1673 	.bDescriptorType =	USB_DT_INTERFACE,
1674 	.bNumEndpoints =	4,
1675 	.bAlternateSetting =	USB_G_ALT_INT_UAS,
1676 	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
1677 	.bInterfaceSubClass =	USB_SC_SCSI,
1678 	.bInterfaceProtocol =	USB_PR_UAS,
1679 };
1680 
1681 static struct usb_endpoint_descriptor uasp_bi_desc = {
1682 	.bLength =		USB_DT_ENDPOINT_SIZE,
1683 	.bDescriptorType =	USB_DT_ENDPOINT,
1684 	.bEndpointAddress =	USB_DIR_IN,
1685 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1686 	.wMaxPacketSize =	cpu_to_le16(512),
1687 };
1688 
1689 static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1690 	.bLength =		USB_DT_ENDPOINT_SIZE,
1691 	.bDescriptorType =	USB_DT_ENDPOINT,
1692 	.bEndpointAddress =	USB_DIR_IN,
1693 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1694 };
1695 
1696 static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1697 	.bLength =		sizeof(uasp_bi_pipe_desc),
1698 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1699 	.bPipeID =		DATA_IN_PIPE_ID,
1700 };
1701 
1702 static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1703 	.bLength =		USB_DT_ENDPOINT_SIZE,
1704 	.bDescriptorType =	USB_DT_ENDPOINT,
1705 	.bEndpointAddress =	USB_DIR_IN,
1706 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1707 	.wMaxPacketSize =	cpu_to_le16(1024),
1708 };
1709 
1710 static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1711 	.bLength =		sizeof(uasp_bi_ep_comp_desc),
1712 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1713 	.bMaxBurst =		15,
1714 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1715 	.wBytesPerInterval =	0,
1716 };
1717 
1718 static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1719 	.bLength =		sizeof(bot_bi_ep_comp_desc),
1720 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1721 	.bMaxBurst =		15,
1722 };
1723 
1724 static struct usb_endpoint_descriptor uasp_bo_desc = {
1725 	.bLength =		USB_DT_ENDPOINT_SIZE,
1726 	.bDescriptorType =	USB_DT_ENDPOINT,
1727 	.bEndpointAddress =	USB_DIR_OUT,
1728 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1729 	.wMaxPacketSize =	cpu_to_le16(512),
1730 };
1731 
1732 static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1733 	.bLength =		USB_DT_ENDPOINT_SIZE,
1734 	.bDescriptorType =	USB_DT_ENDPOINT,
1735 	.bEndpointAddress =	USB_DIR_OUT,
1736 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1737 };
1738 
1739 static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1740 	.bLength =		sizeof(uasp_bo_pipe_desc),
1741 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1742 	.bPipeID =		DATA_OUT_PIPE_ID,
1743 };
1744 
1745 static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1746 	.bLength =		USB_DT_ENDPOINT_SIZE,
1747 	.bDescriptorType =	USB_DT_ENDPOINT,
1748 	.bEndpointAddress =	USB_DIR_OUT,
1749 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1750 	.wMaxPacketSize =	cpu_to_le16(0x400),
1751 };
1752 
1753 static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1754 	.bLength =		sizeof(uasp_bo_ep_comp_desc),
1755 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1756 	.bMaxBurst =		15,
1757 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1758 };
1759 
1760 static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1761 	.bLength =		sizeof(bot_bo_ep_comp_desc),
1762 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1763 	.bMaxBurst =		15,
1764 };
1765 
1766 static struct usb_endpoint_descriptor uasp_status_desc = {
1767 	.bLength =		USB_DT_ENDPOINT_SIZE,
1768 	.bDescriptorType =	USB_DT_ENDPOINT,
1769 	.bEndpointAddress =	USB_DIR_IN,
1770 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1771 	.wMaxPacketSize =	cpu_to_le16(512),
1772 };
1773 
1774 static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1775 	.bLength =		USB_DT_ENDPOINT_SIZE,
1776 	.bDescriptorType =	USB_DT_ENDPOINT,
1777 	.bEndpointAddress =	USB_DIR_IN,
1778 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1779 };
1780 
1781 static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1782 	.bLength =		sizeof(uasp_status_pipe_desc),
1783 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1784 	.bPipeID =		STATUS_PIPE_ID,
1785 };
1786 
1787 static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1788 	.bLength =		USB_DT_ENDPOINT_SIZE,
1789 	.bDescriptorType =	USB_DT_ENDPOINT,
1790 	.bEndpointAddress =	USB_DIR_IN,
1791 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1792 	.wMaxPacketSize =	cpu_to_le16(1024),
1793 };
1794 
1795 static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1796 	.bLength =		sizeof(uasp_status_in_ep_comp_desc),
1797 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1798 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1799 };
1800 
1801 static struct usb_endpoint_descriptor uasp_cmd_desc = {
1802 	.bLength =		USB_DT_ENDPOINT_SIZE,
1803 	.bDescriptorType =	USB_DT_ENDPOINT,
1804 	.bEndpointAddress =	USB_DIR_OUT,
1805 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1806 	.wMaxPacketSize =	cpu_to_le16(512),
1807 };
1808 
1809 static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1810 	.bLength =		USB_DT_ENDPOINT_SIZE,
1811 	.bDescriptorType =	USB_DT_ENDPOINT,
1812 	.bEndpointAddress =	USB_DIR_OUT,
1813 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1814 };
1815 
1816 static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1817 	.bLength =		sizeof(uasp_cmd_pipe_desc),
1818 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1819 	.bPipeID =		CMD_PIPE_ID,
1820 };
1821 
1822 static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1823 	.bLength =		USB_DT_ENDPOINT_SIZE,
1824 	.bDescriptorType =	USB_DT_ENDPOINT,
1825 	.bEndpointAddress =	USB_DIR_OUT,
1826 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1827 	.wMaxPacketSize =	cpu_to_le16(1024),
1828 };
1829 
1830 static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1831 	.bLength =		sizeof(uasp_cmd_comp_desc),
1832 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1833 };
1834 
1835 static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1836 	(struct usb_descriptor_header *) &bot_intf_desc,
1837 	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1838 	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1839 
1840 	(struct usb_descriptor_header *) &uasp_intf_desc,
1841 	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1842 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1843 	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1844 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1845 	(struct usb_descriptor_header *) &uasp_fs_status_desc,
1846 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1847 	(struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1848 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1849 	NULL,
1850 };
1851 
1852 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1853 	(struct usb_descriptor_header *) &bot_intf_desc,
1854 	(struct usb_descriptor_header *) &uasp_bi_desc,
1855 	(struct usb_descriptor_header *) &uasp_bo_desc,
1856 
1857 	(struct usb_descriptor_header *) &uasp_intf_desc,
1858 	(struct usb_descriptor_header *) &uasp_bi_desc,
1859 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1860 	(struct usb_descriptor_header *) &uasp_bo_desc,
1861 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1862 	(struct usb_descriptor_header *) &uasp_status_desc,
1863 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1864 	(struct usb_descriptor_header *) &uasp_cmd_desc,
1865 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1866 	NULL,
1867 };
1868 
1869 static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1870 	(struct usb_descriptor_header *) &bot_intf_desc,
1871 	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1872 	(struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1873 	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1874 	(struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1875 
1876 	(struct usb_descriptor_header *) &uasp_intf_desc,
1877 	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1878 	(struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
1879 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1880 	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1881 	(struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
1882 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1883 	(struct usb_descriptor_header *) &uasp_ss_status_desc,
1884 	(struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
1885 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1886 	(struct usb_descriptor_header *) &uasp_ss_cmd_desc,
1887 	(struct usb_descriptor_header *) &uasp_cmd_comp_desc,
1888 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1889 	NULL,
1890 };
1891 
1892 static struct usb_string	tcm_us_strings[] = {
1893 	[USB_G_STR_INT_UAS].s		= "USB Attached SCSI",
1894 	[USB_G_STR_INT_BBB].s		= "Bulk Only Transport",
1895 	{ },
1896 };
1897 
1898 static struct usb_gadget_strings tcm_stringtab = {
1899 	.language = 0x0409,
1900 	.strings = tcm_us_strings,
1901 };
1902 
1903 static struct usb_gadget_strings *tcm_strings[] = {
1904 	&tcm_stringtab,
1905 	NULL,
1906 };
1907 
1908 static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
1909 {
1910 	struct f_uas		*fu = to_f_uas(f);
1911 	struct usb_string	*us;
1912 	struct usb_gadget	*gadget = c->cdev->gadget;
1913 	struct usb_ep		*ep;
1914 	struct f_tcm_opts	*opts;
1915 	int			iface;
1916 	int			ret;
1917 
1918 	opts = container_of(f->fi, struct f_tcm_opts, func_inst);
1919 
1920 	mutex_lock(&opts->dep_lock);
1921 	if (!opts->can_attach) {
1922 		mutex_unlock(&opts->dep_lock);
1923 		return -ENODEV;
1924 	}
1925 	mutex_unlock(&opts->dep_lock);
1926 	us = usb_gstrings_attach(c->cdev, tcm_strings,
1927 		ARRAY_SIZE(tcm_us_strings));
1928 	if (IS_ERR(us))
1929 		return PTR_ERR(us);
1930 	bot_intf_desc.iInterface = us[USB_G_STR_INT_BBB].id;
1931 	uasp_intf_desc.iInterface = us[USB_G_STR_INT_UAS].id;
1932 
1933 	iface = usb_interface_id(c, f);
1934 	if (iface < 0)
1935 		return iface;
1936 
1937 	bot_intf_desc.bInterfaceNumber = iface;
1938 	uasp_intf_desc.bInterfaceNumber = iface;
1939 	fu->iface = iface;
1940 	ep = usb_ep_autoconfig(gadget, &uasp_fs_bi_desc);
1941 	if (!ep)
1942 		goto ep_fail;
1943 
1944 	fu->ep_in = ep;
1945 
1946 	ep = usb_ep_autoconfig(gadget, &uasp_fs_bo_desc);
1947 	if (!ep)
1948 		goto ep_fail;
1949 	fu->ep_out = ep;
1950 
1951 	ep = usb_ep_autoconfig(gadget, &uasp_fs_status_desc);
1952 	if (!ep)
1953 		goto ep_fail;
1954 	fu->ep_status = ep;
1955 
1956 	ep = usb_ep_autoconfig(gadget, &uasp_fs_cmd_desc);
1957 	if (!ep)
1958 		goto ep_fail;
1959 	fu->ep_cmd = ep;
1960 
1961 	/* Assume endpoint addresses are the same for both speeds */
1962 	uasp_bi_desc.bEndpointAddress =	uasp_fs_bi_desc.bEndpointAddress;
1963 	uasp_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
1964 	uasp_status_desc.bEndpointAddress =
1965 		uasp_fs_status_desc.bEndpointAddress;
1966 	uasp_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
1967 
1968 	uasp_ss_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
1969 	uasp_ss_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
1970 	uasp_ss_status_desc.bEndpointAddress =
1971 		uasp_fs_status_desc.bEndpointAddress;
1972 	uasp_ss_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
1973 
1974 	ret = usb_assign_descriptors(f, uasp_fs_function_desc,
1975 			uasp_hs_function_desc, uasp_ss_function_desc,
1976 			uasp_ss_function_desc);
1977 	if (ret)
1978 		goto ep_fail;
1979 
1980 	return 0;
1981 ep_fail:
1982 	pr_err("Can't claim all required eps\n");
1983 
1984 	return -ENOTSUPP;
1985 }
1986 
1987 struct guas_setup_wq {
1988 	struct work_struct work;
1989 	struct f_uas *fu;
1990 	unsigned int alt;
1991 };
1992 
1993 static void tcm_delayed_set_alt(struct work_struct *wq)
1994 {
1995 	struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
1996 			work);
1997 	struct f_uas *fu = work->fu;
1998 	int alt = work->alt;
1999 
2000 	kfree(work);
2001 
2002 	if (fu->flags & USBG_IS_BOT)
2003 		bot_cleanup_old_alt(fu);
2004 	if (fu->flags & USBG_IS_UAS)
2005 		uasp_cleanup_old_alt(fu);
2006 
2007 	if (alt == USB_G_ALT_INT_BBB)
2008 		bot_set_alt(fu);
2009 	else if (alt == USB_G_ALT_INT_UAS)
2010 		uasp_set_alt(fu);
2011 	usb_composite_setup_continue(fu->function.config->cdev);
2012 }
2013 
2014 static int tcm_get_alt(struct usb_function *f, unsigned intf)
2015 {
2016 	struct f_uas *fu = to_f_uas(f);
2017 
2018 	if (fu->iface != intf)
2019 		return -EOPNOTSUPP;
2020 
2021 	if (fu->flags & USBG_IS_BOT)
2022 		return USB_G_ALT_INT_BBB;
2023 	else if (fu->flags & USBG_IS_UAS)
2024 		return USB_G_ALT_INT_UAS;
2025 
2026 	return -EOPNOTSUPP;
2027 }
2028 
2029 static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2030 {
2031 	struct f_uas *fu = to_f_uas(f);
2032 
2033 	if (fu->iface != intf)
2034 		return -EOPNOTSUPP;
2035 
2036 	if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2037 		struct guas_setup_wq *work;
2038 
2039 		work = kmalloc(sizeof(*work), GFP_ATOMIC);
2040 		if (!work)
2041 			return -ENOMEM;
2042 		INIT_WORK(&work->work, tcm_delayed_set_alt);
2043 		work->fu = fu;
2044 		work->alt = alt;
2045 		schedule_work(&work->work);
2046 		return USB_GADGET_DELAYED_STATUS;
2047 	}
2048 	return -EOPNOTSUPP;
2049 }
2050 
2051 static void tcm_disable(struct usb_function *f)
2052 {
2053 	struct f_uas *fu = to_f_uas(f);
2054 
2055 	if (fu->flags & USBG_IS_UAS)
2056 		uasp_cleanup_old_alt(fu);
2057 	else if (fu->flags & USBG_IS_BOT)
2058 		bot_cleanup_old_alt(fu);
2059 	fu->flags = 0;
2060 }
2061 
2062 static int tcm_setup(struct usb_function *f,
2063 		const struct usb_ctrlrequest *ctrl)
2064 {
2065 	struct f_uas *fu = to_f_uas(f);
2066 
2067 	if (!(fu->flags & USBG_IS_BOT))
2068 		return -EOPNOTSUPP;
2069 
2070 	return usbg_bot_setup(f, ctrl);
2071 }
2072 
2073 static inline struct f_tcm_opts *to_f_tcm_opts(struct config_item *item)
2074 {
2075 	return container_of(to_config_group(item), struct f_tcm_opts,
2076 		func_inst.group);
2077 }
2078 
2079 static void tcm_attr_release(struct config_item *item)
2080 {
2081 	struct f_tcm_opts *opts = to_f_tcm_opts(item);
2082 
2083 	usb_put_function_instance(&opts->func_inst);
2084 }
2085 
2086 static struct configfs_item_operations tcm_item_ops = {
2087 	.release		= tcm_attr_release,
2088 };
2089 
2090 static const struct config_item_type tcm_func_type = {
2091 	.ct_item_ops	= &tcm_item_ops,
2092 	.ct_owner	= THIS_MODULE,
2093 };
2094 
2095 static void tcm_free_inst(struct usb_function_instance *f)
2096 {
2097 	struct f_tcm_opts *opts;
2098 	unsigned i;
2099 
2100 	opts = container_of(f, struct f_tcm_opts, func_inst);
2101 
2102 	mutex_lock(&tpg_instances_lock);
2103 	for (i = 0; i < TPG_INSTANCES; ++i)
2104 		if (tpg_instances[i].func_inst == f)
2105 			break;
2106 	if (i < TPG_INSTANCES)
2107 		tpg_instances[i].func_inst = NULL;
2108 	mutex_unlock(&tpg_instances_lock);
2109 
2110 	kfree(opts);
2111 }
2112 
2113 static int tcm_register_callback(struct usb_function_instance *f)
2114 {
2115 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2116 
2117 	mutex_lock(&opts->dep_lock);
2118 	opts->can_attach = true;
2119 	mutex_unlock(&opts->dep_lock);
2120 
2121 	return 0;
2122 }
2123 
2124 static void tcm_unregister_callback(struct usb_function_instance *f)
2125 {
2126 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2127 
2128 	mutex_lock(&opts->dep_lock);
2129 	unregister_gadget_item(opts->
2130 		func_inst.group.cg_item.ci_parent->ci_parent);
2131 	opts->can_attach = false;
2132 	mutex_unlock(&opts->dep_lock);
2133 }
2134 
2135 static int usbg_attach(struct usbg_tpg *tpg)
2136 {
2137 	struct usb_function_instance *f = tpg->fi;
2138 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2139 
2140 	if (opts->tcm_register_callback)
2141 		return opts->tcm_register_callback(f);
2142 
2143 	return 0;
2144 }
2145 
2146 static void usbg_detach(struct usbg_tpg *tpg)
2147 {
2148 	struct usb_function_instance *f = tpg->fi;
2149 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2150 
2151 	if (opts->tcm_unregister_callback)
2152 		opts->tcm_unregister_callback(f);
2153 }
2154 
2155 static int tcm_set_name(struct usb_function_instance *f, const char *name)
2156 {
2157 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2158 
2159 	pr_debug("tcm: Activating %s\n", name);
2160 
2161 	mutex_lock(&opts->dep_lock);
2162 	opts->ready = true;
2163 	mutex_unlock(&opts->dep_lock);
2164 
2165 	return 0;
2166 }
2167 
2168 static struct usb_function_instance *tcm_alloc_inst(void)
2169 {
2170 	struct f_tcm_opts *opts;
2171 	int i;
2172 
2173 
2174 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2175 	if (!opts)
2176 		return ERR_PTR(-ENOMEM);
2177 
2178 	mutex_lock(&tpg_instances_lock);
2179 	for (i = 0; i < TPG_INSTANCES; ++i)
2180 		if (!tpg_instances[i].func_inst)
2181 			break;
2182 
2183 	if (i == TPG_INSTANCES) {
2184 		mutex_unlock(&tpg_instances_lock);
2185 		kfree(opts);
2186 		return ERR_PTR(-EBUSY);
2187 	}
2188 	tpg_instances[i].func_inst = &opts->func_inst;
2189 	mutex_unlock(&tpg_instances_lock);
2190 
2191 	mutex_init(&opts->dep_lock);
2192 	opts->func_inst.set_inst_name = tcm_set_name;
2193 	opts->func_inst.free_func_inst = tcm_free_inst;
2194 	opts->tcm_register_callback = tcm_register_callback;
2195 	opts->tcm_unregister_callback = tcm_unregister_callback;
2196 
2197 	config_group_init_type_name(&opts->func_inst.group, "",
2198 			&tcm_func_type);
2199 
2200 	return &opts->func_inst;
2201 }
2202 
2203 static void tcm_free(struct usb_function *f)
2204 {
2205 	struct f_uas *tcm = to_f_uas(f);
2206 
2207 	kfree(tcm);
2208 }
2209 
2210 static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
2211 {
2212 	usb_free_all_descriptors(f);
2213 }
2214 
2215 static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
2216 {
2217 	struct f_uas *fu;
2218 	unsigned i;
2219 
2220 	mutex_lock(&tpg_instances_lock);
2221 	for (i = 0; i < TPG_INSTANCES; ++i)
2222 		if (tpg_instances[i].func_inst == fi)
2223 			break;
2224 	if (i == TPG_INSTANCES) {
2225 		mutex_unlock(&tpg_instances_lock);
2226 		return ERR_PTR(-ENODEV);
2227 	}
2228 
2229 	fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2230 	if (!fu) {
2231 		mutex_unlock(&tpg_instances_lock);
2232 		return ERR_PTR(-ENOMEM);
2233 	}
2234 
2235 	fu->function.name = "Target Function";
2236 	fu->function.bind = tcm_bind;
2237 	fu->function.unbind = tcm_unbind;
2238 	fu->function.set_alt = tcm_set_alt;
2239 	fu->function.get_alt = tcm_get_alt;
2240 	fu->function.setup = tcm_setup;
2241 	fu->function.disable = tcm_disable;
2242 	fu->function.free_func = tcm_free;
2243 	fu->tpg = tpg_instances[i].tpg;
2244 	mutex_unlock(&tpg_instances_lock);
2245 
2246 	return &fu->function;
2247 }
2248 
2249 DECLARE_USB_FUNCTION(tcm, tcm_alloc_inst, tcm_alloc);
2250 
2251 static int __init tcm_init(void)
2252 {
2253 	int ret;
2254 
2255 	ret = usb_function_register(&tcmusb_func);
2256 	if (ret)
2257 		return ret;
2258 
2259 	ret = target_register_template(&usbg_ops);
2260 	if (ret)
2261 		usb_function_unregister(&tcmusb_func);
2262 
2263 	return ret;
2264 }
2265 module_init(tcm_init);
2266 
2267 static void __exit tcm_exit(void)
2268 {
2269 	target_unregister_template(&usbg_ops);
2270 	usb_function_unregister(&tcmusb_func);
2271 }
2272 module_exit(tcm_exit);
2273 
2274 MODULE_DESCRIPTION("Target based USB-Gadget");
2275 MODULE_LICENSE("GPL");
2276 MODULE_AUTHOR("Sebastian Andrzej Siewior");
2277