1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*******************************************************************************
3  * Filename: target_core_xcopy.c
4  *
5  * This file contains support for SPC-4 Extended-Copy offload with generic
6  * TCM backends.
7  *
8  * Copyright (c) 2011-2013 Datera, Inc. All rights reserved.
9  *
10  * Author:
11  * Nicholas A. Bellinger <nab@daterainc.com>
12  *
13  ******************************************************************************/
14 
15 #include <linux/slab.h>
16 #include <linux/spinlock.h>
17 #include <linux/list.h>
18 #include <linux/configfs.h>
19 #include <linux/ratelimit.h>
20 #include <scsi/scsi_proto.h>
21 #include <asm/unaligned.h>
22 
23 #include <target/target_core_base.h>
24 #include <target/target_core_backend.h>
25 #include <target/target_core_fabric.h>
26 
27 #include "target_core_internal.h"
28 #include "target_core_pr.h"
29 #include "target_core_ua.h"
30 #include "target_core_xcopy.h"
31 
32 static struct workqueue_struct *xcopy_wq = NULL;
33 
34 static sense_reason_t target_parse_xcopy_cmd(struct xcopy_op *xop);
35 
36 static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
37 {
38 	int off = 0;
39 
40 	buf[off++] = (0x6 << 4);
41 	buf[off++] = 0x01;
42 	buf[off++] = 0x40;
43 	buf[off] = (0x5 << 4);
44 
45 	spc_parse_naa_6h_vendor_specific(dev, &buf[off]);
46 	return 0;
47 }
48 
49 /**
50  * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
51  *
52  * @se_dev: device being considered for match
53  * @dev_wwn: XCOPY requested NAA dev_wwn
54  * @return: 1 on match, 0 on no-match
55  */
56 static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
57 					      const unsigned char *dev_wwn)
58 {
59 	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
60 	int rc;
61 
62 	if (!se_dev->dev_attrib.emulate_3pc) {
63 		pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
64 		return 0;
65 	}
66 
67 	memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
68 	target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
69 
70 	rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
71 	if (rc != 0) {
72 		pr_debug("XCOPY: skip non-matching: %*ph\n",
73 			 XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn);
74 		return 0;
75 	}
76 	pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
77 
78 	return 1;
79 }
80 
81 static int target_xcopy_locate_se_dev_e4(struct se_session *sess,
82 					const unsigned char *dev_wwn,
83 					struct se_device **_found_dev,
84 					struct percpu_ref **_found_lun_ref)
85 {
86 	struct se_dev_entry *deve;
87 	struct se_node_acl *nacl;
88 	struct se_lun *this_lun = NULL;
89 	struct se_device *found_dev = NULL;
90 
91 	/* cmd with NULL sess indicates no associated $FABRIC_MOD */
92 	if (!sess)
93 		goto err_out;
94 
95 	pr_debug("XCOPY 0xe4: searching for: %*ph\n",
96 		 XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn);
97 
98 	nacl = sess->se_node_acl;
99 	rcu_read_lock();
100 	hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) {
101 		struct se_device *this_dev;
102 		int rc;
103 
104 		this_lun = rcu_dereference(deve->se_lun);
105 		this_dev = rcu_dereference_raw(this_lun->lun_se_dev);
106 
107 		rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn);
108 		if (rc) {
109 			if (percpu_ref_tryget_live(&this_lun->lun_ref))
110 				found_dev = this_dev;
111 			break;
112 		}
113 	}
114 	rcu_read_unlock();
115 	if (found_dev == NULL)
116 		goto err_out;
117 
118 	pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n",
119 		 found_dev, &found_dev->dev_group);
120 	*_found_dev = found_dev;
121 	*_found_lun_ref = &this_lun->lun_ref;
122 	return 0;
123 err_out:
124 	pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
125 	return -EINVAL;
126 }
127 
128 static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
129 				unsigned char *p, unsigned short cscd_index)
130 {
131 	unsigned char *desc = p;
132 	unsigned short ript;
133 	u8 desig_len;
134 	/*
135 	 * Extract RELATIVE INITIATOR PORT IDENTIFIER
136 	 */
137 	ript = get_unaligned_be16(&desc[2]);
138 	pr_debug("XCOPY 0xe4: RELATIVE INITIATOR PORT IDENTIFIER: %hu\n", ript);
139 	/*
140 	 * Check for supported code set, association, and designator type
141 	 */
142 	if ((desc[4] & 0x0f) != 0x1) {
143 		pr_err("XCOPY 0xe4: code set of non binary type not supported\n");
144 		return -EINVAL;
145 	}
146 	if ((desc[5] & 0x30) != 0x00) {
147 		pr_err("XCOPY 0xe4: association other than LUN not supported\n");
148 		return -EINVAL;
149 	}
150 	if ((desc[5] & 0x0f) != 0x3) {
151 		pr_err("XCOPY 0xe4: designator type unsupported: 0x%02x\n",
152 				(desc[5] & 0x0f));
153 		return -EINVAL;
154 	}
155 	/*
156 	 * Check for matching 16 byte length for NAA IEEE Registered Extended
157 	 * Assigned designator
158 	 */
159 	desig_len = desc[7];
160 	if (desig_len != XCOPY_NAA_IEEE_REGEX_LEN) {
161 		pr_err("XCOPY 0xe4: invalid desig_len: %d\n", (int)desig_len);
162 		return -EINVAL;
163 	}
164 	pr_debug("XCOPY 0xe4: desig_len: %d\n", (int)desig_len);
165 	/*
166 	 * Check for NAA IEEE Registered Extended Assigned header..
167 	 */
168 	if ((desc[8] & 0xf0) != 0x60) {
169 		pr_err("XCOPY 0xe4: Unsupported DESIGNATOR TYPE: 0x%02x\n",
170 					(desc[8] & 0xf0));
171 		return -EINVAL;
172 	}
173 
174 	if (cscd_index != xop->stdi && cscd_index != xop->dtdi) {
175 		pr_debug("XCOPY 0xe4: ignoring CSCD entry %d - neither src nor "
176 			 "dest\n", cscd_index);
177 		return 0;
178 	}
179 
180 	if (cscd_index == xop->stdi) {
181 		memcpy(&xop->src_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
182 		/*
183 		 * Determine if the source designator matches the local device
184 		 */
185 		if (!memcmp(&xop->local_dev_wwn[0], &xop->src_tid_wwn[0],
186 				XCOPY_NAA_IEEE_REGEX_LEN)) {
187 			xop->op_origin = XCOL_SOURCE_RECV_OP;
188 			xop->src_dev = se_cmd->se_dev;
189 			pr_debug("XCOPY 0xe4: Set xop->src_dev %p from source"
190 					" received xop\n", xop->src_dev);
191 		}
192 	}
193 
194 	if (cscd_index == xop->dtdi) {
195 		memcpy(&xop->dst_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
196 		/*
197 		 * Determine if the destination designator matches the local
198 		 * device. If @cscd_index corresponds to both source (stdi) and
199 		 * destination (dtdi), or dtdi comes after stdi, then
200 		 * XCOL_DEST_RECV_OP wins.
201 		 */
202 		if (!memcmp(&xop->local_dev_wwn[0], &xop->dst_tid_wwn[0],
203 				XCOPY_NAA_IEEE_REGEX_LEN)) {
204 			xop->op_origin = XCOL_DEST_RECV_OP;
205 			xop->dst_dev = se_cmd->se_dev;
206 			pr_debug("XCOPY 0xe4: Set xop->dst_dev: %p from destination"
207 				" received xop\n", xop->dst_dev);
208 		}
209 	}
210 
211 	return 0;
212 }
213 
214 static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
215 				struct xcopy_op *xop, unsigned char *p,
216 				unsigned short tdll, sense_reason_t *sense_ret)
217 {
218 	struct se_device *local_dev = se_cmd->se_dev;
219 	unsigned char *desc = p;
220 	int offset = tdll % XCOPY_TARGET_DESC_LEN, rc;
221 	unsigned short cscd_index = 0;
222 	unsigned short start = 0;
223 
224 	*sense_ret = TCM_INVALID_PARAMETER_LIST;
225 
226 	if (offset != 0) {
227 		pr_err("XCOPY target descriptor list length is not"
228 			" multiple of %d\n", XCOPY_TARGET_DESC_LEN);
229 		*sense_ret = TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE;
230 		return -EINVAL;
231 	}
232 	if (tdll > RCR_OP_MAX_TARGET_DESC_COUNT * XCOPY_TARGET_DESC_LEN) {
233 		pr_err("XCOPY target descriptor supports a maximum"
234 			" two src/dest descriptors, tdll: %hu too large..\n", tdll);
235 		/* spc4r37 6.4.3.4 CSCD DESCRIPTOR LIST LENGTH field */
236 		*sense_ret = TCM_TOO_MANY_TARGET_DESCS;
237 		return -EINVAL;
238 	}
239 	/*
240 	 * Generate an IEEE Registered Extended designator based upon the
241 	 * se_device the XCOPY was received upon..
242 	 */
243 	memset(&xop->local_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
244 	target_xcopy_gen_naa_ieee(local_dev, &xop->local_dev_wwn[0]);
245 
246 	while (start < tdll) {
247 		/*
248 		 * Check target descriptor identification with 0xE4 type, and
249 		 * compare the current index with the CSCD descriptor IDs in
250 		 * the segment descriptor. Use VPD 0x83 WWPN matching ..
251 		 */
252 		switch (desc[0]) {
253 		case 0xe4:
254 			rc = target_xcopy_parse_tiddesc_e4(se_cmd, xop,
255 							&desc[0], cscd_index);
256 			if (rc != 0)
257 				goto out;
258 			start += XCOPY_TARGET_DESC_LEN;
259 			desc += XCOPY_TARGET_DESC_LEN;
260 			cscd_index++;
261 			break;
262 		default:
263 			pr_err("XCOPY unsupported descriptor type code:"
264 					" 0x%02x\n", desc[0]);
265 			*sense_ret = TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE;
266 			goto out;
267 		}
268 	}
269 
270 	switch (xop->op_origin) {
271 	case XCOL_SOURCE_RECV_OP:
272 		rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
273 						xop->dst_tid_wwn,
274 						&xop->dst_dev,
275 						&xop->remote_lun_ref);
276 		break;
277 	case XCOL_DEST_RECV_OP:
278 		rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
279 						xop->src_tid_wwn,
280 						&xop->src_dev,
281 						&xop->remote_lun_ref);
282 		break;
283 	default:
284 		pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - "
285 			"stdi: %hu dtdi: %hu\n", xop->stdi, xop->dtdi);
286 		rc = -EINVAL;
287 		break;
288 	}
289 	/*
290 	 * If a matching IEEE NAA 0x83 descriptor for the requested device
291 	 * is not located on this node, return COPY_ABORTED with ASQ/ASQC
292 	 * 0x0d/0x02 - COPY_TARGET_DEVICE_NOT_REACHABLE to request the
293 	 * initiator to fall back to normal copy method.
294 	 */
295 	if (rc < 0) {
296 		*sense_ret = TCM_COPY_TARGET_DEVICE_NOT_REACHABLE;
297 		goto out;
298 	}
299 
300 	pr_debug("XCOPY TGT desc: Source dev: %p NAA IEEE WWN: 0x%16phN\n",
301 		 xop->src_dev, &xop->src_tid_wwn[0]);
302 	pr_debug("XCOPY TGT desc: Dest dev: %p NAA IEEE WWN: 0x%16phN\n",
303 		 xop->dst_dev, &xop->dst_tid_wwn[0]);
304 
305 	return cscd_index;
306 
307 out:
308 	return -EINVAL;
309 }
310 
311 static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op *xop,
312 					unsigned char *p)
313 {
314 	unsigned char *desc = p;
315 	int dc = (desc[1] & 0x02);
316 	unsigned short desc_len;
317 
318 	desc_len = get_unaligned_be16(&desc[2]);
319 	if (desc_len != 0x18) {
320 		pr_err("XCOPY segment desc 0x02: Illegal desc_len:"
321 				" %hu\n", desc_len);
322 		return -EINVAL;
323 	}
324 
325 	xop->stdi = get_unaligned_be16(&desc[4]);
326 	xop->dtdi = get_unaligned_be16(&desc[6]);
327 
328 	if (xop->stdi > XCOPY_CSCD_DESC_ID_LIST_OFF_MAX ||
329 	    xop->dtdi > XCOPY_CSCD_DESC_ID_LIST_OFF_MAX) {
330 		pr_err("XCOPY segment desc 0x02: unsupported CSCD ID > 0x%x; stdi: %hu dtdi: %hu\n",
331 			XCOPY_CSCD_DESC_ID_LIST_OFF_MAX, xop->stdi, xop->dtdi);
332 		return -EINVAL;
333 	}
334 
335 	pr_debug("XCOPY seg desc 0x02: desc_len: %hu stdi: %hu dtdi: %hu, DC: %d\n",
336 		desc_len, xop->stdi, xop->dtdi, dc);
337 
338 	xop->nolb = get_unaligned_be16(&desc[10]);
339 	xop->src_lba = get_unaligned_be64(&desc[12]);
340 	xop->dst_lba = get_unaligned_be64(&desc[20]);
341 	pr_debug("XCOPY seg desc 0x02: nolb: %hu src_lba: %llu dst_lba: %llu\n",
342 		xop->nolb, (unsigned long long)xop->src_lba,
343 		(unsigned long long)xop->dst_lba);
344 
345 	return 0;
346 }
347 
348 static int target_xcopy_parse_segment_descriptors(struct se_cmd *se_cmd,
349 				struct xcopy_op *xop, unsigned char *p,
350 				unsigned int sdll, sense_reason_t *sense_ret)
351 {
352 	unsigned char *desc = p;
353 	unsigned int start = 0;
354 	int offset = sdll % XCOPY_SEGMENT_DESC_LEN, rc, ret = 0;
355 
356 	*sense_ret = TCM_INVALID_PARAMETER_LIST;
357 
358 	if (offset != 0) {
359 		pr_err("XCOPY segment descriptor list length is not"
360 			" multiple of %d\n", XCOPY_SEGMENT_DESC_LEN);
361 		*sense_ret = TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE;
362 		return -EINVAL;
363 	}
364 	if (sdll > RCR_OP_MAX_SG_DESC_COUNT * XCOPY_SEGMENT_DESC_LEN) {
365 		pr_err("XCOPY supports %u segment descriptor(s), sdll: %u too"
366 			" large..\n", RCR_OP_MAX_SG_DESC_COUNT, sdll);
367 		/* spc4r37 6.4.3.5 SEGMENT DESCRIPTOR LIST LENGTH field */
368 		*sense_ret = TCM_TOO_MANY_SEGMENT_DESCS;
369 		return -EINVAL;
370 	}
371 
372 	while (start < sdll) {
373 		/*
374 		 * Check segment descriptor type code for block -> block
375 		 */
376 		switch (desc[0]) {
377 		case 0x02:
378 			rc = target_xcopy_parse_segdesc_02(se_cmd, xop, desc);
379 			if (rc < 0)
380 				goto out;
381 
382 			ret++;
383 			start += XCOPY_SEGMENT_DESC_LEN;
384 			desc += XCOPY_SEGMENT_DESC_LEN;
385 			break;
386 		default:
387 			pr_err("XCOPY unsupported segment descriptor"
388 				"type: 0x%02x\n", desc[0]);
389 			*sense_ret = TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE;
390 			goto out;
391 		}
392 	}
393 
394 	return ret;
395 
396 out:
397 	return -EINVAL;
398 }
399 
400 /*
401  * Start xcopy_pt ops
402  */
403 
404 struct xcopy_pt_cmd {
405 	struct se_cmd se_cmd;
406 	struct completion xpt_passthrough_sem;
407 	unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
408 };
409 
410 struct se_portal_group xcopy_pt_tpg;
411 static struct se_session xcopy_pt_sess;
412 static struct se_node_acl xcopy_pt_nacl;
413 
414 static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd)
415 {
416         return 0;
417 }
418 
419 static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop)
420 {
421 	if (xop->op_origin == XCOL_SOURCE_RECV_OP)
422 		pr_debug("putting dst lun_ref for %p\n", xop->dst_dev);
423 	else
424 		pr_debug("putting src lun_ref for %p\n", xop->src_dev);
425 
426 	percpu_ref_put(xop->remote_lun_ref);
427 }
428 
429 static void xcopy_pt_release_cmd(struct se_cmd *se_cmd)
430 {
431 	struct xcopy_pt_cmd *xpt_cmd = container_of(se_cmd,
432 				struct xcopy_pt_cmd, se_cmd);
433 
434 	/* xpt_cmd is on the stack, nothing to free here */
435 	pr_debug("xpt_cmd done: %p\n", xpt_cmd);
436 }
437 
438 static int xcopy_pt_check_stop_free(struct se_cmd *se_cmd)
439 {
440 	struct xcopy_pt_cmd *xpt_cmd = container_of(se_cmd,
441 				struct xcopy_pt_cmd, se_cmd);
442 
443 	complete(&xpt_cmd->xpt_passthrough_sem);
444 	return 0;
445 }
446 
447 static int xcopy_pt_write_pending(struct se_cmd *se_cmd)
448 {
449 	return 0;
450 }
451 
452 static int xcopy_pt_queue_data_in(struct se_cmd *se_cmd)
453 {
454 	return 0;
455 }
456 
457 static int xcopy_pt_queue_status(struct se_cmd *se_cmd)
458 {
459 	return 0;
460 }
461 
462 static const struct target_core_fabric_ops xcopy_pt_tfo = {
463 	.fabric_name		= "xcopy-pt",
464 	.get_cmd_state		= xcopy_pt_get_cmd_state,
465 	.release_cmd		= xcopy_pt_release_cmd,
466 	.check_stop_free	= xcopy_pt_check_stop_free,
467 	.write_pending		= xcopy_pt_write_pending,
468 	.queue_data_in		= xcopy_pt_queue_data_in,
469 	.queue_status		= xcopy_pt_queue_status,
470 };
471 
472 /*
473  * End xcopy_pt_ops
474  */
475 
476 int target_xcopy_setup_pt(void)
477 {
478 	int ret;
479 
480 	xcopy_wq = alloc_workqueue("xcopy_wq", WQ_MEM_RECLAIM, 0);
481 	if (!xcopy_wq) {
482 		pr_err("Unable to allocate xcopy_wq\n");
483 		return -ENOMEM;
484 	}
485 
486 	memset(&xcopy_pt_tpg, 0, sizeof(struct se_portal_group));
487 	INIT_LIST_HEAD(&xcopy_pt_tpg.acl_node_list);
488 	INIT_LIST_HEAD(&xcopy_pt_tpg.tpg_sess_list);
489 
490 	xcopy_pt_tpg.se_tpg_tfo = &xcopy_pt_tfo;
491 
492 	memset(&xcopy_pt_nacl, 0, sizeof(struct se_node_acl));
493 	INIT_LIST_HEAD(&xcopy_pt_nacl.acl_list);
494 	INIT_LIST_HEAD(&xcopy_pt_nacl.acl_sess_list);
495 	memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
496 	ret = transport_init_session(&xcopy_pt_sess);
497 	if (ret < 0)
498 		goto destroy_wq;
499 
500 	xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
501 	xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
502 
503 	xcopy_pt_sess.se_tpg = &xcopy_pt_tpg;
504 	xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl;
505 
506 	return 0;
507 
508 destroy_wq:
509 	destroy_workqueue(xcopy_wq);
510 	xcopy_wq = NULL;
511 	return ret;
512 }
513 
514 void target_xcopy_release_pt(void)
515 {
516 	if (xcopy_wq) {
517 		destroy_workqueue(xcopy_wq);
518 		transport_uninit_session(&xcopy_pt_sess);
519 	}
520 }
521 
522 /*
523  * target_xcopy_setup_pt_cmd - set up a pass-through command
524  * @xpt_cmd:	 Data structure to initialize.
525  * @xop:	 Describes the XCOPY operation received from an initiator.
526  * @se_dev:	 Backend device to associate with @xpt_cmd if
527  *		 @remote_port == true.
528  * @cdb:	 SCSI CDB to be copied into @xpt_cmd.
529  * @remote_port: If false, use the LUN through which the XCOPY command has
530  *		 been received. If true, use @se_dev->xcopy_lun.
531  *
532  * Set up a SCSI command (READ or WRITE) that will be used to execute an
533  * XCOPY command.
534  */
535 static int target_xcopy_setup_pt_cmd(
536 	struct xcopy_pt_cmd *xpt_cmd,
537 	struct xcopy_op *xop,
538 	struct se_device *se_dev,
539 	unsigned char *cdb,
540 	bool remote_port)
541 {
542 	struct se_cmd *cmd = &xpt_cmd->se_cmd;
543 
544 	/*
545 	 * Setup LUN+port to honor reservations based upon xop->op_origin for
546 	 * X-COPY PUSH or X-COPY PULL based upon where the CDB was received.
547 	 */
548 	if (remote_port) {
549 		cmd->se_lun = &se_dev->xcopy_lun;
550 		cmd->se_dev = se_dev;
551 	} else {
552 		cmd->se_lun = xop->xop_se_cmd->se_lun;
553 		cmd->se_dev = xop->xop_se_cmd->se_dev;
554 	}
555 	cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
556 
557 	if (target_cmd_init_cdb(cmd, cdb, GFP_KERNEL))
558 		return -EINVAL;
559 
560 	cmd->tag = 0;
561 	if (target_cmd_parse_cdb(cmd))
562 		return -EINVAL;
563 
564 	if (transport_generic_map_mem_to_cmd(cmd, xop->xop_data_sg,
565 					xop->xop_data_nents, NULL, 0))
566 		return -EINVAL;
567 
568 	pr_debug("Setup PASSTHROUGH_NOALLOC t_data_sg: %p t_data_nents:"
569 		 " %u\n", cmd->t_data_sg, cmd->t_data_nents);
570 
571 	return 0;
572 }
573 
574 static int target_xcopy_issue_pt_cmd(struct xcopy_pt_cmd *xpt_cmd)
575 {
576 	struct se_cmd *se_cmd = &xpt_cmd->se_cmd;
577 	sense_reason_t sense_rc;
578 
579 	sense_rc = transport_generic_new_cmd(se_cmd);
580 	if (sense_rc)
581 		return -EINVAL;
582 
583 	if (se_cmd->data_direction == DMA_TO_DEVICE)
584 		target_execute_cmd(se_cmd);
585 
586 	wait_for_completion_interruptible(&xpt_cmd->xpt_passthrough_sem);
587 
588 	pr_debug("target_xcopy_issue_pt_cmd(): SCSI status: 0x%02x\n",
589 			se_cmd->scsi_status);
590 
591 	return (se_cmd->scsi_status) ? -EINVAL : 0;
592 }
593 
594 static int target_xcopy_read_source(
595 	struct se_cmd *ec_cmd,
596 	struct xcopy_op *xop,
597 	struct se_device *src_dev,
598 	sector_t src_lba,
599 	u32 src_sectors)
600 {
601 	struct xcopy_pt_cmd xpt_cmd;
602 	struct se_cmd *se_cmd = &xpt_cmd.se_cmd;
603 	u32 length = (src_sectors * src_dev->dev_attrib.block_size);
604 	int rc;
605 	unsigned char cdb[16];
606 	bool remote_port = (xop->op_origin == XCOL_DEST_RECV_OP);
607 
608 	memset(&xpt_cmd, 0, sizeof(xpt_cmd));
609 	init_completion(&xpt_cmd.xpt_passthrough_sem);
610 
611 	memset(&cdb[0], 0, 16);
612 	cdb[0] = READ_16;
613 	put_unaligned_be64(src_lba, &cdb[2]);
614 	put_unaligned_be32(src_sectors, &cdb[10]);
615 	pr_debug("XCOPY: Built READ_16: LBA: %llu Sectors: %u Length: %u\n",
616 		(unsigned long long)src_lba, src_sectors, length);
617 
618 	__target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
619 			  DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0);
620 
621 	rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, src_dev, &cdb[0],
622 				remote_port);
623 	if (rc < 0) {
624 		ec_cmd->scsi_status = se_cmd->scsi_status;
625 		goto out;
626 	}
627 
628 	pr_debug("XCOPY-READ: Saved xop->xop_data_sg: %p, num: %u for READ"
629 		" memory\n", xop->xop_data_sg, xop->xop_data_nents);
630 
631 	rc = target_xcopy_issue_pt_cmd(&xpt_cmd);
632 	if (rc < 0)
633 		ec_cmd->scsi_status = se_cmd->scsi_status;
634 out:
635 	transport_generic_free_cmd(se_cmd, 0);
636 	return rc;
637 }
638 
639 static int target_xcopy_write_destination(
640 	struct se_cmd *ec_cmd,
641 	struct xcopy_op *xop,
642 	struct se_device *dst_dev,
643 	sector_t dst_lba,
644 	u32 dst_sectors)
645 {
646 	struct xcopy_pt_cmd xpt_cmd;
647 	struct se_cmd *se_cmd = &xpt_cmd.se_cmd;
648 	u32 length = (dst_sectors * dst_dev->dev_attrib.block_size);
649 	int rc;
650 	unsigned char cdb[16];
651 	bool remote_port = (xop->op_origin == XCOL_SOURCE_RECV_OP);
652 
653 	memset(&xpt_cmd, 0, sizeof(xpt_cmd));
654 	init_completion(&xpt_cmd.xpt_passthrough_sem);
655 
656 	memset(&cdb[0], 0, 16);
657 	cdb[0] = WRITE_16;
658 	put_unaligned_be64(dst_lba, &cdb[2]);
659 	put_unaligned_be32(dst_sectors, &cdb[10]);
660 	pr_debug("XCOPY: Built WRITE_16: LBA: %llu Sectors: %u Length: %u\n",
661 		(unsigned long long)dst_lba, dst_sectors, length);
662 
663 	__target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
664 			  DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0);
665 
666 	rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, dst_dev, &cdb[0],
667 				remote_port);
668 	if (rc < 0) {
669 		ec_cmd->scsi_status = se_cmd->scsi_status;
670 		goto out;
671 	}
672 
673 	rc = target_xcopy_issue_pt_cmd(&xpt_cmd);
674 	if (rc < 0)
675 		ec_cmd->scsi_status = se_cmd->scsi_status;
676 out:
677 	transport_generic_free_cmd(se_cmd, 0);
678 	return rc;
679 }
680 
681 static void target_xcopy_do_work(struct work_struct *work)
682 {
683 	struct xcopy_op *xop = container_of(work, struct xcopy_op, xop_work);
684 	struct se_cmd *ec_cmd = xop->xop_se_cmd;
685 	struct se_device *src_dev, *dst_dev;
686 	sector_t src_lba, dst_lba, end_lba;
687 	unsigned int max_sectors;
688 	int rc = 0;
689 	unsigned short nolb, max_nolb, copied_nolb = 0;
690 
691 	if (target_parse_xcopy_cmd(xop) != TCM_NO_SENSE)
692 		goto err_free;
693 
694 	if (WARN_ON_ONCE(!xop->src_dev) || WARN_ON_ONCE(!xop->dst_dev))
695 		goto err_free;
696 
697 	src_dev = xop->src_dev;
698 	dst_dev = xop->dst_dev;
699 	src_lba = xop->src_lba;
700 	dst_lba = xop->dst_lba;
701 	nolb = xop->nolb;
702 	end_lba = src_lba + nolb;
703 	/*
704 	 * Break up XCOPY I/O into hw_max_sectors sized I/O based on the
705 	 * smallest max_sectors between src_dev + dev_dev, or
706 	 */
707 	max_sectors = min(src_dev->dev_attrib.hw_max_sectors,
708 			  dst_dev->dev_attrib.hw_max_sectors);
709 	max_sectors = min_t(u32, max_sectors, XCOPY_MAX_SECTORS);
710 
711 	max_nolb = min_t(u16, max_sectors, ((u16)(~0U)));
712 
713 	pr_debug("target_xcopy_do_work: nolb: %hu, max_nolb: %hu end_lba: %llu\n",
714 			nolb, max_nolb, (unsigned long long)end_lba);
715 	pr_debug("target_xcopy_do_work: Starting src_lba: %llu, dst_lba: %llu\n",
716 			(unsigned long long)src_lba, (unsigned long long)dst_lba);
717 
718 	while (src_lba < end_lba) {
719 		unsigned short cur_nolb = min(nolb, max_nolb);
720 		u32 cur_bytes = cur_nolb * src_dev->dev_attrib.block_size;
721 
722 		if (cur_bytes != xop->xop_data_bytes) {
723 			/*
724 			 * (Re)allocate a buffer large enough to hold the XCOPY
725 			 * I/O size, which can be reused each read / write loop.
726 			 */
727 			target_free_sgl(xop->xop_data_sg, xop->xop_data_nents);
728 			rc = target_alloc_sgl(&xop->xop_data_sg,
729 					      &xop->xop_data_nents,
730 					      cur_bytes,
731 					      false, false);
732 			if (rc < 0)
733 				goto out;
734 			xop->xop_data_bytes = cur_bytes;
735 		}
736 
737 		pr_debug("target_xcopy_do_work: Calling read src_dev: %p src_lba: %llu,"
738 			" cur_nolb: %hu\n", src_dev, (unsigned long long)src_lba, cur_nolb);
739 
740 		rc = target_xcopy_read_source(ec_cmd, xop, src_dev, src_lba, cur_nolb);
741 		if (rc < 0)
742 			goto out;
743 
744 		src_lba += cur_nolb;
745 		pr_debug("target_xcopy_do_work: Incremented READ src_lba to %llu\n",
746 				(unsigned long long)src_lba);
747 
748 		pr_debug("target_xcopy_do_work: Calling write dst_dev: %p dst_lba: %llu,"
749 			" cur_nolb: %hu\n", dst_dev, (unsigned long long)dst_lba, cur_nolb);
750 
751 		rc = target_xcopy_write_destination(ec_cmd, xop, dst_dev,
752 						dst_lba, cur_nolb);
753 		if (rc < 0)
754 			goto out;
755 
756 		dst_lba += cur_nolb;
757 		pr_debug("target_xcopy_do_work: Incremented WRITE dst_lba to %llu\n",
758 				(unsigned long long)dst_lba);
759 
760 		copied_nolb += cur_nolb;
761 		nolb -= cur_nolb;
762 	}
763 
764 	xcopy_pt_undepend_remotedev(xop);
765 	target_free_sgl(xop->xop_data_sg, xop->xop_data_nents);
766 	kfree(xop);
767 
768 	pr_debug("target_xcopy_do_work: Final src_lba: %llu, dst_lba: %llu\n",
769 		(unsigned long long)src_lba, (unsigned long long)dst_lba);
770 	pr_debug("target_xcopy_do_work: Blocks copied: %hu, Bytes Copied: %u\n",
771 		copied_nolb, copied_nolb * dst_dev->dev_attrib.block_size);
772 
773 	pr_debug("target_xcopy_do_work: Setting X-COPY GOOD status -> sending response\n");
774 	target_complete_cmd(ec_cmd, SAM_STAT_GOOD);
775 	return;
776 
777 out:
778 	xcopy_pt_undepend_remotedev(xop);
779 	target_free_sgl(xop->xop_data_sg, xop->xop_data_nents);
780 
781 err_free:
782 	kfree(xop);
783 	/*
784 	 * Don't override an error scsi status if it has already been set
785 	 */
786 	if (ec_cmd->scsi_status == SAM_STAT_GOOD) {
787 		pr_warn_ratelimited("target_xcopy_do_work: rc: %d, Setting X-COPY"
788 			" CHECK_CONDITION -> sending response\n", rc);
789 		ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
790 	}
791 	target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
792 }
793 
794 /*
795  * Returns TCM_NO_SENSE upon success or a sense code != TCM_NO_SENSE if parsing
796  * fails.
797  */
798 static sense_reason_t target_parse_xcopy_cmd(struct xcopy_op *xop)
799 {
800 	struct se_cmd *se_cmd = xop->xop_se_cmd;
801 	unsigned char *p = NULL, *seg_desc;
802 	unsigned int list_id, list_id_usage, sdll, inline_dl;
803 	sense_reason_t ret = TCM_INVALID_PARAMETER_LIST;
804 	int rc;
805 	unsigned short tdll;
806 
807 	p = transport_kmap_data_sg(se_cmd);
808 	if (!p) {
809 		pr_err("transport_kmap_data_sg() failed in target_do_xcopy\n");
810 		return TCM_OUT_OF_RESOURCES;
811 	}
812 
813 	list_id = p[0];
814 	list_id_usage = (p[1] & 0x18) >> 3;
815 
816 	/*
817 	 * Determine TARGET DESCRIPTOR LIST LENGTH + SEGMENT DESCRIPTOR LIST LENGTH
818 	 */
819 	tdll = get_unaligned_be16(&p[2]);
820 	sdll = get_unaligned_be32(&p[8]);
821 	if (tdll + sdll > RCR_OP_MAX_DESC_LIST_LEN) {
822 		pr_err("XCOPY descriptor list length %u exceeds maximum %u\n",
823 		       tdll + sdll, RCR_OP_MAX_DESC_LIST_LEN);
824 		ret = TCM_PARAMETER_LIST_LENGTH_ERROR;
825 		goto out;
826 	}
827 
828 	inline_dl = get_unaligned_be32(&p[12]);
829 	if (inline_dl != 0) {
830 		pr_err("XCOPY with non zero inline data length\n");
831 		goto out;
832 	}
833 
834 	if (se_cmd->data_length < (XCOPY_HDR_LEN + tdll + sdll + inline_dl)) {
835 		pr_err("XCOPY parameter truncation: data length %u too small "
836 			"for tdll: %hu sdll: %u inline_dl: %u\n",
837 			se_cmd->data_length, tdll, sdll, inline_dl);
838 		ret = TCM_PARAMETER_LIST_LENGTH_ERROR;
839 		goto out;
840 	}
841 
842 	pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
843 		" tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
844 		tdll, sdll, inline_dl);
845 
846 	/*
847 	 * skip over the target descriptors until segment descriptors
848 	 * have been passed - CSCD ids are needed to determine src and dest.
849 	 */
850 	seg_desc = &p[16] + tdll;
851 
852 	rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc,
853 						    sdll, &ret);
854 	if (rc <= 0)
855 		goto out;
856 
857 	pr_debug("XCOPY: Processed %d segment descriptors, length: %u\n", rc,
858 				rc * XCOPY_SEGMENT_DESC_LEN);
859 
860 	rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
861 	if (rc <= 0)
862 		goto out;
863 
864 	if (xop->src_dev->dev_attrib.block_size !=
865 	    xop->dst_dev->dev_attrib.block_size) {
866 		pr_err("XCOPY: Non matching src_dev block_size: %u + dst_dev"
867 		       " block_size: %u currently unsupported\n",
868 			xop->src_dev->dev_attrib.block_size,
869 			xop->dst_dev->dev_attrib.block_size);
870 		xcopy_pt_undepend_remotedev(xop);
871 		ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
872 		goto out;
873 	}
874 
875 	pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
876 				rc * XCOPY_TARGET_DESC_LEN);
877 	transport_kunmap_data_sg(se_cmd);
878 	return TCM_NO_SENSE;
879 
880 out:
881 	if (p)
882 		transport_kunmap_data_sg(se_cmd);
883 	return ret;
884 }
885 
886 sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
887 {
888 	struct se_device *dev = se_cmd->se_dev;
889 	struct xcopy_op *xop;
890 	unsigned int sa;
891 
892 	if (!dev->dev_attrib.emulate_3pc) {
893 		pr_err("EXTENDED_COPY operation explicitly disabled\n");
894 		return TCM_UNSUPPORTED_SCSI_OPCODE;
895 	}
896 
897 	sa = se_cmd->t_task_cdb[1] & 0x1f;
898 	if (sa != 0x00) {
899 		pr_err("EXTENDED_COPY(LID4) not supported\n");
900 		return TCM_UNSUPPORTED_SCSI_OPCODE;
901 	}
902 
903 	if (se_cmd->data_length == 0) {
904 		target_complete_cmd(se_cmd, SAM_STAT_GOOD);
905 		return TCM_NO_SENSE;
906 	}
907 	if (se_cmd->data_length < XCOPY_HDR_LEN) {
908 		pr_err("XCOPY parameter truncation: length %u < hdr_len %u\n",
909 				se_cmd->data_length, XCOPY_HDR_LEN);
910 		return TCM_PARAMETER_LIST_LENGTH_ERROR;
911 	}
912 
913 	xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
914 	if (!xop)
915 		goto err;
916 	xop->xop_se_cmd = se_cmd;
917 	INIT_WORK(&xop->xop_work, target_xcopy_do_work);
918 	if (WARN_ON_ONCE(!queue_work(xcopy_wq, &xop->xop_work)))
919 		goto free;
920 	return TCM_NO_SENSE;
921 
922 free:
923 	kfree(xop);
924 
925 err:
926 	return TCM_OUT_OF_RESOURCES;
927 }
928 
929 static sense_reason_t target_rcr_operating_parameters(struct se_cmd *se_cmd)
930 {
931 	unsigned char *p;
932 
933 	p = transport_kmap_data_sg(se_cmd);
934 	if (!p) {
935 		pr_err("transport_kmap_data_sg failed in"
936 		       " target_rcr_operating_parameters\n");
937 		return TCM_OUT_OF_RESOURCES;
938 	}
939 
940 	if (se_cmd->data_length < 54) {
941 		pr_err("Receive Copy Results Op Parameters length"
942 		       " too small: %u\n", se_cmd->data_length);
943 		transport_kunmap_data_sg(se_cmd);
944 		return TCM_INVALID_CDB_FIELD;
945 	}
946 	/*
947 	 * Set SNLID=1 (Supports no List ID)
948 	 */
949 	p[4] = 0x1;
950 	/*
951 	 * MAXIMUM TARGET DESCRIPTOR COUNT
952 	 */
953 	put_unaligned_be16(RCR_OP_MAX_TARGET_DESC_COUNT, &p[8]);
954 	/*
955 	 * MAXIMUM SEGMENT DESCRIPTOR COUNT
956 	 */
957 	put_unaligned_be16(RCR_OP_MAX_SG_DESC_COUNT, &p[10]);
958 	/*
959 	 * MAXIMUM DESCRIPTOR LIST LENGTH
960 	 */
961 	put_unaligned_be32(RCR_OP_MAX_DESC_LIST_LEN, &p[12]);
962 	/*
963 	 * MAXIMUM SEGMENT LENGTH
964 	 */
965 	put_unaligned_be32(RCR_OP_MAX_SEGMENT_LEN, &p[16]);
966 	/*
967 	 * MAXIMUM INLINE DATA LENGTH for SA 0x04 (NOT SUPPORTED)
968 	 */
969 	put_unaligned_be32(0x0, &p[20]);
970 	/*
971 	 * HELD DATA LIMIT
972 	 */
973 	put_unaligned_be32(0x0, &p[24]);
974 	/*
975 	 * MAXIMUM STREAM DEVICE TRANSFER SIZE
976 	 */
977 	put_unaligned_be32(0x0, &p[28]);
978 	/*
979 	 * TOTAL CONCURRENT COPIES
980 	 */
981 	put_unaligned_be16(RCR_OP_TOTAL_CONCURR_COPIES, &p[34]);
982 	/*
983 	 * MAXIMUM CONCURRENT COPIES
984 	 */
985 	p[36] = RCR_OP_MAX_CONCURR_COPIES;
986 	/*
987 	 * DATA SEGMENT GRANULARITY (log 2)
988 	 */
989 	p[37] = RCR_OP_DATA_SEG_GRAN_LOG2;
990 	/*
991 	 * INLINE DATA GRANULARITY log 2)
992 	 */
993 	p[38] = RCR_OP_INLINE_DATA_GRAN_LOG2;
994 	/*
995 	 * HELD DATA GRANULARITY
996 	 */
997 	p[39] = RCR_OP_HELD_DATA_GRAN_LOG2;
998 	/*
999 	 * IMPLEMENTED DESCRIPTOR LIST LENGTH
1000 	 */
1001 	p[43] = 0x2;
1002 	/*
1003 	 * List of implemented descriptor type codes (ordered)
1004 	 */
1005 	p[44] = 0x02; /* Copy Block to Block device */
1006 	p[45] = 0xe4; /* Identification descriptor target descriptor */
1007 
1008 	/*
1009 	 * AVAILABLE DATA (n-3)
1010 	 */
1011 	put_unaligned_be32(42, &p[0]);
1012 
1013 	transport_kunmap_data_sg(se_cmd);
1014 	target_complete_cmd(se_cmd, GOOD);
1015 
1016 	return TCM_NO_SENSE;
1017 }
1018 
1019 sense_reason_t target_do_receive_copy_results(struct se_cmd *se_cmd)
1020 {
1021 	unsigned char *cdb = &se_cmd->t_task_cdb[0];
1022 	int sa = (cdb[1] & 0x1f), list_id = cdb[2];
1023 	sense_reason_t rc = TCM_NO_SENSE;
1024 
1025 	pr_debug("Entering target_do_receive_copy_results: SA: 0x%02x, List ID:"
1026 		" 0x%02x, AL: %u\n", sa, list_id, se_cmd->data_length);
1027 
1028 	if (list_id != 0) {
1029 		pr_err("Receive Copy Results with non zero list identifier"
1030 		       " not supported\n");
1031 		return TCM_INVALID_CDB_FIELD;
1032 	}
1033 
1034 	switch (sa) {
1035 	case RCR_SA_OPERATING_PARAMETERS:
1036 		rc = target_rcr_operating_parameters(se_cmd);
1037 		break;
1038 	case RCR_SA_COPY_STATUS:
1039 	case RCR_SA_RECEIVE_DATA:
1040 	case RCR_SA_FAILED_SEGMENT_DETAILS:
1041 	default:
1042 		pr_err("Unsupported SA for receive copy results: 0x%02x\n", sa);
1043 		return TCM_INVALID_CDB_FIELD;
1044 	}
1045 
1046 	return rc;
1047 }
1048