4 files changed, 2638 insertions, 0 deletions

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 2633f759511..569b33e754b 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -798,6 +798,16 @@ config USB_MASS_STORAGE
           Say "y" to link the driver statically, or "m" to build
           a dynamically linked module called "g_mass_storage".
 
+config USB_GADGET_TARGET
+        tristate "USB Gadget Target Fabric Module"
+        depends on TARGET_CORE
+        help
+          This fabric is an USB gadget. Two USB protocols are supported that is
+          BBB or BOT (Bulk Only Transport) and UAS (USB Attached SCSI). BOT is
+          advertised on alternative interface 0 (primary) and UAS is on
+          alternative interface 1. Both protocols can work on USB2.0 and USB3.0.
+          UAS utilizes the USB 3.0 feature called streams support.
+
 config USB_G_SERIAL
         tristate "Serial Gadget (with CDC ACM and CDC OBEX support)"
         help
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index b7f6eefc392..fc5b83683de 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -52,6 +52,7 @@ g_nokia-y			:= nokia.o
 g_webcam-y                      := webcam.o
 g_ncm-y                         := ncm.o
 g_acm_ms-y                      := acm_ms.o
+g_tcm_usb_gadget-y              := tcm_usb_gadget.o
 
 obj-$(CONFIG_USB_ZERO)          += g_zero.o
 obj-$(CONFIG_USB_AUDIO)         += g_audio.o
@@ -71,3 +72,4 @@ obj-$(CONFIG_USB_G_NOKIA)	+= g_nokia.o
 obj-$(CONFIG_USB_G_WEBCAM)      += g_webcam.o
 obj-$(CONFIG_USB_G_NCM)         += g_ncm.o
 obj-$(CONFIG_USB_G_ACM_MS)      += g_acm_ms.o
+obj-$(CONFIG_USB_GADGET_TARGET) += tcm_usb_gadget.o
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
new file mode 100644
index 00000000000..c46439c8dd7
--- /dev/null
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -0,0 +1,2480 @@
+/* Target based USB-Gadget
+ *
+ * UAS protocol handling, target callbacks, configfs handling,
+ * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
+ *
+ * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
+ * License: GPLv2 as published by FSF.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/configfs.h>
+#include <linux/ctype.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/composite.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/storage.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_tcq.h>
+#include <target/target_core_base.h>
+#include <target/target_core_fabric.h>
+#include <target/target_core_fabric_configfs.h>
+#include <target/target_core_configfs.h>
+#include <target/configfs_macros.h>
+#include <asm/unaligned.h>
+
+#include "usbstring.c"
+#include "epautoconf.c"
+#include "config.c"
+#include "composite.c"
+
+#include "tcm_usb_gadget.h"
+
+static struct target_fabric_configfs *usbg_fabric_configfs;
+
+static inline struct f_uas *to_f_uas(struct usb_function *f)
+{
+        return container_of(f, struct f_uas, function);
+}
+
+static void usbg_cmd_release(struct kref *);
+
+static inline void usbg_cleanup_cmd(struct usbg_cmd *cmd)
+{
+        kref_put(&cmd->ref, usbg_cmd_release);
+}
+
+/* Start bot.c code */
+
+static int bot_enqueue_cmd_cbw(struct f_uas *fu)
+{
+        int ret;
+
+        if (fu->flags & USBG_BOT_CMD_PEND)
+                return 0;
+
+        ret = usb_ep_queue(fu->ep_out, fu->cmd.req, GFP_ATOMIC);
+        if (!ret)
+                fu->flags |= USBG_BOT_CMD_PEND;
+        return ret;
+}
+
+static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct usbg_cmd *cmd = req->context;
+        struct f_uas *fu = cmd->fu;
+
+        usbg_cleanup_cmd(cmd);
+        if (req->status < 0) {
+                pr_err("ERR %s(%d)\n", __func__, __LINE__);
+                return;
+        }
+
+        /* CSW completed, wait for next CBW */
+        bot_enqueue_cmd_cbw(fu);
+}
+
+static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
+{
+        struct bulk_cs_wrap *csw = &fu->bot_status.csw;
+        int ret;
+        u8 *sense;
+        unsigned int csw_stat;
+
+        csw_stat = cmd->csw_code;
+
+        /*
+         * We can't send SENSE as a response. So we take ASC & ASCQ from our
+         * sense buffer and queue it and hope the host sends a REQUEST_SENSE
+         * command where it learns why we failed.
+         */
+        sense = cmd->sense_iu.sense;
+
+        csw->Tag = cmd->bot_tag;
+        csw->Status = csw_stat;
+        fu->bot_status.req->context = cmd;
+        ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
+        if (ret)
+                pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
+}
+
+static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
+{
+        struct usbg_cmd *cmd = req->context;
+        struct f_uas *fu = cmd->fu;
+
+        if (req->status < 0)
+                pr_err("ERR %s(%d)\n", __func__, __LINE__);
+
+        if (cmd->data_len) {
+                if (cmd->data_len > ep->maxpacket) {
+                        req->length = ep->maxpacket;
+                        cmd->data_len -= ep->maxpacket;
+                } else {
+                        req->length = cmd->data_len;
+                        cmd->data_len = 0;
+                }
+
+                usb_ep_queue(ep, req, GFP_ATOMIC);
+                return ;
+        }
+        bot_enqueue_sense_code(fu, cmd);
+}
+
+static void bot_send_bad_status(struct usbg_cmd *cmd)
+{
+        struct f_uas *fu = cmd->fu;
+        struct bulk_cs_wrap *csw = &fu->bot_status.csw;
+        struct usb_request *req;
+        struct usb_ep *ep;
+
+        csw->Residue = cpu_to_le32(cmd->data_len);
+
+        if (cmd->data_len) {
+                if (cmd->is_read) {
+                        ep = fu->ep_in;
+                        req = fu->bot_req_in;
+                } else {
+                        ep = fu->ep_out;
+                        req = fu->bot_req_out;
+                }
+
+                if (cmd->data_len > fu->ep_in->maxpacket) {
+                        req->length = ep->maxpacket;
+                        cmd->data_len -= ep->maxpacket;
+                } else {
+                        req->length = cmd->data_len;
+                        cmd->data_len = 0;
+                }
+                req->complete = bot_err_compl;
+                req->context = cmd;
+                req->buf = fu->cmd.buf;
+                usb_ep_queue(ep, req, GFP_KERNEL);
+        } else {
+                bot_enqueue_sense_code(fu, cmd);
+        }
+}
+
+static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
+{
+        struct f_uas *fu = cmd->fu;
+        struct bulk_cs_wrap *csw = &fu->bot_status.csw;
+        int ret;
+
+        if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
+                if (!moved_data && cmd->data_len) {
+                        /*
+                         * the host wants to move data, we don't. Fill / empty