2 * SCSI Block Commands (SBC) parsing and emulation.
4 * (c) Copyright 2002-2012 RisingTide Systems LLC.
6 * Nicholas A. Bellinger <nab@kernel.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
23 #include <linux/kernel.h>
24 #include <linux/module.h>
25 #include <linux/ratelimit.h>
26 #include <asm/unaligned.h>
27 #include <scsi/scsi.h>
29 #include <target/target_core_base.h>
30 #include <target/target_core_backend.h>
31 #include <target/target_core_fabric.h>
33 #include "target_core_internal.h"
34 #include "target_core_ua.h"
38 sbc_emulate_readcapacity(struct se_cmd
*cmd
)
40 struct se_device
*dev
= cmd
->se_dev
;
41 unsigned char *cdb
= cmd
->t_task_cdb
;
42 unsigned long long blocks_long
= dev
->transport
->get_blocks(dev
);
49 * If the PMI bit is set to zero and the LOGICAL BLOCK
50 * ADDRESS field is not set to zero, the device server shall
51 * terminate the command with CHECK CONDITION status with
52 * the sense key set to ILLEGAL REQUEST and the additional
53 * sense code set to INVALID FIELD IN CDB.
55 * In SBC-3, these fields are obsolete, but some SCSI
56 * compliance tests actually check this, so we might as well
59 if (!(cdb
[8] & 1) && !!(cdb
[2] | cdb
[3] | cdb
[4] | cdb
[5]))
60 return TCM_INVALID_CDB_FIELD
;
62 if (blocks_long
>= 0x00000000ffffffff)
65 blocks
= (u32
)blocks_long
;
67 buf
[0] = (blocks
>> 24) & 0xff;
68 buf
[1] = (blocks
>> 16) & 0xff;
69 buf
[2] = (blocks
>> 8) & 0xff;
70 buf
[3] = blocks
& 0xff;
71 buf
[4] = (dev
->dev_attrib
.block_size
>> 24) & 0xff;
72 buf
[5] = (dev
->dev_attrib
.block_size
>> 16) & 0xff;
73 buf
[6] = (dev
->dev_attrib
.block_size
>> 8) & 0xff;
74 buf
[7] = dev
->dev_attrib
.block_size
& 0xff;
76 rbuf
= transport_kmap_data_sg(cmd
);
78 memcpy(rbuf
, buf
, min_t(u32
, sizeof(buf
), cmd
->data_length
));
79 transport_kunmap_data_sg(cmd
);
82 target_complete_cmd(cmd
, GOOD
);
87 sbc_emulate_readcapacity_16(struct se_cmd
*cmd
)
89 struct se_device
*dev
= cmd
->se_dev
;
91 unsigned char buf
[32];
92 unsigned long long blocks
= dev
->transport
->get_blocks(dev
);
94 memset(buf
, 0, sizeof(buf
));
95 buf
[0] = (blocks
>> 56) & 0xff;
96 buf
[1] = (blocks
>> 48) & 0xff;
97 buf
[2] = (blocks
>> 40) & 0xff;
98 buf
[3] = (blocks
>> 32) & 0xff;
99 buf
[4] = (blocks
>> 24) & 0xff;
100 buf
[5] = (blocks
>> 16) & 0xff;
101 buf
[6] = (blocks
>> 8) & 0xff;
102 buf
[7] = blocks
& 0xff;
103 buf
[8] = (dev
->dev_attrib
.block_size
>> 24) & 0xff;
104 buf
[9] = (dev
->dev_attrib
.block_size
>> 16) & 0xff;
105 buf
[10] = (dev
->dev_attrib
.block_size
>> 8) & 0xff;
106 buf
[11] = dev
->dev_attrib
.block_size
& 0xff;
108 * Set Thin Provisioning Enable bit following sbc3r22 in section
109 * READ CAPACITY (16) byte 14 if emulate_tpu or emulate_tpws is enabled.
111 if (dev
->dev_attrib
.emulate_tpu
|| dev
->dev_attrib
.emulate_tpws
)
114 rbuf
= transport_kmap_data_sg(cmd
);
116 memcpy(rbuf
, buf
, min_t(u32
, sizeof(buf
), cmd
->data_length
));
117 transport_kunmap_data_sg(cmd
);
120 target_complete_cmd(cmd
, GOOD
);
124 sector_t
sbc_get_write_same_sectors(struct se_cmd
*cmd
)
128 if (cmd
->t_task_cdb
[0] == WRITE_SAME
)
129 num_blocks
= get_unaligned_be16(&cmd
->t_task_cdb
[7]);
130 else if (cmd
->t_task_cdb
[0] == WRITE_SAME_16
)
131 num_blocks
= get_unaligned_be32(&cmd
->t_task_cdb
[10]);
132 else /* WRITE_SAME_32 via VARIABLE_LENGTH_CMD */
133 num_blocks
= get_unaligned_be32(&cmd
->t_task_cdb
[28]);
136 * Use the explicit range when non zero is supplied, otherwise calculate
137 * the remaining range based on ->get_blocks() - starting LBA.
142 return cmd
->se_dev
->transport
->get_blocks(cmd
->se_dev
) -
145 EXPORT_SYMBOL(sbc_get_write_same_sectors
);
147 static sense_reason_t
148 sbc_emulate_noop(struct se_cmd
*cmd
)
150 target_complete_cmd(cmd
, GOOD
);
154 static inline u32
sbc_get_size(struct se_cmd
*cmd
, u32 sectors
)
156 return cmd
->se_dev
->dev_attrib
.block_size
* sectors
;
159 static int sbc_check_valid_sectors(struct se_cmd
*cmd
)
161 struct se_device
*dev
= cmd
->se_dev
;
162 unsigned long long end_lba
;
165 sectors
= cmd
->data_length
/ dev
->dev_attrib
.block_size
;
166 end_lba
= dev
->transport
->get_blocks(dev
) + 1;
168 if (cmd
->t_task_lba
+ sectors
> end_lba
) {
169 pr_err("target: lba %llu, sectors %u exceeds end lba %llu\n",
170 cmd
->t_task_lba
, sectors
, end_lba
);
177 static inline u32
transport_get_sectors_6(unsigned char *cdb
)
180 * Use 8-bit sector value. SBC-3 says:
182 * A TRANSFER LENGTH field set to zero specifies that 256
183 * logical blocks shall be written. Any other value
184 * specifies the number of logical blocks that shall be
187 return cdb
[4] ? : 256;
190 static inline u32
transport_get_sectors_10(unsigned char *cdb
)
192 return (u32
)(cdb
[7] << 8) + cdb
[8];
195 static inline u32
transport_get_sectors_12(unsigned char *cdb
)
197 return (u32
)(cdb
[6] << 24) + (cdb
[7] << 16) + (cdb
[8] << 8) + cdb
[9];
200 static inline u32
transport_get_sectors_16(unsigned char *cdb
)
202 return (u32
)(cdb
[10] << 24) + (cdb
[11] << 16) +
203 (cdb
[12] << 8) + cdb
[13];
207 * Used for VARIABLE_LENGTH_CDB WRITE_32 and READ_32 variants
209 static inline u32
transport_get_sectors_32(unsigned char *cdb
)
211 return (u32
)(cdb
[28] << 24) + (cdb
[29] << 16) +
212 (cdb
[30] << 8) + cdb
[31];
216 static inline u32
transport_lba_21(unsigned char *cdb
)
218 return ((cdb
[1] & 0x1f) << 16) | (cdb
[2] << 8) | cdb
[3];
221 static inline u32
transport_lba_32(unsigned char *cdb
)
223 return (cdb
[2] << 24) | (cdb
[3] << 16) | (cdb
[4] << 8) | cdb
[5];
226 static inline unsigned long long transport_lba_64(unsigned char *cdb
)
228 unsigned int __v1
, __v2
;
230 __v1
= (cdb
[2] << 24) | (cdb
[3] << 16) | (cdb
[4] << 8) | cdb
[5];
231 __v2
= (cdb
[6] << 24) | (cdb
[7] << 16) | (cdb
[8] << 8) | cdb
[9];
233 return ((unsigned long long)__v2
) | (unsigned long long)__v1
<< 32;
237 * For VARIABLE_LENGTH_CDB w/ 32 byte extended CDBs
239 static inline unsigned long long transport_lba_64_ext(unsigned char *cdb
)
241 unsigned int __v1
, __v2
;
243 __v1
= (cdb
[12] << 24) | (cdb
[13] << 16) | (cdb
[14] << 8) | cdb
[15];
244 __v2
= (cdb
[16] << 24) | (cdb
[17] << 16) | (cdb
[18] << 8) | cdb
[19];
246 return ((unsigned long long)__v2
) | (unsigned long long)__v1
<< 32;
249 static sense_reason_t
250 sbc_setup_write_same(struct se_cmd
*cmd
, unsigned char *flags
, struct sbc_ops
*ops
)
252 unsigned int sectors
= sbc_get_write_same_sectors(cmd
);
254 if ((flags
[0] & 0x04) || (flags
[0] & 0x02)) {
255 pr_err("WRITE_SAME PBDATA and LBDATA"
256 " bits not supported for Block Discard"
258 return TCM_UNSUPPORTED_SCSI_OPCODE
;
260 if (sectors
> cmd
->se_dev
->dev_attrib
.max_write_same_len
) {
261 pr_warn("WRITE_SAME sectors: %u exceeds max_write_same_len: %u\n",
262 sectors
, cmd
->se_dev
->dev_attrib
.max_write_same_len
);
263 return TCM_INVALID_CDB_FIELD
;
266 * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
267 * translated into block discard requests within backend code.
269 if (flags
[0] & 0x08) {
270 if (!ops
->execute_write_same_unmap
)
271 return TCM_UNSUPPORTED_SCSI_OPCODE
;
273 cmd
->execute_cmd
= ops
->execute_write_same_unmap
;
276 if (!ops
->execute_write_same
)
277 return TCM_UNSUPPORTED_SCSI_OPCODE
;
279 cmd
->execute_cmd
= ops
->execute_write_same
;
283 static void xdreadwrite_callback(struct se_cmd
*cmd
)
285 unsigned char *buf
, *addr
;
286 struct scatterlist
*sg
;
291 * From sbc3r22.pdf section 5.48 XDWRITEREAD (10) command
293 * 1) read the specified logical block(s);
294 * 2) transfer logical blocks from the data-out buffer;
295 * 3) XOR the logical blocks transferred from the data-out buffer with
296 * the logical blocks read, storing the resulting XOR data in a buffer;
297 * 4) if the DISABLE WRITE bit is set to zero, then write the logical
298 * blocks transferred from the data-out buffer; and
299 * 5) transfer the resulting XOR data to the data-in buffer.
301 buf
= kmalloc(cmd
->data_length
, GFP_KERNEL
);
303 pr_err("Unable to allocate xor_callback buf\n");
307 * Copy the scatterlist WRITE buffer located at cmd->t_data_sg
308 * into the locally allocated *buf
310 sg_copy_to_buffer(cmd
->t_data_sg
,
316 * Now perform the XOR against the BIDI read memory located at
317 * cmd->t_mem_bidi_list
321 for_each_sg(cmd
->t_bidi_data_sg
, sg
, cmd
->t_bidi_data_nents
, count
) {
322 addr
= kmap_atomic(sg_page(sg
));
326 for (i
= 0; i
< sg
->length
; i
++)
327 *(addr
+ sg
->offset
+ i
) ^= *(buf
+ offset
+ i
);
329 offset
+= sg
->length
;
338 sbc_parse_cdb(struct se_cmd
*cmd
, struct sbc_ops
*ops
)
340 struct se_device
*dev
= cmd
->se_dev
;
341 unsigned char *cdb
= cmd
->t_task_cdb
;
348 sectors
= transport_get_sectors_6(cdb
);
349 cmd
->t_task_lba
= transport_lba_21(cdb
);
350 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
351 cmd
->execute_cmd
= ops
->execute_rw
;
354 sectors
= transport_get_sectors_10(cdb
);
355 cmd
->t_task_lba
= transport_lba_32(cdb
);
356 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
357 cmd
->execute_cmd
= ops
->execute_rw
;
360 sectors
= transport_get_sectors_12(cdb
);
361 cmd
->t_task_lba
= transport_lba_32(cdb
);
362 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
363 cmd
->execute_cmd
= ops
->execute_rw
;
366 sectors
= transport_get_sectors_16(cdb
);
367 cmd
->t_task_lba
= transport_lba_64(cdb
);
368 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
369 cmd
->execute_cmd
= ops
->execute_rw
;
372 sectors
= transport_get_sectors_6(cdb
);
373 cmd
->t_task_lba
= transport_lba_21(cdb
);
374 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
375 cmd
->execute_cmd
= ops
->execute_rw
;
379 sectors
= transport_get_sectors_10(cdb
);
380 cmd
->t_task_lba
= transport_lba_32(cdb
);
382 cmd
->se_cmd_flags
|= SCF_FUA
;
383 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
384 cmd
->execute_cmd
= ops
->execute_rw
;
387 sectors
= transport_get_sectors_12(cdb
);
388 cmd
->t_task_lba
= transport_lba_32(cdb
);
390 cmd
->se_cmd_flags
|= SCF_FUA
;
391 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
392 cmd
->execute_cmd
= ops
->execute_rw
;
395 sectors
= transport_get_sectors_16(cdb
);
396 cmd
->t_task_lba
= transport_lba_64(cdb
);
398 cmd
->se_cmd_flags
|= SCF_FUA
;
399 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
400 cmd
->execute_cmd
= ops
->execute_rw
;
403 if (cmd
->data_direction
!= DMA_TO_DEVICE
||
404 !(cmd
->se_cmd_flags
& SCF_BIDI
))
405 return TCM_INVALID_CDB_FIELD
;
406 sectors
= transport_get_sectors_10(cdb
);
408 cmd
->t_task_lba
= transport_lba_32(cdb
);
409 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
412 * Setup BIDI XOR callback to be run after I/O completion.
414 cmd
->execute_cmd
= ops
->execute_rw
;
415 cmd
->transport_complete_callback
= &xdreadwrite_callback
;
417 cmd
->se_cmd_flags
|= SCF_FUA
;
419 case VARIABLE_LENGTH_CMD
:
421 u16 service_action
= get_unaligned_be16(&cdb
[8]);
422 switch (service_action
) {
424 sectors
= transport_get_sectors_32(cdb
);
427 * Use WRITE_32 and READ_32 opcodes for the emulated
428 * XDWRITE_READ_32 logic.
430 cmd
->t_task_lba
= transport_lba_64_ext(cdb
);
431 cmd
->se_cmd_flags
|= SCF_SCSI_DATA_CDB
;
434 * Setup BIDI XOR callback to be run during after I/O
437 cmd
->execute_cmd
= ops
->execute_rw
;
438 cmd
->transport_complete_callback
= &xdreadwrite_callback
;
440 cmd
->se_cmd_flags
|= SCF_FUA
;
443 sectors
= transport_get_sectors_32(cdb
);
445 pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not"
447 return TCM_INVALID_CDB_FIELD
;
450 size
= sbc_get_size(cmd
, 1);
451 cmd
->t_task_lba
= get_unaligned_be64(&cdb
[12]);
453 ret
= sbc_setup_write_same(cmd
, &cdb
[10], ops
);
458 pr_err("VARIABLE_LENGTH_CMD service action"
459 " 0x%04x not supported\n", service_action
);
460 return TCM_UNSUPPORTED_SCSI_OPCODE
;
466 cmd
->execute_cmd
= sbc_emulate_readcapacity
;
468 case SERVICE_ACTION_IN
:
469 switch (cmd
->t_task_cdb
[1] & 0x1f) {
470 case SAI_READ_CAPACITY_16
:
471 cmd
->execute_cmd
= sbc_emulate_readcapacity_16
;
474 pr_err("Unsupported SA: 0x%02x\n",
475 cmd
->t_task_cdb
[1] & 0x1f);
476 return TCM_INVALID_CDB_FIELD
;
478 size
= (cdb
[10] << 24) | (cdb
[11] << 16) |
479 (cdb
[12] << 8) | cdb
[13];
481 case SYNCHRONIZE_CACHE
:
482 case SYNCHRONIZE_CACHE_16
:
483 if (!ops
->execute_sync_cache
) {
485 cmd
->execute_cmd
= sbc_emulate_noop
;
490 * Extract LBA and range to be flushed for emulated SYNCHRONIZE_CACHE
492 if (cdb
[0] == SYNCHRONIZE_CACHE
) {
493 sectors
= transport_get_sectors_10(cdb
);
494 cmd
->t_task_lba
= transport_lba_32(cdb
);
496 sectors
= transport_get_sectors_16(cdb
);
497 cmd
->t_task_lba
= transport_lba_64(cdb
);
500 size
= sbc_get_size(cmd
, sectors
);
503 * Check to ensure that LBA + Range does not exceed past end of
504 * device for IBLOCK and FILEIO ->do_sync_cache() backend calls
506 if (cmd
->t_task_lba
|| sectors
) {
507 if (sbc_check_valid_sectors(cmd
) < 0)
508 return TCM_ADDRESS_OUT_OF_RANGE
;
510 cmd
->execute_cmd
= ops
->execute_sync_cache
;
513 if (!ops
->execute_unmap
)
514 return TCM_UNSUPPORTED_SCSI_OPCODE
;
516 size
= get_unaligned_be16(&cdb
[7]);
517 cmd
->execute_cmd
= ops
->execute_unmap
;
520 sectors
= transport_get_sectors_16(cdb
);
522 pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
523 return TCM_INVALID_CDB_FIELD
;
526 size
= sbc_get_size(cmd
, 1);
527 cmd
->t_task_lba
= get_unaligned_be64(&cdb
[2]);
529 ret
= sbc_setup_write_same(cmd
, &cdb
[1], ops
);
534 sectors
= transport_get_sectors_10(cdb
);
536 pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
537 return TCM_INVALID_CDB_FIELD
;
540 size
= sbc_get_size(cmd
, 1);
541 cmd
->t_task_lba
= get_unaligned_be32(&cdb
[2]);
544 * Follow sbcr26 with WRITE_SAME (10) and check for the existence
545 * of byte 1 bit 3 UNMAP instead of original reserved field
547 ret
= sbc_setup_write_same(cmd
, &cdb
[1], ops
);
553 cmd
->execute_cmd
= sbc_emulate_noop
;
559 * There are still clients out there which use these old SCSI-2
560 * commands. This mainly happens when running VMs with legacy
561 * guest systems, connected via SCSI command pass-through to
562 * iSCSI targets. Make them happy and return status GOOD.
565 cmd
->execute_cmd
= sbc_emulate_noop
;
568 ret
= spc_parse_cdb(cmd
, &size
);
573 /* reject any command that we don't have a handler for */
574 if (!(cmd
->se_cmd_flags
& SCF_SCSI_DATA_CDB
) && !cmd
->execute_cmd
)
575 return TCM_UNSUPPORTED_SCSI_OPCODE
;
577 if (cmd
->se_cmd_flags
& SCF_SCSI_DATA_CDB
) {
578 unsigned long long end_lba
;
580 if (sectors
> dev
->dev_attrib
.fabric_max_sectors
) {
581 printk_ratelimited(KERN_ERR
"SCSI OP %02xh with too"
582 " big sectors %u exceeds fabric_max_sectors:"
583 " %u\n", cdb
[0], sectors
,
584 dev
->dev_attrib
.fabric_max_sectors
);
585 return TCM_INVALID_CDB_FIELD
;
587 if (sectors
> dev
->dev_attrib
.hw_max_sectors
) {
588 printk_ratelimited(KERN_ERR
"SCSI OP %02xh with too"
589 " big sectors %u exceeds backend hw_max_sectors:"
590 " %u\n", cdb
[0], sectors
,
591 dev
->dev_attrib
.hw_max_sectors
);
592 return TCM_INVALID_CDB_FIELD
;
595 end_lba
= dev
->transport
->get_blocks(dev
) + 1;
596 if (cmd
->t_task_lba
+ sectors
> end_lba
) {
597 pr_err("cmd exceeds last lba %llu "
598 "(lba %llu, sectors %u)\n",
599 end_lba
, cmd
->t_task_lba
, sectors
);
600 return TCM_ADDRESS_OUT_OF_RANGE
;
603 size
= sbc_get_size(cmd
, sectors
);
606 return target_cmd_size_check(cmd
, size
);
608 EXPORT_SYMBOL(sbc_parse_cdb
);
610 u32
sbc_get_device_type(struct se_device
*dev
)
614 EXPORT_SYMBOL(sbc_get_device_type
);
617 sbc_execute_unmap(struct se_cmd
*cmd
,
618 sense_reason_t (*do_unmap_fn
)(struct se_cmd
*, void *,
622 struct se_device
*dev
= cmd
->se_dev
;
623 unsigned char *buf
, *ptr
= NULL
;
627 sense_reason_t ret
= 0;
630 /* We never set ANC_SUP */
631 if (cmd
->t_task_cdb
[1])
632 return TCM_INVALID_CDB_FIELD
;
634 if (cmd
->data_length
== 0) {
635 target_complete_cmd(cmd
, SAM_STAT_GOOD
);
639 if (cmd
->data_length
< 8) {
640 pr_warn("UNMAP parameter list length %u too small\n",
642 return TCM_PARAMETER_LIST_LENGTH_ERROR
;
645 buf
= transport_kmap_data_sg(cmd
);
647 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE
;
649 dl
= get_unaligned_be16(&buf
[0]);
650 bd_dl
= get_unaligned_be16(&buf
[2]);
652 size
= cmd
->data_length
- 8;
654 pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
655 cmd
->data_length
, bd_dl
);
659 if (size
/ 16 > dev
->dev_attrib
.max_unmap_block_desc_count
) {
660 ret
= TCM_INVALID_PARAMETER_LIST
;
664 /* First UNMAP block descriptor starts at 8 byte offset */
666 pr_debug("UNMAP: Sub: %s Using dl: %u bd_dl: %u size: %u"
667 " ptr: %p\n", dev
->transport
->name
, dl
, bd_dl
, size
, ptr
);
670 lba
= get_unaligned_be64(&ptr
[0]);
671 range
= get_unaligned_be32(&ptr
[8]);
672 pr_debug("UNMAP: Using lba: %llu and range: %u\n",
673 (unsigned long long)lba
, range
);
675 if (range
> dev
->dev_attrib
.max_unmap_lba_count
) {
676 ret
= TCM_INVALID_PARAMETER_LIST
;
680 if (lba
+ range
> dev
->transport
->get_blocks(dev
) + 1) {
681 ret
= TCM_ADDRESS_OUT_OF_RANGE
;
685 ret
= do_unmap_fn(cmd
, priv
, lba
, range
);
694 transport_kunmap_data_sg(cmd
);
696 target_complete_cmd(cmd
, GOOD
);
699 EXPORT_SYMBOL(sbc_execute_unmap
);