1 /*******************************************************************************
2  * This file contains the iSCSI Target specific Task Management functions.
3  *
4  * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
5  *
6  * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
7  *
8  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  ******************************************************************************/
20 
21 #include <asm/unaligned.h>
22 #include <scsi/scsi_device.h>
23 #include <scsi/iscsi_proto.h>
24 #include <target/target_core_base.h>
25 #include <target/target_core_fabric.h>
26 #include <target/iscsi/iscsi_transport.h>
27 
28 #include "iscsi_target_core.h"
29 #include "iscsi_target_seq_pdu_list.h"
30 #include "iscsi_target_datain_values.h"
31 #include "iscsi_target_device.h"
32 #include "iscsi_target_erl0.h"
33 #include "iscsi_target_erl1.h"
34 #include "iscsi_target_erl2.h"
35 #include "iscsi_target_tmr.h"
36 #include "iscsi_target_tpg.h"
37 #include "iscsi_target_util.h"
38 #include "iscsi_target.h"
39 
40 u8 iscsit_tmr_abort_task(
41 	struct iscsi_cmd *cmd,
42 	unsigned char *buf)
43 {
44 	struct iscsi_cmd *ref_cmd;
45 	struct iscsi_conn *conn = cmd->conn;
46 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
47 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
48 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
49 
50 	ref_cmd = iscsit_find_cmd_from_itt(conn, hdr->rtt);
51 	if (!ref_cmd) {
52 		pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
53 			" %hu.\n", hdr->rtt, conn->cid);
54 		return (iscsi_sna_gte(be32_to_cpu(hdr->refcmdsn), conn->sess->exp_cmd_sn) &&
55 			iscsi_sna_lte(be32_to_cpu(hdr->refcmdsn), conn->sess->max_cmd_sn)) ?
56 			ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
57 	}
58 	if (ref_cmd->cmd_sn != be32_to_cpu(hdr->refcmdsn)) {
59 		pr_err("RefCmdSN 0x%08x does not equal"
60 			" task's CmdSN 0x%08x. Rejecting ABORT_TASK.\n",
61 			hdr->refcmdsn, ref_cmd->cmd_sn);
62 		return ISCSI_TMF_RSP_REJECTED;
63 	}
64 
65 	se_tmr->ref_task_tag		= (__force u32)hdr->rtt;
66 	tmr_req->ref_cmd		= ref_cmd;
67 	tmr_req->exp_data_sn		= be32_to_cpu(hdr->exp_datasn);
68 
69 	return ISCSI_TMF_RSP_COMPLETE;
70 }
71 
72 /*
73  *	Called from iscsit_handle_task_mgt_cmd().
74  */
75 int iscsit_tmr_task_warm_reset(
76 	struct iscsi_conn *conn,
77 	struct iscsi_tmr_req *tmr_req,
78 	unsigned char *buf)
79 {
80 	struct iscsi_session *sess = conn->sess;
81 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
82 
83 	if (!na->tmr_warm_reset) {
84 		pr_err("TMR Opcode TARGET_WARM_RESET authorization"
85 			" failed for Initiator Node: %s\n",
86 			sess->se_sess->se_node_acl->initiatorname);
87 		 return -1;
88 	}
89 	/*
90 	 * Do the real work in transport_generic_do_tmr().
91 	 */
92 	return 0;
93 }
94 
95 int iscsit_tmr_task_cold_reset(
96 	struct iscsi_conn *conn,
97 	struct iscsi_tmr_req *tmr_req,
98 	unsigned char *buf)
99 {
100 	struct iscsi_session *sess = conn->sess;
101 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
102 
103 	if (!na->tmr_cold_reset) {
104 		pr_err("TMR Opcode TARGET_COLD_RESET authorization"
105 			" failed for Initiator Node: %s\n",
106 			sess->se_sess->se_node_acl->initiatorname);
107 		return -1;
108 	}
109 	/*
110 	 * Do the real work in transport_generic_do_tmr().
111 	 */
112 	return 0;
113 }
114 
115 u8 iscsit_tmr_task_reassign(
116 	struct iscsi_cmd *cmd,
117 	unsigned char *buf)
118 {
119 	struct iscsi_cmd *ref_cmd = NULL;
120 	struct iscsi_conn *conn = cmd->conn;
121 	struct iscsi_conn_recovery *cr = NULL;
122 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
123 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
124 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
125 	int ret, ref_lun;
126 
127 	pr_debug("Got TASK_REASSIGN TMR ITT: 0x%08x,"
128 		" RefTaskTag: 0x%08x, ExpDataSN: 0x%08x, CID: %hu\n",
129 		hdr->itt, hdr->rtt, hdr->exp_datasn, conn->cid);
130 
131 	if (conn->sess->sess_ops->ErrorRecoveryLevel != 2) {
132 		pr_err("TMR TASK_REASSIGN not supported in ERL<2,"
133 				" ignoring request.\n");
134 		return ISCSI_TMF_RSP_NOT_SUPPORTED;
135 	}
136 
137 	ret = iscsit_find_cmd_for_recovery(conn->sess, &ref_cmd, &cr, hdr->rtt);
138 	if (ret == -2) {
139 		pr_err("Command ITT: 0x%08x is still alligent to CID:"
140 			" %hu\n", ref_cmd->init_task_tag, cr->cid);
141 		return ISCSI_TMF_RSP_TASK_ALLEGIANT;
142 	} else if (ret == -1) {
143 		pr_err("Unable to locate RefTaskTag: 0x%08x in"
144 			" connection recovery command list.\n", hdr->rtt);
145 		return ISCSI_TMF_RSP_NO_TASK;
146 	}
147 	/*
148 	 * Temporary check to prevent connection recovery for
149 	 * connections with a differing Max*DataSegmentLength.
150 	 */
151 	if (cr->maxrecvdatasegmentlength !=
152 	    conn->conn_ops->MaxRecvDataSegmentLength) {
153 		pr_err("Unable to perform connection recovery for"
154 			" differing MaxRecvDataSegmentLength, rejecting"
155 			" TMR TASK_REASSIGN.\n");
156 		return ISCSI_TMF_RSP_REJECTED;
157 	}
158 	if (cr->maxxmitdatasegmentlength !=
159 	    conn->conn_ops->MaxXmitDataSegmentLength) {
160 		pr_err("Unable to perform connection recovery for"
161 			" differing MaxXmitDataSegmentLength, rejecting"
162 			" TMR TASK_REASSIGN.\n");
163 		return ISCSI_TMF_RSP_REJECTED;
164 	}
165 
166 	ref_lun = scsilun_to_int(&hdr->lun);
167 	if (ref_lun != ref_cmd->se_cmd.orig_fe_lun) {
168 		pr_err("Unable to perform connection recovery for"
169 			" differing ref_lun: %d ref_cmd orig_fe_lun: %u\n",
170 			ref_lun, ref_cmd->se_cmd.orig_fe_lun);
171 		return ISCSI_TMF_RSP_REJECTED;
172 	}
173 
174 	se_tmr->ref_task_tag		= (__force u32)hdr->rtt;
175 	tmr_req->ref_cmd		= ref_cmd;
176 	tmr_req->exp_data_sn		= be32_to_cpu(hdr->exp_datasn);
177 	tmr_req->conn_recovery		= cr;
178 	tmr_req->task_reassign		= 1;
179 	/*
180 	 * Command can now be reassigned to a new connection.
181 	 * The task management response must be sent before the
182 	 * reassignment actually happens.  See iscsi_tmr_post_handler().
183 	 */
184 	return ISCSI_TMF_RSP_COMPLETE;
185 }
186 
187 static void iscsit_task_reassign_remove_cmd(
188 	struct iscsi_cmd *cmd,
189 	struct iscsi_conn_recovery *cr,
190 	struct iscsi_session *sess)
191 {
192 	int ret;
193 
194 	spin_lock(&cr->conn_recovery_cmd_lock);
195 	ret = iscsit_remove_cmd_from_connection_recovery(cmd, sess);
196 	spin_unlock(&cr->conn_recovery_cmd_lock);
197 	if (!ret) {
198 		pr_debug("iSCSI connection recovery successful for CID:"
199 			" %hu on SID: %u\n", cr->cid, sess->sid);
200 		iscsit_remove_active_connection_recovery_entry(cr, sess);
201 	}
202 }
203 
204 static int iscsit_task_reassign_complete_nop_out(
205 	struct iscsi_tmr_req *tmr_req,
206 	struct iscsi_conn *conn)
207 {
208 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
209 	struct iscsi_conn_recovery *cr;
210 
211 	if (!cmd->cr) {
212 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
213 			" is NULL!\n", cmd->init_task_tag);
214 		return -1;
215 	}
216 	cr = cmd->cr;
217 
218 	/*
219 	 * Reset the StatSN so a new one for this commands new connection
220 	 * will be assigned.
221 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
222 	 */
223 	cmd->stat_sn = cmd->exp_stat_sn = 0;
224 
225 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
226 
227 	spin_lock_bh(&conn->cmd_lock);
228 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
229 	spin_unlock_bh(&conn->cmd_lock);
230 
231 	cmd->i_state = ISTATE_SEND_NOPIN;
232 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
233 	return 0;
234 }
235 
236 static int iscsit_task_reassign_complete_write(
237 	struct iscsi_cmd *cmd,
238 	struct iscsi_tmr_req *tmr_req)
239 {
240 	int no_build_r2ts = 0;
241 	u32 length = 0, offset = 0;
242 	struct iscsi_conn *conn = cmd->conn;
243 	struct se_cmd *se_cmd = &cmd->se_cmd;
244 	/*
245 	 * The Initiator must not send a R2T SNACK with a Begrun less than
246 	 * the TMR TASK_REASSIGN's ExpDataSN.
247 	 */
248 	if (!tmr_req->exp_data_sn) {
249 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
250 		cmd->acked_data_sn = 0;
251 	} else {
252 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
253 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
254 	}
255 
256 	/*
257 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next R2TSN the
258 	 * Initiator is expecting.  The Target controls all WRITE operations
259 	 * so if we have received all DataOUT we can safety ignore Initiator.
260 	 */
261 	if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
262 		if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
263 			pr_debug("WRITE ITT: 0x%08x: t_state: %d"
264 				" never sent to transport\n",
265 				cmd->init_task_tag, cmd->se_cmd.t_state);
266 			target_execute_cmd(se_cmd);
267 			return 0;
268 		}
269 
270 		cmd->i_state = ISTATE_SEND_STATUS;
271 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
272 		return 0;
273 	}
274 
275 	/*
276 	 * Special case to deal with DataSequenceInOrder=No and Non-Immeidate
277 	 * Unsolicited DataOut.
278 	 */
279 	if (cmd->unsolicited_data) {
280 		cmd->unsolicited_data = 0;
281 
282 		offset = cmd->next_burst_len = cmd->write_data_done;
283 
284 		if ((conn->sess->sess_ops->FirstBurstLength - offset) >=
285 		     cmd->se_cmd.data_length) {
286 			no_build_r2ts = 1;
287 			length = (cmd->se_cmd.data_length - offset);
288 		} else
289 			length = (conn->sess->sess_ops->FirstBurstLength - offset);
290 
291 		spin_lock_bh(&cmd->r2t_lock);
292 		if (iscsit_add_r2t_to_list(cmd, offset, length, 0, 0) < 0) {
293 			spin_unlock_bh(&cmd->r2t_lock);
294 			return -1;
295 		}
296 		cmd->outstanding_r2ts++;
297 		spin_unlock_bh(&cmd->r2t_lock);
298 
299 		if (no_build_r2ts)
300 			return 0;
301 	}
302 	/*
303 	 * iscsit_build_r2ts_for_cmd() can handle the rest from here.
304 	 */
305 	return conn->conn_transport->iscsit_get_dataout(conn, cmd, true);
306 }
307 
308 static int iscsit_task_reassign_complete_read(
309 	struct iscsi_cmd *cmd,
310 	struct iscsi_tmr_req *tmr_req)
311 {
312 	struct iscsi_conn *conn = cmd->conn;
313 	struct iscsi_datain_req *dr;
314 	struct se_cmd *se_cmd = &cmd->se_cmd;
315 	/*
316 	 * The Initiator must not send a Data SNACK with a BegRun less than
317 	 * the TMR TASK_REASSIGN's ExpDataSN.
318 	 */
319 	if (!tmr_req->exp_data_sn) {
320 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
321 		cmd->acked_data_sn = 0;
322 	} else {
323 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
324 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
325 	}
326 
327 	if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
328 		pr_debug("READ ITT: 0x%08x: t_state: %d never sent to"
329 			" transport\n", cmd->init_task_tag,
330 			cmd->se_cmd.t_state);
331 		transport_handle_cdb_direct(se_cmd);
332 		return 0;
333 	}
334 
335 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
336 		pr_err("READ ITT: 0x%08x: t_state: %d, never returned"
337 			" from transport\n", cmd->init_task_tag,
338 			cmd->se_cmd.t_state);
339 		return -1;
340 	}
341 
342 	dr = iscsit_allocate_datain_req();
343 	if (!dr)
344 		return -1;
345 	/*
346 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next DataSN the
347 	 * Initiator is expecting.
348 	 */
349 	dr->data_sn = dr->begrun = tmr_req->exp_data_sn;
350 	dr->runlength = 0;
351 	dr->generate_recovery_values = 1;
352 	dr->recovery = DATAIN_CONNECTION_RECOVERY;
353 
354 	iscsit_attach_datain_req(cmd, dr);
355 
356 	cmd->i_state = ISTATE_SEND_DATAIN;
357 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
358 	return 0;
359 }
360 
361 static int iscsit_task_reassign_complete_none(
362 	struct iscsi_cmd *cmd,
363 	struct iscsi_tmr_req *tmr_req)
364 {
365 	struct iscsi_conn *conn = cmd->conn;
366 
367 	cmd->i_state = ISTATE_SEND_STATUS;
368 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
369 	return 0;
370 }
371 
372 static int iscsit_task_reassign_complete_scsi_cmnd(
373 	struct iscsi_tmr_req *tmr_req,
374 	struct iscsi_conn *conn)
375 {
376 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
377 	struct iscsi_conn_recovery *cr;
378 
379 	if (!cmd->cr) {
380 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
381 			" is NULL!\n", cmd->init_task_tag);
382 		return -1;
383 	}
384 	cr = cmd->cr;
385 
386 	/*
387 	 * Reset the StatSN so a new one for this commands new connection
388 	 * will be assigned.
389 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
390 	 */
391 	cmd->stat_sn = cmd->exp_stat_sn = 0;
392 
393 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
394 
395 	spin_lock_bh(&conn->cmd_lock);
396 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
397 	spin_unlock_bh(&conn->cmd_lock);
398 
399 	if (cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
400 		cmd->i_state = ISTATE_SEND_STATUS;
401 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
402 		return 0;
403 	}
404 
405 	switch (cmd->data_direction) {
406 	case DMA_TO_DEVICE:
407 		return iscsit_task_reassign_complete_write(cmd, tmr_req);
408 	case DMA_FROM_DEVICE:
409 		return iscsit_task_reassign_complete_read(cmd, tmr_req);
410 	case DMA_NONE:
411 		return iscsit_task_reassign_complete_none(cmd, tmr_req);
412 	default:
413 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
414 				cmd->data_direction);
415 		return -1;
416 	}
417 
418 	return 0;
419 }
420 
421 static int iscsit_task_reassign_complete(
422 	struct iscsi_tmr_req *tmr_req,
423 	struct iscsi_conn *conn)
424 {
425 	struct iscsi_cmd *cmd;
426 	int ret = 0;
427 
428 	if (!tmr_req->ref_cmd) {
429 		pr_err("TMR Request is missing a RefCmd struct iscsi_cmd.\n");
430 		return -1;
431 	}
432 	cmd = tmr_req->ref_cmd;
433 
434 	cmd->conn = conn;
435 
436 	switch (cmd->iscsi_opcode) {
437 	case ISCSI_OP_NOOP_OUT:
438 		ret = iscsit_task_reassign_complete_nop_out(tmr_req, conn);
439 		break;
440 	case ISCSI_OP_SCSI_CMD:
441 		ret = iscsit_task_reassign_complete_scsi_cmnd(tmr_req, conn);
442 		break;
443 	default:
444 		 pr_err("Illegal iSCSI Opcode 0x%02x during"
445 			" command realligence\n", cmd->iscsi_opcode);
446 		return -1;
447 	}
448 
449 	if (ret != 0)
450 		return ret;
451 
452 	pr_debug("Completed connection realligence for Opcode: 0x%02x,"
453 		" ITT: 0x%08x to CID: %hu.\n", cmd->iscsi_opcode,
454 			cmd->init_task_tag, conn->cid);
455 
456 	return 0;
457 }
458 
459 /*
460  *	Handles special after-the-fact actions related to TMRs.
461  *	Right now the only one that its really needed for is
462  *	connection recovery releated TASK_REASSIGN.
463  */
464 int iscsit_tmr_post_handler(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
465 {
466 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
467 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
468 
469 	if (tmr_req->task_reassign &&
470 	   (se_tmr->response == ISCSI_TMF_RSP_COMPLETE))
471 		return iscsit_task_reassign_complete(tmr_req, conn);
472 
473 	return 0;
474 }
475 
476 /*
477  *	Nothing to do here, but leave it for good measure. :-)
478  */
479 static int iscsit_task_reassign_prepare_read(
480 	struct iscsi_tmr_req *tmr_req,
481 	struct iscsi_conn *conn)
482 {
483 	return 0;
484 }
485 
486 static void iscsit_task_reassign_prepare_unsolicited_dataout(
487 	struct iscsi_cmd *cmd,
488 	struct iscsi_conn *conn)
489 {
490 	int i, j;
491 	struct iscsi_pdu *pdu = NULL;
492 	struct iscsi_seq *seq = NULL;
493 
494 	if (conn->sess->sess_ops->DataSequenceInOrder) {
495 		cmd->data_sn = 0;
496 
497 		if (cmd->immediate_data)
498 			cmd->r2t_offset += (cmd->first_burst_len -
499 				cmd->seq_start_offset);
500 
501 		if (conn->sess->sess_ops->DataPDUInOrder) {
502 			cmd->write_data_done -= (cmd->immediate_data) ?
503 						(cmd->first_burst_len -
504 						 cmd->seq_start_offset) :
505 						 cmd->first_burst_len;
506 			cmd->first_burst_len = 0;
507 			return;
508 		}
509 
510 		for (i = 0; i < cmd->pdu_count; i++) {
511 			pdu = &cmd->pdu_list[i];
512 
513 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
514 				continue;
515 
516 			if ((pdu->offset >= cmd->seq_start_offset) &&
517 			   ((pdu->offset + pdu->length) <=
518 			     cmd->seq_end_offset)) {
519 				cmd->first_burst_len -= pdu->length;
520 				cmd->write_data_done -= pdu->length;
521 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
522 			}
523 		}
524 	} else {
525 		for (i = 0; i < cmd->seq_count; i++) {
526 			seq = &cmd->seq_list[i];
527 
528 			if (seq->type != SEQTYPE_UNSOLICITED)
529 				continue;
530 
531 			cmd->write_data_done -=
532 					(seq->offset - seq->orig_offset);
533 			cmd->first_burst_len = 0;
534 			seq->data_sn = 0;
535 			seq->offset = seq->orig_offset;
536 			seq->next_burst_len = 0;
537 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
538 
539 			if (conn->sess->sess_ops->DataPDUInOrder)
540 				continue;
541 
542 			for (j = 0; j < seq->pdu_count; j++) {
543 				pdu = &cmd->pdu_list[j+seq->pdu_start];
544 
545 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
546 					continue;
547 
548 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
549 			}
550 		}
551 	}
552 }
553 
554 static int iscsit_task_reassign_prepare_write(
555 	struct iscsi_tmr_req *tmr_req,
556 	struct iscsi_conn *conn)
557 {
558 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
559 	struct iscsi_pdu *pdu = NULL;
560 	struct iscsi_r2t *r2t = NULL, *r2t_tmp;
561 	int first_incomplete_r2t = 1, i = 0;
562 
563 	/*
564 	 * The command was in the process of receiving Unsolicited DataOUT when
565 	 * the connection failed.
566 	 */
567 	if (cmd->unsolicited_data)
568 		iscsit_task_reassign_prepare_unsolicited_dataout(cmd, conn);
569 
570 	/*
571 	 * The Initiator is requesting R2Ts starting from zero,  skip
572 	 * checking acknowledged R2Ts and start checking struct iscsi_r2ts
573 	 * greater than zero.
574 	 */
575 	if (!tmr_req->exp_data_sn)
576 		goto drop_unacknowledged_r2ts;
577 
578 	/*
579 	 * We now check that the PDUs in DataOUT sequences below
580 	 * the TMR TASK_REASSIGN ExpDataSN (R2TSN the Initiator is
581 	 * expecting next) have all the DataOUT they require to complete
582 	 * the DataOUT sequence.  First scan from R2TSN 0 to TMR
583 	 * TASK_REASSIGN ExpDataSN-1.
584 	 *
585 	 * If we have not received all DataOUT in question,  we must
586 	 * make sure to make the appropriate changes to values in
587 	 * struct iscsi_cmd (and elsewhere depending on session parameters)
588 	 * so iscsit_build_r2ts_for_cmd() in iscsit_task_reassign_complete_write()
589 	 * will resend a new R2T for the DataOUT sequences in question.
590 	 */
591 	spin_lock_bh(&cmd->r2t_lock);
592 	if (list_empty(&cmd->cmd_r2t_list)) {
593 		spin_unlock_bh(&cmd->r2t_lock);
594 		return -1;
595 	}
596 
597 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
598 
599 		if (r2t->r2t_sn >= tmr_req->exp_data_sn)
600 			continue;
601 		/*
602 		 * Safely ignore Recovery R2Ts and R2Ts that have completed
603 		 * DataOUT sequences.
604 		 */
605 		if (r2t->seq_complete)
606 			continue;
607 
608 		if (r2t->recovery_r2t)
609 			continue;
610 
611 		/*
612 		 *                 DataSequenceInOrder=Yes:
613 		 *
614 		 * Taking into account the iSCSI implementation requirement of
615 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
616 		 * DataSequenceInOrder=Yes, we must take into consideration
617 		 * the following:
618 		 *
619 		 *                  DataSequenceInOrder=No:
620 		 *
621 		 * Taking into account that the Initiator controls the (possibly
622 		 * random) PDU Order in (possibly random) Sequence Order of
623 		 * DataOUT the target requests with R2Ts,  we must take into
624 		 * consideration the following:
625 		 *
626 		 *      DataPDUInOrder=Yes for DataSequenceInOrder=[Yes,No]:
627 		 *
628 		 * While processing non-complete R2T DataOUT sequence requests
629 		 * the Target will re-request only the total sequence length
630 		 * minus current received offset.  This is because we must
631 		 * assume the initiator will continue sending DataOUT from the
632 		 * last PDU before the connection failed.
633 		 *
634 		 *      DataPDUInOrder=No for DataSequenceInOrder=[Yes,No]:
635 		 *
636 		 * While processing non-complete R2T DataOUT sequence requests
637 		 * the Target will re-request the entire DataOUT sequence if
638 		 * any single PDU is missing from the sequence.  This is because
639 		 * we have no logical method to determine the next PDU offset,
640 		 * and we must assume the Initiator will be sending any random
641 		 * PDU offset in the current sequence after TASK_REASSIGN
642 		 * has completed.
643 		 */
644 		if (conn->sess->sess_ops->DataSequenceInOrder) {
645 			if (!first_incomplete_r2t) {
646 				cmd->r2t_offset -= r2t->xfer_len;
647 				goto next;
648 			}
649 
650 			if (conn->sess->sess_ops->DataPDUInOrder) {
651 				cmd->data_sn = 0;
652 				cmd->r2t_offset -= (r2t->xfer_len -
653 					cmd->next_burst_len);
654 				first_incomplete_r2t = 0;
655 				goto next;
656 			}
657 
658 			cmd->data_sn = 0;
659 			cmd->r2t_offset -= r2t->xfer_len;
660 
661 			for (i = 0; i < cmd->pdu_count; i++) {
662 				pdu = &cmd->pdu_list[i];
663 
664 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
665 					continue;
666 
667 				if ((pdu->offset >= r2t->offset) &&
668 				    (pdu->offset < (r2t->offset +
669 						r2t->xfer_len))) {
670 					cmd->next_burst_len -= pdu->length;
671 					cmd->write_data_done -= pdu->length;
672 					pdu->status = ISCSI_PDU_NOT_RECEIVED;
673 				}
674 			}
675 
676 			first_incomplete_r2t = 0;
677 		} else {
678 			struct iscsi_seq *seq;
679 
680 			seq = iscsit_get_seq_holder(cmd, r2t->offset,
681 					r2t->xfer_len);
682 			if (!seq) {
683 				spin_unlock_bh(&cmd->r2t_lock);
684 				return -1;
685 			}
686 
687 			cmd->write_data_done -=
688 					(seq->offset - seq->orig_offset);
689 			seq->data_sn = 0;
690 			seq->offset = seq->orig_offset;
691 			seq->next_burst_len = 0;
692 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
693 
694 			cmd->seq_send_order--;
695 
696 			if (conn->sess->sess_ops->DataPDUInOrder)
697 				goto next;
698 
699 			for (i = 0; i < seq->pdu_count; i++) {
700 				pdu = &cmd->pdu_list[i+seq->pdu_start];
701 
702 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
703 					continue;
704 
705 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
706 			}
707 		}
708 
709 next:
710 		cmd->outstanding_r2ts--;
711 	}
712 	spin_unlock_bh(&cmd->r2t_lock);
713 
714 	/*
715 	 * We now drop all unacknowledged R2Ts, ie: ExpDataSN from TMR
716 	 * TASK_REASSIGN to the last R2T in the list..  We are also careful
717 	 * to check that the Initiator is not requesting R2Ts for DataOUT
718 	 * sequences it has already completed.
719 	 *
720 	 * Free each R2T in question and adjust values in struct iscsi_cmd
721 	 * accordingly so iscsit_build_r2ts_for_cmd() do the rest of
722 	 * the work after the TMR TASK_REASSIGN Response is sent.
723 	 */
724 drop_unacknowledged_r2ts:
725 
726 	cmd->cmd_flags &= ~ICF_SENT_LAST_R2T;
727 	cmd->r2t_sn = tmr_req->exp_data_sn;
728 
729 	spin_lock_bh(&cmd->r2t_lock);
730 	list_for_each_entry_safe(r2t, r2t_tmp, &cmd->cmd_r2t_list, r2t_list) {
731 		/*
732 		 * Skip up to the R2T Sequence number provided by the
733 		 * iSCSI TASK_REASSIGN TMR
734 		 */
735 		if (r2t->r2t_sn < tmr_req->exp_data_sn)
736 			continue;
737 
738 		if (r2t->seq_complete) {
739 			pr_err("Initiator is requesting R2Ts from"
740 				" R2TSN: 0x%08x, but R2TSN: 0x%08x, Offset: %u,"
741 				" Length: %u is already complete."
742 				"   BAD INITIATOR ERL=2 IMPLEMENTATION!\n",
743 				tmr_req->exp_data_sn, r2t->r2t_sn,
744 				r2t->offset, r2t->xfer_len);
745 			spin_unlock_bh(&cmd->r2t_lock);
746 			return -1;
747 		}
748 
749 		if (r2t->recovery_r2t) {
750 			iscsit_free_r2t(r2t, cmd);
751 			continue;
752 		}
753 
754 		/*		   DataSequenceInOrder=Yes:
755 		 *
756 		 * Taking into account the iSCSI implementation requirement of
757 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
758 		 * DataSequenceInOrder=Yes, it's safe to subtract the R2Ts
759 		 * entire transfer length from the commands R2T offset marker.
760 		 *
761 		 *		   DataSequenceInOrder=No:
762 		 *
763 		 * We subtract the difference from struct iscsi_seq between the
764 		 * current offset and original offset from cmd->write_data_done
765 		 * for account for DataOUT PDUs already received.  Then reset
766 		 * the current offset to the original and zero out the current
767 		 * burst length,  to make sure we re-request the entire DataOUT
768 		 * sequence.
769 		 */
770 		if (conn->sess->sess_ops->DataSequenceInOrder)
771 			cmd->r2t_offset -= r2t->xfer_len;
772 		else
773 			cmd->seq_send_order--;
774 
775 		cmd->outstanding_r2ts--;
776 		iscsit_free_r2t(r2t, cmd);
777 	}
778 	spin_unlock_bh(&cmd->r2t_lock);
779 
780 	return 0;
781 }
782 
783 /*
784  *	Performs sanity checks TMR TASK_REASSIGN's ExpDataSN for
785  *	a given struct iscsi_cmd.
786  */
787 int iscsit_check_task_reassign_expdatasn(
788 	struct iscsi_tmr_req *tmr_req,
789 	struct iscsi_conn *conn)
790 {
791 	struct iscsi_cmd *ref_cmd = tmr_req->ref_cmd;
792 
793 	if (ref_cmd->iscsi_opcode != ISCSI_OP_SCSI_CMD)
794 		return 0;
795 
796 	if (ref_cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION)
797 		return 0;
798 
799 	if (ref_cmd->data_direction == DMA_NONE)
800 		return 0;
801 
802 	/*
803 	 * For READs the TMR TASK_REASSIGNs ExpDataSN contains the next DataSN
804 	 * of DataIN the Initiator is expecting.
805 	 *
806 	 * Also check that the Initiator is not re-requesting DataIN that has
807 	 * already been acknowledged with a DataAck SNACK.
808 	 */
809 	if (ref_cmd->data_direction == DMA_FROM_DEVICE) {
810 		if (tmr_req->exp_data_sn > ref_cmd->data_sn) {
811 			pr_err("Received ExpDataSN: 0x%08x for READ"
812 				" in TMR TASK_REASSIGN greater than command's"
813 				" DataSN: 0x%08x.\n", tmr_req->exp_data_sn,
814 				ref_cmd->data_sn);
815 			return -1;
816 		}
817 		if ((ref_cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
818 		    (tmr_req->exp_data_sn <= ref_cmd->acked_data_sn)) {
819 			pr_err("Received ExpDataSN: 0x%08x for READ"
820 				" in TMR TASK_REASSIGN for previously"
821 				" acknowledged DataIN: 0x%08x,"
822 				" protocol error\n", tmr_req->exp_data_sn,
823 				ref_cmd->acked_data_sn);
824 			return -1;
825 		}
826 		return iscsit_task_reassign_prepare_read(tmr_req, conn);
827 	}
828 
829 	/*
830 	 * For WRITEs the TMR TASK_REASSIGNs ExpDataSN contains the next R2TSN
831 	 * for R2Ts the Initiator is expecting.
832 	 *
833 	 * Do the magic in iscsit_task_reassign_prepare_write().
834 	 */
835 	if (ref_cmd->data_direction == DMA_TO_DEVICE) {
836 		if (tmr_req->exp_data_sn > ref_cmd->r2t_sn) {
837 			pr_err("Received ExpDataSN: 0x%08x for WRITE"
838 				" in TMR TASK_REASSIGN greater than command's"
839 				" R2TSN: 0x%08x.\n", tmr_req->exp_data_sn,
840 					ref_cmd->r2t_sn);
841 			return -1;
842 		}
843 		return iscsit_task_reassign_prepare_write(tmr_req, conn);
844 	}
845 
846 	pr_err("Unknown iSCSI data_direction: 0x%02x\n",
847 			ref_cmd->data_direction);
848 
849 	return -1;
850 }
851