1 /*******************************************************************************
2  * Filename:  target_core_pr.c
3  *
4  * This file contains SPC-3 compliant persistent reservations and
5  * legacy SPC-2 reservations with compatible reservation handling (CRH=1)
6  *
7  * Copyright (c) 2009, 2010 Rising Tide Systems
8  * Copyright (c) 2009, 2010 Linux-iSCSI.org
9  *
10  * Nicholas A. Bellinger <nab@kernel.org>
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of the GNU General Public License as published by
14  * the Free Software Foundation; either version 2 of the License, or
15  * (at your option) any later version.
16  *
17  * This program is distributed in the hope that it will be useful,
18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20  * GNU General Public License for more details.
21  *
22  * You should have received a copy of the GNU General Public License
23  * along with this program; if not, write to the Free Software
24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25  *
26  ******************************************************************************/
27 
28 #include <linux/slab.h>
29 #include <linux/spinlock.h>
30 #include <linux/list.h>
31 #include <scsi/scsi.h>
32 #include <scsi/scsi_cmnd.h>
33 #include <asm/unaligned.h>
34 
35 #include <target/target_core_base.h>
36 #include <target/target_core_device.h>
37 #include <target/target_core_tmr.h>
38 #include <target/target_core_tpg.h>
39 #include <target/target_core_transport.h>
40 #include <target/target_core_fabric_ops.h>
41 #include <target/target_core_configfs.h>
42 
43 #include "target_core_hba.h"
44 #include "target_core_pr.h"
45 #include "target_core_ua.h"
46 
47 /*
48  * Used for Specify Initiator Ports Capable Bit (SPEC_I_PT)
49  */
50 struct pr_transport_id_holder {
51 	int dest_local_nexus;
52 	struct t10_pr_registration *dest_pr_reg;
53 	struct se_portal_group *dest_tpg;
54 	struct se_node_acl *dest_node_acl;
55 	struct se_dev_entry *dest_se_deve;
56 	struct list_head dest_list;
57 };
58 
59 int core_pr_dump_initiator_port(
60 	struct t10_pr_registration *pr_reg,
61 	char *buf,
62 	u32 size)
63 {
64 	if (!pr_reg->isid_present_at_reg)
65 		return 0;
66 
67 	snprintf(buf, size, ",i,0x%s", &pr_reg->pr_reg_isid[0]);
68 	return 1;
69 }
70 
71 static void __core_scsi3_complete_pro_release(struct se_device *, struct se_node_acl *,
72 			struct t10_pr_registration *, int);
73 
74 static int core_scsi2_reservation_seq_non_holder(
75 	struct se_cmd *cmd,
76 	unsigned char *cdb,
77 	u32 pr_reg_type)
78 {
79 	switch (cdb[0]) {
80 	case INQUIRY:
81 	case RELEASE:
82 	case RELEASE_10:
83 		return 0;
84 	default:
85 		return 1;
86 	}
87 
88 	return 1;
89 }
90 
91 static int core_scsi2_reservation_check(struct se_cmd *cmd, u32 *pr_reg_type)
92 {
93 	struct se_device *dev = cmd->se_dev;
94 	struct se_session *sess = cmd->se_sess;
95 	int ret;
96 
97 	if (!sess)
98 		return 0;
99 
100 	spin_lock(&dev->dev_reservation_lock);
101 	if (!dev->dev_reserved_node_acl || !sess) {
102 		spin_unlock(&dev->dev_reservation_lock);
103 		return 0;
104 	}
105 	if (dev->dev_reserved_node_acl != sess->se_node_acl) {
106 		spin_unlock(&dev->dev_reservation_lock);
107 		return -EINVAL;
108 	}
109 	if (!(dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID)) {
110 		spin_unlock(&dev->dev_reservation_lock);
111 		return 0;
112 	}
113 	ret = (dev->dev_res_bin_isid == sess->sess_bin_isid) ? 0 : -EINVAL;
114 	spin_unlock(&dev->dev_reservation_lock);
115 
116 	return ret;
117 }
118 
119 static struct t10_pr_registration *core_scsi3_locate_pr_reg(struct se_device *,
120 					struct se_node_acl *, struct se_session *);
121 static void core_scsi3_put_pr_reg(struct t10_pr_registration *);
122 
123 static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
124 {
125 	struct se_session *se_sess = cmd->se_sess;
126 	struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev;
127 	struct t10_pr_registration *pr_reg;
128 	struct t10_reservation *pr_tmpl = &su_dev->t10_pr;
129 	int crh = (su_dev->t10_pr.res_type == SPC3_PERSISTENT_RESERVATIONS);
130 	int conflict = 0;
131 
132 	if (!crh)
133 		return false;
134 
135 	pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
136 			se_sess);
137 	if (pr_reg) {
138 		/*
139 		 * From spc4r17 5.7.3 Exceptions to SPC-2 RESERVE and RELEASE
140 		 * behavior
141 		 *
142 		 * A RESERVE(6) or RESERVE(10) command shall complete with GOOD
143 		 * status, but no reservation shall be established and the
144 		 * persistent reservation shall not be changed, if the command
145 		 * is received from a) and b) below.
146 		 *
147 		 * A RELEASE(6) or RELEASE(10) command shall complete with GOOD
148 		 * status, but the persistent reservation shall not be released,
149 		 * if the command is received from a) and b)
150 		 *
151 		 * a) An I_T nexus that is a persistent reservation holder; or
152 		 * b) An I_T nexus that is registered if a registrants only or
153 		 *    all registrants type persistent reservation is present.
154 		 *
155 		 * In all other cases, a RESERVE(6) command, RESERVE(10) command,
156 		 * RELEASE(6) command, or RELEASE(10) command shall be processed
157 		 * as defined in SPC-2.
158 		 */
159 		if (pr_reg->pr_res_holder) {
160 			core_scsi3_put_pr_reg(pr_reg);
161 			*ret = 0;
162 			return false;
163 		}
164 		if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) ||
165 		    (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) ||
166 		    (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
167 		    (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
168 			core_scsi3_put_pr_reg(pr_reg);
169 			*ret = 0;
170 			return true;
171 		}
172 		core_scsi3_put_pr_reg(pr_reg);
173 		conflict = 1;
174 	} else {
175 		/*
176 		 * Following spc2r20 5.5.1 Reservations overview:
177 		 *
178 		 * If a logical unit has executed a PERSISTENT RESERVE OUT
179 		 * command with the REGISTER or the REGISTER AND IGNORE
180 		 * EXISTING KEY service action and is still registered by any
181 		 * initiator, all RESERVE commands and all RELEASE commands
182 		 * regardless of initiator shall conflict and shall terminate
183 		 * with a RESERVATION CONFLICT status.
184 		 */
185 		spin_lock(&pr_tmpl->registration_lock);
186 		conflict = (list_empty(&pr_tmpl->registration_list)) ? 0 : 1;
187 		spin_unlock(&pr_tmpl->registration_lock);
188 	}
189 
190 	if (conflict) {
191 		pr_err("Received legacy SPC-2 RESERVE/RELEASE"
192 			" while active SPC-3 registrations exist,"
193 			" returning RESERVATION_CONFLICT\n");
194 		*ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
195 		return true;
196 	}
197 
198 	return false;
199 }
200 
201 int target_scsi2_reservation_release(struct se_task *task)
202 {
203 	struct se_cmd *cmd = task->task_se_cmd;
204 	struct se_device *dev = cmd->se_dev;
205 	struct se_session *sess = cmd->se_sess;
206 	struct se_portal_group *tpg = sess->se_tpg;
207 	int ret = 0;
208 
209 	if (!sess || !tpg)
210 		goto out;
211 	if (target_check_scsi2_reservation_conflict(cmd, &ret))
212 		goto out;
213 
214 	ret = 0;
215 	spin_lock(&dev->dev_reservation_lock);
216 	if (!dev->dev_reserved_node_acl || !sess)
217 		goto out_unlock;
218 
219 	if (dev->dev_reserved_node_acl != sess->se_node_acl)
220 		goto out_unlock;
221 
222 	dev->dev_reserved_node_acl = NULL;
223 	dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
224 	if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
225 		dev->dev_res_bin_isid = 0;
226 		dev->dev_flags &= ~DF_SPC2_RESERVATIONS_WITH_ISID;
227 	}
228 	pr_debug("SCSI-2 Released reservation for %s LUN: %u ->"
229 		" MAPPED LUN: %u for %s\n", tpg->se_tpg_tfo->get_fabric_name(),
230 		cmd->se_lun->unpacked_lun, cmd->se_deve->mapped_lun,
231 		sess->se_node_acl->initiatorname);
232 
233 out_unlock:
234 	spin_unlock(&dev->dev_reservation_lock);
235 out:
236 	if (!ret) {
237 		task->task_scsi_status = GOOD;
238 		transport_complete_task(task, 1);
239 	}
240 	return ret;
241 }
242 
243 int target_scsi2_reservation_reserve(struct se_task *task)
244 {
245 	struct se_cmd *cmd = task->task_se_cmd;
246 	struct se_device *dev = cmd->se_dev;
247 	struct se_session *sess = cmd->se_sess;
248 	struct se_portal_group *tpg = sess->se_tpg;
249 	int ret = 0;
250 
251 	if ((cmd->t_task_cdb[1] & 0x01) &&
252 	    (cmd->t_task_cdb[1] & 0x02)) {
253 		pr_err("LongIO and Obselete Bits set, returning"
254 				" ILLEGAL_REQUEST\n");
255 		ret = PYX_TRANSPORT_ILLEGAL_REQUEST;
256 		goto out;
257 	}
258 	/*
259 	 * This is currently the case for target_core_mod passthrough struct se_cmd
260 	 * ops
261 	 */
262 	if (!sess || !tpg)
263 		goto out;
264 	if (target_check_scsi2_reservation_conflict(cmd, &ret))
265 		goto out;
266 
267 	ret = 0;
268 	spin_lock(&dev->dev_reservation_lock);
269 	if (dev->dev_reserved_node_acl &&
270 	   (dev->dev_reserved_node_acl != sess->se_node_acl)) {
271 		pr_err("SCSI-2 RESERVATION CONFLIFT for %s fabric\n",
272 			tpg->se_tpg_tfo->get_fabric_name());
273 		pr_err("Original reserver LUN: %u %s\n",
274 			cmd->se_lun->unpacked_lun,
275 			dev->dev_reserved_node_acl->initiatorname);
276 		pr_err("Current attempt - LUN: %u -> MAPPED LUN: %u"
277 			" from %s \n", cmd->se_lun->unpacked_lun,
278 			cmd->se_deve->mapped_lun,
279 			sess->se_node_acl->initiatorname);
280 		ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
281 		goto out_unlock;
282 	}
283 
284 	dev->dev_reserved_node_acl = sess->se_node_acl;
285 	dev->dev_flags |= DF_SPC2_RESERVATIONS;
286 	if (sess->sess_bin_isid != 0) {
287 		dev->dev_res_bin_isid = sess->sess_bin_isid;
288 		dev->dev_flags |= DF_SPC2_RESERVATIONS_WITH_ISID;
289 	}
290 	pr_debug("SCSI-2 Reserved %s LUN: %u -> MAPPED LUN: %u"
291 		" for %s\n", tpg->se_tpg_tfo->get_fabric_name(),
292 		cmd->se_lun->unpacked_lun, cmd->se_deve->mapped_lun,
293 		sess->se_node_acl->initiatorname);
294 
295 out_unlock:
296 	spin_unlock(&dev->dev_reservation_lock);
297 out:
298 	if (!ret) {
299 		task->task_scsi_status = GOOD;
300 		transport_complete_task(task, 1);
301 	}
302 	return ret;
303 }
304 
305 
306 /*
307  * Begin SPC-3/SPC-4 Persistent Reservations emulation support
308  *
309  * This function is called by those initiator ports who are *NOT*
310  * the active PR reservation holder when a reservation is present.
311  */
312 static int core_scsi3_pr_seq_non_holder(
313 	struct se_cmd *cmd,
314 	unsigned char *cdb,
315 	u32 pr_reg_type)
316 {
317 	struct se_dev_entry *se_deve;
318 	struct se_session *se_sess = cmd->se_sess;
319 	int other_cdb = 0, ignore_reg;
320 	int registered_nexus = 0, ret = 1; /* Conflict by default */
321 	int all_reg = 0, reg_only = 0; /* ALL_REG, REG_ONLY */
322 	int we = 0; /* Write Exclusive */
323 	int legacy = 0; /* Act like a legacy device and return
324 			 * RESERVATION CONFLICT on some CDBs */
325 	/*
326 	 * A legacy SPC-2 reservation is being held.
327 	 */
328 	if (cmd->se_dev->dev_flags & DF_SPC2_RESERVATIONS)
329 		return core_scsi2_reservation_seq_non_holder(cmd,
330 					cdb, pr_reg_type);
331 
332 	se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
333 	/*
334 	 * Determine if the registration should be ignored due to
335 	 * non-matching ISIDs in core_scsi3_pr_reservation_check().
336 	 */
337 	ignore_reg = (pr_reg_type & 0x80000000);
338 	if (ignore_reg)
339 		pr_reg_type &= ~0x80000000;
340 
341 	switch (pr_reg_type) {
342 	case PR_TYPE_WRITE_EXCLUSIVE:
343 		we = 1;
344 	case PR_TYPE_EXCLUSIVE_ACCESS:
345 		/*
346 		 * Some commands are only allowed for the persistent reservation
347 		 * holder.
348 		 */
349 		if ((se_deve->def_pr_registered) && !(ignore_reg))
350 			registered_nexus = 1;
351 		break;
352 	case PR_TYPE_WRITE_EXCLUSIVE_REGONLY:
353 		we = 1;
354 	case PR_TYPE_EXCLUSIVE_ACCESS_REGONLY:
355 		/*
356 		 * Some commands are only allowed for registered I_T Nexuses.
357 		 */
358 		reg_only = 1;
359 		if ((se_deve->def_pr_registered) && !(ignore_reg))
360 			registered_nexus = 1;
361 		break;
362 	case PR_TYPE_WRITE_EXCLUSIVE_ALLREG:
363 		we = 1;
364 	case PR_TYPE_EXCLUSIVE_ACCESS_ALLREG:
365 		/*
366 		 * Each registered I_T Nexus is a reservation holder.
367 		 */
368 		all_reg = 1;
369 		if ((se_deve->def_pr_registered) && !(ignore_reg))
370 			registered_nexus = 1;
371 		break;
372 	default:
373 		return -EINVAL;
374 	}
375 	/*
376 	 * Referenced from spc4r17 table 45 for *NON* PR holder access
377 	 */
378 	switch (cdb[0]) {
379 	case SECURITY_PROTOCOL_IN:
380 		if (registered_nexus)
381 			return 0;
382 		ret = (we) ? 0 : 1;
383 		break;
384 	case MODE_SENSE:
385 	case MODE_SENSE_10:
386 	case READ_ATTRIBUTE:
387 	case READ_BUFFER:
388 	case RECEIVE_DIAGNOSTIC:
389 		if (legacy) {
390 			ret = 1;
391 			break;
392 		}
393 		if (registered_nexus) {
394 			ret = 0;
395 			break;
396 		}
397 		ret = (we) ? 0 : 1; /* Allowed Write Exclusive */
398 		break;
399 	case PERSISTENT_RESERVE_OUT:
400 		/*
401 		 * This follows PERSISTENT_RESERVE_OUT service actions that
402 		 * are allowed in the presence of various reservations.
403 		 * See spc4r17, table 46
404 		 */
405 		switch (cdb[1] & 0x1f) {
406 		case PRO_CLEAR:
407 		case PRO_PREEMPT:
408 		case PRO_PREEMPT_AND_ABORT:
409 			ret = (registered_nexus) ? 0 : 1;
410 			break;
411 		case PRO_REGISTER:
412 		case PRO_REGISTER_AND_IGNORE_EXISTING_KEY:
413 			ret = 0;
414 			break;
415 		case PRO_REGISTER_AND_MOVE:
416 		case PRO_RESERVE:
417 			ret = 1;
418 			break;
419 		case PRO_RELEASE:
420 			ret = (registered_nexus) ? 0 : 1;
421 			break;
422 		default:
423 			pr_err("Unknown PERSISTENT_RESERVE_OUT service"
424 				" action: 0x%02x\n", cdb[1] & 0x1f);
425 			return -EINVAL;
426 		}
427 		break;
428 	case RELEASE:
429 	case RELEASE_10:
430 		/* Handled by CRH=1 in target_scsi2_reservation_release() */
431 		ret = 0;
432 		break;
433 	case RESERVE:
434 	case RESERVE_10:
435 		/* Handled by CRH=1 in target_scsi2_reservation_reserve() */
436 		ret = 0;
437 		break;
438 	case TEST_UNIT_READY:
439 		ret = (legacy) ? 1 : 0; /* Conflict for legacy */
440 		break;
441 	case MAINTENANCE_IN:
442 		switch (cdb[1] & 0x1f) {
443 		case MI_MANAGEMENT_PROTOCOL_IN:
444 			if (registered_nexus) {
445 				ret = 0;
446 				break;
447 			}
448 			ret = (we) ? 0 : 1; /* Allowed Write Exclusive */
449 			break;
450 		case MI_REPORT_SUPPORTED_OPERATION_CODES:
451 		case MI_REPORT_SUPPORTED_TASK_MANAGEMENT_FUNCTIONS:
452 			if (legacy) {
453 				ret = 1;
454 				break;
455 			}
456 			if (registered_nexus) {
457 				ret = 0;
458 				break;
459 			}
460 			ret = (we) ? 0 : 1; /* Allowed Write Exclusive */
461 			break;
462 		case MI_REPORT_ALIASES:
463 		case MI_REPORT_IDENTIFYING_INFORMATION:
464 		case MI_REPORT_PRIORITY:
465 		case MI_REPORT_TARGET_PGS:
466 		case MI_REPORT_TIMESTAMP:
467 			ret = 0; /* Allowed */
468 			break;
469 		default:
470 			pr_err("Unknown MI Service Action: 0x%02x\n",
471 				(cdb[1] & 0x1f));
472 			return -EINVAL;
473 		}
474 		break;
475 	case ACCESS_CONTROL_IN:
476 	case ACCESS_CONTROL_OUT:
477 	case INQUIRY:
478 	case LOG_SENSE:
479 	case READ_MEDIA_SERIAL_NUMBER:
480 	case REPORT_LUNS:
481 	case REQUEST_SENSE:
482 		ret = 0; /*/ Allowed CDBs */
483 		break;
484 	default:
485 		other_cdb = 1;
486 		break;
487 	}
488 	/*
489 	 * Case where the CDB is explicitly allowed in the above switch
490 	 * statement.
491 	 */
492 	if (!ret && !other_cdb) {
493 #if 0
494 		pr_debug("Allowing explict CDB: 0x%02x for %s"
495 			" reservation holder\n", cdb[0],
496 			core_scsi3_pr_dump_type(pr_reg_type));
497 #endif
498 		return ret;
499 	}
500 	/*
501 	 * Check if write exclusive initiator ports *NOT* holding the
502 	 * WRITE_EXCLUSIVE_* reservation.
503 	 */
504 	if ((we) && !(registered_nexus)) {
505 		if (cmd->data_direction == DMA_TO_DEVICE) {
506 			/*
507 			 * Conflict for write exclusive
508 			 */
509 			pr_debug("%s Conflict for unregistered nexus"
510 				" %s CDB: 0x%02x to %s reservation\n",
511 				transport_dump_cmd_direction(cmd),
512 				se_sess->se_node_acl->initiatorname, cdb[0],
513 				core_scsi3_pr_dump_type(pr_reg_type));
514 			return 1;
515 		} else {
516 			/*
517 			 * Allow non WRITE CDBs for all Write Exclusive
518 			 * PR TYPEs to pass for registered and
519 			 * non-registered_nexuxes NOT holding the reservation.
520 			 *
521 			 * We only make noise for the unregisterd nexuses,
522 			 * as we expect registered non-reservation holding
523 			 * nexuses to issue CDBs.
524 			 */
525 #if 0
526 			if (!registered_nexus) {
527 				pr_debug("Allowing implict CDB: 0x%02x"
528 					" for %s reservation on unregistered"
529 					" nexus\n", cdb[0],
530 					core_scsi3_pr_dump_type(pr_reg_type));
531 			}
532 #endif
533 			return 0;
534 		}
535 	} else if ((reg_only) || (all_reg)) {
536 		if (registered_nexus) {
537 			/*
538 			 * For PR_*_REG_ONLY and PR_*_ALL_REG reservations,
539 			 * allow commands from registered nexuses.
540 			 */
541 #if 0
542 			pr_debug("Allowing implict CDB: 0x%02x for %s"
543 				" reservation\n", cdb[0],
544 				core_scsi3_pr_dump_type(pr_reg_type));
545 #endif
546 			return 0;
547 		}
548 	}
549 	pr_debug("%s Conflict for %sregistered nexus %s CDB: 0x%2x"
550 		" for %s reservation\n", transport_dump_cmd_direction(cmd),
551 		(registered_nexus) ? "" : "un",
552 		se_sess->se_node_acl->initiatorname, cdb[0],
553 		core_scsi3_pr_dump_type(pr_reg_type));
554 
555 	return 1; /* Conflict by default */
556 }
557 
558 static u32 core_scsi3_pr_generation(struct se_device *dev)
559 {
560 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
561 	u32 prg;
562 	/*
563 	 * PRGeneration field shall contain the value of a 32-bit wrapping
564 	 * counter mainted by the device server.
565 	 *
566 	 * Note that this is done regardless of Active Persist across
567 	 * Target PowerLoss (APTPL)
568 	 *
569 	 * See spc4r17 section 6.3.12 READ_KEYS service action
570 	 */
571 	spin_lock(&dev->dev_reservation_lock);
572 	prg = su_dev->t10_pr.pr_generation++;
573 	spin_unlock(&dev->dev_reservation_lock);
574 
575 	return prg;
576 }
577 
578 static int core_scsi3_pr_reservation_check(
579 	struct se_cmd *cmd,
580 	u32 *pr_reg_type)
581 {
582 	struct se_device *dev = cmd->se_dev;
583 	struct se_session *sess = cmd->se_sess;
584 	int ret;
585 
586 	if (!sess)
587 		return 0;
588 	/*
589 	 * A legacy SPC-2 reservation is being held.
590 	 */
591 	if (dev->dev_flags & DF_SPC2_RESERVATIONS)
592 		return core_scsi2_reservation_check(cmd, pr_reg_type);
593 
594 	spin_lock(&dev->dev_reservation_lock);
595 	if (!dev->dev_pr_res_holder) {
596 		spin_unlock(&dev->dev_reservation_lock);
597 		return 0;
598 	}
599 	*pr_reg_type = dev->dev_pr_res_holder->pr_res_type;
600 	cmd->pr_res_key = dev->dev_pr_res_holder->pr_res_key;
601 	if (dev->dev_pr_res_holder->pr_reg_nacl != sess->se_node_acl) {
602 		spin_unlock(&dev->dev_reservation_lock);
603 		return -EINVAL;
604 	}
605 	if (!dev->dev_pr_res_holder->isid_present_at_reg) {
606 		spin_unlock(&dev->dev_reservation_lock);
607 		return 0;
608 	}
609 	ret = (dev->dev_pr_res_holder->pr_reg_bin_isid ==
610 	       sess->sess_bin_isid) ? 0 : -EINVAL;
611 	/*
612 	 * Use bit in *pr_reg_type to notify ISID mismatch in
613 	 * core_scsi3_pr_seq_non_holder().
614 	 */
615 	if (ret != 0)
616 		*pr_reg_type |= 0x80000000;
617 	spin_unlock(&dev->dev_reservation_lock);
618 
619 	return ret;
620 }
621 
622 static struct t10_pr_registration *__core_scsi3_do_alloc_registration(
623 	struct se_device *dev,
624 	struct se_node_acl *nacl,
625 	struct se_dev_entry *deve,
626 	unsigned char *isid,
627 	u64 sa_res_key,
628 	int all_tg_pt,
629 	int aptpl)
630 {
631 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
632 	struct t10_pr_registration *pr_reg;
633 
634 	pr_reg = kmem_cache_zalloc(t10_pr_reg_cache, GFP_ATOMIC);
635 	if (!pr_reg) {
636 		pr_err("Unable to allocate struct t10_pr_registration\n");
637 		return NULL;
638 	}
639 
640 	pr_reg->pr_aptpl_buf = kzalloc(su_dev->t10_pr.pr_aptpl_buf_len,
641 					GFP_ATOMIC);
642 	if (!pr_reg->pr_aptpl_buf) {
643 		pr_err("Unable to allocate pr_reg->pr_aptpl_buf\n");
644 		kmem_cache_free(t10_pr_reg_cache, pr_reg);
645 		return NULL;
646 	}
647 
648 	INIT_LIST_HEAD(&pr_reg->pr_reg_list);
649 	INIT_LIST_HEAD(&pr_reg->pr_reg_abort_list);
650 	INIT_LIST_HEAD(&pr_reg->pr_reg_aptpl_list);
651 	INIT_LIST_HEAD(&pr_reg->pr_reg_atp_list);
652 	INIT_LIST_HEAD(&pr_reg->pr_reg_atp_mem_list);
653 	atomic_set(&pr_reg->pr_res_holders, 0);
654 	pr_reg->pr_reg_nacl = nacl;
655 	pr_reg->pr_reg_deve = deve;
656 	pr_reg->pr_res_mapped_lun = deve->mapped_lun;
657 	pr_reg->pr_aptpl_target_lun = deve->se_lun->unpacked_lun;
658 	pr_reg->pr_res_key = sa_res_key;
659 	pr_reg->pr_reg_all_tg_pt = all_tg_pt;
660 	pr_reg->pr_reg_aptpl = aptpl;
661 	pr_reg->pr_reg_tg_pt_lun = deve->se_lun;
662 	/*
663 	 * If an ISID value for this SCSI Initiator Port exists,
664 	 * save it to the registration now.
665 	 */
666 	if (isid != NULL) {
667 		pr_reg->pr_reg_bin_isid = get_unaligned_be64(isid);
668 		snprintf(pr_reg->pr_reg_isid, PR_REG_ISID_LEN, "%s", isid);
669 		pr_reg->isid_present_at_reg = 1;
670 	}
671 
672 	return pr_reg;
673 }
674 
675 static int core_scsi3_lunacl_depend_item(struct se_dev_entry *);
676 static void core_scsi3_lunacl_undepend_item(struct se_dev_entry *);
677 
678 /*
679  * Function used for handling PR registrations for ALL_TG_PT=1 and ALL_TG_PT=0
680  * modes.
681  */
682 static struct t10_pr_registration *__core_scsi3_alloc_registration(
683 	struct se_device *dev,
684 	struct se_node_acl *nacl,
685 	struct se_dev_entry *deve,
686 	unsigned char *isid,
687 	u64 sa_res_key,
688 	int all_tg_pt,
689 	int aptpl)
690 {
691 	struct se_dev_entry *deve_tmp;
692 	struct se_node_acl *nacl_tmp;
693 	struct se_port *port, *port_tmp;
694 	struct target_core_fabric_ops *tfo = nacl->se_tpg->se_tpg_tfo;
695 	struct t10_pr_registration *pr_reg, *pr_reg_atp, *pr_reg_tmp, *pr_reg_tmp_safe;
696 	int ret;
697 	/*
698 	 * Create a registration for the I_T Nexus upon which the
699 	 * PROUT REGISTER was received.
700 	 */
701 	pr_reg = __core_scsi3_do_alloc_registration(dev, nacl, deve, isid,
702 			sa_res_key, all_tg_pt, aptpl);
703 	if (!pr_reg)
704 		return NULL;
705 	/*
706 	 * Return pointer to pr_reg for ALL_TG_PT=0
707 	 */
708 	if (!all_tg_pt)
709 		return pr_reg;
710 	/*
711 	 * Create list of matching SCSI Initiator Port registrations
712 	 * for ALL_TG_PT=1
713 	 */
714 	spin_lock(&dev->se_port_lock);
715 	list_for_each_entry_safe(port, port_tmp, &dev->dev_sep_list, sep_list) {
716 		atomic_inc(&port->sep_tg_pt_ref_cnt);
717 		smp_mb__after_atomic_inc();
718 		spin_unlock(&dev->se_port_lock);
719 
720 		spin_lock_bh(&port->sep_alua_lock);
721 		list_for_each_entry(deve_tmp, &port->sep_alua_list,
722 					alua_port_list) {
723 			/*
724 			 * This pointer will be NULL for demo mode MappedLUNs
725 			 * that have not been make explict via a ConfigFS
726 			 * MappedLUN group for the SCSI Initiator Node ACL.
727 			 */
728 			if (!deve_tmp->se_lun_acl)
729 				continue;
730 
731 			nacl_tmp = deve_tmp->se_lun_acl->se_lun_nacl;
732 			/*
733 			 * Skip the matching struct se_node_acl that is allocated
734 			 * above..
735 			 */
736 			if (nacl == nacl_tmp)
737 				continue;
738 			/*
739 			 * Only perform PR registrations for target ports on
740 			 * the same fabric module as the REGISTER w/ ALL_TG_PT=1
741 			 * arrived.
742 			 */
743 			if (tfo != nacl_tmp->se_tpg->se_tpg_tfo)
744 				continue;
745 			/*
746 			 * Look for a matching Initiator Node ACL in ASCII format
747 			 */
748 			if (strcmp(nacl->initiatorname, nacl_tmp->initiatorname))
749 				continue;
750 
751 			atomic_inc(&deve_tmp->pr_ref_count);
752 			smp_mb__after_atomic_inc();
753 			spin_unlock_bh(&port->sep_alua_lock);
754 			/*
755 			 * Grab a configfs group dependency that is released
756 			 * for the exception path at label out: below, or upon
757 			 * completion of adding ALL_TG_PT=1 registrations in
758 			 * __core_scsi3_add_registration()
759 			 */
760 			ret = core_scsi3_lunacl_depend_item(deve_tmp);
761 			if (ret < 0) {
762 				pr_err("core_scsi3_lunacl_depend"
763 						"_item() failed\n");
764 				atomic_dec(&port->sep_tg_pt_ref_cnt);
765 				smp_mb__after_atomic_dec();
766 				atomic_dec(&deve_tmp->pr_ref_count);
767 				smp_mb__after_atomic_dec();
768 				goto out;
769 			}
770 			/*
771 			 * Located a matching SCSI Initiator Port on a different
772 			 * port, allocate the pr_reg_atp and attach it to the
773 			 * pr_reg->pr_reg_atp_list that will be processed once
774 			 * the original *pr_reg is processed in
775 			 * __core_scsi3_add_registration()
776 			 */
777 			pr_reg_atp = __core_scsi3_do_alloc_registration(dev,
778 						nacl_tmp, deve_tmp, NULL,
779 						sa_res_key, all_tg_pt, aptpl);
780 			if (!pr_reg_atp) {
781 				atomic_dec(&port->sep_tg_pt_ref_cnt);
782 				smp_mb__after_atomic_dec();
783 				atomic_dec(&deve_tmp->pr_ref_count);
784 				smp_mb__after_atomic_dec();
785 				core_scsi3_lunacl_undepend_item(deve_tmp);
786 				goto out;
787 			}
788 
789 			list_add_tail(&pr_reg_atp->pr_reg_atp_mem_list,
790 				      &pr_reg->pr_reg_atp_list);
791 			spin_lock_bh(&port->sep_alua_lock);
792 		}
793 		spin_unlock_bh(&port->sep_alua_lock);
794 
795 		spin_lock(&dev->se_port_lock);
796 		atomic_dec(&port->sep_tg_pt_ref_cnt);
797 		smp_mb__after_atomic_dec();
798 	}
799 	spin_unlock(&dev->se_port_lock);
800 
801 	return pr_reg;
802 out:
803 	list_for_each_entry_safe(pr_reg_tmp, pr_reg_tmp_safe,
804 			&pr_reg->pr_reg_atp_list, pr_reg_atp_mem_list) {
805 		list_del(&pr_reg_tmp->pr_reg_atp_mem_list);
806 		core_scsi3_lunacl_undepend_item(pr_reg_tmp->pr_reg_deve);
807 		kmem_cache_free(t10_pr_reg_cache, pr_reg_tmp);
808 	}
809 	kmem_cache_free(t10_pr_reg_cache, pr_reg);
810 	return NULL;
811 }
812 
813 int core_scsi3_alloc_aptpl_registration(
814 	struct t10_reservation *pr_tmpl,
815 	u64 sa_res_key,
816 	unsigned char *i_port,
817 	unsigned char *isid,
818 	u32 mapped_lun,
819 	unsigned char *t_port,
820 	u16 tpgt,
821 	u32 target_lun,
822 	int res_holder,
823 	int all_tg_pt,
824 	u8 type)
825 {
826 	struct t10_pr_registration *pr_reg;
827 
828 	if (!i_port || !t_port || !sa_res_key) {
829 		pr_err("Illegal parameters for APTPL registration\n");
830 		return -EINVAL;
831 	}
832 
833 	pr_reg = kmem_cache_zalloc(t10_pr_reg_cache, GFP_KERNEL);
834 	if (!pr_reg) {
835 		pr_err("Unable to allocate struct t10_pr_registration\n");
836 		return -ENOMEM;
837 	}
838 	pr_reg->pr_aptpl_buf = kzalloc(pr_tmpl->pr_aptpl_buf_len, GFP_KERNEL);
839 
840 	INIT_LIST_HEAD(&pr_reg->pr_reg_list);
841 	INIT_LIST_HEAD(&pr_reg->pr_reg_abort_list);
842 	INIT_LIST_HEAD(&pr_reg->pr_reg_aptpl_list);
843 	INIT_LIST_HEAD(&pr_reg->pr_reg_atp_list);
844 	INIT_LIST_HEAD(&pr_reg->pr_reg_atp_mem_list);
845 	atomic_set(&pr_reg->pr_res_holders, 0);
846 	pr_reg->pr_reg_nacl = NULL;
847 	pr_reg->pr_reg_deve = NULL;
848 	pr_reg->pr_res_mapped_lun = mapped_lun;
849 	pr_reg->pr_aptpl_target_lun = target_lun;
850 	pr_reg->pr_res_key = sa_res_key;
851 	pr_reg->pr_reg_all_tg_pt = all_tg_pt;
852 	pr_reg->pr_reg_aptpl = 1;
853 	pr_reg->pr_reg_tg_pt_lun = NULL;
854 	pr_reg->pr_res_scope = 0; /* Always LUN_SCOPE */
855 	pr_reg->pr_res_type = type;
856 	/*
857 	 * If an ISID value had been saved in APTPL metadata for this
858 	 * SCSI Initiator Port, restore it now.
859 	 */
860 	if (isid != NULL) {
861 		pr_reg->pr_reg_bin_isid = get_unaligned_be64(isid);
862 		snprintf(pr_reg->pr_reg_isid, PR_REG_ISID_LEN, "%s", isid);
863 		pr_reg->isid_present_at_reg = 1;
864 	}
865 	/*
866 	 * Copy the i_port and t_port information from caller.
867 	 */
868 	snprintf(pr_reg->pr_iport, PR_APTPL_MAX_IPORT_LEN, "%s", i_port);
869 	snprintf(pr_reg->pr_tport, PR_APTPL_MAX_TPORT_LEN, "%s", t_port);
870 	pr_reg->pr_reg_tpgt = tpgt;
871 	/*
872 	 * Set pr_res_holder from caller, the pr_reg who is the reservation
873 	 * holder will get it's pointer set in core_scsi3_aptpl_reserve() once
874 	 * the Initiator Node LUN ACL from the fabric module is created for
875 	 * this registration.
876 	 */
877 	pr_reg->pr_res_holder = res_holder;
878 
879 	list_add_tail(&pr_reg->pr_reg_aptpl_list, &pr_tmpl->aptpl_reg_list);
880 	pr_debug("SPC-3 PR APTPL Successfully added registration%s from"
881 			" metadata\n", (res_holder) ? "+reservation" : "");
882 	return 0;
883 }
884 
885 static void core_scsi3_aptpl_reserve(
886 	struct se_device *dev,
887 	struct se_portal_group *tpg,
888 	struct se_node_acl *node_acl,
889 	struct t10_pr_registration *pr_reg)
890 {
891 	char i_buf[PR_REG_ISID_ID_LEN];
892 	int prf_isid;
893 
894 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
895 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
896 				PR_REG_ISID_ID_LEN);
897 
898 	spin_lock(&dev->dev_reservation_lock);
899 	dev->dev_pr_res_holder = pr_reg;
900 	spin_unlock(&dev->dev_reservation_lock);
901 
902 	pr_debug("SPC-3 PR [%s] Service Action: APTPL RESERVE created"
903 		" new reservation holder TYPE: %s ALL_TG_PT: %d\n",
904 		tpg->se_tpg_tfo->get_fabric_name(),
905 		core_scsi3_pr_dump_type(pr_reg->pr_res_type),
906 		(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
907 	pr_debug("SPC-3 PR [%s] RESERVE Node: %s%s\n",
908 		tpg->se_tpg_tfo->get_fabric_name(), node_acl->initiatorname,
909 		(prf_isid) ? &i_buf[0] : "");
910 }
911 
912 static void __core_scsi3_add_registration(struct se_device *, struct se_node_acl *,
913 				struct t10_pr_registration *, int, int);
914 
915 static int __core_scsi3_check_aptpl_registration(
916 	struct se_device *dev,
917 	struct se_portal_group *tpg,
918 	struct se_lun *lun,
919 	u32 target_lun,
920 	struct se_node_acl *nacl,
921 	struct se_dev_entry *deve)
922 {
923 	struct t10_pr_registration *pr_reg, *pr_reg_tmp;
924 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
925 	unsigned char i_port[PR_APTPL_MAX_IPORT_LEN];
926 	unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
927 	u16 tpgt;
928 
929 	memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
930 	memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
931 	/*
932 	 * Copy Initiator Port information from struct se_node_acl
933 	 */
934 	snprintf(i_port, PR_APTPL_MAX_IPORT_LEN, "%s", nacl->initiatorname);
935 	snprintf(t_port, PR_APTPL_MAX_TPORT_LEN, "%s",
936 			tpg->se_tpg_tfo->tpg_get_wwn(tpg));
937 	tpgt = tpg->se_tpg_tfo->tpg_get_tag(tpg);
938 	/*
939 	 * Look for the matching registrations+reservation from those
940 	 * created from APTPL metadata.  Note that multiple registrations
941 	 * may exist for fabrics that use ISIDs in their SCSI Initiator Port
942 	 * TransportIDs.
943 	 */
944 	spin_lock(&pr_tmpl->aptpl_reg_lock);
945 	list_for_each_entry_safe(pr_reg, pr_reg_tmp, &pr_tmpl->aptpl_reg_list,
946 				pr_reg_aptpl_list) {
947 		if (!strcmp(pr_reg->pr_iport, i_port) &&
948 		     (pr_reg->pr_res_mapped_lun == deve->mapped_lun) &&
949 		    !(strcmp(pr_reg->pr_tport, t_port)) &&
950 		     (pr_reg->pr_reg_tpgt == tpgt) &&
951 		     (pr_reg->pr_aptpl_target_lun == target_lun)) {
952 
953 			pr_reg->pr_reg_nacl = nacl;
954 			pr_reg->pr_reg_deve = deve;
955 			pr_reg->pr_reg_tg_pt_lun = lun;
956 
957 			list_del(&pr_reg->pr_reg_aptpl_list);
958 			spin_unlock(&pr_tmpl->aptpl_reg_lock);
959 			/*
960 			 * At this point all of the pointers in *pr_reg will
961 			 * be setup, so go ahead and add the registration.
962 			 */
963 
964 			__core_scsi3_add_registration(dev, nacl, pr_reg, 0, 0);
965 			/*
966 			 * If this registration is the reservation holder,
967 			 * make that happen now..
968 			 */
969 			if (pr_reg->pr_res_holder)
970 				core_scsi3_aptpl_reserve(dev, tpg,
971 						nacl, pr_reg);
972 			/*
973 			 * Reenable pr_aptpl_active to accept new metadata
974 			 * updates once the SCSI device is active again..
975 			 */
976 			spin_lock(&pr_tmpl->aptpl_reg_lock);
977 			pr_tmpl->pr_aptpl_active = 1;
978 		}
979 	}
980 	spin_unlock(&pr_tmpl->aptpl_reg_lock);
981 
982 	return 0;
983 }
984 
985 int core_scsi3_check_aptpl_registration(
986 	struct se_device *dev,
987 	struct se_portal_group *tpg,
988 	struct se_lun *lun,
989 	struct se_lun_acl *lun_acl)
990 {
991 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
992 	struct se_node_acl *nacl = lun_acl->se_lun_nacl;
993 	struct se_dev_entry *deve = &nacl->device_list[lun_acl->mapped_lun];
994 
995 	if (su_dev->t10_pr.res_type != SPC3_PERSISTENT_RESERVATIONS)
996 		return 0;
997 
998 	return __core_scsi3_check_aptpl_registration(dev, tpg, lun,
999 				lun->unpacked_lun, nacl, deve);
1000 }
1001 
1002 static void __core_scsi3_dump_registration(
1003 	struct target_core_fabric_ops *tfo,
1004 	struct se_device *dev,
1005 	struct se_node_acl *nacl,
1006 	struct t10_pr_registration *pr_reg,
1007 	int register_type)
1008 {
1009 	struct se_portal_group *se_tpg = nacl->se_tpg;
1010 	char i_buf[PR_REG_ISID_ID_LEN];
1011 	int prf_isid;
1012 
1013 	memset(&i_buf[0], 0, PR_REG_ISID_ID_LEN);
1014 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
1015 				PR_REG_ISID_ID_LEN);
1016 
1017 	pr_debug("SPC-3 PR [%s] Service Action: REGISTER%s Initiator"
1018 		" Node: %s%s\n", tfo->get_fabric_name(), (register_type == 2) ?
1019 		"_AND_MOVE" : (register_type == 1) ?
1020 		"_AND_IGNORE_EXISTING_KEY" : "", nacl->initiatorname,
1021 		(prf_isid) ? i_buf : "");
1022 	pr_debug("SPC-3 PR [%s] registration on Target Port: %s,0x%04x\n",
1023 		 tfo->get_fabric_name(), tfo->tpg_get_wwn(se_tpg),
1024 		tfo->tpg_get_tag(se_tpg));
1025 	pr_debug("SPC-3 PR [%s] for %s TCM Subsystem %s Object Target"
1026 		" Port(s)\n",  tfo->get_fabric_name(),
1027 		(pr_reg->pr_reg_all_tg_pt) ? "ALL" : "SINGLE",
1028 		dev->transport->name);
1029 	pr_debug("SPC-3 PR [%s] SA Res Key: 0x%016Lx PRgeneration:"
1030 		" 0x%08x  APTPL: %d\n", tfo->get_fabric_name(),
1031 		pr_reg->pr_res_key, pr_reg->pr_res_generation,
1032 		pr_reg->pr_reg_aptpl);
1033 }
1034 
1035 /*
1036  * this function can be called with struct se_device->dev_reservation_lock
1037  * when register_move = 1
1038  */
1039 static void __core_scsi3_add_registration(
1040 	struct se_device *dev,
1041 	struct se_node_acl *nacl,
1042 	struct t10_pr_registration *pr_reg,
1043 	int register_type,
1044 	int register_move)
1045 {
1046 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
1047 	struct target_core_fabric_ops *tfo = nacl->se_tpg->se_tpg_tfo;
1048 	struct t10_pr_registration *pr_reg_tmp, *pr_reg_tmp_safe;
1049 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
1050 
1051 	/*
1052 	 * Increment PRgeneration counter for struct se_device upon a successful
1053 	 * REGISTER, see spc4r17 section 6.3.2 READ_KEYS service action
1054 	 *
1055 	 * Also, when register_move = 1 for PROUT REGISTER_AND_MOVE service
1056 	 * action, the struct se_device->dev_reservation_lock will already be held,
1057 	 * so we do not call core_scsi3_pr_generation() which grabs the lock
1058 	 * for the REGISTER.
1059 	 */
1060 	pr_reg->pr_res_generation = (register_move) ?
1061 			su_dev->t10_pr.pr_generation++ :
1062 			core_scsi3_pr_generation(dev);
1063 
1064 	spin_lock(&pr_tmpl->registration_lock);
1065 	list_add_tail(&pr_reg->pr_reg_list, &pr_tmpl->registration_list);
1066 	pr_reg->pr_reg_deve->def_pr_registered = 1;
1067 
1068 	__core_scsi3_dump_registration(tfo, dev, nacl, pr_reg, register_type);
1069 	spin_unlock(&pr_tmpl->registration_lock);
1070 	/*
1071 	 * Skip extra processing for ALL_TG_PT=0 or REGISTER_AND_MOVE.
1072 	 */
1073 	if (!pr_reg->pr_reg_all_tg_pt || register_move)
1074 		return;
1075 	/*
1076 	 * Walk pr_reg->pr_reg_atp_list and add registrations for ALL_TG_PT=1
1077 	 * allocated in __core_scsi3_alloc_registration()
1078 	 */
1079 	list_for_each_entry_safe(pr_reg_tmp, pr_reg_tmp_safe,
1080 			&pr_reg->pr_reg_atp_list, pr_reg_atp_mem_list) {
1081 		list_del(&pr_reg_tmp->pr_reg_atp_mem_list);
1082 
1083 		pr_reg_tmp->pr_res_generation = core_scsi3_pr_generation(dev);
1084 
1085 		spin_lock(&pr_tmpl->registration_lock);
1086 		list_add_tail(&pr_reg_tmp->pr_reg_list,
1087 			      &pr_tmpl->registration_list);
1088 		pr_reg_tmp->pr_reg_deve->def_pr_registered = 1;
1089 
1090 		__core_scsi3_dump_registration(tfo, dev,
1091 				pr_reg_tmp->pr_reg_nacl, pr_reg_tmp,
1092 				register_type);
1093 		spin_unlock(&pr_tmpl->registration_lock);
1094 		/*
1095 		 * Drop configfs group dependency reference from
1096 		 * __core_scsi3_alloc_registration()
1097 		 */
1098 		core_scsi3_lunacl_undepend_item(pr_reg_tmp->pr_reg_deve);
1099 	}
1100 }
1101 
1102 static int core_scsi3_alloc_registration(
1103 	struct se_device *dev,
1104 	struct se_node_acl *nacl,
1105 	struct se_dev_entry *deve,
1106 	unsigned char *isid,
1107 	u64 sa_res_key,
1108 	int all_tg_pt,
1109 	int aptpl,
1110 	int register_type,
1111 	int register_move)
1112 {
1113 	struct t10_pr_registration *pr_reg;
1114 
1115 	pr_reg = __core_scsi3_alloc_registration(dev, nacl, deve, isid,
1116 			sa_res_key, all_tg_pt, aptpl);
1117 	if (!pr_reg)
1118 		return -EPERM;
1119 
1120 	__core_scsi3_add_registration(dev, nacl, pr_reg,
1121 			register_type, register_move);
1122 	return 0;
1123 }
1124 
1125 static struct t10_pr_registration *__core_scsi3_locate_pr_reg(
1126 	struct se_device *dev,
1127 	struct se_node_acl *nacl,
1128 	unsigned char *isid)
1129 {
1130 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
1131 	struct t10_pr_registration *pr_reg, *pr_reg_tmp;
1132 	struct se_portal_group *tpg;
1133 
1134 	spin_lock(&pr_tmpl->registration_lock);
1135 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
1136 			&pr_tmpl->registration_list, pr_reg_list) {
1137 		/*
1138 		 * First look for a matching struct se_node_acl
1139 		 */
1140 		if (pr_reg->pr_reg_nacl != nacl)
1141 			continue;
1142 
1143 		tpg = pr_reg->pr_reg_nacl->se_tpg;
1144 		/*
1145 		 * If this registration does NOT contain a fabric provided
1146 		 * ISID, then we have found a match.
1147 		 */
1148 		if (!pr_reg->isid_present_at_reg) {
1149 			/*
1150 			 * Determine if this SCSI device server requires that
1151 			 * SCSI Intiatior TransportID w/ ISIDs is enforced
1152 			 * for fabric modules (iSCSI) requiring them.
1153 			 */
1154 			if (tpg->se_tpg_tfo->sess_get_initiator_sid != NULL) {
1155 				if (dev->se_sub_dev->se_dev_attrib.enforce_pr_isids)
1156 					continue;
1157 			}
1158 			atomic_inc(&pr_reg->pr_res_holders);
1159 			smp_mb__after_atomic_inc();
1160 			spin_unlock(&pr_tmpl->registration_lock);
1161 			return pr_reg;
1162 		}
1163 		/*
1164 		 * If the *pr_reg contains a fabric defined ISID for multi-value
1165 		 * SCSI Initiator Port TransportIDs, then we expect a valid
1166 		 * matching ISID to be provided by the local SCSI Initiator Port.
1167 		 */
1168 		if (!isid)
1169 			continue;
1170 		if (strcmp(isid, pr_reg->pr_reg_isid))
1171 			continue;
1172 
1173 		atomic_inc(&pr_reg->pr_res_holders);
1174 		smp_mb__after_atomic_inc();
1175 		spin_unlock(&pr_tmpl->registration_lock);
1176 		return pr_reg;
1177 	}
1178 	spin_unlock(&pr_tmpl->registration_lock);
1179 
1180 	return NULL;
1181 }
1182 
1183 static struct t10_pr_registration *core_scsi3_locate_pr_reg(
1184 	struct se_device *dev,
1185 	struct se_node_acl *nacl,
1186 	struct se_session *sess)
1187 {
1188 	struct se_portal_group *tpg = nacl->se_tpg;
1189 	unsigned char buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
1190 
1191 	if (tpg->se_tpg_tfo->sess_get_initiator_sid != NULL) {
1192 		memset(&buf[0], 0, PR_REG_ISID_LEN);
1193 		tpg->se_tpg_tfo->sess_get_initiator_sid(sess, &buf[0],
1194 					PR_REG_ISID_LEN);
1195 		isid_ptr = &buf[0];
1196 	}
1197 
1198 	return __core_scsi3_locate_pr_reg(dev, nacl, isid_ptr);
1199 }
1200 
1201 static void core_scsi3_put_pr_reg(struct t10_pr_registration *pr_reg)
1202 {
1203 	atomic_dec(&pr_reg->pr_res_holders);
1204 	smp_mb__after_atomic_dec();
1205 }
1206 
1207 static int core_scsi3_check_implict_release(
1208 	struct se_device *dev,
1209 	struct t10_pr_registration *pr_reg)
1210 {
1211 	struct se_node_acl *nacl = pr_reg->pr_reg_nacl;
1212 	struct t10_pr_registration *pr_res_holder;
1213 	int ret = 0;
1214 
1215 	spin_lock(&dev->dev_reservation_lock);
1216 	pr_res_holder = dev->dev_pr_res_holder;
1217 	if (!pr_res_holder) {
1218 		spin_unlock(&dev->dev_reservation_lock);
1219 		return ret;
1220 	}
1221 	if (pr_res_holder == pr_reg) {
1222 		/*
1223 		 * Perform an implict RELEASE if the registration that
1224 		 * is being released is holding the reservation.
1225 		 *
1226 		 * From spc4r17, section 5.7.11.1:
1227 		 *
1228 		 * e) If the I_T nexus is the persistent reservation holder
1229 		 *    and the persistent reservation is not an all registrants
1230 		 *    type, then a PERSISTENT RESERVE OUT command with REGISTER
1231 		 *    service action or REGISTER AND  IGNORE EXISTING KEY
1232 		 *    service action with the SERVICE ACTION RESERVATION KEY
1233 		 *    field set to zero (see 5.7.11.3).
1234 		 */
1235 		__core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0);
1236 		ret = 1;
1237 		/*
1238 		 * For 'All Registrants' reservation types, all existing
1239 		 * registrations are still processed as reservation holders
1240 		 * in core_scsi3_pr_seq_non_holder() after the initial
1241 		 * reservation holder is implictly released here.
1242 		 */
1243 	} else if (pr_reg->pr_reg_all_tg_pt &&
1244 		  (!strcmp(pr_res_holder->pr_reg_nacl->initiatorname,
1245 			  pr_reg->pr_reg_nacl->initiatorname)) &&
1246 		  (pr_res_holder->pr_res_key == pr_reg->pr_res_key)) {
1247 		pr_err("SPC-3 PR: Unable to perform ALL_TG_PT=1"
1248 			" UNREGISTER while existing reservation with matching"
1249 			" key 0x%016Lx is present from another SCSI Initiator"
1250 			" Port\n", pr_reg->pr_res_key);
1251 		ret = -EPERM;
1252 	}
1253 	spin_unlock(&dev->dev_reservation_lock);
1254 
1255 	return ret;
1256 }
1257 
1258 /*
1259  * Called with struct t10_reservation->registration_lock held.
1260  */
1261 static void __core_scsi3_free_registration(
1262 	struct se_device *dev,
1263 	struct t10_pr_registration *pr_reg,
1264 	struct list_head *preempt_and_abort_list,
1265 	int dec_holders)
1266 {
1267 	struct target_core_fabric_ops *tfo =
1268 			pr_reg->pr_reg_nacl->se_tpg->se_tpg_tfo;
1269 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
1270 	char i_buf[PR_REG_ISID_ID_LEN];
1271 	int prf_isid;
1272 
1273 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
1274 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
1275 				PR_REG_ISID_ID_LEN);
1276 
1277 	pr_reg->pr_reg_deve->def_pr_registered = 0;
1278 	pr_reg->pr_reg_deve->pr_res_key = 0;
1279 	list_del(&pr_reg->pr_reg_list);
1280 	/*
1281 	 * Caller accessing *pr_reg using core_scsi3_locate_pr_reg(),
1282 	 * so call core_scsi3_put_pr_reg() to decrement our reference.
1283 	 */
1284 	if (dec_holders)
1285 		core_scsi3_put_pr_reg(pr_reg);
1286 	/*
1287 	 * Wait until all reference from any other I_T nexuses for this
1288 	 * *pr_reg have been released.  Because list_del() is called above,
1289 	 * the last core_scsi3_put_pr_reg(pr_reg) will release this reference
1290 	 * count back to zero, and we release *pr_reg.
1291 	 */
1292 	while (atomic_read(&pr_reg->pr_res_holders) != 0) {
1293 		spin_unlock(&pr_tmpl->registration_lock);
1294 		pr_debug("SPC-3 PR [%s] waiting for pr_res_holders\n",
1295 				tfo->get_fabric_name());
1296 		cpu_relax();
1297 		spin_lock(&pr_tmpl->registration_lock);
1298 	}
1299 
1300 	pr_debug("SPC-3 PR [%s] Service Action: UNREGISTER Initiator"
1301 		" Node: %s%s\n", tfo->get_fabric_name(),
1302 		pr_reg->pr_reg_nacl->initiatorname,
1303 		(prf_isid) ? &i_buf[0] : "");
1304 	pr_debug("SPC-3 PR [%s] for %s TCM Subsystem %s Object Target"
1305 		" Port(s)\n", tfo->get_fabric_name(),
1306 		(pr_reg->pr_reg_all_tg_pt) ? "ALL" : "SINGLE",
1307 		dev->transport->name);
1308 	pr_debug("SPC-3 PR [%s] SA Res Key: 0x%016Lx PRgeneration:"
1309 		" 0x%08x\n", tfo->get_fabric_name(), pr_reg->pr_res_key,
1310 		pr_reg->pr_res_generation);
1311 
1312 	if (!preempt_and_abort_list) {
1313 		pr_reg->pr_reg_deve = NULL;
1314 		pr_reg->pr_reg_nacl = NULL;
1315 		kfree(pr_reg->pr_aptpl_buf);
1316 		kmem_cache_free(t10_pr_reg_cache, pr_reg);
1317 		return;
1318 	}
1319 	/*
1320 	 * For PREEMPT_AND_ABORT, the list of *pr_reg in preempt_and_abort_list
1321 	 * are released once the ABORT_TASK_SET has completed..
1322 	 */
1323 	list_add_tail(&pr_reg->pr_reg_abort_list, preempt_and_abort_list);
1324 }
1325 
1326 void core_scsi3_free_pr_reg_from_nacl(
1327 	struct se_device *dev,
1328 	struct se_node_acl *nacl)
1329 {
1330 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
1331 	struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_res_holder;
1332 	/*
1333 	 * If the passed se_node_acl matches the reservation holder,
1334 	 * release the reservation.
1335 	 */
1336 	spin_lock(&dev->dev_reservation_lock);
1337 	pr_res_holder = dev->dev_pr_res_holder;
1338 	if ((pr_res_holder != NULL) &&
1339 	    (pr_res_holder->pr_reg_nacl == nacl))
1340 		__core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0);
1341 	spin_unlock(&dev->dev_reservation_lock);
1342 	/*
1343 	 * Release any registration associated with the struct se_node_acl.
1344 	 */
1345 	spin_lock(&pr_tmpl->registration_lock);
1346 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
1347 			&pr_tmpl->registration_list, pr_reg_list) {
1348 
1349 		if (pr_reg->pr_reg_nacl != nacl)
1350 			continue;
1351 
1352 		__core_scsi3_free_registration(dev, pr_reg, NULL, 0);
1353 	}
1354 	spin_unlock(&pr_tmpl->registration_lock);
1355 }
1356 
1357 void core_scsi3_free_all_registrations(
1358 	struct se_device *dev)
1359 {
1360 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
1361 	struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_res_holder;
1362 
1363 	spin_lock(&dev->dev_reservation_lock);
1364 	pr_res_holder = dev->dev_pr_res_holder;
1365 	if (pr_res_holder != NULL) {
1366 		struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
1367 		__core_scsi3_complete_pro_release(dev, pr_res_nacl,
1368 				pr_res_holder, 0);
1369 	}
1370 	spin_unlock(&dev->dev_reservation_lock);
1371 
1372 	spin_lock(&pr_tmpl->registration_lock);
1373 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
1374 			&pr_tmpl->registration_list, pr_reg_list) {
1375 
1376 		__core_scsi3_free_registration(dev, pr_reg, NULL, 0);
1377 	}
1378 	spin_unlock(&pr_tmpl->registration_lock);
1379 
1380 	spin_lock(&pr_tmpl->aptpl_reg_lock);
1381 	list_for_each_entry_safe(pr_reg, pr_reg_tmp, &pr_tmpl->aptpl_reg_list,
1382 				pr_reg_aptpl_list) {
1383 		list_del(&pr_reg->pr_reg_aptpl_list);
1384 		kfree(pr_reg->pr_aptpl_buf);
1385 		kmem_cache_free(t10_pr_reg_cache, pr_reg);
1386 	}
1387 	spin_unlock(&pr_tmpl->aptpl_reg_lock);
1388 }
1389 
1390 static int core_scsi3_tpg_depend_item(struct se_portal_group *tpg)
1391 {
1392 	return configfs_depend_item(tpg->se_tpg_tfo->tf_subsys,
1393 			&tpg->tpg_group.cg_item);
1394 }
1395 
1396 static void core_scsi3_tpg_undepend_item(struct se_portal_group *tpg)
1397 {
1398 	configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
1399 			&tpg->tpg_group.cg_item);
1400 
1401 	atomic_dec(&tpg->tpg_pr_ref_count);
1402 	smp_mb__after_atomic_dec();
1403 }
1404 
1405 static int core_scsi3_nodeacl_depend_item(struct se_node_acl *nacl)
1406 {
1407 	struct se_portal_group *tpg = nacl->se_tpg;
1408 
1409 	if (nacl->dynamic_node_acl)
1410 		return 0;
1411 
1412 	return configfs_depend_item(tpg->se_tpg_tfo->tf_subsys,
1413 			&nacl->acl_group.cg_item);
1414 }
1415 
1416 static void core_scsi3_nodeacl_undepend_item(struct se_node_acl *nacl)
1417 {
1418 	struct se_portal_group *tpg = nacl->se_tpg;
1419 
1420 	if (nacl->dynamic_node_acl) {
1421 		atomic_dec(&nacl->acl_pr_ref_count);
1422 		smp_mb__after_atomic_dec();
1423 		return;
1424 	}
1425 
1426 	configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
1427 			&nacl->acl_group.cg_item);
1428 
1429 	atomic_dec(&nacl->acl_pr_ref_count);
1430 	smp_mb__after_atomic_dec();
1431 }
1432 
1433 static int core_scsi3_lunacl_depend_item(struct se_dev_entry *se_deve)
1434 {
1435 	struct se_lun_acl *lun_acl = se_deve->se_lun_acl;
1436 	struct se_node_acl *nacl;
1437 	struct se_portal_group *tpg;
1438 	/*
1439 	 * For nacl->dynamic_node_acl=1
1440 	 */
1441 	if (!lun_acl)
1442 		return 0;
1443 
1444 	nacl = lun_acl->se_lun_nacl;
1445 	tpg = nacl->se_tpg;
1446 
1447 	return configfs_depend_item(tpg->se_tpg_tfo->tf_subsys,
1448 			&lun_acl->se_lun_group.cg_item);
1449 }
1450 
1451 static void core_scsi3_lunacl_undepend_item(struct se_dev_entry *se_deve)
1452 {
1453 	struct se_lun_acl *lun_acl = se_deve->se_lun_acl;
1454 	struct se_node_acl *nacl;
1455 	struct se_portal_group *tpg;
1456 	/*
1457 	 * For nacl->dynamic_node_acl=1
1458 	 */
1459 	if (!lun_acl) {
1460 		atomic_dec(&se_deve->pr_ref_count);
1461 		smp_mb__after_atomic_dec();
1462 		return;
1463 	}
1464 	nacl = lun_acl->se_lun_nacl;
1465 	tpg = nacl->se_tpg;
1466 
1467 	configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
1468 			&lun_acl->se_lun_group.cg_item);
1469 
1470 	atomic_dec(&se_deve->pr_ref_count);
1471 	smp_mb__after_atomic_dec();
1472 }
1473 
1474 static int core_scsi3_decode_spec_i_port(
1475 	struct se_cmd *cmd,
1476 	struct se_portal_group *tpg,
1477 	unsigned char *l_isid,
1478 	u64 sa_res_key,
1479 	int all_tg_pt,
1480 	int aptpl)
1481 {
1482 	struct se_device *dev = cmd->se_dev;
1483 	struct se_port *tmp_port;
1484 	struct se_portal_group *dest_tpg = NULL, *tmp_tpg;
1485 	struct se_session *se_sess = cmd->se_sess;
1486 	struct se_node_acl *dest_node_acl = NULL;
1487 	struct se_dev_entry *dest_se_deve = NULL, *local_se_deve;
1488 	struct t10_pr_registration *dest_pr_reg, *local_pr_reg, *pr_reg_e;
1489 	struct t10_pr_registration *pr_reg_tmp, *pr_reg_tmp_safe;
1490 	struct list_head tid_dest_list;
1491 	struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp;
1492 	struct target_core_fabric_ops *tmp_tf_ops;
1493 	unsigned char *buf;
1494 	unsigned char *ptr, *i_str = NULL, proto_ident, tmp_proto_ident;
1495 	char *iport_ptr = NULL, dest_iport[64], i_buf[PR_REG_ISID_ID_LEN];
1496 	u32 tpdl, tid_len = 0;
1497 	int ret, dest_local_nexus, prf_isid;
1498 	u32 dest_rtpi = 0;
1499 
1500 	memset(dest_iport, 0, 64);
1501 	INIT_LIST_HEAD(&tid_dest_list);
1502 
1503 	local_se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
1504 	/*
1505 	 * Allocate a struct pr_transport_id_holder and setup the
1506 	 * local_node_acl and local_se_deve pointers and add to
1507 	 * struct list_head tid_dest_list for add registration
1508 	 * processing in the loop of tid_dest_list below.
1509 	 */
1510 	tidh_new = kzalloc(sizeof(struct pr_transport_id_holder), GFP_KERNEL);
1511 	if (!tidh_new) {
1512 		pr_err("Unable to allocate tidh_new\n");
1513 		return PYX_TRANSPORT_LU_COMM_FAILURE;
1514 	}
1515 	INIT_LIST_HEAD(&tidh_new->dest_list);
1516 	tidh_new->dest_tpg = tpg;
1517 	tidh_new->dest_node_acl = se_sess->se_node_acl;
1518 	tidh_new->dest_se_deve = local_se_deve;
1519 
1520 	local_pr_reg = __core_scsi3_alloc_registration(cmd->se_dev,
1521 				se_sess->se_node_acl, local_se_deve, l_isid,
1522 				sa_res_key, all_tg_pt, aptpl);
1523 	if (!local_pr_reg) {
1524 		kfree(tidh_new);
1525 		return PYX_TRANSPORT_LU_COMM_FAILURE;
1526 	}
1527 	tidh_new->dest_pr_reg = local_pr_reg;
1528 	/*
1529 	 * The local I_T nexus does not hold any configfs dependances,
1530 	 * so we set tid_h->dest_local_nexus=1 to prevent the
1531 	 * configfs_undepend_item() calls in the tid_dest_list loops below.
1532 	 */
1533 	tidh_new->dest_local_nexus = 1;
1534 	list_add_tail(&tidh_new->dest_list, &tid_dest_list);
1535 
1536 	buf = transport_kmap_first_data_page(cmd);
1537 	/*
1538 	 * For a PERSISTENT RESERVE OUT specify initiator ports payload,
1539 	 * first extract TransportID Parameter Data Length, and make sure
1540 	 * the value matches up to the SCSI expected data transfer length.
1541 	 */
1542 	tpdl = (buf[24] & 0xff) << 24;
1543 	tpdl |= (buf[25] & 0xff) << 16;
1544 	tpdl |= (buf[26] & 0xff) << 8;
1545 	tpdl |= buf[27] & 0xff;
1546 
1547 	if ((tpdl + 28) != cmd->data_length) {
1548 		pr_err("SPC-3 PR: Illegal tpdl: %u + 28 byte header"
1549 			" does not equal CDB data_length: %u\n", tpdl,
1550 			cmd->data_length);
1551 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
1552 		goto out;
1553 	}
1554 	/*
1555 	 * Start processing the received transport IDs using the
1556 	 * receiving I_T Nexus portal's fabric dependent methods to
1557 	 * obtain the SCSI Initiator Port/Device Identifiers.
1558 	 */
1559 	ptr = &buf[28];
1560 
1561 	while (tpdl > 0) {
1562 		proto_ident = (ptr[0] & 0x0f);
1563 		dest_tpg = NULL;
1564 
1565 		spin_lock(&dev->se_port_lock);
1566 		list_for_each_entry(tmp_port, &dev->dev_sep_list, sep_list) {
1567 			tmp_tpg = tmp_port->sep_tpg;
1568 			if (!tmp_tpg)
1569 				continue;
1570 			tmp_tf_ops = tmp_tpg->se_tpg_tfo;
1571 			if (!tmp_tf_ops)
1572 				continue;
1573 			if (!tmp_tf_ops->get_fabric_proto_ident ||
1574 			    !tmp_tf_ops->tpg_parse_pr_out_transport_id)
1575 				continue;
1576 			/*
1577 			 * Look for the matching proto_ident provided by
1578 			 * the received TransportID
1579 			 */
1580 			tmp_proto_ident = tmp_tf_ops->get_fabric_proto_ident(tmp_tpg);
1581 			if (tmp_proto_ident != proto_ident)
1582 				continue;
1583 			dest_rtpi = tmp_port->sep_rtpi;
1584 
1585 			i_str = tmp_tf_ops->tpg_parse_pr_out_transport_id(
1586 					tmp_tpg, (const char *)ptr, &tid_len,
1587 					&iport_ptr);
1588 			if (!i_str)
1589 				continue;
1590 
1591 			atomic_inc(&tmp_tpg->tpg_pr_ref_count);
1592 			smp_mb__after_atomic_inc();
1593 			spin_unlock(&dev->se_port_lock);
1594 
1595 			ret = core_scsi3_tpg_depend_item(tmp_tpg);
1596 			if (ret != 0) {
1597 				pr_err(" core_scsi3_tpg_depend_item()"
1598 					" for tmp_tpg\n");
1599 				atomic_dec(&tmp_tpg->tpg_pr_ref_count);
1600 				smp_mb__after_atomic_dec();
1601 				ret = PYX_TRANSPORT_LU_COMM_FAILURE;
1602 				goto out;
1603 			}
1604 			/*
1605 			 * Locate the desination initiator ACL to be registered
1606 			 * from the decoded fabric module specific TransportID
1607 			 * at *i_str.
1608 			 */
1609 			spin_lock_irq(&tmp_tpg->acl_node_lock);
1610 			dest_node_acl = __core_tpg_get_initiator_node_acl(
1611 						tmp_tpg, i_str);
1612 			if (dest_node_acl) {
1613 				atomic_inc(&dest_node_acl->acl_pr_ref_count);
1614 				smp_mb__after_atomic_inc();
1615 			}
1616 			spin_unlock_irq(&tmp_tpg->acl_node_lock);
1617 
1618 			if (!dest_node_acl) {
1619 				core_scsi3_tpg_undepend_item(tmp_tpg);
1620 				spin_lock(&dev->se_port_lock);
1621 				continue;
1622 			}
1623 
1624 			ret = core_scsi3_nodeacl_depend_item(dest_node_acl);
1625 			if (ret != 0) {
1626 				pr_err("configfs_depend_item() failed"
1627 					" for dest_node_acl->acl_group\n");
1628 				atomic_dec(&dest_node_acl->acl_pr_ref_count);
1629 				smp_mb__after_atomic_dec();
1630 				core_scsi3_tpg_undepend_item(tmp_tpg);
1631 				ret = PYX_TRANSPORT_LU_COMM_FAILURE;
1632 				goto out;
1633 			}
1634 
1635 			dest_tpg = tmp_tpg;
1636 			pr_debug("SPC-3 PR SPEC_I_PT: Located %s Node:"
1637 				" %s Port RTPI: %hu\n",
1638 				dest_tpg->se_tpg_tfo->get_fabric_name(),
1639 				dest_node_acl->initiatorname, dest_rtpi);
1640 
1641 			spin_lock(&dev->se_port_lock);
1642 			break;
1643 		}
1644 		spin_unlock(&dev->se_port_lock);
1645 
1646 		if (!dest_tpg) {
1647 			pr_err("SPC-3 PR SPEC_I_PT: Unable to locate"
1648 					" dest_tpg\n");
1649 			ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
1650 			goto out;
1651 		}
1652 #if 0
1653 		pr_debug("SPC-3 PR SPEC_I_PT: Got %s data_length: %u tpdl: %u"
1654 			" tid_len: %d for %s + %s\n",
1655 			dest_tpg->se_tpg_tfo->get_fabric_name(), cmd->data_length,
1656 			tpdl, tid_len, i_str, iport_ptr);
1657 #endif
1658 		if (tid_len > tpdl) {
1659 			pr_err("SPC-3 PR SPEC_I_PT: Illegal tid_len:"
1660 				" %u for Transport ID: %s\n", tid_len, ptr);
1661 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1662 			core_scsi3_tpg_undepend_item(dest_tpg);
1663 			ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
1664 			goto out;
1665 		}
1666 		/*
1667 		 * Locate the desintation struct se_dev_entry pointer for matching
1668 		 * RELATIVE TARGET PORT IDENTIFIER on the receiving I_T Nexus
1669 		 * Target Port.
1670 		 */
1671 		dest_se_deve = core_get_se_deve_from_rtpi(dest_node_acl,
1672 					dest_rtpi);
1673 		if (!dest_se_deve) {
1674 			pr_err("Unable to locate %s dest_se_deve"
1675 				" from destination RTPI: %hu\n",
1676 				dest_tpg->se_tpg_tfo->get_fabric_name(),
1677 				dest_rtpi);
1678 
1679 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1680 			core_scsi3_tpg_undepend_item(dest_tpg);
1681 			ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
1682 			goto out;
1683 		}
1684 
1685 		ret = core_scsi3_lunacl_depend_item(dest_se_deve);
1686 		if (ret < 0) {
1687 			pr_err("core_scsi3_lunacl_depend_item()"
1688 					" failed\n");
1689 			atomic_dec(&dest_se_deve->pr_ref_count);
1690 			smp_mb__after_atomic_dec();
1691 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1692 			core_scsi3_tpg_undepend_item(dest_tpg);
1693 			ret = PYX_TRANSPORT_LU_COMM_FAILURE;
1694 			goto out;
1695 		}
1696 #if 0
1697 		pr_debug("SPC-3 PR SPEC_I_PT: Located %s Node: %s"
1698 			" dest_se_deve mapped_lun: %u\n",
1699 			dest_tpg->se_tpg_tfo->get_fabric_name(),
1700 			dest_node_acl->initiatorname, dest_se_deve->mapped_lun);
1701 #endif
1702 		/*
1703 		 * Skip any TransportIDs that already have a registration for
1704 		 * this target port.
1705 		 */
1706 		pr_reg_e = __core_scsi3_locate_pr_reg(dev, dest_node_acl,
1707 					iport_ptr);
1708 		if (pr_reg_e) {
1709 			core_scsi3_put_pr_reg(pr_reg_e);
1710 			core_scsi3_lunacl_undepend_item(dest_se_deve);
1711 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1712 			core_scsi3_tpg_undepend_item(dest_tpg);
1713 			ptr += tid_len;
1714 			tpdl -= tid_len;
1715 			tid_len = 0;
1716 			continue;
1717 		}
1718 		/*
1719 		 * Allocate a struct pr_transport_id_holder and setup
1720 		 * the dest_node_acl and dest_se_deve pointers for the
1721 		 * loop below.
1722 		 */
1723 		tidh_new = kzalloc(sizeof(struct pr_transport_id_holder),
1724 				GFP_KERNEL);
1725 		if (!tidh_new) {
1726 			pr_err("Unable to allocate tidh_new\n");
1727 			core_scsi3_lunacl_undepend_item(dest_se_deve);
1728 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1729 			core_scsi3_tpg_undepend_item(dest_tpg);
1730 			ret = PYX_TRANSPORT_LU_COMM_FAILURE;
1731 			goto out;
1732 		}
1733 		INIT_LIST_HEAD(&tidh_new->dest_list);
1734 		tidh_new->dest_tpg = dest_tpg;
1735 		tidh_new->dest_node_acl = dest_node_acl;
1736 		tidh_new->dest_se_deve = dest_se_deve;
1737 
1738 		/*
1739 		 * Allocate, but do NOT add the registration for the
1740 		 * TransportID referenced SCSI Initiator port.  This
1741 		 * done because of the following from spc4r17 in section
1742 		 * 6.14.3 wrt SPEC_I_PT:
1743 		 *
1744 		 * "If a registration fails for any initiator port (e.g., if th
1745 		 * logical unit does not have enough resources available to
1746 		 * hold the registration information), no registrations shall be
1747 		 * made, and the command shall be terminated with
1748 		 * CHECK CONDITION status."
1749 		 *
1750 		 * That means we call __core_scsi3_alloc_registration() here,
1751 		 * and then call __core_scsi3_add_registration() in the
1752 		 * 2nd loop which will never fail.
1753 		 */
1754 		dest_pr_reg = __core_scsi3_alloc_registration(cmd->se_dev,
1755 				dest_node_acl, dest_se_deve, iport_ptr,
1756 				sa_res_key, all_tg_pt, aptpl);
1757 		if (!dest_pr_reg) {
1758 			core_scsi3_lunacl_undepend_item(dest_se_deve);
1759 			core_scsi3_nodeacl_undepend_item(dest_node_acl);
1760 			core_scsi3_tpg_undepend_item(dest_tpg);
1761 			kfree(tidh_new);
1762 			ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
1763 			goto out;
1764 		}
1765 		tidh_new->dest_pr_reg = dest_pr_reg;
1766 		list_add_tail(&tidh_new->dest_list, &tid_dest_list);
1767 
1768 		ptr += tid_len;
1769 		tpdl -= tid_len;
1770 		tid_len = 0;
1771 
1772 	}
1773 
1774 	transport_kunmap_first_data_page(cmd);
1775 
1776 	/*
1777 	 * Go ahead and create a registrations from tid_dest_list for the
1778 	 * SPEC_I_PT provided TransportID for the *tidh referenced dest_node_acl
1779 	 * and dest_se_deve.
1780 	 *
1781 	 * The SA Reservation Key from the PROUT is set for the
1782 	 * registration, and ALL_TG_PT is also passed.  ALL_TG_PT=1
1783 	 * means that the TransportID Initiator port will be
1784 	 * registered on all of the target ports in the SCSI target device
1785 	 * ALL_TG_PT=0 means the registration will only be for the
1786 	 * SCSI target port the PROUT REGISTER with SPEC_I_PT=1
1787 	 * was received.
1788 	 */
1789 	list_for_each_entry_safe(tidh, tidh_tmp, &tid_dest_list, dest_list) {
1790 		dest_tpg = tidh->dest_tpg;
1791 		dest_node_acl = tidh->dest_node_acl;
1792 		dest_se_deve = tidh->dest_se_deve;
1793 		dest_pr_reg = tidh->dest_pr_reg;
1794 		dest_local_nexus = tidh->dest_local_nexus;
1795 
1796 		list_del(&tidh->dest_list);
1797 		kfree(tidh);
1798 
1799 		memset(i_buf, 0, PR_REG_ISID_ID_LEN);
1800 		prf_isid = core_pr_dump_initiator_port(dest_pr_reg, &i_buf[0],
1801 						PR_REG_ISID_ID_LEN);
1802 
1803 		__core_scsi3_add_registration(cmd->se_dev, dest_node_acl,
1804 					dest_pr_reg, 0, 0);
1805 
1806 		pr_debug("SPC-3 PR [%s] SPEC_I_PT: Successfully"
1807 			" registered Transport ID for Node: %s%s Mapped LUN:"
1808 			" %u\n", dest_tpg->se_tpg_tfo->get_fabric_name(),
1809 			dest_node_acl->initiatorname, (prf_isid) ?
1810 			&i_buf[0] : "", dest_se_deve->mapped_lun);
1811 
1812 		if (dest_local_nexus)
1813 			continue;
1814 
1815 		core_scsi3_lunacl_undepend_item(dest_se_deve);
1816 		core_scsi3_nodeacl_undepend_item(dest_node_acl);
1817 		core_scsi3_tpg_undepend_item(dest_tpg);
1818 	}
1819 
1820 	return 0;
1821 out:
1822 	transport_kunmap_first_data_page(cmd);
1823 	/*
1824 	 * For the failure case, release everything from tid_dest_list
1825 	 * including *dest_pr_reg and the configfs dependances..
1826 	 */
1827 	list_for_each_entry_safe(tidh, tidh_tmp, &tid_dest_list, dest_list) {
1828 		dest_tpg = tidh->dest_tpg;
1829 		dest_node_acl = tidh->dest_node_acl;
1830 		dest_se_deve = tidh->dest_se_deve;
1831 		dest_pr_reg = tidh->dest_pr_reg;
1832 		dest_local_nexus = tidh->dest_local_nexus;
1833 
1834 		list_del(&tidh->dest_list);
1835 		kfree(tidh);
1836 		/*
1837 		 * Release any extra ALL_TG_PT=1 registrations for
1838 		 * the SPEC_I_PT=1 case.
1839 		 */
1840 		list_for_each_entry_safe(pr_reg_tmp, pr_reg_tmp_safe,
1841 				&dest_pr_reg->pr_reg_atp_list,
1842 				pr_reg_atp_mem_list) {
1843 			list_del(&pr_reg_tmp->pr_reg_atp_mem_list);
1844 			core_scsi3_lunacl_undepend_item(pr_reg_tmp->pr_reg_deve);
1845 			kmem_cache_free(t10_pr_reg_cache, pr_reg_tmp);
1846 		}
1847 
1848 		kfree(dest_pr_reg->pr_aptpl_buf);
1849 		kmem_cache_free(t10_pr_reg_cache, dest_pr_reg);
1850 
1851 		if (dest_local_nexus)
1852 			continue;
1853 
1854 		core_scsi3_lunacl_undepend_item(dest_se_deve);
1855 		core_scsi3_nodeacl_undepend_item(dest_node_acl);
1856 		core_scsi3_tpg_undepend_item(dest_tpg);
1857 	}
1858 	return ret;
1859 }
1860 
1861 /*
1862  * Called with struct se_device->dev_reservation_lock held
1863  */
1864 static int __core_scsi3_update_aptpl_buf(
1865 	struct se_device *dev,
1866 	unsigned char *buf,
1867 	u32 pr_aptpl_buf_len,
1868 	int clear_aptpl_metadata)
1869 {
1870 	struct se_lun *lun;
1871 	struct se_portal_group *tpg;
1872 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
1873 	struct t10_pr_registration *pr_reg;
1874 	unsigned char tmp[512], isid_buf[32];
1875 	ssize_t len = 0;
1876 	int reg_count = 0;
1877 
1878 	memset(buf, 0, pr_aptpl_buf_len);
1879 	/*
1880 	 * Called to clear metadata once APTPL has been deactivated.
1881 	 */
1882 	if (clear_aptpl_metadata) {
1883 		snprintf(buf, pr_aptpl_buf_len,
1884 				"No Registrations or Reservations\n");
1885 		return 0;
1886 	}
1887 	/*
1888 	 * Walk the registration list..
1889 	 */
1890 	spin_lock(&su_dev->t10_pr.registration_lock);
1891 	list_for_each_entry(pr_reg, &su_dev->t10_pr.registration_list,
1892 			pr_reg_list) {
1893 
1894 		tmp[0] = '\0';
1895 		isid_buf[0] = '\0';
1896 		tpg = pr_reg->pr_reg_nacl->se_tpg;
1897 		lun = pr_reg->pr_reg_tg_pt_lun;
1898 		/*
1899 		 * Write out any ISID value to APTPL metadata that was included
1900 		 * in the original registration.
1901 		 */
1902 		if (pr_reg->isid_present_at_reg)
1903 			snprintf(isid_buf, 32, "initiator_sid=%s\n",
1904 					pr_reg->pr_reg_isid);
1905 		/*
1906 		 * Include special metadata if the pr_reg matches the
1907 		 * reservation holder.
1908 		 */
1909 		if (dev->dev_pr_res_holder == pr_reg) {
1910 			snprintf(tmp, 512, "PR_REG_START: %d"
1911 				"\ninitiator_fabric=%s\n"
1912 				"initiator_node=%s\n%s"
1913 				"sa_res_key=%llu\n"
1914 				"res_holder=1\nres_type=%02x\n"
1915 				"res_scope=%02x\nres_all_tg_pt=%d\n"
1916 				"mapped_lun=%u\n", reg_count,
1917 				tpg->se_tpg_tfo->get_fabric_name(),
1918 				pr_reg->pr_reg_nacl->initiatorname, isid_buf,
1919 				pr_reg->pr_res_key, pr_reg->pr_res_type,
1920 				pr_reg->pr_res_scope, pr_reg->pr_reg_all_tg_pt,
1921 				pr_reg->pr_res_mapped_lun);
1922 		} else {
1923 			snprintf(tmp, 512, "PR_REG_START: %d\n"
1924 				"initiator_fabric=%s\ninitiator_node=%s\n%s"
1925 				"sa_res_key=%llu\nres_holder=0\n"
1926 				"res_all_tg_pt=%d\nmapped_lun=%u\n",
1927 				reg_count, tpg->se_tpg_tfo->get_fabric_name(),
1928 				pr_reg->pr_reg_nacl->initiatorname, isid_buf,
1929 				pr_reg->pr_res_key, pr_reg->pr_reg_all_tg_pt,
1930 				pr_reg->pr_res_mapped_lun);
1931 		}
1932 
1933 		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
1934 			pr_err("Unable to update renaming"
1935 				" APTPL metadata\n");
1936 			spin_unlock(&su_dev->t10_pr.registration_lock);
1937 			return -EMSGSIZE;
1938 		}
1939 		len += sprintf(buf+len, "%s", tmp);
1940 
1941 		/*
1942 		 * Include information about the associated SCSI target port.
1943 		 */
1944 		snprintf(tmp, 512, "target_fabric=%s\ntarget_node=%s\n"
1945 			"tpgt=%hu\nport_rtpi=%hu\ntarget_lun=%u\nPR_REG_END:"
1946 			" %d\n", tpg->se_tpg_tfo->get_fabric_name(),
1947 			tpg->se_tpg_tfo->tpg_get_wwn(tpg),
1948 			tpg->se_tpg_tfo->tpg_get_tag(tpg),
1949 			lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
1950 
1951 		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
1952 			pr_err("Unable to update renaming"
1953 				" APTPL metadata\n");
1954 			spin_unlock(&su_dev->t10_pr.registration_lock);
1955 			return -EMSGSIZE;
1956 		}
1957 		len += sprintf(buf+len, "%s", tmp);
1958 		reg_count++;
1959 	}
1960 	spin_unlock(&su_dev->t10_pr.registration_lock);
1961 
1962 	if (!reg_count)
1963 		len += sprintf(buf+len, "No Registrations or Reservations");
1964 
1965 	return 0;
1966 }
1967 
1968 static int core_scsi3_update_aptpl_buf(
1969 	struct se_device *dev,
1970 	unsigned char *buf,
1971 	u32 pr_aptpl_buf_len,
1972 	int clear_aptpl_metadata)
1973 {
1974 	int ret;
1975 
1976 	spin_lock(&dev->dev_reservation_lock);
1977 	ret = __core_scsi3_update_aptpl_buf(dev, buf, pr_aptpl_buf_len,
1978 				clear_aptpl_metadata);
1979 	spin_unlock(&dev->dev_reservation_lock);
1980 
1981 	return ret;
1982 }
1983 
1984 /*
1985  * Called with struct se_device->aptpl_file_mutex held
1986  */
1987 static int __core_scsi3_write_aptpl_to_file(
1988 	struct se_device *dev,
1989 	unsigned char *buf,
1990 	u32 pr_aptpl_buf_len)
1991 {
1992 	struct t10_wwn *wwn = &dev->se_sub_dev->t10_wwn;
1993 	struct file *file;
1994 	struct iovec iov[1];
1995 	mm_segment_t old_fs;
1996 	int flags = O_RDWR | O_CREAT | O_TRUNC;
1997 	char path[512];
1998 	int ret;
1999 
2000 	memset(iov, 0, sizeof(struct iovec));
2001 	memset(path, 0, 512);
2002 
2003 	if (strlen(&wwn->unit_serial[0]) >= 512) {
2004 		pr_err("WWN value for struct se_device does not fit"
2005 			" into path buffer\n");
2006 		return -EMSGSIZE;
2007 	}
2008 
2009 	snprintf(path, 512, "/var/target/pr/aptpl_%s", &wwn->unit_serial[0]);
2010 	file = filp_open(path, flags, 0600);
2011 	if (IS_ERR(file) || !file || !file->f_dentry) {
2012 		pr_err("filp_open(%s) for APTPL metadata"
2013 			" failed\n", path);
2014 		return (PTR_ERR(file) < 0 ? PTR_ERR(file) : -ENOENT);
2015 	}
2016 
2017 	iov[0].iov_base = &buf[0];
2018 	if (!pr_aptpl_buf_len)
2019 		iov[0].iov_len = (strlen(&buf[0]) + 1); /* Add extra for NULL */
2020 	else
2021 		iov[0].iov_len = pr_aptpl_buf_len;
2022 
2023 	old_fs = get_fs();
2024 	set_fs(get_ds());
2025 	ret = vfs_writev(file, &iov[0], 1, &file->f_pos);
2026 	set_fs(old_fs);
2027 
2028 	if (ret < 0) {
2029 		pr_debug("Error writing APTPL metadata file: %s\n", path);
2030 		filp_close(file, NULL);
2031 		return -EIO;
2032 	}
2033 	filp_close(file, NULL);
2034 
2035 	return 0;
2036 }
2037 
2038 static int core_scsi3_update_and_write_aptpl(
2039 	struct se_device *dev,
2040 	unsigned char *in_buf,
2041 	u32 in_pr_aptpl_buf_len)
2042 {
2043 	unsigned char null_buf[64], *buf;
2044 	u32 pr_aptpl_buf_len;
2045 	int ret, clear_aptpl_metadata = 0;
2046 	/*
2047 	 * Can be called with a NULL pointer from PROUT service action CLEAR
2048 	 */
2049 	if (!in_buf) {
2050 		memset(null_buf, 0, 64);
2051 		buf = &null_buf[0];
2052 		/*
2053 		 * This will clear the APTPL metadata to:
2054 		 * "No Registrations or Reservations" status
2055 		 */
2056 		pr_aptpl_buf_len = 64;
2057 		clear_aptpl_metadata = 1;
2058 	} else {
2059 		buf = in_buf;
2060 		pr_aptpl_buf_len = in_pr_aptpl_buf_len;
2061 	}
2062 
2063 	ret = core_scsi3_update_aptpl_buf(dev, buf, pr_aptpl_buf_len,
2064 				clear_aptpl_metadata);
2065 	if (ret != 0)
2066 		return ret;
2067 	/*
2068 	 * __core_scsi3_write_aptpl_to_file() will call strlen()
2069 	 * on the passed buf to determine pr_aptpl_buf_len.
2070 	 */
2071 	ret = __core_scsi3_write_aptpl_to_file(dev, buf, 0);
2072 	if (ret != 0)
2073 		return ret;
2074 
2075 	return ret;
2076 }
2077 
2078 static int core_scsi3_emulate_pro_register(
2079 	struct se_cmd *cmd,
2080 	u64 res_key,
2081 	u64 sa_res_key,
2082 	int aptpl,
2083 	int all_tg_pt,
2084 	int spec_i_pt,
2085 	int ignore_key)
2086 {
2087 	struct se_session *se_sess = cmd->se_sess;
2088 	struct se_device *dev = cmd->se_dev;
2089 	struct se_dev_entry *se_deve;
2090 	struct se_lun *se_lun = cmd->se_lun;
2091 	struct se_portal_group *se_tpg;
2092 	struct t10_pr_registration *pr_reg, *pr_reg_p, *pr_reg_tmp, *pr_reg_e;
2093 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
2094 	/* Used for APTPL metadata w/ UNREGISTER */
2095 	unsigned char *pr_aptpl_buf = NULL;
2096 	unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
2097 	int pr_holder = 0, ret = 0, type;
2098 
2099 	if (!se_sess || !se_lun) {
2100 		pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
2101 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2102 	}
2103 	se_tpg = se_sess->se_tpg;
2104 	se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
2105 
2106 	if (se_tpg->se_tpg_tfo->sess_get_initiator_sid) {
2107 		memset(&isid_buf[0], 0, PR_REG_ISID_LEN);
2108 		se_tpg->se_tpg_tfo->sess_get_initiator_sid(se_sess, &isid_buf[0],
2109 				PR_REG_ISID_LEN);
2110 		isid_ptr = &isid_buf[0];
2111 	}
2112 	/*
2113 	 * Follow logic from spc4r17 Section 5.7.7, Register Behaviors Table 47
2114 	 */
2115 	pr_reg_e = core_scsi3_locate_pr_reg(dev, se_sess->se_node_acl, se_sess);
2116 	if (!pr_reg_e) {
2117 		if (res_key) {
2118 			pr_warn("SPC-3 PR: Reservation Key non-zero"
2119 				" for SA REGISTER, returning CONFLICT\n");
2120 			return PYX_TRANSPORT_RESERVATION_CONFLICT;
2121 		}
2122 		/*
2123 		 * Do nothing but return GOOD status.
2124 		 */
2125 		if (!sa_res_key)
2126 			return PYX_TRANSPORT_SENT_TO_TRANSPORT;
2127 
2128 		if (!spec_i_pt) {
2129 			/*
2130 			 * Perform the Service Action REGISTER on the Initiator
2131 			 * Port Endpoint that the PRO was received from on the
2132 			 * Logical Unit of the SCSI device server.
2133 			 */
2134 			ret = core_scsi3_alloc_registration(cmd->se_dev,
2135 					se_sess->se_node_acl, se_deve, isid_ptr,
2136 					sa_res_key, all_tg_pt, aptpl,
2137 					ignore_key, 0);
2138 			if (ret != 0) {
2139 				pr_err("Unable to allocate"
2140 					" struct t10_pr_registration\n");
2141 				return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
2142 			}
2143 		} else {
2144 			/*
2145 			 * Register both the Initiator port that received
2146 			 * PROUT SA REGISTER + SPEC_I_PT=1 and extract SCSI
2147 			 * TransportID from Parameter list and loop through
2148 			 * fabric dependent parameter list while calling
2149 			 * logic from of core_scsi3_alloc_registration() for
2150 			 * each TransportID provided SCSI Initiator Port/Device
2151 			 */
2152 			ret = core_scsi3_decode_spec_i_port(cmd, se_tpg,
2153 					isid_ptr, sa_res_key, all_tg_pt, aptpl);
2154 			if (ret != 0)
2155 				return ret;
2156 		}
2157 		/*
2158 		 * Nothing left to do for the APTPL=0 case.
2159 		 */
2160 		if (!aptpl) {
2161 			pr_tmpl->pr_aptpl_active = 0;
2162 			core_scsi3_update_and_write_aptpl(cmd->se_dev, NULL, 0);
2163 			pr_debug("SPC-3 PR: Set APTPL Bit Deactivated for"
2164 					" REGISTER\n");
2165 			return 0;
2166 		}
2167 		/*
2168 		 * Locate the newly allocated local I_T Nexus *pr_reg, and
2169 		 * update the APTPL metadata information using its
2170 		 * preallocated *pr_reg->pr_aptpl_buf.
2171 		 */
2172 		pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev,
2173 				se_sess->se_node_acl, se_sess);
2174 
2175 		ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
2176 				&pr_reg->pr_aptpl_buf[0],
2177 				pr_tmpl->pr_aptpl_buf_len);
2178 		if (!ret) {
2179 			pr_tmpl->pr_aptpl_active = 1;
2180 			pr_debug("SPC-3 PR: Set APTPL Bit Activated for REGISTER\n");
2181 		}
2182 
2183 		core_scsi3_put_pr_reg(pr_reg);
2184 		return ret;
2185 	} else {
2186 		/*
2187 		 * Locate the existing *pr_reg via struct se_node_acl pointers
2188 		 */
2189 		pr_reg = pr_reg_e;
2190 		type = pr_reg->pr_res_type;
2191 
2192 		if (!ignore_key) {
2193 			if (res_key != pr_reg->pr_res_key) {
2194 				pr_err("SPC-3 PR REGISTER: Received"
2195 					" res_key: 0x%016Lx does not match"
2196 					" existing SA REGISTER res_key:"
2197 					" 0x%016Lx\n", res_key,
2198 					pr_reg->pr_res_key);
2199 				core_scsi3_put_pr_reg(pr_reg);
2200 				return PYX_TRANSPORT_RESERVATION_CONFLICT;
2201 			}
2202 		}
2203 		if (spec_i_pt) {
2204 			pr_err("SPC-3 PR UNREGISTER: SPEC_I_PT"
2205 				" set while sa_res_key=0\n");
2206 			core_scsi3_put_pr_reg(pr_reg);
2207 			return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
2208 		}
2209 		/*
2210 		 * An existing ALL_TG_PT=1 registration being released
2211 		 * must also set ALL_TG_PT=1 in the incoming PROUT.
2212 		 */
2213 		if (pr_reg->pr_reg_all_tg_pt && !(all_tg_pt)) {
2214 			pr_err("SPC-3 PR UNREGISTER: ALL_TG_PT=1"
2215 				" registration exists, but ALL_TG_PT=1 bit not"
2216 				" present in received PROUT\n");
2217 			core_scsi3_put_pr_reg(pr_reg);
2218 			return PYX_TRANSPORT_INVALID_CDB_FIELD;
2219 		}
2220 		/*
2221 		 * Allocate APTPL metadata buffer used for UNREGISTER ops
2222 		 */
2223 		if (aptpl) {
2224 			pr_aptpl_buf = kzalloc(pr_tmpl->pr_aptpl_buf_len,
2225 						GFP_KERNEL);
2226 			if (!pr_aptpl_buf) {
2227 				pr_err("Unable to allocate"
2228 					" pr_aptpl_buf\n");
2229 				core_scsi3_put_pr_reg(pr_reg);
2230 				return PYX_TRANSPORT_LU_COMM_FAILURE;
2231 			}
2232 		}
2233 		/*
2234 		 * sa_res_key=0 Unregister Reservation Key for registered I_T
2235 		 * Nexus sa_res_key=1 Change Reservation Key for registered I_T
2236 		 * Nexus.
2237 		 */
2238 		if (!sa_res_key) {
2239 			pr_holder = core_scsi3_check_implict_release(
2240 					cmd->se_dev, pr_reg);
2241 			if (pr_holder < 0) {
2242 				kfree(pr_aptpl_buf);
2243 				core_scsi3_put_pr_reg(pr_reg);
2244 				return PYX_TRANSPORT_RESERVATION_CONFLICT;
2245 			}
2246 
2247 			spin_lock(&pr_tmpl->registration_lock);
2248 			/*
2249 			 * Release all ALL_TG_PT=1 for the matching SCSI Initiator Port
2250 			 * and matching pr_res_key.
2251 			 */
2252 			if (pr_reg->pr_reg_all_tg_pt) {
2253 				list_for_each_entry_safe(pr_reg_p, pr_reg_tmp,
2254 						&pr_tmpl->registration_list,
2255 						pr_reg_list) {
2256 
2257 					if (!pr_reg_p->pr_reg_all_tg_pt)
2258 						continue;
2259 
2260 					if (pr_reg_p->pr_res_key != res_key)
2261 						continue;
2262 
2263 					if (pr_reg == pr_reg_p)
2264 						continue;
2265 
2266 					if (strcmp(pr_reg->pr_reg_nacl->initiatorname,
2267 						   pr_reg_p->pr_reg_nacl->initiatorname))
2268 						continue;
2269 
2270 					__core_scsi3_free_registration(dev,
2271 							pr_reg_p, NULL, 0);
2272 				}
2273 			}
2274 			/*
2275 			 * Release the calling I_T Nexus registration now..
2276 			 */
2277 			__core_scsi3_free_registration(cmd->se_dev, pr_reg,
2278 							NULL, 1);
2279 			/*
2280 			 * From spc4r17, section 5.7.11.3 Unregistering
2281 			 *
2282 			 * If the persistent reservation is a registrants only
2283 			 * type, the device server shall establish a unit
2284 			 * attention condition for the initiator port associated
2285 			 * with every registered I_T nexus except for the I_T
2286 			 * nexus on which the PERSISTENT RESERVE OUT command was
2287 			 * received, with the additional sense code set to
2288 			 * RESERVATIONS RELEASED.
2289 			 */
2290 			if (pr_holder &&
2291 			   ((type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) ||
2292 			    (type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY))) {
2293 				list_for_each_entry(pr_reg_p,
2294 						&pr_tmpl->registration_list,
2295 						pr_reg_list) {
2296 
2297 					core_scsi3_ua_allocate(
2298 						pr_reg_p->pr_reg_nacl,
2299 						pr_reg_p->pr_res_mapped_lun,
2300 						0x2A,
2301 						ASCQ_2AH_RESERVATIONS_RELEASED);
2302 				}
2303 			}
2304 			spin_unlock(&pr_tmpl->registration_lock);
2305 
2306 			if (!aptpl) {
2307 				pr_tmpl->pr_aptpl_active = 0;
2308 				core_scsi3_update_and_write_aptpl(dev, NULL, 0);
2309 				pr_debug("SPC-3 PR: Set APTPL Bit Deactivated"
2310 						" for UNREGISTER\n");
2311 				return 0;
2312 			}
2313 
2314 			ret = core_scsi3_update_and_write_aptpl(dev,
2315 					&pr_aptpl_buf[0],
2316 					pr_tmpl->pr_aptpl_buf_len);
2317 			if (!ret) {
2318 				pr_tmpl->pr_aptpl_active = 1;
2319 				pr_debug("SPC-3 PR: Set APTPL Bit Activated"
2320 						" for UNREGISTER\n");
2321 			}
2322 
2323 			kfree(pr_aptpl_buf);
2324 			return ret;
2325 		} else {
2326 			/*
2327 			 * Increment PRgeneration counter for struct se_device"
2328 			 * upon a successful REGISTER, see spc4r17 section 6.3.2
2329 			 * READ_KEYS service action.
2330 			 */
2331 			pr_reg->pr_res_generation = core_scsi3_pr_generation(
2332 							cmd->se_dev);
2333 			pr_reg->pr_res_key = sa_res_key;
2334 			pr_debug("SPC-3 PR [%s] REGISTER%s: Changed Reservation"
2335 				" Key for %s to: 0x%016Lx PRgeneration:"
2336 				" 0x%08x\n", cmd->se_tfo->get_fabric_name(),
2337 				(ignore_key) ? "_AND_IGNORE_EXISTING_KEY" : "",
2338 				pr_reg->pr_reg_nacl->initiatorname,
2339 				pr_reg->pr_res_key, pr_reg->pr_res_generation);
2340 
2341 			if (!aptpl) {
2342 				pr_tmpl->pr_aptpl_active = 0;
2343 				core_scsi3_update_and_write_aptpl(dev, NULL, 0);
2344 				core_scsi3_put_pr_reg(pr_reg);
2345 				pr_debug("SPC-3 PR: Set APTPL Bit Deactivated"
2346 						" for REGISTER\n");
2347 				return 0;
2348 			}
2349 
2350 			ret = core_scsi3_update_and_write_aptpl(dev,
2351 					&pr_aptpl_buf[0],
2352 					pr_tmpl->pr_aptpl_buf_len);
2353 			if (!ret) {
2354 				pr_tmpl->pr_aptpl_active = 1;
2355 				pr_debug("SPC-3 PR: Set APTPL Bit Activated"
2356 						" for REGISTER\n");
2357 			}
2358 
2359 			kfree(pr_aptpl_buf);
2360 			core_scsi3_put_pr_reg(pr_reg);
2361 		}
2362 	}
2363 	return 0;
2364 }
2365 
2366 unsigned char *core_scsi3_pr_dump_type(int type)
2367 {
2368 	switch (type) {
2369 	case PR_TYPE_WRITE_EXCLUSIVE:
2370 		return "Write Exclusive Access";
2371 	case PR_TYPE_EXCLUSIVE_ACCESS:
2372 		return "Exclusive Access";
2373 	case PR_TYPE_WRITE_EXCLUSIVE_REGONLY:
2374 		return "Write Exclusive Access, Registrants Only";
2375 	case PR_TYPE_EXCLUSIVE_ACCESS_REGONLY:
2376 		return "Exclusive Access, Registrants Only";
2377 	case PR_TYPE_WRITE_EXCLUSIVE_ALLREG:
2378 		return "Write Exclusive Access, All Registrants";
2379 	case PR_TYPE_EXCLUSIVE_ACCESS_ALLREG:
2380 		return "Exclusive Access, All Registrants";
2381 	default:
2382 		break;
2383 	}
2384 
2385 	return "Unknown SPC-3 PR Type";
2386 }
2387 
2388 static int core_scsi3_pro_reserve(
2389 	struct se_cmd *cmd,
2390 	struct se_device *dev,
2391 	int type,
2392 	int scope,
2393 	u64 res_key)
2394 {
2395 	struct se_session *se_sess = cmd->se_sess;
2396 	struct se_dev_entry *se_deve;
2397 	struct se_lun *se_lun = cmd->se_lun;
2398 	struct se_portal_group *se_tpg;
2399 	struct t10_pr_registration *pr_reg, *pr_res_holder;
2400 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
2401 	char i_buf[PR_REG_ISID_ID_LEN];
2402 	int ret, prf_isid;
2403 
2404 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
2405 
2406 	if (!se_sess || !se_lun) {
2407 		pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
2408 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2409 	}
2410 	se_tpg = se_sess->se_tpg;
2411 	se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
2412 	/*
2413 	 * Locate the existing *pr_reg via struct se_node_acl pointers
2414 	 */
2415 	pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
2416 				se_sess);
2417 	if (!pr_reg) {
2418 		pr_err("SPC-3 PR: Unable to locate"
2419 			" PR_REGISTERED *pr_reg for RESERVE\n");
2420 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2421 	}
2422 	/*
2423 	 * From spc4r17 Section 5.7.9: Reserving:
2424 	 *
2425 	 * An application client creates a persistent reservation by issuing
2426 	 * a PERSISTENT RESERVE OUT command with RESERVE service action through
2427 	 * a registered I_T nexus with the following parameters:
2428 	 *    a) RESERVATION KEY set to the value of the reservation key that is
2429 	 * 	 registered with the logical unit for the I_T nexus; and
2430 	 */
2431 	if (res_key != pr_reg->pr_res_key) {
2432 		pr_err("SPC-3 PR RESERVE: Received res_key: 0x%016Lx"
2433 			" does not match existing SA REGISTER res_key:"
2434 			" 0x%016Lx\n", res_key, pr_reg->pr_res_key);
2435 		core_scsi3_put_pr_reg(pr_reg);
2436 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2437 	}
2438 	/*
2439 	 * From spc4r17 Section 5.7.9: Reserving:
2440 	 *
2441 	 * From above:
2442 	 *  b) TYPE field and SCOPE field set to the persistent reservation
2443 	 *     being created.
2444 	 *
2445 	 * Only one persistent reservation is allowed at a time per logical unit
2446 	 * and that persistent reservation has a scope of LU_SCOPE.
2447 	 */
2448 	if (scope != PR_SCOPE_LU_SCOPE) {
2449 		pr_err("SPC-3 PR: Illegal SCOPE: 0x%02x\n", scope);
2450 		core_scsi3_put_pr_reg(pr_reg);
2451 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
2452 	}
2453 	/*
2454 	 * See if we have an existing PR reservation holder pointer at
2455 	 * struct se_device->dev_pr_res_holder in the form struct t10_pr_registration
2456 	 * *pr_res_holder.
2457 	 */
2458 	spin_lock(&dev->dev_reservation_lock);
2459 	pr_res_holder = dev->dev_pr_res_holder;
2460 	if ((pr_res_holder)) {
2461 		/*
2462 		 * From spc4r17 Section 5.7.9: Reserving:
2463 		 *
2464 		 * If the device server receives a PERSISTENT RESERVE OUT
2465 		 * command from an I_T nexus other than a persistent reservation
2466 		 * holder (see 5.7.10) that attempts to create a persistent
2467 		 * reservation when a persistent reservation already exists for
2468 		 * the logical unit, then the command shall be completed with
2469 		 * RESERVATION CONFLICT status.
2470 		 */
2471 		if (pr_res_holder != pr_reg) {
2472 			struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
2473 			pr_err("SPC-3 PR: Attempted RESERVE from"
2474 				" [%s]: %s while reservation already held by"
2475 				" [%s]: %s, returning RESERVATION_CONFLICT\n",
2476 				cmd->se_tfo->get_fabric_name(),
2477 				se_sess->se_node_acl->initiatorname,
2478 				pr_res_nacl->se_tpg->se_tpg_tfo->get_fabric_name(),
2479 				pr_res_holder->pr_reg_nacl->initiatorname);
2480 
2481 			spin_unlock(&dev->dev_reservation_lock);
2482 			core_scsi3_put_pr_reg(pr_reg);
2483 			return PYX_TRANSPORT_RESERVATION_CONFLICT;
2484 		}
2485 		/*
2486 		 * From spc4r17 Section 5.7.9: Reserving:
2487 		 *
2488 		 * If a persistent reservation holder attempts to modify the
2489 		 * type or scope of an existing persistent reservation, the
2490 		 * command shall be completed with RESERVATION CONFLICT status.
2491 		 */
2492 		if ((pr_res_holder->pr_res_type != type) ||
2493 		    (pr_res_holder->pr_res_scope != scope)) {
2494 			struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
2495 			pr_err("SPC-3 PR: Attempted RESERVE from"
2496 				" [%s]: %s trying to change TYPE and/or SCOPE,"
2497 				" while reservation already held by [%s]: %s,"
2498 				" returning RESERVATION_CONFLICT\n",
2499 				cmd->se_tfo->get_fabric_name(),
2500 				se_sess->se_node_acl->initiatorname,
2501 				pr_res_nacl->se_tpg->se_tpg_tfo->get_fabric_name(),
2502 				pr_res_holder->pr_reg_nacl->initiatorname);
2503 
2504 			spin_unlock(&dev->dev_reservation_lock);
2505 			core_scsi3_put_pr_reg(pr_reg);
2506 			return PYX_TRANSPORT_RESERVATION_CONFLICT;
2507 		}
2508 		/*
2509 		 * From spc4r17 Section 5.7.9: Reserving:
2510 		 *
2511 		 * If the device server receives a PERSISTENT RESERVE OUT
2512 		 * command with RESERVE service action where the TYPE field and
2513 		 * the SCOPE field contain the same values as the existing type
2514 		 * and scope from a persistent reservation holder, it shall not
2515 		 * make any change to the existing persistent reservation and
2516 		 * shall completethe command with GOOD status.
2517 		 */
2518 		spin_unlock(&dev->dev_reservation_lock);
2519 		core_scsi3_put_pr_reg(pr_reg);
2520 		return PYX_TRANSPORT_SENT_TO_TRANSPORT;
2521 	}
2522 	/*
2523 	 * Otherwise, our *pr_reg becomes the PR reservation holder for said
2524 	 * TYPE/SCOPE.  Also set the received scope and type in *pr_reg.
2525 	 */
2526 	pr_reg->pr_res_scope = scope;
2527 	pr_reg->pr_res_type = type;
2528 	pr_reg->pr_res_holder = 1;
2529 	dev->dev_pr_res_holder = pr_reg;
2530 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
2531 				PR_REG_ISID_ID_LEN);
2532 
2533 	pr_debug("SPC-3 PR [%s] Service Action: RESERVE created new"
2534 		" reservation holder TYPE: %s ALL_TG_PT: %d\n",
2535 		cmd->se_tfo->get_fabric_name(), core_scsi3_pr_dump_type(type),
2536 		(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
2537 	pr_debug("SPC-3 PR [%s] RESERVE Node: %s%s\n",
2538 			cmd->se_tfo->get_fabric_name(),
2539 			se_sess->se_node_acl->initiatorname,
2540 			(prf_isid) ? &i_buf[0] : "");
2541 	spin_unlock(&dev->dev_reservation_lock);
2542 
2543 	if (pr_tmpl->pr_aptpl_active) {
2544 		ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
2545 				&pr_reg->pr_aptpl_buf[0],
2546 				pr_tmpl->pr_aptpl_buf_len);
2547 		if (!ret)
2548 			pr_debug("SPC-3 PR: Updated APTPL metadata"
2549 					" for RESERVE\n");
2550 	}
2551 
2552 	core_scsi3_put_pr_reg(pr_reg);
2553 	return 0;
2554 }
2555 
2556 static int core_scsi3_emulate_pro_reserve(
2557 	struct se_cmd *cmd,
2558 	int type,
2559 	int scope,
2560 	u64 res_key)
2561 {
2562 	struct se_device *dev = cmd->se_dev;
2563 	int ret = 0;
2564 
2565 	switch (type) {
2566 	case PR_TYPE_WRITE_EXCLUSIVE:
2567 	case PR_TYPE_EXCLUSIVE_ACCESS:
2568 	case PR_TYPE_WRITE_EXCLUSIVE_REGONLY:
2569 	case PR_TYPE_EXCLUSIVE_ACCESS_REGONLY:
2570 	case PR_TYPE_WRITE_EXCLUSIVE_ALLREG:
2571 	case PR_TYPE_EXCLUSIVE_ACCESS_ALLREG:
2572 		ret = core_scsi3_pro_reserve(cmd, dev, type, scope, res_key);
2573 		break;
2574 	default:
2575 		pr_err("SPC-3 PR: Unknown Service Action RESERVE Type:"
2576 			" 0x%02x\n", type);
2577 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
2578 	}
2579 
2580 	return ret;
2581 }
2582 
2583 /*
2584  * Called with struct se_device->dev_reservation_lock held.
2585  */
2586 static void __core_scsi3_complete_pro_release(
2587 	struct se_device *dev,
2588 	struct se_node_acl *se_nacl,
2589 	struct t10_pr_registration *pr_reg,
2590 	int explict)
2591 {
2592 	struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo;
2593 	char i_buf[PR_REG_ISID_ID_LEN];
2594 	int prf_isid;
2595 
2596 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
2597 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
2598 				PR_REG_ISID_ID_LEN);
2599 	/*
2600 	 * Go ahead and release the current PR reservation holder.
2601 	 */
2602 	dev->dev_pr_res_holder = NULL;
2603 
2604 	pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
2605 		" reservation holder TYPE: %s ALL_TG_PT: %d\n",
2606 		tfo->get_fabric_name(), (explict) ? "explict" : "implict",
2607 		core_scsi3_pr_dump_type(pr_reg->pr_res_type),
2608 		(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
2609 	pr_debug("SPC-3 PR [%s] RELEASE Node: %s%s\n",
2610 		tfo->get_fabric_name(), se_nacl->initiatorname,
2611 		(prf_isid) ? &i_buf[0] : "");
2612 	/*
2613 	 * Clear TYPE and SCOPE for the next PROUT Service Action: RESERVE
2614 	 */
2615 	pr_reg->pr_res_holder = pr_reg->pr_res_type = pr_reg->pr_res_scope = 0;
2616 }
2617 
2618 static int core_scsi3_emulate_pro_release(
2619 	struct se_cmd *cmd,
2620 	int type,
2621 	int scope,
2622 	u64 res_key)
2623 {
2624 	struct se_device *dev = cmd->se_dev;
2625 	struct se_session *se_sess = cmd->se_sess;
2626 	struct se_lun *se_lun = cmd->se_lun;
2627 	struct t10_pr_registration *pr_reg, *pr_reg_p, *pr_res_holder;
2628 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
2629 	int ret, all_reg = 0;
2630 
2631 	if (!se_sess || !se_lun) {
2632 		pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
2633 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2634 	}
2635 	/*
2636 	 * Locate the existing *pr_reg via struct se_node_acl pointers
2637 	 */
2638 	pr_reg = core_scsi3_locate_pr_reg(dev, se_sess->se_node_acl, se_sess);
2639 	if (!pr_reg) {
2640 		pr_err("SPC-3 PR: Unable to locate"
2641 			" PR_REGISTERED *pr_reg for RELEASE\n");
2642 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2643 	}
2644 	/*
2645 	 * From spc4r17 Section 5.7.11.2 Releasing:
2646 	 *
2647 	 * If there is no persistent reservation or in response to a persistent
2648 	 * reservation release request from a registered I_T nexus that is not a
2649 	 * persistent reservation holder (see 5.7.10), the device server shall
2650 	 * do the following:
2651 	 *
2652 	 *     a) Not release the persistent reservation, if any;
2653 	 *     b) Not remove any registrations; and
2654 	 *     c) Complete the command with GOOD status.
2655 	 */
2656 	spin_lock(&dev->dev_reservation_lock);
2657 	pr_res_holder = dev->dev_pr_res_holder;
2658 	if (!pr_res_holder) {
2659 		/*
2660 		 * No persistent reservation, return GOOD status.
2661 		 */
2662 		spin_unlock(&dev->dev_reservation_lock);
2663 		core_scsi3_put_pr_reg(pr_reg);
2664 		return PYX_TRANSPORT_SENT_TO_TRANSPORT;
2665 	}
2666 	if ((pr_res_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
2667 	    (pr_res_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))
2668 		all_reg = 1;
2669 
2670 	if ((all_reg == 0) && (pr_res_holder != pr_reg)) {
2671 		/*
2672 		 * Non 'All Registrants' PR Type cases..
2673 		 * Release request from a registered I_T nexus that is not a
2674 		 * persistent reservation holder. return GOOD status.
2675 		 */
2676 		spin_unlock(&dev->dev_reservation_lock);
2677 		core_scsi3_put_pr_reg(pr_reg);
2678 		return PYX_TRANSPORT_SENT_TO_TRANSPORT;
2679 	}
2680 	/*
2681 	 * From spc4r17 Section 5.7.11.2 Releasing:
2682 	 *
2683 	 * Only the persistent reservation holder (see 5.7.10) is allowed to
2684 	 * release a persistent reservation.
2685 	 *
2686 	 * An application client releases the persistent reservation by issuing
2687 	 * a PERSISTENT RESERVE OUT command with RELEASE service action through
2688 	 * an I_T nexus that is a persistent reservation holder with the
2689 	 * following parameters:
2690 	 *
2691 	 *     a) RESERVATION KEY field set to the value of the reservation key
2692 	 *	  that is registered with the logical unit for the I_T nexus;
2693 	 */
2694 	if (res_key != pr_reg->pr_res_key) {
2695 		pr_err("SPC-3 PR RELEASE: Received res_key: 0x%016Lx"
2696 			" does not match existing SA REGISTER res_key:"
2697 			" 0x%016Lx\n", res_key, pr_reg->pr_res_key);
2698 		spin_unlock(&dev->dev_reservation_lock);
2699 		core_scsi3_put_pr_reg(pr_reg);
2700 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2701 	}
2702 	/*
2703 	 * From spc4r17 Section 5.7.11.2 Releasing and above:
2704 	 *
2705 	 * b) TYPE field and SCOPE field set to match the persistent
2706 	 *    reservation being released.
2707 	 */
2708 	if ((pr_res_holder->pr_res_type != type) ||
2709 	    (pr_res_holder->pr_res_scope != scope)) {
2710 		struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
2711 		pr_err("SPC-3 PR RELEASE: Attempted to release"
2712 			" reservation from [%s]: %s with different TYPE "
2713 			"and/or SCOPE  while reservation already held by"
2714 			" [%s]: %s, returning RESERVATION_CONFLICT\n",
2715 			cmd->se_tfo->get_fabric_name(),
2716 			se_sess->se_node_acl->initiatorname,
2717 			pr_res_nacl->se_tpg->se_tpg_tfo->get_fabric_name(),
2718 			pr_res_holder->pr_reg_nacl->initiatorname);
2719 
2720 		spin_unlock(&dev->dev_reservation_lock);
2721 		core_scsi3_put_pr_reg(pr_reg);
2722 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2723 	}
2724 	/*
2725 	 * In response to a persistent reservation release request from the
2726 	 * persistent reservation holder the device server shall perform a
2727 	 * release by doing the following as an uninterrupted series of actions:
2728 	 * a) Release the persistent reservation;
2729 	 * b) Not remove any registration(s);
2730 	 * c) If the released persistent reservation is a registrants only type
2731 	 * or all registrants type persistent reservation,
2732 	 *    the device server shall establish a unit attention condition for
2733 	 *    the initiator port associated with every regis-
2734 	 *    tered I_T nexus other than I_T nexus on which the PERSISTENT
2735 	 *    RESERVE OUT command with RELEASE service action was received,
2736 	 *    with the additional sense code set to RESERVATIONS RELEASED; and
2737 	 * d) If the persistent reservation is of any other type, the device
2738 	 *    server shall not establish a unit attention condition.
2739 	 */
2740 	__core_scsi3_complete_pro_release(dev, se_sess->se_node_acl,
2741 			pr_reg, 1);
2742 
2743 	spin_unlock(&dev->dev_reservation_lock);
2744 
2745 	if ((type != PR_TYPE_WRITE_EXCLUSIVE_REGONLY) &&
2746 	    (type != PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) &&
2747 	    (type != PR_TYPE_WRITE_EXCLUSIVE_ALLREG) &&
2748 	    (type != PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
2749 		/*
2750 		 * If no UNIT ATTENTION conditions will be established for
2751 		 * PR_TYPE_WRITE_EXCLUSIVE or PR_TYPE_EXCLUSIVE_ACCESS
2752 		 * go ahead and check for APTPL=1 update+write below
2753 		 */
2754 		goto write_aptpl;
2755 	}
2756 
2757 	spin_lock(&pr_tmpl->registration_lock);
2758 	list_for_each_entry(pr_reg_p, &pr_tmpl->registration_list,
2759 			pr_reg_list) {
2760 		/*
2761 		 * Do not establish a UNIT ATTENTION condition
2762 		 * for the calling I_T Nexus
2763 		 */
2764 		if (pr_reg_p == pr_reg)
2765 			continue;
2766 
2767 		core_scsi3_ua_allocate(pr_reg_p->pr_reg_nacl,
2768 				pr_reg_p->pr_res_mapped_lun,
2769 				0x2A, ASCQ_2AH_RESERVATIONS_RELEASED);
2770 	}
2771 	spin_unlock(&pr_tmpl->registration_lock);
2772 
2773 write_aptpl:
2774 	if (pr_tmpl->pr_aptpl_active) {
2775 		ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
2776 				&pr_reg->pr_aptpl_buf[0],
2777 				pr_tmpl->pr_aptpl_buf_len);
2778 		if (!ret)
2779 			pr_debug("SPC-3 PR: Updated APTPL metadata for RELEASE\n");
2780 	}
2781 
2782 	core_scsi3_put_pr_reg(pr_reg);
2783 	return 0;
2784 }
2785 
2786 static int core_scsi3_emulate_pro_clear(
2787 	struct se_cmd *cmd,
2788 	u64 res_key)
2789 {
2790 	struct se_device *dev = cmd->se_dev;
2791 	struct se_node_acl *pr_reg_nacl;
2792 	struct se_session *se_sess = cmd->se_sess;
2793 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
2794 	struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_reg_n, *pr_res_holder;
2795 	u32 pr_res_mapped_lun = 0;
2796 	int calling_it_nexus = 0;
2797 	/*
2798 	 * Locate the existing *pr_reg via struct se_node_acl pointers
2799 	 */
2800 	pr_reg_n = core_scsi3_locate_pr_reg(cmd->se_dev,
2801 			se_sess->se_node_acl, se_sess);
2802 	if (!pr_reg_n) {
2803 		pr_err("SPC-3 PR: Unable to locate"
2804 			" PR_REGISTERED *pr_reg for CLEAR\n");
2805 			return PYX_TRANSPORT_LU_COMM_FAILURE;
2806 	}
2807 	/*
2808 	 * From spc4r17 section 5.7.11.6, Clearing:
2809 	 *
2810 	 * Any application client may release the persistent reservation and
2811 	 * remove all registrations from a device server by issuing a
2812 	 * PERSISTENT RESERVE OUT command with CLEAR service action through a
2813 	 * registered I_T nexus with the following parameter:
2814 	 *
2815 	 *	a) RESERVATION KEY field set to the value of the reservation key
2816 	 * 	   that is registered with the logical unit for the I_T nexus.
2817 	 */
2818 	if (res_key != pr_reg_n->pr_res_key) {
2819 		pr_err("SPC-3 PR REGISTER: Received"
2820 			" res_key: 0x%016Lx does not match"
2821 			" existing SA REGISTER res_key:"
2822 			" 0x%016Lx\n", res_key, pr_reg_n->pr_res_key);
2823 		core_scsi3_put_pr_reg(pr_reg_n);
2824 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2825 	}
2826 	/*
2827 	 * a) Release the persistent reservation, if any;
2828 	 */
2829 	spin_lock(&dev->dev_reservation_lock);
2830 	pr_res_holder = dev->dev_pr_res_holder;
2831 	if (pr_res_holder) {
2832 		struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
2833 		__core_scsi3_complete_pro_release(dev, pr_res_nacl,
2834 			pr_res_holder, 0);
2835 	}
2836 	spin_unlock(&dev->dev_reservation_lock);
2837 	/*
2838 	 * b) Remove all registration(s) (see spc4r17 5.7.7);
2839 	 */
2840 	spin_lock(&pr_tmpl->registration_lock);
2841 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
2842 			&pr_tmpl->registration_list, pr_reg_list) {
2843 
2844 		calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
2845 		pr_reg_nacl = pr_reg->pr_reg_nacl;
2846 		pr_res_mapped_lun = pr_reg->pr_res_mapped_lun;
2847 		__core_scsi3_free_registration(dev, pr_reg, NULL,
2848 					calling_it_nexus);
2849 		/*
2850 		 * e) Establish a unit attention condition for the initiator
2851 		 *    port associated with every registered I_T nexus other
2852 		 *    than the I_T nexus on which the PERSISTENT RESERVE OUT
2853 		 *    command with CLEAR service action was received, with the
2854 		 *    additional sense code set to RESERVATIONS PREEMPTED.
2855 		 */
2856 		if (!calling_it_nexus)
2857 			core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun,
2858 				0x2A, ASCQ_2AH_RESERVATIONS_PREEMPTED);
2859 	}
2860 	spin_unlock(&pr_tmpl->registration_lock);
2861 
2862 	pr_debug("SPC-3 PR [%s] Service Action: CLEAR complete\n",
2863 		cmd->se_tfo->get_fabric_name());
2864 
2865 	if (pr_tmpl->pr_aptpl_active) {
2866 		core_scsi3_update_and_write_aptpl(cmd->se_dev, NULL, 0);
2867 		pr_debug("SPC-3 PR: Updated APTPL metadata"
2868 				" for CLEAR\n");
2869 	}
2870 
2871 	core_scsi3_pr_generation(dev);
2872 	return 0;
2873 }
2874 
2875 /*
2876  * Called with struct se_device->dev_reservation_lock held.
2877  */
2878 static void __core_scsi3_complete_pro_preempt(
2879 	struct se_device *dev,
2880 	struct t10_pr_registration *pr_reg,
2881 	struct list_head *preempt_and_abort_list,
2882 	int type,
2883 	int scope,
2884 	int abort)
2885 {
2886 	struct se_node_acl *nacl = pr_reg->pr_reg_nacl;
2887 	struct target_core_fabric_ops *tfo = nacl->se_tpg->se_tpg_tfo;
2888 	char i_buf[PR_REG_ISID_ID_LEN];
2889 	int prf_isid;
2890 
2891 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
2892 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
2893 				PR_REG_ISID_ID_LEN);
2894 	/*
2895 	 * Do an implict RELEASE of the existing reservation.
2896 	 */
2897 	if (dev->dev_pr_res_holder)
2898 		__core_scsi3_complete_pro_release(dev, nacl,
2899 				dev->dev_pr_res_holder, 0);
2900 
2901 	dev->dev_pr_res_holder = pr_reg;
2902 	pr_reg->pr_res_holder = 1;
2903 	pr_reg->pr_res_type = type;
2904 	pr_reg->pr_res_scope = scope;
2905 
2906 	pr_debug("SPC-3 PR [%s] Service Action: PREEMPT%s created new"
2907 		" reservation holder TYPE: %s ALL_TG_PT: %d\n",
2908 		tfo->get_fabric_name(), (abort) ? "_AND_ABORT" : "",
2909 		core_scsi3_pr_dump_type(type),
2910 		(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
2911 	pr_debug("SPC-3 PR [%s] PREEMPT%s from Node: %s%s\n",
2912 		tfo->get_fabric_name(), (abort) ? "_AND_ABORT" : "",
2913 		nacl->initiatorname, (prf_isid) ? &i_buf[0] : "");
2914 	/*
2915 	 * For PREEMPT_AND_ABORT, add the preempting reservation's
2916 	 * struct t10_pr_registration to the list that will be compared
2917 	 * against received CDBs..
2918 	 */
2919 	if (preempt_and_abort_list)
2920 		list_add_tail(&pr_reg->pr_reg_abort_list,
2921 				preempt_and_abort_list);
2922 }
2923 
2924 static void core_scsi3_release_preempt_and_abort(
2925 	struct list_head *preempt_and_abort_list,
2926 	struct t10_pr_registration *pr_reg_holder)
2927 {
2928 	struct t10_pr_registration *pr_reg, *pr_reg_tmp;
2929 
2930 	list_for_each_entry_safe(pr_reg, pr_reg_tmp, preempt_and_abort_list,
2931 				pr_reg_abort_list) {
2932 
2933 		list_del(&pr_reg->pr_reg_abort_list);
2934 		if (pr_reg_holder == pr_reg)
2935 			continue;
2936 		if (pr_reg->pr_res_holder) {
2937 			pr_warn("pr_reg->pr_res_holder still set\n");
2938 			continue;
2939 		}
2940 
2941 		pr_reg->pr_reg_deve = NULL;
2942 		pr_reg->pr_reg_nacl = NULL;
2943 		kfree(pr_reg->pr_aptpl_buf);
2944 		kmem_cache_free(t10_pr_reg_cache, pr_reg);
2945 	}
2946 }
2947 
2948 int core_scsi3_check_cdb_abort_and_preempt(
2949 	struct list_head *preempt_and_abort_list,
2950 	struct se_cmd *cmd)
2951 {
2952 	struct t10_pr_registration *pr_reg, *pr_reg_tmp;
2953 
2954 	list_for_each_entry_safe(pr_reg, pr_reg_tmp, preempt_and_abort_list,
2955 				pr_reg_abort_list) {
2956 		if (pr_reg->pr_res_key == cmd->pr_res_key)
2957 			return 0;
2958 	}
2959 
2960 	return 1;
2961 }
2962 
2963 static int core_scsi3_pro_preempt(
2964 	struct se_cmd *cmd,
2965 	int type,
2966 	int scope,
2967 	u64 res_key,
2968 	u64 sa_res_key,
2969 	int abort)
2970 {
2971 	struct se_device *dev = cmd->se_dev;
2972 	struct se_dev_entry *se_deve;
2973 	struct se_node_acl *pr_reg_nacl;
2974 	struct se_session *se_sess = cmd->se_sess;
2975 	struct list_head preempt_and_abort_list;
2976 	struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_reg_n, *pr_res_holder;
2977 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
2978 	u32 pr_res_mapped_lun = 0;
2979 	int all_reg = 0, calling_it_nexus = 0, released_regs = 0;
2980 	int prh_type = 0, prh_scope = 0, ret;
2981 
2982 	if (!se_sess)
2983 		return PYX_TRANSPORT_LU_COMM_FAILURE;
2984 
2985 	se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
2986 	pr_reg_n = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
2987 				se_sess);
2988 	if (!pr_reg_n) {
2989 		pr_err("SPC-3 PR: Unable to locate"
2990 			" PR_REGISTERED *pr_reg for PREEMPT%s\n",
2991 			(abort) ? "_AND_ABORT" : "");
2992 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2993 	}
2994 	if (pr_reg_n->pr_res_key != res_key) {
2995 		core_scsi3_put_pr_reg(pr_reg_n);
2996 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
2997 	}
2998 	if (scope != PR_SCOPE_LU_SCOPE) {
2999 		pr_err("SPC-3 PR: Illegal SCOPE: 0x%02x\n", scope);
3000 		core_scsi3_put_pr_reg(pr_reg_n);
3001 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3002 	}
3003 	INIT_LIST_HEAD(&preempt_and_abort_list);
3004 
3005 	spin_lock(&dev->dev_reservation_lock);
3006 	pr_res_holder = dev->dev_pr_res_holder;
3007 	if (pr_res_holder &&
3008 	   ((pr_res_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
3009 	    (pr_res_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)))
3010 		all_reg = 1;
3011 
3012 	if (!all_reg && !sa_res_key) {
3013 		spin_unlock(&dev->dev_reservation_lock);
3014 		core_scsi3_put_pr_reg(pr_reg_n);
3015 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3016 	}
3017 	/*
3018 	 * From spc4r17, section 5.7.11.4.4 Removing Registrations:
3019 	 *
3020 	 * If the SERVICE ACTION RESERVATION KEY field does not identify a
3021 	 * persistent reservation holder or there is no persistent reservation
3022 	 * holder (i.e., there is no persistent reservation), then the device
3023 	 * server shall perform a preempt by doing the following in an
3024 	 * uninterrupted series of actions. (See below..)
3025 	 */
3026 	if (!pr_res_holder || (pr_res_holder->pr_res_key != sa_res_key)) {
3027 		/*
3028 		 * No existing or SA Reservation Key matching reservations..
3029 		 *
3030 		 * PROUT SA PREEMPT with All Registrant type reservations are
3031 		 * allowed to be processed without a matching SA Reservation Key
3032 		 */
3033 		spin_lock(&pr_tmpl->registration_lock);
3034 		list_for_each_entry_safe(pr_reg, pr_reg_tmp,
3035 				&pr_tmpl->registration_list, pr_reg_list) {
3036 			/*
3037 			 * Removing of registrations in non all registrants
3038 			 * type reservations without a matching SA reservation
3039 			 * key.
3040 			 *
3041 			 * a) Remove the registrations for all I_T nexuses
3042 			 *    specified by the SERVICE ACTION RESERVATION KEY
3043 			 *    field;
3044 			 * b) Ignore the contents of the SCOPE and TYPE fields;
3045 			 * c) Process tasks as defined in 5.7.1; and
3046 			 * d) Establish a unit attention condition for the
3047 			 *    initiator port associated with every I_T nexus
3048 			 *    that lost its registration other than the I_T
3049 			 *    nexus on which the PERSISTENT RESERVE OUT command
3050 			 *    was received, with the additional sense code set
3051 			 *    to REGISTRATIONS PREEMPTED.
3052 			 */
3053 			if (!all_reg) {
3054 				if (pr_reg->pr_res_key != sa_res_key)
3055 					continue;
3056 
3057 				calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
3058 				pr_reg_nacl = pr_reg->pr_reg_nacl;
3059 				pr_res_mapped_lun = pr_reg->pr_res_mapped_lun;
3060 				__core_scsi3_free_registration(dev, pr_reg,
3061 					(abort) ? &preempt_and_abort_list :
3062 						NULL, calling_it_nexus);
3063 				released_regs++;
3064 			} else {
3065 				/*
3066 				 * Case for any existing all registrants type
3067 				 * reservation, follow logic in spc4r17 section
3068 				 * 5.7.11.4 Preempting, Table 52 and Figure 7.
3069 				 *
3070 				 * For a ZERO SA Reservation key, release
3071 				 * all other registrations and do an implict
3072 				 * release of active persistent reservation.
3073 				 *
3074 				 * For a non-ZERO SA Reservation key, only
3075 				 * release the matching reservation key from
3076 				 * registrations.
3077 				 */
3078 				if ((sa_res_key) &&
3079 				     (pr_reg->pr_res_key != sa_res_key))
3080 					continue;
3081 
3082 				calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
3083 				if (calling_it_nexus)
3084 					continue;
3085 
3086 				pr_reg_nacl = pr_reg->pr_reg_nacl;
3087 				pr_res_mapped_lun = pr_reg->pr_res_mapped_lun;
3088 				__core_scsi3_free_registration(dev, pr_reg,
3089 					(abort) ? &preempt_and_abort_list :
3090 						NULL, 0);
3091 				released_regs++;
3092 			}
3093 			if (!calling_it_nexus)
3094 				core_scsi3_ua_allocate(pr_reg_nacl,
3095 					pr_res_mapped_lun, 0x2A,
3096 					ASCQ_2AH_RESERVATIONS_PREEMPTED);
3097 		}
3098 		spin_unlock(&pr_tmpl->registration_lock);
3099 		/*
3100 		 * If a PERSISTENT RESERVE OUT with a PREEMPT service action or
3101 		 * a PREEMPT AND ABORT service action sets the SERVICE ACTION
3102 		 * RESERVATION KEY field to a value that does not match any
3103 		 * registered reservation key, then the device server shall
3104 		 * complete the command with RESERVATION CONFLICT status.
3105 		 */
3106 		if (!released_regs) {
3107 			spin_unlock(&dev->dev_reservation_lock);
3108 			core_scsi3_put_pr_reg(pr_reg_n);
3109 			return PYX_TRANSPORT_RESERVATION_CONFLICT;
3110 		}
3111 		/*
3112 		 * For an existing all registrants type reservation
3113 		 * with a zero SA rservation key, preempt the existing
3114 		 * reservation with the new PR type and scope.
3115 		 */
3116 		if (pr_res_holder && all_reg && !(sa_res_key)) {
3117 			__core_scsi3_complete_pro_preempt(dev, pr_reg_n,
3118 				(abort) ? &preempt_and_abort_list : NULL,
3119 				type, scope, abort);
3120 
3121 			if (abort)
3122 				core_scsi3_release_preempt_and_abort(
3123 					&preempt_and_abort_list, pr_reg_n);
3124 		}
3125 		spin_unlock(&dev->dev_reservation_lock);
3126 
3127 		if (pr_tmpl->pr_aptpl_active) {
3128 			ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
3129 					&pr_reg_n->pr_aptpl_buf[0],
3130 					pr_tmpl->pr_aptpl_buf_len);
3131 			if (!ret)
3132 				pr_debug("SPC-3 PR: Updated APTPL"
3133 					" metadata for  PREEMPT%s\n", (abort) ?
3134 					"_AND_ABORT" : "");
3135 		}
3136 
3137 		core_scsi3_put_pr_reg(pr_reg_n);
3138 		core_scsi3_pr_generation(cmd->se_dev);
3139 		return 0;
3140 	}
3141 	/*
3142 	 * The PREEMPTing SA reservation key matches that of the
3143 	 * existing persistent reservation, first, we check if
3144 	 * we are preempting our own reservation.
3145 	 * From spc4r17, section 5.7.11.4.3 Preempting
3146 	 * persistent reservations and registration handling
3147 	 *
3148 	 * If an all registrants persistent reservation is not
3149 	 * present, it is not an error for the persistent
3150 	 * reservation holder to preempt itself (i.e., a
3151 	 * PERSISTENT RESERVE OUT with a PREEMPT service action
3152 	 * or a PREEMPT AND ABORT service action with the
3153 	 * SERVICE ACTION RESERVATION KEY value equal to the
3154 	 * persistent reservation holder's reservation key that
3155 	 * is received from the persistent reservation holder).
3156 	 * In that case, the device server shall establish the
3157 	 * new persistent reservation and maintain the
3158 	 * registration.
3159 	 */
3160 	prh_type = pr_res_holder->pr_res_type;
3161 	prh_scope = pr_res_holder->pr_res_scope;
3162 	/*
3163 	 * If the SERVICE ACTION RESERVATION KEY field identifies a
3164 	 * persistent reservation holder (see 5.7.10), the device
3165 	 * server shall perform a preempt by doing the following as
3166 	 * an uninterrupted series of actions:
3167 	 *
3168 	 * a) Release the persistent reservation for the holder
3169 	 *    identified by the SERVICE ACTION RESERVATION KEY field;
3170 	 */
3171 	if (pr_reg_n != pr_res_holder)
3172 		__core_scsi3_complete_pro_release(dev,
3173 				pr_res_holder->pr_reg_nacl,
3174 				dev->dev_pr_res_holder, 0);
3175 	/*
3176 	 * b) Remove the registrations for all I_T nexuses identified
3177 	 *    by the SERVICE ACTION RESERVATION KEY field, except the
3178 	 *    I_T nexus that is being used for the PERSISTENT RESERVE
3179 	 *    OUT command. If an all registrants persistent reservation
3180 	 *    is present and the SERVICE ACTION RESERVATION KEY field
3181 	 *    is set to zero, then all registrations shall be removed
3182 	 *    except for that of the I_T nexus that is being used for
3183 	 *    the PERSISTENT RESERVE OUT command;
3184 	 */
3185 	spin_lock(&pr_tmpl->registration_lock);
3186 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
3187 			&pr_tmpl->registration_list, pr_reg_list) {
3188 
3189 		calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
3190 		if (calling_it_nexus)
3191 			continue;
3192 
3193 		if (pr_reg->pr_res_key != sa_res_key)
3194 			continue;
3195 
3196 		pr_reg_nacl = pr_reg->pr_reg_nacl;
3197 		pr_res_mapped_lun = pr_reg->pr_res_mapped_lun;
3198 		__core_scsi3_free_registration(dev, pr_reg,
3199 				(abort) ? &preempt_and_abort_list : NULL,
3200 				calling_it_nexus);
3201 		/*
3202 		 * e) Establish a unit attention condition for the initiator
3203 		 *    port associated with every I_T nexus that lost its
3204 		 *    persistent reservation and/or registration, with the
3205 		 *    additional sense code set to REGISTRATIONS PREEMPTED;
3206 		 */
3207 		core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun, 0x2A,
3208 				ASCQ_2AH_RESERVATIONS_PREEMPTED);
3209 	}
3210 	spin_unlock(&pr_tmpl->registration_lock);
3211 	/*
3212 	 * c) Establish a persistent reservation for the preempting
3213 	 *    I_T nexus using the contents of the SCOPE and TYPE fields;
3214 	 */
3215 	__core_scsi3_complete_pro_preempt(dev, pr_reg_n,
3216 			(abort) ? &preempt_and_abort_list : NULL,
3217 			type, scope, abort);
3218 	/*
3219 	 * d) Process tasks as defined in 5.7.1;
3220 	 * e) See above..
3221 	 * f) If the type or scope has changed, then for every I_T nexus
3222 	 *    whose reservation key was not removed, except for the I_T
3223 	 *    nexus on which the PERSISTENT RESERVE OUT command was
3224 	 *    received, the device server shall establish a unit
3225 	 *    attention condition for the initiator port associated with
3226 	 *    that I_T nexus, with the additional sense code set to
3227 	 *    RESERVATIONS RELEASED. If the type or scope have not
3228 	 *    changed, then no unit attention condition(s) shall be
3229 	 *    established for this reason.
3230 	 */
3231 	if ((prh_type != type) || (prh_scope != scope)) {
3232 		spin_lock(&pr_tmpl->registration_lock);
3233 		list_for_each_entry_safe(pr_reg, pr_reg_tmp,
3234 				&pr_tmpl->registration_list, pr_reg_list) {
3235 
3236 			calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
3237 			if (calling_it_nexus)
3238 				continue;
3239 
3240 			core_scsi3_ua_allocate(pr_reg->pr_reg_nacl,
3241 					pr_reg->pr_res_mapped_lun, 0x2A,
3242 					ASCQ_2AH_RESERVATIONS_RELEASED);
3243 		}
3244 		spin_unlock(&pr_tmpl->registration_lock);
3245 	}
3246 	spin_unlock(&dev->dev_reservation_lock);
3247 	/*
3248 	 * Call LUN_RESET logic upon list of struct t10_pr_registration,
3249 	 * All received CDBs for the matching existing reservation and
3250 	 * registrations undergo ABORT_TASK logic.
3251 	 *
3252 	 * From there, core_scsi3_release_preempt_and_abort() will
3253 	 * release every registration in the list (which have already
3254 	 * been removed from the primary pr_reg list), except the
3255 	 * new persistent reservation holder, the calling Initiator Port.
3256 	 */
3257 	if (abort) {
3258 		core_tmr_lun_reset(dev, NULL, &preempt_and_abort_list, cmd);
3259 		core_scsi3_release_preempt_and_abort(&preempt_and_abort_list,
3260 						pr_reg_n);
3261 	}
3262 
3263 	if (pr_tmpl->pr_aptpl_active) {
3264 		ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
3265 				&pr_reg_n->pr_aptpl_buf[0],
3266 				pr_tmpl->pr_aptpl_buf_len);
3267 		if (!ret)
3268 			pr_debug("SPC-3 PR: Updated APTPL metadata for PREEMPT"
3269 				"%s\n", (abort) ? "_AND_ABORT" : "");
3270 	}
3271 
3272 	core_scsi3_put_pr_reg(pr_reg_n);
3273 	core_scsi3_pr_generation(cmd->se_dev);
3274 	return 0;
3275 }
3276 
3277 static int core_scsi3_emulate_pro_preempt(
3278 	struct se_cmd *cmd,
3279 	int type,
3280 	int scope,
3281 	u64 res_key,
3282 	u64 sa_res_key,
3283 	int abort)
3284 {
3285 	int ret = 0;
3286 
3287 	switch (type) {
3288 	case PR_TYPE_WRITE_EXCLUSIVE:
3289 	case PR_TYPE_EXCLUSIVE_ACCESS:
3290 	case PR_TYPE_WRITE_EXCLUSIVE_REGONLY:
3291 	case PR_TYPE_EXCLUSIVE_ACCESS_REGONLY:
3292 	case PR_TYPE_WRITE_EXCLUSIVE_ALLREG:
3293 	case PR_TYPE_EXCLUSIVE_ACCESS_ALLREG:
3294 		ret = core_scsi3_pro_preempt(cmd, type, scope,
3295 				res_key, sa_res_key, abort);
3296 		break;
3297 	default:
3298 		pr_err("SPC-3 PR: Unknown Service Action PREEMPT%s"
3299 			" Type: 0x%02x\n", (abort) ? "_AND_ABORT" : "", type);
3300 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
3301 	}
3302 
3303 	return ret;
3304 }
3305 
3306 
3307 static int core_scsi3_emulate_pro_register_and_move(
3308 	struct se_cmd *cmd,
3309 	u64 res_key,
3310 	u64 sa_res_key,
3311 	int aptpl,
3312 	int unreg)
3313 {
3314 	struct se_session *se_sess = cmd->se_sess;
3315 	struct se_device *dev = cmd->se_dev;
3316 	struct se_dev_entry *se_deve, *dest_se_deve = NULL;
3317 	struct se_lun *se_lun = cmd->se_lun;
3318 	struct se_node_acl *pr_res_nacl, *pr_reg_nacl, *dest_node_acl = NULL;
3319 	struct se_port *se_port;
3320 	struct se_portal_group *se_tpg, *dest_se_tpg = NULL;
3321 	struct target_core_fabric_ops *dest_tf_ops = NULL, *tf_ops;
3322 	struct t10_pr_registration *pr_reg, *pr_res_holder, *dest_pr_reg;
3323 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
3324 	unsigned char *buf;
3325 	unsigned char *initiator_str;
3326 	char *iport_ptr = NULL, dest_iport[64], i_buf[PR_REG_ISID_ID_LEN];
3327 	u32 tid_len, tmp_tid_len;
3328 	int new_reg = 0, type, scope, ret, matching_iname, prf_isid;
3329 	unsigned short rtpi;
3330 	unsigned char proto_ident;
3331 
3332 	if (!se_sess || !se_lun) {
3333 		pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
3334 		return PYX_TRANSPORT_LU_COMM_FAILURE;
3335 	}
3336 	memset(dest_iport, 0, 64);
3337 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
3338 	se_tpg = se_sess->se_tpg;
3339 	tf_ops = se_tpg->se_tpg_tfo;
3340 	se_deve = &se_sess->se_node_acl->device_list[cmd->orig_fe_lun];
3341 	/*
3342 	 * Follow logic from spc4r17 Section 5.7.8, Table 50 --
3343 	 *	Register behaviors for a REGISTER AND MOVE service action
3344 	 *
3345 	 * Locate the existing *pr_reg via struct se_node_acl pointers
3346 	 */
3347 	pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
3348 				se_sess);
3349 	if (!pr_reg) {
3350 		pr_err("SPC-3 PR: Unable to locate PR_REGISTERED"
3351 			" *pr_reg for REGISTER_AND_MOVE\n");
3352 		return PYX_TRANSPORT_LU_COMM_FAILURE;
3353 	}
3354 	/*
3355 	 * The provided reservation key much match the existing reservation key
3356 	 * provided during this initiator's I_T nexus registration.
3357 	 */
3358 	if (res_key != pr_reg->pr_res_key) {
3359 		pr_warn("SPC-3 PR REGISTER_AND_MOVE: Received"
3360 			" res_key: 0x%016Lx does not match existing SA REGISTER"
3361 			" res_key: 0x%016Lx\n", res_key, pr_reg->pr_res_key);
3362 		core_scsi3_put_pr_reg(pr_reg);
3363 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
3364 	}
3365 	/*
3366 	 * The service active reservation key needs to be non zero
3367 	 */
3368 	if (!sa_res_key) {
3369 		pr_warn("SPC-3 PR REGISTER_AND_MOVE: Received zero"
3370 			" sa_res_key\n");
3371 		core_scsi3_put_pr_reg(pr_reg);
3372 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3373 	}
3374 
3375 	/*
3376 	 * Determine the Relative Target Port Identifier where the reservation
3377 	 * will be moved to for the TransportID containing SCSI initiator WWN
3378 	 * information.
3379 	 */
3380 	buf = transport_kmap_first_data_page(cmd);
3381 	rtpi = (buf[18] & 0xff) << 8;
3382 	rtpi |= buf[19] & 0xff;
3383 	tid_len = (buf[20] & 0xff) << 24;
3384 	tid_len |= (buf[21] & 0xff) << 16;
3385 	tid_len |= (buf[22] & 0xff) << 8;
3386 	tid_len |= buf[23] & 0xff;
3387 	transport_kunmap_first_data_page(cmd);
3388 	buf = NULL;
3389 
3390 	if ((tid_len + 24) != cmd->data_length) {
3391 		pr_err("SPC-3 PR: Illegal tid_len: %u + 24 byte header"
3392 			" does not equal CDB data_length: %u\n", tid_len,
3393 			cmd->data_length);
3394 		core_scsi3_put_pr_reg(pr_reg);
3395 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3396 	}
3397 
3398 	spin_lock(&dev->se_port_lock);
3399 	list_for_each_entry(se_port, &dev->dev_sep_list, sep_list) {
3400 		if (se_port->sep_rtpi != rtpi)
3401 			continue;
3402 		dest_se_tpg = se_port->sep_tpg;
3403 		if (!dest_se_tpg)
3404 			continue;
3405 		dest_tf_ops = dest_se_tpg->se_tpg_tfo;
3406 		if (!dest_tf_ops)
3407 			continue;
3408 
3409 		atomic_inc(&dest_se_tpg->tpg_pr_ref_count);
3410 		smp_mb__after_atomic_inc();
3411 		spin_unlock(&dev->se_port_lock);
3412 
3413 		ret = core_scsi3_tpg_depend_item(dest_se_tpg);
3414 		if (ret != 0) {
3415 			pr_err("core_scsi3_tpg_depend_item() failed"
3416 				" for dest_se_tpg\n");
3417 			atomic_dec(&dest_se_tpg->tpg_pr_ref_count);
3418 			smp_mb__after_atomic_dec();
3419 			core_scsi3_put_pr_reg(pr_reg);
3420 			return PYX_TRANSPORT_LU_COMM_FAILURE;
3421 		}
3422 
3423 		spin_lock(&dev->se_port_lock);
3424 		break;
3425 	}
3426 	spin_unlock(&dev->se_port_lock);
3427 
3428 	if (!dest_se_tpg || !dest_tf_ops) {
3429 		pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate"
3430 			" fabric ops from Relative Target Port Identifier:"
3431 			" %hu\n", rtpi);
3432 		core_scsi3_put_pr_reg(pr_reg);
3433 		return PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3434 	}
3435 
3436 	buf = transport_kmap_first_data_page(cmd);
3437 	proto_ident = (buf[24] & 0x0f);
3438 #if 0
3439 	pr_debug("SPC-3 PR REGISTER_AND_MOVE: Extracted Protocol Identifier:"
3440 			" 0x%02x\n", proto_ident);
3441 #endif
3442 	if (proto_ident != dest_tf_ops->get_fabric_proto_ident(dest_se_tpg)) {
3443 		pr_err("SPC-3 PR REGISTER_AND_MOVE: Received"
3444 			" proto_ident: 0x%02x does not match ident: 0x%02x"
3445 			" from fabric: %s\n", proto_ident,
3446 			dest_tf_ops->get_fabric_proto_ident(dest_se_tpg),
3447 			dest_tf_ops->get_fabric_name());
3448 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3449 		goto out;
3450 	}
3451 	if (dest_tf_ops->tpg_parse_pr_out_transport_id == NULL) {
3452 		pr_err("SPC-3 PR REGISTER_AND_MOVE: Fabric does not"
3453 			" containg a valid tpg_parse_pr_out_transport_id"
3454 			" function pointer\n");
3455 		ret = PYX_TRANSPORT_LU_COMM_FAILURE;
3456 		goto out;
3457 	}
3458 	initiator_str = dest_tf_ops->tpg_parse_pr_out_transport_id(dest_se_tpg,
3459 			(const char *)&buf[24], &tmp_tid_len, &iport_ptr);
3460 	if (!initiator_str) {
3461 		pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate"
3462 			" initiator_str from Transport ID\n");
3463 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3464 		goto out;
3465 	}
3466 
3467 	transport_kunmap_first_data_page(cmd);
3468 	buf = NULL;
3469 
3470 	pr_debug("SPC-3 PR [%s] Extracted initiator %s identifier: %s"
3471 		" %s\n", dest_tf_ops->get_fabric_name(), (iport_ptr != NULL) ?
3472 		"port" : "device", initiator_str, (iport_ptr != NULL) ?
3473 		iport_ptr : "");
3474 	/*
3475 	 * If a PERSISTENT RESERVE OUT command with a REGISTER AND MOVE service
3476 	 * action specifies a TransportID that is the same as the initiator port
3477 	 * of the I_T nexus for the command received, then the command shall
3478 	 * be terminated with CHECK CONDITION status, with the sense key set to
3479 	 * ILLEGAL REQUEST, and the additional sense code set to INVALID FIELD
3480 	 * IN PARAMETER LIST.
3481 	 */
3482 	pr_reg_nacl = pr_reg->pr_reg_nacl;
3483 	matching_iname = (!strcmp(initiator_str,
3484 				  pr_reg_nacl->initiatorname)) ? 1 : 0;
3485 	if (!matching_iname)
3486 		goto after_iport_check;
3487 
3488 	if (!iport_ptr || !pr_reg->isid_present_at_reg) {
3489 		pr_err("SPC-3 PR REGISTER_AND_MOVE: TransportID: %s"
3490 			" matches: %s on received I_T Nexus\n", initiator_str,
3491 			pr_reg_nacl->initiatorname);
3492 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3493 		goto out;
3494 	}
3495 	if (!strcmp(iport_ptr, pr_reg->pr_reg_isid)) {
3496 		pr_err("SPC-3 PR REGISTER_AND_MOVE: TransportID: %s %s"
3497 			" matches: %s %s on received I_T Nexus\n",
3498 			initiator_str, iport_ptr, pr_reg_nacl->initiatorname,
3499 			pr_reg->pr_reg_isid);
3500 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3501 		goto out;
3502 	}
3503 after_iport_check:
3504 	/*
3505 	 * Locate the destination struct se_node_acl from the received Transport ID
3506 	 */
3507 	spin_lock_irq(&dest_se_tpg->acl_node_lock);
3508 	dest_node_acl = __core_tpg_get_initiator_node_acl(dest_se_tpg,
3509 				initiator_str);
3510 	if (dest_node_acl) {
3511 		atomic_inc(&dest_node_acl->acl_pr_ref_count);
3512 		smp_mb__after_atomic_inc();
3513 	}
3514 	spin_unlock_irq(&dest_se_tpg->acl_node_lock);
3515 
3516 	if (!dest_node_acl) {
3517 		pr_err("Unable to locate %s dest_node_acl for"
3518 			" TransportID%s\n", dest_tf_ops->get_fabric_name(),
3519 			initiator_str);
3520 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3521 		goto out;
3522 	}
3523 	ret = core_scsi3_nodeacl_depend_item(dest_node_acl);
3524 	if (ret != 0) {
3525 		pr_err("core_scsi3_nodeacl_depend_item() for"
3526 			" dest_node_acl\n");
3527 		atomic_dec(&dest_node_acl->acl_pr_ref_count);
3528 		smp_mb__after_atomic_dec();
3529 		dest_node_acl = NULL;
3530 		ret = PYX_TRANSPORT_LU_COMM_FAILURE;
3531 		goto out;
3532 	}
3533 #if 0
3534 	pr_debug("SPC-3 PR REGISTER_AND_MOVE: Found %s dest_node_acl:"
3535 		" %s from TransportID\n", dest_tf_ops->get_fabric_name(),
3536 		dest_node_acl->initiatorname);
3537 #endif
3538 	/*
3539 	 * Locate the struct se_dev_entry pointer for the matching RELATIVE TARGET
3540 	 * PORT IDENTIFIER.
3541 	 */
3542 	dest_se_deve = core_get_se_deve_from_rtpi(dest_node_acl, rtpi);
3543 	if (!dest_se_deve) {
3544 		pr_err("Unable to locate %s dest_se_deve from RTPI:"
3545 			" %hu\n",  dest_tf_ops->get_fabric_name(), rtpi);
3546 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3547 		goto out;
3548 	}
3549 
3550 	ret = core_scsi3_lunacl_depend_item(dest_se_deve);
3551 	if (ret < 0) {
3552 		pr_err("core_scsi3_lunacl_depend_item() failed\n");
3553 		atomic_dec(&dest_se_deve->pr_ref_count);
3554 		smp_mb__after_atomic_dec();
3555 		dest_se_deve = NULL;
3556 		ret = PYX_TRANSPORT_LU_COMM_FAILURE;
3557 		goto out;
3558 	}
3559 #if 0
3560 	pr_debug("SPC-3 PR REGISTER_AND_MOVE: Located %s node %s LUN"
3561 		" ACL for dest_se_deve->mapped_lun: %u\n",
3562 		dest_tf_ops->get_fabric_name(), dest_node_acl->initiatorname,
3563 		dest_se_deve->mapped_lun);
3564 #endif
3565 	/*
3566 	 * A persistent reservation needs to already existing in order to
3567 	 * successfully complete the REGISTER_AND_MOVE service action..
3568 	 */
3569 	spin_lock(&dev->dev_reservation_lock);
3570 	pr_res_holder = dev->dev_pr_res_holder;
3571 	if (!pr_res_holder) {
3572 		pr_warn("SPC-3 PR REGISTER_AND_MOVE: No reservation"
3573 			" currently held\n");
3574 		spin_unlock(&dev->dev_reservation_lock);
3575 		ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
3576 		goto out;
3577 	}
3578 	/*
3579 	 * The received on I_T Nexus must be the reservation holder.
3580 	 *
3581 	 * From spc4r17 section 5.7.8  Table 50 --
3582 	 * 	Register behaviors for a REGISTER AND MOVE service action
3583 	 */
3584 	if (pr_res_holder != pr_reg) {
3585 		pr_warn("SPC-3 PR REGISTER_AND_MOVE: Calling I_T"
3586 			" Nexus is not reservation holder\n");
3587 		spin_unlock(&dev->dev_reservation_lock);
3588 		ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
3589 		goto out;
3590 	}
3591 	/*
3592 	 * From spc4r17 section 5.7.8: registering and moving reservation
3593 	 *
3594 	 * If a PERSISTENT RESERVE OUT command with a REGISTER AND MOVE service
3595 	 * action is received and the established persistent reservation is a
3596 	 * Write Exclusive - All Registrants type or Exclusive Access -
3597 	 * All Registrants type reservation, then the command shall be completed
3598 	 * with RESERVATION CONFLICT status.
3599 	 */
3600 	if ((pr_res_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
3601 	    (pr_res_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
3602 		pr_warn("SPC-3 PR REGISTER_AND_MOVE: Unable to move"
3603 			" reservation for type: %s\n",
3604 			core_scsi3_pr_dump_type(pr_res_holder->pr_res_type));
3605 		spin_unlock(&dev->dev_reservation_lock);
3606 		ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
3607 		goto out;
3608 	}
3609 	pr_res_nacl = pr_res_holder->pr_reg_nacl;
3610 	/*
3611 	 * b) Ignore the contents of the (received) SCOPE and TYPE fields;
3612 	 */
3613 	type = pr_res_holder->pr_res_type;
3614 	scope = pr_res_holder->pr_res_type;
3615 	/*
3616 	 * c) Associate the reservation key specified in the SERVICE ACTION
3617 	 *    RESERVATION KEY field with the I_T nexus specified as the
3618 	 *    destination of the register and move, where:
3619 	 *    A) The I_T nexus is specified by the TransportID and the
3620 	 *	 RELATIVE TARGET PORT IDENTIFIER field (see 6.14.4); and
3621 	 *    B) Regardless of the TransportID format used, the association for
3622 	 *       the initiator port is based on either the initiator port name
3623 	 *       (see 3.1.71) on SCSI transport protocols where port names are
3624 	 *       required or the initiator port identifier (see 3.1.70) on SCSI
3625 	 *       transport protocols where port names are not required;
3626 	 * d) Register the reservation key specified in the SERVICE ACTION
3627 	 *    RESERVATION KEY field;
3628 	 * e) Retain the reservation key specified in the SERVICE ACTION
3629 	 *    RESERVATION KEY field and associated information;
3630 	 *
3631 	 * Also, It is not an error for a REGISTER AND MOVE service action to
3632 	 * register an I_T nexus that is already registered with the same
3633 	 * reservation key or a different reservation key.
3634 	 */
3635 	dest_pr_reg = __core_scsi3_locate_pr_reg(dev, dest_node_acl,
3636 					iport_ptr);
3637 	if (!dest_pr_reg) {
3638 		ret = core_scsi3_alloc_registration(cmd->se_dev,
3639 				dest_node_acl, dest_se_deve, iport_ptr,
3640 				sa_res_key, 0, aptpl, 2, 1);
3641 		if (ret != 0) {
3642 			spin_unlock(&dev->dev_reservation_lock);
3643 			ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3644 			goto out;
3645 		}
3646 		dest_pr_reg = __core_scsi3_locate_pr_reg(dev, dest_node_acl,
3647 						iport_ptr);
3648 		new_reg = 1;
3649 	}
3650 	/*
3651 	 * f) Release the persistent reservation for the persistent reservation
3652 	 *    holder (i.e., the I_T nexus on which the
3653 	 */
3654 	__core_scsi3_complete_pro_release(dev, pr_res_nacl,
3655 			dev->dev_pr_res_holder, 0);
3656 	/*
3657 	 * g) Move the persistent reservation to the specified I_T nexus using
3658 	 *    the same scope and type as the persistent reservation released in
3659 	 *    item f); and
3660 	 */
3661 	dev->dev_pr_res_holder = dest_pr_reg;
3662 	dest_pr_reg->pr_res_holder = 1;
3663 	dest_pr_reg->pr_res_type = type;
3664 	pr_reg->pr_res_scope = scope;
3665 	prf_isid = core_pr_dump_initiator_port(pr_reg, &i_buf[0],
3666 				PR_REG_ISID_ID_LEN);
3667 	/*
3668 	 * Increment PRGeneration for existing registrations..
3669 	 */
3670 	if (!new_reg)
3671 		dest_pr_reg->pr_res_generation = pr_tmpl->pr_generation++;
3672 	spin_unlock(&dev->dev_reservation_lock);
3673 
3674 	pr_debug("SPC-3 PR [%s] Service Action: REGISTER_AND_MOVE"
3675 		" created new reservation holder TYPE: %s on object RTPI:"
3676 		" %hu  PRGeneration: 0x%08x\n", dest_tf_ops->get_fabric_name(),
3677 		core_scsi3_pr_dump_type(type), rtpi,
3678 		dest_pr_reg->pr_res_generation);
3679 	pr_debug("SPC-3 PR Successfully moved reservation from"
3680 		" %s Fabric Node: %s%s -> %s Fabric Node: %s %s\n",
3681 		tf_ops->get_fabric_name(), pr_reg_nacl->initiatorname,
3682 		(prf_isid) ? &i_buf[0] : "", dest_tf_ops->get_fabric_name(),
3683 		dest_node_acl->initiatorname, (iport_ptr != NULL) ?
3684 		iport_ptr : "");
3685 	/*
3686 	 * It is now safe to release configfs group dependencies for destination
3687 	 * of Transport ID Initiator Device/Port Identifier
3688 	 */
3689 	core_scsi3_lunacl_undepend_item(dest_se_deve);
3690 	core_scsi3_nodeacl_undepend_item(dest_node_acl);
3691 	core_scsi3_tpg_undepend_item(dest_se_tpg);
3692 	/*
3693 	 * h) If the UNREG bit is set to one, unregister (see 5.7.11.3) the I_T
3694 	 * nexus on which PERSISTENT RESERVE OUT command was received.
3695 	 */
3696 	if (unreg) {
3697 		spin_lock(&pr_tmpl->registration_lock);
3698 		__core_scsi3_free_registration(dev, pr_reg, NULL, 1);
3699 		spin_unlock(&pr_tmpl->registration_lock);
3700 	} else
3701 		core_scsi3_put_pr_reg(pr_reg);
3702 
3703 	/*
3704 	 * Clear the APTPL metadata if APTPL has been disabled, otherwise
3705 	 * write out the updated metadata to struct file for this SCSI device.
3706 	 */
3707 	if (!aptpl) {
3708 		pr_tmpl->pr_aptpl_active = 0;
3709 		core_scsi3_update_and_write_aptpl(cmd->se_dev, NULL, 0);
3710 		pr_debug("SPC-3 PR: Set APTPL Bit Deactivated for"
3711 				" REGISTER_AND_MOVE\n");
3712 	} else {
3713 		pr_tmpl->pr_aptpl_active = 1;
3714 		ret = core_scsi3_update_and_write_aptpl(cmd->se_dev,
3715 				&dest_pr_reg->pr_aptpl_buf[0],
3716 				pr_tmpl->pr_aptpl_buf_len);
3717 		if (!ret)
3718 			pr_debug("SPC-3 PR: Set APTPL Bit Activated for"
3719 					" REGISTER_AND_MOVE\n");
3720 	}
3721 
3722 	transport_kunmap_first_data_page(cmd);
3723 
3724 	core_scsi3_put_pr_reg(dest_pr_reg);
3725 	return 0;
3726 out:
3727 	if (buf)
3728 		transport_kunmap_first_data_page(cmd);
3729 	if (dest_se_deve)
3730 		core_scsi3_lunacl_undepend_item(dest_se_deve);
3731 	if (dest_node_acl)
3732 		core_scsi3_nodeacl_undepend_item(dest_node_acl);
3733 	core_scsi3_tpg_undepend_item(dest_se_tpg);
3734 	core_scsi3_put_pr_reg(pr_reg);
3735 	return ret;
3736 }
3737 
3738 static unsigned long long core_scsi3_extract_reservation_key(unsigned char *cdb)
3739 {
3740 	unsigned int __v1, __v2;
3741 
3742 	__v1 = (cdb[0] << 24) | (cdb[1] << 16) | (cdb[2] << 8) | cdb[3];
3743 	__v2 = (cdb[4] << 24) | (cdb[5] << 16) | (cdb[6] << 8) | cdb[7];
3744 
3745 	return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
3746 }
3747 
3748 /*
3749  * See spc4r17 section 6.14 Table 170
3750  */
3751 int target_scsi3_emulate_pr_out(struct se_task *task)
3752 {
3753 	struct se_cmd *cmd = task->task_se_cmd;
3754 	unsigned char *cdb = &cmd->t_task_cdb[0];
3755 	unsigned char *buf;
3756 	u64 res_key, sa_res_key;
3757 	int sa, scope, type, aptpl;
3758 	int spec_i_pt = 0, all_tg_pt = 0, unreg = 0;
3759 	int ret;
3760 
3761 	/*
3762 	 * Following spc2r20 5.5.1 Reservations overview:
3763 	 *
3764 	 * If a logical unit has been reserved by any RESERVE command and is
3765 	 * still reserved by any initiator, all PERSISTENT RESERVE IN and all
3766 	 * PERSISTENT RESERVE OUT commands shall conflict regardless of
3767 	 * initiator or service action and shall terminate with a RESERVATION
3768 	 * CONFLICT status.
3769 	 */
3770 	if (cmd->se_dev->dev_flags & DF_SPC2_RESERVATIONS) {
3771 		pr_err("Received PERSISTENT_RESERVE CDB while legacy"
3772 			" SPC-2 reservation is held, returning"
3773 			" RESERVATION_CONFLICT\n");
3774 		ret = PYX_TRANSPORT_RESERVATION_CONFLICT;
3775 		goto out;
3776 	}
3777 
3778 	/*
3779 	 * FIXME: A NULL struct se_session pointer means an this is not coming from
3780 	 * a $FABRIC_MOD's nexus, but from internal passthrough ops.
3781 	 */
3782 	if (!cmd->se_sess)
3783 		return PYX_TRANSPORT_LU_COMM_FAILURE;
3784 
3785 	if (cmd->data_length < 24) {
3786 		pr_warn("SPC-PR: Received PR OUT parameter list"
3787 			" length too small: %u\n", cmd->data_length);
3788 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3789 		goto out;
3790 	}
3791 	/*
3792 	 * From the PERSISTENT_RESERVE_OUT command descriptor block (CDB)
3793 	 */
3794 	sa = (cdb[1] & 0x1f);
3795 	scope = (cdb[2] & 0xf0);
3796 	type = (cdb[2] & 0x0f);
3797 
3798 	buf = transport_kmap_first_data_page(cmd);
3799 	/*
3800 	 * From PERSISTENT_RESERVE_OUT parameter list (payload)
3801 	 */
3802 	res_key = core_scsi3_extract_reservation_key(&buf[0]);
3803 	sa_res_key = core_scsi3_extract_reservation_key(&buf[8]);
3804 	/*
3805 	 * REGISTER_AND_MOVE uses a different SA parameter list containing
3806 	 * SCSI TransportIDs.
3807 	 */
3808 	if (sa != PRO_REGISTER_AND_MOVE) {
3809 		spec_i_pt = (buf[20] & 0x08);
3810 		all_tg_pt = (buf[20] & 0x04);
3811 		aptpl = (buf[20] & 0x01);
3812 	} else {
3813 		aptpl = (buf[17] & 0x01);
3814 		unreg = (buf[17] & 0x02);
3815 	}
3816 	transport_kunmap_first_data_page(cmd);
3817 	buf = NULL;
3818 
3819 	/*
3820 	 * SPEC_I_PT=1 is only valid for Service action: REGISTER
3821 	 */
3822 	if (spec_i_pt && ((cdb[1] & 0x1f) != PRO_REGISTER)) {
3823 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3824 		goto out;
3825 	}
3826 
3827 	/*
3828 	 * From spc4r17 section 6.14:
3829 	 *
3830 	 * If the SPEC_I_PT bit is set to zero, the service action is not
3831 	 * REGISTER AND MOVE, and the parameter list length is not 24, then
3832 	 * the command shall be terminated with CHECK CONDITION status, with
3833 	 * the sense key set to ILLEGAL REQUEST, and the additional sense
3834 	 * code set to PARAMETER LIST LENGTH ERROR.
3835 	 */
3836 	if (!spec_i_pt && ((cdb[1] & 0x1f) != PRO_REGISTER_AND_MOVE) &&
3837 	    (cmd->data_length != 24)) {
3838 		pr_warn("SPC-PR: Received PR OUT illegal parameter"
3839 			" list length: %u\n", cmd->data_length);
3840 		ret = PYX_TRANSPORT_INVALID_PARAMETER_LIST;
3841 		goto out;
3842 	}
3843 	/*
3844 	 * (core_scsi3_emulate_pro_* function parameters
3845 	 * are defined by spc4r17 Table 174:
3846 	 * PERSISTENT_RESERVE_OUT service actions and valid parameters.
3847 	 */
3848 	switch (sa) {
3849 	case PRO_REGISTER:
3850 		ret = core_scsi3_emulate_pro_register(cmd,
3851 			res_key, sa_res_key, aptpl, all_tg_pt, spec_i_pt, 0);
3852 		break;
3853 	case PRO_RESERVE:
3854 		ret = core_scsi3_emulate_pro_reserve(cmd, type, scope, res_key);
3855 		break;
3856 	case PRO_RELEASE:
3857 		ret = core_scsi3_emulate_pro_release(cmd, type, scope, res_key);
3858 		break;
3859 	case PRO_CLEAR:
3860 		ret = core_scsi3_emulate_pro_clear(cmd, res_key);
3861 		break;
3862 	case PRO_PREEMPT:
3863 		ret = core_scsi3_emulate_pro_preempt(cmd, type, scope,
3864 					res_key, sa_res_key, 0);
3865 		break;
3866 	case PRO_PREEMPT_AND_ABORT:
3867 		ret = core_scsi3_emulate_pro_preempt(cmd, type, scope,
3868 					res_key, sa_res_key, 1);
3869 		break;
3870 	case PRO_REGISTER_AND_IGNORE_EXISTING_KEY:
3871 		ret = core_scsi3_emulate_pro_register(cmd,
3872 			0, sa_res_key, aptpl, all_tg_pt, spec_i_pt, 1);
3873 		break;
3874 	case PRO_REGISTER_AND_MOVE:
3875 		ret = core_scsi3_emulate_pro_register_and_move(cmd, res_key,
3876 				sa_res_key, aptpl, unreg);
3877 		break;
3878 	default:
3879 		pr_err("Unknown PERSISTENT_RESERVE_OUT service"
3880 			" action: 0x%02x\n", cdb[1] & 0x1f);
3881 		ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
3882 		break;
3883 	}
3884 
3885 out:
3886 	if (!ret) {
3887 		task->task_scsi_status = GOOD;
3888 		transport_complete_task(task, 1);
3889 	}
3890 	return ret;
3891 }
3892 
3893 /*
3894  * PERSISTENT_RESERVE_IN Service Action READ_KEYS
3895  *
3896  * See spc4r17 section 5.7.6.2 and section 6.13.2, Table 160
3897  */
3898 static int core_scsi3_pri_read_keys(struct se_cmd *cmd)
3899 {
3900 	struct se_device *se_dev = cmd->se_dev;
3901 	struct se_subsystem_dev *su_dev = se_dev->se_sub_dev;
3902 	struct t10_pr_registration *pr_reg;
3903 	unsigned char *buf;
3904 	u32 add_len = 0, off = 8;
3905 
3906 	if (cmd->data_length < 8) {
3907 		pr_err("PRIN SA READ_KEYS SCSI Data Length: %u"
3908 			" too small\n", cmd->data_length);
3909 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
3910 	}
3911 
3912 	buf = transport_kmap_first_data_page(cmd);
3913 	buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
3914 	buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
3915 	buf[2] = ((su_dev->t10_pr.pr_generation >> 8) & 0xff);
3916 	buf[3] = (su_dev->t10_pr.pr_generation & 0xff);
3917 
3918 	spin_lock(&su_dev->t10_pr.registration_lock);
3919 	list_for_each_entry(pr_reg, &su_dev->t10_pr.registration_list,
3920 			pr_reg_list) {
3921 		/*
3922 		 * Check for overflow of 8byte PRI READ_KEYS payload and
3923 		 * next reservation key list descriptor.
3924 		 */
3925 		if ((add_len + 8) > (cmd->data_length - 8))
3926 			break;
3927 
3928 		buf[off++] = ((pr_reg->pr_res_key >> 56) & 0xff);
3929 		buf[off++] = ((pr_reg->pr_res_key >> 48) & 0xff);
3930 		buf[off++] = ((pr_reg->pr_res_key >> 40) & 0xff);
3931 		buf[off++] = ((pr_reg->pr_res_key >> 32) & 0xff);
3932 		buf[off++] = ((pr_reg->pr_res_key >> 24) & 0xff);
3933 		buf[off++] = ((pr_reg->pr_res_key >> 16) & 0xff);
3934 		buf[off++] = ((pr_reg->pr_res_key >> 8) & 0xff);
3935 		buf[off++] = (pr_reg->pr_res_key & 0xff);
3936 
3937 		add_len += 8;
3938 	}
3939 	spin_unlock(&su_dev->t10_pr.registration_lock);
3940 
3941 	buf[4] = ((add_len >> 24) & 0xff);
3942 	buf[5] = ((add_len >> 16) & 0xff);
3943 	buf[6] = ((add_len >> 8) & 0xff);
3944 	buf[7] = (add_len & 0xff);
3945 
3946 	transport_kunmap_first_data_page(cmd);
3947 
3948 	return 0;
3949 }
3950 
3951 /*
3952  * PERSISTENT_RESERVE_IN Service Action READ_RESERVATION
3953  *
3954  * See spc4r17 section 5.7.6.3 and section 6.13.3.2 Table 161 and 162
3955  */
3956 static int core_scsi3_pri_read_reservation(struct se_cmd *cmd)
3957 {
3958 	struct se_device *se_dev = cmd->se_dev;
3959 	struct se_subsystem_dev *su_dev = se_dev->se_sub_dev;
3960 	struct t10_pr_registration *pr_reg;
3961 	unsigned char *buf;
3962 	u64 pr_res_key;
3963 	u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */
3964 
3965 	if (cmd->data_length < 8) {
3966 		pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
3967 			" too small\n", cmd->data_length);
3968 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
3969 	}
3970 
3971 	buf = transport_kmap_first_data_page(cmd);
3972 	buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
3973 	buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
3974 	buf[2] = ((su_dev->t10_pr.pr_generation >> 8) & 0xff);
3975 	buf[3] = (su_dev->t10_pr.pr_generation & 0xff);
3976 
3977 	spin_lock(&se_dev->dev_reservation_lock);
3978 	pr_reg = se_dev->dev_pr_res_holder;
3979 	if ((pr_reg)) {
3980 		/*
3981 		 * Set the hardcoded Additional Length
3982 		 */
3983 		buf[4] = ((add_len >> 24) & 0xff);
3984 		buf[5] = ((add_len >> 16) & 0xff);
3985 		buf[6] = ((add_len >> 8) & 0xff);
3986 		buf[7] = (add_len & 0xff);
3987 
3988 		if (cmd->data_length < 22)
3989 			goto err;
3990 
3991 		/*
3992 		 * Set the Reservation key.
3993 		 *
3994 		 * From spc4r17, section 5.7.10:
3995 		 * A persistent reservation holder has its reservation key
3996 		 * returned in the parameter data from a PERSISTENT
3997 		 * RESERVE IN command with READ RESERVATION service action as
3998 		 * follows:
3999 		 * a) For a persistent reservation of the type Write Exclusive
4000 		 *    - All Registrants or Exclusive Access ­ All Regitrants,
4001 		 *      the reservation key shall be set to zero; or
4002 		 * b) For all other persistent reservation types, the
4003 		 *    reservation key shall be set to the registered
4004 		 *    reservation key for the I_T nexus that holds the
4005 		 *    persistent reservation.
4006 		 */
4007 		if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
4008 		    (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))
4009 			pr_res_key = 0;
4010 		else
4011 			pr_res_key = pr_reg->pr_res_key;
4012 
4013 		buf[8] = ((pr_res_key >> 56) & 0xff);
4014 		buf[9] = ((pr_res_key >> 48) & 0xff);
4015 		buf[10] = ((pr_res_key >> 40) & 0xff);
4016 		buf[11] = ((pr_res_key >> 32) & 0xff);
4017 		buf[12] = ((pr_res_key >> 24) & 0xff);
4018 		buf[13] = ((pr_res_key >> 16) & 0xff);
4019 		buf[14] = ((pr_res_key >> 8) & 0xff);
4020 		buf[15] = (pr_res_key & 0xff);
4021 		/*
4022 		 * Set the SCOPE and TYPE
4023 		 */
4024 		buf[21] = (pr_reg->pr_res_scope & 0xf0) |
4025 			  (pr_reg->pr_res_type & 0x0f);
4026 	}
4027 
4028 err:
4029 	spin_unlock(&se_dev->dev_reservation_lock);
4030 	transport_kunmap_first_data_page(cmd);
4031 
4032 	return 0;
4033 }
4034 
4035 /*
4036  * PERSISTENT_RESERVE_IN Service Action REPORT_CAPABILITIES
4037  *
4038  * See spc4r17 section 6.13.4 Table 165
4039  */
4040 static int core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
4041 {
4042 	struct se_device *dev = cmd->se_dev;
4043 	struct t10_reservation *pr_tmpl = &dev->se_sub_dev->t10_pr;
4044 	unsigned char *buf;
4045 	u16 add_len = 8; /* Hardcoded to 8. */
4046 
4047 	if (cmd->data_length < 6) {
4048 		pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
4049 			" %u too small\n", cmd->data_length);
4050 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
4051 	}
4052 
4053 	buf = transport_kmap_first_data_page(cmd);
4054 
4055 	buf[0] = ((add_len << 8) & 0xff);
4056 	buf[1] = (add_len & 0xff);
4057 	buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
4058 	buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
4059 	buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */
4060 	buf[2] |= 0x01; /* PTPL_C: Persistence across Target Power Loss bit */
4061 	/*
4062 	 * We are filling in the PERSISTENT RESERVATION TYPE MASK below, so
4063 	 * set the TMV: Task Mask Valid bit.
4064 	 */
4065 	buf[3] |= 0x80;
4066 	/*
4067 	 * Change ALLOW COMMANDs to 0x20 or 0x40 later from Table 166
4068 	 */
4069 	buf[3] |= 0x10; /* ALLOW COMMANDs field 001b */
4070 	/*
4071 	 * PTPL_A: Persistence across Target Power Loss Active bit
4072 	 */
4073 	if (pr_tmpl->pr_aptpl_active)
4074 		buf[3] |= 0x01;
4075 	/*
4076 	 * Setup the PERSISTENT RESERVATION TYPE MASK from Table 167
4077 	 */
4078 	buf[4] |= 0x80; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
4079 	buf[4] |= 0x40; /* PR_TYPE_EXCLUSIVE_ACCESS_REGONLY */
4080 	buf[4] |= 0x20; /* PR_TYPE_WRITE_EXCLUSIVE_REGONLY */
4081 	buf[4] |= 0x08; /* PR_TYPE_EXCLUSIVE_ACCESS */
4082 	buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
4083 	buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
4084 
4085 	transport_kunmap_first_data_page(cmd);
4086 
4087 	return 0;
4088 }
4089 
4090 /*
4091  * PERSISTENT_RESERVE_IN Service Action READ_FULL_STATUS
4092  *
4093  * See spc4r17 section 6.13.5 Table 168 and 169
4094  */
4095 static int core_scsi3_pri_read_full_status(struct se_cmd *cmd)
4096 {
4097 	struct se_device *se_dev = cmd->se_dev;
4098 	struct se_node_acl *se_nacl;
4099 	struct se_subsystem_dev *su_dev = se_dev->se_sub_dev;
4100 	struct se_portal_group *se_tpg;
4101 	struct t10_pr_registration *pr_reg, *pr_reg_tmp;
4102 	struct t10_reservation *pr_tmpl = &se_dev->se_sub_dev->t10_pr;
4103 	unsigned char *buf;
4104 	u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len;
4105 	u32 off = 8; /* off into first Full Status descriptor */
4106 	int format_code = 0;
4107 
4108 	if (cmd->data_length < 8) {
4109 		pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u"
4110 			" too small\n", cmd->data_length);
4111 		return PYX_TRANSPORT_INVALID_CDB_FIELD;
4112 	}
4113 
4114 	buf = transport_kmap_first_data_page(cmd);
4115 
4116 	buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
4117 	buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
4118 	buf[2] = ((su_dev->t10_pr.pr_generation >> 8) & 0xff);
4119 	buf[3] = (su_dev->t10_pr.pr_generation & 0xff);
4120 
4121 	spin_lock(&pr_tmpl->registration_lock);
4122 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
4123 			&pr_tmpl->registration_list, pr_reg_list) {
4124 
4125 		se_nacl = pr_reg->pr_reg_nacl;
4126 		se_tpg = pr_reg->pr_reg_nacl->se_tpg;
4127 		add_desc_len = 0;
4128 
4129 		atomic_inc(&pr_reg->pr_res_holders);
4130 		smp_mb__after_atomic_inc();
4131 		spin_unlock(&pr_tmpl->registration_lock);
4132 		/*
4133 		 * Determine expected length of $FABRIC_MOD specific
4134 		 * TransportID full status descriptor..
4135 		 */
4136 		exp_desc_len = se_tpg->se_tpg_tfo->tpg_get_pr_transport_id_len(
4137 				se_tpg, se_nacl, pr_reg, &format_code);
4138 
4139 		if ((exp_desc_len + add_len) > cmd->data_length) {
4140 			pr_warn("SPC-3 PRIN READ_FULL_STATUS ran"
4141 				" out of buffer: %d\n", cmd->data_length);
4142 			spin_lock(&pr_tmpl->registration_lock);
4143 			atomic_dec(&pr_reg->pr_res_holders);
4144 			smp_mb__after_atomic_dec();
4145 			break;
4146 		}
4147 		/*
4148 		 * Set RESERVATION KEY
4149 		 */
4150 		buf[off++] = ((pr_reg->pr_res_key >> 56) & 0xff);
4151 		buf[off++] = ((pr_reg->pr_res_key >> 48) & 0xff);
4152 		buf[off++] = ((pr_reg->pr_res_key >> 40) & 0xff);
4153 		buf[off++] = ((pr_reg->pr_res_key >> 32) & 0xff);
4154 		buf[off++] = ((pr_reg->pr_res_key >> 24) & 0xff);
4155 		buf[off++] = ((pr_reg->pr_res_key >> 16) & 0xff);
4156 		buf[off++] = ((pr_reg->pr_res_key >> 8) & 0xff);
4157 		buf[off++] = (pr_reg->pr_res_key & 0xff);
4158 		off += 4; /* Skip Over Reserved area */
4159 
4160 		/*
4161 		 * Set ALL_TG_PT bit if PROUT SA REGISTER had this set.
4162 		 */
4163 		if (pr_reg->pr_reg_all_tg_pt)
4164 			buf[off] = 0x02;
4165 		/*
4166 		 * The struct se_lun pointer will be present for the
4167 		 * reservation holder for PR_HOLDER bit.
4168 		 *
4169 		 * Also, if this registration is the reservation
4170 		 * holder, fill in SCOPE and TYPE in the next byte.
4171 		 */
4172 		if (pr_reg->pr_res_holder) {
4173 			buf[off++] |= 0x01;
4174 			buf[off++] = (pr_reg->pr_res_scope & 0xf0) |
4175 				     (pr_reg->pr_res_type & 0x0f);
4176 		} else
4177 			off += 2;
4178 
4179 		off += 4; /* Skip over reserved area */
4180 		/*
4181 		 * From spc4r17 6.3.15:
4182 		 *
4183 		 * If the ALL_TG_PT bit set to zero, the RELATIVE TARGET PORT
4184 		 * IDENTIFIER field contains the relative port identifier (see
4185 		 * 3.1.120) of the target port that is part of the I_T nexus
4186 		 * described by this full status descriptor. If the ALL_TG_PT
4187 		 * bit is set to one, the contents of the RELATIVE TARGET PORT
4188 		 * IDENTIFIER field are not defined by this standard.
4189 		 */
4190 		if (!pr_reg->pr_reg_all_tg_pt) {
4191 			struct se_port *port = pr_reg->pr_reg_tg_pt_lun->lun_sep;
4192 
4193 			buf[off++] = ((port->sep_rtpi >> 8) & 0xff);
4194 			buf[off++] = (port->sep_rtpi & 0xff);
4195 		} else
4196 			off += 2; /* Skip over RELATIVE TARGET PORT IDENTIFER */
4197 
4198 		/*
4199 		 * Now, have the $FABRIC_MOD fill in the protocol identifier
4200 		 */
4201 		desc_len = se_tpg->se_tpg_tfo->tpg_get_pr_transport_id(se_tpg,
4202 				se_nacl, pr_reg, &format_code, &buf[off+4]);
4203 
4204 		spin_lock(&pr_tmpl->registration_lock);
4205 		atomic_dec(&pr_reg->pr_res_holders);
4206 		smp_mb__after_atomic_dec();
4207 		/*
4208 		 * Set the ADDITIONAL DESCRIPTOR LENGTH
4209 		 */
4210 		buf[off++] = ((desc_len >> 24) & 0xff);
4211 		buf[off++] = ((desc_len >> 16) & 0xff);
4212 		buf[off++] = ((desc_len >> 8) & 0xff);
4213 		buf[off++] = (desc_len & 0xff);
4214 		/*
4215 		 * Size of full desctipor header minus TransportID
4216 		 * containing $FABRIC_MOD specific) initiator device/port
4217 		 * WWN information.
4218 		 *
4219 		 *  See spc4r17 Section 6.13.5 Table 169
4220 		 */
4221 		add_desc_len = (24 + desc_len);
4222 
4223 		off += desc_len;
4224 		add_len += add_desc_len;
4225 	}
4226 	spin_unlock(&pr_tmpl->registration_lock);
4227 	/*
4228 	 * Set ADDITIONAL_LENGTH
4229 	 */
4230 	buf[4] = ((add_len >> 24) & 0xff);
4231 	buf[5] = ((add_len >> 16) & 0xff);
4232 	buf[6] = ((add_len >> 8) & 0xff);
4233 	buf[7] = (add_len & 0xff);
4234 
4235 	transport_kunmap_first_data_page(cmd);
4236 
4237 	return 0;
4238 }
4239 
4240 int target_scsi3_emulate_pr_in(struct se_task *task)
4241 {
4242 	struct se_cmd *cmd = task->task_se_cmd;
4243 	int ret;
4244 
4245 	/*
4246 	 * Following spc2r20 5.5.1 Reservations overview:
4247 	 *
4248 	 * If a logical unit has been reserved by any RESERVE command and is
4249 	 * still reserved by any initiator, all PERSISTENT RESERVE IN and all
4250 	 * PERSISTENT RESERVE OUT commands shall conflict regardless of
4251 	 * initiator or service action and shall terminate with a RESERVATION
4252 	 * CONFLICT status.
4253 	 */
4254 	if (cmd->se_dev->dev_flags & DF_SPC2_RESERVATIONS) {
4255 		pr_err("Received PERSISTENT_RESERVE CDB while legacy"
4256 			" SPC-2 reservation is held, returning"
4257 			" RESERVATION_CONFLICT\n");
4258 		return PYX_TRANSPORT_RESERVATION_CONFLICT;
4259 	}
4260 
4261 	switch (cmd->t_task_cdb[1] & 0x1f) {
4262 	case PRI_READ_KEYS:
4263 		ret = core_scsi3_pri_read_keys(cmd);
4264 		break;
4265 	case PRI_READ_RESERVATION:
4266 		ret = core_scsi3_pri_read_reservation(cmd);
4267 		break;
4268 	case PRI_REPORT_CAPABILITIES:
4269 		ret = core_scsi3_pri_report_capabilities(cmd);
4270 		break;
4271 	case PRI_READ_FULL_STATUS:
4272 		ret = core_scsi3_pri_read_full_status(cmd);
4273 		break;
4274 	default:
4275 		pr_err("Unknown PERSISTENT_RESERVE_IN service"
4276 			" action: 0x%02x\n", cmd->t_task_cdb[1] & 0x1f);
4277 		ret = PYX_TRANSPORT_INVALID_CDB_FIELD;
4278 		break;
4279 	}
4280 
4281 	if (!ret) {
4282 		task->task_scsi_status = GOOD;
4283 		transport_complete_task(task, 1);
4284 	}
4285 	return ret;
4286 }
4287 
4288 static int core_pt_reservation_check(struct se_cmd *cmd, u32 *pr_res_type)
4289 {
4290 	return 0;
4291 }
4292 
4293 static int core_pt_seq_non_holder(
4294 	struct se_cmd *cmd,
4295 	unsigned char *cdb,
4296 	u32 pr_reg_type)
4297 {
4298 	return 0;
4299 }
4300 
4301 int core_setup_reservations(struct se_device *dev, int force_pt)
4302 {
4303 	struct se_subsystem_dev *su_dev = dev->se_sub_dev;
4304 	struct t10_reservation *rest = &su_dev->t10_pr;
4305 	/*
4306 	 * If this device is from Target_Core_Mod/pSCSI, use the reservations
4307 	 * of the Underlying SCSI hardware.  In Linux/SCSI terms, this can
4308 	 * cause a problem because libata and some SATA RAID HBAs appear
4309 	 * under Linux/SCSI, but to emulate reservations themselves.
4310 	 */
4311 	if (((dev->transport->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV) &&
4312 	    !(dev->se_sub_dev->se_dev_attrib.emulate_reservations)) || force_pt) {
4313 		rest->res_type = SPC_PASSTHROUGH;
4314 		rest->pr_ops.t10_reservation_check = &core_pt_reservation_check;
4315 		rest->pr_ops.t10_seq_non_holder = &core_pt_seq_non_holder;
4316 		pr_debug("%s: Using SPC_PASSTHROUGH, no reservation"
4317 			" emulation\n", dev->transport->name);
4318 		return 0;
4319 	}
4320 	/*
4321 	 * If SPC-3 or above is reported by real or emulated struct se_device,
4322 	 * use emulated Persistent Reservations.
4323 	 */
4324 	if (dev->transport->get_device_rev(dev) >= SCSI_3) {
4325 		rest->res_type = SPC3_PERSISTENT_RESERVATIONS;
4326 		rest->pr_ops.t10_reservation_check = &core_scsi3_pr_reservation_check;
4327 		rest->pr_ops.t10_seq_non_holder = &core_scsi3_pr_seq_non_holder;
4328 		pr_debug("%s: Using SPC3_PERSISTENT_RESERVATIONS"
4329 			" emulation\n", dev->transport->name);
4330 	} else {
4331 		rest->res_type = SPC2_RESERVATIONS;
4332 		rest->pr_ops.t10_reservation_check = &core_scsi2_reservation_check;
4333 		rest->pr_ops.t10_seq_non_holder =
4334 				&core_scsi2_reservation_seq_non_holder;
4335 		pr_debug("%s: Using SPC2_RESERVATIONS emulation\n",
4336 			dev->transport->name);
4337 	}
4338 
4339 	return 0;
4340 }
4341