1 /*******************************************************************************
2  * This file contains the iSCSI Target specific Task Management functions.
3  *
4  * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
5  *
6  * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
7  *
8  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  ******************************************************************************/
20 
21 #include <asm/unaligned.h>
22 #include <scsi/scsi_device.h>
23 #include <scsi/iscsi_proto.h>
24 #include <target/target_core_base.h>
25 #include <target/target_core_fabric.h>
26 
27 #include "iscsi_target_core.h"
28 #include "iscsi_target_seq_pdu_list.h"
29 #include "iscsi_target_datain_values.h"
30 #include "iscsi_target_device.h"
31 #include "iscsi_target_erl0.h"
32 #include "iscsi_target_erl1.h"
33 #include "iscsi_target_erl2.h"
34 #include "iscsi_target_tmr.h"
35 #include "iscsi_target_tpg.h"
36 #include "iscsi_target_util.h"
37 #include "iscsi_target.h"
38 
39 u8 iscsit_tmr_abort_task(
40 	struct iscsi_cmd *cmd,
41 	unsigned char *buf)
42 {
43 	struct iscsi_cmd *ref_cmd;
44 	struct iscsi_conn *conn = cmd->conn;
45 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
46 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
47 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
48 
49 	ref_cmd = iscsit_find_cmd_from_itt(conn, hdr->rtt);
50 	if (!ref_cmd) {
51 		pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
52 			" %hu.\n", hdr->rtt, conn->cid);
53 		return ((hdr->refcmdsn >= conn->sess->exp_cmd_sn) &&
54 			(hdr->refcmdsn <= conn->sess->max_cmd_sn)) ?
55 			ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
56 	}
57 	if (ref_cmd->cmd_sn != hdr->refcmdsn) {
58 		pr_err("RefCmdSN 0x%08x does not equal"
59 			" task's CmdSN 0x%08x. Rejecting ABORT_TASK.\n",
60 			hdr->refcmdsn, ref_cmd->cmd_sn);
61 		return ISCSI_TMF_RSP_REJECTED;
62 	}
63 
64 	se_tmr->ref_task_tag		= hdr->rtt;
65 	tmr_req->ref_cmd		= ref_cmd;
66 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
67 	tmr_req->exp_data_sn		= hdr->exp_datasn;
68 
69 	return ISCSI_TMF_RSP_COMPLETE;
70 }
71 
72 /*
73  *	Called from iscsit_handle_task_mgt_cmd().
74  */
75 int iscsit_tmr_task_warm_reset(
76 	struct iscsi_conn *conn,
77 	struct iscsi_tmr_req *tmr_req,
78 	unsigned char *buf)
79 {
80 	struct iscsi_session *sess = conn->sess;
81 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
82 
83 	if (!na->tmr_warm_reset) {
84 		pr_err("TMR Opcode TARGET_WARM_RESET authorization"
85 			" failed for Initiator Node: %s\n",
86 			sess->se_sess->se_node_acl->initiatorname);
87 		 return -1;
88 	}
89 	/*
90 	 * Do the real work in transport_generic_do_tmr().
91 	 */
92 	return 0;
93 }
94 
95 int iscsit_tmr_task_cold_reset(
96 	struct iscsi_conn *conn,
97 	struct iscsi_tmr_req *tmr_req,
98 	unsigned char *buf)
99 {
100 	struct iscsi_session *sess = conn->sess;
101 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
102 
103 	if (!na->tmr_cold_reset) {
104 		pr_err("TMR Opcode TARGET_COLD_RESET authorization"
105 			" failed for Initiator Node: %s\n",
106 			sess->se_sess->se_node_acl->initiatorname);
107 		return -1;
108 	}
109 	/*
110 	 * Do the real work in transport_generic_do_tmr().
111 	 */
112 	return 0;
113 }
114 
115 u8 iscsit_tmr_task_reassign(
116 	struct iscsi_cmd *cmd,
117 	unsigned char *buf)
118 {
119 	struct iscsi_cmd *ref_cmd = NULL;
120 	struct iscsi_conn *conn = cmd->conn;
121 	struct iscsi_conn_recovery *cr = NULL;
122 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
123 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
124 	struct iscsi_tm *hdr = (struct iscsi_tm *) buf;
125 	int ret, ref_lun;
126 
127 	pr_debug("Got TASK_REASSIGN TMR ITT: 0x%08x,"
128 		" RefTaskTag: 0x%08x, ExpDataSN: 0x%08x, CID: %hu\n",
129 		hdr->itt, hdr->rtt, hdr->exp_datasn, conn->cid);
130 
131 	if (conn->sess->sess_ops->ErrorRecoveryLevel != 2) {
132 		pr_err("TMR TASK_REASSIGN not supported in ERL<2,"
133 				" ignoring request.\n");
134 		return ISCSI_TMF_RSP_NOT_SUPPORTED;
135 	}
136 
137 	ret = iscsit_find_cmd_for_recovery(conn->sess, &ref_cmd, &cr, hdr->rtt);
138 	if (ret == -2) {
139 		pr_err("Command ITT: 0x%08x is still alligent to CID:"
140 			" %hu\n", ref_cmd->init_task_tag, cr->cid);
141 		return ISCSI_TMF_RSP_TASK_ALLEGIANT;
142 	} else if (ret == -1) {
143 		pr_err("Unable to locate RefTaskTag: 0x%08x in"
144 			" connection recovery command list.\n", hdr->rtt);
145 		return ISCSI_TMF_RSP_NO_TASK;
146 	}
147 	/*
148 	 * Temporary check to prevent connection recovery for
149 	 * connections with a differing MaxRecvDataSegmentLength.
150 	 */
151 	if (cr->maxrecvdatasegmentlength !=
152 	    conn->conn_ops->MaxRecvDataSegmentLength) {
153 		pr_err("Unable to perform connection recovery for"
154 			" differing MaxRecvDataSegmentLength, rejecting"
155 			" TMR TASK_REASSIGN.\n");
156 		return ISCSI_TMF_RSP_REJECTED;
157 	}
158 
159 	ref_lun = scsilun_to_int(&hdr->lun);
160 	if (ref_lun != ref_cmd->se_cmd.orig_fe_lun) {
161 		pr_err("Unable to perform connection recovery for"
162 			" differing ref_lun: %d ref_cmd orig_fe_lun: %u\n",
163 			ref_lun, ref_cmd->se_cmd.orig_fe_lun);
164 		return ISCSI_TMF_RSP_REJECTED;
165 	}
166 
167 	se_tmr->ref_task_tag		= hdr->rtt;
168 	tmr_req->ref_cmd		= ref_cmd;
169 	tmr_req->ref_cmd_sn		= hdr->refcmdsn;
170 	tmr_req->exp_data_sn		= hdr->exp_datasn;
171 	tmr_req->conn_recovery		= cr;
172 	tmr_req->task_reassign		= 1;
173 	/*
174 	 * Command can now be reassigned to a new connection.
175 	 * The task management response must be sent before the
176 	 * reassignment actually happens.  See iscsi_tmr_post_handler().
177 	 */
178 	return ISCSI_TMF_RSP_COMPLETE;
179 }
180 
181 static void iscsit_task_reassign_remove_cmd(
182 	struct iscsi_cmd *cmd,
183 	struct iscsi_conn_recovery *cr,
184 	struct iscsi_session *sess)
185 {
186 	int ret;
187 
188 	spin_lock(&cr->conn_recovery_cmd_lock);
189 	ret = iscsit_remove_cmd_from_connection_recovery(cmd, sess);
190 	spin_unlock(&cr->conn_recovery_cmd_lock);
191 	if (!ret) {
192 		pr_debug("iSCSI connection recovery successful for CID:"
193 			" %hu on SID: %u\n", cr->cid, sess->sid);
194 		iscsit_remove_active_connection_recovery_entry(cr, sess);
195 	}
196 }
197 
198 static int iscsit_task_reassign_complete_nop_out(
199 	struct iscsi_tmr_req *tmr_req,
200 	struct iscsi_conn *conn)
201 {
202 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
203 	struct iscsi_conn_recovery *cr;
204 
205 	if (!cmd->cr) {
206 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
207 			" is NULL!\n", cmd->init_task_tag);
208 		return -1;
209 	}
210 	cr = cmd->cr;
211 
212 	/*
213 	 * Reset the StatSN so a new one for this commands new connection
214 	 * will be assigned.
215 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
216 	 */
217 	cmd->stat_sn = cmd->exp_stat_sn = 0;
218 
219 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
220 
221 	spin_lock_bh(&conn->cmd_lock);
222 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
223 	spin_unlock_bh(&conn->cmd_lock);
224 
225 	cmd->i_state = ISTATE_SEND_NOPIN;
226 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
227 	return 0;
228 }
229 
230 static int iscsit_task_reassign_complete_write(
231 	struct iscsi_cmd *cmd,
232 	struct iscsi_tmr_req *tmr_req)
233 {
234 	int no_build_r2ts = 0;
235 	u32 length = 0, offset = 0;
236 	struct iscsi_conn *conn = cmd->conn;
237 	struct se_cmd *se_cmd = &cmd->se_cmd;
238 	/*
239 	 * The Initiator must not send a R2T SNACK with a Begrun less than
240 	 * the TMR TASK_REASSIGN's ExpDataSN.
241 	 */
242 	if (!tmr_req->exp_data_sn) {
243 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
244 		cmd->acked_data_sn = 0;
245 	} else {
246 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
247 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
248 	}
249 
250 	/*
251 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next R2TSN the
252 	 * Initiator is expecting.  The Target controls all WRITE operations
253 	 * so if we have received all DataOUT we can safety ignore Initiator.
254 	 */
255 	if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
256 		if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
257 			pr_debug("WRITE ITT: 0x%08x: t_state: %d"
258 				" never sent to transport\n",
259 				cmd->init_task_tag, cmd->se_cmd.t_state);
260 			return transport_generic_handle_data(se_cmd);
261 		}
262 
263 		cmd->i_state = ISTATE_SEND_STATUS;
264 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
265 		return 0;
266 	}
267 
268 	/*
269 	 * Special case to deal with DataSequenceInOrder=No and Non-Immeidate
270 	 * Unsolicited DataOut.
271 	 */
272 	if (cmd->unsolicited_data) {
273 		cmd->unsolicited_data = 0;
274 
275 		offset = cmd->next_burst_len = cmd->write_data_done;
276 
277 		if ((conn->sess->sess_ops->FirstBurstLength - offset) >=
278 		     cmd->se_cmd.data_length) {
279 			no_build_r2ts = 1;
280 			length = (cmd->se_cmd.data_length - offset);
281 		} else
282 			length = (conn->sess->sess_ops->FirstBurstLength - offset);
283 
284 		spin_lock_bh(&cmd->r2t_lock);
285 		if (iscsit_add_r2t_to_list(cmd, offset, length, 0, 0) < 0) {
286 			spin_unlock_bh(&cmd->r2t_lock);
287 			return -1;
288 		}
289 		cmd->outstanding_r2ts++;
290 		spin_unlock_bh(&cmd->r2t_lock);
291 
292 		if (no_build_r2ts)
293 			return 0;
294 	}
295 	/*
296 	 * iscsit_build_r2ts_for_cmd() can handle the rest from here.
297 	 */
298 	return iscsit_build_r2ts_for_cmd(cmd, conn, true);
299 }
300 
301 static int iscsit_task_reassign_complete_read(
302 	struct iscsi_cmd *cmd,
303 	struct iscsi_tmr_req *tmr_req)
304 {
305 	struct iscsi_conn *conn = cmd->conn;
306 	struct iscsi_datain_req *dr;
307 	struct se_cmd *se_cmd = &cmd->se_cmd;
308 	/*
309 	 * The Initiator must not send a Data SNACK with a BegRun less than
310 	 * the TMR TASK_REASSIGN's ExpDataSN.
311 	 */
312 	if (!tmr_req->exp_data_sn) {
313 		cmd->cmd_flags &= ~ICF_GOT_DATACK_SNACK;
314 		cmd->acked_data_sn = 0;
315 	} else {
316 		cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
317 		cmd->acked_data_sn = (tmr_req->exp_data_sn - 1);
318 	}
319 
320 	if (!(cmd->se_cmd.transport_state & CMD_T_SENT)) {
321 		pr_debug("READ ITT: 0x%08x: t_state: %d never sent to"
322 			" transport\n", cmd->init_task_tag,
323 			cmd->se_cmd.t_state);
324 		transport_handle_cdb_direct(se_cmd);
325 		return 0;
326 	}
327 
328 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
329 		pr_err("READ ITT: 0x%08x: t_state: %d, never returned"
330 			" from transport\n", cmd->init_task_tag,
331 			cmd->se_cmd.t_state);
332 		return -1;
333 	}
334 
335 	dr = iscsit_allocate_datain_req();
336 	if (!dr)
337 		return -1;
338 	/*
339 	 * The TMR TASK_REASSIGN's ExpDataSN contains the next DataSN the
340 	 * Initiator is expecting.
341 	 */
342 	dr->data_sn = dr->begrun = tmr_req->exp_data_sn;
343 	dr->runlength = 0;
344 	dr->generate_recovery_values = 1;
345 	dr->recovery = DATAIN_CONNECTION_RECOVERY;
346 
347 	iscsit_attach_datain_req(cmd, dr);
348 
349 	cmd->i_state = ISTATE_SEND_DATAIN;
350 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
351 	return 0;
352 }
353 
354 static int iscsit_task_reassign_complete_none(
355 	struct iscsi_cmd *cmd,
356 	struct iscsi_tmr_req *tmr_req)
357 {
358 	struct iscsi_conn *conn = cmd->conn;
359 
360 	cmd->i_state = ISTATE_SEND_STATUS;
361 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
362 	return 0;
363 }
364 
365 static int iscsit_task_reassign_complete_scsi_cmnd(
366 	struct iscsi_tmr_req *tmr_req,
367 	struct iscsi_conn *conn)
368 {
369 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
370 	struct iscsi_conn_recovery *cr;
371 
372 	if (!cmd->cr) {
373 		pr_err("struct iscsi_conn_recovery pointer for ITT: 0x%08x"
374 			" is NULL!\n", cmd->init_task_tag);
375 		return -1;
376 	}
377 	cr = cmd->cr;
378 
379 	/*
380 	 * Reset the StatSN so a new one for this commands new connection
381 	 * will be assigned.
382 	 * Reset the ExpStatSN as well so we may receive Status SNACKs.
383 	 */
384 	cmd->stat_sn = cmd->exp_stat_sn = 0;
385 
386 	iscsit_task_reassign_remove_cmd(cmd, cr, conn->sess);
387 
388 	spin_lock_bh(&conn->cmd_lock);
389 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
390 	spin_unlock_bh(&conn->cmd_lock);
391 
392 	if (cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
393 		cmd->i_state = ISTATE_SEND_STATUS;
394 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
395 		return 0;
396 	}
397 
398 	switch (cmd->data_direction) {
399 	case DMA_TO_DEVICE:
400 		return iscsit_task_reassign_complete_write(cmd, tmr_req);
401 	case DMA_FROM_DEVICE:
402 		return iscsit_task_reassign_complete_read(cmd, tmr_req);
403 	case DMA_NONE:
404 		return iscsit_task_reassign_complete_none(cmd, tmr_req);
405 	default:
406 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
407 				cmd->data_direction);
408 		return -1;
409 	}
410 
411 	return 0;
412 }
413 
414 static int iscsit_task_reassign_complete(
415 	struct iscsi_tmr_req *tmr_req,
416 	struct iscsi_conn *conn)
417 {
418 	struct iscsi_cmd *cmd;
419 	int ret = 0;
420 
421 	if (!tmr_req->ref_cmd) {
422 		pr_err("TMR Request is missing a RefCmd struct iscsi_cmd.\n");
423 		return -1;
424 	}
425 	cmd = tmr_req->ref_cmd;
426 
427 	cmd->conn = conn;
428 
429 	switch (cmd->iscsi_opcode) {
430 	case ISCSI_OP_NOOP_OUT:
431 		ret = iscsit_task_reassign_complete_nop_out(tmr_req, conn);
432 		break;
433 	case ISCSI_OP_SCSI_CMD:
434 		ret = iscsit_task_reassign_complete_scsi_cmnd(tmr_req, conn);
435 		break;
436 	default:
437 		 pr_err("Illegal iSCSI Opcode 0x%02x during"
438 			" command realligence\n", cmd->iscsi_opcode);
439 		return -1;
440 	}
441 
442 	if (ret != 0)
443 		return ret;
444 
445 	pr_debug("Completed connection realligence for Opcode: 0x%02x,"
446 		" ITT: 0x%08x to CID: %hu.\n", cmd->iscsi_opcode,
447 			cmd->init_task_tag, conn->cid);
448 
449 	return 0;
450 }
451 
452 /*
453  *	Handles special after-the-fact actions related to TMRs.
454  *	Right now the only one that its really needed for is
455  *	connection recovery releated TASK_REASSIGN.
456  */
457 extern int iscsit_tmr_post_handler(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
458 {
459 	struct iscsi_tmr_req *tmr_req = cmd->tmr_req;
460 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
461 
462 	if (tmr_req->task_reassign &&
463 	   (se_tmr->response == ISCSI_TMF_RSP_COMPLETE))
464 		return iscsit_task_reassign_complete(tmr_req, conn);
465 
466 	return 0;
467 }
468 
469 /*
470  *	Nothing to do here, but leave it for good measure. :-)
471  */
472 int iscsit_task_reassign_prepare_read(
473 	struct iscsi_tmr_req *tmr_req,
474 	struct iscsi_conn *conn)
475 {
476 	return 0;
477 }
478 
479 static void iscsit_task_reassign_prepare_unsolicited_dataout(
480 	struct iscsi_cmd *cmd,
481 	struct iscsi_conn *conn)
482 {
483 	int i, j;
484 	struct iscsi_pdu *pdu = NULL;
485 	struct iscsi_seq *seq = NULL;
486 
487 	if (conn->sess->sess_ops->DataSequenceInOrder) {
488 		cmd->data_sn = 0;
489 
490 		if (cmd->immediate_data)
491 			cmd->r2t_offset += (cmd->first_burst_len -
492 				cmd->seq_start_offset);
493 
494 		if (conn->sess->sess_ops->DataPDUInOrder) {
495 			cmd->write_data_done -= (cmd->immediate_data) ?
496 						(cmd->first_burst_len -
497 						 cmd->seq_start_offset) :
498 						 cmd->first_burst_len;
499 			cmd->first_burst_len = 0;
500 			return;
501 		}
502 
503 		for (i = 0; i < cmd->pdu_count; i++) {
504 			pdu = &cmd->pdu_list[i];
505 
506 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
507 				continue;
508 
509 			if ((pdu->offset >= cmd->seq_start_offset) &&
510 			   ((pdu->offset + pdu->length) <=
511 			     cmd->seq_end_offset)) {
512 				cmd->first_burst_len -= pdu->length;
513 				cmd->write_data_done -= pdu->length;
514 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
515 			}
516 		}
517 	} else {
518 		for (i = 0; i < cmd->seq_count; i++) {
519 			seq = &cmd->seq_list[i];
520 
521 			if (seq->type != SEQTYPE_UNSOLICITED)
522 				continue;
523 
524 			cmd->write_data_done -=
525 					(seq->offset - seq->orig_offset);
526 			cmd->first_burst_len = 0;
527 			seq->data_sn = 0;
528 			seq->offset = seq->orig_offset;
529 			seq->next_burst_len = 0;
530 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
531 
532 			if (conn->sess->sess_ops->DataPDUInOrder)
533 				continue;
534 
535 			for (j = 0; j < seq->pdu_count; j++) {
536 				pdu = &cmd->pdu_list[j+seq->pdu_start];
537 
538 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
539 					continue;
540 
541 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
542 			}
543 		}
544 	}
545 }
546 
547 int iscsit_task_reassign_prepare_write(
548 	struct iscsi_tmr_req *tmr_req,
549 	struct iscsi_conn *conn)
550 {
551 	struct iscsi_cmd *cmd = tmr_req->ref_cmd;
552 	struct iscsi_pdu *pdu = NULL;
553 	struct iscsi_r2t *r2t = NULL, *r2t_tmp;
554 	int first_incomplete_r2t = 1, i = 0;
555 
556 	/*
557 	 * The command was in the process of receiving Unsolicited DataOUT when
558 	 * the connection failed.
559 	 */
560 	if (cmd->unsolicited_data)
561 		iscsit_task_reassign_prepare_unsolicited_dataout(cmd, conn);
562 
563 	/*
564 	 * The Initiator is requesting R2Ts starting from zero,  skip
565 	 * checking acknowledged R2Ts and start checking struct iscsi_r2ts
566 	 * greater than zero.
567 	 */
568 	if (!tmr_req->exp_data_sn)
569 		goto drop_unacknowledged_r2ts;
570 
571 	/*
572 	 * We now check that the PDUs in DataOUT sequences below
573 	 * the TMR TASK_REASSIGN ExpDataSN (R2TSN the Initiator is
574 	 * expecting next) have all the DataOUT they require to complete
575 	 * the DataOUT sequence.  First scan from R2TSN 0 to TMR
576 	 * TASK_REASSIGN ExpDataSN-1.
577 	 *
578 	 * If we have not received all DataOUT in question,  we must
579 	 * make sure to make the appropriate changes to values in
580 	 * struct iscsi_cmd (and elsewhere depending on session parameters)
581 	 * so iscsit_build_r2ts_for_cmd() in iscsit_task_reassign_complete_write()
582 	 * will resend a new R2T for the DataOUT sequences in question.
583 	 */
584 	spin_lock_bh(&cmd->r2t_lock);
585 	if (list_empty(&cmd->cmd_r2t_list)) {
586 		spin_unlock_bh(&cmd->r2t_lock);
587 		return -1;
588 	}
589 
590 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
591 
592 		if (r2t->r2t_sn >= tmr_req->exp_data_sn)
593 			continue;
594 		/*
595 		 * Safely ignore Recovery R2Ts and R2Ts that have completed
596 		 * DataOUT sequences.
597 		 */
598 		if (r2t->seq_complete)
599 			continue;
600 
601 		if (r2t->recovery_r2t)
602 			continue;
603 
604 		/*
605 		 *                 DataSequenceInOrder=Yes:
606 		 *
607 		 * Taking into account the iSCSI implementation requirement of
608 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
609 		 * DataSequenceInOrder=Yes, we must take into consideration
610 		 * the following:
611 		 *
612 		 *                  DataSequenceInOrder=No:
613 		 *
614 		 * Taking into account that the Initiator controls the (possibly
615 		 * random) PDU Order in (possibly random) Sequence Order of
616 		 * DataOUT the target requests with R2Ts,  we must take into
617 		 * consideration the following:
618 		 *
619 		 *      DataPDUInOrder=Yes for DataSequenceInOrder=[Yes,No]:
620 		 *
621 		 * While processing non-complete R2T DataOUT sequence requests
622 		 * the Target will re-request only the total sequence length
623 		 * minus current received offset.  This is because we must
624 		 * assume the initiator will continue sending DataOUT from the
625 		 * last PDU before the connection failed.
626 		 *
627 		 *      DataPDUInOrder=No for DataSequenceInOrder=[Yes,No]:
628 		 *
629 		 * While processing non-complete R2T DataOUT sequence requests
630 		 * the Target will re-request the entire DataOUT sequence if
631 		 * any single PDU is missing from the sequence.  This is because
632 		 * we have no logical method to determine the next PDU offset,
633 		 * and we must assume the Initiator will be sending any random
634 		 * PDU offset in the current sequence after TASK_REASSIGN
635 		 * has completed.
636 		 */
637 		if (conn->sess->sess_ops->DataSequenceInOrder) {
638 			if (!first_incomplete_r2t) {
639 				cmd->r2t_offset -= r2t->xfer_len;
640 				goto next;
641 			}
642 
643 			if (conn->sess->sess_ops->DataPDUInOrder) {
644 				cmd->data_sn = 0;
645 				cmd->r2t_offset -= (r2t->xfer_len -
646 					cmd->next_burst_len);
647 				first_incomplete_r2t = 0;
648 				goto next;
649 			}
650 
651 			cmd->data_sn = 0;
652 			cmd->r2t_offset -= r2t->xfer_len;
653 
654 			for (i = 0; i < cmd->pdu_count; i++) {
655 				pdu = &cmd->pdu_list[i];
656 
657 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
658 					continue;
659 
660 				if ((pdu->offset >= r2t->offset) &&
661 				    (pdu->offset < (r2t->offset +
662 						r2t->xfer_len))) {
663 					cmd->next_burst_len -= pdu->length;
664 					cmd->write_data_done -= pdu->length;
665 					pdu->status = ISCSI_PDU_NOT_RECEIVED;
666 				}
667 			}
668 
669 			first_incomplete_r2t = 0;
670 		} else {
671 			struct iscsi_seq *seq;
672 
673 			seq = iscsit_get_seq_holder(cmd, r2t->offset,
674 					r2t->xfer_len);
675 			if (!seq) {
676 				spin_unlock_bh(&cmd->r2t_lock);
677 				return -1;
678 			}
679 
680 			cmd->write_data_done -=
681 					(seq->offset - seq->orig_offset);
682 			seq->data_sn = 0;
683 			seq->offset = seq->orig_offset;
684 			seq->next_burst_len = 0;
685 			seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
686 
687 			cmd->seq_send_order--;
688 
689 			if (conn->sess->sess_ops->DataPDUInOrder)
690 				goto next;
691 
692 			for (i = 0; i < seq->pdu_count; i++) {
693 				pdu = &cmd->pdu_list[i+seq->pdu_start];
694 
695 				if (pdu->status != ISCSI_PDU_RECEIVED_OK)
696 					continue;
697 
698 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
699 			}
700 		}
701 
702 next:
703 		cmd->outstanding_r2ts--;
704 	}
705 	spin_unlock_bh(&cmd->r2t_lock);
706 
707 	/*
708 	 * We now drop all unacknowledged R2Ts, ie: ExpDataSN from TMR
709 	 * TASK_REASSIGN to the last R2T in the list..  We are also careful
710 	 * to check that the Initiator is not requesting R2Ts for DataOUT
711 	 * sequences it has already completed.
712 	 *
713 	 * Free each R2T in question and adjust values in struct iscsi_cmd
714 	 * accordingly so iscsit_build_r2ts_for_cmd() do the rest of
715 	 * the work after the TMR TASK_REASSIGN Response is sent.
716 	 */
717 drop_unacknowledged_r2ts:
718 
719 	cmd->cmd_flags &= ~ICF_SENT_LAST_R2T;
720 	cmd->r2t_sn = tmr_req->exp_data_sn;
721 
722 	spin_lock_bh(&cmd->r2t_lock);
723 	list_for_each_entry_safe(r2t, r2t_tmp, &cmd->cmd_r2t_list, r2t_list) {
724 		/*
725 		 * Skip up to the R2T Sequence number provided by the
726 		 * iSCSI TASK_REASSIGN TMR
727 		 */
728 		if (r2t->r2t_sn < tmr_req->exp_data_sn)
729 			continue;
730 
731 		if (r2t->seq_complete) {
732 			pr_err("Initiator is requesting R2Ts from"
733 				" R2TSN: 0x%08x, but R2TSN: 0x%08x, Offset: %u,"
734 				" Length: %u is already complete."
735 				"   BAD INITIATOR ERL=2 IMPLEMENTATION!\n",
736 				tmr_req->exp_data_sn, r2t->r2t_sn,
737 				r2t->offset, r2t->xfer_len);
738 			spin_unlock_bh(&cmd->r2t_lock);
739 			return -1;
740 		}
741 
742 		if (r2t->recovery_r2t) {
743 			iscsit_free_r2t(r2t, cmd);
744 			continue;
745 		}
746 
747 		/*		   DataSequenceInOrder=Yes:
748 		 *
749 		 * Taking into account the iSCSI implementation requirement of
750 		 * MaxOutstandingR2T=1 while ErrorRecoveryLevel>0 and
751 		 * DataSequenceInOrder=Yes, it's safe to subtract the R2Ts
752 		 * entire transfer length from the commands R2T offset marker.
753 		 *
754 		 *		   DataSequenceInOrder=No:
755 		 *
756 		 * We subtract the difference from struct iscsi_seq between the
757 		 * current offset and original offset from cmd->write_data_done
758 		 * for account for DataOUT PDUs already received.  Then reset
759 		 * the current offset to the original and zero out the current
760 		 * burst length,  to make sure we re-request the entire DataOUT
761 		 * sequence.
762 		 */
763 		if (conn->sess->sess_ops->DataSequenceInOrder)
764 			cmd->r2t_offset -= r2t->xfer_len;
765 		else
766 			cmd->seq_send_order--;
767 
768 		cmd->outstanding_r2ts--;
769 		iscsit_free_r2t(r2t, cmd);
770 	}
771 	spin_unlock_bh(&cmd->r2t_lock);
772 
773 	return 0;
774 }
775 
776 /*
777  *	Performs sanity checks TMR TASK_REASSIGN's ExpDataSN for
778  *	a given struct iscsi_cmd.
779  */
780 int iscsit_check_task_reassign_expdatasn(
781 	struct iscsi_tmr_req *tmr_req,
782 	struct iscsi_conn *conn)
783 {
784 	struct iscsi_cmd *ref_cmd = tmr_req->ref_cmd;
785 
786 	if (ref_cmd->iscsi_opcode != ISCSI_OP_SCSI_CMD)
787 		return 0;
788 
789 	if (ref_cmd->se_cmd.se_cmd_flags & SCF_SENT_CHECK_CONDITION)
790 		return 0;
791 
792 	if (ref_cmd->data_direction == DMA_NONE)
793 		return 0;
794 
795 	/*
796 	 * For READs the TMR TASK_REASSIGNs ExpDataSN contains the next DataSN
797 	 * of DataIN the Initiator is expecting.
798 	 *
799 	 * Also check that the Initiator is not re-requesting DataIN that has
800 	 * already been acknowledged with a DataAck SNACK.
801 	 */
802 	if (ref_cmd->data_direction == DMA_FROM_DEVICE) {
803 		if (tmr_req->exp_data_sn > ref_cmd->data_sn) {
804 			pr_err("Received ExpDataSN: 0x%08x for READ"
805 				" in TMR TASK_REASSIGN greater than command's"
806 				" DataSN: 0x%08x.\n", tmr_req->exp_data_sn,
807 				ref_cmd->data_sn);
808 			return -1;
809 		}
810 		if ((ref_cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
811 		    (tmr_req->exp_data_sn <= ref_cmd->acked_data_sn)) {
812 			pr_err("Received ExpDataSN: 0x%08x for READ"
813 				" in TMR TASK_REASSIGN for previously"
814 				" acknowledged DataIN: 0x%08x,"
815 				" protocol error\n", tmr_req->exp_data_sn,
816 				ref_cmd->acked_data_sn);
817 			return -1;
818 		}
819 		return iscsit_task_reassign_prepare_read(tmr_req, conn);
820 	}
821 
822 	/*
823 	 * For WRITEs the TMR TASK_REASSIGNs ExpDataSN contains the next R2TSN
824 	 * for R2Ts the Initiator is expecting.
825 	 *
826 	 * Do the magic in iscsit_task_reassign_prepare_write().
827 	 */
828 	if (ref_cmd->data_direction == DMA_TO_DEVICE) {
829 		if (tmr_req->exp_data_sn > ref_cmd->r2t_sn) {
830 			pr_err("Received ExpDataSN: 0x%08x for WRITE"
831 				" in TMR TASK_REASSIGN greater than command's"
832 				" R2TSN: 0x%08x.\n", tmr_req->exp_data_sn,
833 					ref_cmd->r2t_sn);
834 			return -1;
835 		}
836 		return iscsit_task_reassign_prepare_write(tmr_req, conn);
837 	}
838 
839 	pr_err("Unknown iSCSI data_direction: 0x%02x\n",
840 			ref_cmd->data_direction);
841 
842 	return -1;
843 }
844