1 /*
2  * SCSI Block Commands (SBC) parsing and emulation.
3  *
4  * (c) Copyright 2002-2013 Datera, Inc.
5  *
6  * Nicholas A. Bellinger <nab@kernel.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
21  */
22 
23 #include <linux/kernel.h>
24 #include <linux/module.h>
25 #include <linux/ratelimit.h>
26 #include <linux/crc-t10dif.h>
27 #include <asm/unaligned.h>
28 #include <scsi/scsi_proto.h>
29 #include <scsi/scsi_tcq.h>
30 
31 #include <target/target_core_base.h>
32 #include <target/target_core_backend.h>
33 #include <target/target_core_fabric.h>
34 
35 #include "target_core_internal.h"
36 #include "target_core_ua.h"
37 #include "target_core_alua.h"
38 
39 static sense_reason_t
40 sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char *, u32, bool);
41 static sense_reason_t sbc_execute_unmap(struct se_cmd *cmd);
42 
43 static sense_reason_t
44 sbc_emulate_readcapacity(struct se_cmd *cmd)
45 {
46 	struct se_device *dev = cmd->se_dev;
47 	unsigned char *cdb = cmd->t_task_cdb;
48 	unsigned long long blocks_long = dev->transport->get_blocks(dev);
49 	unsigned char *rbuf;
50 	unsigned char buf[8];
51 	u32 blocks;
52 
53 	/*
54 	 * SBC-2 says:
55 	 *   If the PMI bit is set to zero and the LOGICAL BLOCK
56 	 *   ADDRESS field is not set to zero, the device server shall
57 	 *   terminate the command with CHECK CONDITION status with
58 	 *   the sense key set to ILLEGAL REQUEST and the additional
59 	 *   sense code set to INVALID FIELD IN CDB.
60 	 *
61 	 * In SBC-3, these fields are obsolete, but some SCSI
62 	 * compliance tests actually check this, so we might as well
63 	 * follow SBC-2.
64 	 */
65 	if (!(cdb[8] & 1) && !!(cdb[2] | cdb[3] | cdb[4] | cdb[5]))
66 		return TCM_INVALID_CDB_FIELD;
67 
68 	if (blocks_long >= 0x00000000ffffffff)
69 		blocks = 0xffffffff;
70 	else
71 		blocks = (u32)blocks_long;
72 
73 	buf[0] = (blocks >> 24) & 0xff;
74 	buf[1] = (blocks >> 16) & 0xff;
75 	buf[2] = (blocks >> 8) & 0xff;
76 	buf[3] = blocks & 0xff;
77 	buf[4] = (dev->dev_attrib.block_size >> 24) & 0xff;
78 	buf[5] = (dev->dev_attrib.block_size >> 16) & 0xff;
79 	buf[6] = (dev->dev_attrib.block_size >> 8) & 0xff;
80 	buf[7] = dev->dev_attrib.block_size & 0xff;
81 
82 	rbuf = transport_kmap_data_sg(cmd);
83 	if (rbuf) {
84 		memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
85 		transport_kunmap_data_sg(cmd);
86 	}
87 
88 	target_complete_cmd_with_length(cmd, GOOD, 8);
89 	return 0;
90 }
91 
92 static sense_reason_t
93 sbc_emulate_readcapacity_16(struct se_cmd *cmd)
94 {
95 	struct se_device *dev = cmd->se_dev;
96 	struct se_session *sess = cmd->se_sess;
97 	int pi_prot_type = dev->dev_attrib.pi_prot_type;
98 
99 	unsigned char *rbuf;
100 	unsigned char buf[32];
101 	unsigned long long blocks = dev->transport->get_blocks(dev);
102 
103 	memset(buf, 0, sizeof(buf));
104 	buf[0] = (blocks >> 56) & 0xff;
105 	buf[1] = (blocks >> 48) & 0xff;
106 	buf[2] = (blocks >> 40) & 0xff;
107 	buf[3] = (blocks >> 32) & 0xff;
108 	buf[4] = (blocks >> 24) & 0xff;
109 	buf[5] = (blocks >> 16) & 0xff;
110 	buf[6] = (blocks >> 8) & 0xff;
111 	buf[7] = blocks & 0xff;
112 	buf[8] = (dev->dev_attrib.block_size >> 24) & 0xff;
113 	buf[9] = (dev->dev_attrib.block_size >> 16) & 0xff;
114 	buf[10] = (dev->dev_attrib.block_size >> 8) & 0xff;
115 	buf[11] = dev->dev_attrib.block_size & 0xff;
116 	/*
117 	 * Set P_TYPE and PROT_EN bits for DIF support
118 	 */
119 	if (sess->sup_prot_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS)) {
120 		/*
121 		 * Only override a device's pi_prot_type if no T10-PI is
122 		 * available, and sess_prot_type has been explicitly enabled.
123 		 */
124 		if (!pi_prot_type)
125 			pi_prot_type = sess->sess_prot_type;
126 
127 		if (pi_prot_type)
128 			buf[12] = (pi_prot_type - 1) << 1 | 0x1;
129 	}
130 
131 	if (dev->transport->get_lbppbe)
132 		buf[13] = dev->transport->get_lbppbe(dev) & 0x0f;
133 
134 	if (dev->transport->get_alignment_offset_lbas) {
135 		u16 lalba = dev->transport->get_alignment_offset_lbas(dev);
136 		buf[14] = (lalba >> 8) & 0x3f;
137 		buf[15] = lalba & 0xff;
138 	}
139 
140 	/*
141 	 * Set Thin Provisioning Enable bit following sbc3r22 in section
142 	 * READ CAPACITY (16) byte 14 if emulate_tpu or emulate_tpws is enabled.
143 	 */
144 	if (dev->dev_attrib.emulate_tpu || dev->dev_attrib.emulate_tpws)
145 		buf[14] |= 0x80;
146 
147 	rbuf = transport_kmap_data_sg(cmd);
148 	if (rbuf) {
149 		memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
150 		transport_kunmap_data_sg(cmd);
151 	}
152 
153 	target_complete_cmd_with_length(cmd, GOOD, 32);
154 	return 0;
155 }
156 
157 static sense_reason_t
158 sbc_emulate_startstop(struct se_cmd *cmd)
159 {
160 	unsigned char *cdb = cmd->t_task_cdb;
161 
162 	/*
163 	 * See sbc3r36 section 5.25
164 	 * Immediate bit should be set since there is nothing to complete
165 	 * POWER CONDITION MODIFIER 0h
166 	 */
167 	if (!(cdb[1] & 1) || cdb[2] || cdb[3])
168 		return TCM_INVALID_CDB_FIELD;
169 
170 	/*
171 	 * See sbc3r36 section 5.25
172 	 * POWER CONDITION 0h START_VALID - process START and LOEJ
173 	 */
174 	if (cdb[4] >> 4 & 0xf)
175 		return TCM_INVALID_CDB_FIELD;
176 
177 	/*
178 	 * See sbc3r36 section 5.25
179 	 * LOEJ 0h - nothing to load or unload
180 	 * START 1h - we are ready
181 	 */
182 	if (!(cdb[4] & 1) || (cdb[4] & 2) || (cdb[4] & 4))
183 		return TCM_INVALID_CDB_FIELD;
184 
185 	target_complete_cmd(cmd, SAM_STAT_GOOD);
186 	return 0;
187 }
188 
189 sector_t sbc_get_write_same_sectors(struct se_cmd *cmd)
190 {
191 	u32 num_blocks;
192 
193 	if (cmd->t_task_cdb[0] == WRITE_SAME)
194 		num_blocks = get_unaligned_be16(&cmd->t_task_cdb[7]);
195 	else if (cmd->t_task_cdb[0] == WRITE_SAME_16)
196 		num_blocks = get_unaligned_be32(&cmd->t_task_cdb[10]);
197 	else /* WRITE_SAME_32 via VARIABLE_LENGTH_CMD */
198 		num_blocks = get_unaligned_be32(&cmd->t_task_cdb[28]);
199 
200 	/*
201 	 * Use the explicit range when non zero is supplied, otherwise calculate
202 	 * the remaining range based on ->get_blocks() - starting LBA.
203 	 */
204 	if (num_blocks)
205 		return num_blocks;
206 
207 	return cmd->se_dev->transport->get_blocks(cmd->se_dev) -
208 		cmd->t_task_lba + 1;
209 }
210 EXPORT_SYMBOL(sbc_get_write_same_sectors);
211 
212 static sense_reason_t
213 sbc_execute_write_same_unmap(struct se_cmd *cmd)
214 {
215 	struct sbc_ops *ops = cmd->protocol_data;
216 	sector_t nolb = sbc_get_write_same_sectors(cmd);
217 	sense_reason_t ret;
218 
219 	if (nolb) {
220 		ret = ops->execute_unmap(cmd, cmd->t_task_lba, nolb);
221 		if (ret)
222 			return ret;
223 	}
224 
225 	target_complete_cmd(cmd, GOOD);
226 	return 0;
227 }
228 
229 static sense_reason_t
230 sbc_emulate_noop(struct se_cmd *cmd)
231 {
232 	target_complete_cmd(cmd, GOOD);
233 	return 0;
234 }
235 
236 static inline u32 sbc_get_size(struct se_cmd *cmd, u32 sectors)
237 {
238 	return cmd->se_dev->dev_attrib.block_size * sectors;
239 }
240 
241 static inline u32 transport_get_sectors_6(unsigned char *cdb)
242 {
243 	/*
244 	 * Use 8-bit sector value.  SBC-3 says:
245 	 *
246 	 *   A TRANSFER LENGTH field set to zero specifies that 256
247 	 *   logical blocks shall be written.  Any other value
248 	 *   specifies the number of logical blocks that shall be
249 	 *   written.
250 	 */
251 	return cdb[4] ? : 256;
252 }
253 
254 static inline u32 transport_get_sectors_10(unsigned char *cdb)
255 {
256 	return (u32)(cdb[7] << 8) + cdb[8];
257 }
258 
259 static inline u32 transport_get_sectors_12(unsigned char *cdb)
260 {
261 	return (u32)(cdb[6] << 24) + (cdb[7] << 16) + (cdb[8] << 8) + cdb[9];
262 }
263 
264 static inline u32 transport_get_sectors_16(unsigned char *cdb)
265 {
266 	return (u32)(cdb[10] << 24) + (cdb[11] << 16) +
267 		    (cdb[12] << 8) + cdb[13];
268 }
269 
270 /*
271  * Used for VARIABLE_LENGTH_CDB WRITE_32 and READ_32 variants
272  */
273 static inline u32 transport_get_sectors_32(unsigned char *cdb)
274 {
275 	return (u32)(cdb[28] << 24) + (cdb[29] << 16) +
276 		    (cdb[30] << 8) + cdb[31];
277 
278 }
279 
280 static inline u32 transport_lba_21(unsigned char *cdb)
281 {
282 	return ((cdb[1] & 0x1f) << 16) | (cdb[2] << 8) | cdb[3];
283 }
284 
285 static inline u32 transport_lba_32(unsigned char *cdb)
286 {
287 	return (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
288 }
289 
290 static inline unsigned long long transport_lba_64(unsigned char *cdb)
291 {
292 	unsigned int __v1, __v2;
293 
294 	__v1 = (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
295 	__v2 = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
296 
297 	return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
298 }
299 
300 /*
301  * For VARIABLE_LENGTH_CDB w/ 32 byte extended CDBs
302  */
303 static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
304 {
305 	unsigned int __v1, __v2;
306 
307 	__v1 = (cdb[12] << 24) | (cdb[13] << 16) | (cdb[14] << 8) | cdb[15];
308 	__v2 = (cdb[16] << 24) | (cdb[17] << 16) | (cdb[18] << 8) | cdb[19];
309 
310 	return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
311 }
312 
313 static sense_reason_t
314 sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)
315 {
316 	struct se_device *dev = cmd->se_dev;
317 	sector_t end_lba = dev->transport->get_blocks(dev) + 1;
318 	unsigned int sectors = sbc_get_write_same_sectors(cmd);
319 	sense_reason_t ret;
320 
321 	if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
322 		pr_err("WRITE_SAME PBDATA and LBDATA"
323 			" bits not supported for Block Discard"
324 			" Emulation\n");
325 		return TCM_UNSUPPORTED_SCSI_OPCODE;
326 	}
327 	if (sectors > cmd->se_dev->dev_attrib.max_write_same_len) {
328 		pr_warn("WRITE_SAME sectors: %u exceeds max_write_same_len: %u\n",
329 			sectors, cmd->se_dev->dev_attrib.max_write_same_len);
330 		return TCM_INVALID_CDB_FIELD;
331 	}
332 	/*
333 	 * Sanity check for LBA wrap and request past end of device.
334 	 */
335 	if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
336 	    ((cmd->t_task_lba + sectors) > end_lba)) {
337 		pr_err("WRITE_SAME exceeds last lba %llu (lba %llu, sectors %u)\n",
338 		       (unsigned long long)end_lba, cmd->t_task_lba, sectors);
339 		return TCM_ADDRESS_OUT_OF_RANGE;
340 	}
341 
342 	/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
343 	if (flags[0] & 0x10) {
344 		pr_warn("WRITE SAME with ANCHOR not supported\n");
345 		return TCM_INVALID_CDB_FIELD;
346 	}
347 	/*
348 	 * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
349 	 * translated into block discard requests within backend code.
350 	 */
351 	if (flags[0] & 0x08) {
352 		if (!ops->execute_unmap)
353 			return TCM_UNSUPPORTED_SCSI_OPCODE;
354 
355 		if (!dev->dev_attrib.emulate_tpws) {
356 			pr_err("Got WRITE_SAME w/ UNMAP=1, but backend device"
357 			       " has emulate_tpws disabled\n");
358 			return TCM_UNSUPPORTED_SCSI_OPCODE;
359 		}
360 		cmd->execute_cmd = sbc_execute_write_same_unmap;
361 		return 0;
362 	}
363 	if (!ops->execute_write_same)
364 		return TCM_UNSUPPORTED_SCSI_OPCODE;
365 
366 	ret = sbc_check_prot(dev, cmd, &cmd->t_task_cdb[0], sectors, true);
367 	if (ret)
368 		return ret;
369 
370 	cmd->execute_cmd = ops->execute_write_same;
371 	return 0;
372 }
373 
374 static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
375 					   int *post_ret)
376 {
377 	unsigned char *buf, *addr;
378 	struct scatterlist *sg;
379 	unsigned int offset;
380 	sense_reason_t ret = TCM_NO_SENSE;
381 	int i, count;
382 	/*
383 	 * From sbc3r22.pdf section 5.48 XDWRITEREAD (10) command
384 	 *
385 	 * 1) read the specified logical block(s);
386 	 * 2) transfer logical blocks from the data-out buffer;
387 	 * 3) XOR the logical blocks transferred from the data-out buffer with
388 	 *    the logical blocks read, storing the resulting XOR data in a buffer;
389 	 * 4) if the DISABLE WRITE bit is set to zero, then write the logical
390 	 *    blocks transferred from the data-out buffer; and
391 	 * 5) transfer the resulting XOR data to the data-in buffer.
392 	 */
393 	buf = kmalloc(cmd->data_length, GFP_KERNEL);
394 	if (!buf) {
395 		pr_err("Unable to allocate xor_callback buf\n");
396 		return TCM_OUT_OF_RESOURCES;
397 	}
398 	/*
399 	 * Copy the scatterlist WRITE buffer located at cmd->t_data_sg
400 	 * into the locally allocated *buf
401 	 */
402 	sg_copy_to_buffer(cmd->t_data_sg,
403 			  cmd->t_data_nents,
404 			  buf,
405 			  cmd->data_length);
406 
407 	/*
408 	 * Now perform the XOR against the BIDI read memory located at
409 	 * cmd->t_mem_bidi_list
410 	 */
411 
412 	offset = 0;
413 	for_each_sg(cmd->t_bidi_data_sg, sg, cmd->t_bidi_data_nents, count) {
414 		addr = kmap_atomic(sg_page(sg));
415 		if (!addr) {
416 			ret = TCM_OUT_OF_RESOURCES;
417 			goto out;
418 		}
419 
420 		for (i = 0; i < sg->length; i++)
421 			*(addr + sg->offset + i) ^= *(buf + offset + i);
422 
423 		offset += sg->length;
424 		kunmap_atomic(addr);
425 	}
426 
427 out:
428 	kfree(buf);
429 	return ret;
430 }
431 
432 static sense_reason_t
433 sbc_execute_rw(struct se_cmd *cmd)
434 {
435 	struct sbc_ops *ops = cmd->protocol_data;
436 
437 	return ops->execute_rw(cmd, cmd->t_data_sg, cmd->t_data_nents,
438 			       cmd->data_direction);
439 }
440 
441 static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
442 					     int *post_ret)
443 {
444 	struct se_device *dev = cmd->se_dev;
445 
446 	/*
447 	 * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
448 	 * within target_complete_ok_work() if the command was successfully
449 	 * sent to the backend driver.
450 	 */
451 	spin_lock_irq(&cmd->t_state_lock);
452 	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
453 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
454 		*post_ret = 1;
455 	}
456 	spin_unlock_irq(&cmd->t_state_lock);
457 
458 	/*
459 	 * Unlock ->caw_sem originally obtained during sbc_compare_and_write()
460 	 * before the original READ I/O submission.
461 	 */
462 	up(&dev->caw_sem);
463 
464 	return TCM_NO_SENSE;
465 }
466 
467 static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
468 						 int *post_ret)
469 {
470 	struct se_device *dev = cmd->se_dev;
471 	struct scatterlist *write_sg = NULL, *sg;
472 	unsigned char *buf = NULL, *addr;
473 	struct sg_mapping_iter m;
474 	unsigned int offset = 0, len;
475 	unsigned int nlbas = cmd->t_task_nolb;
476 	unsigned int block_size = dev->dev_attrib.block_size;
477 	unsigned int compare_len = (nlbas * block_size);
478 	sense_reason_t ret = TCM_NO_SENSE;
479 	int rc, i;
480 
481 	/*
482 	 * Handle early failure in transport_generic_request_failure(),
483 	 * which will not have taken ->caw_sem yet..
484 	 */
485 	if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg))
486 		return TCM_NO_SENSE;
487 	/*
488 	 * Handle special case for zero-length COMPARE_AND_WRITE
489 	 */
490 	if (!cmd->data_length)
491 		goto out;
492 	/*
493 	 * Immediately exit + release dev->caw_sem if command has already
494 	 * been failed with a non-zero SCSI status.
495 	 */
496 	if (cmd->scsi_status) {
497 		pr_err("compare_and_write_callback: non zero scsi_status:"
498 			" 0x%02x\n", cmd->scsi_status);
499 		goto out;
500 	}
501 
502 	buf = kzalloc(cmd->data_length, GFP_KERNEL);
503 	if (!buf) {
504 		pr_err("Unable to allocate compare_and_write buf\n");
505 		ret = TCM_OUT_OF_RESOURCES;
506 		goto out;
507 	}
508 
509 	write_sg = kmalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
510 			   GFP_KERNEL);
511 	if (!write_sg) {
512 		pr_err("Unable to allocate compare_and_write sg\n");
513 		ret = TCM_OUT_OF_RESOURCES;
514 		goto out;
515 	}
516 	sg_init_table(write_sg, cmd->t_data_nents);
517 	/*
518 	 * Setup verify and write data payloads from total NumberLBAs.
519 	 */
520 	rc = sg_copy_to_buffer(cmd->t_data_sg, cmd->t_data_nents, buf,
521 			       cmd->data_length);
522 	if (!rc) {
523 		pr_err("sg_copy_to_buffer() failed for compare_and_write\n");
524 		ret = TCM_OUT_OF_RESOURCES;
525 		goto out;
526 	}
527 	/*
528 	 * Compare against SCSI READ payload against verify payload
529 	 */
530 	for_each_sg(cmd->t_bidi_data_sg, sg, cmd->t_bidi_data_nents, i) {
531 		addr = (unsigned char *)kmap_atomic(sg_page(sg));
532 		if (!addr) {
533 			ret = TCM_OUT_OF_RESOURCES;
534 			goto out;
535 		}
536 
537 		len = min(sg->length, compare_len);
538 
539 		if (memcmp(addr, buf + offset, len)) {
540 			pr_warn("Detected MISCOMPARE for addr: %p buf: %p\n",
541 				addr, buf + offset);
542 			kunmap_atomic(addr);
543 			goto miscompare;
544 		}
545 		kunmap_atomic(addr);
546 
547 		offset += len;
548 		compare_len -= len;
549 		if (!compare_len)
550 			break;
551 	}
552 
553 	i = 0;
554 	len = cmd->t_task_nolb * block_size;
555 	sg_miter_start(&m, cmd->t_data_sg, cmd->t_data_nents, SG_MITER_TO_SG);
556 	/*
557 	 * Currently assumes NoLB=1 and SGLs are PAGE_SIZE..
558 	 */
559 	while (len) {
560 		sg_miter_next(&m);
561 
562 		if (block_size < PAGE_SIZE) {
563 			sg_set_page(&write_sg[i], m.page, block_size,
564 				    m.piter.sg->offset + block_size);
565 		} else {
566 			sg_miter_next(&m);
567 			sg_set_page(&write_sg[i], m.page, block_size,
568 				    m.piter.sg->offset);
569 		}
570 		len -= block_size;
571 		i++;
572 	}
573 	sg_miter_stop(&m);
574 	/*
575 	 * Save the original SGL + nents values before updating to new
576 	 * assignments, to be released in transport_free_pages() ->
577 	 * transport_reset_sgl_orig()
578 	 */
579 	cmd->t_data_sg_orig = cmd->t_data_sg;
580 	cmd->t_data_sg = write_sg;
581 	cmd->t_data_nents_orig = cmd->t_data_nents;
582 	cmd->t_data_nents = 1;
583 
584 	cmd->sam_task_attr = TCM_HEAD_TAG;
585 	cmd->transport_complete_callback = compare_and_write_post;
586 	/*
587 	 * Now reset ->execute_cmd() to the normal sbc_execute_rw() handler
588 	 * for submitting the adjusted SGL to write instance user-data.
589 	 */
590 	cmd->execute_cmd = sbc_execute_rw;
591 
592 	spin_lock_irq(&cmd->t_state_lock);
593 	cmd->t_state = TRANSPORT_PROCESSING;
594 	cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT;
595 	spin_unlock_irq(&cmd->t_state_lock);
596 
597 	__target_execute_cmd(cmd);
598 
599 	kfree(buf);
600 	return ret;
601 
602 miscompare:
603 	pr_warn("Target/%s: Send MISCOMPARE check condition and sense\n",
604 		dev->transport->name);
605 	ret = TCM_MISCOMPARE_VERIFY;
606 out:
607 	/*
608 	 * In the MISCOMPARE or failure case, unlock ->caw_sem obtained in
609 	 * sbc_compare_and_write() before the original READ I/O submission.
610 	 */
611 	up(&dev->caw_sem);
612 	kfree(write_sg);
613 	kfree(buf);
614 	return ret;
615 }
616 
617 static sense_reason_t
618 sbc_compare_and_write(struct se_cmd *cmd)
619 {
620 	struct sbc_ops *ops = cmd->protocol_data;
621 	struct se_device *dev = cmd->se_dev;
622 	sense_reason_t ret;
623 	int rc;
624 	/*
625 	 * Submit the READ first for COMPARE_AND_WRITE to perform the
626 	 * comparision using SGLs at cmd->t_bidi_data_sg..
627 	 */
628 	rc = down_interruptible(&dev->caw_sem);
629 	if (rc != 0) {
630 		cmd->transport_complete_callback = NULL;
631 		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
632 	}
633 	/*
634 	 * Reset cmd->data_length to individual block_size in order to not
635 	 * confuse backend drivers that depend on this value matching the
636 	 * size of the I/O being submitted.
637 	 */
638 	cmd->data_length = cmd->t_task_nolb * dev->dev_attrib.block_size;
639 
640 	ret = ops->execute_rw(cmd, cmd->t_bidi_data_sg, cmd->t_bidi_data_nents,
641 			      DMA_FROM_DEVICE);
642 	if (ret) {
643 		cmd->transport_complete_callback = NULL;
644 		up(&dev->caw_sem);
645 		return ret;
646 	}
647 	/*
648 	 * Unlock of dev->caw_sem to occur in compare_and_write_callback()
649 	 * upon MISCOMPARE, or in compare_and_write_done() upon completion
650 	 * of WRITE instance user-data.
651 	 */
652 	return TCM_NO_SENSE;
653 }
654 
655 static int
656 sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_type,
657 		       bool is_write, struct se_cmd *cmd)
658 {
659 	if (is_write) {
660 		cmd->prot_op = fabric_prot ? TARGET_PROT_DOUT_STRIP :
661 			       protect ? TARGET_PROT_DOUT_PASS :
662 			       TARGET_PROT_DOUT_INSERT;
663 		switch (protect) {
664 		case 0x0:
665 		case 0x3:
666 			cmd->prot_checks = 0;
667 			break;
668 		case 0x1:
669 		case 0x5:
670 			cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
671 			if (prot_type == TARGET_DIF_TYPE1_PROT)
672 				cmd->prot_checks |= TARGET_DIF_CHECK_REFTAG;
673 			break;
674 		case 0x2:
675 			if (prot_type == TARGET_DIF_TYPE1_PROT)
676 				cmd->prot_checks = TARGET_DIF_CHECK_REFTAG;
677 			break;
678 		case 0x4:
679 			cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
680 			break;
681 		default:
682 			pr_err("Unsupported protect field %d\n", protect);
683 			return -EINVAL;
684 		}
685 	} else {
686 		cmd->prot_op = fabric_prot ? TARGET_PROT_DIN_INSERT :
687 			       protect ? TARGET_PROT_DIN_PASS :
688 			       TARGET_PROT_DIN_STRIP;
689 		switch (protect) {
690 		case 0x0:
691 		case 0x1:
692 		case 0x5:
693 			cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
694 			if (prot_type == TARGET_DIF_TYPE1_PROT)
695 				cmd->prot_checks |= TARGET_DIF_CHECK_REFTAG;
696 			break;
697 		case 0x2:
698 			if (prot_type == TARGET_DIF_TYPE1_PROT)
699 				cmd->prot_checks = TARGET_DIF_CHECK_REFTAG;
700 			break;
701 		case 0x3:
702 			cmd->prot_checks = 0;
703 			break;
704 		case 0x4:
705 			cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
706 			break;
707 		default:
708 			pr_err("Unsupported protect field %d\n", protect);
709 			return -EINVAL;
710 		}
711 	}
712 
713 	return 0;
714 }
715 
716 static sense_reason_t
717 sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,
718 	       u32 sectors, bool is_write)
719 {
720 	u8 protect = cdb[1] >> 5;
721 	int sp_ops = cmd->se_sess->sup_prot_ops;
722 	int pi_prot_type = dev->dev_attrib.pi_prot_type;
723 	bool fabric_prot = false;
724 
725 	if (!cmd->t_prot_sg || !cmd->t_prot_nents) {
726 		if (unlikely(protect &&
727 		    !dev->dev_attrib.pi_prot_type && !cmd->se_sess->sess_prot_type)) {
728 			pr_err("CDB contains protect bit, but device + fabric does"
729 			       " not advertise PROTECT=1 feature bit\n");
730 			return TCM_INVALID_CDB_FIELD;
731 		}
732 		if (cmd->prot_pto)
733 			return TCM_NO_SENSE;
734 	}
735 
736 	switch (dev->dev_attrib.pi_prot_type) {
737 	case TARGET_DIF_TYPE3_PROT:
738 		cmd->reftag_seed = 0xffffffff;
739 		break;
740 	case TARGET_DIF_TYPE2_PROT:
741 		if (protect)
742 			return TCM_INVALID_CDB_FIELD;
743 
744 		cmd->reftag_seed = cmd->t_task_lba;
745 		break;
746 	case TARGET_DIF_TYPE1_PROT:
747 		cmd->reftag_seed = cmd->t_task_lba;
748 		break;
749 	case TARGET_DIF_TYPE0_PROT:
750 		/*
751 		 * See if the fabric supports T10-PI, and the session has been
752 		 * configured to allow export PROTECT=1 feature bit with backend
753 		 * devices that don't support T10-PI.
754 		 */
755 		fabric_prot = is_write ?
756 			      !!(sp_ops & (TARGET_PROT_DOUT_PASS | TARGET_PROT_DOUT_STRIP)) :
757 			      !!(sp_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DIN_INSERT));
758 
759 		if (fabric_prot && cmd->se_sess->sess_prot_type) {
760 			pi_prot_type = cmd->se_sess->sess_prot_type;
761 			break;
762 		}
763 		if (!protect)
764 			return TCM_NO_SENSE;
765 		/* Fallthrough */
766 	default:
767 		pr_err("Unable to determine pi_prot_type for CDB: 0x%02x "
768 		       "PROTECT: 0x%02x\n", cdb[0], protect);
769 		return TCM_INVALID_CDB_FIELD;
770 	}
771 
772 	if (sbc_set_prot_op_checks(protect, fabric_prot, pi_prot_type, is_write, cmd))
773 		return TCM_INVALID_CDB_FIELD;
774 
775 	cmd->prot_type = pi_prot_type;
776 	cmd->prot_length = dev->prot_length * sectors;
777 
778 	/**
779 	 * In case protection information exists over the wire
780 	 * we modify command data length to describe pure data.
781 	 * The actual transfer length is data length + protection
782 	 * length
783 	 **/
784 	if (protect)
785 		cmd->data_length = sectors * dev->dev_attrib.block_size;
786 
787 	pr_debug("%s: prot_type=%d, data_length=%d, prot_length=%d "
788 		 "prot_op=%d prot_checks=%d\n",
789 		 __func__, cmd->prot_type, cmd->data_length, cmd->prot_length,
790 		 cmd->prot_op, cmd->prot_checks);
791 
792 	return TCM_NO_SENSE;
793 }
794 
795 static int
796 sbc_check_dpofua(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb)
797 {
798 	if (cdb[1] & 0x10) {
799 		/* see explanation in spc_emulate_modesense */
800 		if (!target_check_fua(dev)) {
801 			pr_err("Got CDB: 0x%02x with DPO bit set, but device"
802 			       " does not advertise support for DPO\n", cdb[0]);
803 			return -EINVAL;
804 		}
805 	}
806 	if (cdb[1] & 0x8) {
807 		if (!target_check_fua(dev)) {
808 			pr_err("Got CDB: 0x%02x with FUA bit set, but device"
809 			       " does not advertise support for FUA write\n",
810 			       cdb[0]);
811 			return -EINVAL;
812 		}
813 		cmd->se_cmd_flags |= SCF_FUA;
814 	}
815 	return 0;
816 }
817 
818 sense_reason_t
819 sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
820 {
821 	struct se_device *dev = cmd->se_dev;
822 	unsigned char *cdb = cmd->t_task_cdb;
823 	unsigned int size;
824 	u32 sectors = 0;
825 	sense_reason_t ret;
826 
827 	cmd->protocol_data = ops;
828 
829 	switch (cdb[0]) {
830 	case READ_6:
831 		sectors = transport_get_sectors_6(cdb);
832 		cmd->t_task_lba = transport_lba_21(cdb);
833 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
834 		cmd->execute_cmd = sbc_execute_rw;
835 		break;
836 	case READ_10:
837 		sectors = transport_get_sectors_10(cdb);
838 		cmd->t_task_lba = transport_lba_32(cdb);
839 
840 		if (sbc_check_dpofua(dev, cmd, cdb))
841 			return TCM_INVALID_CDB_FIELD;
842 
843 		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
844 		if (ret)
845 			return ret;
846 
847 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
848 		cmd->execute_cmd = sbc_execute_rw;
849 		break;
850 	case READ_12:
851 		sectors = transport_get_sectors_12(cdb);
852 		cmd->t_task_lba = transport_lba_32(cdb);
853 
854 		if (sbc_check_dpofua(dev, cmd, cdb))
855 			return TCM_INVALID_CDB_FIELD;
856 
857 		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
858 		if (ret)
859 			return ret;
860 
861 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
862 		cmd->execute_cmd = sbc_execute_rw;
863 		break;
864 	case READ_16:
865 		sectors = transport_get_sectors_16(cdb);
866 		cmd->t_task_lba = transport_lba_64(cdb);
867 
868 		if (sbc_check_dpofua(dev, cmd, cdb))
869 			return TCM_INVALID_CDB_FIELD;
870 
871 		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
872 		if (ret)
873 			return ret;
874 
875 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
876 		cmd->execute_cmd = sbc_execute_rw;
877 		break;
878 	case WRITE_6:
879 		sectors = transport_get_sectors_6(cdb);
880 		cmd->t_task_lba = transport_lba_21(cdb);
881 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
882 		cmd->execute_cmd = sbc_execute_rw;
883 		break;
884 	case WRITE_10:
885 	case WRITE_VERIFY:
886 		sectors = transport_get_sectors_10(cdb);
887 		cmd->t_task_lba = transport_lba_32(cdb);
888 
889 		if (sbc_check_dpofua(dev, cmd, cdb))
890 			return TCM_INVALID_CDB_FIELD;
891 
892 		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
893 		if (ret)
894 			return ret;
895 
896 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
897 		cmd->execute_cmd = sbc_execute_rw;
898 		break;
899 	case WRITE_12:
900 		sectors = transport_get_sectors_12(cdb);
901 		cmd->t_task_lba = transport_lba_32(cdb);
902 
903 		if (sbc_check_dpofua(dev, cmd, cdb))
904 			return TCM_INVALID_CDB_FIELD;
905 
906 		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
907 		if (ret)
908 			return ret;
909 
910 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
911 		cmd->execute_cmd = sbc_execute_rw;
912 		break;
913 	case WRITE_16:
914 		sectors = transport_get_sectors_16(cdb);
915 		cmd->t_task_lba = transport_lba_64(cdb);
916 
917 		if (sbc_check_dpofua(dev, cmd, cdb))
918 			return TCM_INVALID_CDB_FIELD;
919 
920 		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
921 		if (ret)
922 			return ret;
923 
924 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
925 		cmd->execute_cmd = sbc_execute_rw;
926 		break;
927 	case XDWRITEREAD_10:
928 		if (cmd->data_direction != DMA_TO_DEVICE ||
929 		    !(cmd->se_cmd_flags & SCF_BIDI))
930 			return TCM_INVALID_CDB_FIELD;
931 		sectors = transport_get_sectors_10(cdb);
932 
933 		if (sbc_check_dpofua(dev, cmd, cdb))
934 			return TCM_INVALID_CDB_FIELD;
935 
936 		cmd->t_task_lba = transport_lba_32(cdb);
937 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
938 
939 		/*
940 		 * Setup BIDI XOR callback to be run after I/O completion.
941 		 */
942 		cmd->execute_cmd = sbc_execute_rw;
943 		cmd->transport_complete_callback = &xdreadwrite_callback;
944 		break;
945 	case VARIABLE_LENGTH_CMD:
946 	{
947 		u16 service_action = get_unaligned_be16(&cdb[8]);
948 		switch (service_action) {
949 		case XDWRITEREAD_32:
950 			sectors = transport_get_sectors_32(cdb);
951 
952 			if (sbc_check_dpofua(dev, cmd, cdb))
953 				return TCM_INVALID_CDB_FIELD;
954 			/*
955 			 * Use WRITE_32 and READ_32 opcodes for the emulated
956 			 * XDWRITE_READ_32 logic.
957 			 */
958 			cmd->t_task_lba = transport_lba_64_ext(cdb);
959 			cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
960 
961 			/*
962 			 * Setup BIDI XOR callback to be run during after I/O
963 			 * completion.
964 			 */
965 			cmd->execute_cmd = sbc_execute_rw;
966 			cmd->transport_complete_callback = &xdreadwrite_callback;
967 			break;
968 		case WRITE_SAME_32:
969 			sectors = transport_get_sectors_32(cdb);
970 			if (!sectors) {
971 				pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not"
972 				       " supported\n");
973 				return TCM_INVALID_CDB_FIELD;
974 			}
975 
976 			size = sbc_get_size(cmd, 1);
977 			cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
978 
979 			ret = sbc_setup_write_same(cmd, &cdb[10], ops);
980 			if (ret)
981 				return ret;
982 			break;
983 		default:
984 			pr_err("VARIABLE_LENGTH_CMD service action"
985 				" 0x%04x not supported\n", service_action);
986 			return TCM_UNSUPPORTED_SCSI_OPCODE;
987 		}
988 		break;
989 	}
990 	case COMPARE_AND_WRITE:
991 		sectors = cdb[13];
992 		/*
993 		 * Currently enforce COMPARE_AND_WRITE for a single sector
994 		 */
995 		if (sectors > 1) {
996 			pr_err("COMPARE_AND_WRITE contains NoLB: %u greater"
997 			       " than 1\n", sectors);
998 			return TCM_INVALID_CDB_FIELD;
999 		}
1000 		if (sbc_check_dpofua(dev, cmd, cdb))
1001 			return TCM_INVALID_CDB_FIELD;
1002 
1003 		/*
1004 		 * Double size because we have two buffers, note that
1005 		 * zero is not an error..
1006 		 */
1007 		size = 2 * sbc_get_size(cmd, sectors);
1008 		cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
1009 		cmd->t_task_nolb = sectors;
1010 		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB | SCF_COMPARE_AND_WRITE;
1011 		cmd->execute_cmd = sbc_compare_and_write;
1012 		cmd->transport_complete_callback = compare_and_write_callback;
1013 		break;
1014 	case READ_CAPACITY:
1015 		size = READ_CAP_LEN;
1016 		cmd->execute_cmd = sbc_emulate_readcapacity;
1017 		break;
1018 	case SERVICE_ACTION_IN_16:
1019 		switch (cmd->t_task_cdb[1] & 0x1f) {
1020 		case SAI_READ_CAPACITY_16:
1021 			cmd->execute_cmd = sbc_emulate_readcapacity_16;
1022 			break;
1023 		case SAI_REPORT_REFERRALS:
1024 			cmd->execute_cmd = target_emulate_report_referrals;
1025 			break;
1026 		default:
1027 			pr_err("Unsupported SA: 0x%02x\n",
1028 				cmd->t_task_cdb[1] & 0x1f);
1029 			return TCM_INVALID_CDB_FIELD;
1030 		}
1031 		size = (cdb[10] << 24) | (cdb[11] << 16) |
1032 		       (cdb[12] << 8) | cdb[13];
1033 		break;
1034 	case SYNCHRONIZE_CACHE:
1035 	case SYNCHRONIZE_CACHE_16:
1036 		if (cdb[0] == SYNCHRONIZE_CACHE) {
1037 			sectors = transport_get_sectors_10(cdb);
1038 			cmd->t_task_lba = transport_lba_32(cdb);
1039 		} else {
1040 			sectors = transport_get_sectors_16(cdb);
1041 			cmd->t_task_lba = transport_lba_64(cdb);
1042 		}
1043 		if (ops->execute_sync_cache) {
1044 			cmd->execute_cmd = ops->execute_sync_cache;
1045 			goto check_lba;
1046 		}
1047 		size = 0;
1048 		cmd->execute_cmd = sbc_emulate_noop;
1049 		break;
1050 	case UNMAP:
1051 		if (!ops->execute_unmap)
1052 			return TCM_UNSUPPORTED_SCSI_OPCODE;
1053 
1054 		if (!dev->dev_attrib.emulate_tpu) {
1055 			pr_err("Got UNMAP, but backend device has"
1056 			       " emulate_tpu disabled\n");
1057 			return TCM_UNSUPPORTED_SCSI_OPCODE;
1058 		}
1059 		size = get_unaligned_be16(&cdb[7]);
1060 		cmd->execute_cmd = sbc_execute_unmap;
1061 		break;
1062 	case WRITE_SAME_16:
1063 		sectors = transport_get_sectors_16(cdb);
1064 		if (!sectors) {
1065 			pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
1066 			return TCM_INVALID_CDB_FIELD;
1067 		}
1068 
1069 		size = sbc_get_size(cmd, 1);
1070 		cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
1071 
1072 		ret = sbc_setup_write_same(cmd, &cdb[1], ops);
1073 		if (ret)
1074 			return ret;
1075 		break;
1076 	case WRITE_SAME:
1077 		sectors = transport_get_sectors_10(cdb);
1078 		if (!sectors) {
1079 			pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
1080 			return TCM_INVALID_CDB_FIELD;
1081 		}
1082 
1083 		size = sbc_get_size(cmd, 1);
1084 		cmd->t_task_lba = get_unaligned_be32(&cdb[2]);
1085 
1086 		/*
1087 		 * Follow sbcr26 with WRITE_SAME (10) and check for the existence
1088 		 * of byte 1 bit 3 UNMAP instead of original reserved field
1089 		 */
1090 		ret = sbc_setup_write_same(cmd, &cdb[1], ops);
1091 		if (ret)
1092 			return ret;
1093 		break;
1094 	case VERIFY:
1095 		size = 0;
1096 		sectors = transport_get_sectors_10(cdb);
1097 		cmd->t_task_lba = transport_lba_32(cdb);
1098 		cmd->execute_cmd = sbc_emulate_noop;
1099 		goto check_lba;
1100 	case REZERO_UNIT:
1101 	case SEEK_6:
1102 	case SEEK_10:
1103 		/*
1104 		 * There are still clients out there which use these old SCSI-2
1105 		 * commands. This mainly happens when running VMs with legacy
1106 		 * guest systems, connected via SCSI command pass-through to
1107 		 * iSCSI targets. Make them happy and return status GOOD.
1108 		 */
1109 		size = 0;
1110 		cmd->execute_cmd = sbc_emulate_noop;
1111 		break;
1112 	case START_STOP:
1113 		size = 0;
1114 		cmd->execute_cmd = sbc_emulate_startstop;
1115 		break;
1116 	default:
1117 		ret = spc_parse_cdb(cmd, &size);
1118 		if (ret)
1119 			return ret;
1120 	}
1121 
1122 	/* reject any command that we don't have a handler for */
1123 	if (!cmd->execute_cmd)
1124 		return TCM_UNSUPPORTED_SCSI_OPCODE;
1125 
1126 	if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
1127 		unsigned long long end_lba;
1128 check_lba:
1129 		end_lba = dev->transport->get_blocks(dev) + 1;
1130 		if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
1131 		    ((cmd->t_task_lba + sectors) > end_lba)) {
1132 			pr_err("cmd exceeds last lba %llu "
1133 				"(lba %llu, sectors %u)\n",
1134 				end_lba, cmd->t_task_lba, sectors);
1135 			return TCM_ADDRESS_OUT_OF_RANGE;
1136 		}
1137 
1138 		if (!(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE))
1139 			size = sbc_get_size(cmd, sectors);
1140 	}
1141 
1142 	return target_cmd_size_check(cmd, size);
1143 }
1144 EXPORT_SYMBOL(sbc_parse_cdb);
1145 
1146 u32 sbc_get_device_type(struct se_device *dev)
1147 {
1148 	return TYPE_DISK;
1149 }
1150 EXPORT_SYMBOL(sbc_get_device_type);
1151 
1152 static sense_reason_t
1153 sbc_execute_unmap(struct se_cmd *cmd)
1154 {
1155 	struct sbc_ops *ops = cmd->protocol_data;
1156 	struct se_device *dev = cmd->se_dev;
1157 	unsigned char *buf, *ptr = NULL;
1158 	sector_t lba;
1159 	int size;
1160 	u32 range;
1161 	sense_reason_t ret = 0;
1162 	int dl, bd_dl;
1163 
1164 	/* We never set ANC_SUP */
1165 	if (cmd->t_task_cdb[1])
1166 		return TCM_INVALID_CDB_FIELD;
1167 
1168 	if (cmd->data_length == 0) {
1169 		target_complete_cmd(cmd, SAM_STAT_GOOD);
1170 		return 0;
1171 	}
1172 
1173 	if (cmd->data_length < 8) {
1174 		pr_warn("UNMAP parameter list length %u too small\n",
1175 			cmd->data_length);
1176 		return TCM_PARAMETER_LIST_LENGTH_ERROR;
1177 	}
1178 
1179 	buf = transport_kmap_data_sg(cmd);
1180 	if (!buf)
1181 		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
1182 
1183 	dl = get_unaligned_be16(&buf[0]);
1184 	bd_dl = get_unaligned_be16(&buf[2]);
1185 
1186 	size = cmd->data_length - 8;
1187 	if (bd_dl > size)
1188 		pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
1189 			cmd->data_length, bd_dl);
1190 	else
1191 		size = bd_dl;
1192 
1193 	if (size / 16 > dev->dev_attrib.max_unmap_block_desc_count) {
1194 		ret = TCM_INVALID_PARAMETER_LIST;
1195 		goto err;
1196 	}
1197 
1198 	/* First UNMAP block descriptor starts at 8 byte offset */
1199 	ptr = &buf[8];
1200 	pr_debug("UNMAP: Sub: %s Using dl: %u bd_dl: %u size: %u"
1201 		" ptr: %p\n", dev->transport->name, dl, bd_dl, size, ptr);
1202 
1203 	while (size >= 16) {
1204 		lba = get_unaligned_be64(&ptr[0]);
1205 		range = get_unaligned_be32(&ptr[8]);
1206 		pr_debug("UNMAP: Using lba: %llu and range: %u\n",
1207 				 (unsigned long long)lba, range);
1208 
1209 		if (range > dev->dev_attrib.max_unmap_lba_count) {
1210 			ret = TCM_INVALID_PARAMETER_LIST;
1211 			goto err;
1212 		}
1213 
1214 		if (lba + range > dev->transport->get_blocks(dev) + 1) {
1215 			ret = TCM_ADDRESS_OUT_OF_RANGE;
1216 			goto err;
1217 		}
1218 
1219 		ret = ops->execute_unmap(cmd, lba, range);
1220 		if (ret)
1221 			goto err;
1222 
1223 		ptr += 16;
1224 		size -= 16;
1225 	}
1226 
1227 err:
1228 	transport_kunmap_data_sg(cmd);
1229 	if (!ret)
1230 		target_complete_cmd(cmd, GOOD);
1231 	return ret;
1232 }
1233 
1234 void
1235 sbc_dif_generate(struct se_cmd *cmd)
1236 {
1237 	struct se_device *dev = cmd->se_dev;
1238 	struct t10_pi_tuple *sdt;
1239 	struct scatterlist *dsg = cmd->t_data_sg, *psg;
1240 	sector_t sector = cmd->t_task_lba;
1241 	void *daddr, *paddr;
1242 	int i, j, offset = 0;
1243 	unsigned int block_size = dev->dev_attrib.block_size;
1244 
1245 	for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
1246 		paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1247 		daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1248 
1249 		for (j = 0; j < psg->length;
1250 				j += sizeof(*sdt)) {
1251 			__u16 crc;
1252 			unsigned int avail;
1253 
1254 			if (offset >= dsg->length) {
1255 				offset -= dsg->length;
1256 				kunmap_atomic(daddr - dsg->offset);
1257 				dsg = sg_next(dsg);
1258 				if (!dsg) {
1259 					kunmap_atomic(paddr - psg->offset);
1260 					return;
1261 				}
1262 				daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1263 			}
1264 
1265 			sdt = paddr + j;
1266 			avail = min(block_size, dsg->length - offset);
1267 			crc = crc_t10dif(daddr + offset, avail);
1268 			if (avail < block_size) {
1269 				kunmap_atomic(daddr - dsg->offset);
1270 				dsg = sg_next(dsg);
1271 				if (!dsg) {
1272 					kunmap_atomic(paddr - psg->offset);
1273 					return;
1274 				}
1275 				daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1276 				offset = block_size - avail;
1277 				crc = crc_t10dif_update(crc, daddr, offset);
1278 			} else {
1279 				offset += block_size;
1280 			}
1281 
1282 			sdt->guard_tag = cpu_to_be16(crc);
1283 			if (cmd->prot_type == TARGET_DIF_TYPE1_PROT)
1284 				sdt->ref_tag = cpu_to_be32(sector & 0xffffffff);
1285 			sdt->app_tag = 0;
1286 
1287 			pr_debug("DIF %s INSERT sector: %llu guard_tag: 0x%04x"
1288 				 " app_tag: 0x%04x ref_tag: %u\n",
1289 				 (cmd->data_direction == DMA_TO_DEVICE) ?
1290 				 "WRITE" : "READ", (unsigned long long)sector,
1291 				 sdt->guard_tag, sdt->app_tag,
1292 				 be32_to_cpu(sdt->ref_tag));
1293 
1294 			sector++;
1295 		}
1296 
1297 		kunmap_atomic(daddr - dsg->offset);
1298 		kunmap_atomic(paddr - psg->offset);
1299 	}
1300 }
1301 
1302 static sense_reason_t
1303 sbc_dif_v1_verify(struct se_cmd *cmd, struct t10_pi_tuple *sdt,
1304 		  __u16 crc, sector_t sector, unsigned int ei_lba)
1305 {
1306 	__be16 csum;
1307 
1308 	if (!(cmd->prot_checks & TARGET_DIF_CHECK_GUARD))
1309 		goto check_ref;
1310 
1311 	csum = cpu_to_be16(crc);
1312 
1313 	if (sdt->guard_tag != csum) {
1314 		pr_err("DIFv1 checksum failed on sector %llu guard tag 0x%04x"
1315 			" csum 0x%04x\n", (unsigned long long)sector,
1316 			be16_to_cpu(sdt->guard_tag), be16_to_cpu(csum));
1317 		return TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
1318 	}
1319 
1320 check_ref:
1321 	if (!(cmd->prot_checks & TARGET_DIF_CHECK_REFTAG))
1322 		return 0;
1323 
1324 	if (cmd->prot_type == TARGET_DIF_TYPE1_PROT &&
1325 	    be32_to_cpu(sdt->ref_tag) != (sector & 0xffffffff)) {
1326 		pr_err("DIFv1 Type 1 reference failed on sector: %llu tag: 0x%08x"
1327 		       " sector MSB: 0x%08x\n", (unsigned long long)sector,
1328 		       be32_to_cpu(sdt->ref_tag), (u32)(sector & 0xffffffff));
1329 		return TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
1330 	}
1331 
1332 	if (cmd->prot_type == TARGET_DIF_TYPE2_PROT &&
1333 	    be32_to_cpu(sdt->ref_tag) != ei_lba) {
1334 		pr_err("DIFv1 Type 2 reference failed on sector: %llu tag: 0x%08x"
1335 		       " ei_lba: 0x%08x\n", (unsigned long long)sector,
1336 			be32_to_cpu(sdt->ref_tag), ei_lba);
1337 		return TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
1338 	}
1339 
1340 	return 0;
1341 }
1342 
1343 void sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
1344 		       struct scatterlist *sg, int sg_off)
1345 {
1346 	struct se_device *dev = cmd->se_dev;
1347 	struct scatterlist *psg;
1348 	void *paddr, *addr;
1349 	unsigned int i, len, left;
1350 	unsigned int offset = sg_off;
1351 
1352 	if (!sg)
1353 		return;
1354 
1355 	left = sectors * dev->prot_length;
1356 
1357 	for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
1358 		unsigned int psg_len, copied = 0;
1359 
1360 		paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1361 		psg_len = min(left, psg->length);
1362 		while (psg_len) {
1363 			len = min(psg_len, sg->length - offset);
1364 			addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
1365 
1366 			if (read)
1367 				memcpy(paddr + copied, addr, len);
1368 			else
1369 				memcpy(addr, paddr + copied, len);
1370 
1371 			left -= len;
1372 			offset += len;
1373 			copied += len;
1374 			psg_len -= len;
1375 
1376 			kunmap_atomic(addr - sg->offset - offset);
1377 
1378 			if (offset >= sg->length) {
1379 				sg = sg_next(sg);
1380 				offset = 0;
1381 			}
1382 		}
1383 		kunmap_atomic(paddr - psg->offset);
1384 	}
1385 }
1386 EXPORT_SYMBOL(sbc_dif_copy_prot);
1387 
1388 sense_reason_t
1389 sbc_dif_verify(struct se_cmd *cmd, sector_t start, unsigned int sectors,
1390 	       unsigned int ei_lba, struct scatterlist *psg, int psg_off)
1391 {
1392 	struct se_device *dev = cmd->se_dev;
1393 	struct t10_pi_tuple *sdt;
1394 	struct scatterlist *dsg = cmd->t_data_sg;
1395 	sector_t sector = start;
1396 	void *daddr, *paddr;
1397 	int i;
1398 	sense_reason_t rc;
1399 	int dsg_off = 0;
1400 	unsigned int block_size = dev->dev_attrib.block_size;
1401 
1402 	for (; psg && sector < start + sectors; psg = sg_next(psg)) {
1403 		paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1404 		daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1405 
1406 		for (i = psg_off; i < psg->length &&
1407 				sector < start + sectors;
1408 				i += sizeof(*sdt)) {
1409 			__u16 crc;
1410 			unsigned int avail;
1411 
1412 			if (dsg_off >= dsg->length) {
1413 				dsg_off -= dsg->length;
1414 				kunmap_atomic(daddr - dsg->offset);
1415 				dsg = sg_next(dsg);
1416 				if (!dsg) {
1417 					kunmap_atomic(paddr - psg->offset);
1418 					return 0;
1419 				}
1420 				daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1421 			}
1422 
1423 			sdt = paddr + i;
1424 
1425 			pr_debug("DIF READ sector: %llu guard_tag: 0x%04x"
1426 				 " app_tag: 0x%04x ref_tag: %u\n",
1427 				 (unsigned long long)sector, sdt->guard_tag,
1428 				 sdt->app_tag, be32_to_cpu(sdt->ref_tag));
1429 
1430 			if (sdt->app_tag == cpu_to_be16(0xffff)) {
1431 				dsg_off += block_size;
1432 				goto next;
1433 			}
1434 
1435 			avail = min(block_size, dsg->length - dsg_off);
1436 			crc = crc_t10dif(daddr + dsg_off, avail);
1437 			if (avail < block_size) {
1438 				kunmap_atomic(daddr - dsg->offset);
1439 				dsg = sg_next(dsg);
1440 				if (!dsg) {
1441 					kunmap_atomic(paddr - psg->offset);
1442 					return 0;
1443 				}
1444 				daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1445 				dsg_off = block_size - avail;
1446 				crc = crc_t10dif_update(crc, daddr, dsg_off);
1447 			} else {
1448 				dsg_off += block_size;
1449 			}
1450 
1451 			rc = sbc_dif_v1_verify(cmd, sdt, crc, sector, ei_lba);
1452 			if (rc) {
1453 				kunmap_atomic(daddr - dsg->offset);
1454 				kunmap_atomic(paddr - psg->offset);
1455 				cmd->bad_sector = sector;
1456 				return rc;
1457 			}
1458 next:
1459 			sector++;
1460 			ei_lba++;
1461 		}
1462 
1463 		psg_off = 0;
1464 		kunmap_atomic(daddr - dsg->offset);
1465 		kunmap_atomic(paddr - psg->offset);
1466 	}
1467 
1468 	return 0;
1469 }
1470 EXPORT_SYMBOL(sbc_dif_verify);
1471