GNU Linux-libre 4.4.283-gnu1
[releases.git] / drivers / target / target_core_sbc.c
1 /*
2  * SCSI Block Commands (SBC) parsing and emulation.
3  *
4  * (c) Copyright 2002-2013 Datera, Inc.
5  *
6  * Nicholas A. Bellinger <nab@kernel.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
21  */
22
23 #include <linux/kernel.h>
24 #include <linux/module.h>
25 #include <linux/ratelimit.h>
26 #include <linux/crc-t10dif.h>
27 #include <asm/unaligned.h>
28 #include <scsi/scsi_proto.h>
29 #include <scsi/scsi_tcq.h>
30
31 #include <target/target_core_base.h>
32 #include <target/target_core_backend.h>
33 #include <target/target_core_fabric.h>
34
35 #include "target_core_internal.h"
36 #include "target_core_ua.h"
37 #include "target_core_alua.h"
38
39 static sense_reason_t
40 sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char, u32, bool);
41 static sense_reason_t sbc_execute_unmap(struct se_cmd *cmd);
42
43 static sense_reason_t
44 sbc_emulate_readcapacity(struct se_cmd *cmd)
45 {
46         struct se_device *dev = cmd->se_dev;
47         unsigned char *cdb = cmd->t_task_cdb;
48         unsigned long long blocks_long = dev->transport->get_blocks(dev);
49         unsigned char *rbuf;
50         unsigned char buf[8];
51         u32 blocks;
52
53         /*
54          * SBC-2 says:
55          *   If the PMI bit is set to zero and the LOGICAL BLOCK
56          *   ADDRESS field is not set to zero, the device server shall
57          *   terminate the command with CHECK CONDITION status with
58          *   the sense key set to ILLEGAL REQUEST and the additional
59          *   sense code set to INVALID FIELD IN CDB.
60          *
61          * In SBC-3, these fields are obsolete, but some SCSI
62          * compliance tests actually check this, so we might as well
63          * follow SBC-2.
64          */
65         if (!(cdb[8] & 1) && !!(cdb[2] | cdb[3] | cdb[4] | cdb[5]))
66                 return TCM_INVALID_CDB_FIELD;
67
68         if (blocks_long >= 0x00000000ffffffff)
69                 blocks = 0xffffffff;
70         else
71                 blocks = (u32)blocks_long;
72
73         buf[0] = (blocks >> 24) & 0xff;
74         buf[1] = (blocks >> 16) & 0xff;
75         buf[2] = (blocks >> 8) & 0xff;
76         buf[3] = blocks & 0xff;
77         buf[4] = (dev->dev_attrib.block_size >> 24) & 0xff;
78         buf[5] = (dev->dev_attrib.block_size >> 16) & 0xff;
79         buf[6] = (dev->dev_attrib.block_size >> 8) & 0xff;
80         buf[7] = dev->dev_attrib.block_size & 0xff;
81
82         rbuf = transport_kmap_data_sg(cmd);
83         if (rbuf) {
84                 memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
85                 transport_kunmap_data_sg(cmd);
86         }
87
88         target_complete_cmd_with_length(cmd, GOOD, 8);
89         return 0;
90 }
91
92 static sense_reason_t
93 sbc_emulate_readcapacity_16(struct se_cmd *cmd)
94 {
95         struct se_device *dev = cmd->se_dev;
96         struct se_session *sess = cmd->se_sess;
97         int pi_prot_type = dev->dev_attrib.pi_prot_type;
98
99         unsigned char *rbuf;
100         unsigned char buf[32];
101         unsigned long long blocks = dev->transport->get_blocks(dev);
102
103         memset(buf, 0, sizeof(buf));
104         buf[0] = (blocks >> 56) & 0xff;
105         buf[1] = (blocks >> 48) & 0xff;
106         buf[2] = (blocks >> 40) & 0xff;
107         buf[3] = (blocks >> 32) & 0xff;
108         buf[4] = (blocks >> 24) & 0xff;
109         buf[5] = (blocks >> 16) & 0xff;
110         buf[6] = (blocks >> 8) & 0xff;
111         buf[7] = blocks & 0xff;
112         buf[8] = (dev->dev_attrib.block_size >> 24) & 0xff;
113         buf[9] = (dev->dev_attrib.block_size >> 16) & 0xff;
114         buf[10] = (dev->dev_attrib.block_size >> 8) & 0xff;
115         buf[11] = dev->dev_attrib.block_size & 0xff;
116         /*
117          * Set P_TYPE and PROT_EN bits for DIF support
118          */
119         if (sess->sup_prot_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS)) {
120                 /*
121                  * Only override a device's pi_prot_type if no T10-PI is
122                  * available, and sess_prot_type has been explicitly enabled.
123                  */
124                 if (!pi_prot_type)
125                         pi_prot_type = sess->sess_prot_type;
126
127                 if (pi_prot_type)
128                         buf[12] = (pi_prot_type - 1) << 1 | 0x1;
129         }
130
131         if (dev->transport->get_lbppbe)
132                 buf[13] = dev->transport->get_lbppbe(dev) & 0x0f;
133
134         if (dev->transport->get_alignment_offset_lbas) {
135                 u16 lalba = dev->transport->get_alignment_offset_lbas(dev);
136                 buf[14] = (lalba >> 8) & 0x3f;
137                 buf[15] = lalba & 0xff;
138         }
139
140         /*
141          * Set Thin Provisioning Enable bit following sbc3r22 in section
142          * READ CAPACITY (16) byte 14 if emulate_tpu or emulate_tpws is enabled.
143          */
144         if (dev->dev_attrib.emulate_tpu || dev->dev_attrib.emulate_tpws)
145                 buf[14] |= 0x80;
146
147         rbuf = transport_kmap_data_sg(cmd);
148         if (rbuf) {
149                 memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
150                 transport_kunmap_data_sg(cmd);
151         }
152
153         target_complete_cmd_with_length(cmd, GOOD, 32);
154         return 0;
155 }
156
157 static sense_reason_t
158 sbc_emulate_startstop(struct se_cmd *cmd)
159 {
160         unsigned char *cdb = cmd->t_task_cdb;
161
162         /*
163          * See sbc3r36 section 5.25
164          * Immediate bit should be set since there is nothing to complete
165          * POWER CONDITION MODIFIER 0h
166          */
167         if (!(cdb[1] & 1) || cdb[2] || cdb[3])
168                 return TCM_INVALID_CDB_FIELD;
169
170         /*
171          * See sbc3r36 section 5.25
172          * POWER CONDITION 0h START_VALID - process START and LOEJ
173          */
174         if (cdb[4] >> 4 & 0xf)
175                 return TCM_INVALID_CDB_FIELD;
176
177         /*
178          * See sbc3r36 section 5.25
179          * LOEJ 0h - nothing to load or unload
180          * START 1h - we are ready
181          */
182         if (!(cdb[4] & 1) || (cdb[4] & 2) || (cdb[4] & 4))
183                 return TCM_INVALID_CDB_FIELD;
184
185         target_complete_cmd(cmd, SAM_STAT_GOOD);
186         return 0;
187 }
188
189 sector_t sbc_get_write_same_sectors(struct se_cmd *cmd)
190 {
191         u32 num_blocks;
192
193         if (cmd->t_task_cdb[0] == WRITE_SAME)
194                 num_blocks = get_unaligned_be16(&cmd->t_task_cdb[7]);
195         else if (cmd->t_task_cdb[0] == WRITE_SAME_16)
196                 num_blocks = get_unaligned_be32(&cmd->t_task_cdb[10]);
197         else /* WRITE_SAME_32 via VARIABLE_LENGTH_CMD */
198                 num_blocks = get_unaligned_be32(&cmd->t_task_cdb[28]);
199
200         /*
201          * Use the explicit range when non zero is supplied, otherwise calculate
202          * the remaining range based on ->get_blocks() - starting LBA.
203          */
204         if (num_blocks)
205                 return num_blocks;
206
207         return cmd->se_dev->transport->get_blocks(cmd->se_dev) -
208                 cmd->t_task_lba + 1;
209 }
210 EXPORT_SYMBOL(sbc_get_write_same_sectors);
211
212 static sense_reason_t
213 sbc_execute_write_same_unmap(struct se_cmd *cmd)
214 {
215         struct sbc_ops *ops = cmd->protocol_data;
216         sector_t nolb = sbc_get_write_same_sectors(cmd);
217         sense_reason_t ret;
218
219         if (nolb) {
220                 ret = ops->execute_unmap(cmd, cmd->t_task_lba, nolb);
221                 if (ret)
222                         return ret;
223         }
224
225         target_complete_cmd(cmd, GOOD);
226         return 0;
227 }
228
229 static sense_reason_t
230 sbc_emulate_noop(struct se_cmd *cmd)
231 {
232         target_complete_cmd(cmd, GOOD);
233         return 0;
234 }
235
236 static inline u32 sbc_get_size(struct se_cmd *cmd, u32 sectors)
237 {
238         return cmd->se_dev->dev_attrib.block_size * sectors;
239 }
240
241 static inline u32 transport_get_sectors_6(unsigned char *cdb)
242 {
243         /*
244          * Use 8-bit sector value.  SBC-3 says:
245          *
246          *   A TRANSFER LENGTH field set to zero specifies that 256
247          *   logical blocks shall be written.  Any other value
248          *   specifies the number of logical blocks that shall be
249          *   written.
250          */
251         return cdb[4] ? : 256;
252 }
253
254 static inline u32 transport_get_sectors_10(unsigned char *cdb)
255 {
256         return (u32)(cdb[7] << 8) + cdb[8];
257 }
258
259 static inline u32 transport_get_sectors_12(unsigned char *cdb)
260 {
261         return (u32)(cdb[6] << 24) + (cdb[7] << 16) + (cdb[8] << 8) + cdb[9];
262 }
263
264 static inline u32 transport_get_sectors_16(unsigned char *cdb)
265 {
266         return (u32)(cdb[10] << 24) + (cdb[11] << 16) +
267                     (cdb[12] << 8) + cdb[13];
268 }
269
270 /*
271  * Used for VARIABLE_LENGTH_CDB WRITE_32 and READ_32 variants
272  */
273 static inline u32 transport_get_sectors_32(unsigned char *cdb)
274 {
275         return (u32)(cdb[28] << 24) + (cdb[29] << 16) +
276                     (cdb[30] << 8) + cdb[31];
277
278 }
279
280 static inline u32 transport_lba_21(unsigned char *cdb)
281 {
282         return ((cdb[1] & 0x1f) << 16) | (cdb[2] << 8) | cdb[3];
283 }
284
285 static inline u32 transport_lba_32(unsigned char *cdb)
286 {
287         return (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
288 }
289
290 static inline unsigned long long transport_lba_64(unsigned char *cdb)
291 {
292         unsigned int __v1, __v2;
293
294         __v1 = (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
295         __v2 = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
296
297         return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
298 }
299
300 /*
301  * For VARIABLE_LENGTH_CDB w/ 32 byte extended CDBs
302  */
303 static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
304 {
305         unsigned int __v1, __v2;
306
307         __v1 = (cdb[12] << 24) | (cdb[13] << 16) | (cdb[14] << 8) | cdb[15];
308         __v2 = (cdb[16] << 24) | (cdb[17] << 16) | (cdb[18] << 8) | cdb[19];
309
310         return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
311 }
312
313 static sense_reason_t
314 sbc_setup_write_same(struct se_cmd *cmd, unsigned char flags, struct sbc_ops *ops)
315 {
316         struct se_device *dev = cmd->se_dev;
317         sector_t end_lba = dev->transport->get_blocks(dev) + 1;
318         unsigned int sectors = sbc_get_write_same_sectors(cmd);
319         sense_reason_t ret;
320
321         if ((flags & 0x04) || (flags & 0x02)) {
322                 pr_err("WRITE_SAME PBDATA and LBDATA"
323                         " bits not supported for Block Discard"
324                         " Emulation\n");
325                 return TCM_UNSUPPORTED_SCSI_OPCODE;
326         }
327         if (sectors > cmd->se_dev->dev_attrib.max_write_same_len) {
328                 pr_warn("WRITE_SAME sectors: %u exceeds max_write_same_len: %u\n",
329                         sectors, cmd->se_dev->dev_attrib.max_write_same_len);
330                 return TCM_INVALID_CDB_FIELD;
331         }
332         /*
333          * Sanity check for LBA wrap and request past end of device.
334          */
335         if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
336             ((cmd->t_task_lba + sectors) > end_lba)) {
337                 pr_err("WRITE_SAME exceeds last lba %llu (lba %llu, sectors %u)\n",
338                        (unsigned long long)end_lba, cmd->t_task_lba, sectors);
339                 return TCM_ADDRESS_OUT_OF_RANGE;
340         }
341
342         /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
343         if (flags & 0x10) {
344                 pr_warn("WRITE SAME with ANCHOR not supported\n");
345                 return TCM_INVALID_CDB_FIELD;
346         }
347         /*
348          * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
349          * translated into block discard requests within backend code.
350          */
351         if (flags & 0x08) {
352                 if (!ops->execute_unmap)
353                         return TCM_UNSUPPORTED_SCSI_OPCODE;
354
355                 if (!dev->dev_attrib.emulate_tpws) {
356                         pr_err("Got WRITE_SAME w/ UNMAP=1, but backend device"
357                                " has emulate_tpws disabled\n");
358                         return TCM_UNSUPPORTED_SCSI_OPCODE;
359                 }
360                 cmd->execute_cmd = sbc_execute_write_same_unmap;
361                 return 0;
362         }
363         if (!ops->execute_write_same)
364                 return TCM_UNSUPPORTED_SCSI_OPCODE;
365
366         ret = sbc_check_prot(dev, cmd, flags >> 5, sectors, true);
367         if (ret)
368                 return ret;
369
370         cmd->execute_cmd = ops->execute_write_same;
371         return 0;
372 }
373
374 static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
375                                            int *post_ret)
376 {
377         unsigned char *buf, *addr;
378         struct scatterlist *sg;
379         unsigned int offset;
380         sense_reason_t ret = TCM_NO_SENSE;
381         int i, count;
382         /*
383          * From sbc3r22.pdf section 5.48 XDWRITEREAD (10) command
384          *
385          * 1) read the specified logical block(s);
386          * 2) transfer logical blocks from the data-out buffer;
387          * 3) XOR the logical blocks transferred from the data-out buffer with
388          *    the logical blocks read, storing the resulting XOR data in a buffer;
389          * 4) if the DISABLE WRITE bit is set to zero, then write the logical
390          *    blocks transferred from the data-out buffer; and
391          * 5) transfer the resulting XOR data to the data-in buffer.
392          */
393         buf = kmalloc(cmd->data_length, GFP_KERNEL);
394         if (!buf) {
395                 pr_err("Unable to allocate xor_callback buf\n");
396                 return TCM_OUT_OF_RESOURCES;
397         }
398         /*
399          * Copy the scatterlist WRITE buffer located at cmd->t_data_sg
400          * into the locally allocated *buf
401          */
402         sg_copy_to_buffer(cmd->t_data_sg,
403                           cmd->t_data_nents,
404                           buf,
405                           cmd->data_length);
406
407         /*
408          * Now perform the XOR against the BIDI read memory located at
409          * cmd->t_mem_bidi_list
410          */
411
412         offset = 0;
413         for_each_sg(cmd->t_bidi_data_sg, sg, cmd->t_bidi_data_nents, count) {
414                 addr = kmap_atomic(sg_page(sg));
415                 if (!addr) {
416                         ret = TCM_OUT_OF_RESOURCES;
417                         goto out;
418                 }
419
420                 for (i = 0; i < sg->length; i++)
421                         *(addr + sg->offset + i) ^= *(buf + offset + i);
422
423                 offset += sg->length;
424                 kunmap_atomic(addr);
425         }
426
427 out:
428         kfree(buf);
429         return ret;
430 }
431
432 static sense_reason_t
433 sbc_execute_rw(struct se_cmd *cmd)
434 {
435         struct sbc_ops *ops = cmd->protocol_data;
436
437         return ops->execute_rw(cmd, cmd->t_data_sg, cmd->t_data_nents,
438                                cmd->data_direction);
439 }
440
441 static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
442                                              int *post_ret)
443 {
444         struct se_device *dev = cmd->se_dev;
445         sense_reason_t ret = TCM_NO_SENSE;
446
447         /*
448          * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
449          * within target_complete_ok_work() if the command was successfully
450          * sent to the backend driver.
451          */
452         spin_lock_irq(&cmd->t_state_lock);
453         if (cmd->transport_state & CMD_T_SENT) {
454                 cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
455                 *post_ret = 1;
456
457                 if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
458                         ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
459         }
460         spin_unlock_irq(&cmd->t_state_lock);
461
462         /*
463          * Unlock ->caw_sem originally obtained during sbc_compare_and_write()
464          * before the original READ I/O submission.
465          */
466         up(&dev->caw_sem);
467
468         return ret;
469 }
470
471 static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
472                                                  int *post_ret)
473 {
474         struct se_device *dev = cmd->se_dev;
475         struct scatterlist *write_sg = NULL, *sg;
476         unsigned char *buf = NULL, *addr;
477         struct sg_mapping_iter m;
478         unsigned int offset = 0, len;
479         unsigned int nlbas = cmd->t_task_nolb;
480         unsigned int block_size = dev->dev_attrib.block_size;
481         unsigned int compare_len = (nlbas * block_size);
482         sense_reason_t ret = TCM_NO_SENSE;
483         int rc, i;
484
485         /*
486          * Handle early failure in transport_generic_request_failure(),
487          * which will not have taken ->caw_sem yet..
488          */
489         if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg))
490                 return TCM_NO_SENSE;
491         /*
492          * Handle special case for zero-length COMPARE_AND_WRITE
493          */
494         if (!cmd->data_length)
495                 goto out;
496         /*
497          * Immediately exit + release dev->caw_sem if command has already
498          * been failed with a non-zero SCSI status.
499          */
500         if (cmd->scsi_status) {
501                 pr_debug("compare_and_write_callback: non zero scsi_status:"
502                         " 0x%02x\n", cmd->scsi_status);
503                 *post_ret = 1;
504                 if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
505                         ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
506                 goto out;
507         }
508
509         buf = kzalloc(cmd->data_length, GFP_KERNEL);
510         if (!buf) {
511                 pr_err("Unable to allocate compare_and_write buf\n");
512                 ret = TCM_OUT_OF_RESOURCES;
513                 goto out;
514         }
515
516         write_sg = kmalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
517                            GFP_KERNEL);
518         if (!write_sg) {
519                 pr_err("Unable to allocate compare_and_write sg\n");
520                 ret = TCM_OUT_OF_RESOURCES;
521                 goto out;
522         }
523         sg_init_table(write_sg, cmd->t_data_nents);
524         /*
525          * Setup verify and write data payloads from total NumberLBAs.
526          */
527         rc = sg_copy_to_buffer(cmd->t_data_sg, cmd->t_data_nents, buf,
528                                cmd->data_length);
529         if (!rc) {
530                 pr_err("sg_copy_to_buffer() failed for compare_and_write\n");
531                 ret = TCM_OUT_OF_RESOURCES;
532                 goto out;
533         }
534         /*
535          * Compare against SCSI READ payload against verify payload
536          */
537         for_each_sg(cmd->t_bidi_data_sg, sg, cmd->t_bidi_data_nents, i) {
538                 addr = (unsigned char *)kmap_atomic(sg_page(sg));
539                 if (!addr) {
540                         ret = TCM_OUT_OF_RESOURCES;
541                         goto out;
542                 }
543
544                 len = min(sg->length, compare_len);
545
546                 if (memcmp(addr, buf + offset, len)) {
547                         pr_warn("Detected MISCOMPARE for addr: %p buf: %p\n",
548                                 addr, buf + offset);
549                         kunmap_atomic(addr);
550                         goto miscompare;
551                 }
552                 kunmap_atomic(addr);
553
554                 offset += len;
555                 compare_len -= len;
556                 if (!compare_len)
557                         break;
558         }
559
560         i = 0;
561         len = cmd->t_task_nolb * block_size;
562         sg_miter_start(&m, cmd->t_data_sg, cmd->t_data_nents, SG_MITER_TO_SG);
563         /*
564          * Currently assumes NoLB=1 and SGLs are PAGE_SIZE..
565          */
566         while (len) {
567                 sg_miter_next(&m);
568
569                 if (block_size < PAGE_SIZE) {
570                         sg_set_page(&write_sg[i], m.page, block_size,
571                                     m.piter.sg->offset + block_size);
572                 } else {
573                         sg_miter_next(&m);
574                         sg_set_page(&write_sg[i], m.page, block_size,
575                                     m.piter.sg->offset);
576                 }
577                 len -= block_size;
578                 i++;
579         }
580         sg_miter_stop(&m);
581         /*
582          * Save the original SGL + nents values before updating to new
583          * assignments, to be released in transport_free_pages() ->
584          * transport_reset_sgl_orig()
585          */
586         cmd->t_data_sg_orig = cmd->t_data_sg;
587         cmd->t_data_sg = write_sg;
588         cmd->t_data_nents_orig = cmd->t_data_nents;
589         cmd->t_data_nents = 1;
590
591         cmd->sam_task_attr = TCM_HEAD_TAG;
592         cmd->transport_complete_callback = compare_and_write_post;
593         /*
594          * Now reset ->execute_cmd() to the normal sbc_execute_rw() handler
595          * for submitting the adjusted SGL to write instance user-data.
596          */
597         cmd->execute_cmd = sbc_execute_rw;
598
599         spin_lock_irq(&cmd->t_state_lock);
600         cmd->t_state = TRANSPORT_PROCESSING;
601         cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT;
602         spin_unlock_irq(&cmd->t_state_lock);
603
604         __target_execute_cmd(cmd, false);
605
606         kfree(buf);
607         return ret;
608
609 miscompare:
610         pr_warn("Target/%s: Send MISCOMPARE check condition and sense\n",
611                 dev->transport->name);
612         ret = TCM_MISCOMPARE_VERIFY;
613 out:
614         /*
615          * In the MISCOMPARE or failure case, unlock ->caw_sem obtained in
616          * sbc_compare_and_write() before the original READ I/O submission.
617          */
618         up(&dev->caw_sem);
619         kfree(write_sg);
620         kfree(buf);
621         return ret;
622 }
623
624 static sense_reason_t
625 sbc_compare_and_write(struct se_cmd *cmd)
626 {
627         struct sbc_ops *ops = cmd->protocol_data;
628         struct se_device *dev = cmd->se_dev;
629         sense_reason_t ret;
630         int rc;
631         /*
632          * Submit the READ first for COMPARE_AND_WRITE to perform the
633          * comparision using SGLs at cmd->t_bidi_data_sg..
634          */
635         rc = down_interruptible(&dev->caw_sem);
636         if (rc != 0) {
637                 cmd->transport_complete_callback = NULL;
638                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
639         }
640         /*
641          * Reset cmd->data_length to individual block_size in order to not
642          * confuse backend drivers that depend on this value matching the
643          * size of the I/O being submitted.
644          */
645         cmd->data_length = cmd->t_task_nolb * dev->dev_attrib.block_size;
646
647         ret = ops->execute_rw(cmd, cmd->t_bidi_data_sg, cmd->t_bidi_data_nents,
648                               DMA_FROM_DEVICE);
649         if (ret) {
650                 cmd->transport_complete_callback = NULL;
651                 up(&dev->caw_sem);
652                 return ret;
653         }
654         /*
655          * Unlock of dev->caw_sem to occur in compare_and_write_callback()
656          * upon MISCOMPARE, or in compare_and_write_done() upon completion
657          * of WRITE instance user-data.
658          */
659         return TCM_NO_SENSE;
660 }
661
662 static int
663 sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_type,
664                        bool is_write, struct se_cmd *cmd)
665 {
666         if (is_write) {
667                 cmd->prot_op = fabric_prot ? TARGET_PROT_DOUT_STRIP :
668                                protect ? TARGET_PROT_DOUT_PASS :
669                                TARGET_PROT_DOUT_INSERT;
670                 switch (protect) {
671                 case 0x0:
672                 case 0x3:
673                         cmd->prot_checks = 0;
674                         break;
675                 case 0x1:
676                 case 0x5:
677                         cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
678                         if (prot_type == TARGET_DIF_TYPE1_PROT)
679                                 cmd->prot_checks |= TARGET_DIF_CHECK_REFTAG;
680                         break;
681                 case 0x2:
682                         if (prot_type == TARGET_DIF_TYPE1_PROT)
683                                 cmd->prot_checks = TARGET_DIF_CHECK_REFTAG;
684                         break;
685                 case 0x4:
686                         cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
687                         break;
688                 default:
689                         pr_err("Unsupported protect field %d\n", protect);
690                         return -EINVAL;
691                 }
692         } else {
693                 cmd->prot_op = fabric_prot ? TARGET_PROT_DIN_INSERT :
694                                protect ? TARGET_PROT_DIN_PASS :
695                                TARGET_PROT_DIN_STRIP;
696                 switch (protect) {
697                 case 0x0:
698                 case 0x1:
699                 case 0x5:
700                         cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
701                         if (prot_type == TARGET_DIF_TYPE1_PROT)
702                                 cmd->prot_checks |= TARGET_DIF_CHECK_REFTAG;
703                         break;
704                 case 0x2:
705                         if (prot_type == TARGET_DIF_TYPE1_PROT)
706                                 cmd->prot_checks = TARGET_DIF_CHECK_REFTAG;
707                         break;
708                 case 0x3:
709                         cmd->prot_checks = 0;
710                         break;
711                 case 0x4:
712                         cmd->prot_checks = TARGET_DIF_CHECK_GUARD;
713                         break;
714                 default:
715                         pr_err("Unsupported protect field %d\n", protect);
716                         return -EINVAL;
717                 }
718         }
719
720         return 0;
721 }
722
723 static sense_reason_t
724 sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char protect,
725                u32 sectors, bool is_write)
726 {
727         int sp_ops = cmd->se_sess->sup_prot_ops;
728         int pi_prot_type = dev->dev_attrib.pi_prot_type;
729         bool fabric_prot = false;
730
731         if (!cmd->t_prot_sg || !cmd->t_prot_nents) {
732                 if (unlikely(protect &&
733                     !dev->dev_attrib.pi_prot_type && !cmd->se_sess->sess_prot_type)) {
734                         pr_err("CDB contains protect bit, but device + fabric does"
735                                " not advertise PROTECT=1 feature bit\n");
736                         return TCM_INVALID_CDB_FIELD;
737                 }
738                 if (cmd->prot_pto)
739                         return TCM_NO_SENSE;
740         }
741
742         switch (dev->dev_attrib.pi_prot_type) {
743         case TARGET_DIF_TYPE3_PROT:
744                 cmd->reftag_seed = 0xffffffff;
745                 break;
746         case TARGET_DIF_TYPE2_PROT:
747                 if (protect)
748                         return TCM_INVALID_CDB_FIELD;
749
750                 cmd->reftag_seed = cmd->t_task_lba;
751                 break;
752         case TARGET_DIF_TYPE1_PROT:
753                 cmd->reftag_seed = cmd->t_task_lba;
754                 break;
755         case TARGET_DIF_TYPE0_PROT:
756                 /*
757                  * See if the fabric supports T10-PI, and the session has been
758                  * configured to allow export PROTECT=1 feature bit with backend
759                  * devices that don't support T10-PI.
760                  */
761                 fabric_prot = is_write ?
762                               !!(sp_ops & (TARGET_PROT_DOUT_PASS | TARGET_PROT_DOUT_STRIP)) :
763                               !!(sp_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DIN_INSERT));
764
765                 if (fabric_prot && cmd->se_sess->sess_prot_type) {
766                         pi_prot_type = cmd->se_sess->sess_prot_type;
767                         break;
768                 }
769                 if (!protect)
770                         return TCM_NO_SENSE;
771                 /* Fallthrough */
772         default:
773                 pr_err("Unable to determine pi_prot_type for CDB: 0x%02x "
774                        "PROTECT: 0x%02x\n", cmd->t_task_cdb[0], protect);
775                 return TCM_INVALID_CDB_FIELD;
776         }
777
778         if (sbc_set_prot_op_checks(protect, fabric_prot, pi_prot_type, is_write, cmd))
779                 return TCM_INVALID_CDB_FIELD;
780
781         cmd->prot_type = pi_prot_type;
782         cmd->prot_length = dev->prot_length * sectors;
783
784         /**
785          * In case protection information exists over the wire
786          * we modify command data length to describe pure data.
787          * The actual transfer length is data length + protection
788          * length
789          **/
790         if (protect)
791                 cmd->data_length = sectors * dev->dev_attrib.block_size;
792
793         pr_debug("%s: prot_type=%d, data_length=%d, prot_length=%d "
794                  "prot_op=%d prot_checks=%d\n",
795                  __func__, cmd->prot_type, cmd->data_length, cmd->prot_length,
796                  cmd->prot_op, cmd->prot_checks);
797
798         return TCM_NO_SENSE;
799 }
800
801 static int
802 sbc_check_dpofua(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb)
803 {
804         if (cdb[1] & 0x10) {
805                 /* see explanation in spc_emulate_modesense */
806                 if (!target_check_fua(dev)) {
807                         pr_err("Got CDB: 0x%02x with DPO bit set, but device"
808                                " does not advertise support for DPO\n", cdb[0]);
809                         return -EINVAL;
810                 }
811         }
812         if (cdb[1] & 0x8) {
813                 if (!target_check_fua(dev)) {
814                         pr_err("Got CDB: 0x%02x with FUA bit set, but device"
815                                " does not advertise support for FUA write\n",
816                                cdb[0]);
817                         return -EINVAL;
818                 }
819                 cmd->se_cmd_flags |= SCF_FUA;
820         }
821         return 0;
822 }
823
824 sense_reason_t
825 sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
826 {
827         struct se_device *dev = cmd->se_dev;
828         unsigned char *cdb = cmd->t_task_cdb;
829         unsigned int size;
830         u32 sectors = 0;
831         sense_reason_t ret;
832
833         cmd->protocol_data = ops;
834
835         switch (cdb[0]) {
836         case READ_6:
837                 sectors = transport_get_sectors_6(cdb);
838                 cmd->t_task_lba = transport_lba_21(cdb);
839                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
840                 cmd->execute_cmd = sbc_execute_rw;
841                 break;
842         case READ_10:
843                 sectors = transport_get_sectors_10(cdb);
844                 cmd->t_task_lba = transport_lba_32(cdb);
845
846                 if (sbc_check_dpofua(dev, cmd, cdb))
847                         return TCM_INVALID_CDB_FIELD;
848
849                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
850                 if (ret)
851                         return ret;
852
853                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
854                 cmd->execute_cmd = sbc_execute_rw;
855                 break;
856         case READ_12:
857                 sectors = transport_get_sectors_12(cdb);
858                 cmd->t_task_lba = transport_lba_32(cdb);
859
860                 if (sbc_check_dpofua(dev, cmd, cdb))
861                         return TCM_INVALID_CDB_FIELD;
862
863                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
864                 if (ret)
865                         return ret;
866
867                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
868                 cmd->execute_cmd = sbc_execute_rw;
869                 break;
870         case READ_16:
871                 sectors = transport_get_sectors_16(cdb);
872                 cmd->t_task_lba = transport_lba_64(cdb);
873
874                 if (sbc_check_dpofua(dev, cmd, cdb))
875                         return TCM_INVALID_CDB_FIELD;
876
877                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
878                 if (ret)
879                         return ret;
880
881                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
882                 cmd->execute_cmd = sbc_execute_rw;
883                 break;
884         case WRITE_6:
885                 sectors = transport_get_sectors_6(cdb);
886                 cmd->t_task_lba = transport_lba_21(cdb);
887                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
888                 cmd->execute_cmd = sbc_execute_rw;
889                 break;
890         case WRITE_10:
891         case WRITE_VERIFY:
892                 sectors = transport_get_sectors_10(cdb);
893                 cmd->t_task_lba = transport_lba_32(cdb);
894
895                 if (sbc_check_dpofua(dev, cmd, cdb))
896                         return TCM_INVALID_CDB_FIELD;
897
898                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
899                 if (ret)
900                         return ret;
901
902                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
903                 cmd->execute_cmd = sbc_execute_rw;
904                 break;
905         case WRITE_12:
906                 sectors = transport_get_sectors_12(cdb);
907                 cmd->t_task_lba = transport_lba_32(cdb);
908
909                 if (sbc_check_dpofua(dev, cmd, cdb))
910                         return TCM_INVALID_CDB_FIELD;
911
912                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
913                 if (ret)
914                         return ret;
915
916                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
917                 cmd->execute_cmd = sbc_execute_rw;
918                 break;
919         case WRITE_16:
920                 sectors = transport_get_sectors_16(cdb);
921                 cmd->t_task_lba = transport_lba_64(cdb);
922
923                 if (sbc_check_dpofua(dev, cmd, cdb))
924                         return TCM_INVALID_CDB_FIELD;
925
926                 ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
927                 if (ret)
928                         return ret;
929
930                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
931                 cmd->execute_cmd = sbc_execute_rw;
932                 break;
933         case XDWRITEREAD_10:
934                 if (cmd->data_direction != DMA_TO_DEVICE ||
935                     !(cmd->se_cmd_flags & SCF_BIDI))
936                         return TCM_INVALID_CDB_FIELD;
937                 sectors = transport_get_sectors_10(cdb);
938
939                 if (sbc_check_dpofua(dev, cmd, cdb))
940                         return TCM_INVALID_CDB_FIELD;
941
942                 cmd->t_task_lba = transport_lba_32(cdb);
943                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
944
945                 /*
946                  * Setup BIDI XOR callback to be run after I/O completion.
947                  */
948                 cmd->execute_cmd = sbc_execute_rw;
949                 cmd->transport_complete_callback = &xdreadwrite_callback;
950                 break;
951         case VARIABLE_LENGTH_CMD:
952         {
953                 u16 service_action = get_unaligned_be16(&cdb[8]);
954                 switch (service_action) {
955                 case XDWRITEREAD_32:
956                         sectors = transport_get_sectors_32(cdb);
957
958                         if (sbc_check_dpofua(dev, cmd, cdb))
959                                 return TCM_INVALID_CDB_FIELD;
960                         /*
961                          * Use WRITE_32 and READ_32 opcodes for the emulated
962                          * XDWRITE_READ_32 logic.
963                          */
964                         cmd->t_task_lba = transport_lba_64_ext(cdb);
965                         cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
966
967                         /*
968                          * Setup BIDI XOR callback to be run during after I/O
969                          * completion.
970                          */
971                         cmd->execute_cmd = sbc_execute_rw;
972                         cmd->transport_complete_callback = &xdreadwrite_callback;
973                         break;
974                 case WRITE_SAME_32:
975                         sectors = transport_get_sectors_32(cdb);
976                         if (!sectors) {
977                                 pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not"
978                                        " supported\n");
979                                 return TCM_INVALID_CDB_FIELD;
980                         }
981
982                         size = sbc_get_size(cmd, 1);
983                         cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
984
985                         ret = sbc_setup_write_same(cmd, cdb[10], ops);
986                         if (ret)
987                                 return ret;
988                         break;
989                 default:
990                         pr_err("VARIABLE_LENGTH_CMD service action"
991                                 " 0x%04x not supported\n", service_action);
992                         return TCM_UNSUPPORTED_SCSI_OPCODE;
993                 }
994                 break;
995         }
996         case COMPARE_AND_WRITE:
997                 sectors = cdb[13];
998                 /*
999                  * Currently enforce COMPARE_AND_WRITE for a single sector
1000                  */
1001                 if (sectors > 1) {
1002                         pr_err("COMPARE_AND_WRITE contains NoLB: %u greater"
1003                                " than 1\n", sectors);
1004                         return TCM_INVALID_CDB_FIELD;
1005                 }
1006                 if (sbc_check_dpofua(dev, cmd, cdb))
1007                         return TCM_INVALID_CDB_FIELD;
1008
1009                 /*
1010                  * Double size because we have two buffers, note that
1011                  * zero is not an error..
1012                  */
1013                 size = 2 * sbc_get_size(cmd, sectors);
1014                 cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
1015                 cmd->t_task_nolb = sectors;
1016                 cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB | SCF_COMPARE_AND_WRITE;
1017                 cmd->execute_cmd = sbc_compare_and_write;
1018                 cmd->transport_complete_callback = compare_and_write_callback;
1019                 break;
1020         case READ_CAPACITY:
1021                 size = READ_CAP_LEN;
1022                 cmd->execute_cmd = sbc_emulate_readcapacity;
1023                 break;
1024         case SERVICE_ACTION_IN_16:
1025                 switch (cmd->t_task_cdb[1] & 0x1f) {
1026                 case SAI_READ_CAPACITY_16:
1027                         cmd->execute_cmd = sbc_emulate_readcapacity_16;
1028                         break;
1029                 case SAI_REPORT_REFERRALS:
1030                         cmd->execute_cmd = target_emulate_report_referrals;
1031                         break;
1032                 default:
1033                         pr_err("Unsupported SA: 0x%02x\n",
1034                                 cmd->t_task_cdb[1] & 0x1f);
1035                         return TCM_INVALID_CDB_FIELD;
1036                 }
1037                 size = (cdb[10] << 24) | (cdb[11] << 16) |
1038                        (cdb[12] << 8) | cdb[13];
1039                 break;
1040         case SYNCHRONIZE_CACHE:
1041         case SYNCHRONIZE_CACHE_16:
1042                 if (cdb[0] == SYNCHRONIZE_CACHE) {
1043                         sectors = transport_get_sectors_10(cdb);
1044                         cmd->t_task_lba = transport_lba_32(cdb);
1045                 } else {
1046                         sectors = transport_get_sectors_16(cdb);
1047                         cmd->t_task_lba = transport_lba_64(cdb);
1048                 }
1049                 if (ops->execute_sync_cache) {
1050                         cmd->execute_cmd = ops->execute_sync_cache;
1051                         goto check_lba;
1052                 }
1053                 size = 0;
1054                 cmd->execute_cmd = sbc_emulate_noop;
1055                 break;
1056         case UNMAP:
1057                 if (!ops->execute_unmap)
1058                         return TCM_UNSUPPORTED_SCSI_OPCODE;
1059
1060                 if (!dev->dev_attrib.emulate_tpu) {
1061                         pr_err("Got UNMAP, but backend device has"
1062                                " emulate_tpu disabled\n");
1063                         return TCM_UNSUPPORTED_SCSI_OPCODE;
1064                 }
1065                 size = get_unaligned_be16(&cdb[7]);
1066                 cmd->execute_cmd = sbc_execute_unmap;
1067                 break;
1068         case WRITE_SAME_16:
1069                 sectors = transport_get_sectors_16(cdb);
1070                 if (!sectors) {
1071                         pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
1072                         return TCM_INVALID_CDB_FIELD;
1073                 }
1074
1075                 size = sbc_get_size(cmd, 1);
1076                 cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
1077
1078                 ret = sbc_setup_write_same(cmd, cdb[1], ops);
1079                 if (ret)
1080                         return ret;
1081                 break;
1082         case WRITE_SAME:
1083                 sectors = transport_get_sectors_10(cdb);
1084                 if (!sectors) {
1085                         pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
1086                         return TCM_INVALID_CDB_FIELD;
1087                 }
1088
1089                 size = sbc_get_size(cmd, 1);
1090                 cmd->t_task_lba = get_unaligned_be32(&cdb[2]);
1091
1092                 /*
1093                  * Follow sbcr26 with WRITE_SAME (10) and check for the existence
1094                  * of byte 1 bit 3 UNMAP instead of original reserved field
1095                  */
1096                 ret = sbc_setup_write_same(cmd, cdb[1], ops);
1097                 if (ret)
1098                         return ret;
1099                 break;
1100         case VERIFY:
1101         case VERIFY_16:
1102                 size = 0;
1103                 if (cdb[0] == VERIFY) {
1104                         sectors = transport_get_sectors_10(cdb);
1105                         cmd->t_task_lba = transport_lba_32(cdb);
1106                 } else {
1107                         sectors = transport_get_sectors_16(cdb);
1108                         cmd->t_task_lba = transport_lba_64(cdb);
1109                 }
1110                 cmd->execute_cmd = sbc_emulate_noop;
1111                 goto check_lba;
1112         case REZERO_UNIT:
1113         case SEEK_6:
1114         case SEEK_10:
1115                 /*
1116                  * There are still clients out there which use these old SCSI-2
1117                  * commands. This mainly happens when running VMs with legacy
1118                  * guest systems, connected via SCSI command pass-through to
1119                  * iSCSI targets. Make them happy and return status GOOD.
1120                  */
1121                 size = 0;
1122                 cmd->execute_cmd = sbc_emulate_noop;
1123                 break;
1124         case START_STOP:
1125                 size = 0;
1126                 cmd->execute_cmd = sbc_emulate_startstop;
1127                 break;
1128         default:
1129                 ret = spc_parse_cdb(cmd, &size);
1130                 if (ret)
1131                         return ret;
1132         }
1133
1134         /* reject any command that we don't have a handler for */
1135         if (!cmd->execute_cmd)
1136                 return TCM_UNSUPPORTED_SCSI_OPCODE;
1137
1138         if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
1139                 unsigned long long end_lba;
1140 check_lba:
1141                 end_lba = dev->transport->get_blocks(dev) + 1;
1142                 if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
1143                     ((cmd->t_task_lba + sectors) > end_lba)) {
1144                         pr_err("cmd exceeds last lba %llu "
1145                                 "(lba %llu, sectors %u)\n",
1146                                 end_lba, cmd->t_task_lba, sectors);
1147                         return TCM_ADDRESS_OUT_OF_RANGE;
1148                 }
1149
1150                 if (!(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE))
1151                         size = sbc_get_size(cmd, sectors);
1152         }
1153
1154         return target_cmd_size_check(cmd, size);
1155 }
1156 EXPORT_SYMBOL(sbc_parse_cdb);
1157
1158 u32 sbc_get_device_type(struct se_device *dev)
1159 {
1160         return TYPE_DISK;
1161 }
1162 EXPORT_SYMBOL(sbc_get_device_type);
1163
1164 static sense_reason_t
1165 sbc_execute_unmap(struct se_cmd *cmd)
1166 {
1167         struct sbc_ops *ops = cmd->protocol_data;
1168         struct se_device *dev = cmd->se_dev;
1169         unsigned char *buf, *ptr = NULL;
1170         sector_t lba;
1171         int size;
1172         u32 range;
1173         sense_reason_t ret = 0;
1174         int dl, bd_dl;
1175
1176         /* We never set ANC_SUP */
1177         if (cmd->t_task_cdb[1])
1178                 return TCM_INVALID_CDB_FIELD;
1179
1180         if (cmd->data_length == 0) {
1181                 target_complete_cmd(cmd, SAM_STAT_GOOD);
1182                 return 0;
1183         }
1184
1185         if (cmd->data_length < 8) {
1186                 pr_warn("UNMAP parameter list length %u too small\n",
1187                         cmd->data_length);
1188                 return TCM_PARAMETER_LIST_LENGTH_ERROR;
1189         }
1190
1191         buf = transport_kmap_data_sg(cmd);
1192         if (!buf)
1193                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
1194
1195         dl = get_unaligned_be16(&buf[0]);
1196         bd_dl = get_unaligned_be16(&buf[2]);
1197
1198         size = cmd->data_length - 8;
1199         if (bd_dl > size)
1200                 pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
1201                         cmd->data_length, bd_dl);
1202         else
1203                 size = bd_dl;
1204
1205         if (size / 16 > dev->dev_attrib.max_unmap_block_desc_count) {
1206                 ret = TCM_INVALID_PARAMETER_LIST;
1207                 goto err;
1208         }
1209
1210         /* First UNMAP block descriptor starts at 8 byte offset */
1211         ptr = &buf[8];
1212         pr_debug("UNMAP: Sub: %s Using dl: %u bd_dl: %u size: %u"
1213                 " ptr: %p\n", dev->transport->name, dl, bd_dl, size, ptr);
1214
1215         while (size >= 16) {
1216                 lba = get_unaligned_be64(&ptr[0]);
1217                 range = get_unaligned_be32(&ptr[8]);
1218                 pr_debug("UNMAP: Using lba: %llu and range: %u\n",
1219                                  (unsigned long long)lba, range);
1220
1221                 if (range > dev->dev_attrib.max_unmap_lba_count) {
1222                         ret = TCM_INVALID_PARAMETER_LIST;
1223                         goto err;
1224                 }
1225
1226                 if (lba + range > dev->transport->get_blocks(dev) + 1) {
1227                         ret = TCM_ADDRESS_OUT_OF_RANGE;
1228                         goto err;
1229                 }
1230
1231                 ret = ops->execute_unmap(cmd, lba, range);
1232                 if (ret)
1233                         goto err;
1234
1235                 ptr += 16;
1236                 size -= 16;
1237         }
1238
1239 err:
1240         transport_kunmap_data_sg(cmd);
1241         if (!ret)
1242                 target_complete_cmd(cmd, GOOD);
1243         return ret;
1244 }
1245
1246 void
1247 sbc_dif_generate(struct se_cmd *cmd)
1248 {
1249         struct se_device *dev = cmd->se_dev;
1250         struct t10_pi_tuple *sdt;
1251         struct scatterlist *dsg = cmd->t_data_sg, *psg;
1252         sector_t sector = cmd->t_task_lba;
1253         void *daddr, *paddr;
1254         int i, j, offset = 0;
1255         unsigned int block_size = dev->dev_attrib.block_size;
1256
1257         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
1258                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1259                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1260
1261                 for (j = 0; j < psg->length;
1262                                 j += sizeof(*sdt)) {
1263                         __u16 crc;
1264                         unsigned int avail;
1265
1266                         if (offset >= dsg->length) {
1267                                 offset -= dsg->length;
1268                                 kunmap_atomic(daddr - dsg->offset);
1269                                 dsg = sg_next(dsg);
1270                                 if (!dsg) {
1271                                         kunmap_atomic(paddr - psg->offset);
1272                                         return;
1273                                 }
1274                                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1275                         }
1276
1277                         sdt = paddr + j;
1278                         avail = min(block_size, dsg->length - offset);
1279                         crc = crc_t10dif(daddr + offset, avail);
1280                         if (avail < block_size) {
1281                                 kunmap_atomic(daddr - dsg->offset);
1282                                 dsg = sg_next(dsg);
1283                                 if (!dsg) {
1284                                         kunmap_atomic(paddr - psg->offset);
1285                                         return;
1286                                 }
1287                                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1288                                 offset = block_size - avail;
1289                                 crc = crc_t10dif_update(crc, daddr, offset);
1290                         } else {
1291                                 offset += block_size;
1292                         }
1293
1294                         sdt->guard_tag = cpu_to_be16(crc);
1295                         if (cmd->prot_type == TARGET_DIF_TYPE1_PROT)
1296                                 sdt->ref_tag = cpu_to_be32(sector & 0xffffffff);
1297                         sdt->app_tag = 0;
1298
1299                         pr_debug("DIF %s INSERT sector: %llu guard_tag: 0x%04x"
1300                                  " app_tag: 0x%04x ref_tag: %u\n",
1301                                  (cmd->data_direction == DMA_TO_DEVICE) ?
1302                                  "WRITE" : "READ", (unsigned long long)sector,
1303                                  sdt->guard_tag, sdt->app_tag,
1304                                  be32_to_cpu(sdt->ref_tag));
1305
1306                         sector++;
1307                 }
1308
1309                 kunmap_atomic(daddr - dsg->offset);
1310                 kunmap_atomic(paddr - psg->offset);
1311         }
1312 }
1313
1314 static sense_reason_t
1315 sbc_dif_v1_verify(struct se_cmd *cmd, struct t10_pi_tuple *sdt,
1316                   __u16 crc, sector_t sector, unsigned int ei_lba)
1317 {
1318         __be16 csum;
1319
1320         if (!(cmd->prot_checks & TARGET_DIF_CHECK_GUARD))
1321                 goto check_ref;
1322
1323         csum = cpu_to_be16(crc);
1324
1325         if (sdt->guard_tag != csum) {
1326                 pr_err("DIFv1 checksum failed on sector %llu guard tag 0x%04x"
1327                         " csum 0x%04x\n", (unsigned long long)sector,
1328                         be16_to_cpu(sdt->guard_tag), be16_to_cpu(csum));
1329                 return TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
1330         }
1331
1332 check_ref:
1333         if (!(cmd->prot_checks & TARGET_DIF_CHECK_REFTAG))
1334                 return 0;
1335
1336         if (cmd->prot_type == TARGET_DIF_TYPE1_PROT &&
1337             be32_to_cpu(sdt->ref_tag) != (sector & 0xffffffff)) {
1338                 pr_err("DIFv1 Type 1 reference failed on sector: %llu tag: 0x%08x"
1339                        " sector MSB: 0x%08x\n", (unsigned long long)sector,
1340                        be32_to_cpu(sdt->ref_tag), (u32)(sector & 0xffffffff));
1341                 return TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
1342         }
1343
1344         if (cmd->prot_type == TARGET_DIF_TYPE2_PROT &&
1345             be32_to_cpu(sdt->ref_tag) != ei_lba) {
1346                 pr_err("DIFv1 Type 2 reference failed on sector: %llu tag: 0x%08x"
1347                        " ei_lba: 0x%08x\n", (unsigned long long)sector,
1348                         be32_to_cpu(sdt->ref_tag), ei_lba);
1349                 return TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
1350         }
1351
1352         return 0;
1353 }
1354
1355 void sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
1356                        struct scatterlist *sg, int sg_off)
1357 {
1358         struct se_device *dev = cmd->se_dev;
1359         struct scatterlist *psg;
1360         void *paddr, *addr;
1361         unsigned int i, len, left;
1362         unsigned int offset = sg_off;
1363
1364         if (!sg)
1365                 return;
1366
1367         left = sectors * dev->prot_length;
1368
1369         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
1370                 unsigned int psg_len, copied = 0;
1371
1372                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1373                 psg_len = min(left, psg->length);
1374                 while (psg_len) {
1375                         len = min(psg_len, sg->length - offset);
1376                         addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
1377
1378                         if (read)
1379                                 memcpy(paddr + copied, addr, len);
1380                         else
1381                                 memcpy(addr, paddr + copied, len);
1382
1383                         left -= len;
1384                         offset += len;
1385                         copied += len;
1386                         psg_len -= len;
1387
1388                         kunmap_atomic(addr - sg->offset - offset);
1389
1390                         if (offset >= sg->length) {
1391                                 sg = sg_next(sg);
1392                                 offset = 0;
1393                         }
1394                 }
1395                 kunmap_atomic(paddr - psg->offset);
1396         }
1397 }
1398 EXPORT_SYMBOL(sbc_dif_copy_prot);
1399
1400 sense_reason_t
1401 sbc_dif_verify(struct se_cmd *cmd, sector_t start, unsigned int sectors,
1402                unsigned int ei_lba, struct scatterlist *psg, int psg_off)
1403 {
1404         struct se_device *dev = cmd->se_dev;
1405         struct t10_pi_tuple *sdt;
1406         struct scatterlist *dsg = cmd->t_data_sg;
1407         sector_t sector = start;
1408         void *daddr, *paddr;
1409         int i;
1410         sense_reason_t rc;
1411         int dsg_off = 0;
1412         unsigned int block_size = dev->dev_attrib.block_size;
1413
1414         for (; psg && sector < start + sectors; psg = sg_next(psg)) {
1415                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
1416                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1417
1418                 for (i = psg_off; i < psg->length &&
1419                                 sector < start + sectors;
1420                                 i += sizeof(*sdt)) {
1421                         __u16 crc;
1422                         unsigned int avail;
1423
1424                         if (dsg_off >= dsg->length) {
1425                                 dsg_off -= dsg->length;
1426                                 kunmap_atomic(daddr - dsg->offset);
1427                                 dsg = sg_next(dsg);
1428                                 if (!dsg) {
1429                                         kunmap_atomic(paddr - psg->offset);
1430                                         return 0;
1431                                 }
1432                                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1433                         }
1434
1435                         sdt = paddr + i;
1436
1437                         pr_debug("DIF READ sector: %llu guard_tag: 0x%04x"
1438                                  " app_tag: 0x%04x ref_tag: %u\n",
1439                                  (unsigned long long)sector, sdt->guard_tag,
1440                                  sdt->app_tag, be32_to_cpu(sdt->ref_tag));
1441
1442                         if (sdt->app_tag == cpu_to_be16(0xffff)) {
1443                                 dsg_off += block_size;
1444                                 goto next;
1445                         }
1446
1447                         avail = min(block_size, dsg->length - dsg_off);
1448                         crc = crc_t10dif(daddr + dsg_off, avail);
1449                         if (avail < block_size) {
1450                                 kunmap_atomic(daddr - dsg->offset);
1451                                 dsg = sg_next(dsg);
1452                                 if (!dsg) {
1453                                         kunmap_atomic(paddr - psg->offset);
1454                                         return 0;
1455                                 }
1456                                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
1457                                 dsg_off = block_size - avail;
1458                                 crc = crc_t10dif_update(crc, daddr, dsg_off);
1459                         } else {
1460                                 dsg_off += block_size;
1461                         }
1462
1463                         rc = sbc_dif_v1_verify(cmd, sdt, crc, sector, ei_lba);
1464                         if (rc) {
1465                                 kunmap_atomic(daddr - dsg->offset);
1466                                 kunmap_atomic(paddr - psg->offset);
1467                                 cmd->bad_sector = sector;
1468                                 return rc;
1469                         }
1470 next:
1471                         sector++;
1472                         ei_lba++;
1473                 }
1474
1475                 psg_off = 0;
1476                 kunmap_atomic(daddr - dsg->offset);
1477                 kunmap_atomic(paddr - psg->offset);
1478         }
1479
1480         return 0;
1481 }
1482 EXPORT_SYMBOL(sbc_dif_verify);