1 /*******************************************************************************
2  * This file contains the iSCSI Target specific Task Management functions.
3  *
4  * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
5  *
6  * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
7  *
8  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  ******************************************************************************/
20 
21 #include <asm/unaligned.h>
22 #include <scsi/iscsi_proto.h>
23 #include <target/target_core_base.h>
24 #include <target/target_core_fabric.h>
25 
26 #include "iscsi_target_core.h"
27 #include "iscsi_target_seq_pdu_list.h"
28 #include "iscsi_target_datain_values.h"
29 #include "iscsi_target_device.h"
30 #include "iscsi_target_erl0.h"
31 #include "iscsi_target_erl1.h"
32 #include "iscsi_target_erl2.h"
33 #include "iscsi_target_tmr.h"
34 #include "iscsi_target_tpg.h"
35 #include "iscsi_target_util.h"
36 #include "iscsi_target.h"
37 
38 u8 iscsit_tmr_abort_task(
39 	struct iscsi_cmd *cmd,
40 	unsigned char *buf)
41 {
42 	struct iscsi_cmd *ref_cmd;
43 	struct iscsi_conn *conn = cmd->conn;
44 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
45 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
46 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
47 
48 	ref_cmd = iscsit_find_cmd_from_itt(conn, hdr->rtt);
49 	if (!ref_cmd) {
50 		pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
51 			" %hu.\n", hdr->rtt, conn->cid);
52 		return ((hdr->refcmdsn >= conn->sess->exp_cmd_sn) &&
53 			(hdr->refcmdsn <= conn->sess->max_cmd_sn)) ?
54 			ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
55 	}
56 	if (ref_cmd->cmd_sn != hdr->refcmdsn) {
57 		pr_err("RefCmdSN 0x%08x does not equal"
58 			" task's CmdSN 0x%08x. Rejecting ABORT_TASK.\n",
59 			hdr->refcmdsn, ref_cmd->cmd_sn);
60 		return ISCSI_TMF_RSP_REJECTED;
61 	}
62 
63 	se_tmr->ref_task_tag		= hdr->rtt;
64 	se_tmr->ref_cmd			= &ref_cmd->se_cmd;
65 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
66 	tmr_req->exp_data_sn		= hdr->exp_datasn;
67 
68 	return ISCSI_TMF_RSP_COMPLETE;
69 }
70 
71 /*
72  *	Called from iscsit_handle_task_mgt_cmd().
73  */
74 int iscsit_tmr_task_warm_reset(
75 	struct iscsi_conn *conn,
76 	struct iscsi_tmr_req *tmr_req,
77 	unsigned char *buf)
78 {
79 	struct iscsi_session *sess = conn->sess;
80 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
81 
82 	if (!na->tmr_warm_reset) {
83 		pr_err("TMR Opcode TARGET_WARM_RESET authorization"
84 			" failed for Initiator Node: %s\n",
85 			sess->se_sess->se_node_acl->initiatorname);
86 		 return -1;
87 	}
88 	/*
89 	 * Do the real work in transport_generic_do_tmr().
90 	 */
91 	return 0;
92 }
93 
94 int iscsit_tmr_task_cold_reset(
95 	struct iscsi_conn *conn,
96 	struct iscsi_tmr_req *tmr_req,
97 	unsigned char *buf)
98 {
99 	struct iscsi_session *sess = conn->sess;
100 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
101 
102 	if (!na->tmr_cold_reset) {
103 		pr_err("TMR Opcode TARGET_COLD_RESET authorization"
104 			" failed for Initiator Node: %s\n",
105 			sess->se_sess->se_node_acl->initiatorname);
106 		return -1;
107 	}
108 	/*
109 	 * Do the real work in transport_generic_do_tmr().
110 	 */
111 	return 0;
112 }
113 
114 u8 iscsit_tmr_task_reassign(
115 	struct iscsi_cmd *cmd,
116 	unsigned char *buf)
117 {
118 	struct iscsi_cmd *ref_cmd = NULL;
119 	struct iscsi_conn *conn = cmd->conn;
120 	struct iscsi_conn_recovery *cr = NULL;
121 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
122 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
123 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
124 	int ret;
125 
126 	pr_debug("Got TASK_REASSIGN TMR ITT: 0x%08x,"
127 		" RefTaskTag: 0x%08x, ExpDataSN: 0x%08x, CID: %hu\n",
128 		hdr->itt, hdr->rtt, hdr->exp_datasn, conn->cid);
129 
130 	if (conn->sess->sess_ops->ErrorRecoveryLevel != 2) {
131 		pr_err("TMR TASK_REASSIGN not supported in ERL<2,"
132 				" ignoring request.\n");
133 		return ISCSI_TMF_RSP_NOT_SUPPORTED;
134 	}
135 
136 	ret = iscsit_find_cmd_for_recovery(conn->sess, &ref_cmd, &cr, hdr->rtt);
137 	if (ret == -2) {
138 		pr_err("Command ITT: 0x%08x is still alligent to CID:"
139 			" %hu\n", ref_cmd->init_task_tag, cr->cid);
140 		return ISCSI_TMF_RSP_TASK_ALLEGIANT;
141 	} else if (ret == -1) {
142 		pr_err("Unable to locate RefTaskTag: 0x%08x in"
143 			" connection recovery command list.\n", hdr->rtt);
144 		return ISCSI_TMF_RSP_NO_TASK;
145 	}
146 	/*
147 	 * Temporary check to prevent connection recovery for
148 	 * connections with a differing MaxRecvDataSegmentLength.
149 	 */
150 	if (cr->maxrecvdatasegmentlength !=
151 	    conn->conn_ops->MaxRecvDataSegmentLength) {
152 		pr_err("Unable to perform connection recovery for"
153 			" differing MaxRecvDataSegmentLength, rejecting"
154 			" TMR TASK_REASSIGN.\n");
155 		return ISCSI_TMF_RSP_REJECTED;
156 	}
157 
158 	se_tmr->ref_task_tag		= hdr->rtt;
159 	se_tmr->ref_cmd			= &ref_cmd->se_cmd;
160 	se_tmr->ref_task_lun		= get_unaligned_le64(&hdr->lun);
161 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
162 	tmr_req->exp_data_sn		= hdr->exp_datasn;
163 	tmr_req->conn_recovery		= cr;
164 	tmr_req->task_reassign		= 1;
165 	/*
166 	 * Command can now be reassigned to a new connection.
167 	 * The task management response must be sent before the
168 	 * reassignment actually happens.  See iscsi_tmr_post_handler().
169 	 */
170 	return ISCSI_TMF_RSP_COMPLETE;
171 }
172 
173 static void iscsit_task_reassign_remove_cmd(
174 	struct iscsi_cmd *cmd,
175 	struct iscsi_conn_recovery *cr,
176 	struct iscsi_session *sess)
177 {
178 	int ret;
179 
180 	spin_lock(&cr->conn_recovery_cmd_lock);
181 	ret = iscsit_remove_cmd_from_connection_recovery(cmd, sess);
182 	spin_unlock(&cr->conn_recovery_cmd_lock);
183 	if (!ret) {
184 		pr_debug("iSCSI connection recovery successful for CID:"
185 			" %hu on SID: %u\n", cr->cid, sess->sid);
186 		iscsit_remove_active_connection_recovery_entry(cr, sess);
187 	}
188 }
189 
190 static int iscsit_task_reassign_complete_nop_out(
191 	struct iscsi_tmr_req *tmr_req,
192 	struct iscsi_conn *conn)
193 {
194 	struct se_tmr_req *se_tmr = tmr_req->se_tmr_req;
195 	struct se_cmd *se_cmd = se_tmr->ref_cmd;
196 	struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
197 	struct iscsi_conn_recovery *cr;
198 
199 	if (!cmd->cr) {
200 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
201 			" is NULL!\n", cmd->init_task_tag);
202 		return -1;
203 	}
204 	cr = cmd->cr;
205 
206 	/*
207 	 * Reset the StatSN so a new one for this commands new connection
208 	 * will be assigned.
209 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
210 	 */
211 	cmd->stat_sn = cmd->exp_stat_sn = 0;
212 
213 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
214 
215 	spin_lock_bh(&conn->cmd_lock);
216 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
217 	spin_unlock_bh(&conn->cmd_lock);
218 
219 	cmd->i_state = ISTATE_SEND_NOPIN;
220 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
221 	return 0;
222 }
223 
224 static int iscsit_task_reassign_complete_write(
225 	struct iscsi_cmd *cmd,
226 	struct iscsi_tmr_req *tmr_req)
227 {
228 	int no_build_r2ts = 0;
229 	u32 length = 0, offset = 0;
230 	struct iscsi_conn *conn = cmd->conn;
231 	struct se_cmd *se_cmd = &cmd->se_cmd;
232 	/*
233 	 * The Initiator must not send a R2T SNACK with a Begrun less than
234 	 * the TMR TASK_REASSIGN's ExpDataSN.
235 	 */
236 	if (!tmr_req->exp_data_sn) {
237 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
238 		cmd->acked_data_sn = 0;
239 	} else {
240 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
241 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
242 	}
243 
244 	/*
245 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next R2TSN the
246 	 * Initiator is expecting.  The Target controls all WRITE operations
247 	 * so if we have received all DataOUT we can safety ignore Initiator.
248 	 */
249 	if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
250 		if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
251 			pr_debug("WRITE ITT: 0x%08x: t_state: %d"
252 				" never sent to transport\n",
253 				cmd->init_task_tag, cmd->se_cmd.t_state);
254 			return transport_generic_handle_data(se_cmd);
255 		}
256 
257 		cmd->i_state = ISTATE_SEND_STATUS;
258 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
259 		return 0;
260 	}
261 
262 	/*
263 	 * Special case to deal with DataSequenceInOrder=No and Non-Immeidate
264 	 * Unsolicited DataOut.
265 	 */
266 	if (cmd->unsolicited_data) {
267 		cmd->unsolicited_data = 0;
268 
269 		offset = cmd->next_burst_len = cmd->write_data_done;
270 
271 		if ((conn->sess->sess_ops->FirstBurstLength - offset) >=
272 		     cmd->data_length) {
273 			no_build_r2ts = 1;
274 			length = (cmd->data_length - offset);
275 		} else
276 			length = (conn->sess->sess_ops->FirstBurstLength - offset);
277 
278 		spin_lock_bh(&cmd->r2t_lock);
279 		if (iscsit_add_r2t_to_list(cmd, offset, length, 0, 0) < 0) {
280 			spin_unlock_bh(&cmd->r2t_lock);
281 			return -1;
282 		}
283 		cmd->outstanding_r2ts++;
284 		spin_unlock_bh(&cmd->r2t_lock);
285 
286 		if (no_build_r2ts)
287 			return 0;
288 	}
289 	/*
290 	 * iscsit_build_r2ts_for_cmd() can handle the rest from here.
291 	 */
292 	return iscsit_build_r2ts_for_cmd(cmd, conn, true);
293 }
294 
295 static int iscsit_task_reassign_complete_read(
296 	struct iscsi_cmd *cmd,
297 	struct iscsi_tmr_req *tmr_req)
298 {
299 	struct iscsi_conn *conn = cmd->conn;
300 	struct iscsi_datain_req *dr;
301 	struct se_cmd *se_cmd = &cmd->se_cmd;
302 	/*
303 	 * The Initiator must not send a Data SNACK with a BegRun less than
304 	 * the TMR TASK_REASSIGN's ExpDataSN.
305 	 */
306 	if (!tmr_req->exp_data_sn) {
307 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
308 		cmd->acked_data_sn = 0;
309 	} else {
310 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
311 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
312 	}
313 
314 	if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
315 		pr_debug("READ ITT: 0x%08x: t_state: %d never sent to"
316 			" transport\n", cmd->init_task_tag,
317 			cmd->se_cmd.t_state);
318 		transport_handle_cdb_direct(se_cmd);
319 		return 0;
320 	}
321 
322 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
323 		pr_err("READ ITT: 0x%08x: t_state: %d, never returned"
324 			" from transport\n", cmd->init_task_tag,
325 			cmd->se_cmd.t_state);
326 		return -1;
327 	}
328 
329 	dr = iscsit_allocate_datain_req();
330 	if (!dr)
331 		return -1;
332 	/*
333 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next DataSN the
334 	 * Initiator is expecting.
335 	 */
336 	dr->data_sn = dr->begrun = tmr_req->exp_data_sn;
337 	dr->runlength = 0;
338 	dr->generate_recovery_values = 1;
339 	dr->recovery = DATAIN_CONNECTION_RECOVERY;
340 
341 	iscsit_attach_datain_req(cmd, dr);
342 
343 	cmd->i_state = ISTATE_SEND_DATAIN;
344 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
345 	return 0;
346 }
347 
348 static int iscsit_task_reassign_complete_none(
349 	struct iscsi_cmd *cmd,
350 	struct iscsi_tmr_req *tmr_req)
351 {
352 	struct iscsi_conn *conn = cmd->conn;
353 
354 	cmd->i_state = ISTATE_SEND_STATUS;
355 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
356 	return 0;
357 }
358 
359 static int iscsit_task_reassign_complete_scsi_cmnd(
360 	struct iscsi_tmr_req *tmr_req,
361 	struct iscsi_conn *conn)
362 {
363 	struct se_tmr_req *se_tmr = tmr_req->se_tmr_req;
364 	struct se_cmd *se_cmd = se_tmr->ref_cmd;
365 	struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
366 	struct iscsi_conn_recovery *cr;
367 
368 	if (!cmd->cr) {
369 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
370 			" is NULL!\n", cmd->init_task_tag);
371 		return -1;
372 	}
373 	cr = cmd->cr;
374 
375 	/*
376 	 * Reset the StatSN so a new one for this commands new connection
377 	 * will be assigned.
378 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
379 	 */
380 	cmd->stat_sn = cmd->exp_stat_sn = 0;
381 
382 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
383 
384 	spin_lock_bh(&conn->cmd_lock);
385 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
386 	spin_unlock_bh(&conn->cmd_lock);
387 
388 	if (se_cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
389 		cmd->i_state = ISTATE_SEND_STATUS;
390 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
391 		return 0;
392 	}
393 
394 	switch (cmd->data_direction) {
395 	case DMA_TO_DEVICE:
396 		return iscsit_task_reassign_complete_write(cmd, tmr_req);
397 	case DMA_FROM_DEVICE:
398 		return iscsit_task_reassign_complete_read(cmd, tmr_req);
399 	case DMA_NONE:
400 		return iscsit_task_reassign_complete_none(cmd, tmr_req);
401 	default:
402 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
403 				cmd->data_direction);
404 		return -1;
405 	}
406 
407 	return 0;
408 }
409 
410 static int iscsit_task_reassign_complete(
411 	struct iscsi_tmr_req *tmr_req,
412 	struct iscsi_conn *conn)
413 {
414 	struct se_tmr_req *se_tmr = tmr_req->se_tmr_req;
415 	struct se_cmd *se_cmd;
416 	struct iscsi_cmd *cmd;
417 	int ret = 0;
418 
419 	if (!se_tmr->ref_cmd) {
420 		pr_err("TMR Request is missing a RefCmd struct iscsi_cmd.\n");
421 		return -1;
422 	}
423 	se_cmd = se_tmr->ref_cmd;
424 	cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
425 
426 	cmd->conn = conn;
427 
428 	switch (cmd->iscsi_opcode) {
429 	case ISCSI_OP_NOOP_OUT:
430 		ret = iscsit_task_reassign_complete_nop_out(tmr_req, conn);
431 		break;
432 	case ISCSI_OP_SCSI_CMD:
433 		ret = iscsit_task_reassign_complete_scsi_cmnd(tmr_req, conn);
434 		break;
435 	default:
436 		 pr_err("Illegal iSCSI Opcode 0x%02x during"
437 			" command realligence\n", cmd->iscsi_opcode);
438 		return -1;
439 	}
440 
441 	if (ret != 0)
442 		return ret;
443 
444 	pr_debug("Completed connection realligence for Opcode: 0x%02x,"
445 		" ITT: 0x%08x to CID: %hu.\n", cmd->iscsi_opcode,
446 			cmd->init_task_tag, conn->cid);
447 
448 	return 0;
449 }
450 
451 /*
452  *	Handles special after-the-fact actions related to TMRs.
453  *	Right now the only one that its really needed for is
454  *	connection recovery releated TASK_REASSIGN.
455  */
456 extern int iscsit_tmr_post_handler(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
457 {
458 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
459 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
460 
461 	if (tmr_req->task_reassign &&
462 	   (se_tmr->response == ISCSI_TMF_RSP_COMPLETE))
463 		return iscsit_task_reassign_complete(tmr_req, conn);
464 
465 	return 0;
466 }
467 
468 /*
469  *	Nothing to do here, but leave it for good measure. :-)
470  */
471 int iscsit_task_reassign_prepare_read(
472 	struct iscsi_tmr_req *tmr_req,
473 	struct iscsi_conn *conn)
474 {
475 	return 0;
476 }
477 
478 static void iscsit_task_reassign_prepare_unsolicited_dataout(
479 	struct iscsi_cmd *cmd,
480 	struct iscsi_conn *conn)
481 {
482 	int i, j;
483 	struct iscsi_pdu *pdu = NULL;
484 	struct iscsi_seq *seq = NULL;
485 
486 	if (conn->sess->sess_ops->DataSequenceInOrder) {
487 		cmd->data_sn = 0;
488 
489 		if (cmd->immediate_data)
490 			cmd->r2t_offset += (cmd->first_burst_len -
491 				cmd->seq_start_offset);
492 
493 		if (conn->sess->sess_ops->DataPDUInOrder) {
494 			cmd->write_data_done -= (cmd->immediate_data) ?
495 						(cmd->first_burst_len -
496 						 cmd->seq_start_offset) :
497 						 cmd->first_burst_len;
498 			cmd->first_burst_len = 0;
499 			return;
500 		}
501 
502 		for (i = 0; i < cmd->pdu_count; i++) {
503 			pdu = &cmd->pdu_list[i];
504 
505 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
506 				continue;
507 
508 			if ((pdu->offset >= cmd->seq_start_offset) &&
509 			   ((pdu->offset + pdu->length) <=
510 			     cmd->seq_end_offset)) {
511 				cmd->first_burst_len -= pdu->length;
512 				cmd->write_data_done -= pdu->length;
513 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
514 			}
515 		}
516 	} else {
517 		for (i = 0; i < cmd->seq_count; i++) {
518 			seq = &cmd->seq_list[i];
519 
520 			if (seq->type != SEQTYPE_UNSOLICITED)
521 				continue;
522 
523 			cmd->write_data_done -=
524 					(seq->offset - seq->orig_offset);
525 			cmd->first_burst_len = 0;
526 			seq->data_sn = 0;
527 			seq->offset = seq->orig_offset;
528 			seq->next_burst_len = 0;
529 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
530 
531 			if (conn->sess->sess_ops->DataPDUInOrder)
532 				continue;
533 
534 			for (j = 0; j < seq->pdu_count; j++) {
535 				pdu = &cmd->pdu_list[j+seq->pdu_start];
536 
537 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
538 					continue;
539 
540 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
541 			}
542 		}
543 	}
544 }
545 
546 int iscsit_task_reassign_prepare_write(
547 	struct iscsi_tmr_req *tmr_req,
548 	struct iscsi_conn *conn)
549 {
550 	struct se_tmr_req *se_tmr = tmr_req->se_tmr_req;
551 	struct se_cmd *se_cmd = se_tmr->ref_cmd;
552 	struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
553 	struct iscsi_pdu *pdu = NULL;
554 	struct iscsi_r2t *r2t = NULL, *r2t_tmp;
555 	int first_incomplete_r2t = 1, i = 0;
556 
557 	/*
558 	 * The command was in the process of receiving Unsolicited DataOUT when
559 	 * the connection failed.
560 	 */
561 	if (cmd->unsolicited_data)
562 		iscsit_task_reassign_prepare_unsolicited_dataout(cmd, conn);
563 
564 	/*
565 	 * The Initiator is requesting R2Ts starting from zero,  skip
566 	 * checking acknowledged R2Ts and start checking struct iscsi_r2ts
567 	 * greater than zero.
568 	 */
569 	if (!tmr_req->exp_data_sn)
570 		goto drop_unacknowledged_r2ts;
571 
572 	/*
573 	 * We now check that the PDUs in DataOUT sequences below
574 	 * the TMR TASK_REASSIGN ExpDataSN (R2TSN the Initiator is
575 	 * expecting next) have all the DataOUT they require to complete
576 	 * the DataOUT sequence.  First scan from R2TSN 0 to TMR
577 	 * TASK_REASSIGN ExpDataSN-1.
578 	 *
579 	 * If we have not received all DataOUT in question,  we must
580 	 * make sure to make the appropriate changes to values in
581 	 * struct iscsi_cmd (and elsewhere depending on session parameters)
582 	 * so iscsit_build_r2ts_for_cmd() in iscsit_task_reassign_complete_write()
583 	 * will resend a new R2T for the DataOUT sequences in question.
584 	 */
585 	spin_lock_bh(&cmd->r2t_lock);
586 	if (list_empty(&cmd->cmd_r2t_list)) {
587 		spin_unlock_bh(&cmd->r2t_lock);
588 		return -1;
589 	}
590 
591 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
592 
593 		if (r2t->r2t_sn >= tmr_req->exp_data_sn)
594 			continue;
595 		/*
596 		 * Safely ignore Recovery R2Ts and R2Ts that have completed
597 		 * DataOUT sequences.
598 		 */
599 		if (r2t->seq_complete)
600 			continue;
601 
602 		if (r2t->recovery_r2t)
603 			continue;
604 
605 		/*
606 		 *                 DataSequenceInOrder=Yes:
607 		 *
608 		 * Taking into account the iSCSI implementation requirement of
609 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
610 		 * DataSequenceInOrder=Yes, we must take into consideration
611 		 * the following:
612 		 *
613 		 *                  DataSequenceInOrder=No:
614 		 *
615 		 * Taking into account that the Initiator controls the (possibly
616 		 * random) PDU Order in (possibly random) Sequence Order of
617 		 * DataOUT the target requests with R2Ts,  we must take into
618 		 * consideration the following:
619 		 *
620 		 *      DataPDUInOrder=Yes for DataSequenceInOrder=[Yes,No]:
621 		 *
622 		 * While processing non-complete R2T DataOUT sequence requests
623 		 * the Target will re-request only the total sequence length
624 		 * minus current received offset.  This is because we must
625 		 * assume the initiator will continue sending DataOUT from the
626 		 * last PDU before the connection failed.
627 		 *
628 		 *      DataPDUInOrder=No for DataSequenceInOrder=[Yes,No]:
629 		 *
630 		 * While processing non-complete R2T DataOUT sequence requests
631 		 * the Target will re-request the entire DataOUT sequence if
632 		 * any single PDU is missing from the sequence.  This is because
633 		 * we have no logical method to determine the next PDU offset,
634 		 * and we must assume the Initiator will be sending any random
635 		 * PDU offset in the current sequence after TASK_REASSIGN
636 		 * has completed.
637 		 */
638 		if (conn->sess->sess_ops->DataSequenceInOrder) {
639 			if (!first_incomplete_r2t) {
640 				cmd->r2t_offset -= r2t->xfer_len;
641 				goto next;
642 			}
643 
644 			if (conn->sess->sess_ops->DataPDUInOrder) {
645 				cmd->data_sn = 0;
646 				cmd->r2t_offset -= (r2t->xfer_len -
647 					cmd->next_burst_len);
648 				first_incomplete_r2t = 0;
649 				goto next;
650 			}
651 
652 			cmd->data_sn = 0;
653 			cmd->r2t_offset -= r2t->xfer_len;
654 
655 			for (i = 0; i < cmd->pdu_count; i++) {
656 				pdu = &cmd->pdu_list[i];
657 
658 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
659 					continue;
660 
661 				if ((pdu->offset >= r2t->offset) &&
662 				    (pdu->offset < (r2t->offset +
663 						r2t->xfer_len))) {
664 					cmd->next_burst_len -= pdu->length;
665 					cmd->write_data_done -= pdu->length;
666 					pdu->status = ISCSI_PDU_NOT_RECEIVED;
667 				}
668 			}
669 
670 			first_incomplete_r2t = 0;
671 		} else {
672 			struct iscsi_seq *seq;
673 
674 			seq = iscsit_get_seq_holder(cmd, r2t->offset,
675 					r2t->xfer_len);
676 			if (!seq) {
677 				spin_unlock_bh(&cmd->r2t_lock);
678 				return -1;
679 			}
680 
681 			cmd->write_data_done -=
682 					(seq->offset - seq->orig_offset);
683 			seq->data_sn = 0;
684 			seq->offset = seq->orig_offset;
685 			seq->next_burst_len = 0;
686 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
687 
688 			cmd->seq_send_order--;
689 
690 			if (conn->sess->sess_ops->DataPDUInOrder)
691 				goto next;
692 
693 			for (i = 0; i < seq->pdu_count; i++) {
694 				pdu = &cmd->pdu_list[i+seq->pdu_start];
695 
696 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
697 					continue;
698 
699 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
700 			}
701 		}
702 
703 next:
704 		cmd->outstanding_r2ts--;
705 	}
706 	spin_unlock_bh(&cmd->r2t_lock);
707 
708 	/*
709 	 * We now drop all unacknowledged R2Ts, ie: ExpDataSN from TMR
710 	 * TASK_REASSIGN to the last R2T in the list..  We are also careful
711 	 * to check that the Initiator is not requesting R2Ts for DataOUT
712 	 * sequences it has already completed.
713 	 *
714 	 * Free each R2T in question and adjust values in struct iscsi_cmd
715 	 * accordingly so iscsit_build_r2ts_for_cmd() do the rest of
716 	 * the work after the TMR TASK_REASSIGN Response is sent.
717 	 */
718 drop_unacknowledged_r2ts:
719 
720 	cmd->cmd_flags &= ~ICF_SENT_LAST_R2T;
721 	cmd->r2t_sn = tmr_req->exp_data_sn;
722 
723 	spin_lock_bh(&cmd->r2t_lock);
724 	list_for_each_entry_safe(r2t, r2t_tmp, &cmd->cmd_r2t_list, r2t_list) {
725 		/*
726 		 * Skip up to the R2T Sequence number provided by the
727 		 * iSCSI TASK_REASSIGN TMR
728 		 */
729 		if (r2t->r2t_sn < tmr_req->exp_data_sn)
730 			continue;
731 
732 		if (r2t->seq_complete) {
733 			pr_err("Initiator is requesting R2Ts from"
734 				" R2TSN: 0x%08x, but R2TSN: 0x%08x, Offset: %u,"
735 				" Length: %u is already complete."
736 				"   BAD INITIATOR ERL=2 IMPLEMENTATION!\n",
737 				tmr_req->exp_data_sn, r2t->r2t_sn,
738 				r2t->offset, r2t->xfer_len);
739 			spin_unlock_bh(&cmd->r2t_lock);
740 			return -1;
741 		}
742 
743 		if (r2t->recovery_r2t) {
744 			iscsit_free_r2t(r2t, cmd);
745 			continue;
746 		}
747 
748 		/*		   DataSequenceInOrder=Yes:
749 		 *
750 		 * Taking into account the iSCSI implementation requirement of
751 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
752 		 * DataSequenceInOrder=Yes, it's safe to subtract the R2Ts
753 		 * entire transfer length from the commands R2T offset marker.
754 		 *
755 		 *		   DataSequenceInOrder=No:
756 		 *
757 		 * We subtract the difference from struct iscsi_seq between the
758 		 * current offset and original offset from cmd->write_data_done
759 		 * for account for DataOUT PDUs already received.  Then reset
760 		 * the current offset to the original and zero out the current
761 		 * burst length,  to make sure we re-request the entire DataOUT
762 		 * sequence.
763 		 */
764 		if (conn->sess->sess_ops->DataSequenceInOrder)
765 			cmd->r2t_offset -= r2t->xfer_len;
766 		else
767 			cmd->seq_send_order--;
768 
769 		cmd->outstanding_r2ts--;
770 		iscsit_free_r2t(r2t, cmd);
771 	}
772 	spin_unlock_bh(&cmd->r2t_lock);
773 
774 	return 0;
775 }
776 
777 /*
778  *	Performs sanity checks TMR TASK_REASSIGN's ExpDataSN for
779  *	a given struct iscsi_cmd.
780  */
781 int iscsit_check_task_reassign_expdatasn(
782 	struct iscsi_tmr_req *tmr_req,
783 	struct iscsi_conn *conn)
784 {
785 	struct se_tmr_req *se_tmr = tmr_req->se_tmr_req;
786 	struct se_cmd *se_cmd = se_tmr->ref_cmd;
787 	struct iscsi_cmd *ref_cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
788 
789 	if (ref_cmd->iscsi_opcode != ISCSI_OP_SCSI_CMD)
790 		return 0;
791 
792 	if (se_cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION)
793 		return 0;
794 
795 	if (ref_cmd->data_direction == DMA_NONE)
796 		return 0;
797 
798 	/*
799 	 * For READs the TMR TASK_REASSIGNs ExpDataSN contains the next DataSN
800 	 * of DataIN the Initiator is expecting.
801 	 *
802 	 * Also check that the Initiator is not re-requesting DataIN that has
803 	 * already been acknowledged with a DataAck SNACK.
804 	 */
805 	if (ref_cmd->data_direction == DMA_FROM_DEVICE) {
806 		if (tmr_req->exp_data_sn > ref_cmd->data_sn) {
807 			pr_err("Received ExpDataSN: 0x%08x for READ"
808 				" in TMR TASK_REASSIGN greater than command's"
809 				" DataSN: 0x%08x.\n", tmr_req->exp_data_sn,
810 				ref_cmd->data_sn);
811 			return -1;
812 		}
813 		if ((ref_cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
814 		    (tmr_req->exp_data_sn <= ref_cmd->acked_data_sn)) {
815 			pr_err("Received ExpDataSN: 0x%08x for READ"
816 				" in TMR TASK_REASSIGN for previously"
817 				" acknowledged DataIN: 0x%08x,"
818 				" protocol error\n", tmr_req->exp_data_sn,
819 				ref_cmd->acked_data_sn);
820 			return -1;
821 		}
822 		return iscsit_task_reassign_prepare_read(tmr_req, conn);
823 	}
824 
825 	/*
826 	 * For WRITEs the TMR TASK_REASSIGNs ExpDataSN contains the next R2TSN
827 	 * for R2Ts the Initiator is expecting.
828 	 *
829 	 * Do the magic in iscsit_task_reassign_prepare_write().
830 	 */
831 	if (ref_cmd->data_direction == DMA_TO_DEVICE) {
832 		if (tmr_req->exp_data_sn > ref_cmd->r2t_sn) {
833 			pr_err("Received ExpDataSN: 0x%08x for WRITE"
834 				" in TMR TASK_REASSIGN greater than command's"
835 				" R2TSN: 0x%08x.\n", tmr_req->exp_data_sn,
836 					ref_cmd->r2t_sn);
837 			return -1;
838 		}
839 		return iscsit_task_reassign_prepare_write(tmr_req, conn);
840 	}
841 
842 	pr_err("Unknown iSCSI data_direction: 0x%02x\n",
843 			ref_cmd->data_direction);
844 
845 	return -1;
846 }
847