1 /*******************************************************************************
2  * This file contains the iSCSI Target specific Task Management functions.
3  *
4  * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
5  *
6  * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
7  *
8  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  ******************************************************************************/
20 
21 #include <asm/unaligned.h>
22 #include <scsi/scsi_device.h>
23 #include <scsi/iscsi_proto.h>
24 #include <target/target_core_base.h>
25 #include <target/target_core_fabric.h>
26 
27 #include "iscsi_target_core.h"
28 #include "iscsi_target_seq_pdu_list.h"
29 #include "iscsi_target_datain_values.h"
30 #include "iscsi_target_device.h"
31 #include "iscsi_target_erl0.h"
32 #include "iscsi_target_erl1.h"
33 #include "iscsi_target_erl2.h"
34 #include "iscsi_target_tmr.h"
35 #include "iscsi_target_tpg.h"
36 #include "iscsi_target_util.h"
37 #include "iscsi_target.h"
38 
39 u8 iscsit_tmr_abort_task(
40 	struct iscsi_cmd *cmd,
41 	unsigned char *buf)
42 {
43 	struct iscsi_cmd *ref_cmd;
44 	struct iscsi_conn *conn = cmd->conn;
45 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
46 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
47 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
48 
49 	ref_cmd = iscsit_find_cmd_from_itt(conn, hdr->rtt);
50 	if (!ref_cmd) {
51 		pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
52 			" %hu.\n", hdr->rtt, conn->cid);
53 		return ((hdr->refcmdsn >= conn->sess->exp_cmd_sn) &&
54 			(hdr->refcmdsn <= conn->sess->max_cmd_sn)) ?
55 			ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
56 	}
57 	if (ref_cmd->cmd_sn != hdr->refcmdsn) {
58 		pr_err("RefCmdSN 0x%08x does not equal"
59 			" task's CmdSN 0x%08x. Rejecting ABORT_TASK.\n",
60 			hdr->refcmdsn, ref_cmd->cmd_sn);
61 		return ISCSI_TMF_RSP_REJECTED;
62 	}
63 
64 	se_tmr->ref_task_tag		= hdr->rtt;
65 	tmr_req->ref_cmd		= ref_cmd;
66 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
67 	tmr_req->exp_data_sn		= hdr->exp_datasn;
68 
69 	return ISCSI_TMF_RSP_COMPLETE;
70 }
71 
72 /*
73  *	Called from iscsit_handle_task_mgt_cmd().
74  */
75 int iscsit_tmr_task_warm_reset(
76 	struct iscsi_conn *conn,
77 	struct iscsi_tmr_req *tmr_req,
78 	unsigned char *buf)
79 {
80 	struct iscsi_session *sess = conn->sess;
81 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
82 
83 	if (!na->tmr_warm_reset) {
84 		pr_err("TMR Opcode TARGET_WARM_RESET authorization"
85 			" failed for Initiator Node: %s\n",
86 			sess->se_sess->se_node_acl->initiatorname);
87 		 return -1;
88 	}
89 	/*
90 	 * Do the real work in transport_generic_do_tmr().
91 	 */
92 	return 0;
93 }
94 
95 int iscsit_tmr_task_cold_reset(
96 	struct iscsi_conn *conn,
97 	struct iscsi_tmr_req *tmr_req,
98 	unsigned char *buf)
99 {
100 	struct iscsi_session *sess = conn->sess;
101 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
102 
103 	if (!na->tmr_cold_reset) {
104 		pr_err("TMR Opcode TARGET_COLD_RESET authorization"
105 			" failed for Initiator Node: %s\n",
106 			sess->se_sess->se_node_acl->initiatorname);
107 		return -1;
108 	}
109 	/*
110 	 * Do the real work in transport_generic_do_tmr().
111 	 */
112 	return 0;
113 }
114 
115 u8 iscsit_tmr_task_reassign(
116 	struct iscsi_cmd *cmd,
117 	unsigned char *buf)
118 {
119 	struct iscsi_cmd *ref_cmd = NULL;
120 	struct iscsi_conn *conn = cmd->conn;
121 	struct iscsi_conn_recovery *cr = NULL;
122 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
123 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
124 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
125 	int ret, ref_lun;
126 
127 	pr_debug("Got TASK_REASSIGN TMR ITT: 0x%08x,"
128 		" RefTaskTag: 0x%08x, ExpDataSN: 0x%08x, CID: %hu\n",
129 		hdr->itt, hdr->rtt, hdr->exp_datasn, conn->cid);
130 
131 	if (conn->sess->sess_ops->ErrorRecoveryLevel != 2) {
132 		pr_err("TMR TASK_REASSIGN not supported in ERL<2,"
133 				" ignoring request.\n");
134 		return ISCSI_TMF_RSP_NOT_SUPPORTED;
135 	}
136 
137 	ret = iscsit_find_cmd_for_recovery(conn->sess, &ref_cmd, &cr, hdr->rtt);
138 	if (ret == -2) {
139 		pr_err("Command ITT: 0x%08x is still alligent to CID:"
140 			" %hu\n", ref_cmd->init_task_tag, cr->cid);
141 		return ISCSI_TMF_RSP_TASK_ALLEGIANT;
142 	} else if (ret == -1) {
143 		pr_err("Unable to locate RefTaskTag: 0x%08x in"
144 			" connection recovery command list.\n", hdr->rtt);
145 		return ISCSI_TMF_RSP_NO_TASK;
146 	}
147 	/*
148 	 * Temporary check to prevent connection recovery for
149 	 * connections with a differing MaxRecvDataSegmentLength.
150 	 */
151 	if (cr->maxrecvdatasegmentlength !=
152 	    conn->conn_ops->MaxRecvDataSegmentLength) {
153 		pr_err("Unable to perform connection recovery for"
154 			" differing MaxRecvDataSegmentLength, rejecting"
155 			" TMR TASK_REASSIGN.\n");
156 		return ISCSI_TMF_RSP_REJECTED;
157 	}
158 
159 	ref_lun = scsilun_to_int(&hdr->lun);
160 	if (ref_lun != ref_cmd->se_cmd.orig_fe_lun) {
161 		pr_err("Unable to perform connection recovery for"
162 			" differing ref_lun: %d ref_cmd orig_fe_lun: %u\n",
163 			ref_lun, ref_cmd->se_cmd.orig_fe_lun);
164 		return ISCSI_TMF_RSP_REJECTED;
165 	}
166 
167 	se_tmr->ref_task_tag		= hdr->rtt;
168 	tmr_req->ref_cmd		= ref_cmd;
169 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
170 	tmr_req->exp_data_sn		= hdr->exp_datasn;
171 	tmr_req->conn_recovery		= cr;
172 	tmr_req->task_reassign		= 1;
173 	/*
174 	 * Command can now be reassigned to a new connection.
175 	 * The task management response must be sent before the
176 	 * reassignment actually happens.  See iscsi_tmr_post_handler().
177 	 */
178 	return ISCSI_TMF_RSP_COMPLETE;
179 }
180 
181 static void iscsit_task_reassign_remove_cmd(
182 	struct iscsi_cmd *cmd,
183 	struct iscsi_conn_recovery *cr,
184 	struct iscsi_session *sess)
185 {
186 	int ret;
187 
188 	spin_lock(&cr->conn_recovery_cmd_lock);
189 	ret = iscsit_remove_cmd_from_connection_recovery(cmd, sess);
190 	spin_unlock(&cr->conn_recovery_cmd_lock);
191 	if (!ret) {
192 		pr_debug("iSCSI connection recovery successful for CID:"
193 			" %hu on SID: %u\n", cr->cid, sess->sid);
194 		iscsit_remove_active_connection_recovery_entry(cr, sess);
195 	}
196 }
197 
198 static int iscsit_task_reassign_complete_nop_out(
199 	struct iscsi_tmr_req *tmr_req,
200 	struct iscsi_conn *conn)
201 {
202 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
203 	struct iscsi_conn_recovery *cr;
204 
205 	if (!cmd->cr) {
206 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
207 			" is NULL!\n", cmd->init_task_tag);
208 		return -1;
209 	}
210 	cr = cmd->cr;
211 
212 	/*
213 	 * Reset the StatSN so a new one for this commands new connection
214 	 * will be assigned.
215 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
216 	 */
217 	cmd->stat_sn = cmd->exp_stat_sn = 0;
218 
219 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
220 
221 	spin_lock_bh(&conn->cmd_lock);
222 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
223 	spin_unlock_bh(&conn->cmd_lock);
224 
225 	cmd->i_state = ISTATE_SEND_NOPIN;
226 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
227 	return 0;
228 }
229 
230 static int iscsit_task_reassign_complete_write(
231 	struct iscsi_cmd *cmd,
232 	struct iscsi_tmr_req *tmr_req)
233 {
234 	int no_build_r2ts = 0;
235 	u32 length = 0, offset = 0;
236 	struct iscsi_conn *conn = cmd->conn;
237 	struct se_cmd *se_cmd = &cmd->se_cmd;
238 	/*
239 	 * The Initiator must not send a R2T SNACK with a Begrun less than
240 	 * the TMR TASK_REASSIGN's ExpDataSN.
241 	 */
242 	if (!tmr_req->exp_data_sn) {
243 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
244 		cmd->acked_data_sn = 0;
245 	} else {
246 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
247 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
248 	}
249 
250 	/*
251 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next R2TSN the
252 	 * Initiator is expecting.  The Target controls all WRITE operations
253 	 * so if we have received all DataOUT we can safety ignore Initiator.
254 	 */
255 	if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
256 		if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
257 			pr_debug("WRITE ITT: 0x%08x: t_state: %d"
258 				" never sent to transport\n",
259 				cmd->init_task_tag, cmd->se_cmd.t_state);
260 			target_execute_cmd(se_cmd);
261 			return 0;
262 		}
263 
264 		cmd->i_state = ISTATE_SEND_STATUS;
265 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
266 		return 0;
267 	}
268 
269 	/*
270 	 * Special case to deal with DataSequenceInOrder=No and Non-Immeidate
271 	 * Unsolicited DataOut.
272 	 */
273 	if (cmd->unsolicited_data) {
274 		cmd->unsolicited_data = 0;
275 
276 		offset = cmd->next_burst_len = cmd->write_data_done;
277 
278 		if ((conn->sess->sess_ops->FirstBurstLength - offset) >=
279 		     cmd->se_cmd.data_length) {
280 			no_build_r2ts = 1;
281 			length = (cmd->se_cmd.data_length - offset);
282 		} else
283 			length = (conn->sess->sess_ops->FirstBurstLength - offset);
284 
285 		spin_lock_bh(&cmd->r2t_lock);
286 		if (iscsit_add_r2t_to_list(cmd, offset, length, 0, 0) < 0) {
287 			spin_unlock_bh(&cmd->r2t_lock);
288 			return -1;
289 		}
290 		cmd->outstanding_r2ts++;
291 		spin_unlock_bh(&cmd->r2t_lock);
292 
293 		if (no_build_r2ts)
294 			return 0;
295 	}
296 	/*
297 	 * iscsit_build_r2ts_for_cmd() can handle the rest from here.
298 	 */
299 	return iscsit_build_r2ts_for_cmd(cmd, conn, true);
300 }
301 
302 static int iscsit_task_reassign_complete_read(
303 	struct iscsi_cmd *cmd,
304 	struct iscsi_tmr_req *tmr_req)
305 {
306 	struct iscsi_conn *conn = cmd->conn;
307 	struct iscsi_datain_req *dr;
308 	struct se_cmd *se_cmd = &cmd->se_cmd;
309 	/*
310 	 * The Initiator must not send a Data SNACK with a BegRun less than
311 	 * the TMR TASK_REASSIGN's ExpDataSN.
312 	 */
313 	if (!tmr_req->exp_data_sn) {
314 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
315 		cmd->acked_data_sn = 0;
316 	} else {
317 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
318 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
319 	}
320 
321 	if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
322 		pr_debug("READ ITT: 0x%08x: t_state: %d never sent to"
323 			" transport\n", cmd->init_task_tag,
324 			cmd->se_cmd.t_state);
325 		transport_handle_cdb_direct(se_cmd);
326 		return 0;
327 	}
328 
329 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
330 		pr_err("READ ITT: 0x%08x: t_state: %d, never returned"
331 			" from transport\n", cmd->init_task_tag,
332 			cmd->se_cmd.t_state);
333 		return -1;
334 	}
335 
336 	dr = iscsit_allocate_datain_req();
337 	if (!dr)
338 		return -1;
339 	/*
340 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next DataSN the
341 	 * Initiator is expecting.
342 	 */
343 	dr->data_sn = dr->begrun = tmr_req->exp_data_sn;
344 	dr->runlength = 0;
345 	dr->generate_recovery_values = 1;
346 	dr->recovery = DATAIN_CONNECTION_RECOVERY;
347 
348 	iscsit_attach_datain_req(cmd, dr);
349 
350 	cmd->i_state = ISTATE_SEND_DATAIN;
351 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
352 	return 0;
353 }
354 
355 static int iscsit_task_reassign_complete_none(
356 	struct iscsi_cmd *cmd,
357 	struct iscsi_tmr_req *tmr_req)
358 {
359 	struct iscsi_conn *conn = cmd->conn;
360 
361 	cmd->i_state = ISTATE_SEND_STATUS;
362 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
363 	return 0;
364 }
365 
366 static int iscsit_task_reassign_complete_scsi_cmnd(
367 	struct iscsi_tmr_req *tmr_req,
368 	struct iscsi_conn *conn)
369 {
370 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
371 	struct iscsi_conn_recovery *cr;
372 
373 	if (!cmd->cr) {
374 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
375 			" is NULL!\n", cmd->init_task_tag);
376 		return -1;
377 	}
378 	cr = cmd->cr;
379 
380 	/*
381 	 * Reset the StatSN so a new one for this commands new connection
382 	 * will be assigned.
383 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
384 	 */
385 	cmd->stat_sn = cmd->exp_stat_sn = 0;
386 
387 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
388 
389 	spin_lock_bh(&conn->cmd_lock);
390 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
391 	spin_unlock_bh(&conn->cmd_lock);
392 
393 	if (cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
394 		cmd->i_state = ISTATE_SEND_STATUS;
395 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
396 		return 0;
397 	}
398 
399 	switch (cmd->data_direction) {
400 	case DMA_TO_DEVICE:
401 		return iscsit_task_reassign_complete_write(cmd, tmr_req);
402 	case DMA_FROM_DEVICE:
403 		return iscsit_task_reassign_complete_read(cmd, tmr_req);
404 	case DMA_NONE:
405 		return iscsit_task_reassign_complete_none(cmd, tmr_req);
406 	default:
407 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
408 				cmd->data_direction);
409 		return -1;
410 	}
411 
412 	return 0;
413 }
414 
415 static int iscsit_task_reassign_complete(
416 	struct iscsi_tmr_req *tmr_req,
417 	struct iscsi_conn *conn)
418 {
419 	struct iscsi_cmd *cmd;
420 	int ret = 0;
421 
422 	if (!tmr_req->ref_cmd) {
423 		pr_err("TMR Request is missing a RefCmd struct iscsi_cmd.\n");
424 		return -1;
425 	}
426 	cmd = tmr_req->ref_cmd;
427 
428 	cmd->conn = conn;
429 
430 	switch (cmd->iscsi_opcode) {
431 	case ISCSI_OP_NOOP_OUT:
432 		ret = iscsit_task_reassign_complete_nop_out(tmr_req, conn);
433 		break;
434 	case ISCSI_OP_SCSI_CMD:
435 		ret = iscsit_task_reassign_complete_scsi_cmnd(tmr_req, conn);
436 		break;
437 	default:
438 		 pr_err("Illegal iSCSI Opcode 0x%02x during"
439 			" command realligence\n", cmd->iscsi_opcode);
440 		return -1;
441 	}
442 
443 	if (ret != 0)
444 		return ret;
445 
446 	pr_debug("Completed connection realligence for Opcode: 0x%02x,"
447 		" ITT: 0x%08x to CID: %hu.\n", cmd->iscsi_opcode,
448 			cmd->init_task_tag, conn->cid);
449 
450 	return 0;
451 }
452 
453 /*
454  *	Handles special after-the-fact actions related to TMRs.
455  *	Right now the only one that its really needed for is
456  *	connection recovery releated TASK_REASSIGN.
457  */
458 extern int iscsit_tmr_post_handler(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
459 {
460 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
461 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
462 
463 	if (tmr_req->task_reassign &&
464 	   (se_tmr->response == ISCSI_TMF_RSP_COMPLETE))
465 		return iscsit_task_reassign_complete(tmr_req, conn);
466 
467 	return 0;
468 }
469 
470 /*
471  *	Nothing to do here, but leave it for good measure. :-)
472  */
473 int iscsit_task_reassign_prepare_read(
474 	struct iscsi_tmr_req *tmr_req,
475 	struct iscsi_conn *conn)
476 {
477 	return 0;
478 }
479 
480 static void iscsit_task_reassign_prepare_unsolicited_dataout(
481 	struct iscsi_cmd *cmd,
482 	struct iscsi_conn *conn)
483 {
484 	int i, j;
485 	struct iscsi_pdu *pdu = NULL;
486 	struct iscsi_seq *seq = NULL;
487 
488 	if (conn->sess->sess_ops->DataSequenceInOrder) {
489 		cmd->data_sn = 0;
490 
491 		if (cmd->immediate_data)
492 			cmd->r2t_offset += (cmd->first_burst_len -
493 				cmd->seq_start_offset);
494 
495 		if (conn->sess->sess_ops->DataPDUInOrder) {
496 			cmd->write_data_done -= (cmd->immediate_data) ?
497 						(cmd->first_burst_len -
498 						 cmd->seq_start_offset) :
499 						 cmd->first_burst_len;
500 			cmd->first_burst_len = 0;
501 			return;
502 		}
503 
504 		for (i = 0; i < cmd->pdu_count; i++) {
505 			pdu = &cmd->pdu_list[i];
506 
507 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
508 				continue;
509 
510 			if ((pdu->offset >= cmd->seq_start_offset) &&
511 			   ((pdu->offset + pdu->length) <=
512 			     cmd->seq_end_offset)) {
513 				cmd->first_burst_len -= pdu->length;
514 				cmd->write_data_done -= pdu->length;
515 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
516 			}
517 		}
518 	} else {
519 		for (i = 0; i < cmd->seq_count; i++) {
520 			seq = &cmd->seq_list[i];
521 
522 			if (seq->type != SEQTYPE_UNSOLICITED)
523 				continue;
524 
525 			cmd->write_data_done -=
526 					(seq->offset - seq->orig_offset);
527 			cmd->first_burst_len = 0;
528 			seq->data_sn = 0;
529 			seq->offset = seq->orig_offset;
530 			seq->next_burst_len = 0;
531 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
532 
533 			if (conn->sess->sess_ops->DataPDUInOrder)
534 				continue;
535 
536 			for (j = 0; j < seq->pdu_count; j++) {
537 				pdu = &cmd->pdu_list[j+seq->pdu_start];
538 
539 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
540 					continue;
541 
542 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
543 			}
544 		}
545 	}
546 }
547 
548 int iscsit_task_reassign_prepare_write(
549 	struct iscsi_tmr_req *tmr_req,
550 	struct iscsi_conn *conn)
551 {
552 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
553 	struct iscsi_pdu *pdu = NULL;
554 	struct iscsi_r2t *r2t = NULL, *r2t_tmp;
555 	int first_incomplete_r2t = 1, i = 0;
556 
557 	/*
558 	 * The command was in the process of receiving Unsolicited DataOUT when
559 	 * the connection failed.
560 	 */
561 	if (cmd->unsolicited_data)
562 		iscsit_task_reassign_prepare_unsolicited_dataout(cmd, conn);
563 
564 	/*
565 	 * The Initiator is requesting R2Ts starting from zero,  skip
566 	 * checking acknowledged R2Ts and start checking struct iscsi_r2ts
567 	 * greater than zero.
568 	 */
569 	if (!tmr_req->exp_data_sn)
570 		goto drop_unacknowledged_r2ts;
571 
572 	/*
573 	 * We now check that the PDUs in DataOUT sequences below
574 	 * the TMR TASK_REASSIGN ExpDataSN (R2TSN the Initiator is
575 	 * expecting next) have all the DataOUT they require to complete
576 	 * the DataOUT sequence.  First scan from R2TSN 0 to TMR
577 	 * TASK_REASSIGN ExpDataSN-1.
578 	 *
579 	 * If we have not received all DataOUT in question,  we must
580 	 * make sure to make the appropriate changes to values in
581 	 * struct iscsi_cmd (and elsewhere depending on session parameters)
582 	 * so iscsit_build_r2ts_for_cmd() in iscsit_task_reassign_complete_write()
583 	 * will resend a new R2T for the DataOUT sequences in question.
584 	 */
585 	spin_lock_bh(&cmd->r2t_lock);
586 	if (list_empty(&cmd->cmd_r2t_list)) {
587 		spin_unlock_bh(&cmd->r2t_lock);
588 		return -1;
589 	}
590 
591 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
592 
593 		if (r2t->r2t_sn >= tmr_req->exp_data_sn)
594 			continue;
595 		/*
596 		 * Safely ignore Recovery R2Ts and R2Ts that have completed
597 		 * DataOUT sequences.
598 		 */
599 		if (r2t->seq_complete)
600 			continue;
601 
602 		if (r2t->recovery_r2t)
603 			continue;
604 
605 		/*
606 		 *                 DataSequenceInOrder=Yes:
607 		 *
608 		 * Taking into account the iSCSI implementation requirement of
609 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
610 		 * DataSequenceInOrder=Yes, we must take into consideration
611 		 * the following:
612 		 *
613 		 *                  DataSequenceInOrder=No:
614 		 *
615 		 * Taking into account that the Initiator controls the (possibly
616 		 * random) PDU Order in (possibly random) Sequence Order of
617 		 * DataOUT the target requests with R2Ts,  we must take into
618 		 * consideration the following:
619 		 *
620 		 *      DataPDUInOrder=Yes for DataSequenceInOrder=[Yes,No]:
621 		 *
622 		 * While processing non-complete R2T DataOUT sequence requests
623 		 * the Target will re-request only the total sequence length
624 		 * minus current received offset.  This is because we must
625 		 * assume the initiator will continue sending DataOUT from the
626 		 * last PDU before the connection failed.
627 		 *
628 		 *      DataPDUInOrder=No for DataSequenceInOrder=[Yes,No]:
629 		 *
630 		 * While processing non-complete R2T DataOUT sequence requests
631 		 * the Target will re-request the entire DataOUT sequence if
632 		 * any single PDU is missing from the sequence.  This is because
633 		 * we have no logical method to determine the next PDU offset,
634 		 * and we must assume the Initiator will be sending any random
635 		 * PDU offset in the current sequence after TASK_REASSIGN
636 		 * has completed.
637 		 */
638 		if (conn->sess->sess_ops->DataSequenceInOrder) {
639 			if (!first_incomplete_r2t) {
640 				cmd->r2t_offset -= r2t->xfer_len;
641 				goto next;
642 			}
643 
644 			if (conn->sess->sess_ops->DataPDUInOrder) {
645 				cmd->data_sn = 0;
646 				cmd->r2t_offset -= (r2t->xfer_len -
647 					cmd->next_burst_len);
648 				first_incomplete_r2t = 0;
649 				goto next;
650 			}
651 
652 			cmd->data_sn = 0;
653 			cmd->r2t_offset -= r2t->xfer_len;
654 
655 			for (i = 0; i < cmd->pdu_count; i++) {
656 				pdu = &cmd->pdu_list[i];
657 
658 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
659 					continue;
660 
661 				if ((pdu->offset >= r2t->offset) &&
662 				    (pdu->offset < (r2t->offset +
663 						r2t->xfer_len))) {
664 					cmd->next_burst_len -= pdu->length;
665 					cmd->write_data_done -= pdu->length;
666 					pdu->status = ISCSI_PDU_NOT_RECEIVED;
667 				}
668 			}
669 
670 			first_incomplete_r2t = 0;
671 		} else {
672 			struct iscsi_seq *seq;
673 
674 			seq = iscsit_get_seq_holder(cmd, r2t->offset,
675 					r2t->xfer_len);
676 			if (!seq) {
677 				spin_unlock_bh(&cmd->r2t_lock);
678 				return -1;
679 			}
680 
681 			cmd->write_data_done -=
682 					(seq->offset - seq->orig_offset);
683 			seq->data_sn = 0;
684 			seq->offset = seq->orig_offset;
685 			seq->next_burst_len = 0;
686 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
687 
688 			cmd->seq_send_order--;
689 
690 			if (conn->sess->sess_ops->DataPDUInOrder)
691 				goto next;
692 
693 			for (i = 0; i < seq->pdu_count; i++) {
694 				pdu = &cmd->pdu_list[i+seq->pdu_start];
695 
696 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
697 					continue;
698 
699 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
700 			}
701 		}
702 
703 next:
704 		cmd->outstanding_r2ts--;
705 	}
706 	spin_unlock_bh(&cmd->r2t_lock);
707 
708 	/*
709 	 * We now drop all unacknowledged R2Ts, ie: ExpDataSN from TMR
710 	 * TASK_REASSIGN to the last R2T in the list..  We are also careful
711 	 * to check that the Initiator is not requesting R2Ts for DataOUT
712 	 * sequences it has already completed.
713 	 *
714 	 * Free each R2T in question and adjust values in struct iscsi_cmd
715 	 * accordingly so iscsit_build_r2ts_for_cmd() do the rest of
716 	 * the work after the TMR TASK_REASSIGN Response is sent.
717 	 */
718 drop_unacknowledged_r2ts:
719 
720 	cmd->cmd_flags &= ~ICF_SENT_LAST_R2T;
721 	cmd->r2t_sn = tmr_req->exp_data_sn;
722 
723 	spin_lock_bh(&cmd->r2t_lock);
724 	list_for_each_entry_safe(r2t, r2t_tmp, &cmd->cmd_r2t_list, r2t_list) {
725 		/*
726 		 * Skip up to the R2T Sequence number provided by the
727 		 * iSCSI TASK_REASSIGN TMR
728 		 */
729 		if (r2t->r2t_sn < tmr_req->exp_data_sn)
730 			continue;
731 
732 		if (r2t->seq_complete) {
733 			pr_err("Initiator is requesting R2Ts from"
734 				" R2TSN: 0x%08x, but R2TSN: 0x%08x, Offset: %u,"
735 				" Length: %u is already complete."
736 				"   BAD INITIATOR ERL=2 IMPLEMENTATION!\n",
737 				tmr_req->exp_data_sn, r2t->r2t_sn,
738 				r2t->offset, r2t->xfer_len);
739 			spin_unlock_bh(&cmd->r2t_lock);
740 			return -1;
741 		}
742 
743 		if (r2t->recovery_r2t) {
744 			iscsit_free_r2t(r2t, cmd);
745 			continue;
746 		}
747 
748 		/*		   DataSequenceInOrder=Yes:
749 		 *
750 		 * Taking into account the iSCSI implementation requirement of
751 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
752 		 * DataSequenceInOrder=Yes, it's safe to subtract the R2Ts
753 		 * entire transfer length from the commands R2T offset marker.
754 		 *
755 		 *		   DataSequenceInOrder=No:
756 		 *
757 		 * We subtract the difference from struct iscsi_seq between the
758 		 * current offset and original offset from cmd->write_data_done
759 		 * for account for DataOUT PDUs already received.  Then reset
760 		 * the current offset to the original and zero out the current
761 		 * burst length,  to make sure we re-request the entire DataOUT
762 		 * sequence.
763 		 */
764 		if (conn->sess->sess_ops->DataSequenceInOrder)
765 			cmd->r2t_offset -= r2t->xfer_len;
766 		else
767 			cmd->seq_send_order--;
768 
769 		cmd->outstanding_r2ts--;
770 		iscsit_free_r2t(r2t, cmd);
771 	}
772 	spin_unlock_bh(&cmd->r2t_lock);
773 
774 	return 0;
775 }
776 
777 /*
778  *	Performs sanity checks TMR TASK_REASSIGN's ExpDataSN for
779  *	a given struct iscsi_cmd.
780  */
781 int iscsit_check_task_reassign_expdatasn(
782 	struct iscsi_tmr_req *tmr_req,
783 	struct iscsi_conn *conn)
784 {
785 	struct iscsi_cmd *ref_cmd = tmr_req->ref_cmd;
786 
787 	if (ref_cmd->iscsi_opcode != ISCSI_OP_SCSI_CMD)
788 		return 0;
789 
790 	if (ref_cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION)
791 		return 0;
792 
793 	if (ref_cmd->data_direction == DMA_NONE)
794 		return 0;
795 
796 	/*
797 	 * For READs the TMR TASK_REASSIGNs ExpDataSN contains the next DataSN
798 	 * of DataIN the Initiator is expecting.
799 	 *
800 	 * Also check that the Initiator is not re-requesting DataIN that has
801 	 * already been acknowledged with a DataAck SNACK.
802 	 */
803 	if (ref_cmd->data_direction == DMA_FROM_DEVICE) {
804 		if (tmr_req->exp_data_sn > ref_cmd->data_sn) {
805 			pr_err("Received ExpDataSN: 0x%08x for READ"
806 				" in TMR TASK_REASSIGN greater than command's"
807 				" DataSN: 0x%08x.\n", tmr_req->exp_data_sn,
808 				ref_cmd->data_sn);
809 			return -1;
810 		}
811 		if ((ref_cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
812 		    (tmr_req->exp_data_sn <= ref_cmd->acked_data_sn)) {
813 			pr_err("Received ExpDataSN: 0x%08x for READ"
814 				" in TMR TASK_REASSIGN for previously"
815 				" acknowledged DataIN: 0x%08x,"
816 				" protocol error\n", tmr_req->exp_data_sn,
817 				ref_cmd->acked_data_sn);
818 			return -1;
819 		}
820 		return iscsit_task_reassign_prepare_read(tmr_req, conn);
821 	}
822 
823 	/*
824 	 * For WRITEs the TMR TASK_REASSIGNs ExpDataSN contains the next R2TSN
825 	 * for R2Ts the Initiator is expecting.
826 	 *
827 	 * Do the magic in iscsit_task_reassign_prepare_write().
828 	 */
829 	if (ref_cmd->data_direction == DMA_TO_DEVICE) {
830 		if (tmr_req->exp_data_sn > ref_cmd->r2t_sn) {
831 			pr_err("Received ExpDataSN: 0x%08x for WRITE"
832 				" in TMR TASK_REASSIGN greater than command's"
833 				" R2TSN: 0x%08x.\n", tmr_req->exp_data_sn,
834 					ref_cmd->r2t_sn);
835 			return -1;
836 		}
837 		return iscsit_task_reassign_prepare_write(tmr_req, conn);
838 	}
839 
840 	pr_err("Unknown iSCSI data_direction: 0x%02x\n",
841 			ref_cmd->data_direction);
842 
843 	return -1;
844 }
845