fix alloc len vs buffer len checks and safeguard memcpy in spc_pr_read_reservation()

SPC-3, 6.13.3.2, alloc len must be at least 8 bytes,
when no reservation is held, additional len field should be 0, total data-in len is 8;
when there is reservation, additional len should be 16, total buffer len is 24.

make sure that setting fields in data-in buffer don't pass its boundary.

Signed-off-by: Alexander Nezhinsky <nezhinsky@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
set Type Mask Valid (TMV) in response for PERSISTENT_RESERVE_IN's REPORT_CAPABILITIES service action

Signed-off-by: Alexander Nezhinsky <nezhinsky@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
fix length checks in check_pr_out_basic_parameter()

SPC-3, Table 170, "PERSISTENT RESERVE OUT command" defines PARAMETER LIST LENGTH
as spanning from byte 5 (MSB) to byte 8 (LSB). Need to extract BE 32bit value
starting at 5th byte, and not 16bit value starting at 7 byte.

SPC-3, 6.14.1 states:
"the PARAMETER LIST LENGTH field shall contain 24 (18h), if the
 following conditions are true:
 a) The SPEC_I_PT bit (see 6.14.3) is set to zero; and
 b) The service action is not REGISTER AND MOVE."
As check_pr_out_basic_parameter() covers exactly the above case, we should
stipulate parameter list length to be exactly 24 bytes and data transfer length
to be at least 24 bytes.

Signed-off-by: Alexander Nezhinsky <nezhinsky@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
fix field length checks in spc_pr_register_and_move()

REGISTER_AND_MOVE defines (SPC-3, 6.14.4) an extended (not basic) data-out format.
- It must be at least 24 bytes long, possibly extended by the Transport ID parameter.
- Transport parameter data length should be at least 24, and if greater, a multiple of 4.
- Expected data transfer length must be at least the declared parameter list length
  (this is a WR cmd, so the entire data must be transferred by the initiator).
- Parameter list length must account correctly for the transport parameter
  data length, so that no truncation occurs.

Except correcting the above checks enforcement, transport id comparison is fixed.
It was done using strncmp(), which is incorrect here, as transport id format
starts with a few binary fields potentially containing zeros which would terminate
string comparison prematurely.
memcmp() is used instead of strncmp(), and the reported id length is used instead
of the value returned by strlen().

Signed-off-by: Alexander Nezhinsky <nezhinsky@gmail.com>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>