projects/linux·blob master · refs

2794 lines · 68.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2/* Target based USB-Gadget
3 *
4 * UAS protocol handling, target callbacks, configfs handling,
5 * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
6 *
7 * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
8 */
9#include <linux/kernel.h>
10#include <linux/module.h>
11#include <linux/types.h>
12#include <linux/string.h>
13#include <linux/configfs.h>
14#include <linux/ctype.h>
15#include <linux/delay.h>
16#include <linux/usb/ch9.h>
17#include <linux/usb/composite.h>
18#include <linux/usb/gadget.h>
19#include <linux/usb/storage.h>
20#include <scsi/scsi_tcq.h>
21#include <target/target_core_base.h>
22#include <target/target_core_fabric.h>
23#include <linux/unaligned.h>
24
25#include "tcm.h"
26#include "u_tcm.h"
27#include "configfs.h"
28
29#define TPG_INSTANCES 1
30
31struct tpg_instance {
32 struct usb_function_instance *func_inst;
33 struct usbg_tpg *tpg;
34};
35
36static struct tpg_instance tpg_instances[TPG_INSTANCES];
37
38static DEFINE_MUTEX(tpg_instances_lock);
39
40static inline struct f_uas *to_f_uas(struct usb_function *f)
41{
42 return container_of(f, struct f_uas, function);
43}
44
45/* Start bot.c code */
46
47static int bot_enqueue_cmd_cbw(struct f_uas *fu)
48{
49 int ret;
50
51 if (fu->flags & USBG_BOT_CMD_PEND)
52 return 0;
53
54 ret = usb_ep_queue(fu->ep_out, fu->cmd[0].req, GFP_ATOMIC);
55 if (!ret)
56 fu->flags |= USBG_BOT_CMD_PEND;
57 return ret;
58}
59
60static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
61{
62 struct usbg_cmd *cmd = req->context;
63 struct f_uas *fu = cmd->fu;
64
65 transport_generic_free_cmd(&cmd->se_cmd, 0);
66 if (req->status == -ESHUTDOWN)
67 return;
68
69 if (req->status < 0)
70 pr_err("ERR %s(%d)\n", __func__, __LINE__);
71
72 /* CSW completed, wait for next CBW */
73 bot_enqueue_cmd_cbw(fu);
74}
75
76static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
77{
78 struct bulk_cs_wrap *csw = &fu->bot_status.csw;
79 int ret;
80 unsigned int csw_stat;
81
82 csw_stat = cmd->csw_code;
83 csw->Tag = cmd->bot_tag;
84 csw->Status = csw_stat;
85 fu->bot_status.req->context = cmd;
86 ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
87 if (ret)
88 pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
89}
90
91static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
92{
93 struct usbg_cmd *cmd = req->context;
94 struct f_uas *fu = cmd->fu;
95
96 if (req->status < 0)
97 pr_err("ERR %s(%d)\n", __func__, __LINE__);
98
99 if (cmd->data_len) {
100 if (cmd->data_len > ep->maxpacket) {
101 req->length = ep->maxpacket;
102 cmd->data_len -= ep->maxpacket;
103 } else {
104 req->length = cmd->data_len;
105 cmd->data_len = 0;
106 }
107
108 usb_ep_queue(ep, req, GFP_ATOMIC);
109 return;
110 }
111 bot_enqueue_sense_code(fu, cmd);
112}
113
114static void bot_send_bad_status(struct usbg_cmd *cmd)
115{
116 struct f_uas *fu = cmd->fu;
117 struct bulk_cs_wrap *csw = &fu->bot_status.csw;
118 struct usb_request *req;
119 struct usb_ep *ep;
120
121 csw->Residue = cpu_to_le32(cmd->data_len);
122
123 if (cmd->data_len) {
124 if (cmd->is_read) {
125 ep = fu->ep_in;
126 req = fu->bot_req_in;
127 } else {
128 ep = fu->ep_out;
129 req = fu->bot_req_out;
130 }
131
132 if (cmd->data_len > fu->ep_in->maxpacket) {
133 req->length = ep->maxpacket;
134 cmd->data_len -= ep->maxpacket;
135 } else {
136 req->length = cmd->data_len;
137 cmd->data_len = 0;
138 }
139 req->complete = bot_err_compl;
140 req->context = cmd;
141 req->buf = fu->cmd[0].buf;
142 usb_ep_queue(ep, req, GFP_KERNEL);
143 } else {
144 bot_enqueue_sense_code(fu, cmd);
145 }
146}
147
148static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
149{
150 struct f_uas *fu = cmd->fu;
151 struct bulk_cs_wrap *csw = &fu->bot_status.csw;
152 int ret;
153
154 if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
155 if (!moved_data && cmd->data_len) {
156 /*
157 * the host wants to move data, we don't. Fill / empty
158 * the pipe and then send the csw with reside set.
159 */
160 cmd->csw_code = US_BULK_STAT_OK;
161 bot_send_bad_status(cmd);
162 return 0;
163 }
164
165 csw->Tag = cmd->bot_tag;
166 csw->Residue = cpu_to_le32(0);
167 csw->Status = US_BULK_STAT_OK;
168 fu->bot_status.req->context = cmd;
169
170 ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
171 if (ret)
172 pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
173 } else {
174 cmd->csw_code = US_BULK_STAT_FAIL;
175 bot_send_bad_status(cmd);
176 }
177 return 0;
178}
179
180/*
181 * Called after command (no data transfer) or after the write (to device)
182 * operation is completed
183 */
184static int bot_send_status_response(struct usbg_cmd *cmd)
185{
186 bool moved_data = false;
187
188 if (!cmd->is_read)
189 moved_data = true;
190 return bot_send_status(cmd, moved_data);
191}
192
193/* Read request completed, now we have to send the CSW */
194static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
195{
196 struct usbg_cmd *cmd = req->context;
197
198 if (req->status < 0)
199 pr_err("ERR %s(%d)\n", __func__, __LINE__);
200
201 if (req->status == -ESHUTDOWN) {
202 transport_generic_free_cmd(&cmd->se_cmd, 0);
203 return;
204 }
205
206 bot_send_status(cmd, true);
207}
208
209static int bot_send_read_response(struct usbg_cmd *cmd)
210{
211 struct f_uas *fu = cmd->fu;
212 struct se_cmd *se_cmd = &cmd->se_cmd;
213 struct usb_gadget *gadget = fuas_to_gadget(fu);
214 int ret;
215
216 if (!cmd->data_len) {
217 cmd->csw_code = US_BULK_STAT_PHASE;
218 bot_send_bad_status(cmd);
219 return 0;
220 }
221
222 if (!gadget->sg_supported) {
223 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
224 if (!cmd->data_buf)
225 return -ENOMEM;
226
227 sg_copy_to_buffer(se_cmd->t_data_sg,
228 se_cmd->t_data_nents,
229 cmd->data_buf,
230 se_cmd->data_length);
231
232 fu->bot_req_in->buf = cmd->data_buf;
233 } else {
234 fu->bot_req_in->buf = NULL;
235 fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
236 fu->bot_req_in->sg = se_cmd->t_data_sg;
237 }
238
239 fu->bot_req_in->complete = bot_read_compl;
240 fu->bot_req_in->length = se_cmd->data_length;
241 fu->bot_req_in->context = cmd;
242 ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
243 if (ret)
244 pr_err("%s(%d)\n", __func__, __LINE__);
245 return 0;
246}
247
248static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
249static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
250
251static int bot_send_write_request(struct usbg_cmd *cmd)
252{
253 struct f_uas *fu = cmd->fu;
254 int ret;
255
256 cmd->fu = fu;
257
258 if (!cmd->data_len) {
259 cmd->csw_code = US_BULK_STAT_PHASE;
260 return -EINVAL;
261 }
262
263 ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
264 if (ret)
265 goto cleanup;
266 ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
267 if (ret)
268 pr_err("%s(%d)\n", __func__, __LINE__);
269
270cleanup:
271 return ret;
272}
273
274static int bot_submit_command(struct f_uas *, void *, unsigned int);
275
276static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
277{
278 struct f_uas *fu = req->context;
279 int ret;
280
281 if (req->status == -ESHUTDOWN)
282 return;
283
284 fu->flags &= ~USBG_BOT_CMD_PEND;
285
286 if (req->status < 0) {
287 struct usb_gadget *gadget = fuas_to_gadget(fu);
288
289 dev_err(&gadget->dev, "BOT command req err (%d)\n", req->status);
290 bot_enqueue_cmd_cbw(fu);
291 return;
292 }
293
294 ret = bot_submit_command(fu, req->buf, req->actual);
295 if (ret) {
296 pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
297 if (!(fu->flags & USBG_BOT_WEDGED))
298 usb_ep_set_wedge(fu->ep_in);
299
300 fu->flags |= USBG_BOT_WEDGED;
301 bot_enqueue_cmd_cbw(fu);
302 } else if (fu->flags & USBG_BOT_WEDGED) {
303 fu->flags &= ~USBG_BOT_WEDGED;
304 usb_ep_clear_halt(fu->ep_in);
305 }
306}
307
308static int bot_prepare_reqs(struct f_uas *fu)
309{
310 int ret;
311
312 fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
313 if (!fu->bot_req_in)
314 goto err;
315
316 fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
317 if (!fu->bot_req_out)
318 goto err_out;
319
320 fu->cmd[0].req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
321 if (!fu->cmd[0].req)
322 goto err_cmd;
323
324 fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
325 if (!fu->bot_status.req)
326 goto err_sts;
327
328 fu->bot_status.req->buf = &fu->bot_status.csw;
329 fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
330 fu->bot_status.req->complete = bot_status_complete;
331 fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
332
333 fu->cmd[0].buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
334 if (!fu->cmd[0].buf)
335 goto err_buf;
336
337 fu->cmd[0].req->complete = bot_cmd_complete;
338 fu->cmd[0].req->buf = fu->cmd[0].buf;
339 fu->cmd[0].req->length = fu->ep_out->maxpacket;
340 fu->cmd[0].req->context = fu;
341
342 ret = bot_enqueue_cmd_cbw(fu);
343 if (ret)
344 goto err_queue;
345 return 0;
346err_queue:
347 kfree(fu->cmd[0].buf);
348 fu->cmd[0].buf = NULL;
349err_buf:
350 usb_ep_free_request(fu->ep_in, fu->bot_status.req);
351err_sts:
352 usb_ep_free_request(fu->ep_out, fu->cmd[0].req);
353 fu->cmd[0].req = NULL;
354err_cmd:
355 usb_ep_free_request(fu->ep_out, fu->bot_req_out);
356 fu->bot_req_out = NULL;
357err_out:
358 usb_ep_free_request(fu->ep_in, fu->bot_req_in);
359 fu->bot_req_in = NULL;
360err:
361 pr_err("BOT: endpoint setup failed\n");
362 return -ENOMEM;
363}
364
365static void bot_cleanup_old_alt(struct f_uas *fu)
366{
367 if (!(fu->flags & USBG_ENABLED))
368 return;
369
370 usb_ep_disable(fu->ep_in);
371 usb_ep_disable(fu->ep_out);
372
373 if (!fu->bot_req_in)
374 return;
375
376 usb_ep_free_request(fu->ep_in, fu->bot_req_in);
377 usb_ep_free_request(fu->ep_out, fu->bot_req_out);
378 usb_ep_free_request(fu->ep_out, fu->cmd[0].req);
379 usb_ep_free_request(fu->ep_in, fu->bot_status.req);
380
381 kfree(fu->cmd[0].buf);
382
383 fu->bot_req_in = NULL;
384 fu->bot_req_out = NULL;
385 fu->cmd[0].req = NULL;
386 fu->bot_status.req = NULL;
387 fu->cmd[0].buf = NULL;
388}
389
390static void bot_set_alt(struct f_uas *fu)
391{
392 struct usb_function *f = &fu->function;
393 struct usb_gadget *gadget = f->config->cdev->gadget;
394 int ret;
395
396 fu->flags = USBG_IS_BOT;
397
398 config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_BBB);
399 ret = usb_ep_enable(fu->ep_in);
400 if (ret)
401 goto err_b_in;
402
403 config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_BBB);
404 ret = usb_ep_enable(fu->ep_out);
405 if (ret)
406 goto err_b_out;
407
408 ret = bot_prepare_reqs(fu);
409 if (ret)
410 goto err_wq;
411 fu->flags |= USBG_ENABLED;
412 pr_info("Using the BOT protocol\n");
413 return;
414err_wq:
415 usb_ep_disable(fu->ep_out);
416err_b_out:
417 usb_ep_disable(fu->ep_in);
418err_b_in:
419 fu->flags = USBG_IS_BOT;
420}
421
422static int usbg_bot_setup(struct usb_function *f,
423 const struct usb_ctrlrequest *ctrl)
424{
425 struct f_uas *fu = to_f_uas(f);
426 struct usb_composite_dev *cdev = f->config->cdev;
427 u16 w_value = le16_to_cpu(ctrl->wValue);
428 u16 w_length = le16_to_cpu(ctrl->wLength);
429 int luns;
430 u8 *ret_lun;
431
432 switch (ctrl->bRequest) {
433 case US_BULK_GET_MAX_LUN:
434 if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
435 USB_RECIP_INTERFACE))
436 return -ENOTSUPP;
437
438 if (w_length < 1)
439 return -EINVAL;
440 if (w_value != 0)
441 return -EINVAL;
442 luns = atomic_read(&fu->tpg->tpg_port_count);
443 if (!luns) {
444 pr_err("No LUNs configured?\n");
445 return -EINVAL;
446 }
447 luns--;
448 if (luns > US_BULK_MAX_LUN_LIMIT) {
449 pr_info_once("Limiting the number of luns to 16\n");
450 luns = US_BULK_MAX_LUN_LIMIT;
451 }
452 ret_lun = cdev->req->buf;
453 *ret_lun = luns;
454 cdev->req->length = 1;
455 return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
456
457 case US_BULK_RESET_REQUEST:
458 /* XXX maybe we should remove previous requests for IN + OUT */
459 if (fu->flags & USBG_BOT_WEDGED) {
460 fu->flags &= ~USBG_BOT_WEDGED;
461 usb_ep_clear_halt(fu->ep_in);
462 }
463
464 bot_enqueue_cmd_cbw(fu);
465 return 0;
466 }
467 return -ENOTSUPP;
468}
469
470/* Start uas.c code */
471
472static int tcm_to_uasp_response(enum tcm_tmrsp_table code)
473{
474 switch (code) {
475 case TMR_FUNCTION_FAILED:
476 return RC_TMF_FAILED;
477 case TMR_FUNCTION_COMPLETE:
478 case TMR_TASK_DOES_NOT_EXIST:
479 return RC_TMF_COMPLETE;
480 case TMR_LUN_DOES_NOT_EXIST:
481 return RC_INCORRECT_LUN;
482 case TMR_FUNCTION_REJECTED:
483 case TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED:
484 default:
485 return RC_TMF_NOT_SUPPORTED;
486 }
487}
488
489static unsigned char uasp_to_tcm_func(int code)
490{
491 switch (code) {
492 case TMF_ABORT_TASK:
493 return TMR_ABORT_TASK;
494 case TMF_ABORT_TASK_SET:
495 return TMR_ABORT_TASK_SET;
496 case TMF_CLEAR_TASK_SET:
497 return TMR_CLEAR_TASK_SET;
498 case TMF_LOGICAL_UNIT_RESET:
499 return TMR_LUN_RESET;
500 case TMF_CLEAR_ACA:
501 return TMR_CLEAR_ACA;
502 case TMF_I_T_NEXUS_RESET:
503 case TMF_QUERY_TASK:
504 case TMF_QUERY_TASK_SET:
505 case TMF_QUERY_ASYNC_EVENT:
506 default:
507 return TMR_UNKNOWN;
508 }
509}
510
511static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
512{
513 /* We have either all three allocated or none */
514 if (!stream->req_in)
515 return;
516
517 usb_ep_free_request(fu->ep_in, stream->req_in);
518 usb_ep_free_request(fu->ep_out, stream->req_out);
519 usb_ep_free_request(fu->ep_status, stream->req_status);
520
521 stream->req_in = NULL;
522 stream->req_out = NULL;
523 stream->req_status = NULL;
524}
525
526static void uasp_free_cmdreq(struct f_uas *fu)
527{
528 int i;
529
530 for (i = 0; i < USBG_NUM_CMDS; i++) {
531 usb_ep_free_request(fu->ep_cmd, fu->cmd[i].req);
532 kfree(fu->cmd[i].buf);
533 fu->cmd[i].req = NULL;
534 fu->cmd[i].buf = NULL;
535 }
536}
537
538static void uasp_cleanup_old_alt(struct f_uas *fu)
539{
540 int i;
541
542 if (!(fu->flags & USBG_ENABLED))
543 return;
544
545 usb_ep_disable(fu->ep_in);
546 usb_ep_disable(fu->ep_out);
547 usb_ep_disable(fu->ep_status);
548 usb_ep_disable(fu->ep_cmd);
549
550 for (i = 0; i < USBG_NUM_CMDS; i++)
551 uasp_cleanup_one_stream(fu, &fu->stream[i]);
552 uasp_free_cmdreq(fu);
553}
554
555static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
556
557static int uasp_prepare_r_request(struct usbg_cmd *cmd)
558{
559 struct se_cmd *se_cmd = &cmd->se_cmd;
560 struct f_uas *fu = cmd->fu;
561 struct usb_gadget *gadget = fuas_to_gadget(fu);
562 struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
563
564 if (!gadget->sg_supported) {
565 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
566 if (!cmd->data_buf)
567 return -ENOMEM;
568
569 sg_copy_to_buffer(se_cmd->t_data_sg,
570 se_cmd->t_data_nents,
571 cmd->data_buf,
572 se_cmd->data_length);
573
574 stream->req_in->buf = cmd->data_buf;
575 } else {
576 stream->req_in->buf = NULL;
577 stream->req_in->num_sgs = se_cmd->t_data_nents;
578 stream->req_in->sg = se_cmd->t_data_sg;
579 }
580
581 stream->req_in->is_last = 1;
582 stream->req_in->stream_id = cmd->tag;
583 stream->req_in->complete = uasp_status_data_cmpl;
584 stream->req_in->length = se_cmd->data_length;
585 stream->req_in->context = cmd;
586
587 cmd->state = UASP_SEND_STATUS;
588 return 0;
589}
590
591static void uasp_prepare_status(struct usbg_cmd *cmd)
592{
593 struct se_cmd *se_cmd = &cmd->se_cmd;
594 struct sense_iu *iu = &cmd->sense_iu;
595 struct uas_stream *stream = &cmd->fu->stream[se_cmd->map_tag];
596
597 cmd->state = UASP_QUEUE_COMMAND;
598 iu->iu_id = IU_ID_STATUS;
599 iu->tag = cpu_to_be16(cmd->tag);
600
601 /*
602 * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
603 */
604 iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
605 iu->status = se_cmd->scsi_status;
606 stream->req_status->is_last = 1;
607 stream->req_status->stream_id = cmd->tag;
608 stream->req_status->context = cmd;
609 stream->req_status->length = se_cmd->scsi_sense_length + 16;
610 stream->req_status->buf = iu;
611 stream->req_status->complete = uasp_status_data_cmpl;
612}
613
614static void uasp_prepare_response(struct usbg_cmd *cmd)
615{
616 struct se_cmd *se_cmd = &cmd->se_cmd;
617 struct response_iu *rsp_iu = &cmd->response_iu;
618 struct uas_stream *stream = &cmd->fu->stream[se_cmd->map_tag];
619
620 cmd->state = UASP_QUEUE_COMMAND;
621 rsp_iu->iu_id = IU_ID_RESPONSE;
622 rsp_iu->tag = cpu_to_be16(cmd->tag);
623
624 if (cmd->tmr_rsp != RC_RESPONSE_UNKNOWN)
625 rsp_iu->response_code = cmd->tmr_rsp;
626 else
627 rsp_iu->response_code =
628 tcm_to_uasp_response(se_cmd->se_tmr_req->response);
629
630 /*
631 * The UASP driver must support all the task management functions listed
632 * in Table 20 of UAS-r04. To remain compliant while indicate that the
633 * TMR did not go through, report RC_TMF_FAILED instead of
634 * RC_TMF_NOT_SUPPORTED and print a warning to the user.
635 */
636 switch (cmd->tmr_func) {
637 case TMF_ABORT_TASK:
638 case TMF_ABORT_TASK_SET:
639 case TMF_CLEAR_TASK_SET:
640 case TMF_LOGICAL_UNIT_RESET:
641 case TMF_CLEAR_ACA:
642 case TMF_I_T_NEXUS_RESET:
643 case TMF_QUERY_TASK:
644 case TMF_QUERY_TASK_SET:
645 case TMF_QUERY_ASYNC_EVENT:
646 if (rsp_iu->response_code == RC_TMF_NOT_SUPPORTED) {
647 struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
648
649 dev_warn(&gadget->dev, "TMF function %d not supported\n",
650 cmd->tmr_func);
651 rsp_iu->response_code = RC_TMF_FAILED;
652 }
653 break;
654 default:
655 break;
656 }
657
658 stream->req_status->is_last = 1;
659 stream->req_status->stream_id = cmd->tag;
660 stream->req_status->context = cmd;
661 stream->req_status->length = sizeof(struct response_iu);
662 stream->req_status->buf = rsp_iu;
663 stream->req_status->complete = uasp_status_data_cmpl;
664}
665
666static void usbg_release_cmd(struct se_cmd *se_cmd);
667static int uasp_send_tm_response(struct usbg_cmd *cmd);
668
669static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
670{
671 struct usbg_cmd *cmd = req->context;
672 struct f_uas *fu = cmd->fu;
673 struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
674 int ret;
675
676 if (req->status == -ESHUTDOWN)
677 goto cleanup;
678
679 switch (cmd->state) {
680 case UASP_SEND_DATA:
681 ret = uasp_prepare_r_request(cmd);
682 if (ret)
683 goto cleanup;
684 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
685 if (ret)
686 pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
687 break;
688
689 case UASP_RECEIVE_DATA:
690 ret = usbg_prepare_w_request(cmd, stream->req_out);
691 if (ret)
692 goto cleanup;
693 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
694 if (ret)
695 pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
696 break;
697
698 case UASP_SEND_STATUS:
699 uasp_prepare_status(cmd);
700 ret = usb_ep_queue(fu->ep_status, stream->req_status,
701 GFP_ATOMIC);
702 if (ret)
703 pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
704 break;
705
706 case UASP_QUEUE_COMMAND:
707 /*
708 * Overlapped command detected and cancelled.
709 * So send overlapped attempted status.
710 */
711 if (cmd->tmr_rsp == RC_OVERLAPPED_TAG &&
712 req->status == -ECONNRESET) {
713 uasp_send_tm_response(cmd);
714 return;
715 }
716
717 hash_del(&stream->node);
718
719 /*
720 * If no command submitted to target core here, just free the
721 * bitmap index. This is for the cases where f_tcm handles
722 * status response instead of the target core.
723 */
724 if (cmd->tmr_rsp != RC_OVERLAPPED_TAG &&
725 cmd->tmr_rsp != RC_RESPONSE_UNKNOWN) {
726 struct se_session *se_sess;
727
728 se_sess = fu->tpg->tpg_nexus->tvn_se_sess;
729 sbitmap_queue_clear(&se_sess->sess_tag_pool,
730 cmd->se_cmd.map_tag,
731 cmd->se_cmd.map_cpu);
732 } else {
733 transport_generic_free_cmd(&cmd->se_cmd, 0);
734 }
735
736 usb_ep_queue(fu->ep_cmd, cmd->req, GFP_ATOMIC);
737 complete(&stream->cmd_completion);
738 break;
739
740 default:
741 BUG();
742 }
743 return;
744
745cleanup:
746 hash_del(&stream->node);
747 transport_generic_free_cmd(&cmd->se_cmd, 0);
748}
749
750static int uasp_send_status_response(struct usbg_cmd *cmd)
751{
752 struct f_uas *fu = cmd->fu;
753 struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
754 struct sense_iu *iu = &cmd->sense_iu;
755
756 iu->tag = cpu_to_be16(cmd->tag);
757 cmd->fu = fu;
758 uasp_prepare_status(cmd);
759 return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
760}
761
762static int uasp_send_tm_response(struct usbg_cmd *cmd)
763{
764 struct f_uas *fu = cmd->fu;
765 struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
766 struct response_iu *iu = &cmd->response_iu;
767
768 iu->tag = cpu_to_be16(cmd->tag);
769 cmd->fu = fu;
770 uasp_prepare_response(cmd);
771 return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
772}
773
774static int uasp_send_read_response(struct usbg_cmd *cmd)
775{
776 struct f_uas *fu = cmd->fu;
777 struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
778 struct sense_iu *iu = &cmd->sense_iu;
779 int ret;
780
781 cmd->fu = fu;
782
783 iu->tag = cpu_to_be16(cmd->tag);
784 if (fu->flags & USBG_USE_STREAMS) {
785
786 ret = uasp_prepare_r_request(cmd);
787 if (ret)
788 goto out;
789 ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
790 if (ret) {
791 pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
792 kfree(cmd->data_buf);
793 cmd->data_buf = NULL;
794 }
795
796 } else {
797
798 iu->iu_id = IU_ID_READ_READY;
799 iu->tag = cpu_to_be16(cmd->tag);
800
801 stream->req_status->complete = uasp_status_data_cmpl;
802 stream->req_status->context = cmd;
803
804 cmd->state = UASP_SEND_DATA;
805 stream->req_status->buf = iu;
806 stream->req_status->length = sizeof(struct iu);
807
808 ret = usb_ep_queue(fu->ep_status, stream->req_status,
809 GFP_ATOMIC);
810 if (ret)
811 pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
812 }
813out:
814 return ret;
815}
816
817static int uasp_send_write_request(struct usbg_cmd *cmd)
818{
819 struct f_uas *fu = cmd->fu;
820 struct se_cmd *se_cmd = &cmd->se_cmd;
821 struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
822 struct sense_iu *iu = &cmd->sense_iu;
823 int ret;
824
825 cmd->fu = fu;
826
827 iu->tag = cpu_to_be16(cmd->tag);
828
829 if (fu->flags & USBG_USE_STREAMS) {
830
831 ret = usbg_prepare_w_request(cmd, stream->req_out);
832 if (ret)
833 goto cleanup;
834 ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
835 if (ret)
836 pr_err("%s(%d)\n", __func__, __LINE__);
837
838 } else {
839
840 iu->iu_id = IU_ID_WRITE_READY;
841 iu->tag = cpu_to_be16(cmd->tag);
842
843 stream->req_status->complete = uasp_status_data_cmpl;
844 stream->req_status->context = cmd;
845
846 cmd->state = UASP_RECEIVE_DATA;
847 stream->req_status->buf = iu;
848 stream->req_status->length = sizeof(struct iu);
849
850 ret = usb_ep_queue(fu->ep_status, stream->req_status,
851 GFP_ATOMIC);
852 if (ret)
853 pr_err("%s(%d)\n", __func__, __LINE__);
854 }
855
856cleanup:
857 return ret;
858}
859
860static int usbg_submit_command(struct f_uas *, struct usb_request *);
861
862static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
863{
864 struct f_uas *fu = req->context;
865
866 if (req->status == -ESHUTDOWN)
867 return;
868
869 if (req->status < 0) {
870 usb_ep_queue(fu->ep_cmd, req, GFP_ATOMIC);
871 return;
872 }
873
874 usbg_submit_command(fu, req);
875}
876
877static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
878{
879 init_completion(&stream->cmd_completion);
880
881 stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
882 if (!stream->req_in)
883 goto out;
884
885 stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
886 if (!stream->req_out)
887 goto err_out;
888
889 stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
890 if (!stream->req_status)
891 goto err_sts;
892
893 return 0;
894
895err_sts:
896 usb_ep_free_request(fu->ep_out, stream->req_out);
897 stream->req_out = NULL;
898err_out:
899 usb_ep_free_request(fu->ep_in, stream->req_in);
900 stream->req_in = NULL;
901out:
902 return -ENOMEM;
903}
904
905static int uasp_alloc_cmd(struct f_uas *fu, int i)
906{
907 fu->cmd[i].req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
908 if (!fu->cmd[i].req)
909 goto err;
910
911 fu->cmd[i].buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
912 if (!fu->cmd[i].buf)
913 goto err_buf;
914
915 fu->cmd[i].req->complete = uasp_cmd_complete;
916 fu->cmd[i].req->buf = fu->cmd[i].buf;
917 fu->cmd[i].req->length = fu->ep_cmd->maxpacket;
918 fu->cmd[i].req->context = fu;
919 return 0;
920
921err_buf:
922 usb_ep_free_request(fu->ep_cmd, fu->cmd[i].req);
923err:
924 return -ENOMEM;
925}
926
927static int uasp_prepare_reqs(struct f_uas *fu)
928{
929 int ret;
930 int i;
931
932 for (i = 0; i < USBG_NUM_CMDS; i++) {
933 ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
934 if (ret)
935 goto err_cleanup;
936 }
937
938 for (i = 0; i < USBG_NUM_CMDS; i++) {
939 ret = uasp_alloc_cmd(fu, i);
940 if (ret)
941 goto err_free_stream;
942
943 ret = usb_ep_queue(fu->ep_cmd, fu->cmd[i].req, GFP_ATOMIC);
944 if (ret)
945 goto err_free_stream;
946 }
947
948 return 0;
949
950err_free_stream:
951 uasp_free_cmdreq(fu);
952
953err_cleanup:
954 if (i) {
955 do {
956 uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
957 i--;
958 } while (i);
959 }
960 pr_err("UASP: endpoint setup failed\n");
961 return ret;
962}
963
964static void uasp_set_alt(struct f_uas *fu)
965{
966 struct usb_function *f = &fu->function;
967 struct usb_gadget *gadget = f->config->cdev->gadget;
968 int ret;
969
970 fu->flags = USBG_IS_UAS;
971
972 if (gadget->speed >= USB_SPEED_SUPER)
973 fu->flags |= USBG_USE_STREAMS;
974
975 config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_UAS);
976 ret = usb_ep_enable(fu->ep_in);
977 if (ret)
978 goto err_b_in;
979
980 config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_UAS);
981 ret = usb_ep_enable(fu->ep_out);
982 if (ret)
983 goto err_b_out;
984
985 config_ep_by_speed_and_alt(gadget, f, fu->ep_cmd, USB_G_ALT_INT_UAS);
986 ret = usb_ep_enable(fu->ep_cmd);
987 if (ret)
988 goto err_cmd;
989 config_ep_by_speed_and_alt(gadget, f, fu->ep_status, USB_G_ALT_INT_UAS);
990 ret = usb_ep_enable(fu->ep_status);
991 if (ret)
992 goto err_status;
993
994 ret = uasp_prepare_reqs(fu);
995 if (ret)
996 goto err_wq;
997 fu->flags |= USBG_ENABLED;
998
999 pr_info("Using the UAS protocol\n");
1000 return;
1001err_wq:
1002 usb_ep_disable(fu->ep_status);
1003err_status:
1004 usb_ep_disable(fu->ep_cmd);
1005err_cmd:
1006 usb_ep_disable(fu->ep_out);
1007err_b_out:
1008 usb_ep_disable(fu->ep_in);
1009err_b_in:
1010 fu->flags = 0;
1011}
1012
1013static int get_cmd_dir(const unsigned char *cdb)
1014{
1015 int ret;
1016
1017 switch (cdb[0]) {
1018 case READ_6:
1019 case READ_10:
1020 case READ_12:
1021 case READ_16:
1022 case INQUIRY:
1023 case MODE_SENSE:
1024 case MODE_SENSE_10:
1025 case SERVICE_ACTION_IN_16:
1026 case MAINTENANCE_IN:
1027 case PERSISTENT_RESERVE_IN:
1028 case SECURITY_PROTOCOL_IN:
1029 case ACCESS_CONTROL_IN:
1030 case REPORT_LUNS:
1031 case READ_BLOCK_LIMITS:
1032 case READ_POSITION:
1033 case READ_CAPACITY:
1034 case READ_TOC:
1035 case READ_FORMAT_CAPACITIES:
1036 case REQUEST_SENSE:
1037 case ATA_12:
1038 case ATA_16:
1039 ret = DMA_FROM_DEVICE;
1040 break;
1041
1042 case WRITE_6:
1043 case WRITE_10:
1044 case WRITE_12:
1045 case WRITE_16:
1046 case MODE_SELECT:
1047 case MODE_SELECT_10:
1048 case WRITE_VERIFY:
1049 case WRITE_VERIFY_12:
1050 case PERSISTENT_RESERVE_OUT:
1051 case MAINTENANCE_OUT:
1052 case SECURITY_PROTOCOL_OUT:
1053 case ACCESS_CONTROL_OUT:
1054 ret = DMA_TO_DEVICE;
1055 break;
1056 case ALLOW_MEDIUM_REMOVAL:
1057 case TEST_UNIT_READY:
1058 case SYNCHRONIZE_CACHE:
1059 case START_STOP:
1060 case ERASE:
1061 case REZERO_UNIT:
1062 case SEEK_10:
1063 case SPACE:
1064 case VERIFY:
1065 case WRITE_FILEMARKS:
1066 ret = DMA_NONE;
1067 break;
1068 default:
1069#define CMD_DIR_MSG "target: Unknown data direction for SCSI Opcode 0x%02x\n"
1070 pr_warn(CMD_DIR_MSG, cdb[0]);
1071#undef CMD_DIR_MSG
1072 ret = -EINVAL;
1073 }
1074 return ret;
1075}
1076
1077static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
1078{
1079 struct usbg_cmd *cmd = req->context;
1080 struct se_cmd *se_cmd = &cmd->se_cmd;
1081
1082 cmd->state = UASP_QUEUE_COMMAND;
1083
1084 if (req->status == -ESHUTDOWN) {
1085 struct uas_stream *stream = &cmd->fu->stream[se_cmd->map_tag];
1086
1087 hash_del(&stream->node);
1088 target_put_sess_cmd(se_cmd);
1089 transport_generic_free_cmd(&cmd->se_cmd, 0);
1090 return;
1091 }
1092
1093 if (req->status) {
1094 pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
1095 goto cleanup;
1096 }
1097
1098 if (req->num_sgs == 0) {
1099 sg_copy_from_buffer(se_cmd->t_data_sg,
1100 se_cmd->t_data_nents,
1101 cmd->data_buf,
1102 se_cmd->data_length);
1103 }
1104
1105 cmd->flags |= USBG_CMD_PENDING_DATA_WRITE;
1106 queue_work(cmd->fu->tpg->workqueue, &cmd->work);
1107 return;
1108
1109cleanup:
1110 target_put_sess_cmd(se_cmd);
1111
1112 /* Command was aborted due to overlapped tag */
1113 if (cmd->state == UASP_QUEUE_COMMAND &&
1114 cmd->tmr_rsp == RC_OVERLAPPED_TAG) {
1115 uasp_send_tm_response(cmd);
1116 return;
1117 }
1118
1119 transport_send_check_condition_and_sense(se_cmd,
1120 TCM_CHECK_CONDITION_ABORT_CMD, 0);
1121}
1122
1123static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
1124{
1125 struct se_cmd *se_cmd = &cmd->se_cmd;
1126 struct f_uas *fu = cmd->fu;
1127 struct usb_gadget *gadget = fuas_to_gadget(fu);
1128
1129 if (!gadget->sg_supported) {
1130 cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
1131 if (!cmd->data_buf)
1132 return -ENOMEM;
1133
1134 req->buf = cmd->data_buf;
1135 } else {
1136 req->buf = NULL;
1137 req->num_sgs = se_cmd->t_data_nents;
1138 req->sg = se_cmd->t_data_sg;
1139 }
1140
1141 req->is_last = 1;
1142 req->stream_id = cmd->tag;
1143 req->complete = usbg_data_write_cmpl;
1144 req->length = se_cmd->data_length;
1145 req->context = cmd;
1146
1147 cmd->state = UASP_SEND_STATUS;
1148 return 0;
1149}
1150
1151static int usbg_send_status_response(struct se_cmd *se_cmd)
1152{
1153 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1154 se_cmd);
1155 struct f_uas *fu = cmd->fu;
1156
1157 if (fu->flags & USBG_IS_BOT)
1158 return bot_send_status_response(cmd);
1159 else
1160 return uasp_send_status_response(cmd);
1161}
1162
1163static int usbg_send_write_request(struct se_cmd *se_cmd)
1164{
1165 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1166 se_cmd);
1167 struct f_uas *fu = cmd->fu;
1168
1169 if (fu->flags & USBG_IS_BOT)
1170 return bot_send_write_request(cmd);
1171 else
1172 return uasp_send_write_request(cmd);
1173}
1174
1175static int usbg_send_read_response(struct se_cmd *se_cmd)
1176{
1177 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1178 se_cmd);
1179 struct f_uas *fu = cmd->fu;
1180
1181 if (fu->flags & USBG_IS_BOT)
1182 return bot_send_read_response(cmd);
1183 else
1184 return uasp_send_read_response(cmd);
1185}
1186
1187static void usbg_aborted_task(struct se_cmd *se_cmd);
1188
1189static void usbg_submit_tmr(struct usbg_cmd *cmd)
1190{
1191 struct se_session *se_sess;
1192 struct se_cmd *se_cmd;
1193 int flags = TARGET_SCF_ACK_KREF;
1194
1195 se_cmd = &cmd->se_cmd;
1196 se_sess = cmd->fu->tpg->tpg_nexus->tvn_se_sess;
1197
1198 target_submit_tmr(se_cmd, se_sess,
1199 cmd->response_iu.add_response_info,
1200 cmd->unpacked_lun, NULL, uasp_to_tcm_func(cmd->tmr_func),
1201 GFP_ATOMIC, cmd->tag, flags);
1202}
1203
1204static void usbg_submit_cmd(struct usbg_cmd *cmd)
1205{
1206 struct se_cmd *se_cmd;
1207 struct tcm_usbg_nexus *tv_nexus;
1208 struct usbg_tpg *tpg;
1209 int dir, flags = (TARGET_SCF_UNKNOWN_SIZE | TARGET_SCF_ACK_KREF);
1210
1211 /*
1212 * Note: each command will spawn its own process, and each stage of the
1213 * command is processed sequentially. Should this no longer be the case,
1214 * locking is needed.
1215 */
1216 if (cmd->flags & USBG_CMD_PENDING_DATA_WRITE) {
1217 target_execute_cmd(&cmd->se_cmd);
1218 cmd->flags &= ~USBG_CMD_PENDING_DATA_WRITE;
1219 return;
1220 }
1221
1222 se_cmd = &cmd->se_cmd;
1223 tpg = cmd->fu->tpg;
1224 tv_nexus = tpg->tpg_nexus;
1225 if (!tv_nexus) {
1226 struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
1227
1228 dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
1229 return;
1230 }
1231
1232 dir = get_cmd_dir(cmd->cmd_buf);
1233 if (dir < 0)
1234 goto out;
1235
1236 target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess, cmd->cmd_buf,
1237 cmd->sense_iu.sense, cmd->unpacked_lun, cmd->data_len,
1238 cmd->prio_attr, dir, flags);
1239
1240 return;
1241
1242out:
1243 __target_init_cmd(se_cmd,
1244 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1245 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1246 cmd->prio_attr, cmd->sense_iu.sense,
1247 cmd->unpacked_lun, NULL);
1248 transport_send_check_condition_and_sense(se_cmd,
1249 TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1250}
1251
1252static void usbg_cmd_work(struct work_struct *work)
1253{
1254 struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1255
1256 /*
1257 * Failure is detected by f_tcm here. Skip submitting the command to the
1258 * target core if we already know the failing response and send the usb
1259 * response to the host directly.
1260 */
1261 if (cmd->tmr_rsp != RC_RESPONSE_UNKNOWN)
1262 goto skip;
1263
1264 if (cmd->tmr_func)
1265 usbg_submit_tmr(cmd);
1266 else
1267 usbg_submit_cmd(cmd);
1268
1269 return;
1270
1271skip:
1272 if (cmd->tmr_rsp == RC_OVERLAPPED_TAG) {
1273 struct f_uas *fu = cmd->fu;
1274 struct se_session *se_sess;
1275 struct uas_stream *stream = NULL;
1276 struct hlist_node *tmp;
1277 struct usbg_cmd *active_cmd = NULL;
1278
1279 se_sess = cmd->fu->tpg->tpg_nexus->tvn_se_sess;
1280
1281 hash_for_each_possible_safe(fu->stream_hash, stream, tmp, node, cmd->tag) {
1282 int i = stream - &fu->stream[0];
1283
1284 active_cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[i];
1285 if (active_cmd->tag == cmd->tag)
1286 break;
1287 }
1288
1289 /* Sanity check */
1290 if (!stream || (active_cmd && active_cmd->tag != cmd->tag)) {
1291 usbg_submit_command(cmd->fu, cmd->req);
1292 return;
1293 }
1294
1295 reinit_completion(&stream->cmd_completion);
1296
1297 /*
1298 * A UASP command consists of the command, data, and status
1299 * stages, each operating sequentially from different endpoints.
1300 *
1301 * Each USB endpoint operates independently, and depending on
1302 * hardware implementation, a completion callback for a transfer
1303 * from one endpoint may not reflect the order of completion on
1304 * the wire. This is particularly true for devices with
1305 * endpoints that have independent interrupts and event buffers.
1306 *
1307 * The driver must still detect misbehaving hosts and respond
1308 * with an overlap status. To reduce false overlap failures,
1309 * allow the active and matching stream ID a brief 1ms to
1310 * complete before responding with an overlap command failure.
1311 * Overlap failure should be rare.
1312 */
1313 wait_for_completion_timeout(&stream->cmd_completion, msecs_to_jiffies(1));
1314
1315 /* If the previous stream is completed, retry the command. */
1316 if (!hash_hashed(&stream->node)) {
1317 usbg_submit_command(cmd->fu, cmd->req);
1318 return;
1319 }
1320
1321 /*
1322 * The command isn't submitted to the target core, so we're safe
1323 * to remove the bitmap index from the session tag pool.
1324 */
1325 sbitmap_queue_clear(&se_sess->sess_tag_pool,
1326 cmd->se_cmd.map_tag,
1327 cmd->se_cmd.map_cpu);
1328
1329 /*
1330 * Overlap command tag detected. Cancel any pending transfer of
1331 * the command submitted to target core.
1332 */
1333 active_cmd->tmr_rsp = RC_OVERLAPPED_TAG;
1334 usbg_aborted_task(&active_cmd->se_cmd);
1335
1336 /* Send the response after the transfer is aborted. */
1337 return;
1338 }
1339
1340 uasp_send_tm_response(cmd);
1341}
1342
1343static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
1344 struct tcm_usbg_nexus *tv_nexus, u32 scsi_tag)
1345{
1346 struct se_session *se_sess = tv_nexus->tvn_se_sess;
1347 struct usbg_cmd *cmd;
1348 int tag, cpu;
1349
1350 tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
1351 if (tag < 0)
1352 return ERR_PTR(-ENOMEM);
1353
1354 cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[tag];
1355 memset(cmd, 0, sizeof(*cmd));
1356 cmd->se_cmd.map_tag = tag;
1357 cmd->se_cmd.map_cpu = cpu;
1358 cmd->se_cmd.cpuid = cpu;
1359 cmd->se_cmd.tag = cmd->tag = scsi_tag;
1360 cmd->fu = fu;
1361
1362 return cmd;
1363}
1364
1365static void usbg_release_cmd(struct se_cmd *);
1366
1367static int usbg_submit_command(struct f_uas *fu, struct usb_request *req)
1368{
1369 struct iu *iu = req->buf;
1370 struct usbg_cmd *cmd;
1371 struct usbg_tpg *tpg = fu->tpg;
1372 struct tcm_usbg_nexus *tv_nexus;
1373 struct uas_stream *stream;
1374 struct hlist_node *tmp;
1375 struct command_iu *cmd_iu;
1376 u32 cmd_len;
1377 u16 scsi_tag;
1378
1379 tv_nexus = tpg->tpg_nexus;
1380 if (!tv_nexus) {
1381 pr_err("Missing nexus, ignoring command\n");
1382 return -EINVAL;
1383 }
1384
1385 scsi_tag = be16_to_cpup(&iu->tag);
1386 cmd = usbg_get_cmd(fu, tv_nexus, scsi_tag);
1387 if (IS_ERR(cmd)) {
1388 pr_err("usbg_get_cmd failed\n");
1389 return -ENOMEM;
1390 }
1391
1392 cmd->req = req;
1393 cmd->fu = fu;
1394 cmd->tag = scsi_tag;
1395 cmd->se_cmd.tag = scsi_tag;
1396 cmd->tmr_func = 0;
1397 cmd->tmr_rsp = RC_RESPONSE_UNKNOWN;
1398 cmd->flags = 0;
1399 cmd->data_len = 0;
1400
1401 cmd_iu = (struct command_iu *)iu;
1402
1403 /* Command and Task Management IUs share the same LUN offset */
1404 cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1405
1406 if (iu->iu_id != IU_ID_COMMAND && iu->iu_id != IU_ID_TASK_MGMT) {
1407 cmd->tmr_rsp = RC_INVALID_INFO_UNIT;
1408 goto skip;
1409 }
1410
1411 hash_for_each_possible_safe(fu->stream_hash, stream, tmp, node, scsi_tag) {
1412 struct usbg_cmd *active_cmd;
1413 struct se_session *se_sess;
1414 int i = stream - &fu->stream[0];
1415
1416 se_sess = cmd->fu->tpg->tpg_nexus->tvn_se_sess;
1417 active_cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[i];
1418
1419 if (active_cmd->tag == scsi_tag) {
1420 cmd->tmr_rsp = RC_OVERLAPPED_TAG;
1421 goto skip;
1422 }
1423 }
1424
1425 stream = &fu->stream[cmd->se_cmd.map_tag];
1426 hash_add(fu->stream_hash, &stream->node, scsi_tag);
1427
1428 if (iu->iu_id == IU_ID_TASK_MGMT) {
1429 struct task_mgmt_iu *tm_iu;
1430
1431 tm_iu = (struct task_mgmt_iu *)iu;
1432 cmd->tmr_func = tm_iu->function;
1433 goto skip;
1434 }
1435
1436 cmd_len = (cmd_iu->len & ~0x3) + 16;
1437 if (cmd_len > USBG_MAX_CMD) {
1438 target_free_tag(tv_nexus->tvn_se_sess, &cmd->se_cmd);
1439 hash_del(&stream->node);
1440 return -EINVAL;
1441 }
1442 memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1443
1444 switch (cmd_iu->prio_attr & 0x7) {
1445 case UAS_HEAD_TAG:
1446 cmd->prio_attr = TCM_HEAD_TAG;
1447 break;
1448 case UAS_ORDERED_TAG:
1449 cmd->prio_attr = TCM_ORDERED_TAG;
1450 break;
1451 case UAS_ACA:
1452 cmd->prio_attr = TCM_ACA_TAG;
1453 break;
1454 default:
1455 pr_debug_once("Unsupported prio_attr: %02x.\n",
1456 cmd_iu->prio_attr);
1457 fallthrough;
1458 case UAS_SIMPLE_TAG:
1459 cmd->prio_attr = TCM_SIMPLE_TAG;
1460 break;
1461 }
1462
1463skip:
1464 INIT_WORK(&cmd->work, usbg_cmd_work);
1465 queue_work(tpg->workqueue, &cmd->work);
1466
1467 return 0;
1468}
1469
1470static void bot_cmd_work(struct work_struct *work)
1471{
1472 struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1473 struct se_cmd *se_cmd;
1474 struct tcm_usbg_nexus *tv_nexus;
1475 struct usbg_tpg *tpg;
1476 int flags = TARGET_SCF_ACK_KREF;
1477 int dir;
1478
1479 /*
1480 * Note: each command will spawn its own process, and each stage of the
1481 * command is processed sequentially. Should this no longer be the case,
1482 * locking is needed.
1483 */
1484 if (cmd->flags & USBG_CMD_PENDING_DATA_WRITE) {
1485 target_execute_cmd(&cmd->se_cmd);
1486 cmd->flags &= ~USBG_CMD_PENDING_DATA_WRITE;
1487 return;
1488 }
1489
1490 se_cmd = &cmd->se_cmd;
1491 tpg = cmd->fu->tpg;
1492 tv_nexus = tpg->tpg_nexus;
1493 if (!tv_nexus) {
1494 struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
1495
1496 dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
1497 return;
1498 }
1499
1500 dir = get_cmd_dir(cmd->cmd_buf);
1501 if (dir < 0)
1502 goto out;
1503
1504 target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1505 cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1506 cmd->data_len, cmd->prio_attr, dir, flags);
1507 return;
1508
1509out:
1510 __target_init_cmd(se_cmd,
1511 tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1512 tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1513 cmd->prio_attr, cmd->sense_iu.sense,
1514 cmd->unpacked_lun, NULL);
1515 transport_send_check_condition_and_sense(se_cmd,
1516 TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1517}
1518
1519static int bot_submit_command(struct f_uas *fu,
1520 void *cmdbuf, unsigned int len)
1521{
1522 struct bulk_cb_wrap *cbw = cmdbuf;
1523 struct usbg_cmd *cmd;
1524 struct usbg_tpg *tpg = fu->tpg;
1525 struct tcm_usbg_nexus *tv_nexus;
1526 u32 cmd_len;
1527
1528 if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1529 pr_err("Wrong signature on CBW\n");
1530 return -EINVAL;
1531 }
1532 if (len != 31) {
1533 pr_err("Wrong length for CBW\n");
1534 return -EINVAL;
1535 }
1536
1537 cmd_len = cbw->Length;
1538 if (cmd_len < 1 || cmd_len > 16)
1539 return -EINVAL;
1540
1541 tv_nexus = tpg->tpg_nexus;
1542 if (!tv_nexus) {
1543 pr_err("Missing nexus, ignoring command\n");
1544 return -ENODEV;
1545 }
1546
1547 cmd = usbg_get_cmd(fu, tv_nexus, cbw->Tag);
1548 if (IS_ERR(cmd)) {
1549 pr_err("usbg_get_cmd failed\n");
1550 return -ENOMEM;
1551 }
1552 memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1553
1554 cmd->bot_tag = cbw->Tag;
1555 cmd->prio_attr = TCM_SIMPLE_TAG;
1556 cmd->unpacked_lun = cbw->Lun;
1557 cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1558 cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1559 cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1560 cmd->flags = 0;
1561
1562 INIT_WORK(&cmd->work, bot_cmd_work);
1563 queue_work(tpg->workqueue, &cmd->work);
1564
1565 return 0;
1566}
1567
1568/* Start fabric.c code */
1569
1570static int usbg_check_true(struct se_portal_group *se_tpg)
1571{
1572 return 1;
1573}
1574
1575static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1576{
1577 struct usbg_tpg *tpg = container_of(se_tpg,
1578 struct usbg_tpg, se_tpg);
1579 struct usbg_tport *tport = tpg->tport;
1580
1581 return &tport->tport_name[0];
1582}
1583
1584static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1585{
1586 struct usbg_tpg *tpg = container_of(se_tpg,
1587 struct usbg_tpg, se_tpg);
1588 return tpg->tport_tpgt;
1589}
1590
1591static void usbg_release_cmd(struct se_cmd *se_cmd)
1592{
1593 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1594 se_cmd);
1595 struct se_session *se_sess = se_cmd->se_sess;
1596
1597 cmd->tag = 0;
1598 kfree(cmd->data_buf);
1599 target_free_tag(se_sess, se_cmd);
1600}
1601
1602static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1603{
1604 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd, se_cmd);
1605
1606 uasp_send_tm_response(cmd);
1607}
1608
1609static void usbg_aborted_task(struct se_cmd *se_cmd)
1610{
1611 struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd, se_cmd);
1612 struct f_uas *fu = cmd->fu;
1613 struct usb_gadget *gadget = fuas_to_gadget(fu);
1614 struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
1615 int ret = 0;
1616
1617 if (stream->req_out->status == -EINPROGRESS)
1618 ret = usb_ep_dequeue(fu->ep_out, stream->req_out);
1619 else if (stream->req_in->status == -EINPROGRESS)
1620 ret = usb_ep_dequeue(fu->ep_in, stream->req_in);
1621 else if (stream->req_status->status == -EINPROGRESS)
1622 ret = usb_ep_dequeue(fu->ep_status, stream->req_status);
1623
1624 if (ret)
1625 dev_err(&gadget->dev, "Failed to abort cmd tag %d, (%d)\n",
1626 cmd->tag, ret);
1627
1628 cmd->state = UASP_QUEUE_COMMAND;
1629}
1630
1631static const char *usbg_check_wwn(const char *name)
1632{
1633 const char *n;
1634 unsigned int len;
1635
1636 n = strstr(name, "naa.");
1637 if (!n)
1638 return NULL;
1639 n += 4;
1640 len = strlen(n);
1641 if (len == 0 || len > USBG_NAMELEN - 1)
1642 return NULL;
1643 return n;
1644}
1645
1646static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1647{
1648 if (!usbg_check_wwn(name))
1649 return -EINVAL;
1650 return 0;
1651}
1652
1653static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
1654 const char *name)
1655{
1656 struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1657 tport_wwn);
1658 struct usbg_tpg *tpg;
1659 u16 tpgt;
1660 int ret;
1661 struct f_tcm_opts *opts;
1662 unsigned i;
1663
1664 if (strstr(name, "tpgt_") != name)
1665 return ERR_PTR(-EINVAL);
1666 if (kstrtou16(name + 5, 0, &tpgt))
1667 return ERR_PTR(-EINVAL);
1668 ret = -ENODEV;
1669 mutex_lock(&tpg_instances_lock);
1670 for (i = 0; i < TPG_INSTANCES; ++i)
1671 if (tpg_instances[i].func_inst && !tpg_instances[i].tpg)
1672 break;
1673 if (i == TPG_INSTANCES)
1674 goto unlock_inst;
1675
1676 opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
1677 func_inst);
1678 if (!READ_ONCE(opts->ready))
1679 goto unlock_inst;
1680
1681 if (opts->has_dep) {
1682 if (!try_module_get(opts->dependent))
1683 goto unlock_inst;
1684 } else {
1685 /*
1686 * configfs_depend_item_unlocked() may acquire the configfs
1687 * root inode lock when the target belongs to a different
1688 * subsystem. Calling it under dep_lock would create a
1689 * circular dependency:
1690 * dep_lock -> configfs inode lock -> su_mutex -> dep_lock
1691 */
1692 ret = configfs_depend_item_unlocked(
1693 wwn->wwn_group.cg_subsys,
1694 &opts->func_inst.group.cg_item);
1695 if (ret)
1696 goto unlock_inst;
1697 }
1698
1699 tpg = kzalloc_obj(struct usbg_tpg);
1700 ret = -ENOMEM;
1701 if (!tpg)
1702 goto unref_dep;
1703 mutex_init(&tpg->tpg_mutex);
1704 atomic_set(&tpg->tpg_port_count, 0);
1705 tpg->workqueue = alloc_workqueue("tcm_usb_gadget",
1706 WQ_UNBOUND, WQ_UNBOUND_MAX_ACTIVE);
1707 if (!tpg->workqueue)
1708 goto free_tpg;
1709
1710 tpg->tport = tport;
1711 tpg->tport_tpgt = tpgt;
1712
1713 /*
1714 * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1715 * pretend to be SAS..
1716 */
1717 ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1718 if (ret < 0)
1719 goto free_workqueue;
1720
1721 tpg_instances[i].tpg = tpg;
1722 tpg->fi = tpg_instances[i].func_inst;
1723 mutex_unlock(&tpg_instances_lock);
1724 return &tpg->se_tpg;
1725
1726free_workqueue:
1727 destroy_workqueue(tpg->workqueue);
1728free_tpg:
1729 kfree(tpg);
1730unref_dep:
1731 if (opts->has_dep)
1732 module_put(opts->dependent);
1733 else
1734 configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1735unlock_inst:
1736 mutex_unlock(&tpg_instances_lock);
1737
1738 return ERR_PTR(ret);
1739}
1740
1741static int tcm_usbg_drop_nexus(struct usbg_tpg *);
1742
1743static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1744{
1745 struct usbg_tpg *tpg = container_of(se_tpg,
1746 struct usbg_tpg, se_tpg);
1747 unsigned i;
1748 struct f_tcm_opts *opts;
1749
1750 tcm_usbg_drop_nexus(tpg);
1751 core_tpg_deregister(se_tpg);
1752 destroy_workqueue(tpg->workqueue);
1753
1754 mutex_lock(&tpg_instances_lock);
1755 for (i = 0; i < TPG_INSTANCES; ++i)
1756 if (tpg_instances[i].tpg == tpg)
1757 break;
1758 if (i < TPG_INSTANCES) {
1759 tpg_instances[i].tpg = NULL;
1760 opts = container_of(tpg_instances[i].func_inst,
1761 struct f_tcm_opts, func_inst);
1762 mutex_lock(&opts->dep_lock);
1763 if (opts->has_dep)
1764 module_put(opts->dependent);
1765 else
1766 configfs_undepend_item_unlocked(
1767 &opts->func_inst.group.cg_item);
1768 mutex_unlock(&opts->dep_lock);
1769 }
1770 mutex_unlock(&tpg_instances_lock);
1771
1772 kfree(tpg);
1773}
1774
1775static struct se_wwn *usbg_make_tport(
1776 struct target_fabric_configfs *tf,
1777 struct config_group *group,
1778 const char *name)
1779{
1780 struct usbg_tport *tport;
1781 const char *wnn_name;
1782 u64 wwpn = 0;
1783
1784 wnn_name = usbg_check_wwn(name);
1785 if (!wnn_name)
1786 return ERR_PTR(-EINVAL);
1787
1788 tport = kzalloc_obj(struct usbg_tport);
1789 if (!(tport))
1790 return ERR_PTR(-ENOMEM);
1791
1792 tport->tport_wwpn = wwpn;
1793 snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1794 return &tport->tport_wwn;
1795}
1796
1797static void usbg_drop_tport(struct se_wwn *wwn)
1798{
1799 struct usbg_tport *tport = container_of(wwn,
1800 struct usbg_tport, tport_wwn);
1801 kfree(tport);
1802}
1803
1804/*
1805 * If somebody feels like dropping the version property, go ahead.
1806 */
1807static ssize_t usbg_wwn_version_show(struct config_item *item, char *page)
1808{
1809 return sprintf(page, "usb-gadget fabric module\n");
1810}
1811
1812CONFIGFS_ATTR_RO(usbg_wwn_, version);
1813
1814static struct configfs_attribute *usbg_wwn_attrs[] = {
1815 &usbg_wwn_attr_version,
1816 NULL,
1817};
1818
1819static int usbg_attach(struct usbg_tpg *);
1820static void usbg_detach(struct usbg_tpg *);
1821
1822static int usbg_enable_tpg(struct se_portal_group *se_tpg, bool enable)
1823{
1824 struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1825 int ret = 0;
1826
1827 if (enable)
1828 ret = usbg_attach(tpg);
1829 else
1830 usbg_detach(tpg);
1831 if (ret)
1832 return ret;
1833
1834 tpg->gadget_connect = enable;
1835
1836 return 0;
1837}
1838
1839static ssize_t tcm_usbg_tpg_nexus_show(struct config_item *item, char *page)
1840{
1841 struct se_portal_group *se_tpg = to_tpg(item);
1842 struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1843 struct tcm_usbg_nexus *tv_nexus;
1844 ssize_t ret;
1845
1846 mutex_lock(&tpg->tpg_mutex);
1847 tv_nexus = tpg->tpg_nexus;
1848 if (!tv_nexus) {
1849 ret = -ENODEV;
1850 goto out;
1851 }
1852 ret = sysfs_emit(page, "%s\n",
1853 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1854out:
1855 mutex_unlock(&tpg->tpg_mutex);
1856 return ret;
1857}
1858
1859static int usbg_alloc_sess_cb(struct se_portal_group *se_tpg,
1860 struct se_session *se_sess, void *p)
1861{
1862 struct usbg_tpg *tpg = container_of(se_tpg,
1863 struct usbg_tpg, se_tpg);
1864
1865 tpg->tpg_nexus = p;
1866 return 0;
1867}
1868
1869static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1870{
1871 struct tcm_usbg_nexus *tv_nexus;
1872 int ret = 0;
1873
1874 mutex_lock(&tpg->tpg_mutex);
1875 if (tpg->tpg_nexus) {
1876 ret = -EEXIST;
1877 pr_debug("tpg->tpg_nexus already exists\n");
1878 goto out_unlock;
1879 }
1880
1881 tv_nexus = kzalloc_obj(*tv_nexus);
1882 if (!tv_nexus) {
1883 ret = -ENOMEM;
1884 goto out_unlock;
1885 }
1886
1887 tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg,
1888 USB_G_DEFAULT_SESSION_TAGS,
1889 sizeof(struct usbg_cmd),
1890 TARGET_PROT_NORMAL, name,
1891 tv_nexus, usbg_alloc_sess_cb);
1892 if (IS_ERR(tv_nexus->tvn_se_sess)) {
1893#define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
1894 pr_debug(MAKE_NEXUS_MSG, name);
1895#undef MAKE_NEXUS_MSG
1896 ret = PTR_ERR(tv_nexus->tvn_se_sess);
1897 kfree(tv_nexus);
1898 }
1899
1900out_unlock:
1901 mutex_unlock(&tpg->tpg_mutex);
1902 return ret;
1903}
1904
1905static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1906{
1907 struct se_session *se_sess;
1908 struct tcm_usbg_nexus *tv_nexus;
1909 int ret = -ENODEV;
1910
1911 mutex_lock(&tpg->tpg_mutex);
1912 tv_nexus = tpg->tpg_nexus;
1913 if (!tv_nexus)
1914 goto out;
1915
1916 se_sess = tv_nexus->tvn_se_sess;
1917 if (!se_sess)
1918 goto out;
1919
1920 if (atomic_read(&tpg->tpg_port_count)) {
1921 ret = -EPERM;
1922#define MSG "Unable to remove Host I_T Nexus with active TPG port count: %d\n"
1923 pr_err(MSG, atomic_read(&tpg->tpg_port_count));
1924#undef MSG
1925 goto out;
1926 }
1927
1928 pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1929 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1930 /*
1931 * Release the SCSI I_T Nexus to the emulated vHost Target Port
1932 */
1933 target_remove_session(se_sess);
1934 tpg->tpg_nexus = NULL;
1935
1936 kfree(tv_nexus);
1937 ret = 0;
1938out:
1939 mutex_unlock(&tpg->tpg_mutex);
1940 return ret;
1941}
1942
1943static ssize_t tcm_usbg_tpg_nexus_store(struct config_item *item,
1944 const char *page, size_t count)
1945{
1946 struct se_portal_group *se_tpg = to_tpg(item);
1947 struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1948 unsigned char i_port[USBG_NAMELEN], *ptr;
1949 int ret;
1950
1951 if (!strncmp(page, "NULL", 4)) {
1952 ret = tcm_usbg_drop_nexus(tpg);
1953 return (!ret) ? count : ret;
1954 }
1955 if (strlen(page) >= USBG_NAMELEN) {
1956
1957#define NEXUS_STORE_MSG "Emulated NAA Sas Address: %s, exceeds max: %d\n"
1958 pr_err(NEXUS_STORE_MSG, page, USBG_NAMELEN);
1959#undef NEXUS_STORE_MSG
1960 return -EINVAL;
1961 }
1962 snprintf(i_port, USBG_NAMELEN, "%s", page);
1963
1964 ptr = strstr(i_port, "naa.");
1965 if (!ptr) {
1966 pr_err("Missing 'naa.' prefix\n");
1967 return -EINVAL;
1968 }
1969
1970 if (i_port[strlen(i_port) - 1] == '\n')
1971 i_port[strlen(i_port) - 1] = '\0';
1972
1973 ret = tcm_usbg_make_nexus(tpg, &i_port[0]);
1974 if (ret < 0)
1975 return ret;
1976 return count;
1977}
1978
1979CONFIGFS_ATTR(tcm_usbg_tpg_, nexus);
1980
1981static struct configfs_attribute *usbg_base_attrs[] = {
1982 &tcm_usbg_tpg_attr_nexus,
1983 NULL,
1984};
1985
1986static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1987{
1988 struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1989
1990 atomic_inc(&tpg->tpg_port_count);
1991 smp_mb__after_atomic();
1992 return 0;
1993}
1994
1995static void usbg_port_unlink(struct se_portal_group *se_tpg,
1996 struct se_lun *se_lun)
1997{
1998 struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1999
2000 atomic_dec(&tpg->tpg_port_count);
2001 smp_mb__after_atomic();
2002}
2003
2004static int usbg_check_stop_free(struct se_cmd *se_cmd)
2005{
2006 return target_put_sess_cmd(se_cmd);
2007}
2008
2009static const struct target_core_fabric_ops usbg_ops = {
2010 .module = THIS_MODULE,
2011 .fabric_name = "usb_gadget",
2012 .tpg_get_wwn = usbg_get_fabric_wwn,
2013 .tpg_get_tag = usbg_get_tag,
2014 .tpg_check_demo_mode = usbg_check_true,
2015 .release_cmd = usbg_release_cmd,
2016 .sess_get_initiator_sid = NULL,
2017 .write_pending = usbg_send_write_request,
2018 .queue_data_in = usbg_send_read_response,
2019 .queue_status = usbg_send_status_response,
2020 .queue_tm_rsp = usbg_queue_tm_rsp,
2021 .aborted_task = usbg_aborted_task,
2022 .check_stop_free = usbg_check_stop_free,
2023
2024 .fabric_make_wwn = usbg_make_tport,
2025 .fabric_drop_wwn = usbg_drop_tport,
2026 .fabric_make_tpg = usbg_make_tpg,
2027 .fabric_enable_tpg = usbg_enable_tpg,
2028 .fabric_drop_tpg = usbg_drop_tpg,
2029 .fabric_post_link = usbg_port_link,
2030 .fabric_post_unlink = usbg_port_unlink,
2031 .fabric_init_nodeacl = usbg_init_nodeacl,
2032
2033 .tfc_wwn_attrs = usbg_wwn_attrs,
2034 .tfc_tpg_base_attrs = usbg_base_attrs,
2035
2036 .default_compl_type = TARGET_QUEUE_COMPL,
2037 .default_submit_type = TARGET_DIRECT_SUBMIT,
2038 .direct_submit_supp = 1,
2039};
2040
2041/* Start gadget.c code */
2042
2043static struct usb_interface_descriptor bot_intf_desc = {
2044 .bLength = sizeof(bot_intf_desc),
2045 .bDescriptorType = USB_DT_INTERFACE,
2046 .bNumEndpoints = 2,
2047 .bAlternateSetting = USB_G_ALT_INT_BBB,
2048 .bInterfaceClass = USB_CLASS_MASS_STORAGE,
2049 .bInterfaceSubClass = USB_SC_SCSI,
2050 .bInterfaceProtocol = USB_PR_BULK,
2051};
2052
2053static struct usb_interface_descriptor uasp_intf_desc = {
2054 .bLength = sizeof(uasp_intf_desc),
2055 .bDescriptorType = USB_DT_INTERFACE,
2056 .bNumEndpoints = 4,
2057 .bAlternateSetting = USB_G_ALT_INT_UAS,
2058 .bInterfaceClass = USB_CLASS_MASS_STORAGE,
2059 .bInterfaceSubClass = USB_SC_SCSI,
2060 .bInterfaceProtocol = USB_PR_UAS,
2061};
2062
2063static struct usb_endpoint_descriptor uasp_bi_desc = {
2064 .bLength = USB_DT_ENDPOINT_SIZE,
2065 .bDescriptorType = USB_DT_ENDPOINT,
2066 .bEndpointAddress = USB_DIR_IN,
2067 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2068 .wMaxPacketSize = cpu_to_le16(512),
2069};
2070
2071static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
2072 .bLength = USB_DT_ENDPOINT_SIZE,
2073 .bDescriptorType = USB_DT_ENDPOINT,
2074 .bEndpointAddress = USB_DIR_IN,
2075 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2076};
2077
2078static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
2079 .bLength = sizeof(uasp_bi_pipe_desc),
2080 .bDescriptorType = USB_DT_PIPE_USAGE,
2081 .bPipeID = DATA_IN_PIPE_ID,
2082};
2083
2084static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
2085 .bLength = USB_DT_ENDPOINT_SIZE,
2086 .bDescriptorType = USB_DT_ENDPOINT,
2087 .bEndpointAddress = USB_DIR_IN,
2088 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2089 .wMaxPacketSize = cpu_to_le16(1024),
2090};
2091
2092static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
2093 .bLength = sizeof(uasp_bi_ep_comp_desc),
2094 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2095 .bMaxBurst = 15,
2096 .bmAttributes = UASP_SS_EP_COMP_LOG_STREAMS,
2097 .wBytesPerInterval = 0,
2098};
2099
2100static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
2101 .bLength = sizeof(bot_bi_ep_comp_desc),
2102 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2103 .bMaxBurst = 15,
2104};
2105
2106static struct usb_endpoint_descriptor uasp_bo_desc = {
2107 .bLength = USB_DT_ENDPOINT_SIZE,
2108 .bDescriptorType = USB_DT_ENDPOINT,
2109 .bEndpointAddress = USB_DIR_OUT,
2110 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2111 .wMaxPacketSize = cpu_to_le16(512),
2112};
2113
2114static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
2115 .bLength = USB_DT_ENDPOINT_SIZE,
2116 .bDescriptorType = USB_DT_ENDPOINT,
2117 .bEndpointAddress = USB_DIR_OUT,
2118 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2119};
2120
2121static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
2122 .bLength = sizeof(uasp_bo_pipe_desc),
2123 .bDescriptorType = USB_DT_PIPE_USAGE,
2124 .bPipeID = DATA_OUT_PIPE_ID,
2125};
2126
2127static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
2128 .bLength = USB_DT_ENDPOINT_SIZE,
2129 .bDescriptorType = USB_DT_ENDPOINT,
2130 .bEndpointAddress = USB_DIR_OUT,
2131 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2132 .wMaxPacketSize = cpu_to_le16(0x400),
2133};
2134
2135static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
2136 .bLength = sizeof(uasp_bo_ep_comp_desc),
2137 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2138 .bMaxBurst = 15,
2139 .bmAttributes = UASP_SS_EP_COMP_LOG_STREAMS,
2140};
2141
2142static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
2143 .bLength = sizeof(bot_bo_ep_comp_desc),
2144 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2145 .bMaxBurst = 15,
2146};
2147
2148static struct usb_endpoint_descriptor uasp_status_desc = {
2149 .bLength = USB_DT_ENDPOINT_SIZE,
2150 .bDescriptorType = USB_DT_ENDPOINT,
2151 .bEndpointAddress = USB_DIR_IN,
2152 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2153 .wMaxPacketSize = cpu_to_le16(512),
2154};
2155
2156static struct usb_endpoint_descriptor uasp_fs_status_desc = {
2157 .bLength = USB_DT_ENDPOINT_SIZE,
2158 .bDescriptorType = USB_DT_ENDPOINT,
2159 .bEndpointAddress = USB_DIR_IN,
2160 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2161};
2162
2163static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
2164 .bLength = sizeof(uasp_status_pipe_desc),
2165 .bDescriptorType = USB_DT_PIPE_USAGE,
2166 .bPipeID = STATUS_PIPE_ID,
2167};
2168
2169static struct usb_endpoint_descriptor uasp_ss_status_desc = {
2170 .bLength = USB_DT_ENDPOINT_SIZE,
2171 .bDescriptorType = USB_DT_ENDPOINT,
2172 .bEndpointAddress = USB_DIR_IN,
2173 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2174 .wMaxPacketSize = cpu_to_le16(1024),
2175};
2176
2177static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
2178 .bLength = sizeof(uasp_status_in_ep_comp_desc),
2179 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2180 .bmAttributes = UASP_SS_EP_COMP_LOG_STREAMS,
2181};
2182
2183static struct usb_endpoint_descriptor uasp_cmd_desc = {
2184 .bLength = USB_DT_ENDPOINT_SIZE,
2185 .bDescriptorType = USB_DT_ENDPOINT,
2186 .bEndpointAddress = USB_DIR_OUT,
2187 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2188 .wMaxPacketSize = cpu_to_le16(512),
2189};
2190
2191static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
2192 .bLength = USB_DT_ENDPOINT_SIZE,
2193 .bDescriptorType = USB_DT_ENDPOINT,
2194 .bEndpointAddress = USB_DIR_OUT,
2195 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2196};
2197
2198static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
2199 .bLength = sizeof(uasp_cmd_pipe_desc),
2200 .bDescriptorType = USB_DT_PIPE_USAGE,
2201 .bPipeID = CMD_PIPE_ID,
2202};
2203
2204static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
2205 .bLength = USB_DT_ENDPOINT_SIZE,
2206 .bDescriptorType = USB_DT_ENDPOINT,
2207 .bEndpointAddress = USB_DIR_OUT,
2208 .bmAttributes = USB_ENDPOINT_XFER_BULK,
2209 .wMaxPacketSize = cpu_to_le16(1024),
2210};
2211
2212static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
2213 .bLength = sizeof(uasp_cmd_comp_desc),
2214 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
2215};
2216
2217static struct usb_descriptor_header *uasp_fs_function_desc[] = {
2218 (struct usb_descriptor_header *) &bot_intf_desc,
2219 (struct usb_descriptor_header *) &uasp_fs_bi_desc,
2220 (struct usb_descriptor_header *) &uasp_fs_bo_desc,
2221
2222 (struct usb_descriptor_header *) &uasp_intf_desc,
2223 (struct usb_descriptor_header *) &uasp_fs_bi_desc,
2224 (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
2225 (struct usb_descriptor_header *) &uasp_fs_bo_desc,
2226 (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
2227 (struct usb_descriptor_header *) &uasp_fs_status_desc,
2228 (struct usb_descriptor_header *) &uasp_status_pipe_desc,
2229 (struct usb_descriptor_header *) &uasp_fs_cmd_desc,
2230 (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
2231 NULL,
2232};
2233
2234static struct usb_descriptor_header *uasp_hs_function_desc[] = {
2235 (struct usb_descriptor_header *) &bot_intf_desc,
2236 (struct usb_descriptor_header *) &uasp_bi_desc,
2237 (struct usb_descriptor_header *) &uasp_bo_desc,
2238
2239 (struct usb_descriptor_header *) &uasp_intf_desc,
2240 (struct usb_descriptor_header *) &uasp_bi_desc,
2241 (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
2242 (struct usb_descriptor_header *) &uasp_bo_desc,
2243 (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
2244 (struct usb_descriptor_header *) &uasp_status_desc,
2245 (struct usb_descriptor_header *) &uasp_status_pipe_desc,
2246 (struct usb_descriptor_header *) &uasp_cmd_desc,
2247 (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
2248 NULL,
2249};
2250
2251static struct usb_descriptor_header *uasp_ss_function_desc[] = {
2252 (struct usb_descriptor_header *) &bot_intf_desc,
2253 (struct usb_descriptor_header *) &uasp_ss_bi_desc,
2254 (struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
2255 (struct usb_descriptor_header *) &uasp_ss_bo_desc,
2256 (struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
2257
2258 (struct usb_descriptor_header *) &uasp_intf_desc,
2259 (struct usb_descriptor_header *) &uasp_ss_bi_desc,
2260 (struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
2261 (struct usb_descriptor_header *) &uasp_bi_pipe_desc,
2262 (struct usb_descriptor_header *) &uasp_ss_bo_desc,
2263 (struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
2264 (struct usb_descriptor_header *) &uasp_bo_pipe_desc,
2265 (struct usb_descriptor_header *) &uasp_ss_status_desc,
2266 (struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
2267 (struct usb_descriptor_header *) &uasp_status_pipe_desc,
2268 (struct usb_descriptor_header *) &uasp_ss_cmd_desc,
2269 (struct usb_descriptor_header *) &uasp_cmd_comp_desc,
2270 (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
2271 NULL,
2272};
2273
2274static struct usb_string tcm_us_strings[] = {
2275 [USB_G_STR_INT_UAS].s = "USB Attached SCSI",
2276 [USB_G_STR_INT_BBB].s = "Bulk Only Transport",
2277 { },
2278};
2279
2280static struct usb_gadget_strings tcm_stringtab = {
2281 .language = 0x0409,
2282 .strings = tcm_us_strings,
2283};
2284
2285static struct usb_gadget_strings *tcm_strings[] = {
2286 &tcm_stringtab,
2287 NULL,
2288};
2289
2290static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
2291{
2292 struct f_uas *fu = to_f_uas(f);
2293 struct usb_string *us;
2294 struct usb_gadget *gadget = c->cdev->gadget;
2295 struct usb_ep *ep;
2296 struct f_tcm_opts *opts;
2297 int iface;
2298 int ret;
2299
2300 opts = container_of(f->fi, struct f_tcm_opts, func_inst);
2301
2302 mutex_lock(&opts->dep_lock);
2303 if (!opts->can_attach) {
2304 mutex_unlock(&opts->dep_lock);
2305 return -ENODEV;
2306 }
2307 mutex_unlock(&opts->dep_lock);
2308 us = usb_gstrings_attach(c->cdev, tcm_strings,
2309 ARRAY_SIZE(tcm_us_strings));
2310 if (IS_ERR(us))
2311 return PTR_ERR(us);
2312 bot_intf_desc.iInterface = us[USB_G_STR_INT_BBB].id;
2313 uasp_intf_desc.iInterface = us[USB_G_STR_INT_UAS].id;
2314
2315 iface = usb_interface_id(c, f);
2316 if (iface < 0)
2317 return iface;
2318
2319 bot_intf_desc.bInterfaceNumber = iface;
2320 uasp_intf_desc.bInterfaceNumber = iface;
2321 fu->iface = iface;
2322 ep = usb_ep_autoconfig(gadget, &uasp_fs_bi_desc);
2323 if (!ep)
2324 goto ep_fail;
2325
2326 fu->ep_in = ep;
2327
2328 ep = usb_ep_autoconfig(gadget, &uasp_fs_bo_desc);
2329 if (!ep)
2330 goto ep_fail;
2331 fu->ep_out = ep;
2332
2333 ep = usb_ep_autoconfig(gadget, &uasp_fs_status_desc);
2334 if (!ep)
2335 goto ep_fail;
2336 fu->ep_status = ep;
2337
2338 ep = usb_ep_autoconfig(gadget, &uasp_fs_cmd_desc);
2339 if (!ep)
2340 goto ep_fail;
2341 fu->ep_cmd = ep;
2342
2343 /* Assume endpoint addresses are the same for both speeds */
2344 uasp_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
2345 uasp_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
2346 uasp_status_desc.bEndpointAddress =
2347 uasp_fs_status_desc.bEndpointAddress;
2348 uasp_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
2349
2350 uasp_ss_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
2351 uasp_ss_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
2352 uasp_ss_status_desc.bEndpointAddress =
2353 uasp_fs_status_desc.bEndpointAddress;
2354 uasp_ss_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
2355
2356 ret = usb_assign_descriptors(f, uasp_fs_function_desc,
2357 uasp_hs_function_desc, uasp_ss_function_desc,
2358 uasp_ss_function_desc);
2359 if (ret)
2360 goto ep_fail;
2361
2362 return 0;
2363ep_fail:
2364 pr_err("Can't claim all required eps\n");
2365
2366 return -ENOTSUPP;
2367}
2368
2369static void tcm_cleanup_old_alt(struct f_uas *fu)
2370{
2371 if (fu->flags & USBG_IS_UAS)
2372 uasp_cleanup_old_alt(fu);
2373 else if (fu->flags & USBG_IS_BOT)
2374 bot_cleanup_old_alt(fu);
2375 fu->flags = 0;
2376}
2377
2378static void tcm_delayed_set_alt_done(struct f_uas *fu)
2379{
2380 unsigned long flags;
2381
2382 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2383 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
2384 fu->delayed_set_alt_cancel = false;
2385 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2386}
2387
2388static bool tcm_delayed_set_alt_cancelled(struct f_uas *fu)
2389{
2390 bool cancelled;
2391 unsigned long flags;
2392
2393 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2394 cancelled = fu->delayed_set_alt_cancel;
2395 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2396
2397 return cancelled;
2398}
2399
2400static bool tcm_complete_delayed_status(struct f_uas *fu)
2401{
2402 struct usb_composite_dev *cdev = fu->function.config->cdev;
2403 struct usb_request *req = cdev->req;
2404 unsigned long cdev_flags;
2405 bool cancelled;
2406 int ret;
2407
2408 spin_lock_irqsave(&cdev->lock, cdev_flags);
2409 spin_lock(&fu->delayed_set_alt_lock);
2410 cancelled = fu->delayed_set_alt_cancel;
2411 if (!cancelled) {
2412 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
2413 fu->delayed_set_alt_cancel = false;
2414 }
2415 spin_unlock(&fu->delayed_set_alt_lock);
2416
2417 if (cancelled) {
2418 spin_unlock_irqrestore(&cdev->lock, cdev_flags);
2419 return false;
2420 }
2421
2422 if (cdev->delayed_status == 0) {
2423 WARN(cdev, "%s: Unexpected call\n", __func__);
2424 } else if (--cdev->delayed_status == 0) {
2425 req->length = 0;
2426 req->context = cdev;
2427 ret = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
2428 if (ret == 0) {
2429 cdev->setup_pending = true;
2430 } else {
2431 req->status = 0;
2432 req->complete(cdev->gadget->ep0, req);
2433 }
2434 }
2435
2436 spin_unlock_irqrestore(&cdev->lock, cdev_flags);
2437
2438 return true;
2439}
2440
2441static bool tcm_cancel_delayed_set_alt(struct f_uas *fu)
2442{
2443 bool cleanup = false;
2444 bool cancel = false;
2445 unsigned long flags;
2446
2447 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2448 switch (fu->delayed_set_alt_state) {
2449 case USBG_DELAYED_SET_ALT_IDLE:
2450 cleanup = true;
2451 break;
2452 case USBG_DELAYED_SET_ALT_QUEUED:
2453 case USBG_DELAYED_SET_ALT_RUNNING:
2454 fu->delayed_set_alt_cancel = true;
2455 cancel = true;
2456 break;
2457 }
2458 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2459
2460 if (cancel && cancel_work(&fu->delayed_set_alt)) {
2461 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2462 if (fu->delayed_set_alt_state == USBG_DELAYED_SET_ALT_QUEUED) {
2463 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
2464 fu->delayed_set_alt_cancel = false;
2465 cleanup = true;
2466 }
2467 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2468 }
2469
2470 return cleanup;
2471}
2472
2473static void tcm_cancel_delayed_set_alt_sync(struct f_uas *fu)
2474{
2475 unsigned long flags;
2476
2477 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2478 if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_IDLE)
2479 fu->delayed_set_alt_cancel = true;
2480 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2481
2482 cancel_work_sync(&fu->delayed_set_alt);
2483
2484 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2485 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
2486 fu->delayed_set_alt_cancel = false;
2487 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2488}
2489
2490static void tcm_delayed_set_alt(struct work_struct *wq)
2491{
2492 struct f_uas *fu = container_of(wq, struct f_uas, delayed_set_alt);
2493 unsigned long flags;
2494 unsigned int alt;
2495
2496 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2497 if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_QUEUED) {
2498 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2499 return;
2500 }
2501 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_RUNNING;
2502 alt = fu->delayed_alt;
2503 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2504
2505 tcm_cleanup_old_alt(fu);
2506
2507 if (tcm_delayed_set_alt_cancelled(fu))
2508 goto out_done;
2509
2510 if (alt == USB_G_ALT_INT_BBB)
2511 bot_set_alt(fu);
2512 else if (alt == USB_G_ALT_INT_UAS)
2513 uasp_set_alt(fu);
2514
2515 if (tcm_complete_delayed_status(fu))
2516 return;
2517
2518 tcm_cleanup_old_alt(fu);
2519out_done:
2520 tcm_delayed_set_alt_done(fu);
2521}
2522
2523static int tcm_get_alt(struct usb_function *f, unsigned intf)
2524{
2525 struct f_uas *fu = to_f_uas(f);
2526
2527 if (fu->iface != intf)
2528 return -EOPNOTSUPP;
2529
2530 if (fu->flags & USBG_IS_BOT)
2531 return USB_G_ALT_INT_BBB;
2532 else if (fu->flags & USBG_IS_UAS)
2533 return USB_G_ALT_INT_UAS;
2534
2535 return -EOPNOTSUPP;
2536}
2537
2538static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2539{
2540 struct f_uas *fu = to_f_uas(f);
2541
2542 if (fu->iface != intf)
2543 return -EOPNOTSUPP;
2544
2545 if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2546 unsigned long flags;
2547
2548 spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
2549 if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_IDLE) {
2550 spin_unlock_irqrestore(&fu->delayed_set_alt_lock,
2551 flags);
2552 return -EBUSY;
2553 }
2554 fu->delayed_alt = alt;
2555 fu->delayed_set_alt_cancel = false;
2556 fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_QUEUED;
2557 spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
2558
2559 schedule_work(&fu->delayed_set_alt);
2560 return USB_GADGET_DELAYED_STATUS;
2561 }
2562 return -EOPNOTSUPP;
2563}
2564
2565static void tcm_disable(struct usb_function *f)
2566{
2567 struct f_uas *fu = to_f_uas(f);
2568
2569 if (tcm_cancel_delayed_set_alt(fu))
2570 tcm_cleanup_old_alt(fu);
2571}
2572
2573static int tcm_setup(struct usb_function *f,
2574 const struct usb_ctrlrequest *ctrl)
2575{
2576 struct f_uas *fu = to_f_uas(f);
2577
2578 if (!(fu->flags & USBG_IS_BOT))
2579 return -EOPNOTSUPP;
2580
2581 return usbg_bot_setup(f, ctrl);
2582}
2583
2584static inline struct f_tcm_opts *to_f_tcm_opts(struct config_item *item)
2585{
2586 return container_of(to_config_group(item), struct f_tcm_opts,
2587 func_inst.group);
2588}
2589
2590static void tcm_attr_release(struct config_item *item)
2591{
2592 struct f_tcm_opts *opts = to_f_tcm_opts(item);
2593
2594 usb_put_function_instance(&opts->func_inst);
2595}
2596
2597static const struct configfs_item_operations tcm_item_ops = {
2598 .release = tcm_attr_release,
2599};
2600
2601static const struct config_item_type tcm_func_type = {
2602 .ct_item_ops = &tcm_item_ops,
2603 .ct_owner = THIS_MODULE,
2604};
2605
2606static void tcm_free_inst(struct usb_function_instance *f)
2607{
2608 struct f_tcm_opts *opts;
2609 unsigned i;
2610
2611 opts = container_of(f, struct f_tcm_opts, func_inst);
2612
2613 mutex_lock(&tpg_instances_lock);
2614 for (i = 0; i < TPG_INSTANCES; ++i)
2615 if (tpg_instances[i].func_inst == f)
2616 break;
2617 if (i < TPG_INSTANCES)
2618 tpg_instances[i].func_inst = NULL;
2619 mutex_unlock(&tpg_instances_lock);
2620
2621 kfree(opts);
2622}
2623
2624static int tcm_register_callback(struct usb_function_instance *f)
2625{
2626 struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2627
2628 mutex_lock(&opts->dep_lock);
2629 opts->can_attach = true;
2630 mutex_unlock(&opts->dep_lock);
2631
2632 return 0;
2633}
2634
2635static void tcm_unregister_callback(struct usb_function_instance *f)
2636{
2637 struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2638
2639 mutex_lock(&opts->dep_lock);
2640 unregister_gadget_item(opts->
2641 func_inst.group.cg_item.ci_parent->ci_parent);
2642 opts->can_attach = false;
2643 mutex_unlock(&opts->dep_lock);
2644}
2645
2646static int usbg_attach(struct usbg_tpg *tpg)
2647{
2648 struct usb_function_instance *f = tpg->fi;
2649 struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2650
2651 if (opts->tcm_register_callback)
2652 return opts->tcm_register_callback(f);
2653
2654 return 0;
2655}
2656
2657static void usbg_detach(struct usbg_tpg *tpg)
2658{
2659 struct usb_function_instance *f = tpg->fi;
2660 struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2661
2662 if (opts->tcm_unregister_callback)
2663 opts->tcm_unregister_callback(f);
2664}
2665
2666static int tcm_set_name(struct usb_function_instance *f, const char *name)
2667{
2668 struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2669
2670 pr_debug("tcm: Activating %s\n", name);
2671
2672 WRITE_ONCE(opts->ready, true);
2673
2674 return 0;
2675}
2676
2677static struct usb_function_instance *tcm_alloc_inst(void)
2678{
2679 struct f_tcm_opts *opts;
2680 int i;
2681
2682
2683 opts = kzalloc_obj(*opts);
2684 if (!opts)
2685 return ERR_PTR(-ENOMEM);
2686
2687 mutex_lock(&tpg_instances_lock);
2688 for (i = 0; i < TPG_INSTANCES; ++i)
2689 if (!tpg_instances[i].func_inst)
2690 break;
2691
2692 if (i == TPG_INSTANCES) {
2693 mutex_unlock(&tpg_instances_lock);
2694 kfree(opts);
2695 return ERR_PTR(-EBUSY);
2696 }
2697 tpg_instances[i].func_inst = &opts->func_inst;
2698 mutex_unlock(&tpg_instances_lock);
2699
2700 mutex_init(&opts->dep_lock);
2701 opts->func_inst.set_inst_name = tcm_set_name;
2702 opts->func_inst.free_func_inst = tcm_free_inst;
2703 opts->tcm_register_callback = tcm_register_callback;
2704 opts->tcm_unregister_callback = tcm_unregister_callback;
2705
2706 config_group_init_type_name(&opts->func_inst.group, "",
2707 &tcm_func_type);
2708
2709 return &opts->func_inst;
2710}
2711
2712static void tcm_free(struct usb_function *f)
2713{
2714 struct f_uas *tcm = to_f_uas(f);
2715
2716 tcm_cancel_delayed_set_alt_sync(tcm);
2717 kfree(tcm);
2718}
2719
2720static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
2721{
2722 struct f_uas *fu = to_f_uas(f);
2723
2724 tcm_cancel_delayed_set_alt_sync(fu);
2725 tcm_cleanup_old_alt(fu);
2726 usb_free_all_descriptors(f);
2727}
2728
2729static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
2730{
2731 struct f_uas *fu;
2732 unsigned i;
2733
2734 mutex_lock(&tpg_instances_lock);
2735 for (i = 0; i < TPG_INSTANCES; ++i)
2736 if (tpg_instances[i].func_inst == fi)
2737 break;
2738 if (i == TPG_INSTANCES) {
2739 mutex_unlock(&tpg_instances_lock);
2740 return ERR_PTR(-ENODEV);
2741 }
2742
2743 fu = kzalloc_obj(*fu);
2744 if (!fu) {
2745 mutex_unlock(&tpg_instances_lock);
2746 return ERR_PTR(-ENOMEM);
2747 }
2748
2749 fu->function.name = "Target Function";
2750 fu->function.bind = tcm_bind;
2751 fu->function.unbind = tcm_unbind;
2752 fu->function.set_alt = tcm_set_alt;
2753 fu->function.get_alt = tcm_get_alt;
2754 fu->function.setup = tcm_setup;
2755 fu->function.disable = tcm_disable;
2756 fu->function.free_func = tcm_free;
2757 fu->tpg = tpg_instances[i].tpg;
2758 INIT_WORK(&fu->delayed_set_alt, tcm_delayed_set_alt);
2759 spin_lock_init(&fu->delayed_set_alt_lock);
2760
2761 hash_init(fu->stream_hash);
2762 mutex_unlock(&tpg_instances_lock);
2763
2764 return &fu->function;
2765}
2766
2767DECLARE_USB_FUNCTION(tcm, tcm_alloc_inst, tcm_alloc);
2768
2769static int __init tcm_init(void)
2770{
2771 int ret;
2772
2773 ret = usb_function_register(&tcmusb_func);
2774 if (ret)
2775 return ret;
2776
2777 ret = target_register_template(&usbg_ops);
2778 if (ret)
2779 usb_function_unregister(&tcmusb_func);
2780
2781 return ret;
2782}
2783module_init(tcm_init);
2784
2785static void __exit tcm_exit(void)
2786{
2787 target_unregister_template(&usbg_ops);
2788 usb_function_unregister(&tcmusb_func);
2789}
2790module_exit(tcm_exit);
2791
2792MODULE_DESCRIPTION("Target based USB-Gadget");
2793MODULE_LICENSE("GPL");
2794MODULE_AUTHOR("Sebastian Andrzej Siewior");