drivers/target/target_core_transport.c

   1 /*******************************************************************************
   2  * Filename:  target_core_transport.c
   3  *
   4  * This file contains the Generic Target Engine Core.
   5  *
   6  * Copyright (c) 2002, 2003, 2004, 2005 PyX Technologies, Inc.
   7  * Copyright (c) 2005, 2006, 2007 SBE, Inc.
   8  * Copyright (c) 2007-2010 Rising Tide Systems
   9  * Copyright (c) 2008-2010 Linux-iSCSI.org
  10  *
  11  * Nicholas A. Bellinger <nab@kernel.org>
  12  *
  13  * This program is free software; you can redistribute it and/or modify
  14  * it under the terms of the GNU General Public License as published by
  15  * the Free Software Foundation; either version 2 of the License, or
  16  * (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  26  *
  27  ******************************************************************************/
  28
  29 #include <linux/version.h>
  30 #include <linux/net.h>
  31 #include <linux/delay.h>
  32 #include <linux/string.h>
  33 #include <linux/timer.h>
  34 #include <linux/slab.h>
  35 #include <linux/blkdev.h>
  36 #include <linux/spinlock.h>
  37 #include <linux/kthread.h>
  38 #include <linux/in.h>
  39 #include <linux/cdrom.h>
  40 #include <asm/unaligned.h>
  41 #include <net/sock.h>
  42 #include <net/tcp.h>
  43 #include <scsi/scsi.h>
  44 #include <scsi/scsi_cmnd.h>
  45 #include <scsi/libsas.h> /* For TASK_ATTR_* */
  46
  47 #include <target/target_core_base.h>
  48 #include <target/target_core_device.h>
  49 #include <target/target_core_tmr.h>
  50 #include <target/target_core_tpg.h>
  51 #include <target/target_core_transport.h>
  52 #include <target/target_core_fabric_ops.h>
  53 #include <target/target_core_configfs.h>
  54
  55 #include "target_core_alua.h"
  56 #include "target_core_hba.h"
  57 #include "target_core_pr.h"
  58 #include "target_core_scdb.h"
  59 #include "target_core_ua.h"
  60
  61 /* #define DEBUG_CDB_HANDLER */
  62 #ifdef DEBUG_CDB_HANDLER
  63 #define DEBUG_CDB_H(x...) printk(KERN_INFO x)
  64 #else
  65 #define DEBUG_CDB_H(x...)
  66 #endif
  67
  68 /* #define DEBUG_CMD_MAP */
  69 #ifdef DEBUG_CMD_MAP
  70 #define DEBUG_CMD_M(x...) printk(KERN_INFO x)
  71 #else
  72 #define DEBUG_CMD_M(x...)
  73 #endif
  74
  75 /* #define DEBUG_MEM_ALLOC */
  76 #ifdef DEBUG_MEM_ALLOC
  77 #define DEBUG_MEM(x...) printk(KERN_INFO x)
  78 #else
  79 #define DEBUG_MEM(x...)
  80 #endif
  81
  82 /* #define DEBUG_MEM2_ALLOC */
  83 #ifdef DEBUG_MEM2_ALLOC
  84 #define DEBUG_MEM2(x...) printk(KERN_INFO x)
  85 #else
  86 #define DEBUG_MEM2(x...)
  87 #endif
  88
  89 /* #define DEBUG_SG_CALC */
  90 #ifdef DEBUG_SG_CALC
  91 #define DEBUG_SC(x...) printk(KERN_INFO x)
  92 #else
  93 #define DEBUG_SC(x...)
  94 #endif
  95
  96 /* #define DEBUG_SE_OBJ */
  97 #ifdef DEBUG_SE_OBJ
  98 #define DEBUG_SO(x...) printk(KERN_INFO x)
  99 #else
 100 #define DEBUG_SO(x...)
 101 #endif
 102
 103 /* #define DEBUG_CMD_VOL */
 104 #ifdef DEBUG_CMD_VOL
 105 #define DEBUG_VOL(x...) printk(KERN_INFO x)
 106 #else
 107 #define DEBUG_VOL(x...)
 108 #endif
 109
 110 /* #define DEBUG_CMD_STOP */
 111 #ifdef DEBUG_CMD_STOP
 112 #define DEBUG_CS(x...) printk(KERN_INFO x)
 113 #else
 114 #define DEBUG_CS(x...)
 115 #endif
 116
 117 /* #define DEBUG_PASSTHROUGH */
 118 #ifdef DEBUG_PASSTHROUGH
 119 #define DEBUG_PT(x...) printk(KERN_INFO x)
 120 #else
 121 #define DEBUG_PT(x...)
 122 #endif
 123
 124 /* #define DEBUG_TASK_STOP */
 125 #ifdef DEBUG_TASK_STOP
 126 #define DEBUG_TS(x...) printk(KERN_INFO x)
 127 #else
 128 #define DEBUG_TS(x...)
 129 #endif
 130
 131 /* #define DEBUG_TRANSPORT_STOP */
 132 #ifdef DEBUG_TRANSPORT_STOP
 133 #define DEBUG_TRANSPORT_S(x...) printk(KERN_INFO x)
 134 #else
 135 #define DEBUG_TRANSPORT_S(x...)
 136 #endif
 137
 138 /* #define DEBUG_TASK_FAILURE */
 139 #ifdef DEBUG_TASK_FAILURE
 140 #define DEBUG_TF(x...) printk(KERN_INFO x)
 141 #else
 142 #define DEBUG_TF(x...)
 143 #endif
 144
 145 /* #define DEBUG_DEV_OFFLINE */
 146 #ifdef DEBUG_DEV_OFFLINE
 147 #define DEBUG_DO(x...) printk(KERN_INFO x)
 148 #else
 149 #define DEBUG_DO(x...)
 150 #endif
 151
 152 /* #define DEBUG_TASK_STATE */
 153 #ifdef DEBUG_TASK_STATE
 154 #define DEBUG_TSTATE(x...) printk(KERN_INFO x)
 155 #else
 156 #define DEBUG_TSTATE(x...)
 157 #endif
 158
 159 /* #define DEBUG_STATUS_THR */
 160 #ifdef DEBUG_STATUS_THR
 161 #define DEBUG_ST(x...) printk(KERN_INFO x)
 162 #else
 163 #define DEBUG_ST(x...)
 164 #endif
 165
 166 /* #define DEBUG_TASK_TIMEOUT */
 167 #ifdef DEBUG_TASK_TIMEOUT
 168 #define DEBUG_TT(x...) printk(KERN_INFO x)
 169 #else
 170 #define DEBUG_TT(x...)
 171 #endif
 172
 173 /* #define DEBUG_GENERIC_REQUEST_FAILURE */
 174 #ifdef DEBUG_GENERIC_REQUEST_FAILURE
 175 #define DEBUG_GRF(x...) printk(KERN_INFO x)
 176 #else
 177 #define DEBUG_GRF(x...)
 178 #endif
 179
 180 /* #define DEBUG_SAM_TASK_ATTRS */
 181 #ifdef DEBUG_SAM_TASK_ATTRS
 182 #define DEBUG_STA(x...) printk(KERN_INFO x)
 183 #else
 184 #define DEBUG_STA(x...)
 185 #endif
 186
 187 struct se_global *se_global;
 188
 189 static struct kmem_cache *se_cmd_cache;
 190 static struct kmem_cache *se_sess_cache;
 191 struct kmem_cache *se_tmr_req_cache;
 192 struct kmem_cache *se_ua_cache;
 193 struct kmem_cache *se_mem_cache;
 194 struct kmem_cache *t10_pr_reg_cache;
 195 struct kmem_cache *t10_alua_lu_gp_cache;
 196 struct kmem_cache *t10_alua_lu_gp_mem_cache;
 197 struct kmem_cache *t10_alua_tg_pt_gp_cache;
 198 struct kmem_cache *t10_alua_tg_pt_gp_mem_cache;
 199
 200 /* Used for transport_dev_get_map_*() */
 201 typedef int (*map_func_t)(struct se_task *, u32);
 202
 203 static int transport_generic_write_pending(struct se_cmd *);
 204 static int transport_processing_thread(void *);
 205 static int __transport_execute_tasks(struct se_device *dev);
 206 static void transport_complete_task_attr(struct se_cmd *cmd);
 207 static void transport_direct_request_timeout(struct se_cmd *cmd);
 208 static void transport_free_dev_tasks(struct se_cmd *cmd);
 209 static u32 transport_generic_get_cdb_count(struct se_cmd *cmd,
 210                 unsigned long long starting_lba, u32 sectors,
 211                 enum dma_data_direction data_direction,
 212                 struct list_head *mem_list, int set_counts);
 213 static int transport_generic_get_mem(struct se_cmd *cmd, u32 length,
 214                 u32 dma_size);
 215 static int transport_generic_remove(struct se_cmd *cmd,
 216                 int release_to_pool, int session_reinstatement);
 217 static int transport_get_sectors(struct se_cmd *cmd);
 218 static struct list_head *transport_init_se_mem_list(void);
 219 static int transport_map_sg_to_mem(struct se_cmd *cmd,
 220                 struct list_head *se_mem_list, void *in_mem,
 221                 u32 *se_mem_cnt);
 222 static void transport_memcpy_se_mem_read_contig(struct se_cmd *cmd,
 223                 unsigned char *dst, struct list_head *se_mem_list);
 224 static void transport_release_fe_cmd(struct se_cmd *cmd);
 225 static void transport_remove_cmd_from_queue(struct se_cmd *cmd,
 226                 struct se_queue_obj *qobj);
 227 static int transport_set_sense_codes(struct se_cmd *cmd, u8 asc, u8 ascq);
 228 static void transport_stop_all_task_timers(struct se_cmd *cmd);
 229
 230 int init_se_global(void)
 231 {
 232         struct se_global *global;
 233
 234         global = kzalloc(sizeof(struct se_global), GFP_KERNEL);
 235         if (!(global)) {
 236                 printk(KERN_ERR "Unable to allocate memory for struct se_global\n");
 237                 return -1;
 238         }
 239
 240         INIT_LIST_HEAD(&global->g_lu_gps_list);
 241         INIT_LIST_HEAD(&global->g_se_tpg_list);
 242         INIT_LIST_HEAD(&global->g_hba_list);
 243         INIT_LIST_HEAD(&global->g_se_dev_list);
 244         spin_lock_init(&global->g_device_lock);
 245         spin_lock_init(&global->hba_lock);
 246         spin_lock_init(&global->se_tpg_lock);
 247         spin_lock_init(&global->lu_gps_lock);
 248         spin_lock_init(&global->plugin_class_lock);
 249
 250         se_cmd_cache = kmem_cache_create("se_cmd_cache",
 251                         sizeof(struct se_cmd), __alignof__(struct se_cmd), 0, NULL);
 252         if (!(se_cmd_cache)) {
 253                 printk(KERN_ERR "kmem_cache_create for struct se_cmd failed\n");
 254                 goto out;
 255         }
 256         se_tmr_req_cache = kmem_cache_create("se_tmr_cache",
 257                         sizeof(struct se_tmr_req), __alignof__(struct se_tmr_req),
 258                         0, NULL);
 259         if (!(se_tmr_req_cache)) {
 260                 printk(KERN_ERR "kmem_cache_create() for struct se_tmr_req"
 261                                 " failed\n");
 262                 goto out;
 263         }
 264         se_sess_cache = kmem_cache_create("se_sess_cache",
 265                         sizeof(struct se_session), __alignof__(struct se_session),
 266                         0, NULL);
 267         if (!(se_sess_cache)) {
 268                 printk(KERN_ERR "kmem_cache_create() for struct se_session"
 269                                 " failed\n");
 270                 goto out;
 271         }
 272         se_ua_cache = kmem_cache_create("se_ua_cache",
 273                         sizeof(struct se_ua), __alignof__(struct se_ua),
 274                         0, NULL);
 275         if (!(se_ua_cache)) {
 276                 printk(KERN_ERR "kmem_cache_create() for struct se_ua failed\n");
 277                 goto out;
 278         }
 279         se_mem_cache = kmem_cache_create("se_mem_cache",
 280                         sizeof(struct se_mem), __alignof__(struct se_mem), 0, NULL);
 281         if (!(se_mem_cache)) {
 282                 printk(KERN_ERR "kmem_cache_create() for struct se_mem failed\n");
 283                 goto out;
 284         }
 285         t10_pr_reg_cache = kmem_cache_create("t10_pr_reg_cache",
 286                         sizeof(struct t10_pr_registration),
 287                         __alignof__(struct t10_pr_registration), 0, NULL);
 288         if (!(t10_pr_reg_cache)) {
 289                 printk(KERN_ERR "kmem_cache_create() for struct t10_pr_registration"
 290                                 " failed\n");
 291                 goto out;
 292         }
 293         t10_alua_lu_gp_cache = kmem_cache_create("t10_alua_lu_gp_cache",
 294                         sizeof(struct t10_alua_lu_gp), __alignof__(struct t10_alua_lu_gp),
 295                         0, NULL);
 296         if (!(t10_alua_lu_gp_cache)) {
 297                 printk(KERN_ERR "kmem_cache_create() for t10_alua_lu_gp_cache"
 298                                 " failed\n");
 299                 goto out;
 300         }
 301         t10_alua_lu_gp_mem_cache = kmem_cache_create("t10_alua_lu_gp_mem_cache",
 302                         sizeof(struct t10_alua_lu_gp_member),
 303                         __alignof__(struct t10_alua_lu_gp_member), 0, NULL);
 304         if (!(t10_alua_lu_gp_mem_cache)) {
 305                 printk(KERN_ERR "kmem_cache_create() for t10_alua_lu_gp_mem_"
 306                                 "cache failed\n");
 307                 goto out;
 308         }
 309         t10_alua_tg_pt_gp_cache = kmem_cache_create("t10_alua_tg_pt_gp_cache",
 310                         sizeof(struct t10_alua_tg_pt_gp),
 311                         __alignof__(struct t10_alua_tg_pt_gp), 0, NULL);
 312         if (!(t10_alua_tg_pt_gp_cache)) {
 313                 printk(KERN_ERR "kmem_cache_create() for t10_alua_tg_pt_gp_"
 314                                 "cache failed\n");
 315                 goto out;
 316         }
 317         t10_alua_tg_pt_gp_mem_cache = kmem_cache_create(
 318                         "t10_alua_tg_pt_gp_mem_cache",
 319                         sizeof(struct t10_alua_tg_pt_gp_member),
 320                         __alignof__(struct t10_alua_tg_pt_gp_member),
 321                         0, NULL);
 322         if (!(t10_alua_tg_pt_gp_mem_cache)) {
 323                 printk(KERN_ERR "kmem_cache_create() for t10_alua_tg_pt_gp_"
 324                                 "mem_t failed\n");
 325                 goto out;
 326         }
 327
 328         se_global = global;
 329
 330         return 0;
 331 out:
 332         if (se_cmd_cache)
 333                 kmem_cache_destroy(se_cmd_cache);
 334         if (se_tmr_req_cache)
 335                 kmem_cache_destroy(se_tmr_req_cache);
 336         if (se_sess_cache)
 337                 kmem_cache_destroy(se_sess_cache);
 338         if (se_ua_cache)
 339                 kmem_cache_destroy(se_ua_cache);
 340         if (se_mem_cache)
 341                 kmem_cache_destroy(se_mem_cache);
 342         if (t10_pr_reg_cache)
 343                 kmem_cache_destroy(t10_pr_reg_cache);
 344         if (t10_alua_lu_gp_cache)
 345                 kmem_cache_destroy(t10_alua_lu_gp_cache);
 346         if (t10_alua_lu_gp_mem_cache)
 347                 kmem_cache_destroy(t10_alua_lu_gp_mem_cache);
 348         if (t10_alua_tg_pt_gp_cache)
 349                 kmem_cache_destroy(t10_alua_tg_pt_gp_cache);
 350         if (t10_alua_tg_pt_gp_mem_cache)
 351                 kmem_cache_destroy(t10_alua_tg_pt_gp_mem_cache);
 352         kfree(global);
 353         return -1;
 354 }
 355
 356 void release_se_global(void)
 357 {
 358         struct se_global *global;
 359
 360         global = se_global;
 361         if (!(global))
 362                 return;
 363
 364         kmem_cache_destroy(se_cmd_cache);
 365         kmem_cache_destroy(se_tmr_req_cache);
 366         kmem_cache_destroy(se_sess_cache);
 367         kmem_cache_destroy(se_ua_cache);
 368         kmem_cache_destroy(se_mem_cache);
 369         kmem_cache_destroy(t10_pr_reg_cache);
 370         kmem_cache_destroy(t10_alua_lu_gp_cache);
 371         kmem_cache_destroy(t10_alua_lu_gp_mem_cache);
 372         kmem_cache_destroy(t10_alua_tg_pt_gp_cache);
 373         kmem_cache_destroy(t10_alua_tg_pt_gp_mem_cache);
 374         kfree(global);
 375
 376         se_global = NULL;
 377 }
 378
 379 /* SCSI statistics table index */
 380 static struct scsi_index_table scsi_index_table;
 381
 382 /*
 383  * Initialize the index table for allocating unique row indexes to various mib
 384  * tables.
 385  */
 386 void init_scsi_index_table(void)
 387 {
 388         memset(&scsi_index_table, 0, sizeof(struct scsi_index_table));
 389         spin_lock_init(&scsi_index_table.lock);
 390 }
 391
 392 /*
 393  * Allocate a new row index for the entry type specified
 394  */
 395 u32 scsi_get_new_index(scsi_index_t type)
 396 {
 397         u32 new_index;
 398
 399         if ((type < 0) || (type >= SCSI_INDEX_TYPE_MAX)) {
 400                 printk(KERN_ERR "Invalid index type %d\n", type);
 401                 return -EINVAL;
 402         }
 403
 404         spin_lock(&scsi_index_table.lock);
 405         new_index = ++scsi_index_table.scsi_mib_index[type];
 406         if (new_index == 0)
 407                 new_index = ++scsi_index_table.scsi_mib_index[type];
 408         spin_unlock(&scsi_index_table.lock);
 409
 410         return new_index;
 411 }
 412
 413 void transport_init_queue_obj(struct se_queue_obj *qobj)
 414 {
 415         atomic_set(&qobj->queue_cnt, 0);
 416         INIT_LIST_HEAD(&qobj->qobj_list);
 417         init_waitqueue_head(&qobj->thread_wq);
 418         spin_lock_init(&qobj->cmd_queue_lock);
 419 }
 420 EXPORT_SYMBOL(transport_init_queue_obj);
 421
 422 static int transport_subsystem_reqmods(void)
 423 {
 424         int ret;
 425
 426         ret = request_module("target_core_iblock");
 427         if (ret != 0)
 428                 printk(KERN_ERR "Unable to load target_core_iblock\n");
 429
 430         ret = request_module("target_core_file");
 431         if (ret != 0)
 432                 printk(KERN_ERR "Unable to load target_core_file\n");
 433
 434         ret = request_module("target_core_pscsi");
 435         if (ret != 0)
 436                 printk(KERN_ERR "Unable to load target_core_pscsi\n");
 437
 438         ret = request_module("target_core_stgt");
 439         if (ret != 0)
 440                 printk(KERN_ERR "Unable to load target_core_stgt\n");
 441
 442         return 0;
 443 }
 444
 445 int transport_subsystem_check_init(void)
 446 {
 447         if (se_global->g_sub_api_initialized)
 448                 return 0;
 449         /*
 450          * Request the loading of known TCM subsystem plugins..
 451          */
 452         if (transport_subsystem_reqmods() < 0)
 453                 return -1;
 454
 455         se_global->g_sub_api_initialized = 1;
 456         return 0;
 457 }
 458
 459 struct se_session *transport_init_session(void)
 460 {
 461         struct se_session *se_sess;
 462
 463         se_sess = kmem_cache_zalloc(se_sess_cache, GFP_KERNEL);
 464         if (!(se_sess)) {
 465                 printk(KERN_ERR "Unable to allocate struct se_session from"
 466                                 " se_sess_cache\n");
 467                 return ERR_PTR(-ENOMEM);
 468         }
 469         INIT_LIST_HEAD(&se_sess->sess_list);
 470         INIT_LIST_HEAD(&se_sess->sess_acl_list);
 471
 472         return se_sess;
 473 }
 474 EXPORT_SYMBOL(transport_init_session);
 475
 476 /*
 477  * Called with spin_lock_bh(&struct se_portal_group->session_lock called.
 478  */
 479 void __transport_register_session(
 480         struct se_portal_group *se_tpg,
 481         struct se_node_acl *se_nacl,
 482         struct se_session *se_sess,
 483         void *fabric_sess_ptr)
 484 {
 485         unsigned char buf[PR_REG_ISID_LEN];
 486
 487         se_sess->se_tpg = se_tpg;
 488         se_sess->fabric_sess_ptr = fabric_sess_ptr;
 489         /*
 490          * Used by struct se_node_acl's under ConfigFS to locate active se_session-t
 491          *
 492          * Only set for struct se_session's that will actually be moving I/O.
 493          * eg: *NOT* discovery sessions.
 494          */
 495         if (se_nacl) {
 496                 /*
 497                  * If the fabric module supports an ISID based TransportID,
 498                  * save this value in binary from the fabric I_T Nexus now.
 499                  */
 500                 if (TPG_TFO(se_tpg)->sess_get_initiator_sid != NULL) {
 501                         memset(&buf[0], 0, PR_REG_ISID_LEN);
 502                         TPG_TFO(se_tpg)->sess_get_initiator_sid(se_sess,
 503                                         &buf[0], PR_REG_ISID_LEN);
 504                         se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]);
 505                 }
 506                 spin_lock_irq(&se_nacl->nacl_sess_lock);
 507                 /*
 508                  * The se_nacl->nacl_sess pointer will be set to the
 509                  * last active I_T Nexus for each struct se_node_acl.
 510                  */
 511                 se_nacl->nacl_sess = se_sess;
 512
 513                 list_add_tail(&se_sess->sess_acl_list,
 514                               &se_nacl->acl_sess_list);
 515                 spin_unlock_irq(&se_nacl->nacl_sess_lock);
 516         }
 517         list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list);
 518
 519         printk(KERN_INFO "TARGET_CORE[%s]: Registered fabric_sess_ptr: %p\n",
 520                 TPG_TFO(se_tpg)->get_fabric_name(), se_sess->fabric_sess_ptr);
 521 }
 522 EXPORT_SYMBOL(__transport_register_session);
 523
 524 void transport_register_session(
 525         struct se_portal_group *se_tpg,
 526         struct se_node_acl *se_nacl,
 527         struct se_session *se_sess,
 528         void *fabric_sess_ptr)
 529 {
 530         spin_lock_bh(&se_tpg->session_lock);
 531         __transport_register_session(se_tpg, se_nacl, se_sess, fabric_sess_ptr);
 532         spin_unlock_bh(&se_tpg->session_lock);
 533 }
 534 EXPORT_SYMBOL(transport_register_session);
 535
 536 void transport_deregister_session_configfs(struct se_session *se_sess)
 537 {
 538         struct se_node_acl *se_nacl;
 539
 540         /*
 541          * Used by struct se_node_acl's under ConfigFS to locate active struct se_session
 542          */
 543         se_nacl = se_sess->se_node_acl;
 544         if ((se_nacl)) {
 545                 spin_lock_irq(&se_nacl->nacl_sess_lock);
 546                 list_del(&se_sess->sess_acl_list);
 547                 /*
 548                  * If the session list is empty, then clear the pointer.
 549                  * Otherwise, set the struct se_session pointer from the tail
 550                  * element of the per struct se_node_acl active session list.
 551                  */
 552                 if (list_empty(&se_nacl->acl_sess_list))
 553                         se_nacl->nacl_sess = NULL;
 554                 else {
 555                         se_nacl->nacl_sess = container_of(
 556                                         se_nacl->acl_sess_list.prev,
 557                                         struct se_session, sess_acl_list);
 558                 }
 559                 spin_unlock_irq(&se_nacl->nacl_sess_lock);
 560         }
 561 }
 562 EXPORT_SYMBOL(transport_deregister_session_configfs);
 563
 564 void transport_free_session(struct se_session *se_sess)
 565 {
 566         kmem_cache_free(se_sess_cache, se_sess);
 567 }
 568 EXPORT_SYMBOL(transport_free_session);
 569
 570 void transport_deregister_session(struct se_session *se_sess)
 571 {
 572         struct se_portal_group *se_tpg = se_sess->se_tpg;
 573         struct se_node_acl *se_nacl;
 574
 575         if (!(se_tpg)) {
 576                 transport_free_session(se_sess);
 577                 return;
 578         }
 579
 580         spin_lock_bh(&se_tpg->session_lock);
 581         list_del(&se_sess->sess_list);
 582         se_sess->se_tpg = NULL;
 583         se_sess->fabric_sess_ptr = NULL;
 584         spin_unlock_bh(&se_tpg->session_lock);
 585
 586         /*
 587          * Determine if we need to do extra work for this initiator node's
 588          * struct se_node_acl if it had been previously dynamically generated.
 589          */
 590         se_nacl = se_sess->se_node_acl;
 591         if ((se_nacl)) {
 592                 spin_lock_bh(&se_tpg->acl_node_lock);
 593                 if (se_nacl->dynamic_node_acl) {
 594                         if (!(TPG_TFO(se_tpg)->tpg_check_demo_mode_cache(
 595                                         se_tpg))) {
 596                                 list_del(&se_nacl->acl_list);
 597                                 se_tpg->num_node_acls--;
 598                                 spin_unlock_bh(&se_tpg->acl_node_lock);
 599
 600                                 core_tpg_wait_for_nacl_pr_ref(se_nacl);
 601                                 core_free_device_list_for_node(se_nacl, se_tpg);
 602                                 TPG_TFO(se_tpg)->tpg_release_fabric_acl(se_tpg,
 603                                                 se_nacl);
 604                                 spin_lock_bh(&se_tpg->acl_node_lock);
 605                         }
 606                 }
 607                 spin_unlock_bh(&se_tpg->acl_node_lock);
 608         }
 609
 610         transport_free_session(se_sess);
 611
 612         printk(KERN_INFO "TARGET_CORE[%s]: Deregistered fabric_sess\n",
 613                 TPG_TFO(se_tpg)->get_fabric_name());
 614 }
 615 EXPORT_SYMBOL(transport_deregister_session);
 616
 617 /*
 618  * Called with T_TASK(cmd)->t_state_lock held.
 619  */
 620 static void transport_all_task_dev_remove_state(struct se_cmd *cmd)
 621 {
 622         struct se_device *dev;
 623         struct se_task *task;
 624         unsigned long flags;
 625
 626         if (!T_TASK(cmd))
 627                 return;
 628
 629         list_for_each_entry(task, &T_TASK(cmd)->t_task_list, t_list) {
 630                 dev = task->se_dev;
 631                 if (!(dev))
 632                         continue;
 633
 634                 if (atomic_read(&task->task_active))
 635                         continue;
 636
 637                 if (!(atomic_read(&task->task_state_active)))
 638                         continue;
 639
 640                 spin_lock_irqsave(&dev->execute_task_lock, flags);
 641                 list_del(&task->t_state_list);
 642                 DEBUG_TSTATE("Removed ITT: 0x%08x dev: %p task[%p]\n",
 643                         CMD_TFO(cmd)->tfo_get_task_tag(cmd), dev, task);
 644                 spin_unlock_irqrestore(&dev->execute_task_lock, flags);
 645
 646                 atomic_set(&task->task_state_active, 0);
 647                 atomic_dec(&T_TASK(cmd)->t_task_cdbs_ex_left);
 648         }
 649 }
 650
 651 /*      transport_cmd_check_stop():
 652  *
 653  *      'transport_off = 1' determines if t_transport_active should be cleared.
 654  *      'transport_off = 2' determines if task_dev_state should be removed.
 655  *
 656  *      A non-zero u8 t_state sets cmd->t_state.
 657  *      Returns 1 when command is stopped, else 0.
 658  */
 659 static int transport_cmd_check_stop(
 660         struct se_cmd *cmd,
 661         int transport_off,
 662         u8 t_state)
 663 {
 664         unsigned long flags;
 665
 666         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
 667         /*
 668          * Determine if IOCTL context caller in requesting the stopping of this
 669          * command for LUN shutdown purposes.
 670          */
 671         if (atomic_read(&T_TASK(cmd)->transport_lun_stop)) {
 672                 DEBUG_CS("%s:%d atomic_read(&T_TASK(cmd)->transport_lun_stop)"
 673                         " == TRUE for ITT: 0x%08x\n", __func__, __LINE__,
 674                         CMD_TFO(cmd)->get_task_tag(cmd));
 675
 676                 cmd->deferred_t_state = cmd->t_state;
 677                 cmd->t_state = TRANSPORT_DEFERRED_CMD;
 678                 atomic_set(&T_TASK(cmd)->t_transport_active, 0);
 679                 if (transport_off == 2)
 680                         transport_all_task_dev_remove_state(cmd);
 681                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 682
 683                 complete(&T_TASK(cmd)->transport_lun_stop_comp);
 684                 return 1;
 685         }
 686         /*
 687          * Determine if frontend context caller is requesting the stopping of
 688          * this command for frontend excpections.
 689          */
 690         if (atomic_read(&T_TASK(cmd)->t_transport_stop)) {
 691                 DEBUG_CS("%s:%d atomic_read(&T_TASK(cmd)->t_transport_stop) =="
 692                         " TRUE for ITT: 0x%08x\n", __func__, __LINE__,
 693                         CMD_TFO(cmd)->get_task_tag(cmd));
 694
 695                 cmd->deferred_t_state = cmd->t_state;
 696                 cmd->t_state = TRANSPORT_DEFERRED_CMD;
 697                 if (transport_off == 2)
 698                         transport_all_task_dev_remove_state(cmd);
 699
 700                 /*
 701                  * Clear struct se_cmd->se_lun before the transport_off == 2 handoff
 702                  * to FE.
 703                  */
 704                 if (transport_off == 2)
 705                         cmd->se_lun = NULL;
 706                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 707
 708                 complete(&T_TASK(cmd)->t_transport_stop_comp);
 709                 return 1;
 710         }
 711         if (transport_off) {
 712                 atomic_set(&T_TASK(cmd)->t_transport_active, 0);
 713                 if (transport_off == 2) {
 714                         transport_all_task_dev_remove_state(cmd);
 715                         /*
 716                          * Clear struct se_cmd->se_lun before the transport_off == 2
 717                          * handoff to fabric module.
 718                          */
 719                         cmd->se_lun = NULL;
 720                         /*
 721                          * Some fabric modules like tcm_loop can release
 722                          * their internally allocated I/O refrence now and
 723                          * struct se_cmd now.
 724                          */
 725                         if (CMD_TFO(cmd)->check_stop_free != NULL) {
 726                                 spin_unlock_irqrestore(
 727                                         &T_TASK(cmd)->t_state_lock, flags);
 728
 729                                 CMD_TFO(cmd)->check_stop_free(cmd);
 730                                 return 1;
 731                         }
 732                 }
 733                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 734
 735                 return 0;
 736         } else if (t_state)
 737                 cmd->t_state = t_state;
 738         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 739
 740         return 0;
 741 }
 742
 743 static int transport_cmd_check_stop_to_fabric(struct se_cmd *cmd)
 744 {
 745         return transport_cmd_check_stop(cmd, 2, 0);
 746 }
 747
 748 static void transport_lun_remove_cmd(struct se_cmd *cmd)
 749 {
 750         struct se_lun *lun = SE_LUN(cmd);
 751         unsigned long flags;
 752
 753         if (!lun)
 754                 return;
 755
 756         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
 757         if (!(atomic_read(&T_TASK(cmd)->transport_dev_active))) {
 758                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 759                 goto check_lun;
 760         }
 761         atomic_set(&T_TASK(cmd)->transport_dev_active, 0);
 762         transport_all_task_dev_remove_state(cmd);
 763         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 764
 765         transport_free_dev_tasks(cmd);
 766
 767 check_lun:
 768         spin_lock_irqsave(&lun->lun_cmd_lock, flags);
 769         if (atomic_read(&T_TASK(cmd)->transport_lun_active)) {
 770                 list_del(&cmd->se_lun_list);
 771                 atomic_set(&T_TASK(cmd)->transport_lun_active, 0);
 772 #if 0
 773                 printk(KERN_INFO "Removed ITT: 0x%08x from LUN LIST[%d]\n"
 774                         CMD_TFO(cmd)->get_task_tag(cmd), lun->unpacked_lun);
 775 #endif
 776         }
 777         spin_unlock_irqrestore(&lun->lun_cmd_lock, flags);
 778 }
 779
 780 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 781 {
 782         transport_remove_cmd_from_queue(cmd, SE_DEV(cmd)->dev_queue_obj);
 783         transport_lun_remove_cmd(cmd);
 784
 785         if (transport_cmd_check_stop_to_fabric(cmd))
 786                 return;
 787         if (remove)
 788                 transport_generic_remove(cmd, 0, 0);
 789 }
 790
 791 void transport_cmd_finish_abort_tmr(struct se_cmd *cmd)
 792 {
 793         transport_remove_cmd_from_queue(cmd, SE_DEV(cmd)->dev_queue_obj);
 794
 795         if (transport_cmd_check_stop_to_fabric(cmd))
 796                 return;
 797
 798         transport_generic_remove(cmd, 0, 0);
 799 }
 800
 801 static int transport_add_cmd_to_queue(
 802         struct se_cmd *cmd,
 803         int t_state)
 804 {
 805         struct se_device *dev = cmd->se_dev;
 806         struct se_queue_obj *qobj = dev->dev_queue_obj;
 807         struct se_queue_req *qr;
 808         unsigned long flags;
 809
 810         qr = kzalloc(sizeof(struct se_queue_req), GFP_ATOMIC);
 811         if (!(qr)) {
 812                 printk(KERN_ERR "Unable to allocate memory for"
 813                                 " struct se_queue_req\n");
 814                 return -1;
 815         }
 816         INIT_LIST_HEAD(&qr->qr_list);
 817
 818         qr->cmd = (void *)cmd;
 819         qr->state = t_state;
 820
 821         if (t_state) {
 822                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
 823                 cmd->t_state = t_state;
 824                 atomic_set(&T_TASK(cmd)->t_transport_active, 1);
 825                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 826         }
 827
 828         spin_lock_irqsave(&qobj->cmd_queue_lock, flags);
 829         list_add_tail(&qr->qr_list, &qobj->qobj_list);
 830         atomic_inc(&T_TASK(cmd)->t_transport_queue_active);
 831         spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
 832
 833         atomic_inc(&qobj->queue_cnt);
 834         wake_up_interruptible(&qobj->thread_wq);
 835         return 0;
 836 }
 837
 838 /*
 839  * Called with struct se_queue_obj->cmd_queue_lock held.
 840  */
 841 static struct se_queue_req *
 842 __transport_get_qr_from_queue(struct se_queue_obj *qobj)
 843 {
 844         struct se_cmd *cmd;
 845         struct se_queue_req *qr = NULL;
 846
 847         if (list_empty(&qobj->qobj_list))
 848                 return NULL;
 849
 850         list_for_each_entry(qr, &qobj->qobj_list, qr_list)
 851                 break;
 852
 853         if (qr->cmd) {
 854                 cmd = (struct se_cmd *)qr->cmd;
 855                 atomic_dec(&T_TASK(cmd)->t_transport_queue_active);
 856         }
 857         list_del(&qr->qr_list);
 858         atomic_dec(&qobj->queue_cnt);
 859
 860         return qr;
 861 }
 862
 863 static struct se_queue_req *
 864 transport_get_qr_from_queue(struct se_queue_obj *qobj)
 865 {
 866         struct se_cmd *cmd;
 867         struct se_queue_req *qr;
 868         unsigned long flags;
 869
 870         spin_lock_irqsave(&qobj->cmd_queue_lock, flags);
 871         if (list_empty(&qobj->qobj_list)) {
 872                 spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
 873                 return NULL;
 874         }
 875
 876         list_for_each_entry(qr, &qobj->qobj_list, qr_list)
 877                 break;
 878
 879         if (qr->cmd) {
 880                 cmd = (struct se_cmd *)qr->cmd;
 881                 atomic_dec(&T_TASK(cmd)->t_transport_queue_active);
 882         }
 883         list_del(&qr->qr_list);
 884         atomic_dec(&qobj->queue_cnt);
 885         spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
 886
 887         return qr;
 888 }
 889
 890 static void transport_remove_cmd_from_queue(struct se_cmd *cmd,
 891                 struct se_queue_obj *qobj)
 892 {
 893         struct se_cmd *q_cmd;
 894         struct se_queue_req *qr = NULL, *qr_p = NULL;
 895         unsigned long flags;
 896
 897         spin_lock_irqsave(&qobj->cmd_queue_lock, flags);
 898         if (!(atomic_read(&T_TASK(cmd)->t_transport_queue_active))) {
 899                 spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
 900                 return;
 901         }
 902
 903         list_for_each_entry_safe(qr, qr_p, &qobj->qobj_list, qr_list) {
 904                 q_cmd = (struct se_cmd *)qr->cmd;
 905                 if (q_cmd != cmd)
 906                         continue;
 907
 908                 atomic_dec(&T_TASK(q_cmd)->t_transport_queue_active);
 909                 atomic_dec(&qobj->queue_cnt);
 910                 list_del(&qr->qr_list);
 911                 kfree(qr);
 912         }
 913         spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
 914
 915         if (atomic_read(&T_TASK(cmd)->t_transport_queue_active)) {
 916                 printk(KERN_ERR "ITT: 0x%08x t_transport_queue_active: %d\n",
 917                         CMD_TFO(cmd)->get_task_tag(cmd),
 918                         atomic_read(&T_TASK(cmd)->t_transport_queue_active));
 919         }
 920 }
 921
 922 /*
 923  * Completion function used by TCM subsystem plugins (such as FILEIO)
 924  * for queueing up response from struct se_subsystem_api->do_task()
 925  */
 926 void transport_complete_sync_cache(struct se_cmd *cmd, int good)
 927 {
 928         struct se_task *task = list_entry(T_TASK(cmd)->t_task_list.next,
 929                                 struct se_task, t_list);
 930
 931         if (good) {
 932                 cmd->scsi_status = SAM_STAT_GOOD;
 933                 task->task_scsi_status = GOOD;
 934         } else {
 935                 task->task_scsi_status = SAM_STAT_CHECK_CONDITION;
 936                 task->task_error_status = PYX_TRANSPORT_ILLEGAL_REQUEST;
 937                 TASK_CMD(task)->transport_error_status =
 938                                         PYX_TRANSPORT_ILLEGAL_REQUEST;
 939         }
 940
 941         transport_complete_task(task, good);
 942 }
 943 EXPORT_SYMBOL(transport_complete_sync_cache);
 944
 945 /*      transport_complete_task():
 946  *
 947  *      Called from interrupt and non interrupt context depending
 948  *      on the transport plugin.
 949  */
 950 void transport_complete_task(struct se_task *task, int success)
 951 {
 952         struct se_cmd *cmd = TASK_CMD(task);
 953         struct se_device *dev = task->se_dev;
 954         int t_state;
 955         unsigned long flags;
 956 #if 0
 957         printk(KERN_INFO "task: %p CDB: 0x%02x obj_ptr: %p\n", task,
 958                         T_TASK(cmd)->t_task_cdb[0], dev);
 959 #endif
 960         if (dev) {
 961                 spin_lock_irqsave(&SE_HBA(dev)->hba_queue_lock, flags);
 962                 atomic_inc(&dev->depth_left);
 963                 atomic_inc(&SE_HBA(dev)->left_queue_depth);
 964                 spin_unlock_irqrestore(&SE_HBA(dev)->hba_queue_lock, flags);
 965         }
 966
 967         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
 968         atomic_set(&task->task_active, 0);
 969
 970         /*
 971          * See if any sense data exists, if so set the TASK_SENSE flag.
 972          * Also check for any other post completion work that needs to be
 973          * done by the plugins.
 974          */
 975         if (dev && dev->transport->transport_complete) {
 976                 if (dev->transport->transport_complete(task) != 0) {
 977                         cmd->se_cmd_flags |= SCF_TRANSPORT_TASK_SENSE;
 978                         task->task_sense = 1;
 979                         success = 1;
 980                 }
 981         }
 982
 983         /*
 984          * See if we are waiting for outstanding struct se_task
 985          * to complete for an exception condition
 986          */
 987         if (atomic_read(&task->task_stop)) {
 988                 /*
 989                  * Decrement T_TASK(cmd)->t_se_count if this task had
 990                  * previously thrown its timeout exception handler.
 991                  */
 992                 if (atomic_read(&task->task_timeout)) {
 993                         atomic_dec(&T_TASK(cmd)->t_se_count);
 994                         atomic_set(&task->task_timeout, 0);
 995                 }
 996                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
 997
 998                 complete(&task->task_stop_comp);
 999                 return;
1000         }
1001         /*
1002          * If the task's timeout handler has fired, use the t_task_cdbs_timeout
1003          * left counter to determine when the struct se_cmd is ready to be queued to
1004          * the processing thread.
1005          */
1006         if (atomic_read(&task->task_timeout)) {
1007                 if (!(atomic_dec_and_test(
1008                                 &T_TASK(cmd)->t_task_cdbs_timeout_left))) {
1009                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
1010                                 flags);
1011                         return;
1012                 }
1013                 t_state = TRANSPORT_COMPLETE_TIMEOUT;
1014                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
1015
1016                 transport_add_cmd_to_queue(cmd, t_state);
1017                 return;
1018         }
1019         atomic_dec(&T_TASK(cmd)->t_task_cdbs_timeout_left);
1020
1021         /*
1022          * Decrement the outstanding t_task_cdbs_left count.  The last
1023          * struct se_task from struct se_cmd will complete itself into the
1024          * device queue depending upon int success.
1025          */
1026         if (!(atomic_dec_and_test(&T_TASK(cmd)->t_task_cdbs_left))) {
1027                 if (!success)
1028                         T_TASK(cmd)->t_tasks_failed = 1;
1029
1030                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
1031                 return;
1032         }
1033
1034         if (!success || T_TASK(cmd)->t_tasks_failed) {
1035                 t_state = TRANSPORT_COMPLETE_FAILURE;
1036                 if (!task->task_error_status) {
1037                         task->task_error_status =
1038                                 PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
1039                         cmd->transport_error_status =
1040                                 PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
1041                 }
1042         } else {
1043                 atomic_set(&T_TASK(cmd)->t_transport_complete, 1);
1044                 t_state = TRANSPORT_COMPLETE_OK;
1045         }
1046         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
1047
1048         transport_add_cmd_to_queue(cmd, t_state);
1049 }
1050 EXPORT_SYMBOL(transport_complete_task);
1051
1052 /*
1053  * Called by transport_add_tasks_from_cmd() once a struct se_cmd's
1054  * struct se_task list are ready to be added to the active execution list
1055  * struct se_device
1056
1057  * Called with se_dev_t->execute_task_lock called.
1058  */
1059 static inline int transport_add_task_check_sam_attr(
1060         struct se_task *task,
1061         struct se_task *task_prev,
1062         struct se_device *dev)
1063 {
1064         /*
1065          * No SAM Task attribute emulation enabled, add to tail of
1066          * execution queue
1067          */
1068         if (dev->dev_task_attr_type != SAM_TASK_ATTR_EMULATED) {
1069                 list_add_tail(&task->t_execute_list, &dev->execute_task_list);
1070                 return 0;
1071         }
1072         /*
1073          * HEAD_OF_QUEUE attribute for received CDB, which means
1074          * the first task that is associated with a struct se_cmd goes to
1075          * head of the struct se_device->execute_task_list, and task_prev
1076          * after that for each subsequent task
1077          */
1078         if (task->task_se_cmd->sam_task_attr == TASK_ATTR_HOQ) {
1079                 list_add(&task->t_execute_list,
1080                                 (task_prev != NULL) ?
1081                                 &task_prev->t_execute_list :
1082                                 &dev->execute_task_list);
1083
1084                 DEBUG_STA("Set HEAD_OF_QUEUE for task CDB: 0x%02x"
1085                                 " in execution queue\n",
1086                                 T_TASK(task->task_se_cmd)->t_task_cdb[0]);
1087                 return 1;
1088         }
1089         /*
1090          * For ORDERED, SIMPLE or UNTAGGED attribute tasks once they have been
1091          * transitioned from Dermant -> Active state, and are added to the end
1092          * of the struct se_device->execute_task_list
1093          */
1094         list_add_tail(&task->t_execute_list, &dev->execute_task_list);
1095         return 0;
1096 }
1097
1098 /*      __transport_add_task_to_execute_queue():
1099  *
1100  *      Called with se_dev_t->execute_task_lock called.
1101  */
1102 static void __transport_add_task_to_execute_queue(
1103         struct se_task *task,
1104         struct se_task *task_prev,
1105         struct se_device *dev)
1106 {
1107         int head_of_queue;
1108
1109         head_of_queue = transport_add_task_check_sam_attr(task, task_prev, dev);
1110         atomic_inc(&dev->execute_tasks);
1111
1112         if (atomic_read(&task->task_state_active))
1113                 return;
1114         /*
1115          * Determine if this task needs to go to HEAD_OF_QUEUE for the
1116          * state list as well.  Running with SAM Task Attribute emulation
1117          * will always return head_of_queue == 0 here
1118          */
1119         if (head_of_queue)
1120                 list_add(&task->t_state_list, (task_prev) ?
1121                                 &task_prev->t_state_list :
1122                                 &dev->state_task_list);
1123         else
1124                 list_add_tail(&task->t_state_list, &dev->state_task_list);
1125
1126         atomic_set(&task->task_state_active, 1);
1127
1128         DEBUG_TSTATE("Added ITT: 0x%08x task[%p] to dev: %p\n",
1129                 CMD_TFO(task->task_se_cmd)->get_task_tag(task->task_se_cmd),
1130                 task, dev);
1131 }
1132
1133 static void transport_add_tasks_to_state_queue(struct se_cmd *cmd)
1134 {
1135         struct se_device *dev;
1136         struct se_task *task;
1137         unsigned long flags;
1138
1139         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
1140         list_for_each_entry(task, &T_TASK(cmd)->t_task_list, t_list) {
1141                 dev = task->se_dev;
1142
1143                 if (atomic_read(&task->task_state_active))
1144                         continue;
1145
1146                 spin_lock(&dev->execute_task_lock);
1147                 list_add_tail(&task->t_state_list, &dev->state_task_list);
1148                 atomic_set(&task->task_state_active, 1);
1149
1150                 DEBUG_TSTATE("Added ITT: 0x%08x task[%p] to dev: %p\n",
1151                         CMD_TFO(task->task_se_cmd)->get_task_tag(
1152                         task->task_se_cmd), task, dev);
1153
1154                 spin_unlock(&dev->execute_task_lock);
1155         }
1156         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
1157 }
1158
1159 static void transport_add_tasks_from_cmd(struct se_cmd *cmd)
1160 {
1161         struct se_device *dev = SE_DEV(cmd);
1162         struct se_task *task, *task_prev = NULL;
1163         unsigned long flags;
1164
1165         spin_lock_irqsave(&dev->execute_task_lock, flags);
1166         list_for_each_entry(task, &T_TASK(cmd)->t_task_list, t_list) {
1167                 if (atomic_read(&task->task_execute_queue))
1168                         continue;
1169                 /*
1170                  * __transport_add_task_to_execute_queue() handles the
1171                  * SAM Task Attribute emulation if enabled
1172                  */
1173                 __transport_add_task_to_execute_queue(task, task_prev, dev);
1174                 atomic_set(&task->task_execute_queue, 1);
1175                 task_prev = task;
1176         }
1177         spin_unlock_irqrestore(&dev->execute_task_lock, flags);
1178
1179         return;
1180 }
1181
1182 /*      transport_get_task_from_execute_queue():
1183  *
1184  *      Called with dev->execute_task_lock held.
1185  */
1186 static struct se_task *
1187 transport_get_task_from_execute_queue(struct se_device *dev)
1188 {
1189         struct se_task *task;
1190
1191         if (list_empty(&dev->execute_task_list))
1192                 return NULL;
1193
1194         list_for_each_entry(task, &dev->execute_task_list, t_execute_list)
1195                 break;
1196
1197         list_del(&task->t_execute_list);
1198         atomic_dec(&dev->execute_tasks);
1199
1200         return task;
1201 }
1202
1203 /*      transport_remove_task_from_execute_queue():
1204  *
1205  *
1206  */
1207 void transport_remove_task_from_execute_queue(
1208         struct se_task *task,
1209         struct se_device *dev)
1210 {
1211         unsigned long flags;
1212
1213         spin_lock_irqsave(&dev->execute_task_lock, flags);
1214         list_del(&task->t_execute_list);
1215         atomic_dec(&dev->execute_tasks);
1216         spin_unlock_irqrestore(&dev->execute_task_lock, flags);
1217 }
1218
1219 unsigned char *transport_dump_cmd_direction(struct se_cmd *cmd)
1220 {
1221         switch (cmd->data_direction) {
1222         case DMA_NONE:
1223                 return "NONE";
1224         case DMA_FROM_DEVICE:
1225                 return "READ";
1226         case DMA_TO_DEVICE:
1227                 return "WRITE";
1228         case DMA_BIDIRECTIONAL:
1229                 return "BIDI";
1230         default:
1231                 break;
1232         }
1233
1234         return "UNKNOWN";
1235 }
1236
1237 void transport_dump_dev_state(
1238         struct se_device *dev,
1239         char *b,
1240         int *bl)
1241 {
1242         *bl += sprintf(b + *bl, "Status: ");
1243         switch (dev->dev_status) {
1244         case TRANSPORT_DEVICE_ACTIVATED:
1245                 *bl += sprintf(b + *bl, "ACTIVATED");
1246                 break;
1247         case TRANSPORT_DEVICE_DEACTIVATED:
1248                 *bl += sprintf(b + *bl, "DEACTIVATED");
1249                 break;
1250         case TRANSPORT_DEVICE_SHUTDOWN:
1251                 *bl += sprintf(b + *bl, "SHUTDOWN");
1252                 break;
1253         case TRANSPORT_DEVICE_OFFLINE_ACTIVATED:
1254         case TRANSPORT_DEVICE_OFFLINE_DEACTIVATED:
1255                 *bl += sprintf(b + *bl, "OFFLINE");
1256                 break;
1257         default:
1258                 *bl += sprintf(b + *bl, "UNKNOWN=%d", dev->dev_status);
1259                 break;
1260         }
1261
1262         *bl += sprintf(b + *bl, "  Execute/Left/Max Queue Depth: %d/%d/%d",
1263                 atomic_read(&dev->execute_tasks), atomic_read(&dev->depth_left),
1264                 dev->queue_depth);
1265         *bl += sprintf(b + *bl, "  SectorSize: %u  MaxSectors: %u\n",
1266                 DEV_ATTRIB(dev)->block_size, DEV_ATTRIB(dev)->max_sectors);
1267         *bl += sprintf(b + *bl, "        ");
1268 }
1269
1270 /*      transport_release_all_cmds():
1271  *
1272  *
1273  */
1274 static void transport_release_all_cmds(struct se_device *dev)
1275 {
1276         struct se_cmd *cmd = NULL;
1277         struct se_queue_req *qr = NULL, *qr_p = NULL;
1278         int bug_out = 0, t_state;
1279         unsigned long flags;
1280
1281         spin_lock_irqsave(&dev->dev_queue_obj->cmd_queue_lock, flags);
1282         list_for_each_entry_safe(qr, qr_p, &dev->dev_queue_obj->qobj_list,
1283                                 qr_list) {
1284
1285                 cmd = (struct se_cmd *)qr->cmd;
1286                 t_state = qr->state;
1287                 list_del(&qr->qr_list);
1288                 kfree(qr);
1289                 spin_unlock_irqrestore(&dev->dev_queue_obj->cmd_queue_lock,
1290                                 flags);
1291
1292                 printk(KERN_ERR "Releasing ITT: 0x%08x, i_state: %u,"
1293                         " t_state: %u directly\n",
1294                         CMD_TFO(cmd)->get_task_tag(cmd),
1295                         CMD_TFO(cmd)->get_cmd_state(cmd), t_state);
1296
1297                 transport_release_fe_cmd(cmd);
1298                 bug_out = 1;
1299
1300                 spin_lock_irqsave(&dev->dev_queue_obj->cmd_queue_lock, flags);
1301         }
1302         spin_unlock_irqrestore(&dev->dev_queue_obj->cmd_queue_lock, flags);
1303 #if 0
1304         if (bug_out)
1305                 BUG();
1306 #endif
1307 }
1308
1309 void transport_dump_vpd_proto_id(
1310         struct t10_vpd *vpd,
1311         unsigned char *p_buf,
1312         int p_buf_len)
1313 {
1314         unsigned char buf[VPD_TMP_BUF_SIZE];
1315         int len;
1316
1317         memset(buf, 0, VPD_TMP_BUF_SIZE);
1318         len = sprintf(buf, "T10 VPD Protocol Identifier: ");
1319
1320         switch (vpd->protocol_identifier) {
1321         case 0x00:
1322                 sprintf(buf+len, "Fibre Channel\n");
1323                 break;
1324         case 0x10:
1325                 sprintf(buf+len, "Parallel SCSI\n");
1326                 break;
1327         case 0x20:
1328                 sprintf(buf+len, "SSA\n");
1329                 break;
1330         case 0x30:
1331                 sprintf(buf+len, "IEEE 1394\n");
1332                 break;
1333         case 0x40:
1334                 sprintf(buf+len, "SCSI Remote Direct Memory Access"
1335                                 " Protocol\n");
1336                 break;
1337         case 0x50:
1338                 sprintf(buf+len, "Internet SCSI (iSCSI)\n");
1339                 break;
1340         case 0x60:
1341                 sprintf(buf+len, "SAS Serial SCSI Protocol\n");
1342                 break;
1343         case 0x70:
1344                 sprintf(buf+len, "Automation/Drive Interface Transport"
1345                                 " Protocol\n");
1346                 break;
1347         case 0x80:
1348                 sprintf(buf+len, "AT Attachment Interface ATA/ATAPI\n");
1349                 break;
1350         default:
1351                 sprintf(buf+len, "Unknown 0x%02x\n",
1352                                 vpd->protocol_identifier);
1353                 break;
1354         }
1355
1356         if (p_buf)
1357                 strncpy(p_buf, buf, p_buf_len);
1358         else
1359                 printk(KERN_INFO "%s", buf);
1360 }
1361
1362 void
1363 transport_set_vpd_proto_id(struct t10_vpd *vpd, unsigned char *page_83)
1364 {
1365         /*
1366          * Check if the Protocol Identifier Valid (PIV) bit is set..
1367          *
1368          * from spc3r23.pdf section 7.5.1
1369          */
1370          if (page_83[1] & 0x80) {
1371                 vpd->protocol_identifier = (page_83[0] & 0xf0);
1372                 vpd->protocol_identifier_set = 1;
1373                 transport_dump_vpd_proto_id(vpd, NULL, 0);
1374         }
1375 }
1376 EXPORT_SYMBOL(transport_set_vpd_proto_id);
1377
1378 int transport_dump_vpd_assoc(
1379         struct t10_vpd *vpd,
1380         unsigned char *p_buf,
1381         int p_buf_len)
1382 {
1383         unsigned char buf[VPD_TMP_BUF_SIZE];
1384         int ret = 0, len;
1385
1386         memset(buf, 0, VPD_TMP_BUF_SIZE);
1387         len = sprintf(buf, "T10 VPD Identifier Association: ");
1388
1389         switch (vpd->association) {
1390         case 0x00:
1391                 sprintf(buf+len, "addressed logical unit\n");
1392                 break;
1393         case 0x10:
1394                 sprintf(buf+len, "target port\n");
1395                 break;
1396         case 0x20:
1397                 sprintf(buf+len, "SCSI target device\n");
1398                 break;
1399         default:
1400                 sprintf(buf+len, "Unknown 0x%02x\n", vpd->association);
1401                 ret = -1;
1402                 break;
1403         }
1404
1405         if (p_buf)
1406                 strncpy(p_buf, buf, p_buf_len);
1407         else
1408                 printk("%s", buf);
1409
1410         return ret;
1411 }
1412
1413 int transport_set_vpd_assoc(struct t10_vpd *vpd, unsigned char *page_83)
1414 {
1415         /*
1416          * The VPD identification association..
1417          *
1418          * from spc3r23.pdf Section 7.6.3.1 Table 297
1419          */
1420         vpd->association = (page_83[1] & 0x30);
1421         return transport_dump_vpd_assoc(vpd, NULL, 0);
1422 }
1423 EXPORT_SYMBOL(transport_set_vpd_assoc);
1424
1425 int transport_dump_vpd_ident_type(
1426         struct t10_vpd *vpd,
1427         unsigned char *p_buf,
1428         int p_buf_len)
1429 {
1430         unsigned char buf[VPD_TMP_BUF_SIZE];
1431         int ret = 0, len;
1432
1433         memset(buf, 0, VPD_TMP_BUF_SIZE);
1434         len = sprintf(buf, "T10 VPD Identifier Type: ");
1435
1436         switch (vpd->device_identifier_type) {
1437         case 0x00:
1438                 sprintf(buf+len, "Vendor specific\n");
1439                 break;
1440         case 0x01:
1441                 sprintf(buf+len, "T10 Vendor ID based\n");
1442                 break;
1443         case 0x02:
1444                 sprintf(buf+len, "EUI-64 based\n");
1445                 break;
1446         case 0x03:
1447                 sprintf(buf+len, "NAA\n");
1448                 break;
1449         case 0x04:
1450                 sprintf(buf+len, "Relative target port identifier\n");
1451                 break;
1452         case 0x08:
1453                 sprintf(buf+len, "SCSI name string\n");
1454                 break;
1455         default:
1456                 sprintf(buf+len, "Unsupported: 0x%02x\n",
1457                                 vpd->device_identifier_type);
1458                 ret = -1;
1459                 break;
1460         }
1461
1462         if (p_buf)
1463                 strncpy(p_buf, buf, p_buf_len);
1464         else
1465                 printk("%s", buf);
1466
1467         return ret;
1468 }
1469
1470 int transport_set_vpd_ident_type(struct t10_vpd *vpd, unsigned char *page_83)
1471 {
1472         /*
1473          * The VPD identifier type..
1474          *
1475          * from spc3r23.pdf Section 7.6.3.1 Table 298
1476          */
1477         vpd->device_identifier_type = (page_83[1] & 0x0f);
1478         return transport_dump_vpd_ident_type(vpd, NULL, 0);
1479 }
1480 EXPORT_SYMBOL(transport_set_vpd_ident_type);
1481
1482 int transport_dump_vpd_ident(
1483         struct t10_vpd *vpd,
1484         unsigned char *p_buf,
1485         int p_buf_len)
1486 {
1487         unsigned char buf[VPD_TMP_BUF_SIZE];
1488         int ret = 0;
1489
1490         memset(buf, 0, VPD_TMP_BUF_SIZE);
1491
1492         switch (vpd->device_identifier_code_set) {
1493         case 0x01: /* Binary */
1494                 sprintf(buf, "T10 VPD Binary Device Identifier: %s\n",
1495                         &vpd->device_identifier[0]);
1496                 break;
1497         case 0x02: /* ASCII */
1498                 sprintf(buf, "T10 VPD ASCII Device Identifier: %s\n",
1499                         &vpd->device_identifier[0]);
1500                 break;
1501         case 0x03: /* UTF-8 */
1502                 sprintf(buf, "T10 VPD UTF-8 Device Identifier: %s\n",
1503                         &vpd->device_identifier[0]);
1504                 break;
1505         default:
1506                 sprintf(buf, "T10 VPD Device Identifier encoding unsupported:"
1507                         " 0x%02x", vpd->device_identifier_code_set);
1508                 ret = -1;
1509                 break;
1510         }
1511
1512         if (p_buf)
1513                 strncpy(p_buf, buf, p_buf_len);
1514         else
1515                 printk("%s", buf);
1516
1517         return ret;
1518 }
1519
1520 int
1521 transport_set_vpd_ident(struct t10_vpd *vpd, unsigned char *page_83)
1522 {
1523         static const char hex_str[] = "0123456789abcdef";
1524         int j = 0, i = 4; /* offset to start of the identifer */
1525
1526         /*
1527          * The VPD Code Set (encoding)
1528          *
1529          * from spc3r23.pdf Section 7.6.3.1 Table 296
1530          */
1531         vpd->device_identifier_code_set = (page_83[0] & 0x0f);
1532         switch (vpd->device_identifier_code_set) {
1533         case 0x01: /* Binary */
1534                 vpd->device_identifier[j++] =
1535                                 hex_str[vpd->device_identifier_type];
1536                 while (i < (4 + page_83[3])) {
1537                         vpd->device_identifier[j++] =
1538                                 hex_str[(page_83[i] & 0xf0) >> 4];
1539                         vpd->device_identifier[j++] =
1540                                 hex_str[page_83[i] & 0x0f];
1541                         i++;
1542                 }
1543                 break;
1544         case 0x02: /* ASCII */
1545         case 0x03: /* UTF-8 */
1546                 while (i < (4 + page_83[3]))
1547                         vpd->device_identifier[j++] = page_83[i++];
1548                 break;
1549         default:
1550                 break;
1551         }
1552
1553         return transport_dump_vpd_ident(vpd, NULL, 0);
1554 }
1555 EXPORT_SYMBOL(transport_set_vpd_ident);
1556
1557 static void core_setup_task_attr_emulation(struct se_device *dev)
1558 {
1559         /*
1560          * If this device is from Target_Core_Mod/pSCSI, disable the
1561          * SAM Task Attribute emulation.
1562          *
1563          * This is currently not available in upsream Linux/SCSI Target
1564          * mode code, and is assumed to be disabled while using TCM/pSCSI.
1565          */
1566         if (TRANSPORT(dev)->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV) {
1567                 dev->dev_task_attr_type = SAM_TASK_ATTR_PASSTHROUGH;
1568                 return;
1569         }
1570
1571         dev->dev_task_attr_type = SAM_TASK_ATTR_EMULATED;
1572         DEBUG_STA("%s: Using SAM_TASK_ATTR_EMULATED for SPC: 0x%02x"
1573                 " device\n", TRANSPORT(dev)->name,
1574                 TRANSPORT(dev)->get_device_rev(dev));
1575 }
1576
1577 static void scsi_dump_inquiry(struct se_device *dev)
1578 {
1579         struct t10_wwn *wwn = DEV_T10_WWN(dev);
1580         int i, device_type;
1581         /*
1582          * Print Linux/SCSI style INQUIRY formatting to the kernel ring buffer
1583          */
1584         printk("  Vendor: ");
1585         for (i = 0; i < 8; i++)
1586                 if (wwn->vendor[i] >= 0x20)
1587                         printk("%c", wwn->vendor[i]);
1588                 else
1589                         printk(" ");
1590
1591         printk("  Model: ");
1592         for (i = 0; i < 16; i++)
1593                 if (wwn->model[i] >= 0x20)
1594                         printk("%c", wwn->model[i]);
1595                 else
1596                         printk(" ");
1597
1598         printk("  Revision: ");
1599         for (i = 0; i < 4; i++)
1600                 if (wwn->revision[i] >= 0x20)
1601                         printk("%c", wwn->revision[i]);
1602                 else
1603                         printk(" ");
1604
1605         printk("\n");
1606
1607         device_type = TRANSPORT(dev)->get_device_type(dev);
1608         printk("  Type:   %s ", scsi_device_type(device_type));
1609         printk("                 ANSI SCSI revision: %02x\n",
1610                                 TRANSPORT(dev)->get_device_rev(dev));
1611 }
1612
1613 struct se_device *transport_add_device_to_core_hba(
1614         struct se_hba *hba,
1615         struct se_subsystem_api *transport,
1616         struct se_subsystem_dev *se_dev,
1617         u32 device_flags,
1618         void *transport_dev,
1619         struct se_dev_limits *dev_limits,
1620         const char *inquiry_prod,
1621         const char *inquiry_rev)
1622 {
1623         int ret = 0, force_pt;
1624         struct se_device  *dev;
1625
1626         dev = kzalloc(sizeof(struct se_device), GFP_KERNEL);
1627         if (!(dev)) {
1628                 printk(KERN_ERR "Unable to allocate memory for se_dev_t\n");
1629                 return NULL;
1630         }
1631         dev->dev_queue_obj = kzalloc(sizeof(struct se_queue_obj), GFP_KERNEL);
1632         if (!(dev->dev_queue_obj)) {
1633                 printk(KERN_ERR "Unable to allocate memory for"
1634                                 " dev->dev_queue_obj\n");
1635                 kfree(dev);
1636                 return NULL;
1637         }
1638         transport_init_queue_obj(dev->dev_queue_obj);
1639
1640         dev->dev_status_queue_obj = kzalloc(sizeof(struct se_queue_obj),
1641                                         GFP_KERNEL);
1642         if (!(dev->dev_status_queue_obj)) {
1643                 printk(KERN_ERR "Unable to allocate memory for"
1644                                 " dev->dev_status_queue_obj\n");
1645                 kfree(dev->dev_queue_obj);
1646                 kfree(dev);
1647                 return NULL;
1648         }
1649         transport_init_queue_obj(dev->dev_status_queue_obj);
1650
1651         dev->dev_flags          = device_flags;
1652         dev->dev_status         |= TRANSPORT_DEVICE_DEACTIVATED;
1653         dev->dev_ptr            = (void *) transport_dev;
1654         dev->se_hba             = hba;
1655         dev->se_sub_dev         = se_dev;
1656         dev->transport          = transport;
1657         atomic_set(&dev->active_cmds, 0);
1658         INIT_LIST_HEAD(&dev->dev_list);
1659         INIT_LIST_HEAD(&dev->dev_sep_list);
1660         INIT_LIST_HEAD(&dev->dev_tmr_list);
1661         INIT_LIST_HEAD(&dev->execute_task_list);
1662         INIT_LIST_HEAD(&dev->delayed_cmd_list);
1663         INIT_LIST_HEAD(&dev->ordered_cmd_list);
1664         INIT_LIST_HEAD(&dev->state_task_list);
1665         spin_lock_init(&dev->execute_task_lock);
1666         spin_lock_init(&dev->delayed_cmd_lock);
1667         spin_lock_init(&dev->ordered_cmd_lock);
1668         spin_lock_init(&dev->state_task_lock);
1669         spin_lock_init(&dev->dev_alua_lock);
1670         spin_lock_init(&dev->dev_reservation_lock);
1671         spin_lock_init(&dev->dev_status_lock);
1672         spin_lock_init(&dev->dev_status_thr_lock);
1673         spin_lock_init(&dev->se_port_lock);
1674         spin_lock_init(&dev->se_tmr_lock);
1675
1676         dev->queue_depth        = dev_limits->queue_depth;
1677         atomic_set(&dev->depth_left, dev->queue_depth);
1678         atomic_set(&dev->dev_ordered_id, 0);
1679
1680         se_dev_set_default_attribs(dev, dev_limits);
1681
1682         dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX);
1683         dev->creation_time = get_jiffies_64();
1684         spin_lock_init(&dev->stats_lock);
1685
1686         spin_lock(&hba->device_lock);
1687         list_add_tail(&dev->dev_list, &hba->hba_dev_list);
1688         hba->dev_count++;
1689         spin_unlock(&hba->device_lock);
1690         /*
1691          * Setup the SAM Task Attribute emulation for struct se_device
1692          */
1693         core_setup_task_attr_emulation(dev);
1694         /*
1695          * Force PR and ALUA passthrough emulation with internal object use.
1696          */
1697         force_pt = (hba->hba_flags & HBA_FLAGS_INTERNAL_USE);
1698         /*
1699          * Setup the Reservations infrastructure for struct se_device
1700          */
1701         core_setup_reservations(dev, force_pt);
1702         /*
1703          * Setup the Asymmetric Logical Unit Assignment for struct se_device
1704          */
1705         if (core_setup_alua(dev, force_pt) < 0)
1706                 goto out;
1707
1708         /*
1709          * Startup the struct se_device processing thread
1710          */
1711         dev->process_thread = kthread_run(transport_processing_thread, dev,
1712                                           "LIO_%s", TRANSPORT(dev)->name);
1713         if (IS_ERR(dev->process_thread)) {
1714                 printk(KERN_ERR "Unable to create kthread: LIO_%s\n",
1715                         TRANSPORT(dev)->name);
1716                 goto out;
1717         }
1718
1719         /*
1720          * Preload the initial INQUIRY const values if we are doing
1721          * anything virtual (IBLOCK, FILEIO, RAMDISK), but not for TCM/pSCSI
1722          * passthrough because this is being provided by the backend LLD.
1723          * This is required so that transport_get_inquiry() copies these
1724          * originals once back into DEV_T10_WWN(dev) for the virtual device
1725          * setup.
1726          */
1727         if (TRANSPORT(dev)->transport_type != TRANSPORT_PLUGIN_PHBA_PDEV) {
1728                 if (!(inquiry_prod) || !(inquiry_prod)) {
1729                         printk(KERN_ERR "All non TCM/pSCSI plugins require"
1730                                 " INQUIRY consts\n");
1731                         goto out;
1732                 }
1733
1734                 strncpy(&DEV_T10_WWN(dev)->vendor[0], "LIO-ORG", 8);
1735                 strncpy(&DEV_T10_WWN(dev)->model[0], inquiry_prod, 16);
1736                 strncpy(&DEV_T10_WWN(dev)->revision[0], inquiry_rev, 4);
1737         }
1738         scsi_dump_inquiry(dev);
1739
1740 out:
1741         if (!ret)
1742                 return dev;
1743         kthread_stop(dev->process_thread);
1744
1745         spin_lock(&hba->device_lock);
1746         list_del(&dev->dev_list);
1747         hba->dev_count--;
1748         spin_unlock(&hba->device_lock);
1749
1750         se_release_vpd_for_dev(dev);
1751
1752         kfree(dev->dev_status_queue_obj);
1753         kfree(dev->dev_queue_obj);
1754         kfree(dev);
1755
1756         return NULL;
1757 }
1758 EXPORT_SYMBOL(transport_add_device_to_core_hba);
1759
1760 /*      transport_generic_prepare_cdb():
1761  *
1762  *      Since the Initiator sees iSCSI devices as LUNs,  the SCSI CDB will
1763  *      contain the iSCSI LUN in bits 7-5 of byte 1 as per SAM-2.
1764  *      The point of this is since we are mapping iSCSI LUNs to
1765  *      SCSI Target IDs having a non-zero LUN in the CDB will throw the
1766  *      devices and HBAs for a loop.
1767  */
1768 static inline void transport_generic_prepare_cdb(
1769         unsigned char *cdb)
1770 {
1771         switch (cdb[0]) {
1772         case READ_10: /* SBC - RDProtect */
1773         case READ_12: /* SBC - RDProtect */
1774         case READ_16: /* SBC - RDProtect */
1775         case SEND_DIAGNOSTIC: /* SPC - SELF-TEST Code */
1776         case VERIFY: /* SBC - VRProtect */
1777         case VERIFY_16: /* SBC - VRProtect */
1778         case WRITE_VERIFY: /* SBC - VRProtect */
1779         case WRITE_VERIFY_12: /* SBC - VRProtect */
1780                 break;
1781         default:
1782                 cdb[1] &= 0x1f; /* clear logical unit number */
1783                 break;
1784         }
1785 }
1786
1787 static struct se_task *
1788 transport_generic_get_task(struct se_cmd *cmd,
1789                 enum dma_data_direction data_direction)
1790 {
1791         struct se_task *task;
1792         struct se_device *dev = SE_DEV(cmd);
1793         unsigned long flags;
1794
1795         task = dev->transport->alloc_task(cmd);
1796         if (!task) {
1797                 printk(KERN_ERR "Unable to allocate struct se_task\n");
1798                 return NULL;
1799         }
1800
1801         INIT_LIST_HEAD(&task->t_list);
1802         INIT_LIST_HEAD(&task->t_execute_list);
1803         INIT_LIST_HEAD(&task->t_state_list);
1804         init_completion(&task->task_stop_comp);
1805         task->task_no = T_TASK(cmd)->t_tasks_no++;
1806         task->task_se_cmd = cmd;
1807         task->se_dev = dev;
1808         task->task_data_direction = data_direction;
1809
1810         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
1811         list_add_tail(&task->t_list, &T_TASK(cmd)->t_task_list);
1812         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
1813
1814         return task;
1815 }
1816
1817 static int transport_generic_cmd_sequencer(struct se_cmd *, unsigned char *);
1818
1819 void transport_device_setup_cmd(struct se_cmd *cmd)
1820 {
1821         cmd->se_dev = SE_LUN(cmd)->lun_se_dev;
1822 }
1823 EXPORT_SYMBOL(transport_device_setup_cmd);
1824
1825 /*
1826  * Used by fabric modules containing a local struct se_cmd within their
1827  * fabric dependent per I/O descriptor.
1828  */
1829 void transport_init_se_cmd(
1830         struct se_cmd *cmd,
1831         struct target_core_fabric_ops *tfo,
1832         struct se_session *se_sess,
1833         u32 data_length,
1834         int data_direction,
1835         int task_attr,
1836         unsigned char *sense_buffer)
1837 {
1838         INIT_LIST_HEAD(&cmd->se_lun_list);
1839         INIT_LIST_HEAD(&cmd->se_delayed_list);
1840         INIT_LIST_HEAD(&cmd->se_ordered_list);
1841         /*
1842          * Setup t_task pointer to t_task_backstore
1843          */
1844         cmd->t_task = &cmd->t_task_backstore;
1845
1846         INIT_LIST_HEAD(&T_TASK(cmd)->t_task_list);
1847         init_completion(&T_TASK(cmd)->transport_lun_fe_stop_comp);
1848         init_completion(&T_TASK(cmd)->transport_lun_stop_comp);
1849         init_completion(&T_TASK(cmd)->t_transport_stop_comp);
1850         spin_lock_init(&T_TASK(cmd)->t_state_lock);
1851         atomic_set(&T_TASK(cmd)->transport_dev_active, 1);
1852
1853         cmd->se_tfo = tfo;
1854         cmd->se_sess = se_sess;
1855         cmd->data_length = data_length;
1856         cmd->data_direction = data_direction;
1857         cmd->sam_task_attr = task_attr;
1858         cmd->sense_buffer = sense_buffer;
1859 }
1860 EXPORT_SYMBOL(transport_init_se_cmd);
1861
1862 static int transport_check_alloc_task_attr(struct se_cmd *cmd)
1863 {
1864         /*
1865          * Check if SAM Task Attribute emulation is enabled for this
1866          * struct se_device storage object
1867          */
1868         if (SE_DEV(cmd)->dev_task_attr_type != SAM_TASK_ATTR_EMULATED)
1869                 return 0;
1870
1871         if (cmd->sam_task_attr == TASK_ATTR_ACA) {
1872                 DEBUG_STA("SAM Task Attribute ACA"
1873                         " emulation is not supported\n");
1874                 return -1;
1875         }
1876         /*
1877          * Used to determine when ORDERED commands should go from
1878          * Dormant to Active status.
1879          */
1880         cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
1881         smp_mb__after_atomic_inc();
1882         DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
1883                         cmd->se_ordered_id, cmd->sam_task_attr,
1884                         TRANSPORT(cmd->se_dev)->name);
1885         return 0;
1886 }
1887
1888 void transport_free_se_cmd(
1889         struct se_cmd *se_cmd)
1890 {
1891         if (se_cmd->se_tmr_req)
1892                 core_tmr_release_req(se_cmd->se_tmr_req);
1893         /*
1894          * Check and free any extended CDB buffer that was allocated
1895          */
1896         if (T_TASK(se_cmd)->t_task_cdb != T_TASK(se_cmd)->__t_task_cdb)
1897                 kfree(T_TASK(se_cmd)->t_task_cdb);
1898 }
1899 EXPORT_SYMBOL(transport_free_se_cmd);
1900
1901 static void transport_generic_wait_for_tasks(struct se_cmd *, int, int);
1902
1903 /*      transport_generic_allocate_tasks():
1904  *
1905  *      Called from fabric RX Thread.
1906  */
1907 int transport_generic_allocate_tasks(
1908         struct se_cmd *cmd,
1909         unsigned char *cdb)
1910 {
1911         int ret;
1912
1913         transport_generic_prepare_cdb(cdb);
1914
1915         /*
1916          * This is needed for early exceptions.
1917          */
1918         cmd->transport_wait_for_tasks = &transport_generic_wait_for_tasks;
1919
1920         transport_device_setup_cmd(cmd);
1921         /*
1922          * Ensure that the received CDB is less than the max (252 + 8) bytes
1923          * for VARIABLE_LENGTH_CMD
1924          */
1925         if (scsi_command_size(cdb) > SCSI_MAX_VARLEN_CDB_SIZE) {
1926                 printk(KERN_ERR "Received SCSI CDB with command_size: %d that"
1927                         " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
1928                         scsi_command_size(cdb), SCSI_MAX_VARLEN_CDB_SIZE);
1929                 return -1;
1930         }
1931         /*
1932          * If the received CDB is larger than TCM_MAX_COMMAND_SIZE,
1933          * allocate the additional extended CDB buffer now..  Otherwise
1934          * setup the pointer from __t_task_cdb to t_task_cdb.
1935          */
1936         if (scsi_command_size(cdb) > sizeof(T_TASK(cmd)->__t_task_cdb)) {
1937                 T_TASK(cmd)->t_task_cdb = kzalloc(scsi_command_size(cdb),
1938                                                 GFP_KERNEL);
1939                 if (!(T_TASK(cmd)->t_task_cdb)) {
1940                         printk(KERN_ERR "Unable to allocate T_TASK(cmd)->t_task_cdb"
1941                                 " %u > sizeof(T_TASK(cmd)->__t_task_cdb): %lu ops\n",
1942                                 scsi_command_size(cdb),
1943                                 (unsigned long)sizeof(T_TASK(cmd)->__t_task_cdb));
1944                         return -1;
1945                 }
1946         } else
1947                 T_TASK(cmd)->t_task_cdb = &T_TASK(cmd)->__t_task_cdb[0];
1948         /*
1949          * Copy the original CDB into T_TASK(cmd).
1950          */
1951         memcpy(T_TASK(cmd)->t_task_cdb, cdb, scsi_command_size(cdb));
1952         /*
1953          * Setup the received CDB based on SCSI defined opcodes and
1954          * perform unit attention, persistent reservations and ALUA
1955          * checks for virtual device backends.  The T_TASK(cmd)->t_task_cdb
1956          * pointer is expected to be setup before we reach this point.
1957          */
1958         ret = transport_generic_cmd_sequencer(cmd, cdb);
1959         if (ret < 0)
1960                 return ret;
1961         /*
1962          * Check for SAM Task Attribute Emulation
1963          */
1964         if (transport_check_alloc_task_attr(cmd) < 0) {
1965                 cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
1966                 cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
1967                 return -2;
1968         }
1969         spin_lock(&cmd->se_lun->lun_sep_lock);
1970         if (cmd->se_lun->lun_sep)
1971                 cmd->se_lun->lun_sep->sep_stats.cmd_pdus++;
1972         spin_unlock(&cmd->se_lun->lun_sep_lock);
1973         return 0;
1974 }
1975 EXPORT_SYMBOL(transport_generic_allocate_tasks);
1976
1977 /*
1978  * Used by fabric module frontends not defining a TFO->new_cmd_map()
1979  * to queue up a newly setup se_cmd w/ TRANSPORT_NEW_CMD statis
1980  */
1981 int transport_generic_handle_cdb(
1982         struct se_cmd *cmd)
1983 {
1984         if (!SE_LUN(cmd)) {
1985                 dump_stack();
1986                 printk(KERN_ERR "SE_LUN(cmd) is NULL\n");
1987                 return -1;
1988         }
1989
1990         transport_add_cmd_to_queue(cmd, TRANSPORT_NEW_CMD);
1991         return 0;
1992 }
1993 EXPORT_SYMBOL(transport_generic_handle_cdb);
1994
1995 /*
1996  * Used by fabric module frontends defining a TFO->new_cmd_map() caller
1997  * to  queue up a newly setup se_cmd w/ TRANSPORT_NEW_CMD_MAP in order to
1998  * complete setup in TCM process context w/ TFO->new_cmd_map().
1999  */
2000 int transport_generic_handle_cdb_map(
2001         struct se_cmd *cmd)
2002 {
2003         if (!SE_LUN(cmd)) {
2004                 dump_stack();
2005                 printk(KERN_ERR "SE_LUN(cmd) is NULL\n");
2006                 return -1;
2007         }
2008
2009         transport_add_cmd_to_queue(cmd, TRANSPORT_NEW_CMD_MAP);
2010         return 0;
2011 }
2012 EXPORT_SYMBOL(transport_generic_handle_cdb_map);
2013
2014 /*      transport_generic_handle_data():
2015  *
2016  *
2017  */
2018 int transport_generic_handle_data(
2019         struct se_cmd *cmd)
2020 {
2021         /*
2022          * For the software fabric case, then we assume the nexus is being
2023          * failed/shutdown when signals are pending from the kthread context
2024          * caller, so we return a failure.  For the HW target mode case running
2025          * in interrupt code, the signal_pending() check is skipped.
2026          */
2027         if (!in_interrupt() && signal_pending(current))
2028                 return -1;
2029         /*
2030          * If the received CDB has aleady been ABORTED by the generic
2031          * target engine, we now call transport_check_aborted_status()
2032          * to queue any delated TASK_ABORTED status for the received CDB to the
2033          * fabric module as we are expecting no futher incoming DATA OUT
2034          * sequences at this point.
2035          */
2036         if (transport_check_aborted_status(cmd, 1) != 0)
2037                 return 0;
2038
2039         transport_add_cmd_to_queue(cmd, TRANSPORT_PROCESS_WRITE);
2040         return 0;
2041 }
2042 EXPORT_SYMBOL(transport_generic_handle_data);
2043
2044 /*      transport_generic_handle_tmr():
2045  *
2046  *
2047  */
2048 int transport_generic_handle_tmr(
2049         struct se_cmd *cmd)
2050 {
2051         /*
2052          * This is needed for early exceptions.
2053          */
2054         cmd->transport_wait_for_tasks = &transport_generic_wait_for_tasks;
2055         transport_device_setup_cmd(cmd);
2056
2057         transport_add_cmd_to_queue(cmd, TRANSPORT_PROCESS_TMR);
2058         return 0;
2059 }
2060 EXPORT_SYMBOL(transport_generic_handle_tmr);
2061
2062 static int transport_stop_tasks_for_cmd(struct se_cmd *cmd)
2063 {
2064         struct se_task *task, *task_tmp;
2065         unsigned long flags;
2066         int ret = 0;
2067
2068         DEBUG_TS("ITT[0x%08x] - Stopping tasks\n",
2069                 CMD_TFO(cmd)->get_task_tag(cmd));
2070
2071         /*
2072          * No tasks remain in the execution queue
2073          */
2074         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2075         list_for_each_entry_safe(task, task_tmp,
2076                                 &T_TASK(cmd)->t_task_list, t_list) {
2077                 DEBUG_TS("task_no[%d] - Processing task %p\n",
2078                                 task->task_no, task);
2079                 /*
2080                  * If the struct se_task has not been sent and is not active,
2081                  * remove the struct se_task from the execution queue.
2082                  */
2083                 if (!atomic_read(&task->task_sent) &&
2084                     !atomic_read(&task->task_active)) {
2085                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
2086                                         flags);
2087                         transport_remove_task_from_execute_queue(task,
2088                                         task->se_dev);
2089
2090                         DEBUG_TS("task_no[%d] - Removed from execute queue\n",
2091                                 task->task_no);
2092                         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2093                         continue;
2094                 }
2095
2096                 /*
2097                  * If the struct se_task is active, sleep until it is returned
2098                  * from the plugin.
2099                  */
2100                 if (atomic_read(&task->task_active)) {
2101                         atomic_set(&task->task_stop, 1);
2102                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
2103                                         flags);
2104
2105                         DEBUG_TS("task_no[%d] - Waiting to complete\n",
2106                                 task->task_no);
2107                         wait_for_completion(&task->task_stop_comp);
2108                         DEBUG_TS("task_no[%d] - Stopped successfully\n",
2109                                 task->task_no);
2110
2111                         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2112                         atomic_dec(&T_TASK(cmd)->t_task_cdbs_left);
2113
2114                         atomic_set(&task->task_active, 0);
2115                         atomic_set(&task->task_stop, 0);
2116                 } else {
2117                         DEBUG_TS("task_no[%d] - Did nothing\n", task->task_no);
2118                         ret++;
2119                 }
2120
2121                 __transport_stop_task_timer(task, &flags);
2122         }
2123         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2124
2125         return ret;
2126 }
2127
2128 static void transport_failure_reset_queue_depth(struct se_device *dev)
2129 {
2130         unsigned long flags;
2131
2132         spin_lock_irqsave(&SE_HBA(dev)->hba_queue_lock, flags);;
2133         atomic_inc(&dev->depth_left);
2134         atomic_inc(&SE_HBA(dev)->left_queue_depth);
2135         spin_unlock_irqrestore(&SE_HBA(dev)->hba_queue_lock, flags);
2136 }
2137
2138 /*
2139  * Handle SAM-esque emulation for generic transport request failures.
2140  */
2141 static void transport_generic_request_failure(
2142         struct se_cmd *cmd,
2143         struct se_device *dev,
2144         int complete,
2145         int sc)
2146 {
2147         DEBUG_GRF("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x"
2148                 " CDB: 0x%02x\n", cmd, CMD_TFO(cmd)->get_task_tag(cmd),
2149                 T_TASK(cmd)->t_task_cdb[0]);
2150         DEBUG_GRF("-----[ i_state: %d t_state/def_t_state:"
2151                 " %d/%d transport_error_status: %d\n",
2152                 CMD_TFO(cmd)->get_cmd_state(cmd),
2153                 cmd->t_state, cmd->deferred_t_state,
2154                 cmd->transport_error_status);
2155         DEBUG_GRF("-----[ t_task_cdbs: %d t_task_cdbs_left: %d"
2156                 " t_task_cdbs_sent: %d t_task_cdbs_ex_left: %d --"
2157                 " t_transport_active: %d t_transport_stop: %d"
2158                 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
2159                 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
2160                 atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
2161                 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
2162                 atomic_read(&T_TASK(cmd)->t_transport_active),
2163                 atomic_read(&T_TASK(cmd)->t_transport_stop),
2164                 atomic_read(&T_TASK(cmd)->t_transport_sent));
2165
2166         transport_stop_all_task_timers(cmd);
2167
2168         if (dev)
2169                 transport_failure_reset_queue_depth(dev);
2170         /*
2171          * For SAM Task Attribute emulation for failed struct se_cmd
2172          */
2173         if (cmd->se_dev->dev_task_attr_type == SAM_TASK_ATTR_EMULATED)
2174                 transport_complete_task_attr(cmd);
2175
2176         if (complete) {
2177                 transport_direct_request_timeout(cmd);
2178                 cmd->transport_error_status = PYX_TRANSPORT_LU_COMM_FAILURE;
2179         }
2180
2181         switch (cmd->transport_error_status) {
2182         case PYX_TRANSPORT_UNKNOWN_SAM_OPCODE:
2183                 cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
2184                 break;
2185         case PYX_TRANSPORT_REQ_TOO_MANY_SECTORS:
2186                 cmd->scsi_sense_reason = TCM_SECTOR_COUNT_TOO_MANY;
2187                 break;
2188         case PYX_TRANSPORT_INVALID_CDB_FIELD:
2189                 cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
2190                 break;
2191         case PYX_TRANSPORT_INVALID_PARAMETER_LIST:
2192                 cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
2193                 break;
2194         case PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES:
2195                 if (!sc)
2196                         transport_new_cmd_failure(cmd);
2197                 /*
2198                  * Currently for PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES,
2199                  * we force this session to fall back to session
2200                  * recovery.
2201                  */
2202                 CMD_TFO(cmd)->fall_back_to_erl0(cmd->se_sess);
2203                 CMD_TFO(cmd)->stop_session(cmd->se_sess, 0, 0);
2204
2205                 goto check_stop;
2206         case PYX_TRANSPORT_LU_COMM_FAILURE:
2207         case PYX_TRANSPORT_ILLEGAL_REQUEST:
2208                 cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
2209                 break;
2210         case PYX_TRANSPORT_UNKNOWN_MODE_PAGE:
2211                 cmd->scsi_sense_reason = TCM_UNKNOWN_MODE_PAGE;
2212                 break;
2213         case PYX_TRANSPORT_WRITE_PROTECTED:
2214                 cmd->scsi_sense_reason = TCM_WRITE_PROTECTED;
2215                 break;
2216         case PYX_TRANSPORT_RESERVATION_CONFLICT:
2217                 /*
2218                  * No SENSE Data payload for this case, set SCSI Status
2219                  * and queue the response to $FABRIC_MOD.
2220                  *
2221                  * Uses linux/include/scsi/scsi.h SAM status codes defs
2222                  */
2223                 cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
2224                 /*
2225                  * For UA Interlock Code 11b, a RESERVATION CONFLICT will
2226                  * establish a UNIT ATTENTION with PREVIOUS RESERVATION
2227                  * CONFLICT STATUS.
2228                  *
2229                  * See spc4r17, section 7.4.6 Control Mode Page, Table 349
2230                  */
2231                 if (SE_SESS(cmd) &&
2232                     DEV_ATTRIB(cmd->se_dev)->emulate_ua_intlck_ctrl == 2)
2233                         core_scsi3_ua_allocate(SE_SESS(cmd)->se_node_acl,
2234                                 cmd->orig_fe_lun, 0x2C,
2235                                 ASCQ_2CH_PREVIOUS_RESERVATION_CONFLICT_STATUS);
2236
2237                 CMD_TFO(cmd)->queue_status(cmd);
2238                 goto check_stop;
2239         case PYX_TRANSPORT_USE_SENSE_REASON:
2240                 /*
2241                  * struct se_cmd->scsi_sense_reason already set
2242                  */
2243                 break;
2244         default:
2245                 printk(KERN_ERR "Unknown transport error for CDB 0x%02x: %d\n",
2246                         T_TASK(cmd)->t_task_cdb[0],
2247                         cmd->transport_error_status);
2248                 cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
2249                 break;
2250         }
2251
2252         if (!sc)
2253                 transport_new_cmd_failure(cmd);
2254         else
2255                 transport_send_check_condition_and_sense(cmd,
2256                         cmd->scsi_sense_reason, 0);
2257 check_stop:
2258         transport_lun_remove_cmd(cmd);
2259         if (!(transport_cmd_check_stop_to_fabric(cmd)))
2260                 ;
2261 }
2262
2263 static void transport_direct_request_timeout(struct se_cmd *cmd)
2264 {
2265         unsigned long flags;
2266
2267         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2268         if (!(atomic_read(&T_TASK(cmd)->t_transport_timeout))) {
2269                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2270                 return;
2271         }
2272         if (atomic_read(&T_TASK(cmd)->t_task_cdbs_timeout_left)) {
2273                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2274                 return;
2275         }
2276
2277         atomic_sub(atomic_read(&T_TASK(cmd)->t_transport_timeout),
2278                    &T_TASK(cmd)->t_se_count);
2279         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2280 }
2281
2282 static void transport_generic_request_timeout(struct se_cmd *cmd)
2283 {
2284         unsigned long flags;
2285
2286         /*
2287          * Reset T_TASK(cmd)->t_se_count to allow transport_generic_remove()
2288          * to allow last call to free memory resources.
2289          */
2290         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2291         if (atomic_read(&T_TASK(cmd)->t_transport_timeout) > 1) {
2292                 int tmp = (atomic_read(&T_TASK(cmd)->t_transport_timeout) - 1);
2293
2294                 atomic_sub(tmp, &T_TASK(cmd)->t_se_count);
2295         }
2296         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2297
2298         transport_generic_remove(cmd, 0, 0);
2299 }
2300
2301 static int
2302 transport_generic_allocate_buf(struct se_cmd *cmd, u32 data_length)
2303 {
2304         unsigned char *buf;
2305
2306         buf = kzalloc(data_length, GFP_KERNEL);
2307         if (!(buf)) {
2308                 printk(KERN_ERR "Unable to allocate memory for buffer\n");
2309                 return -1;
2310         }
2311
2312         T_TASK(cmd)->t_tasks_se_num = 0;
2313         T_TASK(cmd)->t_task_buf = buf;
2314
2315         return 0;
2316 }
2317
2318 static inline u32 transport_lba_21(unsigned char *cdb)
2319 {
2320         return ((cdb[1] & 0x1f) << 16) | (cdb[2] << 8) | cdb[3];
2321 }
2322
2323 static inline u32 transport_lba_32(unsigned char *cdb)
2324 {
2325         return (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
2326 }
2327
2328 static inline unsigned long long transport_lba_64(unsigned char *cdb)
2329 {
2330         unsigned int __v1, __v2;
2331
2332         __v1 = (cdb[2] << 24) | (cdb[3] << 16) | (cdb[4] << 8) | cdb[5];
2333         __v2 = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
2334
2335         return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
2336 }
2337
2338 /*
2339  * For VARIABLE_LENGTH_CDB w/ 32 byte extended CDBs
2340  */
2341 static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
2342 {
2343         unsigned int __v1, __v2;
2344
2345         __v1 = (cdb[12] << 24) | (cdb[13] << 16) | (cdb[14] << 8) | cdb[15];
2346         __v2 = (cdb[16] << 24) | (cdb[17] << 16) | (cdb[18] << 8) | cdb[19];
2347
2348         return ((unsigned long long)__v2) | (unsigned long long)__v1 << 32;
2349 }
2350
2351 static void transport_set_supported_SAM_opcode(struct se_cmd *se_cmd)
2352 {
2353         unsigned long flags;
2354
2355         spin_lock_irqsave(&T_TASK(se_cmd)->t_state_lock, flags);
2356         se_cmd->se_cmd_flags |= SCF_SUPPORTED_SAM_OPCODE;
2357         spin_unlock_irqrestore(&T_TASK(se_cmd)->t_state_lock, flags);
2358 }
2359
2360 /*
2361  * Called from interrupt context.
2362  */
2363 static void transport_task_timeout_handler(unsigned long data)
2364 {
2365         struct se_task *task = (struct se_task *)data;
2366         struct se_cmd *cmd = TASK_CMD(task);
2367         unsigned long flags;
2368
2369         DEBUG_TT("transport task timeout fired! task: %p cmd: %p\n", task, cmd);
2370
2371         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2372         if (task->task_flags & TF_STOP) {
2373                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2374                 return;
2375         }
2376         task->task_flags &= ~TF_RUNNING;
2377
2378         /*
2379          * Determine if transport_complete_task() has already been called.
2380          */
2381         if (!(atomic_read(&task->task_active))) {
2382                 DEBUG_TT("transport task: %p cmd: %p timeout task_active"
2383                                 " == 0\n", task, cmd);
2384                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2385                 return;
2386         }
2387
2388         atomic_inc(&T_TASK(cmd)->t_se_count);
2389         atomic_inc(&T_TASK(cmd)->t_transport_timeout);
2390         T_TASK(cmd)->t_tasks_failed = 1;
2391
2392         atomic_set(&task->task_timeout, 1);
2393         task->task_error_status = PYX_TRANSPORT_TASK_TIMEOUT;
2394         task->task_scsi_status = 1;
2395
2396         if (atomic_read(&task->task_stop)) {
2397                 DEBUG_TT("transport task: %p cmd: %p timeout task_stop"
2398                                 " == 1\n", task, cmd);
2399                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2400                 complete(&task->task_stop_comp);
2401                 return;
2402         }
2403
2404         if (!(atomic_dec_and_test(&T_TASK(cmd)->t_task_cdbs_left))) {
2405                 DEBUG_TT("transport task: %p cmd: %p timeout non zero"
2406                                 " t_task_cdbs_left\n", task, cmd);
2407                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2408                 return;
2409         }
2410         DEBUG_TT("transport task: %p cmd: %p timeout ZERO t_task_cdbs_left\n",
2411                         task, cmd);
2412
2413         cmd->t_state = TRANSPORT_COMPLETE_FAILURE;
2414         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2415
2416         transport_add_cmd_to_queue(cmd, TRANSPORT_COMPLETE_FAILURE);
2417 }
2418
2419 /*
2420  * Called with T_TASK(cmd)->t_state_lock held.
2421  */
2422 static void transport_start_task_timer(struct se_task *task)
2423 {
2424         struct se_device *dev = task->se_dev;
2425         int timeout;
2426
2427         if (task->task_flags & TF_RUNNING)
2428                 return;
2429         /*
2430          * If the task_timeout is disabled, exit now.
2431          */
2432         timeout = DEV_ATTRIB(dev)->task_timeout;
2433         if (!(timeout))
2434                 return;
2435
2436         init_timer(&task->task_timer);
2437         task->task_timer.expires = (get_jiffies_64() + timeout * HZ);
2438         task->task_timer.data = (unsigned long) task;
2439         task->task_timer.function = transport_task_timeout_handler;
2440
2441         task->task_flags |= TF_RUNNING;
2442         add_timer(&task->task_timer);
2443 #if 0
2444         printk(KERN_INFO "Starting task timer for cmd: %p task: %p seconds:"
2445                 " %d\n", task->task_se_cmd, task, timeout);
2446 #endif
2447 }
2448
2449 /*
2450  * Called with spin_lock_irq(&T_TASK(cmd)->t_state_lock) held.
2451  */
2452 void __transport_stop_task_timer(struct se_task *task, unsigned long *flags)
2453 {
2454         struct se_cmd *cmd = TASK_CMD(task);
2455
2456         if (!(task->task_flags & TF_RUNNING))
2457                 return;
2458
2459         task->task_flags |= TF_STOP;
2460         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, *flags);
2461
2462         del_timer_sync(&task->task_timer);
2463
2464         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, *flags);
2465         task->task_flags &= ~TF_RUNNING;
2466         task->task_flags &= ~TF_STOP;
2467 }
2468
2469 static void transport_stop_all_task_timers(struct se_cmd *cmd)
2470 {
2471         struct se_task *task = NULL, *task_tmp;
2472         unsigned long flags;
2473
2474         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2475         list_for_each_entry_safe(task, task_tmp,
2476                                 &T_TASK(cmd)->t_task_list, t_list)
2477                 __transport_stop_task_timer(task, &flags);
2478         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2479 }
2480
2481 static inline int transport_tcq_window_closed(struct se_device *dev)
2482 {
2483         if (dev->dev_tcq_window_closed++ <
2484                         PYX_TRANSPORT_WINDOW_CLOSED_THRESHOLD) {
2485                 msleep(PYX_TRANSPORT_WINDOW_CLOSED_WAIT_SHORT);
2486         } else
2487                 msleep(PYX_TRANSPORT_WINDOW_CLOSED_WAIT_LONG);
2488
2489         wake_up_interruptible(&dev->dev_queue_obj->thread_wq);
2490         return 0;
2491 }
2492
2493 /*
2494  * Called from Fabric Module context from transport_execute_tasks()
2495  *
2496  * The return of this function determins if the tasks from struct se_cmd
2497  * get added to the execution queue in transport_execute_tasks(),
2498  * or are added to the delayed or ordered lists here.
2499  */
2500 static inline int transport_execute_task_attr(struct se_cmd *cmd)
2501 {
2502         if (SE_DEV(cmd)->dev_task_attr_type != SAM_TASK_ATTR_EMULATED)
2503                 return 1;
2504         /*
2505          * Check for the existance of HEAD_OF_QUEUE, and if true return 1
2506          * to allow the passed struct se_cmd list of tasks to the front of the list.
2507          */
2508          if (cmd->sam_task_attr == TASK_ATTR_HOQ) {
2509                 atomic_inc(&SE_DEV(cmd)->dev_hoq_count);
2510                 smp_mb__after_atomic_inc();
2511                 DEBUG_STA("Added HEAD_OF_QUEUE for CDB:"
2512                         " 0x%02x, se_ordered_id: %u\n",
2513                         T_TASK(cmd)->t_task_cdb[0],
2514                         cmd->se_ordered_id);
2515                 return 1;
2516         } else if (cmd->sam_task_attr == TASK_ATTR_ORDERED) {
2517                 spin_lock(&SE_DEV(cmd)->ordered_cmd_lock);
2518                 list_add_tail(&cmd->se_ordered_list,
2519                                 &SE_DEV(cmd)->ordered_cmd_list);
2520                 spin_unlock(&SE_DEV(cmd)->ordered_cmd_lock);
2521
2522                 atomic_inc(&SE_DEV(cmd)->dev_ordered_sync);
2523                 smp_mb__after_atomic_inc();
2524
2525                 DEBUG_STA("Added ORDERED for CDB: 0x%02x to ordered"
2526                                 " list, se_ordered_id: %u\n",
2527                                 T_TASK(cmd)->t_task_cdb[0],
2528                                 cmd->se_ordered_id);
2529                 /*
2530                  * Add ORDERED command to tail of execution queue if
2531                  * no other older commands exist that need to be
2532                  * completed first.
2533                  */
2534                 if (!(atomic_read(&SE_DEV(cmd)->simple_cmds)))
2535                         return 1;
2536         } else {
2537                 /*
2538                  * For SIMPLE and UNTAGGED Task Attribute commands
2539                  */
2540                 atomic_inc(&SE_DEV(cmd)->simple_cmds);
2541                 smp_mb__after_atomic_inc();
2542         }
2543         /*
2544          * Otherwise if one or more outstanding ORDERED task attribute exist,
2545          * add the dormant task(s) built for the passed struct se_cmd to the
2546          * execution queue and become in Active state for this struct se_device.
2547          */
2548         if (atomic_read(&SE_DEV(cmd)->dev_ordered_sync) != 0) {
2549                 /*
2550                  * Otherwise, add cmd w/ tasks to delayed cmd queue that
2551                  * will be drained upon competion of HEAD_OF_QUEUE task.
2552                  */
2553                 spin_lock(&SE_DEV(cmd)->delayed_cmd_lock);
2554                 cmd->se_cmd_flags |= SCF_DELAYED_CMD_FROM_SAM_ATTR;
2555                 list_add_tail(&cmd->se_delayed_list,
2556                                 &SE_DEV(cmd)->delayed_cmd_list);
2557                 spin_unlock(&SE_DEV(cmd)->delayed_cmd_lock);
2558
2559                 DEBUG_STA("Added CDB: 0x%02x Task Attr: 0x%02x to"
2560                         " delayed CMD list, se_ordered_id: %u\n",
2561                         T_TASK(cmd)->t_task_cdb[0], cmd->sam_task_attr,
2562                         cmd->se_ordered_id);
2563                 /*
2564                  * Return zero to let transport_execute_tasks() know
2565                  * not to add the delayed tasks to the execution list.
2566                  */
2567                 return 0;
2568         }
2569         /*
2570          * Otherwise, no ORDERED task attributes exist..
2571          */
2572         return 1;
2573 }
2574
2575 /*
2576  * Called from fabric module context in transport_generic_new_cmd() and
2577  * transport_generic_process_write()
2578  */
2579 static int transport_execute_tasks(struct se_cmd *cmd)
2580 {
2581         int add_tasks;
2582
2583         if (!(cmd->se_cmd_flags & SCF_SE_DISABLE_ONLINE_CHECK)) {
2584                 if (se_dev_check_online(cmd->se_orig_obj_ptr) != 0) {
2585                         cmd->transport_error_status =
2586                                 PYX_TRANSPORT_LU_COMM_FAILURE;
2587                         transport_generic_request_failure(cmd, NULL, 0, 1);
2588                         return 0;
2589                 }
2590         }
2591         /*
2592          * Call transport_cmd_check_stop() to see if a fabric exception
2593          * has occured that prevents execution.
2594          */
2595         if (!(transport_cmd_check_stop(cmd, 0, TRANSPORT_PROCESSING))) {
2596                 /*
2597                  * Check for SAM Task Attribute emulation and HEAD_OF_QUEUE
2598                  * attribute for the tasks of the received struct se_cmd CDB
2599                  */
2600                 add_tasks = transport_execute_task_attr(cmd);
2601                 if (add_tasks == 0)
2602                         goto execute_tasks;
2603                 /*
2604                  * This calls transport_add_tasks_from_cmd() to handle
2605                  * HEAD_OF_QUEUE ordering for SAM Task Attribute emulation
2606                  * (if enabled) in __transport_add_task_to_execute_queue() and
2607                  * transport_add_task_check_sam_attr().
2608                  */
2609                 transport_add_tasks_from_cmd(cmd);
2610         }
2611         /*
2612          * Kick the execution queue for the cmd associated struct se_device
2613          * storage object.
2614          */
2615 execute_tasks:
2616         __transport_execute_tasks(SE_DEV(cmd));
2617         return 0;
2618 }
2619
2620 /*
2621  * Called to check struct se_device tcq depth window, and once open pull struct se_task
2622  * from struct se_device->execute_task_list and
2623  *
2624  * Called from transport_processing_thread()
2625  */
2626 static int __transport_execute_tasks(struct se_device *dev)
2627 {
2628         int error;
2629         struct se_cmd *cmd = NULL;
2630         struct se_task *task;
2631         unsigned long flags;
2632
2633         /*
2634          * Check if there is enough room in the device and HBA queue to send
2635          * struct se_transport_task's to the selected transport.
2636          */
2637 check_depth:
2638         spin_lock_irqsave(&SE_HBA(dev)->hba_queue_lock, flags);
2639         if (!(atomic_read(&dev->depth_left)) ||
2640             !(atomic_read(&SE_HBA(dev)->left_queue_depth))) {
2641                 spin_unlock_irqrestore(&SE_HBA(dev)->hba_queue_lock, flags);
2642                 return transport_tcq_window_closed(dev);
2643         }
2644         dev->dev_tcq_window_closed = 0;
2645
2646         spin_lock(&dev->execute_task_lock);
2647         task = transport_get_task_from_execute_queue(dev);
2648         spin_unlock(&dev->execute_task_lock);
2649
2650         if (!task) {
2651                 spin_unlock_irqrestore(&SE_HBA(dev)->hba_queue_lock, flags);
2652                 return 0;
2653         }
2654
2655         atomic_dec(&dev->depth_left);
2656         atomic_dec(&SE_HBA(dev)->left_queue_depth);
2657         spin_unlock_irqrestore(&SE_HBA(dev)->hba_queue_lock, flags);
2658
2659         cmd = TASK_CMD(task);
2660
2661         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2662         atomic_set(&task->task_active, 1);
2663         atomic_set(&task->task_sent, 1);
2664         atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
2665
2666         if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
2667             T_TASK(cmd)->t_task_cdbs)
2668                 atomic_set(&cmd->transport_sent, 1);
2669
2670         transport_start_task_timer(task);
2671         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2672         /*
2673          * The struct se_cmd->transport_emulate_cdb() function pointer is used
2674          * to grab REPORT_LUNS CDBs before they hit the
2675          * struct se_subsystem_api->do_task() caller below.
2676          */
2677         if (cmd->transport_emulate_cdb) {
2678                 error = cmd->transport_emulate_cdb(cmd);
2679                 if (error != 0) {
2680                         cmd->transport_error_status = error;
2681                         atomic_set(&task->task_active, 0);
2682                         atomic_set(&cmd->transport_sent, 0);
2683                         transport_stop_tasks_for_cmd(cmd);
2684                         transport_generic_request_failure(cmd, dev, 0, 1);
2685                         goto check_depth;
2686                 }
2687                 /*
2688                  * Handle the successful completion for transport_emulate_cdb()
2689                  * for synchronous operation, following SCF_EMULATE_CDB_ASYNC
2690                  * Otherwise the caller is expected to complete the task with
2691                  * proper status.
2692                  */
2693                 if (!(cmd->se_cmd_flags & SCF_EMULATE_CDB_ASYNC)) {
2694                         cmd->scsi_status = SAM_STAT_GOOD;
2695                         task->task_scsi_status = GOOD;
2696                         transport_complete_task(task, 1);
2697                 }
2698         } else {
2699                 /*
2700                  * Currently for all virtual TCM plugins including IBLOCK, FILEIO and
2701                  * RAMDISK we use the internal transport_emulate_control_cdb() logic
2702                  * with struct se_subsystem_api callers for the primary SPC-3 TYPE_DISK
2703                  * LUN emulation code.
2704                  *
2705                  * For TCM/pSCSI and all other SCF_SCSI_DATA_SG_IO_CDB I/O tasks we
2706                  * call ->do_task() directly and let the underlying TCM subsystem plugin
2707                  * code handle the CDB emulation.
2708                  */
2709                 if ((TRANSPORT(dev)->transport_type != TRANSPORT_PLUGIN_PHBA_PDEV) &&
2710                     (!(TASK_CMD(task)->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)))
2711                         error = transport_emulate_control_cdb(task);
2712                 else
2713                         error = TRANSPORT(dev)->do_task(task);
2714
2715                 if (error != 0) {
2716                         cmd->transport_error_status = error;
2717                         atomic_set(&task->task_active, 0);
2718                         atomic_set(&cmd->transport_sent, 0);
2719                         transport_stop_tasks_for_cmd(cmd);
2720                         transport_generic_request_failure(cmd, dev, 0, 1);
2721                 }
2722         }
2723
2724         goto check_depth;
2725
2726         return 0;
2727 }
2728
2729 void transport_new_cmd_failure(struct se_cmd *se_cmd)
2730 {
2731         unsigned long flags;
2732         /*
2733          * Any unsolicited data will get dumped for failed command inside of
2734          * the fabric plugin
2735          */
2736         spin_lock_irqsave(&T_TASK(se_cmd)->t_state_lock, flags);
2737         se_cmd->se_cmd_flags |= SCF_SE_CMD_FAILED;
2738         se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
2739         spin_unlock_irqrestore(&T_TASK(se_cmd)->t_state_lock, flags);
2740
2741         CMD_TFO(se_cmd)->new_cmd_failure(se_cmd);
2742 }
2743
2744 static void transport_nop_wait_for_tasks(struct se_cmd *, int, int);
2745
2746 static inline u32 transport_get_sectors_6(
2747         unsigned char *cdb,
2748         struct se_cmd *cmd,
2749         int *ret)
2750 {
2751         struct se_device *dev = SE_LUN(cmd)->lun_se_dev;
2752
2753         /*
2754          * Assume TYPE_DISK for non struct se_device objects.
2755          * Use 8-bit sector value.
2756          */
2757         if (!dev)
2758                 goto type_disk;
2759
2760         /*
2761          * Use 24-bit allocation length for TYPE_TAPE.
2762          */
2763         if (TRANSPORT(dev)->get_device_type(dev) == TYPE_TAPE)
2764                 return (u32)(cdb[2] << 16) + (cdb[3] << 8) + cdb[4];
2765
2766         /*
2767          * Everything else assume TYPE_DISK Sector CDB location.
2768          * Use 8-bit sector value.
2769          */
2770 type_disk:
2771         return (u32)cdb[4];
2772 }
2773
2774 static inline u32 transport_get_sectors_10(
2775         unsigned char *cdb,
2776         struct se_cmd *cmd,
2777         int *ret)
2778 {
2779         struct se_device *dev = SE_LUN(cmd)->lun_se_dev;
2780
2781         /*
2782          * Assume TYPE_DISK for non struct se_device objects.
2783          * Use 16-bit sector value.
2784          */
2785         if (!dev)
2786                 goto type_disk;
2787
2788         /*
2789          * XXX_10 is not defined in SSC, throw an exception
2790          */
2791         if (TRANSPORT(dev)->get_device_type(dev) == TYPE_TAPE) {
2792                 *ret = -1;
2793                 return 0;
2794         }
2795
2796         /*
2797          * Everything else assume TYPE_DISK Sector CDB location.
2798          * Use 16-bit sector value.
2799          */
2800 type_disk:
2801         return (u32)(cdb[7] << 8) + cdb[8];
2802 }
2803
2804 static inline u32 transport_get_sectors_12(
2805         unsigned char *cdb,
2806         struct se_cmd *cmd,
2807         int *ret)
2808 {
2809         struct se_device *dev = SE_LUN(cmd)->lun_se_dev;
2810
2811         /*
2812          * Assume TYPE_DISK for non struct se_device objects.
2813          * Use 32-bit sector value.
2814          */
2815         if (!dev)
2816                 goto type_disk;
2817
2818         /*
2819          * XXX_12 is not defined in SSC, throw an exception
2820          */
2821         if (TRANSPORT(dev)->get_device_type(dev) == TYPE_TAPE) {
2822                 *ret = -1;
2823                 return 0;
2824         }
2825
2826         /*
2827          * Everything else assume TYPE_DISK Sector CDB location.
2828          * Use 32-bit sector value.
2829          */
2830 type_disk:
2831         return (u32)(cdb[6] << 24) + (cdb[7] << 16) + (cdb[8] << 8) + cdb[9];
2832 }
2833
2834 static inline u32 transport_get_sectors_16(
2835         unsigned char *cdb,
2836         struct se_cmd *cmd,
2837         int *ret)
2838 {
2839         struct se_device *dev = SE_LUN(cmd)->lun_se_dev;
2840
2841         /*
2842          * Assume TYPE_DISK for non struct se_device objects.
2843          * Use 32-bit sector value.
2844          */
2845         if (!dev)
2846                 goto type_disk;
2847
2848         /*
2849          * Use 24-bit allocation length for TYPE_TAPE.
2850          */
2851         if (TRANSPORT(dev)->get_device_type(dev) == TYPE_TAPE)
2852                 return (u32)(cdb[12] << 16) + (cdb[13] << 8) + cdb[14];
2853
2854 type_disk:
2855         return (u32)(cdb[10] << 24) + (cdb[11] << 16) +
2856                     (cdb[12] << 8) + cdb[13];
2857 }
2858
2859 /*
2860  * Used for VARIABLE_LENGTH_CDB WRITE_32 and READ_32 variants
2861  */
2862 static inline u32 transport_get_sectors_32(
2863         unsigned char *cdb,
2864         struct se_cmd *cmd,
2865         int *ret)
2866 {
2867         /*
2868          * Assume TYPE_DISK for non struct se_device objects.
2869          * Use 32-bit sector value.
2870          */
2871         return (u32)(cdb[28] << 24) + (cdb[29] << 16) +
2872                     (cdb[30] << 8) + cdb[31];
2873
2874 }
2875
2876 static inline u32 transport_get_size(
2877         u32 sectors,
2878         unsigned char *cdb,
2879         struct se_cmd *cmd)
2880 {
2881         struct se_device *dev = SE_DEV(cmd);
2882
2883         if (TRANSPORT(dev)->get_device_type(dev) == TYPE_TAPE) {
2884                 if (cdb[1] & 1) { /* sectors */
2885                         return DEV_ATTRIB(dev)->block_size * sectors;
2886                 } else /* bytes */
2887                         return sectors;
2888         }
2889 #if 0
2890         printk(KERN_INFO "Returning block_size: %u, sectors: %u == %u for"
2891                         " %s object\n", DEV_ATTRIB(dev)->block_size, sectors,
2892                         DEV_ATTRIB(dev)->block_size * sectors,
2893                         TRANSPORT(dev)->name);
2894 #endif
2895         return DEV_ATTRIB(dev)->block_size * sectors;
2896 }
2897
2898 unsigned char transport_asciihex_to_binaryhex(unsigned char val[2])
2899 {
2900         unsigned char result = 0;
2901         /*
2902          * MSB
2903          */
2904         if ((val[0] >= 'a') && (val[0] <= 'f'))
2905                 result = ((val[0] - 'a' + 10) & 0xf) << 4;
2906         else
2907                 if ((val[0] >= 'A') && (val[0] <= 'F'))
2908                         result = ((val[0] - 'A' + 10) & 0xf) << 4;
2909                 else /* digit */
2910                         result = ((val[0] - '0') & 0xf) << 4;
2911         /*
2912          * LSB
2913          */
2914         if ((val[1] >= 'a') && (val[1] <= 'f'))
2915                 result |= ((val[1] - 'a' + 10) & 0xf);
2916         else
2917                 if ((val[1] >= 'A') && (val[1] <= 'F'))
2918                         result |= ((val[1] - 'A' + 10) & 0xf);
2919                 else /* digit */
2920                         result |= ((val[1] - '0') & 0xf);
2921
2922         return result;
2923 }
2924 EXPORT_SYMBOL(transport_asciihex_to_binaryhex);
2925
2926 static void transport_xor_callback(struct se_cmd *cmd)
2927 {
2928         unsigned char *buf, *addr;
2929         struct se_mem *se_mem;
2930         unsigned int offset;
2931         int i;
2932         /*
2933          * From sbc3r22.pdf section 5.48 XDWRITEREAD (10) command
2934          *
2935          * 1) read the specified logical block(s);
2936          * 2) transfer logical blocks from the data-out buffer;
2937          * 3) XOR the logical blocks transferred from the data-out buffer with
2938          *    the logical blocks read, storing the resulting XOR data in a buffer;
2939          * 4) if the DISABLE WRITE bit is set to zero, then write the logical
2940          *    blocks transferred from the data-out buffer; and
2941          * 5) transfer the resulting XOR data to the data-in buffer.
2942          */
2943         buf = kmalloc(cmd->data_length, GFP_KERNEL);
2944         if (!(buf)) {
2945                 printk(KERN_ERR "Unable to allocate xor_callback buf\n");
2946                 return;
2947         }
2948         /*
2949          * Copy the scatterlist WRITE buffer located at T_TASK(cmd)->t_mem_list
2950          * into the locally allocated *buf
2951          */
2952         transport_memcpy_se_mem_read_contig(cmd, buf, T_TASK(cmd)->t_mem_list);
2953         /*
2954          * Now perform the XOR against the BIDI read memory located at
2955          * T_TASK(cmd)->t_mem_bidi_list
2956          */
2957
2958         offset = 0;
2959         list_for_each_entry(se_mem, T_TASK(cmd)->t_mem_bidi_list, se_list) {
2960                 addr = (unsigned char *)kmap_atomic(se_mem->se_page, KM_USER0);
2961                 if (!(addr))
2962                         goto out;
2963
2964                 for (i = 0; i < se_mem->se_len; i++)
2965                         *(addr + se_mem->se_off + i) ^= *(buf + offset + i);
2966
2967                 offset += se_mem->se_len;
2968                 kunmap_atomic(addr, KM_USER0);
2969         }
2970 out:
2971         kfree(buf);
2972 }
2973
2974 /*
2975  * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
2976  */
2977 static int transport_get_sense_data(struct se_cmd *cmd)
2978 {
2979         unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
2980         struct se_device *dev;
2981         struct se_task *task = NULL, *task_tmp;
2982         unsigned long flags;
2983         u32 offset = 0;
2984
2985         if (!SE_LUN(cmd)) {
2986                 printk(KERN_ERR "SE_LUN(cmd) is NULL\n");
2987                 return -1;
2988         }
2989         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
2990         if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
2991                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
2992                 return 0;
2993         }
2994
2995         list_for_each_entry_safe(task, task_tmp,
2996                                 &T_TASK(cmd)->t_task_list, t_list) {
2997
2998                 if (!task->task_sense)
2999                         continue;
3000
3001                 dev = task->se_dev;
3002                 if (!(dev))
3003                         continue;
3004
3005                 if (!TRANSPORT(dev)->get_sense_buffer) {
3006                         printk(KERN_ERR "TRANSPORT(dev)->get_sense_buffer"
3007                                         " is NULL\n");
3008                         continue;
3009                 }
3010
3011                 sense_buffer = TRANSPORT(dev)->get_sense_buffer(task);
3012                 if (!(sense_buffer)) {
3013                         printk(KERN_ERR "ITT[0x%08x]_TASK[%d]: Unable to locate"
3014                                 " sense buffer for task with sense\n",
3015                                 CMD_TFO(cmd)->get_task_tag(cmd), task->task_no);
3016                         continue;
3017                 }
3018                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
3019
3020                 offset = CMD_TFO(cmd)->set_fabric_sense_len(cmd,
3021                                 TRANSPORT_SENSE_BUFFER);
3022
3023                 memcpy((void *)&buffer[offset], (void *)sense_buffer,
3024                                 TRANSPORT_SENSE_BUFFER);
3025                 cmd->scsi_status = task->task_scsi_status;
3026                 /* Automatically padded */
3027                 cmd->scsi_sense_length =
3028                                 (TRANSPORT_SENSE_BUFFER + offset);
3029
3030                 printk(KERN_INFO "HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x"
3031                                 " and sense\n",
3032                         dev->se_hba->hba_id, TRANSPORT(dev)->name,
3033                                 cmd->scsi_status);
3034                 return 0;
3035         }
3036         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
3037
3038         return -1;
3039 }
3040
3041 static int transport_allocate_resources(struct se_cmd *cmd)
3042 {
3043         u32 length = cmd->data_length;
3044
3045         if ((cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) ||
3046             (cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB))
3047                 return transport_generic_get_mem(cmd, length, PAGE_SIZE);
3048         else if (cmd->se_cmd_flags & SCF_SCSI_CONTROL_NONSG_IO_CDB)
3049                 return transport_generic_allocate_buf(cmd, length);
3050         else
3051                 return 0;
3052 }
3053
3054 static int
3055 transport_handle_reservation_conflict(struct se_cmd *cmd)
3056 {
3057         cmd->transport_wait_for_tasks = &transport_nop_wait_for_tasks;
3058         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
3059         cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
3060         cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
3061         /*
3062          * For UA Interlock Code 11b, a RESERVATION CONFLICT will
3063          * establish a UNIT ATTENTION with PREVIOUS RESERVATION
3064          * CONFLICT STATUS.
3065          *
3066          * See spc4r17, section 7.4.6 Control Mode Page, Table 349
3067          */
3068         if (SE_SESS(cmd) &&
3069             DEV_ATTRIB(cmd->se_dev)->emulate_ua_intlck_ctrl == 2)
3070                 core_scsi3_ua_allocate(SE_SESS(cmd)->se_node_acl,
3071                         cmd->orig_fe_lun, 0x2C,
3072                         ASCQ_2CH_PREVIOUS_RESERVATION_CONFLICT_STATUS);
3073         return -2;
3074 }
3075
3076 /*      transport_generic_cmd_sequencer():
3077  *
3078  *      Generic Command Sequencer that should work for most DAS transport
3079  *      drivers.
3080  *
3081  *      Called from transport_generic_allocate_tasks() in the $FABRIC_MOD
3082  *      RX Thread.
3083  *
3084  *      FIXME: Need to support other SCSI OPCODES where as well.
3085  */
3086 static int transport_generic_cmd_sequencer(
3087         struct se_cmd *cmd,
3088         unsigned char *cdb)
3089 {
3090         struct se_device *dev = SE_DEV(cmd);
3091         struct se_subsystem_dev *su_dev = dev->se_sub_dev;
3092         int ret = 0, sector_ret = 0, passthrough;
3093         u32 sectors = 0, size = 0, pr_reg_type = 0;
3094         u16 service_action;
3095         u8 alua_ascq = 0;
3096         /*
3097          * Check for an existing UNIT ATTENTION condition
3098          */
3099         if (core_scsi3_ua_check(cmd, cdb) < 0) {
3100                 cmd->transport_wait_for_tasks =
3101                                 &transport_nop_wait_for_tasks;
3102                 cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
3103                 cmd->scsi_sense_reason = TCM_CHECK_CONDITION_UNIT_ATTENTION;
3104                 return -2;
3105         }
3106         /*
3107          * Check status of Asymmetric Logical Unit Assignment port
3108          */
3109         ret = T10_ALUA(su_dev)->alua_state_check(cmd, cdb, &alua_ascq);
3110         if (ret != 0) {
3111                 cmd->transport_wait_for_tasks = &transport_nop_wait_for_tasks;
3112                 /*
3113                  * Set SCSI additional sense code (ASC) to 'LUN Not Accessable';
3114                  * The ALUA additional sense code qualifier (ASCQ) is determined
3115                  * by the ALUA primary or secondary access state..
3116                  */
3117                 if (ret > 0) {
3118 #if 0
3119                         printk(KERN_INFO "[%s]: ALUA TG Port not available,"
3120                                 " SenseKey: NOT_READY, ASC/ASCQ: 0x04/0x%02x\n",
3121                                 CMD_TFO(cmd)->get_fabric_name(), alua_ascq);
3122 #endif
3123                         transport_set_sense_codes(cmd, 0x04, alua_ascq);
3124                         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
3125                         cmd->scsi_sense_reason = TCM_CHECK_CONDITION_NOT_READY;
3126                         return -2;
3127                 }
3128                 goto out_invalid_cdb_field;
3129         }
3130         /*
3131          * Check status for SPC-3 Persistent Reservations
3132          */
3133         if (T10_PR_OPS(su_dev)->t10_reservation_check(cmd, &pr_reg_type) != 0) {
3134                 if (T10_PR_OPS(su_dev)->t10_seq_non_holder(
3135                                         cmd, cdb, pr_reg_type) != 0)
3136                         return transport_handle_reservation_conflict(cmd);
3137                 /*
3138                  * This means the CDB is allowed for the SCSI Initiator port
3139                  * when said port is *NOT* holding the legacy SPC-2 or
3140                  * SPC-3 Persistent Reservation.
3141                  */
3142         }
3143
3144         switch (cdb[0]) {
3145         case READ_6:
3146                 sectors = transport_get_sectors_6(cdb, cmd, &sector_ret);
3147                 if (sector_ret)
3148                         goto out_unsupported_cdb;
3149                 size = transport_get_size(sectors, cdb, cmd);
3150                 cmd->transport_split_cdb = &split_cdb_XX_6;
3151                 T_TASK(cmd)->t_task_lba = transport_lba_21(cdb);
3152                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3153                 break;
3154         case READ_10:
3155                 sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
3156                 if (sector_ret)
3157                         goto out_unsupported_cdb;
3158                 size = transport_get_size(sectors, cdb, cmd);
3159                 cmd->transport_split_cdb = &split_cdb_XX_10;
3160                 T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3161                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3162                 break;
3163         case READ_12:
3164                 sectors = transport_get_sectors_12(cdb, cmd, &sector_ret);
3165                 if (sector_ret)
3166                         goto out_unsupported_cdb;
3167                 size = transport_get_size(sectors, cdb, cmd);
3168                 cmd->transport_split_cdb = &split_cdb_XX_12;
3169                 T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3170                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3171                 break;
3172         case READ_16:
3173                 sectors = transport_get_sectors_16(cdb, cmd, &sector_ret);
3174                 if (sector_ret)
3175                         goto out_unsupported_cdb;
3176                 size = transport_get_size(sectors, cdb, cmd);
3177                 cmd->transport_split_cdb = &split_cdb_XX_16;
3178                 T_TASK(cmd)->t_task_lba = transport_lba_64(cdb);
3179                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3180                 break;
3181         case WRITE_6:
3182                 sectors = transport_get_sectors_6(cdb, cmd, &sector_ret);
3183                 if (sector_ret)
3184                         goto out_unsupported_cdb;
3185                 size = transport_get_size(sectors, cdb, cmd);
3186                 cmd->transport_split_cdb = &split_cdb_XX_6;
3187                 T_TASK(cmd)->t_task_lba = transport_lba_21(cdb);
3188                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3189                 break;
3190         case WRITE_10:
3191                 sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
3192                 if (sector_ret)
3193                         goto out_unsupported_cdb;
3194                 size = transport_get_size(sectors, cdb, cmd);
3195                 cmd->transport_split_cdb = &split_cdb_XX_10;
3196                 T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3197                 T_TASK(cmd)->t_tasks_fua = (cdb[1] & 0x8);
3198                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3199                 break;
3200         case WRITE_12:
3201                 sectors = transport_get_sectors_12(cdb, cmd, &sector_ret);
3202                 if (sector_ret)
3203                         goto out_unsupported_cdb;
3204                 size = transport_get_size(sectors, cdb, cmd);
3205                 cmd->transport_split_cdb = &split_cdb_XX_12;
3206                 T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3207                 T_TASK(cmd)->t_tasks_fua = (cdb[1] & 0x8);
3208                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3209                 break;
3210         case WRITE_16:
3211                 sectors = transport_get_sectors_16(cdb, cmd, &sector_ret);
3212                 if (sector_ret)
3213                         goto out_unsupported_cdb;
3214                 size = transport_get_size(sectors, cdb, cmd);
3215                 cmd->transport_split_cdb = &split_cdb_XX_16;
3216                 T_TASK(cmd)->t_task_lba = transport_lba_64(cdb);
3217                 T_TASK(cmd)->t_tasks_fua = (cdb[1] & 0x8);
3218                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3219                 break;
3220         case XDWRITEREAD_10:
3221                 if ((cmd->data_direction != DMA_TO_DEVICE) ||
3222                     !(T_TASK(cmd)->t_tasks_bidi))
3223                         goto out_invalid_cdb_field;
3224                 sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
3225                 if (sector_ret)
3226                         goto out_unsupported_cdb;
3227                 size = transport_get_size(sectors, cdb, cmd);
3228                 cmd->transport_split_cdb = &split_cdb_XX_10;
3229                 T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3230                 cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3231                 passthrough = (TRANSPORT(dev)->transport_type ==
3232                                 TRANSPORT_PLUGIN_PHBA_PDEV);
3233                 /*
3234                  * Skip the remaining assignments for TCM/PSCSI passthrough
3235                  */
3236                 if (passthrough)
3237                         break;
3238                 /*
3239                  * Setup BIDI XOR callback to be run during transport_generic_complete_ok()
3240                  */
3241                 cmd->transport_complete_callback = &transport_xor_callback;
3242                 T_TASK(cmd)->t_tasks_fua = (cdb[1] & 0x8);
3243                 break;
3244         case VARIABLE_LENGTH_CMD:
3245                 service_action = get_unaligned_be16(&cdb[8]);
3246                 /*
3247                  * Determine if this is TCM/PSCSI device and we should disable
3248                  * internal emulation for this CDB.
3249                  */
3250                 passthrough = (TRANSPORT(dev)->transport_type ==
3251                                         TRANSPORT_PLUGIN_PHBA_PDEV);
3252
3253                 switch (service_action) {
3254                 case XDWRITEREAD_32:
3255                         sectors = transport_get_sectors_32(cdb, cmd, &sector_ret);
3256                         if (sector_ret)
3257                                 goto out_unsupported_cdb;
3258                         size = transport_get_size(sectors, cdb, cmd);
3259                         /*
3260                          * Use WRITE_32 and READ_32 opcodes for the emulated
3261                          * XDWRITE_READ_32 logic.
3262                          */
3263                         cmd->transport_split_cdb = &split_cdb_XX_32;
3264                         T_TASK(cmd)->t_task_lba = transport_lba_64_ext(cdb);
3265                         cmd->se_cmd_flags |= SCF_SCSI_DATA_SG_IO_CDB;
3266
3267                         /*
3268                          * Skip the remaining assignments for TCM/PSCSI passthrough
3269                          */
3270                         if (passthrough)
3271                                 break;
3272
3273                         /*
3274                          * Setup BIDI XOR callback to be run during
3275                          * transport_generic_complete_ok()
3276                          */
3277                         cmd->transport_complete_callback = &transport_xor_callback;
3278                         T_TASK(cmd)->t_tasks_fua = (cdb[10] & 0x8);
3279                         break;
3280                 case WRITE_SAME_32:
3281                         sectors = transport_get_sectors_32(cdb, cmd, &sector_ret);
3282                         if (sector_ret)
3283                                 goto out_unsupported_cdb;
3284                         size = transport_get_size(sectors, cdb, cmd);
3285                         T_TASK(cmd)->t_task_lba = get_unaligned_be64(&cdb[12]);
3286                         cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3287
3288                         /*
3289                          * Skip the remaining assignments for TCM/PSCSI passthrough
3290                          */
3291                         if (passthrough)
3292                                 break;
3293
3294                         if ((cdb[10] & 0x04) || (cdb[10] & 0x02)) {
3295                                 printk(KERN_ERR "WRITE_SAME PBDATA and LBDATA"
3296                                         " bits not supported for Block Discard"
3297                                         " Emulation\n");
3298                                 goto out_invalid_cdb_field;
3299                         }
3300                         /*
3301                          * Currently for the emulated case we only accept
3302                          * tpws with the UNMAP=1 bit set.
3303                          */
3304                         if (!(cdb[10] & 0x08)) {
3305                                 printk(KERN_ERR "WRITE_SAME w/o UNMAP bit not"
3306                                         " supported for Block Discard Emulation\n");
3307                                 goto out_invalid_cdb_field;
3308                         }
3309                         break;
3310                 default:
3311                         printk(KERN_ERR "VARIABLE_LENGTH_CMD service action"
3312                                 " 0x%04x not supported\n", service_action);
3313                         goto out_unsupported_cdb;
3314                 }
3315                 break;
3316         case 0xa3:
3317                 if (TRANSPORT(dev)->get_device_type(dev) != TYPE_ROM) {
3318                         /* MAINTENANCE_IN from SCC-2 */
3319                         /*
3320                          * Check for emulated MI_REPORT_TARGET_PGS.
3321                          */
3322                         if (cdb[1] == MI_REPORT_TARGET_PGS) {
3323                                 cmd->transport_emulate_cdb =
3324                                 (T10_ALUA(su_dev)->alua_type ==
3325                                  SPC3_ALUA_EMULATED) ?
3326                                 &core_emulate_report_target_port_groups :
3327                                 NULL;
3328                         }
3329                         size = (cdb[6] << 24) | (cdb[7] << 16) |
3330                                (cdb[8] << 8) | cdb[9];
3331                 } else {
3332                         /* GPCMD_SEND_KEY from multi media commands */
3333                         size = (cdb[8] << 8) + cdb[9];
3334                 }
3335                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3336                 break;
3337         case MODE_SELECT:
3338                 size = cdb[4];
3339                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3340                 break;
3341         case MODE_SELECT_10:
3342                 size = (cdb[7] << 8) + cdb[8];
3343                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3344                 break;
3345         case MODE_SENSE:
3346                 size = cdb[4];
3347                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3348                 break;
3349         case MODE_SENSE_10:
3350         case GPCMD_READ_BUFFER_CAPACITY:
3351         case GPCMD_SEND_OPC:
3352         case LOG_SELECT:
3353         case LOG_SENSE:
3354                 size = (cdb[7] << 8) + cdb[8];
3355                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3356                 break;
3357         case READ_BLOCK_LIMITS:
3358                 size = READ_BLOCK_LEN;
3359                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3360                 break;
3361         case GPCMD_GET_CONFIGURATION:
3362         case GPCMD_READ_FORMAT_CAPACITIES:
3363         case GPCMD_READ_DISC_INFO:
3364         case GPCMD_READ_TRACK_RZONE_INFO:
3365                 size = (cdb[7] << 8) + cdb[8];
3366                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3367                 break;
3368         case PERSISTENT_RESERVE_IN:
3369         case PERSISTENT_RESERVE_OUT:
3370                 cmd->transport_emulate_cdb =
3371                         (T10_RES(su_dev)->res_type ==
3372                          SPC3_PERSISTENT_RESERVATIONS) ?
3373                         &core_scsi3_emulate_pr : NULL;
3374                 size = (cdb[7] << 8) + cdb[8];
3375                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3376                 break;
3377         case GPCMD_MECHANISM_STATUS:
3378         case GPCMD_READ_DVD_STRUCTURE:
3379                 size = (cdb[8] << 8) + cdb[9];
3380                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3381                 break;
3382         case READ_POSITION:
3383                 size = READ_POSITION_LEN;
3384                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3385                 break;
3386         case 0xa4:
3387                 if (TRANSPORT(dev)->get_device_type(dev) != TYPE_ROM) {
3388                         /* MAINTENANCE_OUT from SCC-2
3389                          *
3390                          * Check for emulated MO_SET_TARGET_PGS.
3391                          */
3392                         if (cdb[1] == MO_SET_TARGET_PGS) {
3393                                 cmd->transport_emulate_cdb =
3394                                 (T10_ALUA(su_dev)->alua_type ==
3395                                         SPC3_ALUA_EMULATED) ?
3396                                 &core_emulate_set_target_port_groups :
3397                                 NULL;
3398                         }
3399
3400                         size = (cdb[6] << 24) | (cdb[7] << 16) |
3401                                (cdb[8] << 8) | cdb[9];
3402                 } else  {
3403                         /* GPCMD_REPORT_KEY from multi media commands */
3404                         size = (cdb[8] << 8) + cdb[9];
3405                 }
3406                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3407                 break;
3408         case INQUIRY:
3409                 size = (cdb[3] << 8) + cdb[4];
3410                 /*
3411                  * Do implict HEAD_OF_QUEUE processing for INQUIRY.
3412                  * See spc4r17 section 5.3
3413                  */
3414                 if (SE_DEV(cmd)->dev_task_attr_type == SAM_TASK_ATTR_EMULATED)
3415                         cmd->sam_task_attr = TASK_ATTR_HOQ;
3416                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3417                 break;
3418         case READ_BUFFER:
3419                 size = (cdb[6] << 16) + (cdb[7] << 8) + cdb[8];
3420                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3421                 break;
3422         case READ_CAPACITY:
3423                 size = READ_CAP_LEN;
3424                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3425                 break;
3426         case READ_MEDIA_SERIAL_NUMBER:
3427         case SECURITY_PROTOCOL_IN:
3428         case SECURITY_PROTOCOL_OUT:
3429                 size = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
3430                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3431                 break;
3432         case SERVICE_ACTION_IN:
3433         case ACCESS_CONTROL_IN:
3434         case ACCESS_CONTROL_OUT:
3435         case EXTENDED_COPY:
3436         case READ_ATTRIBUTE:
3437         case RECEIVE_COPY_RESULTS:
3438         case WRITE_ATTRIBUTE:
3439                 size = (cdb[10] << 24) | (cdb[11] << 16) |
3440                        (cdb[12] << 8) | cdb[13];
3441                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3442                 break;
3443         case RECEIVE_DIAGNOSTIC:
3444         case SEND_DIAGNOSTIC:
3445                 size = (cdb[3] << 8) | cdb[4];
3446                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3447                 break;
3448 /* #warning FIXME: Figure out correct GPCMD_READ_CD blocksize. */
3449 #if 0
3450         case GPCMD_READ_CD:
3451                 sectors = (cdb[6] << 16) + (cdb[7] << 8) + cdb[8];
3452                 size = (2336 * sectors);
3453                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3454                 break;
3455 #endif
3456         case READ_TOC:
3457                 size = cdb[8];
3458                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3459                 break;
3460         case REQUEST_SENSE:
3461                 size = cdb[4];
3462                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3463                 break;
3464         case READ_ELEMENT_STATUS:
3465                 size = 65536 * cdb[7] + 256 * cdb[8] + cdb[9];
3466                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3467                 break;
3468         case WRITE_BUFFER:
3469                 size = (cdb[6] << 16) + (cdb[7] << 8) + cdb[8];
3470                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3471                 break;
3472         case RESERVE:
3473         case RESERVE_10:
3474                 /*
3475                  * The SPC-2 RESERVE does not contain a size in the SCSI CDB.
3476                  * Assume the passthrough or $FABRIC_MOD will tell us about it.
3477                  */
3478                 if (cdb[0] == RESERVE_10)
3479                         size = (cdb[7] << 8) | cdb[8];
3480                 else
3481                         size = cmd->data_length;
3482
3483                 /*
3484                  * Setup the legacy emulated handler for SPC-2 and
3485                  * >= SPC-3 compatible reservation handling (CRH=1)
3486                  * Otherwise, we assume the underlying SCSI logic is
3487                  * is running in SPC_PASSTHROUGH, and wants reservations
3488                  * emulation disabled.
3489                  */
3490                 cmd->transport_emulate_cdb =
3491                                 (T10_RES(su_dev)->res_type !=
3492                                  SPC_PASSTHROUGH) ?
3493                                 &core_scsi2_emulate_crh : NULL;
3494                 cmd->se_cmd_flags |= SCF_SCSI_NON_DATA_CDB;
3495                 break;
3496         case RELEASE:
3497         case RELEASE_10:
3498                 /*
3499                  * The SPC-2 RELEASE does not contain a size in the SCSI CDB.
3500                  * Assume the passthrough or $FABRIC_MOD will tell us about it.
3501                 */
3502                 if (cdb[0] == RELEASE_10)
3503                         size = (cdb[7] << 8) | cdb[8];
3504                 else
3505                         size = cmd->data_length;
3506
3507                 cmd->transport_emulate_cdb =
3508                                 (T10_RES(su_dev)->res_type !=
3509                                  SPC_PASSTHROUGH) ?
3510                                 &core_scsi2_emulate_crh : NULL;
3511                 cmd->se_cmd_flags |= SCF_SCSI_NON_DATA_CDB;
3512                 break;
3513         case SYNCHRONIZE_CACHE:
3514         case 0x91: /* SYNCHRONIZE_CACHE_16: */
3515                 /*
3516                  * Extract LBA and range to be flushed for emulated SYNCHRONIZE_CACHE
3517                  */
3518                 if (cdb[0] == SYNCHRONIZE_CACHE) {
3519                         sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
3520                         T_TASK(cmd)->t_task_lba = transport_lba_32(cdb);
3521                 } else {
3522                         sectors = transport_get_sectors_16(cdb, cmd, &sector_ret);
3523                         T_TASK(cmd)->t_task_lba = transport_lba_64(cdb);
3524                 }
3525                 if (sector_ret)
3526                         goto out_unsupported_cdb;
3527
3528                 size = transport_get_size(sectors, cdb, cmd);
3529                 cmd->se_cmd_flags |= SCF_SCSI_NON_DATA_CDB;
3530
3531                 /*
3532                  * For TCM/pSCSI passthrough, skip cmd->transport_emulate_cdb()
3533                  */
3534                 if (TRANSPORT(dev)->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV)
3535                         break;
3536                 /*
3537                  * Set SCF_EMULATE_CDB_ASYNC to ensure asynchronous operation
3538                  * for SYNCHRONIZE_CACHE* Immed=1 case in __transport_execute_tasks()
3539                  */
3540                 cmd->se_cmd_flags |= SCF_EMULATE_CDB_ASYNC;
3541                 /*
3542                  * Check to ensure that LBA + Range does not exceed past end of
3543                  * device.
3544                  */
3545                 if (transport_get_sectors(cmd) < 0)
3546                         goto out_invalid_cdb_field;
3547                 break;
3548         case UNMAP:
3549                 size = get_unaligned_be16(&cdb[7]);
3550                 passthrough = (TRANSPORT(dev)->transport_type ==
3551                                 TRANSPORT_PLUGIN_PHBA_PDEV);
3552                 /*
3553                  * Determine if the received UNMAP used to for direct passthrough
3554                  * into Linux/SCSI with struct request via TCM/pSCSI or we are
3555                  * signaling the use of internal transport_generic_unmap() emulation
3556                  * for UNMAP -> Linux/BLOCK disbard with TCM/IBLOCK and TCM/FILEIO
3557                  * subsystem plugin backstores.
3558                  */
3559                 if (!(passthrough))
3560                         cmd->se_cmd_flags |= SCF_EMULATE_SYNC_UNMAP;
3561
3562                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3563                 break;
3564         case WRITE_SAME_16:
3565                 sectors = transport_get_sectors_16(cdb, cmd, &sector_ret);
3566                 if (sector_ret)
3567                         goto out_unsupported_cdb;
3568                 size = transport_get_size(sectors, cdb, cmd);
3569                 T_TASK(cmd)->t_task_lba = get_unaligned_be16(&cdb[2]);
3570                 passthrough = (TRANSPORT(dev)->transport_type ==
3571                                 TRANSPORT_PLUGIN_PHBA_PDEV);
3572                 /*
3573                  * Determine if the received WRITE_SAME_16 is used to for direct
3574                  * passthrough into Linux/SCSI with struct request via TCM/pSCSI
3575                  * or we are signaling the use of internal WRITE_SAME + UNMAP=1
3576                  * emulation for -> Linux/BLOCK disbard with TCM/IBLOCK and
3577                  * TCM/FILEIO subsystem plugin backstores.
3578                  */
3579                 if (!(passthrough)) {
3580                         if ((cdb[1] & 0x04) || (cdb[1] & 0x02)) {
3581                                 printk(KERN_ERR "WRITE_SAME PBDATA and LBDATA"
3582                                         " bits not supported for Block Discard"
3583                                         " Emulation\n");
3584                                 goto out_invalid_cdb_field;
3585                         }
3586                         /*
3587                          * Currently for the emulated case we only accept
3588                          * tpws with the UNMAP=1 bit set.
3589                          */
3590                         if (!(cdb[1] & 0x08)) {
3591                                 printk(KERN_ERR "WRITE_SAME w/o UNMAP bit not "
3592                                         " supported for Block Discard Emulation\n");
3593                                 goto out_invalid_cdb_field;
3594                         }
3595                 }
3596                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
3597                 break;
3598         case ALLOW_MEDIUM_REMOVAL:
3599         case GPCMD_CLOSE_TRACK:
3600         case ERASE:
3601         case INITIALIZE_ELEMENT_STATUS:
3602         case GPCMD_LOAD_UNLOAD:
3603         case REZERO_UNIT:
3604         case SEEK_10:
3605         case GPCMD_SET_SPEED:
3606         case SPACE:
3607         case START_STOP:
3608         case TEST_UNIT_READY:
3609         case VERIFY:
3610         case WRITE_FILEMARKS:
3611         case MOVE_MEDIUM:
3612                 cmd->se_cmd_flags |= SCF_SCSI_NON_DATA_CDB;
3613                 break;
3614         case REPORT_LUNS:
3615                 cmd->transport_emulate_cdb =
3616                                 &transport_core_report_lun_response;
3617                 size = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
3618                 /*
3619                  * Do implict HEAD_OF_QUEUE processing for REPORT_LUNS
3620                  * See spc4r17 section 5.3
3621                  */
3622                 if (SE_DEV(cmd)->dev_task_attr_type == SAM_TASK_ATTR_EMULATED)
3623                         cmd->sam_task_attr = TASK_ATTR_HOQ;
3624                 cmd->se_cmd_flags |= SCF_SCSI_CONTROL_NONSG_IO_CDB;
3625                 break;
3626         default:
3627                 printk(KERN_WARNING "TARGET_CORE[%s]: Unsupported SCSI Opcode"
3628                         " 0x%02x, sending CHECK_CONDITION.\n",
3629                         CMD_TFO(cmd)->get_fabric_name(), cdb[0]);
3630                 cmd->transport_wait_for_tasks = &transport_nop_wait_for_tasks;
3631                 goto out_unsupported_cdb;
3632         }
3633
3634         if (size != cmd->data_length) {
3635                 printk(KERN_WARNING "TARGET_CORE[%s]: Expected Transfer Length:"
3636                         " %u does not match SCSI CDB Length: %u for SAM Opcode:"
3637                         " 0x%02x\n", CMD_TFO(cmd)->get_fabric_name(),
3638                                 cmd->data_length, size, cdb[0]);
3639
3640                 cmd->cmd_spdtl = size;
3641
3642                 if (cmd->data_direction == DMA_TO_DEVICE) {
3643                         printk(KERN_ERR "Rejecting underflow/overflow"
3644                                         " WRITE data\n");
3645                         goto out_invalid_cdb_field;
3646                 }
3647                 /*
3648                  * Reject READ_* or WRITE_* with overflow/underflow for
3649                  * type SCF_SCSI_DATA_SG_IO_CDB.
3650                  */
3651                 if (!(ret) && (DEV_ATTRIB(dev)->block_size != 512))  {
3652                         printk(KERN_ERR "Failing OVERFLOW/UNDERFLOW for LBA op"
3653                                 " CDB on non 512-byte sector setup subsystem"
3654                                 " plugin: %s\n", TRANSPORT(dev)->name);
3655                         /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
3656                         goto out_invalid_cdb_field;
3657                 }
3658
3659                 if (size > cmd->data_length) {
3660                         cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
3661                         cmd->residual_count = (size - cmd->data_length);
3662                 } else {
3663                         cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
3664                         cmd->residual_count = (cmd->data_length - size);
3665                 }
3666                 cmd->data_length = size;
3667         }
3668
3669         transport_set_supported_SAM_opcode(cmd);
3670         return ret;
3671
3672 out_unsupported_cdb:
3673         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
3674         cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
3675         return -2;
3676 out_invalid_cdb_field:
3677         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
3678         cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
3679         return -2;
3680 }
3681
3682 static inline void transport_release_tasks(struct se_cmd *);
3683
3684 /*
3685  * This function will copy a contiguous *src buffer into a destination
3686  * struct scatterlist array.
3687  */
3688 static void transport_memcpy_write_contig(
3689         struct se_cmd *cmd,
3690         struct scatterlist *sg_d,
3691         unsigned char *src)
3692 {
3693         u32 i = 0, length = 0, total_length = cmd->data_length;
3694         void *dst;
3695
3696         while (total_length) {
3697                 length = sg_d[i].length;
3698
3699                 if (length > total_length)
3700                         length = total_length;
3701
3702                 dst = sg_virt(&sg_d[i]);
3703
3704                 memcpy(dst, src, length);
3705
3706                 if (!(total_length -= length))
3707                         return;
3708
3709                 src += length;
3710                 i++;
3711         }
3712 }
3713
3714 /*
3715  * This function will copy a struct scatterlist array *sg_s into a destination
3716  * contiguous *dst buffer.
3717  */
3718 static void transport_memcpy_read_contig(
3719         struct se_cmd *cmd,
3720         unsigned char *dst,
3721         struct scatterlist *sg_s)
3722 {
3723         u32 i = 0, length = 0, total_length = cmd->data_length;
3724         void *src;
3725
3726         while (total_length) {
3727                 length = sg_s[i].length;
3728
3729                 if (length > total_length)
3730                         length = total_length;
3731
3732                 src = sg_virt(&sg_s[i]);
3733
3734                 memcpy(dst, src, length);
3735
3736                 if (!(total_length -= length))
3737                         return;
3738
3739                 dst += length;
3740                 i++;
3741         }
3742 }
3743
3744 static void transport_memcpy_se_mem_read_contig(
3745         struct se_cmd *cmd,
3746         unsigned char *dst,
3747         struct list_head *se_mem_list)
3748 {
3749         struct se_mem *se_mem;
3750         void *src;
3751         u32 length = 0, total_length = cmd->data_length;
3752
3753         list_for_each_entry(se_mem, se_mem_list, se_list) {
3754                 length = se_mem->se_len;
3755
3756                 if (length > total_length)
3757                         length = total_length;
3758
3759                 src = page_address(se_mem->se_page) + se_mem->se_off;
3760
3761                 memcpy(dst, src, length);
3762
3763                 if (!(total_length -= length))
3764                         return;
3765
3766                 dst += length;
3767         }
3768 }
3769
3770 /*
3771  * Called from transport_generic_complete_ok() and
3772  * transport_generic_request_failure() to determine which dormant/delayed
3773  * and ordered cmds need to have their tasks added to the execution queue.
3774  */
3775 static void transport_complete_task_attr(struct se_cmd *cmd)
3776 {
3777         struct se_device *dev = SE_DEV(cmd);
3778         struct se_cmd *cmd_p, *cmd_tmp;
3779         int new_active_tasks = 0;
3780
3781         if (cmd->sam_task_attr == TASK_ATTR_SIMPLE) {
3782                 atomic_dec(&dev->simple_cmds);
3783                 smp_mb__after_atomic_dec();
3784                 dev->dev_cur_ordered_id++;
3785                 DEBUG_STA("Incremented dev->dev_cur_ordered_id: %u for"
3786                         " SIMPLE: %u\n", dev->dev_cur_ordered_id,
3787                         cmd->se_ordered_id);
3788         } else if (cmd->sam_task_attr == TASK_ATTR_HOQ) {
3789                 atomic_dec(&dev->dev_hoq_count);
3790                 smp_mb__after_atomic_dec();
3791                 dev->dev_cur_ordered_id++;
3792                 DEBUG_STA("Incremented dev_cur_ordered_id: %u for"
3793                         " HEAD_OF_QUEUE: %u\n", dev->dev_cur_ordered_id,
3794                         cmd->se_ordered_id);
3795         } else if (cmd->sam_task_attr == TASK_ATTR_ORDERED) {
3796                 spin_lock(&dev->ordered_cmd_lock);
3797                 list_del(&cmd->se_ordered_list);
3798                 atomic_dec(&dev->dev_ordered_sync);
3799                 smp_mb__after_atomic_dec();
3800                 spin_unlock(&dev->ordered_cmd_lock);
3801
3802                 dev->dev_cur_ordered_id++;
3803                 DEBUG_STA("Incremented dev_cur_ordered_id: %u for ORDERED:"
3804                         " %u\n", dev->dev_cur_ordered_id, cmd->se_ordered_id);
3805         }
3806         /*
3807          * Process all commands up to the last received
3808          * ORDERED task attribute which requires another blocking
3809          * boundary
3810          */
3811         spin_lock(&dev->delayed_cmd_lock);
3812         list_for_each_entry_safe(cmd_p, cmd_tmp,
3813                         &dev->delayed_cmd_list, se_delayed_list) {
3814
3815                 list_del(&cmd_p->se_delayed_list);
3816                 spin_unlock(&dev->delayed_cmd_lock);
3817
3818                 DEBUG_STA("Calling add_tasks() for"
3819                         " cmd_p: 0x%02x Task Attr: 0x%02x"
3820                         " Dormant -> Active, se_ordered_id: %u\n",
3821                         T_TASK(cmd_p)->t_task_cdb[0],
3822                         cmd_p->sam_task_attr, cmd_p->se_ordered_id);
3823
3824                 transport_add_tasks_from_cmd(cmd_p);
3825                 new_active_tasks++;
3826
3827                 spin_lock(&dev->delayed_cmd_lock);
3828                 if (cmd_p->sam_task_attr == TASK_ATTR_ORDERED)
3829                         break;
3830         }
3831         spin_unlock(&dev->delayed_cmd_lock);
3832         /*
3833          * If new tasks have become active, wake up the transport thread
3834          * to do the processing of the Active tasks.
3835          */
3836         if (new_active_tasks != 0)
3837                 wake_up_interruptible(&dev->dev_queue_obj->thread_wq);
3838 }
3839
3840 static void transport_generic_complete_ok(struct se_cmd *cmd)
3841 {
3842         int reason = 0;
3843         /*
3844          * Check if we need to move delayed/dormant tasks from cmds on the
3845          * delayed execution list after a HEAD_OF_QUEUE or ORDERED Task
3846          * Attribute.
3847          */
3848         if (SE_DEV(cmd)->dev_task_attr_type == SAM_TASK_ATTR_EMULATED)
3849                 transport_complete_task_attr(cmd);
3850         /*
3851          * Check if we need to retrieve a sense buffer from
3852          * the struct se_cmd in question.
3853          */
3854         if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
3855                 if (transport_get_sense_data(cmd) < 0)
3856                         reason = TCM_NON_EXISTENT_LUN;
3857
3858                 /*
3859                  * Only set when an struct se_task->task_scsi_status returned
3860                  * a non GOOD status.
3861                  */
3862                 if (cmd->scsi_status) {
3863                         transport_send_check_condition_and_sense(
3864                                         cmd, reason, 1);
3865                         transport_lun_remove_cmd(cmd);
3866                         transport_cmd_check_stop_to_fabric(cmd);
3867                         return;
3868                 }
3869         }
3870         /*
3871          * Check for a callback, used by amoungst other things
3872          * XDWRITE_READ_10 emulation.
3873          */
3874         if (cmd->transport_complete_callback)
3875                 cmd->transport_complete_callback(cmd);
3876
3877         switch (cmd->data_direction) {
3878         case DMA_FROM_DEVICE:
3879                 spin_lock(&cmd->se_lun->lun_sep_lock);
3880                 if (SE_LUN(cmd)->lun_sep) {
3881                         SE_LUN(cmd)->lun_sep->sep_stats.tx_data_octets +=
3882                                         cmd->data_length;
3883                 }
3884                 spin_unlock(&cmd->se_lun->lun_sep_lock);
3885                 /*
3886                  * If enabled by TCM fabirc module pre-registered SGL
3887                  * memory, perform the memcpy() from the TCM internal
3888                  * contigious buffer back to the original SGL.
3889                  */
3890                 if (cmd->se_cmd_flags & SCF_PASSTHROUGH_CONTIG_TO_SG)
3891                         transport_memcpy_write_contig(cmd,
3892                                  T_TASK(cmd)->t_task_pt_sgl,
3893                                  T_TASK(cmd)->t_task_buf);
3894
3895                 CMD_TFO(cmd)->queue_data_in(cmd);
3896                 break;
3897         case DMA_TO_DEVICE:
3898                 spin_lock(&cmd->se_lun->lun_sep_lock);
3899                 if (SE_LUN(cmd)->lun_sep) {
3900                         SE_LUN(cmd)->lun_sep->sep_stats.rx_data_octets +=
3901                                 cmd->data_length;
3902                 }
3903                 spin_unlock(&cmd->se_lun->lun_sep_lock);
3904                 /*
3905                  * Check if we need to send READ payload for BIDI-COMMAND
3906                  */
3907                 if (T_TASK(cmd)->t_mem_bidi_list != NULL) {
3908                         spin_lock(&cmd->se_lun->lun_sep_lock);
3909                         if (SE_LUN(cmd)->lun_sep) {
3910                                 SE_LUN(cmd)->lun_sep->sep_stats.tx_data_octets +=
3911                                         cmd->data_length;
3912                         }
3913                         spin_unlock(&cmd->se_lun->lun_sep_lock);
3914                         CMD_TFO(cmd)->queue_data_in(cmd);
3915                         break;
3916                 }
3917                 /* Fall through for DMA_TO_DEVICE */
3918         case DMA_NONE:
3919                 CMD_TFO(cmd)->queue_status(cmd);
3920                 break;
3921         default:
3922                 break;
3923         }
3924
3925         transport_lun_remove_cmd(cmd);
3926         transport_cmd_check_stop_to_fabric(cmd);
3927 }
3928
3929 static void transport_free_dev_tasks(struct se_cmd *cmd)
3930 {
3931         struct se_task *task, *task_tmp;
3932         unsigned long flags;
3933
3934         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
3935         list_for_each_entry_safe(task, task_tmp,
3936                                 &T_TASK(cmd)->t_task_list, t_list) {
3937                 if (atomic_read(&task->task_active))
3938                         continue;
3939
3940                 kfree(task->task_sg_bidi);
3941                 kfree(task->task_sg);
3942
3943                 list_del(&task->t_list);
3944
3945                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
3946                 if (task->se_dev)
3947                         TRANSPORT(task->se_dev)->free_task(task);
3948                 else
3949                         printk(KERN_ERR "task[%u] - task->se_dev is NULL\n",
3950                                 task->task_no);
3951                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
3952         }
3953         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
3954 }
3955
3956 static inline void transport_free_pages(struct se_cmd *cmd)
3957 {
3958         struct se_mem *se_mem, *se_mem_tmp;
3959         int free_page = 1;
3960
3961         if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)
3962                 free_page = 0;
3963         if (cmd->se_dev->transport->do_se_mem_map)
3964                 free_page = 0;
3965
3966         if (T_TASK(cmd)->t_task_buf) {
3967                 kfree(T_TASK(cmd)->t_task_buf);
3968                 T_TASK(cmd)->t_task_buf = NULL;
3969                 return;
3970         }
3971
3972         /*
3973          * Caller will handle releasing of struct se_mem.
3974          */
3975         if (cmd->se_cmd_flags & SCF_CMD_PASSTHROUGH_NOALLOC)
3976                 return;
3977
3978         if (!(T_TASK(cmd)->t_tasks_se_num))
3979                 return;
3980
3981         list_for_each_entry_safe(se_mem, se_mem_tmp,
3982                         T_TASK(cmd)->t_mem_list, se_list) {
3983                 /*
3984                  * We only release call __free_page(struct se_mem->se_page) when
3985                  * SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is NOT in use,
3986                  */
3987                 if (free_page)
3988                         __free_page(se_mem->se_page);
3989
3990                 list_del(&se_mem->se_list);
3991                 kmem_cache_free(se_mem_cache, se_mem);
3992         }
3993
3994         if (T_TASK(cmd)->t_mem_bidi_list && T_TASK(cmd)->t_tasks_se_bidi_num) {
3995                 list_for_each_entry_safe(se_mem, se_mem_tmp,
3996                                 T_TASK(cmd)->t_mem_bidi_list, se_list) {
3997                         /*
3998                          * We only release call __free_page(struct se_mem->se_page) when
3999                          * SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is NOT in use,
4000                          */
4001                         if (free_page)
4002                                 __free_page(se_mem->se_page);
4003
4004                         list_del(&se_mem->se_list);
4005                         kmem_cache_free(se_mem_cache, se_mem);
4006                 }
4007         }
4008
4009         kfree(T_TASK(cmd)->t_mem_bidi_list);
4010         T_TASK(cmd)->t_mem_bidi_list = NULL;
4011         kfree(T_TASK(cmd)->t_mem_list);
4012         T_TASK(cmd)->t_mem_list = NULL;
4013         T_TASK(cmd)->t_tasks_se_num = 0;
4014 }
4015
4016 static inline void transport_release_tasks(struct se_cmd *cmd)
4017 {
4018         transport_free_dev_tasks(cmd);
4019 }
4020
4021 static inline int transport_dec_and_check(struct se_cmd *cmd)
4022 {
4023         unsigned long flags;
4024
4025         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
4026         if (atomic_read(&T_TASK(cmd)->t_fe_count)) {
4027                 if (!(atomic_dec_and_test(&T_TASK(cmd)->t_fe_count))) {
4028                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
4029                                         flags);
4030                         return 1;
4031                 }
4032         }
4033
4034         if (atomic_read(&T_TASK(cmd)->t_se_count)) {
4035                 if (!(atomic_dec_and_test(&T_TASK(cmd)->t_se_count))) {
4036                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
4037                                         flags);
4038                         return 1;
4039                 }
4040         }
4041         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
4042
4043         return 0;
4044 }
4045
4046 static void transport_release_fe_cmd(struct se_cmd *cmd)
4047 {
4048         unsigned long flags;
4049
4050         if (transport_dec_and_check(cmd))
4051                 return;
4052
4053         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
4054         if (!(atomic_read(&T_TASK(cmd)->transport_dev_active))) {
4055                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
4056                 goto free_pages;
4057         }
4058         atomic_set(&T_TASK(cmd)->transport_dev_active, 0);
4059         transport_all_task_dev_remove_state(cmd);
4060         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
4061
4062         transport_release_tasks(cmd);
4063 free_pages:
4064         transport_free_pages(cmd);
4065         transport_free_se_cmd(cmd);
4066         CMD_TFO(cmd)->release_cmd_direct(cmd);
4067 }
4068
4069 static int transport_generic_remove(
4070         struct se_cmd *cmd,
4071         int release_to_pool,
4072         int session_reinstatement)
4073 {
4074         unsigned long flags;
4075
4076         if (!(T_TASK(cmd)))
4077                 goto release_cmd;
4078
4079         if (transport_dec_and_check(cmd)) {
4080                 if (session_reinstatement) {
4081                         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
4082                         transport_all_task_dev_remove_state(cmd);
4083                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
4084                                         flags);
4085                 }
4086                 return 1;
4087         }
4088
4089         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
4090         if (!(atomic_read(&T_TASK(cmd)->transport_dev_active))) {
4091                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
4092                 goto free_pages;
4093         }
4094         atomic_set(&T_TASK(cmd)->transport_dev_active, 0);
4095         transport_all_task_dev_remove_state(cmd);
4096         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
4097
4098         transport_release_tasks(cmd);
4099 free_pages:
4100         transport_free_pages(cmd);
4101
4102 release_cmd:
4103         if (release_to_pool) {
4104                 transport_release_cmd_to_pool(cmd);
4105         } else {
4106                 transport_free_se_cmd(cmd);
4107                 CMD_TFO(cmd)->release_cmd_direct(cmd);
4108         }
4109
4110         return 0;
4111 }
4112
4113 /*
4114  * transport_generic_map_mem_to_cmd - Perform SGL -> struct se_mem map
4115  * @cmd:  Associated se_cmd descriptor
4116  * @mem:  SGL style memory for TCM WRITE / READ
4117  * @sg_mem_num: Number of SGL elements
4118  * @mem_bidi_in: SGL style memory for TCM BIDI READ
4119  * @sg_mem_bidi_num: Number of BIDI READ SGL elements
4120  *
4121  * Return: nonzero return cmd was rejected for -ENOMEM or inproper usage
4122  * of parameters.
4123  */
4124 int transport_generic_map_mem_to_cmd(
4125         struct se_cmd *cmd,
4126         struct scatterlist *mem,
4127         u32 sg_mem_num,
4128         struct scatterlist *mem_bidi_in,
4129         u32 sg_mem_bidi_num)
4130 {
4131         u32 se_mem_cnt_out = 0;
4132         int ret;
4133
4134         if (!(mem) || !(sg_mem_num))
4135                 return 0;
4136         /*
4137          * Passed *mem will contain a list_head containing preformatted
4138          * struct se_mem elements...
4139          */
4140         if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM)) {
4141                 if ((mem_bidi_in) || (sg_mem_bidi_num)) {
4142                         printk(KERN_ERR "SCF_CMD_PASSTHROUGH_NOALLOC not supported"
4143                                 " with BIDI-COMMAND\n");
4144                         return -ENOSYS;
4145                 }
4146
4147                 T_TASK(cmd)->t_mem_list = (struct list_head *)mem;
4148                 T_TASK(cmd)->t_tasks_se_num = sg_mem_num;
4149                 cmd->se_cmd_flags |= SCF_CMD_PASSTHROUGH_NOALLOC;
4150                 return 0;
4151         }
4152         /*
4153          * Otherwise, assume the caller is passing a struct scatterlist
4154          * array from include/linux/scatterlist.h
4155          */
4156         if ((cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) ||
4157             (cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB)) {
4158                 /*
4159                  * For CDB using TCM struct se_mem linked list scatterlist memory
4160                  * processed into a TCM struct se_subsystem_dev, we do the mapping
4161                  * from the passed physical memory to struct se_mem->se_page here.
4162                  */
4163                 T_TASK(cmd)->t_mem_list = transport_init_se_mem_list();
4164                 if (!(T_TASK(cmd)->t_mem_list))
4165                         return -ENOMEM;
4166
4167                 ret = transport_map_sg_to_mem(cmd,
4168                         T_TASK(cmd)->t_mem_list, mem, &se_mem_cnt_out);
4169                 if (ret < 0)
4170                         return -ENOMEM;
4171
4172                 T_TASK(cmd)->t_tasks_se_num = se_mem_cnt_out;
4173                 /*
4174                  * Setup BIDI READ list of struct se_mem elements
4175                  */
4176                 if ((mem_bidi_in) && (sg_mem_bidi_num)) {
4177                         T_TASK(cmd)->t_mem_bidi_list = transport_init_se_mem_list();
4178                         if (!(T_TASK(cmd)->t_mem_bidi_list)) {
4179                                 kfree(T_TASK(cmd)->t_mem_list);
4180                                 return -ENOMEM;
4181                         }
4182                         se_mem_cnt_out = 0;
4183
4184                         ret = transport_map_sg_to_mem(cmd,
4185                                 T_TASK(cmd)->t_mem_bidi_list, mem_bidi_in,
4186                                 &se_mem_cnt_out);
4187                         if (ret < 0) {
4188                                 kfree(T_TASK(cmd)->t_mem_list);
4189                                 return -ENOMEM;
4190                         }
4191
4192                         T_TASK(cmd)->t_tasks_se_bidi_num = se_mem_cnt_out;
4193                 }
4194                 cmd->se_cmd_flags |= SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC;
4195
4196         } else if (cmd->se_cmd_flags & SCF_SCSI_CONTROL_NONSG_IO_CDB) {
4197                 if (mem_bidi_in || sg_mem_bidi_num) {
4198                         printk(KERN_ERR "BIDI-Commands not supported using "
4199                                 "SCF_SCSI_CONTROL_NONSG_IO_CDB\n");
4200                         return -ENOSYS;
4201                 }
4202                 /*
4203                  * For incoming CDBs using a contiguous buffer internall with TCM,
4204                  * save the passed struct scatterlist memory.  After TCM storage object
4205                  * processing has completed for this struct se_cmd, TCM core will call
4206                  * transport_memcpy_[write,read]_contig() as necessary from
4207                  * transport_generic_complete_ok() and transport_write_pending() in order
4208                  * to copy the TCM buffer to/from the original passed *mem in SGL ->
4209                  * struct scatterlist format.
4210                  */
4211                 cmd->se_cmd_flags |= SCF_PASSTHROUGH_CONTIG_TO_SG;
4212                 T_TASK(cmd)->t_task_pt_sgl = mem;
4213         }
4214
4215         return 0;
4216 }
4217 EXPORT_SYMBOL(transport_generic_map_mem_to_cmd);
4218
4219
4220 static inline long long transport_dev_end_lba(struct se_device *dev)
4221 {
4222         return dev->transport->get_blocks(dev) + 1;
4223 }
4224
4225 static int transport_get_sectors(struct se_cmd *cmd)
4226 {
4227         struct se_device *dev = SE_DEV(cmd);
4228
4229         T_TASK(cmd)->t_tasks_sectors =
4230                 (cmd->data_length / DEV_ATTRIB(dev)->block_size);
4231         if (!(T_TASK(cmd)->t_tasks_sectors))
4232                 T_TASK(cmd)->t_tasks_sectors = 1;
4233
4234         if (TRANSPORT(dev)->get_device_type(dev) != TYPE_DISK)
4235                 return 0;
4236
4237         if ((T_TASK(cmd)->t_task_lba + T_TASK(cmd)->t_tasks_sectors) >
4238              transport_dev_end_lba(dev)) {
4239                 printk(KERN_ERR "LBA: %llu Sectors: %u exceeds"
4240                         " transport_dev_end_lba(): %llu\n",
4241                         T_TASK(cmd)->t_task_lba, T_TASK(cmd)->t_tasks_sectors,
4242                         transport_dev_end_lba(dev));
4243                 cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
4244                 cmd->scsi_sense_reason = TCM_SECTOR_COUNT_TOO_MANY;
4245                 return PYX_TRANSPORT_REQ_TOO_MANY_SECTORS;
4246         }
4247
4248         return 0;
4249 }
4250
4251 static int transport_new_cmd_obj(struct se_cmd *cmd)
4252 {
4253         struct se_device *dev = SE_DEV(cmd);
4254         u32 task_cdbs = 0, rc;
4255
4256         if (!(cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)) {
4257                 task_cdbs++;
4258                 T_TASK(cmd)->t_task_cdbs++;
4259         } else {
4260                 int set_counts = 1;
4261
4262                 /*
4263                  * Setup any BIDI READ tasks and memory from
4264                  * T_TASK(cmd)->t_mem_bidi_list so the READ struct se_tasks
4265                  * are queued first for the non pSCSI passthrough case.
4266                  */
4267                 if ((T_TASK(cmd)->t_mem_bidi_list != NULL) &&
4268                     (TRANSPORT(dev)->transport_type != TRANSPORT_PLUGIN_PHBA_PDEV)) {
4269                         rc = transport_generic_get_cdb_count(cmd,
4270                                 T_TASK(cmd)->t_task_lba,
4271                                 T_TASK(cmd)->t_tasks_sectors,
4272                                 DMA_FROM_DEVICE, T_TASK(cmd)->t_mem_bidi_list,
4273                                 set_counts);
4274                         if (!(rc)) {
4275                                 cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
4276                                 cmd->scsi_sense_reason =
4277                                         TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
4278                                 return PYX_TRANSPORT_LU_COMM_FAILURE;
4279                         }
4280                         set_counts = 0;
4281                 }
4282                 /*
4283                  * Setup the tasks and memory from T_TASK(cmd)->t_mem_list
4284                  * Note for BIDI transfers this will contain the WRITE payload
4285                  */
4286                 task_cdbs = transport_generic_get_cdb_count(cmd,
4287                                 T_TASK(cmd)->t_task_lba,
4288                                 T_TASK(cmd)->t_tasks_sectors,
4289                                 cmd->data_direction, T_TASK(cmd)->t_mem_list,
4290                                 set_counts);
4291                 if (!(task_cdbs)) {
4292                         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
4293                         cmd->scsi_sense_reason =
4294                                         TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
4295                         return PYX_TRANSPORT_LU_COMM_FAILURE;
4296                 }
4297                 T_TASK(cmd)->t_task_cdbs += task_cdbs;
4298
4299 #if 0
4300                 printk(KERN_INFO "data_length: %u, LBA: %llu t_tasks_sectors:"
4301                         " %u, t_task_cdbs: %u\n", obj_ptr, cmd->data_length,
4302                         T_TASK(cmd)->t_task_lba, T_TASK(cmd)->t_tasks_sectors,
4303                         T_TASK(cmd)->t_task_cdbs);
4304 #endif
4305         }
4306
4307         atomic_set(&T_TASK(cmd)->t_task_cdbs_left, task_cdbs);
4308         atomic_set(&T_TASK(cmd)->t_task_cdbs_ex_left, task_cdbs);
4309         atomic_set(&T_TASK(cmd)->t_task_cdbs_timeout_left, task_cdbs);
4310         return 0;
4311 }
4312
4313 static struct list_head *transport_init_se_mem_list(void)
4314 {
4315         struct list_head *se_mem_list;
4316
4317         se_mem_list = kzalloc(sizeof(struct list_head), GFP_KERNEL);
4318         if (!(se_mem_list)) {
4319                 printk(KERN_ERR "Unable to allocate memory for se_mem_list\n");
4320                 return NULL;
4321         }
4322         INIT_LIST_HEAD(se_mem_list);
4323
4324         return se_mem_list;
4325 }
4326
4327 static int
4328 transport_generic_get_mem(struct se_cmd *cmd, u32 length, u32 dma_size)
4329 {
4330         unsigned char *buf;
4331         struct se_mem *se_mem;
4332
4333         T_TASK(cmd)->t_mem_list = transport_init_se_mem_list();
4334         if (!(T_TASK(cmd)->t_mem_list))
4335                 return -ENOMEM;
4336
4337         /*
4338          * If the device uses memory mapping this is enough.
4339          */
4340         if (cmd->se_dev->transport->do_se_mem_map)
4341                 return 0;
4342
4343         /*
4344          * Setup BIDI-COMMAND READ list of struct se_mem elements
4345          */
4346         if (T_TASK(cmd)->t_tasks_bidi) {
4347                 T_TASK(cmd)->t_mem_bidi_list = transport_init_se_mem_list();
4348                 if (!(T_TASK(cmd)->t_mem_bidi_list)) {
4349                         kfree(T_TASK(cmd)->t_mem_list);
4350                         return -ENOMEM;
4351                 }
4352         }
4353
4354         while (length) {
4355                 se_mem = kmem_cache_zalloc(se_mem_cache, GFP_KERNEL);
4356                 if (!(se_mem)) {
4357                         printk(KERN_ERR "Unable to allocate struct se_mem\n");
4358                         goto out;
4359                 }
4360                 INIT_LIST_HEAD(&se_mem->se_list);
4361                 se_mem->se_len = (length > dma_size) ? dma_size : length;
4362
4363 /* #warning FIXME Allocate contigous pages for struct se_mem elements */
4364                 se_mem->se_page = (struct page *) alloc_pages(GFP_KERNEL, 0);
4365                 if (!(se_mem->se_page)) {
4366                         printk(KERN_ERR "alloc_pages() failed\n");
4367                         goto out;
4368                 }
4369
4370                 buf = kmap_atomic(se_mem->se_page, KM_IRQ0);
4371                 if (!(buf)) {
4372                         printk(KERN_ERR "kmap_atomic() failed\n");
4373                         goto out;
4374                 }
4375                 memset(buf, 0, se_mem->se_len);
4376                 kunmap_atomic(buf, KM_IRQ0);
4377
4378                 list_add_tail(&se_mem->se_list, T_TASK(cmd)->t_mem_list);
4379                 T_TASK(cmd)->t_tasks_se_num++;
4380
4381                 DEBUG_MEM("Allocated struct se_mem page(%p) Length(%u)"
4382                         " Offset(%u)\n", se_mem->se_page, se_mem->se_len,
4383                         se_mem->se_off);
4384
4385                 length -= se_mem->se_len;
4386         }
4387
4388         DEBUG_MEM("Allocated total struct se_mem elements(%u)\n",
4389                         T_TASK(cmd)->t_tasks_se_num);
4390
4391         return 0;
4392 out:
4393         return -1;
4394 }
4395
4396 u32 transport_calc_sg_num(
4397         struct se_task *task,
4398         struct se_mem *in_se_mem,
4399         u32 task_offset)
4400 {
4401         struct se_cmd *se_cmd = task->task_se_cmd;
4402         struct se_device *se_dev = SE_DEV(se_cmd);
4403         struct se_mem *se_mem = in_se_mem;
4404         struct target_core_fabric_ops *tfo = CMD_TFO(se_cmd);
4405         u32 sg_length, task_size = task->task_size, task_sg_num_padded;
4406
4407         while (task_size != 0) {
4408                 DEBUG_SC("se_mem->se_page(%p) se_mem->se_len(%u)"
4409                         " se_mem->se_off(%u) task_offset(%u)\n",
4410                         se_mem->se_page, se_mem->se_len,
4411                         se_mem->se_off, task_offset);
4412
4413                 if (task_offset == 0) {
4414                         if (task_size >= se_mem->se_len) {
4415                                 sg_length = se_mem->se_len;
4416
4417                                 if (!(list_is_last(&se_mem->se_list,
4418                                                 T_TASK(se_cmd)->t_mem_list)))
4419                                         se_mem = list_entry(se_mem->se_list.next,
4420                                                         struct se_mem, se_list);
4421                         } else {
4422                                 sg_length = task_size;
4423                                 task_size -= sg_length;
4424                                 goto next;
4425                         }
4426
4427                         DEBUG_SC("sg_length(%u) task_size(%u)\n",
4428                                         sg_length, task_size);
4429                 } else {
4430                         if ((se_mem->se_len - task_offset) > task_size) {
4431                                 sg_length = task_size;
4432                                 task_size -= sg_length;
4433                                 goto next;
4434                          } else {
4435                                 sg_length = (se_mem->se_len - task_offset);
4436
4437                                 if (!(list_is_last(&se_mem->se_list,
4438                                                 T_TASK(se_cmd)->t_mem_list)))
4439                                         se_mem = list_entry(se_mem->se_list.next,
4440                                                         struct se_mem, se_list);
4441                         }
4442
4443                         DEBUG_SC("sg_length(%u) task_size(%u)\n",
4444                                         sg_length, task_size);
4445
4446                         task_offset = 0;
4447                 }
4448                 task_size -= sg_length;
4449 next:
4450                 DEBUG_SC("task[%u] - Reducing task_size to(%u)\n",
4451                         task->task_no, task_size);
4452
4453                 task->task_sg_num++;
4454         }
4455         /*
4456          * Check if the fabric module driver is requesting that all
4457          * struct se_task->task_sg[] be chained together..  If so,
4458          * then allocate an extra padding SG entry for linking and
4459          * marking the end of the chained SGL.
4460          */
4461         if (tfo->task_sg_chaining) {
4462                 task_sg_num_padded = (task->task_sg_num + 1);
4463                 task->task_padded_sg = 1;
4464         } else
4465                 task_sg_num_padded = task->task_sg_num;
4466
4467         task->task_sg = kzalloc(task_sg_num_padded *
4468                         sizeof(struct scatterlist), GFP_KERNEL);
4469         if (!(task->task_sg)) {
4470                 printk(KERN_ERR "Unable to allocate memory for"
4471                                 " task->task_sg\n");
4472                 return 0;
4473         }
4474         sg_init_table(&task->task_sg[0], task_sg_num_padded);
4475         /*
4476          * Setup task->task_sg_bidi for SCSI READ payload for
4477          * TCM/pSCSI passthrough if present for BIDI-COMMAND
4478          */
4479         if ((T_TASK(se_cmd)->t_mem_bidi_list != NULL) &&
4480             (TRANSPORT(se_dev)->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV)) {
4481                 task->task_sg_bidi = kzalloc(task_sg_num_padded *
4482                                 sizeof(struct scatterlist), GFP_KERNEL);
4483                 if (!(task->task_sg_bidi)) {
4484                         printk(KERN_ERR "Unable to allocate memory for"
4485                                 " task->task_sg_bidi\n");
4486                         return 0;
4487                 }
4488                 sg_init_table(&task->task_sg_bidi[0], task_sg_num_padded);
4489         }
4490         /*
4491          * For the chaining case, setup the proper end of SGL for the
4492          * initial submission struct task into struct se_subsystem_api.
4493          * This will be cleared later by transport_do_task_sg_chain()
4494          */
4495         if (task->task_padded_sg) {
4496                 sg_mark_end(&task->task_sg[task->task_sg_num - 1]);
4497                 /*
4498                  * Added the 'if' check before marking end of bi-directional
4499                  * scatterlist (which gets created only in case of request
4500                  * (RD + WR).
4501                  */
4502                 if (task->task_sg_bidi)
4503                         sg_mark_end(&task->task_sg_bidi[task->task_sg_num - 1]);
4504         }
4505
4506         DEBUG_SC("Successfully allocated task->task_sg_num(%u),"
4507                 " task_sg_num_padded(%u)\n", task->task_sg_num,
4508                 task_sg_num_padded);
4509
4510         return task->task_sg_num;
4511 }
4512
4513 static inline int transport_set_tasks_sectors_disk(
4514         struct se_task *task,
4515         struct se_device *dev,
4516         unsigned long long lba,
4517         u32 sectors,
4518         int *max_sectors_set)
4519 {
4520         if ((lba + sectors) > transport_dev_end_lba(dev)) {
4521                 task->task_sectors = ((transport_dev_end_lba(dev) - lba) + 1);
4522
4523                 if (task->task_sectors > DEV_ATTRIB(dev)->max_sectors) {
4524                         task->task_sectors = DEV_ATTRIB(dev)->max_sectors;
4525                         *max_sectors_set = 1;
4526                 }
4527         } else {
4528                 if (sectors > DEV_ATTRIB(dev)->max_sectors) {
4529                         task->task_sectors = DEV_ATTRIB(dev)->max_sectors;
4530                         *max_sectors_set = 1;
4531                 } else
4532                         task->task_sectors = sectors;
4533         }
4534
4535         return 0;
4536 }
4537
4538 static inline int transport_set_tasks_sectors_non_disk(
4539         struct se_task *task,
4540         struct se_device *dev,
4541         unsigned long long lba,
4542         u32 sectors,
4543         int *max_sectors_set)
4544 {
4545         if (sectors > DEV_ATTRIB(dev)->max_sectors) {
4546                 task->task_sectors = DEV_ATTRIB(dev)->max_sectors;
4547                 *max_sectors_set = 1;
4548         } else
4549                 task->task_sectors = sectors;
4550
4551         return 0;
4552 }
4553
4554 static inline int transport_set_tasks_sectors(
4555         struct se_task *task,
4556         struct se_device *dev,
4557         unsigned long long lba,
4558         u32 sectors,
4559         int *max_sectors_set)
4560 {
4561         return (TRANSPORT(dev)->get_device_type(dev) == TYPE_DISK) ?
4562                 transport_set_tasks_sectors_disk(task, dev, lba, sectors,
4563                                 max_sectors_set) :
4564                 transport_set_tasks_sectors_non_disk(task, dev, lba, sectors,
4565                                 max_sectors_set);
4566 }
4567
4568 static int transport_map_sg_to_mem(
4569         struct se_cmd *cmd,
4570         struct list_head *se_mem_list,
4571         void *in_mem,
4572         u32 *se_mem_cnt)
4573 {
4574         struct se_mem *se_mem;
4575         struct scatterlist *sg;
4576         u32 sg_count = 1, cmd_size = cmd->data_length;
4577
4578         if (!in_mem) {
4579                 printk(KERN_ERR "No source scatterlist\n");
4580                 return -1;
4581         }
4582         sg = (struct scatterlist *)in_mem;
4583
4584         while (cmd_size) {
4585                 se_mem = kmem_cache_zalloc(se_mem_cache, GFP_KERNEL);
4586                 if (!(se_mem)) {
4587                         printk(KERN_ERR "Unable to allocate struct se_mem\n");
4588                         return -1;
4589                 }
4590                 INIT_LIST_HEAD(&se_mem->se_list);
4591                 DEBUG_MEM("sg_to_mem: Starting loop with cmd_size: %u"
4592                         " sg_page: %p offset: %d length: %d\n", cmd_size,
4593                         sg_page(sg), sg->offset, sg->length);
4594
4595                 se_mem->se_page = sg_page(sg);
4596                 se_mem->se_off = sg->offset;
4597
4598                 if (cmd_size > sg->length) {
4599                         se_mem->se_len = sg->length;
4600                         sg = sg_next(sg);
4601                         sg_count++;
4602                 } else
4603                         se_mem->se_len = cmd_size;
4604
4605                 cmd_size -= se_mem->se_len;
4606
4607                 DEBUG_MEM("sg_to_mem: *se_mem_cnt: %u cmd_size: %u\n",
4608                                 *se_mem_cnt, cmd_size);
4609                 DEBUG_MEM("sg_to_mem: Final se_page: %p se_off: %d se_len: %d\n",
4610                                 se_mem->se_page, se_mem->se_off, se_mem->se_len);
4611
4612                 list_add_tail(&se_mem->se_list, se_mem_list);
4613                 (*se_mem_cnt)++;
4614         }
4615
4616         DEBUG_MEM("task[0] - Mapped(%u) struct scatterlist segments to(%u)"
4617                 " struct se_mem\n", sg_count, *se_mem_cnt);
4618
4619         if (sg_count != *se_mem_cnt)
4620                 BUG();
4621
4622         return 0;
4623 }
4624
4625 /*      transport_map_mem_to_sg():
4626  *
4627  *
4628  */
4629 int transport_map_mem_to_sg(
4630         struct se_task *task,
4631         struct list_head *se_mem_list,
4632         void *in_mem,
4633         struct se_mem *in_se_mem,
4634         struct se_mem **out_se_mem,
4635         u32 *se_mem_cnt,
4636         u32 *task_offset)
4637 {
4638         struct se_cmd *se_cmd = task->task_se_cmd;
4639         struct se_mem *se_mem = in_se_mem;
4640         struct scatterlist *sg = (struct scatterlist *)in_mem;
4641         u32 task_size = task->task_size, sg_no = 0;
4642
4643         if (!sg) {
4644                 printk(KERN_ERR "Unable to locate valid struct"
4645                                 " scatterlist pointer\n");
4646                 return -1;
4647         }
4648
4649         while (task_size != 0) {
4650                 /*
4651                  * Setup the contigious array of scatterlists for
4652                  * this struct se_task.
4653                  */
4654                 sg_assign_page(sg, se_mem->se_page);
4655
4656                 if (*task_offset == 0) {
4657                         sg->offset = se_mem->se_off;
4658
4659                         if (task_size >= se_mem->se_len) {
4660                                 sg->length = se_mem->se_len;
4661
4662                                 if (!(list_is_last(&se_mem->se_list,
4663                                                 T_TASK(se_cmd)->t_mem_list))) {
4664                                         se_mem = list_entry(se_mem->se_list.next,
4665                                                         struct se_mem, se_list);
4666                                         (*se_mem_cnt)++;
4667                                 }
4668                         } else {
4669                                 sg->length = task_size;
4670                                 /*
4671                                  * Determine if we need to calculate an offset
4672                                  * into the struct se_mem on the next go around..
4673                                  */
4674                                 task_size -= sg->length;
4675                                 if (!(task_size))
4676                                         *task_offset = sg->length;
4677
4678                                 goto next;
4679                         }
4680
4681                 } else {
4682                         sg->offset = (*task_offset + se_mem->se_off);
4683
4684                         if ((se_mem->se_len - *task_offset) > task_size) {
4685                                 sg->length = task_size;
4686                                 /*
4687                                  * Determine if we need to calculate an offset
4688                                  * into the struct se_mem on the next go around..
4689                                  */
4690                                 task_size -= sg->length;
4691                                 if (!(task_size))
4692                                         *task_offset += sg->length;
4693
4694                                 goto next;
4695                         } else {
4696                                 sg->length = (se_mem->se_len - *task_offset);
4697
4698                                 if (!(list_is_last(&se_mem->se_list,
4699                                                 T_TASK(se_cmd)->t_mem_list))) {
4700                                         se_mem = list_entry(se_mem->se_list.next,
4701                                                         struct se_mem, se_list);
4702                                         (*se_mem_cnt)++;
4703                                 }
4704                         }
4705
4706                         *task_offset = 0;
4707                 }
4708                 task_size -= sg->length;
4709 next:
4710                 DEBUG_MEM("task[%u] mem_to_sg - sg[%u](%p)(%u)(%u) - Reducing"
4711                         " task_size to(%u), task_offset: %u\n", task->task_no, sg_no,
4712                         sg_page(sg), sg->length, sg->offset, task_size, *task_offset);
4713
4714                 sg_no++;
4715                 if (!(task_size))
4716                         break;
4717
4718                 sg = sg_next(sg);
4719
4720                 if (task_size > se_cmd->data_length)
4721                         BUG();
4722         }
4723         *out_se_mem = se_mem;
4724
4725         DEBUG_MEM("task[%u] - Mapped(%u) struct se_mem segments to total(%u)"
4726                 " SGs\n", task->task_no, *se_mem_cnt, sg_no);
4727
4728         return 0;
4729 }
4730
4731 /*
4732  * This function can be used by HW target mode drivers to create a linked
4733  * scatterlist from all contiguously allocated struct se_task->task_sg[].
4734  * This is intended to be called during the completion path by TCM Core
4735  * when struct target_core_fabric_ops->check_task_sg_chaining is enabled.
4736  */
4737 void transport_do_task_sg_chain(struct se_cmd *cmd)
4738 {
4739         struct scatterlist *sg_head = NULL, *sg_link = NULL, *sg_first = NULL;
4740         struct scatterlist *sg_head_cur = NULL, *sg_link_cur = NULL;
4741         struct scatterlist *sg, *sg_end = NULL, *sg_end_cur = NULL;
4742         struct se_task *task;
4743         struct target_core_fabric_ops *tfo = CMD_TFO(cmd);
4744         u32 task_sg_num = 0, sg_count = 0;
4745         int i;
4746
4747         if (tfo->task_sg_chaining == 0) {
4748                 printk(KERN_ERR "task_sg_chaining is diabled for fabric module:"
4749                                 " %s\n", tfo->get_fabric_name());
4750                 dump_stack();
4751                 return;
4752         }
4753         /*
4754          * Walk the struct se_task list and setup scatterlist chains
4755          * for each contiguosly allocated struct se_task->task_sg[].
4756          */
4757         list_for_each_entry(task, &T_TASK(cmd)->t_task_list, t_list) {
4758                 if (!(task->task_sg) || !(task->task_padded_sg))
4759                         continue;
4760
4761                 if (sg_head && sg_link) {
4762                         sg_head_cur = &task->task_sg[0];
4763                         sg_link_cur = &task->task_sg[task->task_sg_num];
4764                         /*
4765                          * Either add chain or mark end of scatterlist
4766                          */
4767                         if (!(list_is_last(&task->t_list,
4768                                         &T_TASK(cmd)->t_task_list))) {
4769                                 /*
4770                                  * Clear existing SGL termination bit set in
4771                                  * transport_calc_sg_num(), see sg_mark_end()
4772                                  */
4773                                 sg_end_cur = &task->task_sg[task->task_sg_num - 1];
4774                                 sg_end_cur->page_link &= ~0x02;
4775
4776                                 sg_chain(sg_head, task_sg_num, sg_head_cur);
4777                                 sg_count += (task->task_sg_num + 1);
4778                         } else
4779                                 sg_count += task->task_sg_num;
4780
4781                         sg_head = sg_head_cur;
4782                         sg_link = sg_link_cur;
4783                         task_sg_num = task->task_sg_num;
4784                         continue;
4785                 }
4786                 sg_head = sg_first = &task->task_sg[0];
4787                 sg_link = &task->task_sg[task->task_sg_num];
4788                 task_sg_num = task->task_sg_num;
4789                 /*
4790                  * Check for single task..
4791                  */
4792                 if (!(list_is_last(&task->t_list, &T_TASK(cmd)->t_task_list))) {
4793                         /*
4794                          * Clear existing SGL termination bit set in
4795                          * transport_calc_sg_num(), see sg_mark_end()
4796                          */
4797                         sg_end = &task->task_sg[task->task_sg_num - 1];
4798                         sg_end->page_link &= ~0x02;
4799                         sg_count += (task->task_sg_num + 1);
4800                 } else
4801                         sg_count += task->task_sg_num;
4802         }
4803         /*
4804          * Setup the starting pointer and total t_tasks_sg_linked_no including
4805          * padding SGs for linking and to mark the end.
4806          */
4807         T_TASK(cmd)->t_tasks_sg_chained = sg_first;
4808         T_TASK(cmd)->t_tasks_sg_chained_no = sg_count;
4809
4810         DEBUG_CMD_M("Setup T_TASK(cmd)->t_tasks_sg_chained: %p and"
4811                 " t_tasks_sg_chained_no: %u\n", T_TASK(cmd)->t_tasks_sg_chained,
4812                 T_TASK(cmd)->t_tasks_sg_chained_no);
4813
4814         for_each_sg(T_TASK(cmd)->t_tasks_sg_chained, sg,
4815                         T_TASK(cmd)->t_tasks_sg_chained_no, i) {
4816
4817                 DEBUG_CMD_M("SG: %p page: %p length: %d offset: %d\n",
4818                         sg, sg_page(sg), sg->length, sg->offset);
4819                 if (sg_is_chain(sg))
4820                         DEBUG_CMD_M("SG: %p sg_is_chain=1\n", sg);
4821                 if (sg_is_last(sg))
4822                         DEBUG_CMD_M("SG: %p sg_is_last=1\n", sg);
4823         }
4824
4825 }
4826 EXPORT_SYMBOL(transport_do_task_sg_chain);
4827
4828 static int transport_do_se_mem_map(
4829         struct se_device *dev,
4830         struct se_task *task,
4831         struct list_head *se_mem_list,
4832         void *in_mem,
4833         struct se_mem *in_se_mem,
4834         struct se_mem **out_se_mem,
4835         u32 *se_mem_cnt,
4836         u32 *task_offset_in)
4837 {
4838         u32 task_offset = *task_offset_in;
4839         int ret = 0;
4840         /*
4841          * se_subsystem_api_t->do_se_mem_map is used when internal allocation
4842          * has been done by the transport plugin.
4843          */
4844         if (TRANSPORT(dev)->do_se_mem_map) {
4845                 ret = TRANSPORT(dev)->do_se_mem_map(task, se_mem_list,
4846                                 in_mem, in_se_mem, out_se_mem, se_mem_cnt,
4847                                 task_offset_in);
4848                 if (ret == 0)
4849                         T_TASK(task->task_se_cmd)->t_tasks_se_num += *se_mem_cnt;
4850
4851                 return ret;
4852         }
4853
4854         BUG_ON(list_empty(se_mem_list));
4855         /*
4856          * This is the normal path for all normal non BIDI and BIDI-COMMAND
4857          * WRITE payloads..  If we need to do BIDI READ passthrough for
4858          * TCM/pSCSI the first call to transport_do_se_mem_map ->
4859          * transport_calc_sg_num() -> transport_map_mem_to_sg() will do the
4860          * allocation for task->task_sg_bidi, and the subsequent call to
4861          * transport_do_se_mem_map() from transport_generic_get_cdb_count()
4862          */
4863         if (!(task->task_sg_bidi)) {
4864                 /*
4865                  * Assume default that transport plugin speaks preallocated
4866                  * scatterlists.
4867                  */
4868                 if (!(transport_calc_sg_num(task, in_se_mem, task_offset)))
4869                         return -1;
4870                 /*
4871                  * struct se_task->task_sg now contains the struct scatterlist array.
4872                  */
4873                 return transport_map_mem_to_sg(task, se_mem_list, task->task_sg,
4874                                         in_se_mem, out_se_mem, se_mem_cnt,
4875                                         task_offset_in);
4876         }
4877         /*
4878          * Handle the se_mem_list -> struct task->task_sg_bidi
4879          * memory map for the extra BIDI READ payload
4880          */
4881         return transport_map_mem_to_sg(task, se_mem_list, task->task_sg_bidi,
4882                                 in_se_mem, out_se_mem, se_mem_cnt,
4883                                 task_offset_in);
4884 }
4885
4886 static u32 transport_generic_get_cdb_count(
4887         struct se_cmd *cmd,
4888         unsigned long long lba,
4889         u32 sectors,
4890         enum dma_data_direction data_direction,
4891         struct list_head *mem_list,
4892         int set_counts)
4893 {
4894         unsigned char *cdb = NULL;
4895         struct se_task *task;
4896         struct se_mem *se_mem = NULL, *se_mem_lout = NULL;
4897         struct se_mem *se_mem_bidi = NULL, *se_mem_bidi_lout = NULL;
4898         struct se_device *dev = SE_DEV(cmd);
4899         int max_sectors_set = 0, ret;
4900         u32 task_offset_in = 0, se_mem_cnt = 0, se_mem_bidi_cnt = 0, task_cdbs = 0;
4901
4902         if (!mem_list) {
4903                 printk(KERN_ERR "mem_list is NULL in transport_generic_get"
4904                                 "_cdb_count()\n");
4905                 return 0;
4906         }
4907         /*
4908          * While using RAMDISK_DR backstores is the only case where
4909          * mem_list will ever be empty at this point.
4910          */
4911         if (!(list_empty(mem_list)))
4912                 se_mem = list_entry(mem_list->next, struct se_mem, se_list);
4913         /*
4914          * Check for extra se_mem_bidi mapping for BIDI-COMMANDs to
4915          * struct se_task->task_sg_bidi for TCM/pSCSI passthrough operation
4916          */
4917         if ((T_TASK(cmd)->t_mem_bidi_list != NULL) &&
4918             !(list_empty(T_TASK(cmd)->t_mem_bidi_list)) &&
4919             (TRANSPORT(dev)->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV))
4920                 se_mem_bidi = list_entry(T_TASK(cmd)->t_mem_bidi_list->next,
4921                                         struct se_mem, se_list);
4922
4923         while (sectors) {
4924                 DEBUG_VOL("ITT[0x%08x] LBA(%llu) SectorsLeft(%u) EOBJ(%llu)\n",
4925                         CMD_TFO(cmd)->get_task_tag(cmd), lba, sectors,
4926                         transport_dev_end_lba(dev));
4927
4928                 task = transport_generic_get_task(cmd, data_direction);
4929                 if (!(task))
4930                         goto out;
4931
4932                 transport_set_tasks_sectors(task, dev, lba, sectors,
4933                                 &max_sectors_set);
4934
4935                 task->task_lba = lba;
4936                 lba += task->task_sectors;
4937                 sectors -= task->task_sectors;
4938                 task->task_size = (task->task_sectors *
4939                                    DEV_ATTRIB(dev)->block_size);
4940
4941                 cdb = TRANSPORT(dev)->get_cdb(task);
4942                 if ((cdb)) {
4943                         memcpy(cdb, T_TASK(cmd)->t_task_cdb,
4944                                 scsi_command_size(T_TASK(cmd)->t_task_cdb));
4945                         cmd->transport_split_cdb(task->task_lba,
4946                                         &task->task_sectors, cdb);
4947                 }
4948
4949                 /*
4950                  * Perform the SE OBJ plugin and/or Transport plugin specific
4951                  * mapping for T_TASK(cmd)->t_mem_list. And setup the
4952                  * task->task_sg and if necessary task->task_sg_bidi
4953                  */
4954                 ret = transport_do_se_mem_map(dev, task, mem_list,
4955                                 NULL, se_mem, &se_mem_lout, &se_mem_cnt,
4956                                 &task_offset_in);
4957                 if (ret < 0)
4958                         goto out;
4959
4960                 se_mem = se_mem_lout;
4961                 /*
4962                  * Setup the T_TASK(cmd)->t_mem_bidi_list -> task->task_sg_bidi
4963                  * mapping for SCSI READ for BIDI-COMMAND passthrough with TCM/pSCSI
4964                  *
4965                  * Note that the first call to transport_do_se_mem_map() above will
4966                  * allocate struct se_task->task_sg_bidi in transport_do_se_mem_map()
4967                  * -> transport_calc_sg_num(), and the second here will do the
4968                  * mapping for SCSI READ for BIDI-COMMAND passthrough with TCM/pSCSI.
4969                  */
4970                 if (task->task_sg_bidi != NULL) {
4971                         ret = transport_do_se_mem_map(dev, task,
4972                                 T_TASK(cmd)->t_mem_bidi_list, NULL,
4973                                 se_mem_bidi, &se_mem_bidi_lout, &se_mem_bidi_cnt,
4974                                 &task_offset_in);
4975                         if (ret < 0)
4976                                 goto out;
4977
4978                         se_mem_bidi = se_mem_bidi_lout;
4979                 }
4980                 task_cdbs++;
4981
4982                 DEBUG_VOL("Incremented task_cdbs(%u) task->task_sg_num(%u)\n",
4983                                 task_cdbs, task->task_sg_num);
4984
4985                 if (max_sectors_set) {
4986                         max_sectors_set = 0;
4987                         continue;
4988                 }
4989
4990                 if (!sectors)
4991                         break;
4992         }
4993
4994         if (set_counts) {
4995                 atomic_inc(&T_TASK(cmd)->t_fe_count);
4996                 atomic_inc(&T_TASK(cmd)->t_se_count);
4997         }
4998
4999         DEBUG_VOL("ITT[0x%08x] total %s cdbs(%u)\n",
5000                 CMD_TFO(cmd)->get_task_tag(cmd), (data_direction == DMA_TO_DEVICE)
5001                 ? "DMA_TO_DEVICE" : "DMA_FROM_DEVICE", task_cdbs);
5002
5003         return task_cdbs;
5004 out:
5005         return 0;
5006 }
5007
5008 static int
5009 transport_map_control_cmd_to_task(struct se_cmd *cmd)
5010 {
5011         struct se_device *dev = SE_DEV(cmd);
5012         unsigned char *cdb;
5013         struct se_task *task;
5014         int ret;
5015
5016         task = transport_generic_get_task(cmd, cmd->data_direction);
5017         if (!task)
5018                 return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
5019
5020         cdb = TRANSPORT(dev)->get_cdb(task);
5021         if (cdb)
5022                 memcpy(cdb, cmd->t_task->t_task_cdb,
5023                         scsi_command_size(cmd->t_task->t_task_cdb));
5024
5025         task->task_size = cmd->data_length;
5026         task->task_sg_num =
5027                 (cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) ? 1 : 0;
5028
5029         atomic_inc(&cmd->t_task->t_fe_count);
5030         atomic_inc(&cmd->t_task->t_se_count);
5031
5032         if (cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) {
5033                 struct se_mem *se_mem = NULL, *se_mem_lout = NULL;
5034                 u32 se_mem_cnt = 0, task_offset = 0;
5035
5036                 if (!list_empty(T_TASK(cmd)->t_mem_list))
5037                         se_mem = list_entry(T_TASK(cmd)->t_mem_list->next,
5038                                         struct se_mem, se_list);
5039
5040                 ret = transport_do_se_mem_map(dev, task,
5041                                 cmd->t_task->t_mem_list, NULL, se_mem,
5042                                 &se_mem_lout, &se_mem_cnt, &task_offset);
5043                 if (ret < 0)
5044                         return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
5045
5046                 if (dev->transport->map_task_SG)
5047                         return dev->transport->map_task_SG(task);
5048                 return 0;
5049         } else if (cmd->se_cmd_flags & SCF_SCSI_CONTROL_NONSG_IO_CDB) {
5050                 if (dev->transport->map_task_non_SG)
5051                         return dev->transport->map_task_non_SG(task);
5052                 return 0;
5053         } else if (cmd->se_cmd_flags & SCF_SCSI_NON_DATA_CDB) {
5054                 if (dev->transport->cdb_none)
5055                         return dev->transport->cdb_none(task);
5056                 return 0;
5057         } else {
5058                 BUG();
5059                 return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
5060         }
5061 }
5062
5063 /*       transport_generic_new_cmd(): Called from transport_processing_thread()
5064  *
5065  *       Allocate storage transport resources from a set of values predefined
5066  *       by transport_generic_cmd_sequencer() from the iSCSI Target RX process.
5067  *       Any non zero return here is treated as an "out of resource' op here.
5068  */
5069         /*
5070          * Generate struct se_task(s) and/or their payloads for this CDB.
5071          */
5072 static int transport_generic_new_cmd(struct se_cmd *cmd)
5073 {
5074         struct se_portal_group *se_tpg;
5075         struct se_task *task;
5076         struct se_device *dev = SE_DEV(cmd);
5077         int ret = 0;
5078
5079         /*
5080          * Determine is the TCM fabric module has already allocated physical
5081          * memory, and is directly calling transport_generic_map_mem_to_cmd()
5082          * to setup beforehand the linked list of physical memory at
5083          * T_TASK(cmd)->t_mem_list of struct se_mem->se_page
5084          */
5085         if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)) {
5086                 ret = transport_allocate_resources(cmd);
5087                 if (ret < 0)
5088                         return ret;
5089         }
5090
5091         ret = transport_get_sectors(cmd);
5092         if (ret < 0)
5093                 return ret;
5094
5095         ret = transport_new_cmd_obj(cmd);
5096         if (ret < 0)
5097                 return ret;
5098
5099         /*
5100          * Determine if the calling TCM fabric module is talking to
5101          * Linux/NET via kernel sockets and needs to allocate a
5102          * struct iovec array to complete the struct se_cmd
5103          */
5104         se_tpg = SE_LUN(cmd)->lun_sep->sep_tpg;
5105         if (TPG_TFO(se_tpg)->alloc_cmd_iovecs != NULL) {
5106                 ret = TPG_TFO(se_tpg)->alloc_cmd_iovecs(cmd);
5107                 if (ret < 0)
5108                         return PYX_TRANSPORT_OUT_OF_MEMORY_RESOURCES;
5109         }
5110
5111         if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
5112                 list_for_each_entry(task, &T_TASK(cmd)->t_task_list, t_list) {
5113                         if (atomic_read(&task->task_sent))
5114                                 continue;
5115                         if (!dev->transport->map_task_SG)
5116                                 continue;
5117
5118                         ret = dev->transport->map_task_SG(task);
5119                         if (ret < 0)
5120                                 return ret;
5121                 }
5122         } else {
5123                 ret = transport_map_control_cmd_to_task(cmd);
5124                 if (ret < 0)
5125                         return ret;
5126         }
5127
5128         /*
5129          * For WRITEs, let the iSCSI Target RX Thread know its buffer is ready..
5130          * This WRITE struct se_cmd (and all of its associated struct se_task's)
5131          * will be added to the struct se_device execution queue after its WRITE
5132          * data has arrived. (ie: It gets handled by the transport processing
5133          * thread a second time)
5134          */
5135         if (cmd->data_direction == DMA_TO_DEVICE) {
5136                 transport_add_tasks_to_state_queue(cmd);
5137                 return transport_generic_write_pending(cmd);
5138         }
5139         /*
5140          * Everything else but a WRITE, add the struct se_cmd's struct se_task's
5141          * to the execution queue.
5142          */
5143         transport_execute_tasks(cmd);
5144         return 0;
5145 }
5146
5147 /*      transport_generic_process_write():
5148  *
5149  *
5150  */
5151 void transport_generic_process_write(struct se_cmd *cmd)
5152 {
5153 #if 0
5154         /*
5155          * Copy SCSI Presented DTL sector(s) from received buffers allocated to
5156          * original EDTL
5157          */
5158         if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
5159                 if (!T_TASK(cmd)->t_tasks_se_num) {
5160                         unsigned char *dst, *buf =
5161                                 (unsigned char *)T_TASK(cmd)->t_task_buf;
5162
5163                         dst = kzalloc(cmd->cmd_spdtl), GFP_KERNEL);
5164                         if (!(dst)) {
5165                                 printk(KERN_ERR "Unable to allocate memory for"
5166                                                 " WRITE underflow\n");
5167                                 transport_generic_request_failure(cmd, NULL,
5168                                         PYX_TRANSPORT_REQ_TOO_MANY_SECTORS, 1);
5169                                 return;
5170                         }
5171                         memcpy(dst, buf, cmd->cmd_spdtl);
5172
5173                         kfree(T_TASK(cmd)->t_task_buf);
5174                         T_TASK(cmd)->t_task_buf = dst;
5175                 } else {
5176                         struct scatterlist *sg =
5177                                 (struct scatterlist *sg)T_TASK(cmd)->t_task_buf;
5178                         struct scatterlist *orig_sg;
5179
5180                         orig_sg = kzalloc(sizeof(struct scatterlist) *
5181                                         T_TASK(cmd)->t_tasks_se_num,
5182                                         GFP_KERNEL))) {
5183                         if (!(orig_sg)) {
5184                                 printk(KERN_ERR "Unable to allocate memory"
5185                                                 " for WRITE underflow\n");
5186                                 transport_generic_request_failure(cmd, NULL,
5187                                         PYX_TRANSPORT_REQ_TOO_MANY_SECTORS, 1);
5188                                 return;
5189                         }
5190
5191                         memcpy(orig_sg, T_TASK(cmd)->t_task_buf,
5192                                         sizeof(struct scatterlist) *
5193                                         T_TASK(cmd)->t_tasks_se_num);
5194
5195                         cmd->data_length = cmd->cmd_spdtl;
5196                         /*
5197                          * FIXME, clear out original struct se_task and state
5198                          * information.
5199                          */
5200                         if (transport_generic_new_cmd(cmd) < 0) {
5201                                 transport_generic_request_failure(cmd, NULL,
5202                                         PYX_TRANSPORT_REQ_TOO_MANY_SECTORS, 1);
5203                                 kfree(orig_sg);
5204                                 return;
5205                         }
5206
5207                         transport_memcpy_write_sg(cmd, orig_sg);
5208                 }
5209         }
5210 #endif
5211         transport_execute_tasks(cmd);
5212 }
5213 EXPORT_SYMBOL(transport_generic_process_write);
5214
5215 /*      transport_generic_write_pending():
5216  *
5217  *
5218  */
5219 static int transport_generic_write_pending(struct se_cmd *cmd)
5220 {
5221         unsigned long flags;
5222         int ret;
5223
5224         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5225         cmd->t_state = TRANSPORT_WRITE_PENDING;
5226         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5227         /*
5228          * For the TCM control CDBs using a contiguous buffer, do the memcpy
5229          * from the passed Linux/SCSI struct scatterlist located at
5230          * T_TASK(se_cmd)->t_task_pt_buf to the contiguous buffer at
5231          * T_TASK(se_cmd)->t_task_buf.
5232          */
5233         if (cmd->se_cmd_flags & SCF_PASSTHROUGH_CONTIG_TO_SG)
5234                 transport_memcpy_read_contig(cmd,
5235                                 T_TASK(cmd)->t_task_buf,
5236                                 T_TASK(cmd)->t_task_pt_sgl);
5237         /*
5238          * Clear the se_cmd for WRITE_PENDING status in order to set
5239          * T_TASK(cmd)->t_transport_active=0 so that transport_generic_handle_data
5240          * can be called from HW target mode interrupt code.  This is safe
5241          * to be called with transport_off=1 before the CMD_TFO(cmd)->write_pending
5242          * because the se_cmd->se_lun pointer is not being cleared.
5243          */
5244         transport_cmd_check_stop(cmd, 1, 0);
5245
5246         /*
5247          * Call the fabric write_pending function here to let the
5248          * frontend know that WRITE buffers are ready.
5249          */
5250         ret = CMD_TFO(cmd)->write_pending(cmd);
5251         if (ret < 0)
5252                 return ret;
5253
5254         return PYX_TRANSPORT_WRITE_PENDING;
5255 }
5256
5257 /*      transport_release_cmd_to_pool():
5258  *
5259  *
5260  */
5261 void transport_release_cmd_to_pool(struct se_cmd *cmd)
5262 {
5263         BUG_ON(!T_TASK(cmd));
5264         BUG_ON(!CMD_TFO(cmd));
5265
5266         transport_free_se_cmd(cmd);
5267         CMD_TFO(cmd)->release_cmd_to_pool(cmd);
5268 }
5269 EXPORT_SYMBOL(transport_release_cmd_to_pool);
5270
5271 /*      transport_generic_free_cmd():
5272  *
5273  *      Called from processing frontend to release storage engine resources
5274  */
5275 void transport_generic_free_cmd(
5276         struct se_cmd *cmd,
5277         int wait_for_tasks,
5278         int release_to_pool,
5279         int session_reinstatement)
5280 {
5281         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) || !T_TASK(cmd))
5282                 transport_release_cmd_to_pool(cmd);
5283         else {
5284                 core_dec_lacl_count(cmd->se_sess->se_node_acl, cmd);
5285
5286                 if (SE_LUN(cmd)) {
5287 #if 0
5288                         printk(KERN_INFO "cmd: %p ITT: 0x%08x contains"
5289                                 " SE_LUN(cmd)\n", cmd,
5290                                 CMD_TFO(cmd)->get_task_tag(cmd));
5291 #endif
5292                         transport_lun_remove_cmd(cmd);
5293                 }
5294
5295                 if (wait_for_tasks && cmd->transport_wait_for_tasks)
5296                         cmd->transport_wait_for_tasks(cmd, 0, 0);
5297
5298                 transport_generic_remove(cmd, release_to_pool,
5299                                 session_reinstatement);
5300         }
5301 }
5302 EXPORT_SYMBOL(transport_generic_free_cmd);
5303
5304 static void transport_nop_wait_for_tasks(
5305         struct se_cmd *cmd,
5306         int remove_cmd,
5307         int session_reinstatement)
5308 {
5309         return;
5310 }
5311
5312 /*      transport_lun_wait_for_tasks():
5313  *
5314  *      Called from ConfigFS context to stop the passed struct se_cmd to allow
5315  *      an struct se_lun to be successfully shutdown.
5316  */
5317 static int transport_lun_wait_for_tasks(struct se_cmd *cmd, struct se_lun *lun)
5318 {
5319         unsigned long flags;
5320         int ret;
5321         /*
5322          * If the frontend has already requested this struct se_cmd to
5323          * be stopped, we can safely ignore this struct se_cmd.
5324          */
5325         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5326         if (atomic_read(&T_TASK(cmd)->t_transport_stop)) {
5327                 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
5328                 DEBUG_TRANSPORT_S("ConfigFS ITT[0x%08x] - t_transport_stop =="
5329                         " TRUE, skipping\n", CMD_TFO(cmd)->get_task_tag(cmd));
5330                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5331                 transport_cmd_check_stop(cmd, 1, 0);
5332                 return -1;
5333         }
5334         atomic_set(&T_TASK(cmd)->transport_lun_fe_stop, 1);
5335         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5336
5337         wake_up_interruptible(&SE_DEV(cmd)->dev_queue_obj->thread_wq);
5338
5339         ret = transport_stop_tasks_for_cmd(cmd);
5340
5341         DEBUG_TRANSPORT_S("ConfigFS: cmd: %p t_task_cdbs: %d stop tasks ret:"
5342                         " %d\n", cmd, T_TASK(cmd)->t_task_cdbs, ret);
5343         if (!ret) {
5344                 DEBUG_TRANSPORT_S("ConfigFS: ITT[0x%08x] - stopping cmd....\n",
5345                                 CMD_TFO(cmd)->get_task_tag(cmd));
5346                 wait_for_completion(&T_TASK(cmd)->transport_lun_stop_comp);
5347                 DEBUG_TRANSPORT_S("ConfigFS: ITT[0x%08x] - stopped cmd....\n",
5348                                 CMD_TFO(cmd)->get_task_tag(cmd));
5349         }
5350         transport_remove_cmd_from_queue(cmd, SE_DEV(cmd)->dev_queue_obj);
5351
5352         return 0;
5353 }
5354
5355 /* #define DEBUG_CLEAR_LUN */
5356 #ifdef DEBUG_CLEAR_LUN
5357 #define DEBUG_CLEAR_L(x...) printk(KERN_INFO x)
5358 #else
5359 #define DEBUG_CLEAR_L(x...)
5360 #endif
5361
5362 static void __transport_clear_lun_from_sessions(struct se_lun *lun)
5363 {
5364         struct se_cmd *cmd = NULL;
5365         unsigned long lun_flags, cmd_flags;
5366         /*
5367          * Do exception processing and return CHECK_CONDITION status to the
5368          * Initiator Port.
5369          */
5370         spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
5371         while (!list_empty_careful(&lun->lun_cmd_list)) {
5372                 cmd = list_entry(lun->lun_cmd_list.next,
5373                         struct se_cmd, se_lun_list);
5374                 list_del(&cmd->se_lun_list);
5375
5376                 if (!(T_TASK(cmd))) {
5377                         printk(KERN_ERR "ITT: 0x%08x, T_TASK(cmd) = NULL"
5378                                 "[i,t]_state: %u/%u\n",
5379                                 CMD_TFO(cmd)->get_task_tag(cmd),
5380                                 CMD_TFO(cmd)->get_cmd_state(cmd), cmd->t_state);
5381                         BUG();
5382                 }
5383                 atomic_set(&T_TASK(cmd)->transport_lun_active, 0);
5384                 /*
5385                  * This will notify iscsi_target_transport.c:
5386                  * transport_cmd_check_stop() that a LUN shutdown is in
5387                  * progress for the iscsi_cmd_t.
5388                  */
5389                 spin_lock(&T_TASK(cmd)->t_state_lock);
5390                 DEBUG_CLEAR_L("SE_LUN[%d] - Setting T_TASK(cmd)->transport"
5391                         "_lun_stop for  ITT: 0x%08x\n",
5392                         SE_LUN(cmd)->unpacked_lun,
5393                         CMD_TFO(cmd)->get_task_tag(cmd));
5394                 atomic_set(&T_TASK(cmd)->transport_lun_stop, 1);
5395                 spin_unlock(&T_TASK(cmd)->t_state_lock);
5396
5397                 spin_unlock_irqrestore(&lun->lun_cmd_lock, lun_flags);
5398
5399                 if (!(SE_LUN(cmd))) {
5400                         printk(KERN_ERR "ITT: 0x%08x, [i,t]_state: %u/%u\n",
5401                                 CMD_TFO(cmd)->get_task_tag(cmd),
5402                                 CMD_TFO(cmd)->get_cmd_state(cmd), cmd->t_state);
5403                         BUG();
5404                 }
5405                 /*
5406                  * If the Storage engine still owns the iscsi_cmd_t, determine
5407                  * and/or stop its context.
5408                  */
5409                 DEBUG_CLEAR_L("SE_LUN[%d] - ITT: 0x%08x before transport"
5410                         "_lun_wait_for_tasks()\n", SE_LUN(cmd)->unpacked_lun,
5411                         CMD_TFO(cmd)->get_task_tag(cmd));
5412
5413                 if (transport_lun_wait_for_tasks(cmd, SE_LUN(cmd)) < 0) {
5414                         spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
5415                         continue;
5416                 }
5417
5418                 DEBUG_CLEAR_L("SE_LUN[%d] - ITT: 0x%08x after transport_lun"
5419                         "_wait_for_tasks(): SUCCESS\n",
5420                         SE_LUN(cmd)->unpacked_lun,
5421                         CMD_TFO(cmd)->get_task_tag(cmd));
5422
5423                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, cmd_flags);
5424                 if (!(atomic_read(&T_TASK(cmd)->transport_dev_active))) {
5425                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, cmd_flags);
5426                         goto check_cond;
5427                 }
5428                 atomic_set(&T_TASK(cmd)->transport_dev_active, 0);
5429                 transport_all_task_dev_remove_state(cmd);
5430                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, cmd_flags);
5431
5432                 transport_free_dev_tasks(cmd);
5433                 /*
5434                  * The Storage engine stopped this struct se_cmd before it was
5435                  * send to the fabric frontend for delivery back to the
5436                  * Initiator Node.  Return this SCSI CDB back with an
5437                  * CHECK_CONDITION status.
5438                  */
5439 check_cond:
5440                 transport_send_check_condition_and_sense(cmd,
5441                                 TCM_NON_EXISTENT_LUN, 0);
5442                 /*
5443                  *  If the fabric frontend is waiting for this iscsi_cmd_t to
5444                  * be released, notify the waiting thread now that LU has
5445                  * finished accessing it.
5446                  */
5447                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, cmd_flags);
5448                 if (atomic_read(&T_TASK(cmd)->transport_lun_fe_stop)) {
5449                         DEBUG_CLEAR_L("SE_LUN[%d] - Detected FE stop for"
5450                                 " struct se_cmd: %p ITT: 0x%08x\n",
5451                                 lun->unpacked_lun,
5452                                 cmd, CMD_TFO(cmd)->get_task_tag(cmd));
5453
5454                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
5455                                         cmd_flags);
5456                         transport_cmd_check_stop(cmd, 1, 0);
5457                         complete(&T_TASK(cmd)->transport_lun_fe_stop_comp);
5458                         spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
5459                         continue;
5460                 }
5461                 DEBUG_CLEAR_L("SE_LUN[%d] - ITT: 0x%08x finished processing\n",
5462                         lun->unpacked_lun, CMD_TFO(cmd)->get_task_tag(cmd));
5463
5464                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, cmd_flags);
5465                 spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
5466         }
5467         spin_unlock_irqrestore(&lun->lun_cmd_lock, lun_flags);
5468 }
5469
5470 static int transport_clear_lun_thread(void *p)
5471 {
5472         struct se_lun *lun = (struct se_lun *)p;
5473
5474         __transport_clear_lun_from_sessions(lun);
5475         complete(&lun->lun_shutdown_comp);
5476
5477         return 0;
5478 }
5479
5480 int transport_clear_lun_from_sessions(struct se_lun *lun)
5481 {
5482         struct task_struct *kt;
5483
5484         kt = kthread_run(transport_clear_lun_thread, (void *)lun,
5485                         "tcm_cl_%u", lun->unpacked_lun);
5486         if (IS_ERR(kt)) {
5487                 printk(KERN_ERR "Unable to start clear_lun thread\n");
5488                 return -1;
5489         }
5490         wait_for_completion(&lun->lun_shutdown_comp);
5491
5492         return 0;
5493 }
5494
5495 /*      transport_generic_wait_for_tasks():
5496  *
5497  *      Called from frontend or passthrough context to wait for storage engine
5498  *      to pause and/or release frontend generated struct se_cmd.
5499  */
5500 static void transport_generic_wait_for_tasks(
5501         struct se_cmd *cmd,
5502         int remove_cmd,
5503         int session_reinstatement)
5504 {
5505         unsigned long flags;
5506
5507         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) && !(cmd->se_tmr_req))
5508                 return;
5509
5510         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5511         /*
5512          * If we are already stopped due to an external event (ie: LUN shutdown)
5513          * sleep until the connection can have the passed struct se_cmd back.
5514          * The T_TASK(cmd)->transport_lun_stopped_sem will be upped by
5515          * transport_clear_lun_from_sessions() once the ConfigFS context caller
5516          * has completed its operation on the struct se_cmd.
5517          */
5518         if (atomic_read(&T_TASK(cmd)->transport_lun_stop)) {
5519
5520                 DEBUG_TRANSPORT_S("wait_for_tasks: Stopping"
5521                         " wait_for_completion(&T_TASK(cmd)transport_lun_fe"
5522                         "_stop_comp); for ITT: 0x%08x\n",
5523                         CMD_TFO(cmd)->get_task_tag(cmd));
5524                 /*
5525                  * There is a special case for WRITES where a FE exception +
5526                  * LUN shutdown means ConfigFS context is still sleeping on
5527                  * transport_lun_stop_comp in transport_lun_wait_for_tasks().
5528                  * We go ahead and up transport_lun_stop_comp just to be sure
5529                  * here.
5530                  */
5531                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5532                 complete(&T_TASK(cmd)->transport_lun_stop_comp);
5533                 wait_for_completion(&T_TASK(cmd)->transport_lun_fe_stop_comp);
5534                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5535
5536                 transport_all_task_dev_remove_state(cmd);
5537                 /*
5538                  * At this point, the frontend who was the originator of this
5539                  * struct se_cmd, now owns the structure and can be released through
5540                  * normal means below.
5541                  */
5542                 DEBUG_TRANSPORT_S("wait_for_tasks: Stopped"
5543                         " wait_for_completion(&T_TASK(cmd)transport_lun_fe_"
5544                         "stop_comp); for ITT: 0x%08x\n",
5545                         CMD_TFO(cmd)->get_task_tag(cmd));
5546
5547                 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
5548         }
5549         if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
5550              atomic_read(&T_TASK(cmd)->t_transport_aborted))
5551                 goto remove;
5552
5553         atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
5554
5555         DEBUG_TRANSPORT_S("wait_for_tasks: Stopping %p ITT: 0x%08x"
5556                 " i_state: %d, t_state/def_t_state: %d/%d, t_transport_stop"
5557                 " = TRUE\n", cmd, CMD_TFO(cmd)->get_task_tag(cmd),
5558                 CMD_TFO(cmd)->get_cmd_state(cmd), cmd->t_state,
5559                 cmd->deferred_t_state);
5560
5561         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5562
5563         wake_up_interruptible(&SE_DEV(cmd)->dev_queue_obj->thread_wq);
5564
5565         wait_for_completion(&T_TASK(cmd)->t_transport_stop_comp);
5566
5567         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5568         atomic_set(&T_TASK(cmd)->t_transport_active, 0);
5569         atomic_set(&T_TASK(cmd)->t_transport_stop, 0);
5570
5571         DEBUG_TRANSPORT_S("wait_for_tasks: Stopped wait_for_compltion("
5572                 "&T_TASK(cmd)->t_transport_stop_comp) for ITT: 0x%08x\n",
5573                 CMD_TFO(cmd)->get_task_tag(cmd));
5574 remove:
5575         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5576         if (!remove_cmd)
5577                 return;
5578
5579         transport_generic_free_cmd(cmd, 0, 0, session_reinstatement);
5580 }
5581
5582 static int transport_get_sense_codes(
5583         struct se_cmd *cmd,
5584         u8 *asc,
5585         u8 *ascq)
5586 {
5587         *asc = cmd->scsi_asc;
5588         *ascq = cmd->scsi_ascq;
5589
5590         return 0;
5591 }
5592
5593 static int transport_set_sense_codes(
5594         struct se_cmd *cmd,
5595         u8 asc,
5596         u8 ascq)
5597 {
5598         cmd->scsi_asc = asc;
5599         cmd->scsi_ascq = ascq;
5600
5601         return 0;
5602 }
5603
5604 int transport_send_check_condition_and_sense(
5605         struct se_cmd *cmd,
5606         u8 reason,
5607         int from_transport)
5608 {
5609         unsigned char *buffer = cmd->sense_buffer;
5610         unsigned long flags;
5611         int offset;
5612         u8 asc = 0, ascq = 0;
5613
5614         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5615         if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
5616                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5617                 return 0;
5618         }
5619         cmd->se_cmd_flags |= SCF_SENT_CHECK_CONDITION;
5620         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
5621
5622         if (!reason && from_transport)
5623                 goto after_reason;
5624
5625         if (!from_transport)
5626                 cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
5627         /*
5628          * Data Segment and SenseLength of the fabric response PDU.
5629          *
5630          * TRANSPORT_SENSE_BUFFER is now set to SCSI_SENSE_BUFFERSIZE
5631          * from include/scsi/scsi_cmnd.h
5632          */
5633         offset = CMD_TFO(cmd)->set_fabric_sense_len(cmd,
5634                                 TRANSPORT_SENSE_BUFFER);
5635         /*
5636          * Actual SENSE DATA, see SPC-3 7.23.2  SPC_SENSE_KEY_OFFSET uses
5637          * SENSE KEY values from include/scsi/scsi.h
5638          */
5639         switch (reason) {
5640         case TCM_NON_EXISTENT_LUN:
5641         case TCM_UNSUPPORTED_SCSI_OPCODE:
5642         case TCM_SECTOR_COUNT_TOO_MANY:
5643                 /* CURRENT ERROR */
5644                 buffer[offset] = 0x70;
5645                 /* ILLEGAL REQUEST */
5646                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
5647                 /* INVALID COMMAND OPERATION CODE */
5648                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x20;
5649                 break;
5650         case TCM_UNKNOWN_MODE_PAGE:
5651                 /* CURRENT ERROR */
5652                 buffer[offset] = 0x70;
5653                 /* ILLEGAL REQUEST */
5654                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
5655                 /* INVALID FIELD IN CDB */
5656                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24;
5657                 break;
5658         case TCM_CHECK_CONDITION_ABORT_CMD:
5659                 /* CURRENT ERROR */
5660                 buffer[offset] = 0x70;
5661                 /* ABORTED COMMAND */
5662                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5663                 /* BUS DEVICE RESET FUNCTION OCCURRED */
5664                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x29;
5665                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = 0x03;
5666                 break;
5667         case TCM_INCORRECT_AMOUNT_OF_DATA:
5668                 /* CURRENT ERROR */
5669                 buffer[offset] = 0x70;
5670                 /* ABORTED COMMAND */
5671                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5672                 /* WRITE ERROR */
5673                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x0c;
5674                 /* NOT ENOUGH UNSOLICITED DATA */
5675                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = 0x0d;
5676                 break;
5677         case TCM_INVALID_CDB_FIELD:
5678                 /* CURRENT ERROR */
5679                 buffer[offset] = 0x70;
5680                 /* ABORTED COMMAND */
5681                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5682                 /* INVALID FIELD IN CDB */
5683                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24;
5684                 break;
5685         case TCM_INVALID_PARAMETER_LIST:
5686                 /* CURRENT ERROR */
5687                 buffer[offset] = 0x70;
5688                 /* ABORTED COMMAND */
5689                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5690                 /* INVALID FIELD IN PARAMETER LIST */
5691                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x26;
5692                 break;
5693         case TCM_UNEXPECTED_UNSOLICITED_DATA:
5694                 /* CURRENT ERROR */
5695                 buffer[offset] = 0x70;
5696                 /* ABORTED COMMAND */
5697                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5698                 /* WRITE ERROR */
5699                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x0c;
5700                 /* UNEXPECTED_UNSOLICITED_DATA */
5701                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = 0x0c;
5702                 break;
5703         case TCM_SERVICE_CRC_ERROR:
5704                 /* CURRENT ERROR */
5705                 buffer[offset] = 0x70;
5706                 /* ABORTED COMMAND */
5707                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5708                 /* PROTOCOL SERVICE CRC ERROR */
5709                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x47;
5710                 /* N/A */
5711                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = 0x05;
5712                 break;
5713         case TCM_SNACK_REJECTED:
5714                 /* CURRENT ERROR */
5715                 buffer[offset] = 0x70;
5716                 /* ABORTED COMMAND */
5717                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
5718                 /* READ ERROR */
5719                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x11;
5720                 /* FAILED RETRANSMISSION REQUEST */
5721                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = 0x13;
5722                 break;
5723         case TCM_WRITE_PROTECTED:
5724                 /* CURRENT ERROR */
5725                 buffer[offset] = 0x70;
5726                 /* DATA PROTECT */
5727                 buffer[offset+SPC_SENSE_KEY_OFFSET] = DATA_PROTECT;
5728                 /* WRITE PROTECTED */
5729                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x27;
5730                 break;
5731         case TCM_CHECK_CONDITION_UNIT_ATTENTION:
5732                 /* CURRENT ERROR */
5733                 buffer[offset] = 0x70;
5734                 /* UNIT ATTENTION */
5735                 buffer[offset+SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
5736                 core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
5737                 buffer[offset+SPC_ASC_KEY_OFFSET] = asc;
5738                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = ascq;
5739                 break;
5740         case TCM_CHECK_CONDITION_NOT_READY:
5741                 /* CURRENT ERROR */
5742                 buffer[offset] = 0x70;
5743                 /* Not Ready */
5744                 buffer[offset+SPC_SENSE_KEY_OFFSET] = NOT_READY;
5745                 transport_get_sense_codes(cmd, &asc, &ascq);
5746                 buffer[offset+SPC_ASC_KEY_OFFSET] = asc;
5747                 buffer[offset+SPC_ASCQ_KEY_OFFSET] = ascq;
5748                 break;
5749         case TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE:
5750         default:
5751                 /* CURRENT ERROR */
5752                 buffer[offset] = 0x70;
5753                 /* ILLEGAL REQUEST */
5754                 buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
5755                 /* LOGICAL UNIT COMMUNICATION FAILURE */
5756                 buffer[offset+SPC_ASC_KEY_OFFSET] = 0x80;
5757                 break;
5758         }
5759         /*
5760          * This code uses linux/include/scsi/scsi.h SAM status codes!
5761          */
5762         cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
5763         /*
5764          * Automatically padded, this value is encoded in the fabric's
5765          * data_length response PDU containing the SCSI defined sense data.
5766          */
5767         cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER + offset;
5768
5769 after_reason:
5770         CMD_TFO(cmd)->queue_status(cmd);
5771         return 0;
5772 }
5773 EXPORT_SYMBOL(transport_send_check_condition_and_sense);
5774
5775 int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
5776 {
5777         int ret = 0;
5778
5779         if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
5780                 if (!(send_status) ||
5781                      (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
5782                         return 1;
5783 #if 0
5784                 printk(KERN_INFO "Sending delayed SAM_STAT_TASK_ABORTED"
5785                         " status for CDB: 0x%02x ITT: 0x%08x\n",
5786                         T_TASK(cmd)->t_task_cdb[0],
5787                         CMD_TFO(cmd)->get_task_tag(cmd));
5788 #endif
5789                 cmd->se_cmd_flags |= SCF_SENT_DELAYED_TAS;
5790                 CMD_TFO(cmd)->queue_status(cmd);
5791                 ret = 1;
5792         }
5793         return ret;
5794 }
5795 EXPORT_SYMBOL(transport_check_aborted_status);
5796
5797 void transport_send_task_abort(struct se_cmd *cmd)
5798 {
5799         /*
5800          * If there are still expected incoming fabric WRITEs, we wait
5801          * until until they have completed before sending a TASK_ABORTED
5802          * response.  This response with TASK_ABORTED status will be
5803          * queued back to fabric module by transport_check_aborted_status().
5804          */
5805         if (cmd->data_direction == DMA_TO_DEVICE) {
5806                 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
5807                         atomic_inc(&T_TASK(cmd)->t_transport_aborted);
5808                         smp_mb__after_atomic_inc();
5809                         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
5810                         transport_new_cmd_failure(cmd);
5811                         return;
5812                 }
5813         }
5814         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
5815 #if 0
5816         printk(KERN_INFO "Setting SAM_STAT_TASK_ABORTED status for CDB: 0x%02x,"
5817                 " ITT: 0x%08x\n", T_TASK(cmd)->t_task_cdb[0],
5818                 CMD_TFO(cmd)->get_task_tag(cmd));
5819 #endif
5820         CMD_TFO(cmd)->queue_status(cmd);
5821 }
5822
5823 /*      transport_generic_do_tmr():
5824  *
5825  *
5826  */
5827 int transport_generic_do_tmr(struct se_cmd *cmd)
5828 {
5829         struct se_cmd *ref_cmd;
5830         struct se_device *dev = SE_DEV(cmd);
5831         struct se_tmr_req *tmr = cmd->se_tmr_req;
5832         int ret;
5833
5834         switch (tmr->function) {
5835         case ABORT_TASK:
5836                 ref_cmd = tmr->ref_cmd;
5837                 tmr->response = TMR_FUNCTION_REJECTED;
5838                 break;
5839         case ABORT_TASK_SET:
5840         case CLEAR_ACA:
5841         case CLEAR_TASK_SET:
5842                 tmr->response = TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
5843                 break;
5844         case LUN_RESET:
5845                 ret = core_tmr_lun_reset(dev, tmr, NULL, NULL);
5846                 tmr->response = (!ret) ? TMR_FUNCTION_COMPLETE :
5847                                          TMR_FUNCTION_REJECTED;
5848                 break;
5849 #if 0
5850         case TARGET_WARM_RESET:
5851                 transport_generic_host_reset(dev->se_hba);
5852                 tmr->response = TMR_FUNCTION_REJECTED;
5853                 break;
5854         case TARGET_COLD_RESET:
5855                 transport_generic_host_reset(dev->se_hba);
5856                 transport_generic_cold_reset(dev->se_hba);
5857                 tmr->response = TMR_FUNCTION_REJECTED;
5858                 break;
5859 #endif
5860         default:
5861                 printk(KERN_ERR "Uknown TMR function: 0x%02x.\n",
5862                                 tmr->function);
5863                 tmr->response = TMR_FUNCTION_REJECTED;
5864                 break;
5865         }
5866
5867         cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
5868         CMD_TFO(cmd)->queue_tm_rsp(cmd);
5869
5870         transport_cmd_check_stop(cmd, 2, 0);
5871         return 0;
5872 }
5873
5874 /*
5875  *      Called with spin_lock_irq(&dev->execute_task_lock); held
5876  *
5877  */
5878 static struct se_task *
5879 transport_get_task_from_state_list(struct se_device *dev)
5880 {
5881         struct se_task *task;
5882
5883         if (list_empty(&dev->state_task_list))
5884                 return NULL;
5885
5886         list_for_each_entry(task, &dev->state_task_list, t_state_list)
5887                 break;
5888
5889         list_del(&task->t_state_list);
5890         atomic_set(&task->task_state_active, 0);
5891
5892         return task;
5893 }
5894
5895 static void transport_processing_shutdown(struct se_device *dev)
5896 {
5897         struct se_cmd *cmd;
5898         struct se_queue_req *qr;
5899         struct se_task *task;
5900         u8 state;
5901         unsigned long flags;
5902         /*
5903          * Empty the struct se_device's struct se_task state list.
5904          */
5905         spin_lock_irqsave(&dev->execute_task_lock, flags);
5906         while ((task = transport_get_task_from_state_list(dev))) {
5907                 if (!(TASK_CMD(task))) {
5908                         printk(KERN_ERR "TASK_CMD(task) is NULL!\n");
5909                         continue;
5910                 }
5911                 cmd = TASK_CMD(task);
5912
5913                 if (!T_TASK(cmd)) {
5914                         printk(KERN_ERR "T_TASK(cmd) is NULL for task: %p cmd:"
5915                                 " %p ITT: 0x%08x\n", task, cmd,
5916                                 CMD_TFO(cmd)->get_task_tag(cmd));
5917                         continue;
5918                 }
5919                 spin_unlock_irqrestore(&dev->execute_task_lock, flags);
5920
5921                 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5922
5923                 DEBUG_DO("PT: cmd: %p task: %p ITT/CmdSN: 0x%08x/0x%08x,"
5924                         " i_state/def_i_state: %d/%d, t_state/def_t_state:"
5925                         " %d/%d cdb: 0x%02x\n", cmd, task,
5926                         CMD_TFO(cmd)->get_task_tag(cmd), cmd->cmd_sn,
5927                         CMD_TFO(cmd)->get_cmd_state(cmd), cmd->deferred_i_state,
5928                         cmd->t_state, cmd->deferred_t_state,
5929                         T_TASK(cmd)->t_task_cdb[0]);
5930                 DEBUG_DO("PT: ITT[0x%08x] - t_task_cdbs: %d t_task_cdbs_left:"
5931                         " %d t_task_cdbs_sent: %d -- t_transport_active: %d"
5932                         " t_transport_stop: %d t_transport_sent: %d\n",
5933                         CMD_TFO(cmd)->get_task_tag(cmd),
5934                         T_TASK(cmd)->t_task_cdbs,
5935                         atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
5936                         atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
5937                         atomic_read(&T_TASK(cmd)->t_transport_active),
5938                         atomic_read(&T_TASK(cmd)->t_transport_stop),
5939                         atomic_read(&T_TASK(cmd)->t_transport_sent));
5940
5941                 if (atomic_read(&task->task_active)) {
5942                         atomic_set(&task->task_stop, 1);
5943                         spin_unlock_irqrestore(
5944                                 &T_TASK(cmd)->t_state_lock, flags);
5945
5946                         DEBUG_DO("Waiting for task: %p to shutdown for dev:"
5947                                 " %p\n", task, dev);
5948                         wait_for_completion(&task->task_stop_comp);
5949                         DEBUG_DO("Completed task: %p shutdown for dev: %p\n",
5950                                 task, dev);
5951
5952                         spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
5953                         atomic_dec(&T_TASK(cmd)->t_task_cdbs_left);
5954
5955                         atomic_set(&task->task_active, 0);
5956                         atomic_set(&task->task_stop, 0);
5957                 } else {
5958                         if (atomic_read(&task->task_execute_queue) != 0)
5959                                 transport_remove_task_from_execute_queue(task, dev);
5960                 }
5961                 __transport_stop_task_timer(task, &flags);
5962
5963                 if (!(atomic_dec_and_test(&T_TASK(cmd)->t_task_cdbs_ex_left))) {
5964                         spin_unlock_irqrestore(
5965                                         &T_TASK(cmd)->t_state_lock, flags);
5966
5967                         DEBUG_DO("Skipping task: %p, dev: %p for"
5968                                 " t_task_cdbs_ex_left: %d\n", task, dev,
5969                                 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left));
5970
5971                         spin_lock_irqsave(&dev->execute_task_lock, flags);
5972                         continue;
5973                 }
5974
5975                 if (atomic_read(&T_TASK(cmd)->t_transport_active)) {
5976                         DEBUG_DO("got t_transport_active = 1 for task: %p, dev:"
5977                                         " %p\n", task, dev);
5978
5979                         if (atomic_read(&T_TASK(cmd)->t_fe_count)) {
5980                                 spin_unlock_irqrestore(
5981                                         &T_TASK(cmd)->t_state_lock, flags);
5982                                 transport_send_check_condition_and_sense(
5983                                         cmd, TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE,
5984                                         0);
5985                                 transport_remove_cmd_from_queue(cmd,
5986                                         SE_DEV(cmd)->dev_queue_obj);
5987
5988                                 transport_lun_remove_cmd(cmd);
5989                                 transport_cmd_check_stop(cmd, 1, 0);
5990                         } else {
5991                                 spin_unlock_irqrestore(
5992                                         &T_TASK(cmd)->t_state_lock, flags);
5993
5994                                 transport_remove_cmd_from_queue(cmd,
5995                                         SE_DEV(cmd)->dev_queue_obj);
5996
5997                                 transport_lun_remove_cmd(cmd);
5998
5999                                 if (transport_cmd_check_stop(cmd, 1, 0))
6000                                         transport_generic_remove(cmd, 0, 0);
6001                         }
6002
6003                         spin_lock_irqsave(&dev->execute_task_lock, flags);
6004                         continue;
6005                 }
6006                 DEBUG_DO("Got t_transport_active = 0 for task: %p, dev: %p\n",
6007                                 task, dev);
6008
6009                 if (atomic_read(&T_TASK(cmd)->t_fe_count)) {
6010                         spin_unlock_irqrestore(
6011                                 &T_TASK(cmd)->t_state_lock, flags);
6012                         transport_send_check_condition_and_sense(cmd,
6013                                 TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
6014                         transport_remove_cmd_from_queue(cmd,
6015                                 SE_DEV(cmd)->dev_queue_obj);
6016
6017                         transport_lun_remove_cmd(cmd);
6018                         transport_cmd_check_stop(cmd, 1, 0);
6019                 } else {
6020                         spin_unlock_irqrestore(
6021                                 &T_TASK(cmd)->t_state_lock, flags);
6022
6023                         transport_remove_cmd_from_queue(cmd,
6024                                 SE_DEV(cmd)->dev_queue_obj);
6025                         transport_lun_remove_cmd(cmd);
6026
6027                         if (transport_cmd_check_stop(cmd, 1, 0))
6028                                 transport_generic_remove(cmd, 0, 0);
6029                 }
6030
6031                 spin_lock_irqsave(&dev->execute_task_lock, flags);
6032         }
6033         spin_unlock_irqrestore(&dev->execute_task_lock, flags);
6034         /*
6035          * Empty the struct se_device's struct se_cmd list.
6036          */
6037         spin_lock_irqsave(&dev->dev_queue_obj->cmd_queue_lock, flags);
6038         while ((qr = __transport_get_qr_from_queue(dev->dev_queue_obj))) {
6039                 spin_unlock_irqrestore(
6040                                 &dev->dev_queue_obj->cmd_queue_lock, flags);
6041                 cmd = (struct se_cmd *)qr->cmd;
6042                 state = qr->state;
6043                 kfree(qr);
6044
6045                 DEBUG_DO("From Device Queue: cmd: %p t_state: %d\n",
6046                                 cmd, state);
6047
6048                 if (atomic_read(&T_TASK(cmd)->t_fe_count)) {
6049                         transport_send_check_condition_and_sense(cmd,
6050                                 TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
6051
6052                         transport_lun_remove_cmd(cmd);
6053                         transport_cmd_check_stop(cmd, 1, 0);
6054                 } else {
6055                         transport_lun_remove_cmd(cmd);
6056                         if (transport_cmd_check_stop(cmd, 1, 0))
6057                                 transport_generic_remove(cmd, 0, 0);
6058                 }
6059                 spin_lock_irqsave(&dev->dev_queue_obj->cmd_queue_lock, flags);
6060         }
6061         spin_unlock_irqrestore(&dev->dev_queue_obj->cmd_queue_lock, flags);
6062 }
6063
6064 /*      transport_processing_thread():
6065  *
6066  *
6067  */
6068 static int transport_processing_thread(void *param)
6069 {
6070         int ret, t_state;
6071         struct se_cmd *cmd;
6072         struct se_device *dev = (struct se_device *) param;
6073         struct se_queue_req *qr;
6074
6075         set_user_nice(current, -20);
6076
6077         while (!kthread_should_stop()) {
6078                 ret = wait_event_interruptible(dev->dev_queue_obj->thread_wq,
6079                                 atomic_read(&dev->dev_queue_obj->queue_cnt) ||
6080                                 kthread_should_stop());
6081                 if (ret < 0)
6082                         goto out;
6083
6084                 spin_lock_irq(&dev->dev_status_lock);
6085                 if (dev->dev_status & TRANSPORT_DEVICE_SHUTDOWN) {
6086                         spin_unlock_irq(&dev->dev_status_lock);
6087                         transport_processing_shutdown(dev);
6088                         continue;
6089                 }
6090                 spin_unlock_irq(&dev->dev_status_lock);
6091
6092 get_cmd:
6093                 __transport_execute_tasks(dev);
6094
6095                 qr = transport_get_qr_from_queue(dev->dev_queue_obj);
6096                 if (!(qr))
6097                         continue;
6098
6099                 cmd = (struct se_cmd *)qr->cmd;
6100                 t_state = qr->state;
6101                 kfree(qr);
6102
6103                 switch (t_state) {
6104                 case TRANSPORT_NEW_CMD_MAP:
6105                         if (!(CMD_TFO(cmd)->new_cmd_map)) {
6106                                 printk(KERN_ERR "CMD_TFO(cmd)->new_cmd_map is"
6107                                         " NULL for TRANSPORT_NEW_CMD_MAP\n");
6108                                 BUG();
6109                         }
6110                         ret = CMD_TFO(cmd)->new_cmd_map(cmd);
6111                         if (ret < 0) {
6112                                 cmd->transport_error_status = ret;
6113                                 transport_generic_request_failure(cmd, NULL,
6114                                                 0, (cmd->data_direction !=
6115                                                     DMA_TO_DEVICE));
6116                                 break;
6117                         }
6118                         /* Fall through */
6119                 case TRANSPORT_NEW_CMD:
6120                         ret = transport_generic_new_cmd(cmd);
6121                         if (ret < 0) {
6122                                 cmd->transport_error_status = ret;
6123                                 transport_generic_request_failure(cmd, NULL,
6124                                         0, (cmd->data_direction !=
6125                                          DMA_TO_DEVICE));
6126                         }
6127                         break;
6128                 case TRANSPORT_PROCESS_WRITE:
6129                         transport_generic_process_write(cmd);
6130                         break;
6131                 case TRANSPORT_COMPLETE_OK:
6132                         transport_stop_all_task_timers(cmd);
6133                         transport_generic_complete_ok(cmd);
6134                         break;
6135                 case TRANSPORT_REMOVE:
6136                         transport_generic_remove(cmd, 1, 0);
6137                         break;
6138                 case TRANSPORT_PROCESS_TMR:
6139                         transport_generic_do_tmr(cmd);
6140                         break;
6141                 case TRANSPORT_COMPLETE_FAILURE:
6142                         transport_generic_request_failure(cmd, NULL, 1, 1);
6143                         break;
6144                 case TRANSPORT_COMPLETE_TIMEOUT:
6145                         transport_stop_all_task_timers(cmd);
6146                         transport_generic_request_timeout(cmd);
6147                         break;
6148                 default:
6149                         printk(KERN_ERR "Unknown t_state: %d deferred_t_state:"
6150                                 " %d for ITT: 0x%08x i_state: %d on SE LUN:"
6151                                 " %u\n", t_state, cmd->deferred_t_state,
6152                                 CMD_TFO(cmd)->get_task_tag(cmd),
6153                                 CMD_TFO(cmd)->get_cmd_state(cmd),
6154                                 SE_LUN(cmd)->unpacked_lun);
6155                         BUG();
6156                 }
6157
6158                 goto get_cmd;
6159         }
6160
6161 out:
6162         transport_release_all_cmds(dev);
6163         dev->process_thread = NULL;
6164         return 0;
6165 }